* OH1 walk-oracle capture: WALK (2026-09-02). Adds the cell-shell/object-cell
* stamp events (EC/OC) to the exact proven FW0 F/P/LS/BLD/DI/DC per-frame
* shape. Frame count default 5 (substitute <FRAMES> via
* oh-run-capture.ps1 -Frames, or by hand).
*
* AUTO-DETACH: this file deliberately does NOT reuse FW0's own
* ".if (@$t0 >= 0nN) { qd } .else { gc }" shape -- that puts `qd` inside a
* CONDITIONAL bp action, which the project's own retail-debugger toolchain
* memory documents as NEVER FIRING (qd/q/qq inside a bp action is silently
* ignored; re-confirmed the hard way on issue #177, see
* claude-memory/project_retail_debugger.md). Instead this uses the proven
* tools/cdb/pview-spiral2.cdb recipe: the frame-marker bp's action calls
* `gc` while below threshold and simply omits `gc` on the terminal hit (so
* the action "falls through" and the whole process genuinely stops); control
* then returns to the script's single top-level `g`, and a TOP-LEVEL `qd`
* (not inside any bp action) detaches cleanly. Every other bp in this file
* always `gc`s unconditionally -- only the frame marker decides when to
* stop, exactly like every other capture script in this directory.
*
* LINE FORMATS:
*   F <n>                                  -- unchanged from FW0
*   P <cellid> <ox> <oy> <oz> <qw> <qx> <qy> <qz>  -- unchanged from FW0
*   LS                                     -- unchanged from FW0
*   BLD <cellid>                           -- unchanged from FW0
*   DI <cellid>                            -- unchanged from FW0
*   DC pv=<PView*> ov=<n> n=<n>: <ids...>  -- unchanged from FW0
*   EC <cellid>                            -- NEW. RenderDeviceD3D::DrawEnvCell
*                                              @0x0059F170 entry; id is the
*                                              CEnvCell's m_DID (arg2+0x28).
*   OC <cellid>                            -- NEW. RenderDeviceD3D::
*                                              DrawObjCellForDummies
*                                              @0x005A0760 entry; id is the
*                                              CObjCell's m_DID (arg2+0x28).
* EC/OC together let a human line up "which cell shells/object lists did
* PView::DrawCells' reverse loops (steps 9-10 in oh1-depth-lifecycle.md)
* actually stamp-draw this frame" against the DC line's flood-cell roster.
*
* OFFSETS (VERIFY-IN-RECON -- see oh-recon.cdb, all in this file's dt list):
*   CEnvCell+0x28 / CObjCell+0x28 = m_DID   -- PROVEN, not a guess: this is
*     the exact offset the existing FW0 DI/DC/BLD lines already read in
*     production captures (docs/research/2026-08-30-fw-walk-oracle/*.log),
*     and CEnvCell : CObjCell (acclient.h:32072) shares the base-class
*     layout, so DrawObjCellForDummies's CObjCell* argument reads the same
*     way. Still listed in oh-recon.cdb's dt for a fresh re-confirmation.
*   RenderDeviceD3D::DrawEnvCell(this@ecx, CEnvCell* arg2)   -- arg2 @ esp+4.
*     Signature: acclient_2013_pseudo_c.txt:427885. Same "this@ecx, one
*     stack arg" shape as the already-proven DrawBuilding/DrawInside hooks.
*   RenderDeviceD3D::DrawObjCellForDummies(this, CObjCell* arg2) -- plain
*     __thiscall, arg2 @ esp+4. Signature: acclient_2013_pseudo_c.txt:429177.
*
* BEFORE USE: replace <FRAMES> (plain decimal digits, e.g. "5" -- the
* template already supplies the "0n" decimal-radix prefix) and <LOG>
* (output path). oh-run-capture.ps1 -Frames does this substitution.
* <VPOS> is pre-resolved to Render::viewer_pos @0x0081ef00 (the address the
* FW0 posed captures already used successfully -- see
* claude-memory/project_frame_walk_campaign.md 2026-08-30 evening entry and
* tools/walk-oracle/fw0-capture-pose.cdb.template's own <VPOS> note). Re-run
* `x acclient!*viewer_pos*` in oh-recon.cdb if this session's binary differs.

.logopen <LOG>
.sympath C:\Users\erikn\source\repos\acdream\refs
.symopt+ 0x40
.reload /f acclient.exe
r $t0 = 0
bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0081ef00+4), poi(0081ef00+0x3c), poi(0081ef00+0x40), poi(0081ef00+0x44), poi(0081ef00+8), poi(0081ef00+0xc), poi(0081ef00+0x10), poi(0081ef00+0x14); .if (@$t0 < 0n<FRAMES>) { gc }"
bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc"
bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc"
bp 00506330 ".printf \"LS\\n\"; gc"
bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc"
bp 0059f170 ".printf \"EC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
bp 005a0760 ".printf \"OC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
bp 0059f120 ".printf \"LC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
bp 0059f140 ".printf \"SC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
g
.echo ===DETACHING===
qd
.logclose