#include "90CN_companion_p0.h"
#include "90CN_companion_projection.h"
#include "90CN_companion_quickbar_policy.h"
#include "90CN_companion_native_bindings.h"

#include <windows.h>
#include <cstdint>
#include <cstddef>
#include <cstdio>
#include <cstring>
#include <cstdarg>
#include <cwchar>
#include <deque>
#include <vector>
#include <utility>
#include <intrin.h>

// Defined in 90CN.cpp.  Kept at global scope so the declaration has external
// linkage (the anonymous namespace below would give it internal linkage).
// Local copy of the prologue-checked inline hook installer.
// (90CN.cpp's helper has internal linkage in this build, so duplicate the small
// trampoline routine here instead of exposing it across translation units.)

// The naked detour below references this by its plain C name.
extern "C" void* g_companionEquipmentTrampoline = nullptr;

namespace dnf90_companion_p0 {
namespace {

CompanionNativeBindings g_native;
bool g_newNativeHooksReady = false;

// Read-only stat probe state.  g_lastCompanionStatBlob is the exact 92-byte
// value set the client was told to use for the current companion actor; the
// probe scans the actor window for those values to locate the stat fields
// without hardcoding any build-specific offset.
alignas(4) unsigned char g_lastCompanionStatBlob[92] = {};
bool g_hasLastCompanionStatBlob = false;
void* g_companionStatProbedActor = nullptr;

constexpr int kDungeonSceneMode = 3;
constexpr unsigned char kNativeSummonApcSignature[] = {
    0x55, 0x8B, 0xEC, 0x81, 0xEC, 0x80, 0x00, 0x00,
    0x00, 0x56, 0x8B, 0x75, 0x08, 0x85, 0xF6, 0x0F,
};
constexpr unsigned char kNativeReadySignature[] = {
    0x56, 0x8B, 0xF1, 0xE8, 0xD8, 0x54, 0x39, 0x00,
    0x85, 0xC0, 0x74, 0x14, 0xE8, 0xCF, 0x54, 0x39,
};
constexpr unsigned char kSceneContextGetterSignature[] = {
    0xE9, 0x4B, 0xA4, 0x56, 0x00
};
constexpr unsigned char kSceneModeSignature[] = {
    0x55, 0x8B, 0xEC, 0x83, 0xEC, 0x08
};

using NativeSummonApcFn = void (__thiscall*)(
    void* ignoredThis,
    void* actor,
    const FixedApcDescriptor* descriptor);
using NativeReadyFn = unsigned char (__thiscall*)(void* actor);
using SceneContextGetterFn = void* (__cdecl*)();
using SceneModeFn = int (__thiscall*)(void* sceneContext);
using PayloadEncodeFn = void (__cdecl*)(
    unsigned char* payload,
    std::int32_t length,
    void* keyState);
using InternalReceiveFn = void (__thiscall*)(
    void* self,
    std::int32_t sourceSlot,
    unsigned char* packet,
    std::int32_t totalLength);
using NetworkRouterFn = int (__thiscall*)(
    void* self,
    std::int32_t sourceContext,
    unsigned char* packet,
    std::int32_t totalLength);
using PeerDeliveryFn = void (__thiscall*)(
    void* self,
    unsigned char* packet,
    std::int32_t length,
    std::int32_t slot,
    std::uint32_t routeKind,
    std::uint32_t mode);

using AicCopyFn = void* (__thiscall*)(
    void* destination,
    const void* source);
using NativeRefStringAllocFn = void* (__cdecl*)(std::size_t bytes);
using NativeRefStringFreeFn = void (__cdecl*)(void* header);
using NativeRefStringRefFn = long (__stdcall*)(void* header);
using NativeVectorFreeFn = void (__cdecl*)(void* data);
using NativeVectorAllocateFn = unsigned char (__thiscall*)(
    void* vectorObject,
    std::uint32_t elementCount);

using ApcRegistrationFn = unsigned char (__thiscall*)(
    void* self,
    void* ownerActor,
    std::uint32_t flags,
    std::uint32_t objectKey,
    void* actor,
    std::uint32_t value5,
    std::uint32_t value6,
    std::uint32_t value7,
    std::uint32_t value8);
using Class0ProjectionDispatchFn = int (__stdcall*)(
    int dispatcherArg,
    int packet);

thread_local FixedApcRetryPolicy g_retry;
thread_local void* g_armedActor = nullptr;
thread_local DWORD g_armedThread = 0;
thread_local unsigned int g_waitLogCount = 0;
thread_local bool g_directLoopbackArmed = false;
thread_local bool g_directLoopbackInReceive = false;
thread_local bool g_directLoopbackHandled = false;
thread_local bool g_directLoopbackFailed = false;
thread_local unsigned int g_suppressedPeerDeliveries = 0;
PayloadEncodeFn g_originalPayloadEncode = nullptr;
PeerDeliveryFn g_originalPeerDelivery = nullptr;
NetworkRouterFn g_originalNetworkRouter = nullptr;

AicCopyFn g_originalAicCopy = nullptr;
ApcRegistrationFn g_originalApcRegistration = nullptr;
using AIConditionFn = unsigned char (__thiscall*)(void*);
using AIParameterFn = float* (__thiscall*)(void*, const int*);
using KeyStepReadyFn = unsigned char (__thiscall*)(void*, int);
AIConditionFn g_originalAICondition = nullptr;
Class0ProjectionDispatchFn g_projectionClass0Dispatch = nullptr;
constexpr std::size_t kProjectionPacketCapacity =
    dnf90_companion_projection::kPacketHeaderSize +
    dnf90_companion_projection::kBodyHeaderSize +
    dnf90_companion_projection::kMaxDynamicAicBytes +
    2 * dnf90_companion_projection::kMaxProjectionBody;
constexpr std::size_t kProjectionNativePacketCapacity =
    dnf90_companion_projection::kPacketHeaderSize +
    dnf90_companion_projection::kMaxProjectionBody;
thread_local std::uint16_t g_projectionApcObjectKey = 0;
thread_local void* g_projectionApcActor = nullptr;
thread_local unsigned char g_projectionPacket[kProjectionPacketCapacity] = {};
thread_local std::size_t g_projectionPacketLength = 0;
thread_local int g_projectionDispatcherArg = 0;
thread_local bool g_projectionPending = false;
thread_local bool g_projectionApplyActive = false;
thread_local bool g_projectionAicApplied = false;
thread_local bool g_projectionMode1Failed = false;
thread_local unsigned int g_projectionMode0RetryCount = 0;
thread_local unsigned char g_projectionMode0Packet[kProjectionNativePacketCapacity] = {};


thread_local unsigned char g_projectionMode1Packet[kProjectionNativePacketCapacity] = {};
constexpr unsigned int kProjectionMode0RetryLimit = 3;
constexpr std::size_t kProjectionQueueMaxEntries = 8;
constexpr std::size_t kProjectionQueueMaxBytes = 512 * 1024;

// __except filters are the only place GetExceptionInformation may be read, so
// the crash site is copied out there and reported by the handler.
// Runtime counters: they make it possible to tell "hook never called" apart
// from "hook called but nothing selected" on a machine that misbehaves.
volatile LONG g_conditionEvaluations = 0;
volatile LONG g_supportSelections = 0;

std::uintptr_t g_lastProjectionExceptionAddress = 0;
std::uintptr_t g_lastProjectionFaultAddress = 0;
// Return addresses captured from the faulting EBP chain. Printed as module
// RVAs so a crash inside the native dispatcher can be located without an
// external debugger.
std::uintptr_t g_lastProjectionStack[8] = {};
int g_lastProjectionStackCount = 0;
int CaptureProjectionException(PEXCEPTION_POINTERS info)
{
    if (info && info->ExceptionRecord) {
        g_lastProjectionExceptionAddress =
            reinterpret_cast<std::uintptr_t>(info->ExceptionRecord->ExceptionAddress);
        if (info->ExceptionRecord->NumberParameters > 1) {
            g_lastProjectionFaultAddress = static_cast<std::uintptr_t>(
                info->ExceptionRecord->ExceptionInformation[1]);
        }
    }
    g_lastProjectionStackCount = 0;
    if (info && info->ContextRecord) {
        std::uintptr_t frame = info->ContextRecord->Ebp;
        for (int depth = 0; depth < 8 && frame; ++depth) {
            __try {
                const std::uintptr_t next = *reinterpret_cast<std::uintptr_t*>(frame);
                const std::uintptr_t ret = *reinterpret_cast<std::uintptr_t*>(frame + 4);
                if (!ret) break;
                g_lastProjectionStack[g_lastProjectionStackCount++] = ret;
                if (next <= frame) break;
                frame = next;
            } __except (EXCEPTION_EXECUTE_HANDLER) {
                break;
            }
        }
    }
    return EXCEPTION_EXECUTE_HANDLER;
}

struct QueuedProjection {
    std::vector<unsigned char> packet;
    int dispatcherArg = 0;
};
thread_local std::deque<QueuedProjection> g_projectionQueue;
thread_local std::size_t g_projectionQueueBytes = 0;
thread_local std::size_t g_projectionQueueHighWater = 0;
thread_local unsigned int g_projectionQueueDropCount = 0;

void Log(const char* format, ...);

// ── Companion equipment-instance experiment ───────────────────────────────
// The private 0x7F41 mode1 body already carries the source character's real
// equipment create rows (item id + instance/quality/sockets/forging), but the
// native userinfo dispatcher faults on APC actors, so the patch currently
// applies only the 92-byte stat blob.  This block replays the native equipment
// row reader (sub_1D77560 / RVA 0x01977560) against the APC actor, gated by an
// explicit environment flag.  The probe hook is read-only; the apply path
// changes only the opt-in run.
//
//   DNF90_COMPANION_EQUIP_PROBE=1   install the logging detour
//   DNF90_COMPANION_EQUIP_APPLY=1   also replay the mode1 equipment rows
struct ProjectionNativeReaderState {
    unsigned char* cursor;
    int remaining;
    unsigned char* packet;
    int packetLength;
};
static_assert(sizeof(ProjectionNativeReaderState) == 16, "native x86 reader ABI");

constexpr uintptr_t kEquipmentApplyRva = 0x01977560;
using EquipmentApplyFn = int (__cdecl*)(void* actor, int mode, int arg3, int arg4);

EquipmentApplyFn g_equipmentApplyOriginal = nullptr;
volatile LONG g_equipmentProbeCalls = 0;
bool g_equipmentProbeInstalled = false;

bool CompanionEquipmentEnvFlag(const char* name) {
    char value[8] = {};
    DWORD length = GetEnvironmentVariableA(name, value, sizeof(value));
    return length > 0 && value[0] == '1';
}

bool CompanionFlagFilePresent(const wchar_t* name) {
    wchar_t path[MAX_PATH] = {};
    const DWORD length = GetModuleFileNameW(nullptr, path, _MAX_PATH);
    if (!length || length >= _MAX_PATH || !name) return false;
    wchar_t* slash = wcsrchr(path, L'\\');
    if (!slash) return false;
    if (wcscpy_s(slash + 1, _MAX_PATH - (slash + 1 - path), name) != 0) {
        return false;
    }
    const DWORD attributes = GetFileAttributesW(path);
    return attributes != INVALID_FILE_ATTRIBUTES &&
        (attributes & FILE_ATTRIBUTE_DIRECTORY) == 0;
}

bool CompanionEquipmentProbeEnabled() {
    static const bool enabled =
        CompanionEquipmentEnvFlag("DNF90_COMPANION_EQUIP_PROBE") ||
        CompanionFlagFilePresent(L"90CN_equip_probe.enabled");
    return enabled;
}

// 支援兵普攻开关：启动器在客户端目录放置 90CN_basic_attack.disabled。
// 只影响 CompanionBasicAttack 回退程序，12 格技能程序不变。
bool CompanionBasicAttackEnabled() {
    static const bool disabled =
        CompanionFlagFilePresent(L"90CN_basic_attack.disabled");
    return !disabled;
}

bool CompanionEquipmentApplyEnabled() {
    // Production default: the mode1 equipment rows are replayed for every
    // companion APC.  A disable flag exists for a one-restart rollback.
    static const bool disabled =
        CompanionEquipmentEnvFlag("DNF90_COMPANION_EQUIP_APPLY_DISABLE") ||
        CompanionFlagFilePresent(L"90CN_equip_apply.disabled");
    return !disabled;
}

bool CompanionEquipmentVerifyEnabled() {
    static const bool enabled =
        CompanionEquipmentEnvFlag("DNF90_COMPANION_EQUIP_VERIFY") ||
        CompanionFlagFilePresent(L"90CN_equip_verify.enabled");
    return enabled;
}

bool CompanionModuleContains(const void* pointer) {
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    if (!base || !pointer) return false;
    __try {
        const auto* dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
        if (dos->e_magic != IMAGE_DOS_SIGNATURE || dos->e_lfanew <= 0) {
            return false;
        }
        const auto* nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(
            base + dos->e_lfanew);
        if (nt->Signature != IMAGE_NT_SIGNATURE) return false;
        const uintptr_t value = reinterpret_cast<uintptr_t>(pointer);
        return value >= base && value < base + nt->OptionalHeader.SizeOfImage;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

extern "C" void __cdecl CompanionEquipmentProbeLog(
    unsigned actor, unsigned a2, unsigned a3, unsigned a4, unsigned ret)
{
    if (!CompanionEquipmentProbeEnabled()) return;
    const LONG calls = InterlockedIncrement(&g_equipmentProbeCalls);
    if (calls > 24) return;
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    auto* reader = reinterpret_cast<ProjectionNativeReaderState*>(
        base + g_native.kProjectionReaderStateRva);
    const unsigned char* cursor = reader ? reader->cursor : nullptr;
    unsigned vtable = 0;
    unsigned getter = 0;
    __try {
        if (actor) {
            vtable = *reinterpret_cast<const unsigned*>(actor);
            if (vtable) {
                getter = *reinterpret_cast<const unsigned*>(vtable + 0xCF4);
            }
        }
    } __except (EXCEPTION_EXECUTE_HANDLER) {
    }
    Log("equipment-probe call=%ld actor=%08X a2=%u a3=%u a4=%u ret=%08X vtable=%08X getter=%08X cursor=%p remaining=%d bytes=%02X %02X %02X %02X",
        calls, actor, a2, a3, a4, ret, vtable, getter,
        cursor, reader ? reader->remaining : -1,
        cursor ? cursor[0] : 0, cursor ? cursor[1] : 0,
        cursor ? cursor[2] : 0, cursor ? cursor[3] : 0);
}

extern "C" void __declspec(naked) CompanionEquipmentProbeDetour()
{
    __asm {
        push ebp
        mov ebp, esp
        pushad
        pushfd
        push dword ptr [ebp + 4]
        push dword ptr [ebp + 0x14]
        push dword ptr [ebp + 0x10]
        push dword ptr [ebp + 0x0C]
        push dword ptr [ebp + 0x08]
        call CompanionEquipmentProbeLog
        add esp, 20
        popfd
        popad
        pop ebp
        jmp dword ptr [g_companionEquipmentTrampoline]
    }
}

bool InstallCompanionInlineHook(uintptr_t target, const unsigned char* expected,
    size_t patchLength, void* detour, void** original, const char* label)
{
    if (!target || !expected || patchLength < 5 || !detour || !original) {
        return false;
    }
    if (memcmp(reinterpret_cast<const void*>(target), expected, patchLength) != 0) {
        Log("%s prologue mismatch at 0x%08X", label, target);
        return false;
    }
    unsigned char* trampoline = static_cast<unsigned char*>(VirtualAlloc(
        nullptr, patchLength + 5, MEM_COMMIT | MEM_RESERVE,
        PAGE_EXECUTE_READWRITE));
    if (!trampoline) {
        Log("%s trampoline allocation failed: %u", label, GetLastError());
        return false;
    }
    memcpy(trampoline, reinterpret_cast<void*>(target), patchLength);
    trampoline[patchLength] = 0xE9;
    *reinterpret_cast<int32_t*>(trampoline + patchLength + 1) =
        static_cast<int32_t>(
            static_cast<intptr_t>(target + patchLength) -
            reinterpret_cast<intptr_t>(trampoline + patchLength + 5));

    DWORD oldProtection = 0;
    if (!VirtualProtect(reinterpret_cast<void*>(target), patchLength,
            PAGE_EXECUTE_READWRITE, &oldProtection)) {
        Log("%s VirtualProtect failed: %u", label, GetLastError());
        VirtualFree(trampoline, 0, MEM_RELEASE);
        return false;
    }
    unsigned char jump[5] = {0xE9};
    *reinterpret_cast<int32_t*>(jump + 1) = static_cast<int32_t>(
        reinterpret_cast<intptr_t>(detour) -
        static_cast<intptr_t>(target + 5));
    memcpy(reinterpret_cast<void*>(target), jump, sizeof(jump));
    for (size_t i = sizeof(jump); i < patchLength; ++i) {
        *reinterpret_cast<unsigned char*>(target + i) = 0x90;
    }
    DWORD ignoredProtection = 0;
    VirtualProtect(reinterpret_cast<void*>(target), patchLength,
        oldProtection, &ignoredProtection);
    FlushInstructionCache(GetCurrentProcess(),
        reinterpret_cast<void*>(target), patchLength);
    FlushInstructionCache(GetCurrentProcess(), trampoline, patchLength + 5);
    *original = trampoline;
    Log("%s installed target=0x%08X trampoline=%p", label, target, trampoline);
    return true;
}

bool InstallCompanionEquipmentProbe() {
    Log("equipment-hook flags probe=%u apply=%u installed=%u",
        CompanionEquipmentProbeEnabled() ? 1u : 0u,
        CompanionEquipmentApplyEnabled() ? 1u : 0u,
        g_equipmentProbeInstalled ? 1u : 0u);
    if (g_equipmentProbeInstalled) {
        return g_equipmentApplyOriginal != nullptr;
    }
    if (!CompanionEquipmentProbeEnabled() &&
        !CompanionEquipmentApplyEnabled()) {
        return false;
    }
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    const uintptr_t target = base + kEquipmentApplyRva;
    static const unsigned char expected[] = {0x55, 0x8B, 0xEC, 0x6A, 0xFF};
    void* trampoline = nullptr;
    if (!InstallCompanionInlineHook(target, expected, sizeof(expected),
            reinterpret_cast<void*>(&CompanionEquipmentProbeDetour),
            &trampoline, "companion-equipment-probe")) {
        Log("equipment-probe hook install failed target=0x%08X", target);
        return false;
    }
    g_companionEquipmentTrampoline = trampoline;
    g_equipmentApplyOriginal = reinterpret_cast<EquipmentApplyFn>(trampoline);
    g_equipmentProbeInstalled = true;
    Log("equipment-probe hook installed target=0x%08X trampoline=%p probe=%u apply=%u",
        target, trampoline, CompanionEquipmentProbeEnabled() ? 1u : 0u,
        CompanionEquipmentApplyEnabled() ? 1u : 0u);
    return true;
}

void LogCompanionEquipmentVerify(
    const char* phase, void* actor, void* info, void* aic)
{
    if (!CompanionEquipmentVerifyEnabled()) return;
    unsigned aicRows = 0;
    const unsigned weaponID = 101010856u;
    unsigned weaponRow[3] = {};
    if (aic) {
        auto* begin = *reinterpret_cast<unsigned char**>(
            reinterpret_cast<unsigned char*>(aic) +
            g_native.kAicEquipmentVectorOffset);
        auto* end = *reinterpret_cast<unsigned char**>(
            reinterpret_cast<unsigned char*>(aic) +
            g_native.kAicEquipmentVectorOffset + 4);
        if (begin && end >= begin && ((end - begin) % 12) == 0) {
            aicRows = static_cast<unsigned>((end - begin) / 12);
            for (unsigned i = 0; i < aicRows; ++i) {
                auto* row = reinterpret_cast<unsigned*>(begin + i * 12);
                if (row[0] == weaponID) {
                    weaponRow[0] = row[0];
                    weaponRow[1] = row[1];
                    weaponRow[2] = row[2];
                }
            }
        }
    }
    int qualityHits = 0;
    int weaponHits = 0;
    int qualityOff = -1;
    int weaponOff = -1;
    const unsigned quality = 999999998u;
    if (info) {
        __try {
            auto* p = reinterpret_cast<unsigned char*>(info);
            for (int off = 0; off + 4 <= 0x4000; off += 4) {
                const unsigned value = *reinterpret_cast<unsigned*>(p + off);
                if (value == quality) {
                    ++qualityHits;
                    if (qualityOff < 0) qualityOff = off;
                }
                if (value == weaponID) {
                    ++weaponHits;
                    if (weaponOff < 0) weaponOff = off;
                }
            }
        } __except (EXCEPTION_EXECUTE_HANDLER) {
        }
    }
    Log("equipment-verify phase=%s actor=%p info=%p aic=%p aic_rows=%u aic_weapon=%u/%u/%u quality_hits=%d@%d weapon_hits=%d@%d",
        phase, actor, info, aic, aicRows,
        weaponRow[0], weaponRow[1], weaponRow[2],
        qualityHits, qualityOff, weaponHits, weaponOff);
}

bool TryApplyCompanionEquipment(
    void* actor,
    unsigned char* mode1Packet,
    std::size_t mode1PacketLength,
    unsigned char* mode1,
    std::size_t mode1Length,
    void* aic)
{
    if (mode1 && mode1Length >= 125 && CompanionEquipmentProbeEnabled()) {
        Log("equipment-rows source body=%zu count=%u",
            mode1Length, static_cast<unsigned>(mode1[124]));
    }
    if (!CompanionEquipmentApplyEnabled() || !g_equipmentApplyOriginal ||
        !actor || !mode1Packet || !mode1) {
        return false;
    }
    if (mode1Length < 125 || mode1PacketLength < 16 + mode1Length) {
        return false;
    }
    const unsigned count = mode1[124];
    if (count == 0 || count > 32) {
        Log("equipment-apply skipped rows=%u body=%zu", count, mode1Length);
        return false;
    }
    auto** table = *reinterpret_cast<void***>(actor);
    if (!table) return false;
    const void* getter = table[0xCF4 / 4];
    if (!CompanionModuleContains(getter)) {
        Log("equipment-apply skipped: actor userinfo getter=%p outside module",
            getter);
        return false;
    }
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    void* info = nullptr;
    using UserInfoFn = void* (__thiscall*)(void*);
    __try {
        info = reinterpret_cast<UserInfoFn>(
            const_cast<void*>(getter))(actor);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        info = nullptr;
    }
    LogCompanionEquipmentVerify("before", actor, info, aic);
    auto* reader = reinterpret_cast<ProjectionNativeReaderState*>(
        base + g_native.kProjectionReaderStateRva);
    const ProjectionNativeReaderState saved = *reader;
    int result = -1;
    unsigned long code = 0;
    __try {
        reader->cursor = mode1 + 124;
        reader->remaining = static_cast<int>(mode1Length - 124);
        reader->packet = mode1Packet;
        reader->packetLength = static_cast<int>(mode1PacketLength);
        result = g_equipmentApplyOriginal(actor, 1, 0, 0);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        code = GetExceptionCode();
    }
    *reader = saved;
    LogCompanionEquipmentVerify("after", actor, info, aic);
    Log("equipment-apply actor=%p rows=%u body=%zu result=%d exception=0x%08X",
        actor, count, mode1Length, result, code);
    return code == 0;
}

// Registration, not combat packets, owns the source -> APC identity. Entries
// are discarded on the accepted town boundary / a new dungeon arm.
struct LiveProjectionActor {
    std::uint16_t source = 0, key = 0, level = 0;
    std::uint64_t revision = 0;
    void* actor = nullptr;
    void* owner = nullptr;
    void* aic = nullptr;
    std::uint32_t skills[512] = {};
    std::uint32_t quick[12] = {};
    std::uint8_t aiBehavior = 0;
    std::uint8_t aiComboPresetHash = 0;
    std::uint16_t aiClass = 0;
    bool aiComboEnabled = false;
    bool keysReady = false;
    std::uint8_t job = 0, grow = 0;
    void* aiVm = nullptr;
    void* buffCondition = nullptr;
    void* buffCooldown = nullptr;
    void* healCondition = nullptr;
    void* actionStateCondition = nullptr;
    float* buffSkillParameter = nullptr;
    float* buffSlotParameter = nullptr;
    float* healThresholdParameter = nullptr;
    void* modeConditions[8] = {};
    std::size_t modeConditionCount = 0;
    void* areaCooldowns[128] = {};
    std::size_t areaCooldownCount = 0;
    bool supportActionPending = true;
    int selfHpPercent = -1;
    std::uint32_t observedClock = 0, selfHurtAt = 0;
    bool selfHurtRecorded = false, recentlyHurt = false;
    bool quickbarPolicyReady = false;
    unsigned int lastChosenSkill = 0;
};
thread_local std::vector<LiveProjectionActor> g_liveProjectionActors;
thread_local bool g_quickbarSelectionActive = false;

void ResetCurrentProjectionActorState() {
    g_projectionApcObjectKey = 0;
    g_projectionApcActor = nullptr;
    g_projectionApplyActive = false;
    g_projectionAicApplied = false;
    g_projectionMode1Failed = false;
    g_projectionMode0RetryCount = 0;
}

void ClearCurrentProjectionPacket() {
    ResetCurrentProjectionActorState();
    g_projectionPacketLength = 0;
    g_projectionDispatcherArg = 0;
    g_projectionPending = false;
}

void ClearQueuedProjections(const char* reason) {
    if (!g_projectionQueue.empty()) {
    Log("projection queue cleared reason=%s entries=%zu bytes=%zu high_water=%zu drops=%u",
            reason ? reason : "unspecified", g_projectionQueue.size(),
            g_projectionQueueBytes, g_projectionQueueHighWater,
            g_projectionQueueDropCount);
    }
    g_projectionQueue.clear();
    g_projectionQueueBytes = 0;
}

bool LoadCurrentProjectionPacket(
    const unsigned char* bytes,
    std::size_t packetLength,
    int dispatcherArg)
{
    if (!bytes || packetLength == 0 ||
        packetLength > sizeof(g_projectionPacket)) {
        return false;
    }
    ResetCurrentProjectionActorState();
    memcpy(g_projectionPacket, bytes, packetLength);
    g_projectionPacketLength = packetLength;
    g_projectionDispatcherArg = dispatcherArg;
    g_projectionPending = true;
    return true;
}

bool LoadNextQueuedProjection() {
    if (g_projectionQueue.empty()) {
        ClearCurrentProjectionPacket();
        return false;
    }
    QueuedProjection next = std::move(g_projectionQueue.front());
    g_projectionQueueBytes -= next.packet.size();
    g_projectionQueue.pop_front();
    return LoadCurrentProjectionPacket(
        next.packet.data(), next.packet.size(), next.dispatcherArg);
}

void QueueProjectionPacket(
    const unsigned char* bytes,
    std::size_t packetLength,
    int dispatcherArg)
{
    if (!bytes || packetLength == 0 || packetLength > kProjectionQueueMaxBytes) {
        ++g_projectionQueueDropCount;
        Log("projection queue drop reason=packet-too-large length=%zu drops=%u",
            packetLength, g_projectionQueueDropCount);
        return;
    }

    dnf90_companion_projection::View incoming{};
    const bool decoded = dnf90_companion_projection::DecodePacket(
        bytes, packetLength, &incoming);
    if (decoded) {
        for (auto& existing : g_projectionQueue) {
            dnf90_companion_projection::View queuedView{};
            if (!dnf90_companion_projection::DecodePacket(
                    existing.packet.data(), existing.packet.size(), &queuedView) ||
                queuedView.sourceCharacter != incoming.sourceCharacter ||
                queuedView.revision != incoming.revision) {
                continue;
            }
            g_projectionQueueBytes -= existing.packet.size();
            std::vector<unsigned char> replacement(bytes, bytes + packetLength);
            existing.packet.swap(replacement);
            existing.dispatcherArg = dispatcherArg;
            g_projectionQueueBytes += existing.packet.size();
            Log("projection queue coalesced source=%u revision=%llu depth=%zu bytes=%zu",
                static_cast<unsigned int>(incoming.sourceCharacter),
                static_cast<unsigned long long>(incoming.revision),
                g_projectionQueue.size(), g_projectionQueueBytes);
            return;
        }
    }

    while (g_projectionQueue.size() >= kProjectionQueueMaxEntries ||
           g_projectionQueueBytes + packetLength > kProjectionQueueMaxBytes) {
        if (g_projectionQueue.empty()) break;
        g_projectionQueueBytes -= g_projectionQueue.front().packet.size();
        g_projectionQueue.pop_front();
        ++g_projectionQueueDropCount;
    }
    if (g_projectionQueue.size() >= kProjectionQueueMaxEntries ||
        g_projectionQueueBytes + packetLength > kProjectionQueueMaxBytes) {
        ++g_projectionQueueDropCount;
        Log("projection queue drop reason=bounded-capacity length=%zu drops=%u",
            packetLength, g_projectionQueueDropCount);
        return;
    }

    QueuedProjection queued;
    queued.packet.assign(bytes, bytes + packetLength);
    queued.dispatcherArg = dispatcherArg;
    g_projectionQueue.push_back(std::move(queued));
    g_projectionQueueBytes += packetLength;
    if (g_projectionQueue.size() > g_projectionQueueHighWater) {
        g_projectionQueueHighWater = g_projectionQueue.size();
    }
}

bool Enabled() {
    return DirectOp40Enabled();
}

bool ModuleImageRange(
    HMODULE module,
    uintptr_t* baseOut,
    size_t* sizeOut)
{
    if (baseOut) *baseOut = 0;
    if (sizeOut) *sizeOut = 0;
    if (!module) return false;

    __try {
        const uintptr_t base =
            reinterpret_cast<uintptr_t>(module);
        const IMAGE_DOS_HEADER* dos =
            reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
        if (dos->e_magic != IMAGE_DOS_SIGNATURE) return false;
        const IMAGE_NT_HEADERS* nt =
            reinterpret_cast<const IMAGE_NT_HEADERS*>(
                base + static_cast<uintptr_t>(dos->e_lfanew));
        if (nt->Signature != IMAGE_NT_SIGNATURE) return false;
        const size_t imageSize =
            static_cast<size_t>(nt->OptionalHeader.SizeOfImage);
        if (imageSize == 0) return false;
        if (baseOut) *baseOut = base;
        if (sizeOut) *sizeOut = imageSize;
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return false;
    }
}

bool SceneModeEntryIsExpected(
    const unsigned char* entry)
{
    if (!entry) return false;
    if (memcmp(entry, kSceneModeSignature,
            sizeof(kSceneModeSignature)) == 0) {
        return true;
    }
    if (!SceneModeEntryContract::IsRelativeJump(entry[0])) {
        return false;
    }

    std::int32_t relative = 0;
    memcpy(&relative, entry + 1, sizeof(relative));

    HMODULE selfModule = GetModuleHandleW(L"90CN.dll");
    uintptr_t selfBase = 0;
    size_t selfSize = 0;
    if (!ModuleImageRange(selfModule, &selfBase, &selfSize)) {
        return false;
    }
    return SceneModeEntryContract::JumpTargetInsideModule(
        reinterpret_cast<uintptr_t>(entry),
        relative,
        selfBase,
        selfSize);
}

void Log(const char* format, ...) {
    char line[512] = {};
    va_list args;
    va_start(args, format);
    _vsnprintf_s(line, _countof(line), _TRUNCATE, format, args);
    va_end(args);

    wchar_t path[MAX_PATH] = {};
    DWORD length = GetModuleFileNameW(nullptr, path, _countof(path));
    if (!length || length >= _countof(path)) return;
    wchar_t* slash = wcsrchr(path, L'\\');
    if (!slash) return;
    if (wcscpy_s(slash + 1, _countof(path) - (slash + 1 - path),
            L"90CN_companion_p0.log") != 0) return;

    HANDLE file = CreateFileW(
        path, FILE_APPEND_DATA, FILE_SHARE_READ | FILE_SHARE_WRITE,
        nullptr, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
    if (file == INVALID_HANDLE_VALUE) return;
    SYSTEMTIME now = {};
    GetLocalTime(&now);
    char prefix[80] = {};
    _snprintf_s(prefix, _countof(prefix), _TRUNCATE,
        "%04u-%02u-%02u %02u:%02u:%02u.%03u tid=%lu ",
        now.wYear, now.wMonth, now.wDay, now.wHour, now.wMinute,
        now.wSecond, now.wMilliseconds, GetCurrentThreadId());
    DWORD written = 0;
    WriteFile(file, prefix, static_cast<DWORD>(strlen(prefix)), &written, nullptr);
    WriteFile(file, line, static_cast<DWORD>(strlen(line)), &written, nullptr);
    static const char newline[] = "\r\n";
    WriteFile(file, newline, 2, &written, nullptr);
    CloseHandle(file);
}

bool ReadControlledActor(uintptr_t base, void** actor) {
    if (!base || !actor) return false;
    *actor = nullptr;
    __try {
        *actor = g_native.kControlledActorGetterRva
            ? reinterpret_cast<void* (__cdecl*)()>(base + g_native.kControlledActorGetterRva)()
            : *reinterpret_cast<void**>(base + g_native.kControlledActorPointerRva);
        return *actor != nullptr;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("blocked reason=controlled-actor-read-exception code=0x%08X",
            GetExceptionCode());
        return false;
    }
}

bool ValidateNativeRoute(uintptr_t base, void* actor) {
    if (!base || !actor) return false;
    __try {
        const unsigned char* summonEntry =
            reinterpret_cast<const unsigned char*>(
                base + g_native.kNativeSummonApcRva);
        if (!g_native.newNative && memcmp(summonEntry, kNativeSummonApcSignature,
                sizeof(kNativeSummonApcSignature)) != 0) {
            Log("blocked reason=summon-signature-mismatch actor=%p", actor);
            return false;
        }
        const unsigned char* readyEntry =
            reinterpret_cast<const unsigned char*>(base + g_native.kNativeReadyRva);
        if (!g_native.newNative && memcmp(readyEntry, kNativeReadySignature,
                sizeof(kNativeReadySignature)) != 0) {
            Log("blocked reason=ready-signature-mismatch actor=%p", actor);
            return false;
        }
        const unsigned char* sceneGetterEntry =
            reinterpret_cast<const unsigned char*>(
                base + g_native.kSceneContextGetterRva);
        if (!g_native.newNative && memcmp(sceneGetterEntry, kSceneContextGetterSignature,
                sizeof(kSceneContextGetterSignature)) != 0) {
            Log("blocked reason=scene-getter-signature-mismatch actor=%p",
                actor);
            return false;
        }
        const unsigned char* sceneModeEntry =
            reinterpret_cast<const unsigned char*>(base + g_native.kSceneModeRva);
        if (!SceneModeEntryIsExpected(sceneModeEntry)) {
            Log("blocked reason=scene-mode-entry-mismatch actor=%p entry=%02X %02X %02X %02X %02X",
                actor,
                sceneModeEntry[0], sceneModeEntry[1],
                sceneModeEntry[2], sceneModeEntry[3],
                sceneModeEntry[4]);
            return false;
        }
        const uintptr_t vtable =
            *reinterpret_cast<const uintptr_t*>(actor);
        if (!vtable) {
            Log("blocked reason=actor-vtable-null actor=%p", actor);
            return false;
        }
        const uintptr_t serializer =
            *reinterpret_cast<const uintptr_t*>(
                vtable + g_native.kSerializerVtableOffset);
        if (serializer != base + g_native.kExpectedSerializerRva) {
            Log("blocked reason=serializer-mismatch actor=%p actual=%p expected=%p",
                actor, reinterpret_cast<void*>(serializer),
                reinterpret_cast<void*>(base + g_native.kExpectedSerializerRva));
            return false;
        }
        void* owner = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(actor) + g_native.kActorOwnerContextOffset);
        if (!owner) {
            return false;
        }
        void* runtime = *reinterpret_cast<void**>(
            reinterpret_cast<uintptr_t>(owner) + g_native.kOwnerRuntimeOffset);
        return runtime != nullptr;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("blocked reason=validation-exception actor=%p code=0x%08X",
            actor, GetExceptionCode());
        return false;
    }
}

bool NativeReady(uintptr_t base, void* actor) {
    NativeReadyFn ready =
        reinterpret_cast<NativeReadyFn>(base + g_native.kNativeReadyRva);
    __try {
        return ready(actor) != 0;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("blocked reason=ready-exception actor=%p code=0x%08X",
            actor, GetExceptionCode());
        return false;
    }
}

bool DungeonSceneReady(uintptr_t base, int* modeOut) {
    if (modeOut) *modeOut = -1;
    if (!base) return false;
    __try {
        SceneContextGetterFn getSceneContext =
            reinterpret_cast<SceneContextGetterFn>(
                base + g_native.kSceneContextGetterRva);
        SceneModeFn getSceneMode =
            reinterpret_cast<SceneModeFn>(base + g_native.kSceneModeRva);
        void* sceneContext = getSceneContext();
        if (!sceneContext) {
            return false;
        }
        const int mode = getSceneMode(sceneContext);
        if (modeOut) *modeOut = mode;
        return mode == kDungeonSceneMode;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("blocked reason=scene-mode-exception code=0x%08X",
            GetExceptionCode());
        return false;
    }
}

bool Submit(uintptr_t base, void* actor) {
    if (!g_originalPayloadEncode) {
        Log("blocked reason=direct-op40-encode-hook-not-ready actor=%p", actor);
        return false;
    }
    FixedApcDescriptor descriptor = FixedApc5405Descriptor();
    if (g_projectionPending) {
        dnf90_companion_projection::View view{};
        if (!dnf90_companion_projection::DecodePacket(
                g_projectionPacket,
                g_projectionPacketLength,
                &view)) {
            Log("blocked reason=baseline-projection-decode actor=%p", actor);
            return false;
        }
        ProjectionBaseline baseline{};
        if (!ProjectionBaselineContract::TrySelect(
                view.job, view.grow, &baseline)) {
            Log("blocked reason=unsupported-projection-baseline job=%u grow=%u source=%u actor=%p",
                static_cast<unsigned int>(view.job),
                static_cast<unsigned int>(view.grow),
                static_cast<unsigned int>(view.sourceCharacter),
                actor);
            return false;
        }
        descriptor = baseline.descriptor;
        const std::int32_t baselineLevel = descriptor.minimumLevel;
        descriptor.minimumLevel = static_cast<std::int32_t>(view.level);
        descriptor.maximumLevel = static_cast<std::int32_t>(view.level);
        Log("projection baseline selected source=%u source_job=%u source_grow=0x%02X first_grow=%u awakening=%u apc=%d aic_job=%u aic_grow=%u bridged=%u baseline_level=%d source_level=%u",
            static_cast<unsigned int>(view.sourceCharacter),
            static_cast<unsigned int>(view.job),
            static_cast<unsigned int>(view.grow),
            static_cast<unsigned int>(baseline.sourceGrow),
            static_cast<unsigned int>((view.grow >> 4) & 0x0Fu),
            descriptor.apcCode,
            static_cast<unsigned int>(baseline.aicJob),
            static_cast<unsigned int>(baseline.aicGrow),
            baseline.bridged ? 1u : 0u,
            baselineLevel,
            static_cast<unsigned int>(view.level));
    }
    NativeSummonApcFn summon =
        reinterpret_cast<NativeSummonApcFn>(
            base + g_native.kNativeSummonApcRva);
    g_directLoopbackHandled = false;
    g_directLoopbackFailed = false;
    g_suppressedPeerDeliveries = 0;
    g_directLoopbackArmed = true;
    __try {
        summon(actor, actor, &descriptor);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        g_directLoopbackArmed = false;
        g_directLoopbackFailed = true;
        Log("blocked reason=summon-exception actor=%p code=0x%08X",
            actor, GetExceptionCode());
        return false;
    }
    g_directLoopbackArmed = false;
    if (!g_directLoopbackHandled || g_directLoopbackFailed) {
        Log("blocked reason=direct-op40-loopback-not-completed actor=%p handled=%u failed=%u",
            actor,
            g_directLoopbackHandled ? 1u : 0u,
            g_directLoopbackFailed ? 1u : 0u);
        return false;
    }
    Log("submitted direct-op40 apc=%d level=%d lifetime=%d actor=%p suppressed_peer_deliveries=%u",
        descriptor.apcCode, descriptor.minimumLevel,
        descriptor.lifetimeValue, actor, g_suppressedPeerDeliveries);
    return true;
}

} // namespace

void LogProjectionDecodeRejected(
    const unsigned char* bytes,
    std::size_t packetLength,
    const char* stage);

bool DirectOp40Enabled() {
    // Formal support-soldier runtime: hooks stay installed for every client.
    // Actual APC creation is still fail-closed because FixedApcRetryPolicy
    // requires a valid server-owned 0x7F41 projection packet for this run.
    return !g_native.newNative || g_newNativeHooksReady;
}

bool ConfigureNewNativeBindings() {
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    g_newNativeHooksReady = false;
    g_native = NewNativeCompanionBindings();
    __try {
        const auto* dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
        const auto* nt = reinterpret_cast<const IMAGE_NT_HEADERS32*>(base + dos->e_lfanew);
        if (dos->e_magic != IMAGE_DOS_SIGNATURE || nt->Signature != IMAGE_NT_SIGNATURE ||
            nt->FileHeader.Machine != IMAGE_FILE_MACHINE_I386 ||
            nt->FileHeader.TimeDateStamp != 0x5C24898C ||
            nt->OptionalHeader.SizeOfImage != 0x06A92000) return false;
        for (const auto& anchor : kNewNativeCompanionAnchors) {
            if (memcmp(reinterpret_cast<const void*>(base + anchor.rva),
                    anchor.bytes, sizeof(anchor.bytes))) {
                Log("new-native binding rejected rva=0x%08X", anchor.rva);
                return false;
            }
        }
        Log("new-native ABI verified anchors=%zu", _countof(kNewNativeCompanionAnchors));
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("new-native ABI verification exception=0x%08X", GetExceptionCode());
        return false;
    }
}

void SetNewNativeHooksReady(bool ready) {
    g_newNativeHooksReady = ready;
    if (ready) {
        InstallCompanionEquipmentProbe();
    }
    Log("new-native companion hooks ready=%u", ready ? 1u : 0u);
}

void SetOriginalPayloadEncode(void* original) {
    g_originalPayloadEncode = reinterpret_cast<PayloadEncodeFn>(original);
    Log("direct-op40 encode hook original=%p enabled=%u",
        original, DirectOp40Enabled() ? 1u : 0u);
}

void __cdecl ProxyPayloadEncode(
    std::uint8_t* payload,
    std::int32_t length,
    void* keyState)
{
    PayloadEncodeFn original = g_originalPayloadEncode;
    if (!original) {
        return;
    }

    // Always preserve the native encoder first. The P0 path observes the
    // exact bytes normal send produced; all unrelated calls are unchanged.
    original(payload, length, keyState);

    if (!g_directLoopbackArmed ||
        g_directLoopbackInReceive ||
        GetCurrentThreadId() != g_armedThread) {
        return;
    }

    uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    if (!base || !payload || length < 0) {
        g_directLoopbackFailed = true;
        return;
    }
    const uintptr_t caller =
        reinterpret_cast<uintptr_t>(_ReturnAddress());
    if (caller != base + g_native.kPayloadEncodeReturnRva) {
        return;
    }

    __try {
        void* writer = *reinterpret_cast<void**>(base + g_native.kWriterPointerRva);
        void* dispatcher =
            *reinterpret_cast<void**>(base + g_native.kDispatcherPointerRva);
        if (!writer || writer != dispatcher) {
            Log("blocked reason=direct-op40-owner-mismatch writer=%p dispatcher=%p",
                writer, dispatcher);
            g_directLoopbackFailed = true;
            return;
        }

        const uintptr_t vtable = *reinterpret_cast<uintptr_t*>(writer);
        if (!vtable) {
            g_directLoopbackFailed = true;
            return;
        }
        const uintptr_t receiveAddress =
            *reinterpret_cast<uintptr_t*>(vtable + 0x04);
        if (receiveAddress != base + g_native.kExpectedReceiveRva) {
            Log("blocked reason=direct-op40-receive-mismatch actual=%p expected=%p",
                reinterpret_cast<void*>(receiveAddress),
                reinterpret_cast<void*>(base + g_native.kExpectedReceiveRva));
            g_directLoopbackFailed = true;
            return;
        }

        unsigned char* packet =
            reinterpret_cast<unsigned char*>(
                reinterpret_cast<uintptr_t>(writer) + g_native.kPacketBufferOffset);
        unsigned char* cursor =
            *reinterpret_cast<unsigned char**>(
                reinterpret_cast<uintptr_t>(writer) + g_native.kWriterCursorOffset);
        if (!cursor || cursor < packet) {
            g_directLoopbackFailed = true;
            return;
        }
        const std::size_t totalLength =
            static_cast<std::size_t>(cursor - packet);
        if (totalLength < DirectOp40PacketContract::kHeaderSize ||
            totalLength > 4096 ||
            payload != packet + DirectOp40PacketContract::kHeaderSize ||
            static_cast<std::size_t>(length) !=
                totalLength - DirectOp40PacketContract::kHeaderSize ||
            !DirectOp40PacketContract::Matches(packet, totalLength)) {
            // A different encoded message can occur in nested native work.
            // It has already been encoded by the original function, so simply
            // preserve normal send.
            return;
        }

        unsigned char backup[4096] = {};
        memcpy(backup, packet, totalLength);

        InternalReceiveFn receive =
            reinterpret_cast<InternalReceiveFn>(receiveAddress);
        g_directLoopbackInReceive = true;
        receive(writer, 0, packet, static_cast<std::int32_t>(totalLength));
        g_directLoopbackInReceive = false;

        // Native receive decodes payload in-place. Restore the exact encoded
        // packet so the remainder of normal send sees byte-for-byte the state
        // it would have seen without P0.
        memcpy(packet, backup, totalLength);

        g_directLoopbackHandled = true;
        Log("direct-op40 encoded loopback consumed length=%zu actor=%p",
            totalLength, g_armedActor);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        g_directLoopbackInReceive = false;
        g_directLoopbackFailed = true;
        Log("blocked reason=direct-op40-encoded-loopback-exception code=0x%08X actor=%p",
            GetExceptionCode(), g_armedActor);
    }
}

void SetOriginalPeerDelivery(void* original) {
    g_originalPeerDelivery = reinterpret_cast<PeerDeliveryFn>(original);
    Log("direct-op40 peer-delivery hook original=%p enabled=%u",
        original, DirectOp40Enabled() ? 1u : 0u);
}

void __fastcall ProxyPeerDelivery(
    void* self,
    void* /*unusedEdx*/,
    std::uint8_t* packet,
    std::int32_t length,
    std::int32_t slot,
    std::uint32_t routeKind,
    std::uint32_t mode)
{
    PeerDeliveryFn original = g_originalPeerDelivery;
    if (!original) {
        return;
    }

    const std::size_t packetLength =
        length > 0 ? static_cast<std::size_t>(length) : 0;
    const bool contractMatch =
        DirectOp40PeerDeliveryContract::Matches(
            g_directLoopbackArmed,
            g_directLoopbackHandled,
            g_directLoopbackInReceive,
            static_cast<std::uint32_t>(GetCurrentThreadId()),
            static_cast<std::uint32_t>(g_armedThread),
            packet,
            packetLength,
            routeKind,
            mode);

    if (contractMatch) {
        uintptr_t base =
            reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
        __try {
            void* writer =
                *reinterpret_cast<void**>(base + g_native.kWriterPointerRva);
            if (writer) {
                unsigned char* expectedPacket =
                    reinterpret_cast<unsigned char*>(
                        reinterpret_cast<uintptr_t>(writer) +
                        g_native.kPacketBufferOffset);
                unsigned char* cursor =
                    *reinterpret_cast<unsigned char**>(
                        reinterpret_cast<uintptr_t>(writer) +
                        g_native.kWriterCursorOffset);
                const std::size_t expectedLength =
                    cursor && cursor >= expectedPacket ?
                    static_cast<std::size_t>(cursor - expectedPacket) : 0;
                if (packet == expectedPacket &&
                    packetLength == expectedLength) {
                    ++g_suppressedPeerDeliveries;
                    if (g_suppressedPeerDeliveries <= 2) {
                        Log("suppressed duplicate direct-op40 peer delivery slot=%d length=%d route=%u mode=%u actor=%p",
                            slot, length, routeKind, mode, g_armedActor);
                    }
                    return;
                }
            }
        } __except (EXCEPTION_EXECUTE_HANDLER) {
            Log("peer-delivery suppression validation exception code=0x%08X",
                GetExceptionCode());
        }
    }

    original(self, packet, length, slot, routeKind, mode);
}





std::uint32_t ProjectionTemplateFingerprint(
    const void* source)
{
    if (!source) return 0;
    const std::uint8_t* bytes =
        reinterpret_cast<const std::uint8_t*>(source);
    std::uint32_t hash = 2166136261u;
    auto mix = [&](const void* data, std::size_t length) {
        const std::uint8_t* p =
            reinterpret_cast<const std::uint8_t*>(data);
        for (std::size_t i = 0; i < length; ++i) {
            hash ^= p[i];
            hash *= 16777619u;
        }
    };
    __try {
        mix(bytes + 8, 12);
        const std::uintptr_t begin =
            *reinterpret_cast<const std::uintptr_t*>(bytes + g_native.kAicEquipmentVectorOffset);
        const std::uintptr_t end =
            *reinterpret_cast<const std::uintptr_t*>(bytes + g_native.kAicEquipmentVectorOffset + 4);
        if (begin && end >= begin && end - begin <= 12u * 32u) {
            mix(reinterpret_cast<const void*>(begin), end - begin);
        }
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        return 0;
    }
    return hash;
}

bool AssignNativeRefWideString(
    void* stringField,
    const wchar_t* text)
{
    if (!stringField || !text) return false;

    const std::size_t units = std::wcslen(text);
    if (units == 0 ||
        units > dnf90_companion_projection::kMaxAicNameUnits) {
        return false;
    }

    uintptr_t base =
        reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    if (!base) return false;

    NativeRefStringAllocFn alloc =
        reinterpret_cast<NativeRefStringAllocFn>(
            base + g_native.kNativeRefStringAllocRva);
    NativeRefStringFreeFn freeBlock =
        reinterpret_cast<NativeRefStringFreeFn>(
            base + g_native.kNativeRefStringFreeRva);
    NativeRefStringRefFn increment =
        *reinterpret_cast<NativeRefStringRefFn*>(
            base + g_native.kNativeRefStringIncIatRva);
    NativeRefStringRefFn decrement =
        *reinterpret_cast<NativeRefStringRefFn*>(
            base + g_native.kNativeRefStringDecIatRva);
    if (!alloc || !freeBlock || !increment || !decrement) {
        return false;
    }

    __try {
        wchar_t* oldData =
            *reinterpret_cast<wchar_t**>(stringField);
        if (!oldData) return false;

        std::uint8_t* oldHeader =
            reinterpret_cast<std::uint8_t*>(oldData) - 8;
        const std::uint32_t oldBytes =
            *reinterpret_cast<std::uint32_t*>(oldHeader + 4);
        if (oldBytes < 2 || oldBytes > 512 ||
            (oldBytes % 2u) != 0) {
            return false;
        }

        const std::size_t newBytes =
            (units + 1u) * sizeof(wchar_t);
        if (oldBytes == newBytes &&
            memcmp(oldData, text, newBytes) == 0) {
            return true;
        }

        std::uint8_t* newHeader =
            reinterpret_cast<std::uint8_t*>(
                alloc(8u + newBytes));
        if (!newHeader) return false;

        *reinterpret_cast<long*>(newHeader) = 0;
        *reinterpret_cast<std::uint32_t*>(newHeader + 4) =
            static_cast<std::uint32_t>(newBytes);
        memcpy(newHeader + 8, text, newBytes);

        increment(newHeader);
        *reinterpret_cast<wchar_t**>(stringField) =
            reinterpret_cast<wchar_t*>(newHeader + 8);

        const long remaining = decrement(oldHeader);
        if (remaining <= 0) {
            freeBlock(oldHeader);
        }
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("native-ref-string assign exception field=%p code=0x%08X",
            stringField, GetExceptionCode());
        return false;
    }
}

struct NativeVectorStorage {
    std::uint32_t opaque = 0;
    std::uintptr_t begin = 0;
    std::uintptr_t end = 0;
    std::uintptr_t capacityEnd = 0;
};

bool EnsureNativeVectorCapacity(
    std::uint8_t* destination,
    std::size_t objectOffset,
    std::size_t elementSize,
    std::size_t requestedCount,
    std::uintptr_t allocateRva,
    std::uintptr_t* beginOut,
    std::uintptr_t* endOut,
    std::uintptr_t* capacityOut,
    bool* grewOut)
{
    if (!destination || elementSize == 0 ||
        !beginOut || !endOut || !capacityOut || !grewOut ||
        requestedCount > static_cast<std::size_t>(0x7FFFFFFFu)) {
        return false;
    }
    *grewOut = false;

    __try {
        std::uint8_t* object = destination + objectOffset;
        std::uintptr_t begin =
            *reinterpret_cast<std::uintptr_t*>(object + 4);
        std::uintptr_t end =
            *reinterpret_cast<std::uintptr_t*>(object + 8);
        std::uintptr_t capacityEnd =
            *reinterpret_cast<std::uintptr_t*>(object + 12);

        if (begin == 0 || end == 0 || capacityEnd == 0) {
            if (begin != 0 || end != 0 || capacityEnd != 0) {
                return false;
            }
        } else {
            if (end < begin || capacityEnd < end ||
                ((end - begin) % elementSize) != 0 ||
                ((capacityEnd - begin) % elementSize) != 0) {
                return false;
            }
            const std::size_t capacity =
                (capacityEnd - begin) / elementSize;
            if (requestedCount <= capacity) {
                *beginOut = begin;
                *endOut = end;
                *capacityOut = capacityEnd;
                return true;
            }
        }

        if (requestedCount == 0) {
            *beginOut = begin;
            *endOut = end;
            *capacityOut = capacityEnd;
            return true;
        }

        uintptr_t base =
            reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
        NativeVectorAllocateFn allocate =
            reinterpret_cast<NativeVectorAllocateFn>(
                base + allocateRva);
        NativeVectorFreeFn freeData =
            reinterpret_cast<NativeVectorFreeFn>(
                base + g_native.kNativeVectorFreeRva);
        if (!allocate || !freeData) return false;

        NativeVectorStorage temporary{};
        if (!allocate(
                &temporary,
                static_cast<std::uint32_t>(requestedCount)) ||
            temporary.begin == 0 ||
            temporary.end != temporary.begin ||
            temporary.capacityEnd < temporary.begin ||
            ((temporary.capacityEnd - temporary.begin) %
                elementSize) != 0 ||
            (temporary.capacityEnd - temporary.begin) /
                    elementSize <
                requestedCount) {
            if (temporary.begin != 0) {
                freeData(reinterpret_cast<void*>(temporary.begin));
            }
            return false;
        }

        const std::uintptr_t oldBegin = begin;
        *reinterpret_cast<std::uintptr_t*>(object + 4) =
            temporary.begin;
        *reinterpret_cast<std::uintptr_t*>(object + 8) =
            temporary.begin;
        *reinterpret_cast<std::uintptr_t*>(object + 12) =
            temporary.capacityEnd;
        if (oldBegin != 0) {
            freeData(reinterpret_cast<void*>(oldBegin));
        }

        *beginOut = temporary.begin;
        *endOut = temporary.begin;
        *capacityOut = temporary.capacityEnd;
        *grewOut = true;
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("native-vector ensure exception object_offset=0x%zX count=%zu code=0x%08X",
            objectOffset, requestedCount, GetExceptionCode());
        return false;
    }
}

bool ApplyDynamicAicProjection(
    void* destination,
    const void* source,
    const dnf90_companion_projection::View& view)
{
    if (!destination || !source || !view.present ||
        !view.nameUtf16 || view.level == 0 || view.level > 90 ||
        view.nameUnits == 0 ||
        view.nameUnits > dnf90_companion_projection::kMaxAicNameUnits ||
        view.equipmentCount > dnf90_companion_projection::kMaxAicEquipment ||
        view.skillCount > dnf90_companion_projection::kMaxAicSkills ||
        view.quickSkillCount > dnf90_companion_projection::kMaxAicQuickSkills) {
        return false;
    }

    __try {
        const std::uint32_t templateBefore =
            ProjectionTemplateFingerprint(source);
        if (templateBefore == 0) return false;

        wchar_t name[
            dnf90_companion_projection::kMaxAicNameUnits + 1] = {};
        for (std::size_t i = 0; i < view.nameUnits; ++i) {
            const std::uint16_t unit =
                dnf90_companion_projection::Read16(
                    view.nameUtf16 + i * 2);
            if (unit == 0) return false;
            name[i] = static_cast<wchar_t>(unit);
        }
        name[view.nameUnits] = L'\0';

        std::uint8_t* dest =
            reinterpret_cast<std::uint8_t*>(destination);
        ProjectionBaseline baseline{};
        if (!ProjectionBaselineContract::TrySelect(
                view.job, view.grow, &baseline)) {
            Log("dynamic-aic blocked reason=baseline-map-miss source=%u job=%u grow=0x%02X",
                static_cast<unsigned int>(view.sourceCharacter),
                static_cast<unsigned int>(view.job),
                static_cast<unsigned int>(view.grow));
            return false;
        }

        const std::uint32_t baselineJob =
            *reinterpret_cast<std::uint32_t*>(dest + 0x0C);
        const std::uint32_t baselineGrow =
            *reinterpret_cast<std::uint32_t*>(dest + 0x10);
        if (baselineJob !=
                static_cast<std::uint32_t>(baseline.aicJob) ||
            baselineGrow !=
                static_cast<std::uint32_t>(baseline.aicGrow)) {
            Log("dynamic-aic blocked reason=baseline-job-grow-mismatch source=%u source_job=%u source_grow=0x%02X expected_aic=%u/%u actual_aic=%u/%u apc=%d",
                static_cast<unsigned int>(view.sourceCharacter),
                static_cast<unsigned int>(view.job),
                static_cast<unsigned int>(view.grow),
                static_cast<unsigned int>(baseline.aicJob),
                static_cast<unsigned int>(baseline.aicGrow),
                static_cast<unsigned int>(baselineJob),
                static_cast<unsigned int>(baselineGrow),
                baseline.descriptor.apcCode);
            return false;
        }

        if (ProjectionGrowBridgeContract::ShouldApplyFirstGrow(
                baseline)) {
            *reinterpret_cast<std::uint32_t*>(
                dest + 0x10) =
                static_cast<std::uint32_t>(
                    baseline.sourceGrow);
            Log("dynamic-aic grow bridge source=%u job=%u aic_grow=%u source_grow=%u apc=%d",
                static_cast<unsigned int>(view.sourceCharacter),
                static_cast<unsigned int>(baseline.sourceJob),
                static_cast<unsigned int>(baseline.aicGrow),
                static_cast<unsigned int>(baseline.sourceGrow),
                baseline.descriptor.apcCode);
        }
        if (ProjectionGrowBridgeContract::ShouldApplyAwakening(
                baseline, view.grow)) {
            const std::uint8_t awakening =
                ProjectionGrowBridgeContract::AwakeningStage(
                    view.grow);
            *reinterpret_cast<std::uint32_t*>(
                dest + 0x14) =
                static_cast<std::uint32_t>(awakening);
            Log("dynamic-aic awakening bridge source=%u job=%u packed_grow=0x%02X awakening=%u apc=%d",
                static_cast<unsigned int>(view.sourceCharacter),
                static_cast<unsigned int>(baseline.sourceJob),
                static_cast<unsigned int>(view.grow),
                static_cast<unsigned int>(awakening),
                baseline.descriptor.apcCode);
        }

        for (std::size_t i = 0; i < view.equipmentCount; ++i) {
            if (dnf90_companion_projection::Read32(
                    view.equipmentIds + i * 4) == 0) {
                return false;
            }
        }
        for (std::size_t i = 0; i < view.quickSkillCount; ++i) {
            const std::uint32_t id =
                dnf90_companion_projection::Read32(
                    view.quickSkills + i * 8);
            const std::uint32_t level =
                dnf90_companion_projection::Read32(
                    view.quickSkills + i * 8 + 4);
            // Quickbar projection is positional. Empty A/S/D/F/G/H or
            // Q/W/E/R/T/Y slots are encoded as 0/0 so later slots do not
            // shift left. A half-empty pair is invalid.
            if (!ProjectionQuickSkillContract::PairValid(
                    id, level)) {
                return false;
            }
        }
        for (std::size_t i = 0; i < view.skillCount; ++i) {
            if (dnf90_companion_projection::Read32(
                    view.skills + i * 8) == 0 ||
                dnf90_companion_projection::Read32(
                    view.skills + i * 8 + 4) == 0) {
                return false;
            }
        }

        std::uintptr_t equipBegin = 0, equipEnd = 0, equipCapacity = 0;
        std::uintptr_t quickBegin = 0, quickEnd = 0, quickCapacity = 0;
        std::uintptr_t skillBegin = 0, skillEnd = 0, skillCapacity = 0;
        bool equipGrew = false;
        bool quickGrew = false;
        bool skillGrew = false;
        if (!EnsureNativeVectorCapacity(
                dest,
                g_native.kAicEquipmentVectorObjectOffset,
                12u,
                view.equipmentCount,
                g_native.kNativeEquipmentVectorAllocateRva,
                &equipBegin, &equipEnd, &equipCapacity,
                &equipGrew) ||
            !EnsureNativeVectorCapacity(
                dest,
                g_native.kAicQuickSkillVectorObjectOffset,
                8u,
                view.quickSkillCount,
                g_native.kNativeSkillVectorAllocateRva,
                &quickBegin, &quickEnd, &quickCapacity,
                &quickGrew) ||
            !EnsureNativeVectorCapacity(
                dest,
                g_native.kAicSkillVectorObjectOffset,
                8u,
                view.skillCount,
                g_native.kNativeSkillVectorAllocateRva,
                &skillBegin, &skillEnd, &skillCapacity,
                &skillGrew)) {
            Log("dynamic-aic blocked reason=vector-resize source=%u equipment=%zu quick=%zu skills=%zu",
                static_cast<unsigned int>(view.sourceCharacter),
                view.equipmentCount,
                view.quickSkillCount,
                view.skillCount);
            return false;
        }

        if (!AssignNativeRefWideString(dest + 8, name)) {
            Log("dynamic-aic blocked reason=name-assign source=%u dest=%p",
                static_cast<unsigned int>(view.sourceCharacter),
                destination);
            return false;
        }

        const std::size_t oldEquipmentCount =
            (equipEnd - equipBegin) / 12u;
        std::uint8_t* equipmentRows =
            reinterpret_cast<std::uint8_t*>(equipBegin);
        for (std::size_t i = 0; i < view.equipmentCount; ++i) {
            const std::uint32_t itemID =
                dnf90_companion_projection::Read32(
                    view.equipmentIds + i * 4);
            if (itemID == 0) return false;
            std::uint32_t* row =
                reinterpret_cast<std::uint32_t*>(
                    equipmentRows + i * 12u);
            row[0] = itemID;
            row[1] = 0;
            row[2] = 0;
        }
        if (oldEquipmentCount > view.equipmentCount) {
            memset(equipmentRows + view.equipmentCount * 12u, 0,
                (oldEquipmentCount - view.equipmentCount) * 12u);
        }
        *reinterpret_cast<std::uintptr_t*>(
            dest + g_native.kAicEquipmentVectorOffset + 4) =
            equipBegin + view.equipmentCount * 12u;

        const std::size_t oldQuickCount =
            (quickEnd - quickBegin) / 8u;
        std::uint8_t* quickRows =
            reinterpret_cast<std::uint8_t*>(quickBegin);
        for (std::size_t i = 0; i < view.quickSkillCount; ++i) {
            const std::uint32_t id =
                dnf90_companion_projection::Read32(
                    view.quickSkills + i * 8);
            const std::uint32_t level =
                dnf90_companion_projection::Read32(
                    view.quickSkills + i * 8 + 4);
            if (!ProjectionQuickSkillContract::PairValid(
                    id, level)) return false;
            std::uint32_t* row =
                reinterpret_cast<std::uint32_t*>(
                    quickRows + i * 8u);
            row[0] = id;
            row[1] = level;
        }
        if (oldQuickCount > view.quickSkillCount) {
            memset(quickRows + view.quickSkillCount * 8u, 0,
                (oldQuickCount - view.quickSkillCount) * 8u);
        }
        *reinterpret_cast<std::uintptr_t*>(
            dest + g_native.kAicQuickSkillVectorOffset + 4) =
            quickBegin + view.quickSkillCount * 8u;

        const std::size_t oldSkillCount =
            (skillEnd - skillBegin) / 8u;
        std::uint8_t* skillRows =
            reinterpret_cast<std::uint8_t*>(skillBegin);
        for (std::size_t i = 0; i < view.skillCount; ++i) {
            const std::uint32_t id =
                dnf90_companion_projection::Read32(
                    view.skills + i * 8);
            const std::uint32_t level =
                dnf90_companion_projection::Read32(
                    view.skills + i * 8 + 4);
            if (id == 0 || level == 0) return false;
            std::uint32_t* row =
                reinterpret_cast<std::uint32_t*>(
                    skillRows + i * 8u);
            row[0] = id;
            row[1] = level;
        }
        if (oldSkillCount > view.skillCount) {
            memset(skillRows + view.skillCount * 8u, 0,
                (oldSkillCount - view.skillCount) * 8u);
        }
        *reinterpret_cast<std::uintptr_t*>(
            dest + g_native.kAicSkillVectorOffset + 4) =
            skillBegin + view.skillCount * 8u;

        const std::uint32_t templateAfter =
            ProjectionTemplateFingerprint(source);
        if (templateAfter == 0 || templateAfter != templateBefore) {
            Log("dynamic-aic blocked reason=template-mutated before=%08X after=%08X",
                templateBefore, templateAfter);
            return false;
        }

        Log("dynamic-aic applied source=%u level=%u source_job=%u source_grow=0x%02X aic_job=%u aic_grow=%u bridged=%u equipment=%zu quick=%zu skills=%zu capacities=%zu/%zu/%zu grew=%u/%u/%u dest=%p source_template=%p template_mutation=0",
            static_cast<unsigned int>(view.sourceCharacter),
            static_cast<unsigned int>(view.level),
            static_cast<unsigned int>(view.job),
            static_cast<unsigned int>(view.grow),
            static_cast<unsigned int>(baseline.aicJob),
            static_cast<unsigned int>(baseline.aicGrow),
            baseline.bridged ? 1u : 0u,
            view.equipmentCount,
            view.quickSkillCount,
            view.skillCount,
            equipBegin && equipCapacity >= equipBegin
                ? (equipCapacity - equipBegin) / 12u : 0u,
            quickBegin && quickCapacity >= quickBegin
                ? (quickCapacity - quickBegin) / 8u : 0u,
            skillBegin && skillCapacity >= skillBegin
                ? (skillCapacity - skillBegin) / 8u : 0u,
            equipGrew ? 1u : 0u,
            quickGrew ? 1u : 0u,
            skillGrew ? 1u : 0u,
            destination,
            source);
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("dynamic-aic apply exception code=0x%08X",
            GetExceptionCode());
        return false;
    }
}

void SetOriginalAicCopy(void* original) {
    g_originalAicCopy =
        reinterpret_cast<AicCopyFn>(original);
    Log("projection AIC copy hook original=%p enabled=%u",
        original, DirectOp40Enabled() ? 1u : 0u);
}

void* __fastcall ProxyAicCopy(
    void* destination,
    void* /*unusedEdx*/,
    const void* source)
{
    AicCopyFn original = g_originalAicCopy;
    if (!original) return destination;

    void* result = original(destination, source);

    if (!DynamicAicApplyContract::Matches(
            g_projectionPending,
            g_directLoopbackInReceive,
            g_projectionAicApplied,
            GetCurrentThreadId(),
            g_armedThread,
            destination,
            source)) {
        return result;
    }

    dnf90_companion_projection::View view{};
    if (!dnf90_companion_projection::DecodePacket(
            g_projectionPacket,
            g_projectionPacketLength,
            &view)) {
        Log("dynamic-aic blocked reason=projection-decode");
        return result;
    }

    if (ApplyDynamicAicProjection(
            destination, source, view)) {
        // Stage 1 is complete, but keep the cached projection pending.
        // The registered APC object key is only known later in the same native
        // op40 transaction; Stage 2 uses mode0 at the post-registration safe
        // point to update scene/name state for that exact actor.
        g_projectionAicApplied = true;
    }
    return result;
}

void SetOriginalNetworkRouter(void* original) {
    g_originalNetworkRouter =
        reinterpret_cast<NetworkRouterFn>(original);
    Log("projection network-router hook original=%p enabled=%u",
        original, DirectOp40Enabled() ? 1u : 0u);
}

int __fastcall ProxyNetworkRouter(
    void* self,
    void* /*unusedEdx*/,
    std::int32_t sourceContext,
    std::uint8_t* packet,
    std::int32_t totalLength)
{
    NetworkRouterFn original = g_originalNetworkRouter;
    if (!original) {
        return static_cast<int>(0x80000001u);
    }

    const std::size_t available =
        totalLength > 0 ? static_cast<std::size_t>(totalLength) : 0;
    bool privateProjection = false;
    __try {
        privateProjection =
            Enabled() &&
            available <= kProjectionPacketCapacity &&
            dnf90_companion_projection::IsPrivateNetworkPacketHeader(
                packet, available);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        privateProjection = false;
    }

    // The socket router receives the protected outer packet. The native
    // router decodes/normalizes it before entering the class0 dispatcher;
    // projection capture is therefore performed by ProxyClass0Dispatch,
    // where the body is already plaintext and the same call stack still owns
    // the AIC/APC construction transaction.
    const int result = original(self, sourceContext, packet, totalLength);

    if (!privateProjection) {
        return result;
    }

    Log("projection private packet routed to class0 source_context=%d length=%d native_result=0x%08X",
        sourceContext, totalLength, static_cast<unsigned int>(result));
    return result;
}


// Direct-key programs are compiled per client build: the retail EXE emits
// 0x180-byte bodies with the skill code at +0x100, DB4 emits 0x1BC at +0x128,
// and the currently deployed client emits 0x200-byte bodies whose skill-code
// slot matches neither constant. Treat the body length as a range and locate
// the code slot by content, so no PVF-side key rewrite is required.
constexpr std::size_t kMinDirectKeyBytecodeSize = 0x80;
// Program bodies are not uniform: the shell AIC ships 512-byte key programs
// next to 1152-byte combo/command bodies, so only a generous sanity bound is
// enforced here. The skill-code field position is what the rebinding relies on.
constexpr std::size_t kMaxDirectKeyBytecodeSize = 0x4000;

std::size_t FindDirectKeySkillCodeOffset(
    std::uint8_t* bytecode,
    std::size_t size,
    std::uint32_t expected)
{
    if (bytecode && size >= 4 && expected != 0) {
        for (std::size_t offset = 0; offset + 4 <= size; offset += 4) {
            if (*reinterpret_cast<std::uint32_t*>(bytecode + offset) == expected) {
                return offset;
            }
        }
    }
    return g_native.kRuntimeKeySkillCodeOffset;
}

// Bind the source quickbar to the native key programs. Mode selection belongs
// to the owned VM predicates below, separately from the key identities.
bool ApplyDynamicRuntimeKeyPrograms(
    void* actor,
    const dnf90_companion_projection::View& view,
    const std::uint32_t* previousSkills = nullptr)
{
    using Contract = ProjectionRuntimeKeyContract;
    if (!actor ||
        view.quickSkillCount != Contract::kQuickSlotCount) {
        return false;
    }

    __try {
        std::uint8_t* actorBytes =
            reinterpret_cast<std::uint8_t*>(actor);
        std::uint8_t* aic =
            *reinterpret_cast<std::uint8_t**>(
                actorBytes + g_native.kActorAicOffset);
        if (!aic) {
            Log("runtime-key projection blocked reason=aic-null actor=%p",
                actor);
            return false;
        }

        std::uintptr_t begin =
            *reinterpret_cast<std::uintptr_t*>(
                aic + g_native.kAicRuntimeKeyProgramVectorOffset);
        std::uintptr_t end =
            *reinterpret_cast<std::uintptr_t*>(
                aic + g_native.kAicRuntimeKeyProgramVectorOffset + 4);
        std::uintptr_t capacity =
            *reinterpret_cast<std::uintptr_t*>(
                aic + g_native.kAicRuntimeKeyProgramVectorOffset + 8);
        if (!begin || end < begin || capacity < end ||
            ((end - begin) % sizeof(void*)) != 0 ||
            ((capacity - begin) % sizeof(void*)) != 0) {
            Log("runtime-key projection blocked reason=program-vector-shape aic=%p begin=%p end=%p cap=%p",
                aic,
                reinterpret_cast<void*>(begin),
                reinterpret_cast<void*>(end),
                reinterpret_cast<void*>(capacity));
            return false;
        }

        const std::size_t programCount =
            (end - begin) / sizeof(void*);
        void** programs =
            reinterpret_cast<void**>(begin);
        if (!Contract::ProgramCountValid(programCount)) {
            Log("runtime-key projection skipped reason=program-count count=%zu expected=%u..%u aic=%p",
                programCount,
                Contract::kRequiredProgramCount,
                Contract::kMaxCompatibleProgramCount,
                aic);
            // Shape probe: the runtime synthesizer needs the AIC's real program
            // object layout when a shell ships fewer than 25 key programs.
            for (std::size_t probe = 0; probe < programCount && probe < 3; ++probe) {
                std::uint8_t* probeProgram =
                    reinterpret_cast<std::uint8_t*>(programs[probe]);
                if (!probeProgram) continue;
                const std::uintptr_t probeBegin =
                    *reinterpret_cast<std::uintptr_t*>(
                        probeProgram + g_native.kRuntimeKeyProgramBytecodeBeginOffset);
                const std::uintptr_t probeEnd =
                    *reinterpret_cast<std::uintptr_t*>(
                        probeProgram + g_native.kRuntimeKeyProgramBytecodeEndOffset);
                const std::size_t probeSize =
                    probeEnd >= probeBegin ? probeEnd - probeBegin : 0;
                Log("runtime-key probe index=%zu program=%p next=%p size=%zu code100=0x%08X code128=0x%08X",
                    probe,
                    probeProgram,
                    probe + 1 < programCount ? programs[probe + 1] : nullptr,
                    probeSize,
                    probeSize > 0x104 ? *reinterpret_cast<std::uint32_t*>(probeBegin + 0x100) : 0,
                    probeSize > 0x12C ? *reinterpret_cast<std::uint32_t*>(probeBegin + 0x128) : 0);
            }
            return false;
        }

        // 关闭普攻时把 CompanionBasicAttack 的技能码改成空占位码，
        // 只禁用技能冷却后的普攻回退，不触碰 0..11 的 12 格技能程序。
        if (!CompanionBasicAttackEnabled()) {
            void* basicProgram =
                programs[Contract::kBasicAttackProgramIndex];
            std::uint8_t* basic =
                reinterpret_cast<std::uint8_t*>(basicProgram);
            if (basic) {
                std::uintptr_t basicBegin =
                    *reinterpret_cast<std::uintptr_t*>(
                        basic +
                        g_native.kRuntimeKeyProgramBytecodeBeginOffset);
                std::uintptr_t basicEnd =
                    *reinterpret_cast<std::uintptr_t*>(
                        basic +
                        g_native.kRuntimeKeyProgramBytecodeEndOffset);
                std::uintptr_t basicCapacity =
                    *reinterpret_cast<std::uintptr_t*>(
                        basic +
                        g_native.kRuntimeKeyProgramBytecodeCapacityOffset);
                if (basicBegin && basicEnd >= basicBegin &&
                    basicCapacity >= basicEnd &&
                    basicEnd - basicBegin >=
                        g_native.kRuntimeKeySkillCodeOffset + 4) {
                    *reinterpret_cast<std::uint32_t*>(
                        basicBegin +
                        g_native.kRuntimeKeySkillCodeOffset) =
                        Contract::kSkillCodeBias +
                        Contract::kPlaceholderSkillId;
                    Log("companion basic attack disabled actor=%p program=%p",
                        actor,
                        basicProgram);
                }
            }
        }

        std::uint8_t* directBytecode[
            Contract::kQuickSlotCount] = {};
        std::size_t directBytecodeSize[
            Contract::kQuickSlotCount] = {};
        std::size_t directSkillCodeOffset[
            Contract::kQuickSlotCount] = {};
        std::uint8_t* directPrograms[Contract::kQuickSlotCount] = {};
        std::uint32_t directCooldown[Contract::kQuickSlotCount] = {};
        std::uint32_t encodedSkills[
            Contract::kQuickSlotCount] = {};
        const std::uint32_t placeholderCode =
            Contract::kSkillCodeBias +
            Contract::kPlaceholderSkillId;

        // Validate the entire direct pool before mutating anything.
        for (std::size_t i = 0;
             i < Contract::kQuickSlotCount;
             ++i) {
            if (!programs[i] ||
                !programs[Contract::kDirectPoolBase + i] ||
                programs[i] ==
                    programs[Contract::kDirectPoolBase + i]) {
                Log("runtime-key projection blocked reason=program-null-or-alias slot=%zu front=%p direct=%p",
                    i,
                    programs[i],
                    programs[Contract::kDirectPoolBase + i]);
                return false;
            }

            const bool currentlyBound =
                previousSkills && previousSkills[i] != 0;
            const std::size_t directIndex = currentlyBound
                ? i : Contract::kDirectPoolBase + i;
            std::uint8_t* program =
                reinterpret_cast<std::uint8_t*>(
                    programs[directIndex]);
            std::uintptr_t codeBegin =
                *reinterpret_cast<std::uintptr_t*>(
                    program +
                    g_native.kRuntimeKeyProgramBytecodeBeginOffset);
            std::uintptr_t codeEnd =
                *reinterpret_cast<std::uintptr_t*>(
                    program +
                    g_native.kRuntimeKeyProgramBytecodeEndOffset);
            std::uintptr_t codeCapacity =
                *reinterpret_cast<std::uintptr_t*>(
                    program +
                    g_native.kRuntimeKeyProgramBytecodeCapacityOffset);
            const std::size_t codeSize =
                codeEnd >= codeBegin
                    ? static_cast<std::size_t>(codeEnd - codeBegin) : 0;
            if (!codeBegin ||
                codeEnd < codeBegin ||
                codeCapacity < codeEnd ||
                codeSize < kMinDirectKeyBytecodeSize ||
                codeSize > kMaxDirectKeyBytecodeSize) {
                Log("runtime-key projection blocked reason=direct-bytecode-shape slot=%zu program=%p begin=%p end=%p cap=%p size=%zu",
                    i,
                    program,
                    reinterpret_cast<void*>(codeBegin),
                    reinterpret_cast<void*>(codeEnd),
                    reinterpret_cast<void*>(codeCapacity),
                    codeSize);
                return false;
            }

            std::uint8_t* code =
                reinterpret_cast<std::uint8_t*>(
                    codeBegin);
            if (i == 0) {
                // One-shot layout dump: the shell's original key programs do not
                // follow the placeholder contract, so record the real field
                // layout next to the quickbar the projection wants to bind.
                Log("runtime-key dump slot=0 size=%zu quick=%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u",
                    codeSize,
                    dnf90_companion_projection::Read32(view.quickSkills + 0),
                    dnf90_companion_projection::Read32(view.quickSkills + 8),
                    dnf90_companion_projection::Read32(view.quickSkills + 16),
                    dnf90_companion_projection::Read32(view.quickSkills + 24),
                    dnf90_companion_projection::Read32(view.quickSkills + 32),
                    dnf90_companion_projection::Read32(view.quickSkills + 40),
                    dnf90_companion_projection::Read32(view.quickSkills + 48),
                    dnf90_companion_projection::Read32(view.quickSkills + 56),
                    dnf90_companion_projection::Read32(view.quickSkills + 64),
                    dnf90_companion_projection::Read32(view.quickSkills + 72),
                    dnf90_companion_projection::Read32(view.quickSkills + 80),
                    dnf90_companion_projection::Read32(view.quickSkills + 88));
                for (std::size_t row = 0; row < 8; ++row) {
                    const std::size_t base = row * 0x28;
                    if (base + 0x28 > codeSize) break;
                    Log("runtime-key dump +0x%02zX: %08X %08X %08X %08X %08X %08X %08X %08X %08X %08X",
                        base,
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x00),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x04),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x08),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x0C),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x10),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x14),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x18),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x1C),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x20),
                        *reinterpret_cast<std::uint32_t*>(code + base + 0x24));
                }
            }
            const std::uint32_t expectedCode = currentlyBound
                ? Contract::kSkillCodeBias + previousSkills[i] : placeholderCode;
            const std::size_t codeOffset =
                g_native.kRuntimeKeySkillCodeOffset;
            // The shell AIC's original key programs do not carry the projection
            // placeholder: the slot holds either an encoded skill (0x100 + id,
            // e.g. 0x1A9 = skill 169) or an unrelated value on command-style
            // programs (e.g. 0x3E). The field position is what matters, so the
            // observed value is recorded and overwritten instead of gating.
            const std::uint32_t observedPlaceholder =
                *reinterpret_cast<std::uint32_t*>(
                    code + codeOffset);
            if (observedPlaceholder != expectedCode && i == 0) {
                Log("runtime-key rebinding slot=%zu observed=0x%08X expected=0x%08X offset=0x%zX size=%zu",
                    i,
                    observedPlaceholder,
                    expectedCode,
                    codeOffset,
                    codeSize);
            }
            directBytecode[i] = code;
            directBytecodeSize[i] = codeSize;
            directSkillCodeOffset[i] = codeOffset;
            directPrograms[i] = program;

            const std::uint32_t skillId =
                dnf90_companion_projection::Read32(
                    view.quickSkills + i * 8);
            const std::uint32_t skillLevel =
                dnf90_companion_projection::Read32(
                    view.quickSkills + i * 8 + 4);
            if (!ProjectionQuickSkillContract::PairValid(
                    skillId, skillLevel)) {
                Log("runtime-key projection blocked reason=quick-pair slot=%zu id=%u level=%u",
                    i,
                    skillId,
                    skillLevel);
                return false;
            }
            if (skillId != 0 &&
                !Contract::EncodeSkill(
                    skillId,
                    &encodedSkills[i])) {
                Log("runtime-key projection blocked reason=skill-encode slot=%zu id=%u",
                    i,
                    skillId);
                return false;
            }
            directCooldown[i] = dnf90_companion_quickbar::CooldownMS(view.job, skillId);
            if (!directCooldown[i]) {
                auto* front = reinterpret_cast<std::uint8_t*>(programs[currentlyBound
                    ? Contract::kDirectPoolBase + i : i]);
                directCooldown[i] = *reinterpret_cast<std::uint32_t*>(front + 0x64);
            }
        }

        std::size_t applied = 0;
        for (std::size_t i = 0;
             i < Contract::kQuickSlotCount;
             ++i) {
            const bool previouslyBound = previousSkills && previousSkills[i] != 0;
            const bool shouldBind = encodedSkills[i] != 0;
            const std::uint32_t targetCode =
                shouldBind ? encodedSkills[i] : placeholderCode;
            *reinterpret_cast<std::uint32_t*>(
                directBytecode[i] +
                directSkillCodeOffset[i]) =
                targetCode;
            // Native 262B040 reads duration at +0x64 and compares it with
            // +0x68, which 262B1A0 updates when the game accepts an action.
            // Swapping the direct program must carry its cooldown as well.
            *reinterpret_cast<std::uint32_t*>(directPrograms[i] + 0x64) = directCooldown[i];

            if (previouslyBound != shouldBind) {
                void* originalFront = programs[i];
                programs[i] = programs[Contract::kDirectPoolBase + i];
                programs[Contract::kDirectPoolBase + i] = originalFront;
            }
            ++applied;
        }

        Log("runtime-key direct projection applied actor=%p aic=%p slots=%zu programs=%zu placeholder=%u size=%zu code_offset=0x%zX",
            actor,
            aic,
            applied,
            programCount,
            Contract::kPlaceholderSkillId,
            directBytecodeSize[0],
            directSkillCodeOffset[0]);
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("runtime-key projection exception actor=%p code=0x%08X",
            actor,
            GetExceptionCode());
        return false;
    }
}

bool BindAreaCooldownChain(LiveProjectionActor& entry, std::uint8_t* node, AIParameterFn parameter) {
    // Reverse 11..0 chain is reserved for crowd selection in the generated
    // archive. Validate all nodes before allowing purpose filtering there.
    std::uint8_t* chain[12] = {};
    for (int slot = 11; slot >= 0; --slot) {
        if (!node || *reinterpret_cast<void**>(node + 8) != entry.aiVm ||
            *reinterpret_cast<unsigned*>(node + 0x1C) != 57 ||
            *reinterpret_cast<unsigned*>(node + 0x58) != 1 ||
            *reinterpret_cast<int*>(node + 0x0C) != slot ||
            *reinterpret_cast<void**>(node + 0x14)) return false;
        int zero = 0;
        const auto* index = parameter(node + 0x4C, &zero);
        if (!index || *index != static_cast<float>(slot)) return false;
        chain[slot] = node;
        node = *reinterpret_cast<std::uint8_t**>(node + 0x18);
    }
    for (auto* cooldown : chain) {
        bool duplicate = false;
        for (std::size_t i = 0; i < entry.areaCooldownCount; ++i)
            if (entry.areaCooldowns[i] == cooldown) duplicate = true;
        if (!duplicate) {
            if (entry.areaCooldownCount >= 128) return false;
            entry.areaCooldowns[entry.areaCooldownCount++] = cooldown;
        }
    }
    return true;
}

bool BindModeConditions(LiveProjectionActor& entry, std::uint8_t* node,
    AIParameterFn parameter, unsigned int depth, unsigned int& nodes) {
    if (!node) return true;
    if (depth > 64 || ++nodes > 512 || *reinterpret_cast<void**>(node + 8) != entry.aiVm) return false;
    if (*reinterpret_cast<unsigned*>(node + 0x1C) == 57 && *reinterpret_cast<int*>(node + 0x0C) == 11) {
        auto* next = *reinterpret_cast<std::uint8_t**>(node + 0x18);
        if (next && *reinterpret_cast<unsigned*>(next + 0x1C) == 57 && *reinterpret_cast<int*>(next + 0x0C) == 10 &&
            !BindAreaCooldownChain(entry, node, parameter)) return false;
    }
    if (*reinterpret_cast<unsigned*>(node + 0x1C) == 4 && *reinterpret_cast<unsigned*>(node + 0x58) == 1) {
        int zero = 0;
        float* state = parameter(node + 0x4C, &zero);
        if (!state) return false;
        if (*state == 0) {
            bool duplicate = false;
            for (std::size_t i = 0; i < entry.modeConditionCount; ++i)
                if (entry.modeConditions[i] == node) duplicate = true;
            if (!duplicate) {
                if (entry.modeConditionCount >= 8) return false;
                entry.modeConditions[entry.modeConditionCount++] = node;
            }
        }
    }
    return BindModeConditions(entry, *reinterpret_cast<std::uint8_t**>(node + 0x14), parameter, depth + 1, nodes) &&
        BindModeConditions(entry, *reinterpret_cast<std::uint8_t**>(node + 0x18), parameter, depth + 1, nodes);
}

bool IsConditionTreeVm(const void* vm, uintptr_t base) {
    if (!vm) return false;
    if (!g_native.newNative) return true;
    const auto* bytes = static_cast<const unsigned char*>(vm);
    return *reinterpret_cast<const uintptr_t*>(bytes) ==
            base + g_native.kAIControlledVmVtableRva &&
        *reinterpret_cast<const unsigned*>(bytes + 0x664) == 0;
}

bool BindQuickbarPolicy(LiveProjectionActor& entry) {
    if (!g_originalAICondition || !entry.keysReady || !dnf90_companion_quickbar::SupportsQuickbarPolicy(entry.job)) return false;
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    static const unsigned char parameterSignature[] = {0x55,0x8B,0xEC,0x6A,0xFF,0x68,0xD8,0x3E,0xCD,0x03};
    if (!g_native.newNative && memcmp(reinterpret_cast<void*>(base + g_native.kAIParameterRva), parameterSignature, sizeof(parameterSignature))) return false;
    const auto parameter = reinterpret_cast<AIParameterFn>(base + g_native.kAIParameterRva);
    auto* vm = *reinterpret_cast<std::uint8_t**>(reinterpret_cast<std::uint8_t*>(entry.actor) + g_native.kActorVmOffset);
    // The alternate native VM stores unrelated data at the roots offsets.
    if (!IsConditionTreeVm(vm, base)) return false;
    const auto begin = *reinterpret_cast<uintptr_t*>(vm + 0x6CC);
    const auto end = *reinterpret_cast<uintptr_t*>(vm + 0x6D0);
    if (!begin || end < begin || end - begin != 4 * sizeof(void*)) return false;
    auto* roots = reinterpret_cast<std::uint8_t**>(begin);
    auto* state = roots[2];
    if (!state || *reinterpret_cast<unsigned*>(state + 0x1C) != 4) return false;
    auto* party = *reinterpret_cast<std::uint8_t**>(state + 0x14);
    if (!party || *reinterpret_cast<unsigned*>(party + 0x1C) != 47) return false;
    auto* buff = *reinterpret_cast<std::uint8_t**>(party + 0x18);
    // The current EXE uses a checked STL map at +0x4C: its count is
    // map+0x0C (+0x58 in the node), not the unchecked map layout at +0x50.
    // Verified against the live parsed BUFF/cooldown/HP nodes and getter.
    constexpr std::size_t floatMapCountOffset = 0x58;
    if (!buff || *reinterpret_cast<unsigned*>(buff + 0x1C) != 52 ||
        *reinterpret_cast<void**>(buff + 8) != vm || *reinterpret_cast<unsigned*>(buff + floatMapCountOffset) != 2) return false;
    auto* cooldown = *reinterpret_cast<std::uint8_t**>(buff + 0x14);
    if (!cooldown || *reinterpret_cast<unsigned*>(cooldown + 0x1C) != 57 ||
        *reinterpret_cast<unsigned*>(cooldown + floatMapCountOffset) != 1 || *reinterpret_cast<int*>(cooldown + 0x0C) != 1) return false;
    int zero = 0, one = 1;
    float* family = parameter(buff + 0x4C, &zero);
    float* skill = parameter(buff + 0x4C, &one);
    float* slot = parameter(cooldown + 0x4C, &zero);
    // All current stable APCs share this verified placeholder grammar. The
    // owned selector supplies actual profession and learned quickbar roles.
    if (!family || !skill || !slot || *family != 4 || *skill != 7 || *slot != 1) return false;
    auto* heal = roots[0];
    if (!heal || *reinterpret_cast<void**>(heal + 8) != vm ||
        *reinterpret_cast<unsigned*>(heal + 0x1C) != 12 ||
        *reinterpret_cast<std::uint16_t*>(heal + 0x20) != 0x31 ||
        *reinterpret_cast<unsigned*>(heal + floatMapCountOffset) != 1 ||
        *reinterpret_cast<int*>(heal + 0x0C) != -1 || *reinterpret_cast<int*>(heal + 0x10) != -1 ||
        *reinterpret_cast<void**>(heal + 0x14) || *reinterpret_cast<void**>(heal + 0x18)) return false;
    float* threshold = parameter(heal + 0x4C, &zero);
    if (!threshold || *threshold <= 0 || *threshold > 100 || *reinterpret_cast<unsigned*>(heal + 0x1C) == 4) return false;
    entry.aiVm = vm;
    entry.buffCondition = buff;
    entry.buffCooldown = cooldown;
    entry.healCondition = heal;
    entry.actionStateCondition = state;
    entry.buffSkillParameter = skill;
    entry.buffSlotParameter = slot;
    entry.healThresholdParameter = threshold;
    // Destination, movement and combat use parsed state-0 mode predicates.
    // Bind only this APC's VM nodes; keep native state-4 cast protection.
    if (!roots[1] || !roots[3] || *reinterpret_cast<unsigned*>(roots[1] + 0x1C) != 4 ||
        *reinterpret_cast<unsigned*>(roots[3] + 0x1C) != 4) return false;
    unsigned int nodes = 0;
    for (const auto lane : {1, 2, 3})
        if (!BindModeConditions(entry, roots[lane], parameter, 0, nodes)) return false;
    if (entry.modeConditionCount < 4 || entry.areaCooldownCount < 12) return false;
    entry.quickbarPolicyReady = true;
    Log("quickbar policy bound source=%u actor=%p vm=%p job=%u grow=%u heal_threshold=%.0f behavior=%u mode_nodes=%zu area_nodes=%zu",
        entry.source, entry.actor, vm, entry.job, entry.grow, *threshold, entry.aiBehavior, entry.modeConditionCount, entry.areaCooldownCount);
    return true;
}

void RememberLiveProjectionActor(void* owner, void* actor,
    std::uint16_t key, const dnf90_companion_projection::View& view, bool keysReady) {
    LiveProjectionActor entry{};
    entry.source = view.sourceCharacter;
    entry.key = key;
    entry.level = view.level;
    entry.revision = view.revision;
    entry.actor = actor;
    entry.owner = owner;
    entry.aic = *reinterpret_cast<void**>(reinterpret_cast<std::uint8_t*>(actor) + g_native.kActorAicOffset);
    // Keep the owning condition VM even when the optional, resource-specific
    // support selector cannot bind.  The generic cooldown guard below still
    // has enough information to reject empty/unlearned quickbar slots and
    // prevents a stock AIC from falling back to its PVF quick-skill list.
    entry.aiVm = *reinterpret_cast<void**>(reinterpret_cast<std::uint8_t*>(actor) + g_native.kActorVmOffset);
    entry.aiBehavior = view.aiBehavior;
    entry.aiComboPresetHash = view.aiComboPresetHash;
    entry.aiClass = view.aiClass;
    entry.aiComboEnabled = view.aiComboEnabled;
    entry.keysReady = keysReady;
    entry.job = view.job;
    entry.grow = view.grow;
    for (std::size_t i = 0; i < view.skillCount; ++i) {
        const auto id = dnf90_companion_projection::Read32(view.skills + i * 8);
        if (id < 512) entry.skills[id] = dnf90_companion_projection::Read32(view.skills + i * 8 + 4);
    }
    for (std::size_t i = 0; i < view.quickSkillCount && i < 12; ++i)
        entry.quick[i] = dnf90_companion_projection::Read32(view.quickSkills + i * 8);
    __try { BindQuickbarPolicy(entry); }
    __except (EXCEPTION_EXECUTE_HANDLER) {
        entry.quickbarPolicyReady = false;
        Log("quickbar policy binding failed source=%u code=0x%08X", entry.source, GetExceptionCode());
    }
    for (auto& previous : g_liveProjectionActors) {
        if (previous.source == entry.source) { previous = entry; return; }
    }
    if (g_liveProjectionActors.size() < 64) g_liveProjectionActors.push_back(entry);
}

// Room transitions migrate the same APC into the owner's new manager. Resolve
// membership from the current owner, never the manager saved at registration.
// sub_25BCC90 inserts actors into manager+8 (begin +0x0C, end +0x10); +0xBC
// is updated by vfunc +0x70, and +0x50 returns the registered composite key.
bool LiveProjectionActorPresent(const LiveProjectionActor& entry) {
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    void* owner = nullptr;
    int scene = -1;
    if (GetCurrentThreadId() != g_armedThread ||
        !ReadControlledActor(base, &owner) || owner != entry.owner || owner != g_armedActor ||
        !DungeonSceneReady(base, &scene)) return false;
    auto* ownerBytes = reinterpret_cast<std::uint8_t*>(owner);
    auto* manager = *reinterpret_cast<std::uint8_t**>(ownerBytes + g_native.kActorOwnerContextOffset);
    if (!manager) return false;
    const auto begin = *reinterpret_cast<uintptr_t*>(manager + 0x0C);
    const auto end = *reinterpret_cast<uintptr_t*>(manager + 0x10);
    if (!begin || end < begin || (end - begin) % sizeof(void*) ||
        (end - begin) / sizeof(void*) > 4096) return false;
    bool found = false;
    for (auto cursor = begin; cursor < end; cursor += sizeof(void*)) {
        if (*reinterpret_cast<void**>(cursor) == entry.actor) { found = true; break; }
    }
    if (!found || entry.actor == owner) return false;
    auto* actor = reinterpret_cast<std::uint8_t*>(entry.actor);
    if (*reinterpret_cast<void**>(actor + g_native.kActorOwnerContextOffset) != manager) return false;
    if (*reinterpret_cast<void**>(actor + g_native.kActorAicOffset) != entry.aic) return false;
    auto** table = *reinterpret_cast<void***>(actor);
    using KeyFn = std::uint32_t (__thiscall*)(void*);
    return static_cast<std::uint16_t>(reinterpret_cast<KeyFn>(table[g_native.kActorKeyVtableOffset / 4])(actor)) == entry.key;
}

bool QuickbarProgramReady(const LiveProjectionActor& entry, std::size_t slot) {
    if (slot >= 12 || !entry.aic) return false;
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    static const unsigned char coolSignature[] = {0x56,0x8B,0xF1,0x80,0x7E,0x6D,0x00};
    static const unsigned char readySignature[] = {0x55,0x8B,0xEC,0x56,0x8B,0xF1,0x83,0x7E,0x4C,0x00};
    if (!g_native.newNative && (memcmp(reinterpret_cast<void*>(base + g_native.kAICooldownRva), coolSignature, sizeof(coolSignature)) ||
        memcmp(reinterpret_cast<void*>(base + g_native.kAIKeyReadyRva), readySignature, sizeof(readySignature)))) return false;
    auto* aic = reinterpret_cast<std::uint8_t*>(entry.aic);
    const auto begin = *reinterpret_cast<uintptr_t*>(aic + g_native.kAicRuntimeKeyProgramVectorOffset);
    const auto end = *reinterpret_cast<uintptr_t*>(aic + g_native.kAicRuntimeKeyProgramVectorOffset + 4);
    if (!begin || end < begin || (end - begin) % sizeof(void*) ||
        !ProjectionRuntimeKeyContract::ProgramCountValid((end - begin) / sizeof(void*))) return false;
    auto* program = reinterpret_cast<std::uint8_t**>(begin)[slot];
    if (!program) return false;
    const auto code = *reinterpret_cast<uintptr_t*>(program + 8);
    const auto codeEnd = *reinterpret_cast<uintptr_t*>(program + 12);
    if (!code || codeEnd < code) return false;
    const std::size_t codeSize = codeEnd - code;
    if (codeSize < kMinDirectKeyBytecodeSize || codeSize > kMaxDirectKeyBytecodeSize) return false;
    const std::uint32_t expectedSkillCode = 0x100u + entry.quick[slot];
    const std::size_t codeOffset = g_native.kRuntimeKeySkillCodeOffset;
    if (*reinterpret_cast<std::uint32_t*>(code + codeOffset) != expectedSkillCode) return false;
    const auto cooling = reinterpret_cast<AIConditionFn>(base + g_native.kAICooldownRva);
    const auto ready = reinterpret_cast<KeyStepReadyFn>(base + g_native.kAIKeyReadyRva);
    return cooling(program) == 0 && ready(program, 2) != 0;
}

void SetOriginalAICondition(void* original) {
    g_originalAICondition = reinterpret_cast<AIConditionFn>(original);
    Log("quickbar condition hook original=%p", original);
}

std::uint32_t NativeSupportActionTimestamp(const LiveProjectionActor& entry, std::uint32_t id) {
    auto* aic = reinterpret_cast<std::uint8_t*>(entry.aic);
    const auto begin = *reinterpret_cast<uintptr_t*>(aic + g_native.kAicRuntimeKeyProgramVectorOffset);
    const auto end = *reinterpret_cast<uintptr_t*>(aic + g_native.kAicRuntimeKeyProgramVectorOffset + 4);
    if (!begin || end < begin || (end - begin) % sizeof(void*) ||
        !ProjectionRuntimeKeyContract::ProgramCountValid((end - begin) / sizeof(void*))) return 0;
    auto** programs = reinterpret_cast<std::uint8_t**>(begin);
    std::uint32_t latest = 0;
    for (std::size_t slot = 0; slot < 12; ++slot) {
        if (entry.quick[slot] == id && programs[slot]) {
            const auto started = *reinterpret_cast<std::uint32_t*>(programs[slot] + 0x68);
            if (started > latest) latest = started;
        }
    }
    return latest;
}

bool NativeSupportBuffHandled(const LiveProjectionActor& entry, std::uint32_t id) {
    if (!dnf90_companion_quickbar::HasNativeBuffCheck(entry.job, id)) {
        return dnf90_companion_quickbar::SupportDispatchHandled(entry.job, id, entry.observedClock,
            NativeSupportActionTimestamp(entry, id));
    }
    const float saved = *entry.buffSkillParameter;
    auto** recipient = reinterpret_cast<void**>(reinterpret_cast<std::uint8_t*>(entry.aiVm) + 0x4D4);
    void* const savedRecipient = *recipient;
    bool present = false;
    __try {
        // Native 262EB80 reads VM+0x4D4. The PVF party selection currently
        // resolves to the APC itself; support policy must inspect its owner.
        *recipient = entry.owner;
        *entry.buffSkillParameter = static_cast<float>(id);
        present = g_originalAICondition(entry.buffCondition) != 0;
    } __finally {
        *entry.buffSkillParameter = saved;
        *recipient = savedRecipient;
    }
    return present;
}

bool NativeLeaderNeedsHealing(const LiveProjectionActor& entry) {
    auto** recipient = reinterpret_cast<void**>(reinterpret_cast<std::uint8_t*>(entry.aiVm) + 0x4D4);
    void* const savedRecipient = *recipient;
    bool needsHealing = false;
    __try {
        *recipient = entry.owner;
        needsHealing = g_originalAICondition(entry.healCondition) != 0;
    } __finally {
        *recipient = savedRecipient;
    }
    return needsHealing;
}

bool ReadNativeActorClock(const LiveProjectionActor& entry, std::uint32_t& now) {
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    static const unsigned char clockAddress[] = {0x8D,0x41,0x5C,0xC3};
    static const unsigned char clockRead[] = {0x55,0x8B,0xEC,0x83,0xEC,0x10,0x56,0x8B,0xF1};
    if (!g_native.newNative && (memcmp(reinterpret_cast<void*>(base + g_native.kActorClockRva), clockAddress, sizeof(clockAddress)) ||
        memcmp(reinterpret_cast<void*>(base + g_native.kClockReadRva), clockRead, sizeof(clockRead)))) return false;
    // Same getter pair used by native key cooldown 262B040. Never decode
    // the encrypted timer or maintain an unrelated wall-clock substitute.
    using ClockAddressFn = void* (__thiscall*)(void*);
    using ClockReadFn = std::uint32_t (__thiscall*)(void*);
    auto* clock = reinterpret_cast<ClockAddressFn>(base + g_native.kActorClockRva)(entry.actor);
    if (!clock) return false;
    now = reinterpret_cast<ClockReadFn>(base + g_native.kClockReadRva)(clock);
    return true;
}

int ReadNativeSelfHpPercent(const LiveProjectionActor& entry) {
    auto** recipient = reinterpret_cast<void**>(reinterpret_cast<std::uint8_t*>(entry.aiVm) + 0x4D4);
    void* const savedRecipient = *recipient;
    const float savedThreshold = *entry.healThresholdParameter;
    int low = 0, high = 100;
    __try {
        *recipient = entry.actor;
        // Reuse the verified native percentage predicate rather than guessing
        // encrypted HP offsets. At most seven comparisons, once per think.
        while (low < high) {
            const int middle = (low + high + 1) / 2;
            *entry.healThresholdParameter = static_cast<float>(middle);
            if (g_originalAICondition(entry.healCondition)) high = middle - 1;
            else low = middle;
        }
    } __finally {
        *entry.healThresholdParameter = savedThreshold;
        *recipient = savedRecipient;
    }
    return low;
}

bool CompanionStatProbeEnabled() {
    // Not cached: the flag may appear after the client started, and this is
    // checked at most once per companion actor spawn.
    return CompanionFlagFilePresent(L"90CN_stat_probe.enabled");
}

void LogCompanionStatHex(const unsigned char* base, std::size_t bytes) {
    char line[256] = {};
    std::size_t used = 0;
    for (std::size_t i = 0; i < bytes && used + 4 < sizeof(line); ++i) {
        used += static_cast<std::size_t>(snprintf(
            line + used, sizeof(line) - used, "%02X ", base[i]));
    }
    Log("stat-probe hex %s", line);
}

struct CompanionStatHit {
    char kind[12];
    std::uint32_t value;
    long long address;
};

struct CompanionStatTarget {
    const char* field;
    std::uint32_t value;
};

// The blob carries the four dimensions as s16*10, but the client divides them
// by 10 before storing, so both forms are searched; HP/MP are also tried as
// float.  Values above 0xFFFF are never matched as u16 (a truncated match is
// pure noise).
int BuildCompanionStatTargets(
    std::uint32_t hp, std::uint32_t mp,
    std::int16_t str, std::int16_t vit, std::int16_t intel, std::int16_t spr,
    CompanionStatTarget* out)
{
    int n = 0;
    const auto add = [&](const char* field, std::uint32_t value) {
        if (value != 0 && n < 24) { out[n].field = field; out[n].value = value; ++n; }
    };
    add("hp", hp);
    add("mp", mp);
    add("str", static_cast<std::uint32_t>(str));
    add("str", static_cast<std::uint32_t>(str) / 10u);
    add("vit", static_cast<std::uint32_t>(vit));
    add("vit", static_cast<std::uint32_t>(vit) / 10u);
    add("int", static_cast<std::uint32_t>(intel));
    add("int", static_cast<std::uint32_t>(intel) / 10u);
    add("spr", static_cast<std::uint32_t>(spr));
    add("spr", static_cast<std::uint32_t>(spr) / 10u);
    return n;
}

bool ClassifyCompanionStatWord(
    const unsigned char* p, const CompanionStatTarget* targets, int targetCount,
    const char** field, std::uint32_t* value)
{
    const std::uint32_t word = *reinterpret_cast<const std::uint32_t*>(p);
    const std::uint16_t half = *reinterpret_cast<const std::uint16_t*>(p);
    const float single = *reinterpret_cast<const float*>(p);
    for (int i = 0; i < targetCount; ++i) {
        const std::uint32_t candidate = targets[i].value;
        if (word == candidate) {
            *field = targets[i].field;
            *value = word;
            return true;
        }
        if (candidate <= 0xFFFFu && half == static_cast<std::uint16_t>(candidate)) {
            *field = targets[i].field;
            *value = half;
            return true;
        }
        if (single == static_cast<float>(candidate)) {
            *field = targets[i].field;
            *value = candidate;
            return true;
        }
    }
    return false;
}

void DumpCompanionStatWindow(std::uintptr_t address) {
    __try {
        LogCompanionStatHex(reinterpret_cast<const unsigned char*>(address), 0x80);
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("stat-probe hex skipped (unreadable window)");
    }
}

// Scan one region for the blob values.  A hit is only reported when a second,
// different value sits within +/-0x100 of it: a lone match in an unrelated
// sequential table is almost always a coincidence.
void ScanCompanionStatRegion(
    const char* label, std::uintptr_t base, std::uintptr_t back, std::uintptr_t forward,
    const CompanionStatTarget* targets, int targetCount)
{
    const std::uintptr_t start = base - back;
    const std::uintptr_t end = base + forward;
    CompanionStatHit hits[96] = {};
    int n = 0;
    for (std::uintptr_t cursor = start; cursor < end;) {
        MEMORY_BASIC_INFORMATION mbi = {};
        if (VirtualQuery(reinterpret_cast<LPCVOID>(cursor), &mbi, sizeof(mbi)) != sizeof(mbi)) break;
        const std::uintptr_t regionEnd =
            reinterpret_cast<std::uintptr_t>(mbi.BaseAddress) + mbi.RegionSize;
        const bool readable = mbi.State == MEM_COMMIT &&
            (mbi.Protect & (PAGE_READONLY | PAGE_READWRITE | PAGE_WRITECOPY |
                            PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE)) != 0 &&
            (mbi.Protect & PAGE_GUARD) == 0;
        if (readable) {
            const std::uintptr_t scanBegin = cursor > start ? cursor : start;
            const std::uintptr_t scanEnd = regionEnd < end ? regionEnd : end;
            __try {
                for (std::uintptr_t addr = scanBegin; addr + 4 <= scanEnd; addr += 2) {
                    const char* field = nullptr;
                    std::uint32_t value = 0;
                    if (ClassifyCompanionStatWord(
                            reinterpret_cast<const unsigned char*>(addr),
                            targets, targetCount, &field, &value) && n < 96) {
                        hits[n].value = value;
                        hits[n].address = static_cast<long long>(addr);
                        strncpy_s(hits[n].kind, field, _TRUNCATE);
                        ++n;
                    }
                }
            } __except (EXCEPTION_EXECUTE_HANDLER) {
            }
        }
        if (regionEnd <= cursor) break;
        cursor = regionEnd;
    }
    int confirmed = 0;
    std::uintptr_t dumpAt = 0;
    for (int i = 0; i < n && confirmed < 10; ++i) {
        bool ok = false;
        for (int j = 0; j < n && !ok; ++j) {
            if (j == i || strcmp(hits[i].kind, hits[j].kind) == 0) continue;
            const long long d = hits[j].address - hits[i].address;
            if (d > -0x100 && d < 0x100) ok = true;
        }
        if (!ok) continue;
        if (dumpAt == 0) dumpAt = static_cast<std::uintptr_t>(hits[i].address);
        ++confirmed;
        Log("stat-probe %s off=%+lld addr=0x%08llX kind=%s value=%u",
            label,
            static_cast<long long>(hits[i].address) - static_cast<long long>(base),
            hits[i].address, hits[i].kind, hits[i].value);
    }
    Log("stat-probe %s total=%d confirmed=%d", label, n, confirmed);
    if (dumpAt) DumpCompanionStatWindow(dumpAt - 0x20);
}

// Scan the actor, its UserInfo, its AIC and its ability object for the values
// that were just written through the 92-byte stat blob.  Read-only:
// VirtualQuery validates pages and every read is SEH-guarded.
void ProbeCompanionStatWindow(void* actor) {
    if (!actor || !g_hasLastCompanionStatBlob) return;
    const auto* blob = g_lastCompanionStatBlob;
    const std::uint32_t hp = *reinterpret_cast<const std::uint32_t*>(blob);
    const std::uint32_t mp = *reinterpret_cast<const std::uint32_t*>(blob + 4);
    const std::int16_t str = *reinterpret_cast<const std::int16_t*>(blob + 8);
    const std::int16_t vit = *reinterpret_cast<const std::int16_t*>(blob + 10);
    const std::int16_t intel = *reinterpret_cast<const std::int16_t*>(blob + 12);
    const std::int16_t spr = *reinterpret_cast<const std::int16_t*>(blob + 14);
    Log("stat-probe scan actor=%p hp=%u mp=%u str=%d vit=%d int=%d spr=%d",
        actor, hp, mp, str, vit, intel, spr);

    CompanionStatTarget targets[24] = {};
    const int targetCount =
        BuildCompanionStatTargets(hp, mp, str, vit, intel, spr, targets);

    ScanCompanionStatRegion("actor", reinterpret_cast<std::uintptr_t>(actor),
        0x4000, 0x200000, targets, targetCount);

    // Legacy 2018 base-table slots: +0xB9C = 装备属性, +0x646C = 物品栏,
    // +0x6F54 = actor VM.  Dump the bytes at each slot verbatim and, when the
    // slot holds a plausible pointer, scan around the pointed object too.
    {
        struct LegacySlot {
            const char* name;
            std::size_t offset;
        };
        const LegacySlot legacy[] = {
            {"equipAttrs", 0xB9C},
            {"inventory", 0x646C},
            {"vm", 0x6F54},
        };
        for (const auto& slot : legacy) {
            std::uintptr_t target = 0;
            __try {
                const auto* at =
                    reinterpret_cast<const unsigned char*>(actor) + slot.offset;
                target = *reinterpret_cast<const std::uint32_t*>(at);
                LogCompanionStatHex(at, 0x40);
            } __except (EXCEPTION_EXECUTE_HANDLER) {
                target = 0;
            }
            Log("stat-probe legacy %s +0x%X target=0x%08X",
                slot.name, static_cast<unsigned>(slot.offset),
                static_cast<unsigned>(target));
            if (target >= 0x00010000u && target < 0x7FFF0000u) {
                ScanCompanionStatRegion(slot.name, target,
                    0x4000, 0x8000, targets, targetCount);
            }
        }
    }

    void* info = nullptr;
    void* aic = nullptr;
    void* ability = nullptr;
    __try {
        auto** table = *reinterpret_cast<void***>(actor);
        if (table) {
            using UserInfoFn = void* (__thiscall*)(void*);
            using AbilityFn = void* (__thiscall*)(void*, int);
            const void* getter = table[g_native.kActorUserInfoVtableOffset / 4];
            info = reinterpret_cast<UserInfoFn>(const_cast<void*>(getter))(actor);
            const void* abilityGetter = table[g_native.kActorAbilityVtableOffset / 4];
            ability = reinterpret_cast<AbilityFn>(const_cast<void*>(abilityGetter))(actor, 0);
            aic = *reinterpret_cast<void**>(
                reinterpret_cast<unsigned char*>(actor) + g_native.kActorAicOffset);
        }
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        info = nullptr;
        aic = nullptr;
        ability = nullptr;
    }
    Log("stat-probe info=%p aic=%p ability=%p", info, aic, ability);
    if (info) {
        ScanCompanionStatRegion("info", reinterpret_cast<std::uintptr_t>(info),
            0x1000, 0x8000, targets, targetCount);
    }
    if (aic) {
        ScanCompanionStatRegion("aic", reinterpret_cast<std::uintptr_t>(aic),
            0x1000, 0x8000, targets, targetCount);
    }
    if (ability) {
        ScanCompanionStatRegion("ability", reinterpret_cast<std::uintptr_t>(ability),
            0x2000, 0x10000, targets, targetCount);
    }
}

void ObserveNativeCombatState(LiveProjectionActor& entry) {
    if (entry.actor && entry.actor != g_companionStatProbedActor &&
        CompanionStatProbeEnabled()) {
        g_companionStatProbedActor = entry.actor;
        ProbeCompanionStatWindow(entry.actor);
    }
    std::uint32_t now = 0;
    if (!ReadNativeActorClock(entry, now)) return;
    const int hp = ReadNativeSelfHpPercent(entry);
    if (entry.selfHpPercent < 0) {
        Log("quickbar self vitals source=%u actor=%p hp_percent=%d native_time=%u",
            entry.source, entry.actor, hp, now);
    } else if (hp < entry.selfHpPercent) {
        entry.selfHurtAt = now;
        entry.selfHurtRecorded = true;
        Log("quickbar self damage source=%u actor=%p hp_before=%d hp_now=%d native_time=%u",
            entry.source, entry.actor, entry.selfHpPercent, hp, now);
    }
    entry.selfHpPercent = hp;
    entry.observedClock = now;
    entry.recentlyHurt = entry.selfHurtRecorded &&
        dnf90_companion_quickbar::NativeActionRecent(now, entry.selfHurtAt, 1600);
}

bool NativeCombatRecentlyStarted(const LiveProjectionActor& entry) {
    auto* aic = reinterpret_cast<std::uint8_t*>(entry.aic);
    const auto begin = *reinterpret_cast<uintptr_t*>(aic + g_native.kAicRuntimeKeyProgramVectorOffset);
    const auto end = *reinterpret_cast<uintptr_t*>(aic + g_native.kAicRuntimeKeyProgramVectorOffset + 4);
    if (!begin || end < begin || (end - begin) % sizeof(void*) ||
        !ProjectionRuntimeKeyContract::ProgramCountValid((end - begin) / sizeof(void*))) return false;
    auto** programs = reinterpret_cast<std::uint8_t**>(begin);
    constexpr std::size_t basicIndex = ProjectionRuntimeKeyContract::kQuickSlotCount * 2;
    for (std::size_t i = 0; i <= basicIndex; ++i) {
        if (i >= 12 && i != basicIndex) continue; // Direct pool is not an action slot.
        if (i < 12 && dnf90_companion_quickbar::Classify(entry.job, entry.quick[i], entry.grow) !=
            dnf90_companion_quickbar::Purpose::Combat) continue;
        if (!programs[i]) continue;
        const auto started = *reinterpret_cast<std::uint32_t*>(programs[i] + 0x68);
        if (started && dnf90_companion_quickbar::NativeActionRecent(entry.observedClock, started, 3000)) return true;
    }
    return false;
}

unsigned char EvaluateQuickbarCondition(void* condition) {
    const auto original = g_originalAICondition;
    if (!original || !condition) return 0;
    const LONG evaluations = InterlockedIncrement(&g_conditionEvaluations);
    if (evaluations % 600 == 0) {
        Log("companion stats condition_evals=%ld support_selections=%ld",
            evaluations,
            static_cast<long>(g_supportSelections));
    }
    __try {
        auto* node = reinterpret_cast<std::uint8_t*>(condition);
        const unsigned int type = *reinterpret_cast<unsigned int*>(node + 0x1C);
        if (type != 4 && type != 52 && type != 57) return original(condition);
        for (auto& entry : g_liveProjectionActors) {
            if (!entry.aiVm || *reinterpret_cast<void**>(node + 8) != entry.aiVm ||
                !LiveProjectionActorPresent(entry)) continue;
            if (!entry.quickbarPolicyReady) {
                // BindQuickbarPolicy is intentionally fail-closed because its
                // buff/mode tree is PVF-specific.  A missing binding must not
                // re-enable the native AIC's unrelated [quick skill] list.
                // Block the support selector itself as well; otherwise its
                // fixed PVF placeholder can still return a slot before the
                // twelve-slot policy gets a chance to validate it.
                if (type == 52) return 1;
                // Type-57 nodes carry the generated CompanionSlot index; only
                // allow a slot whose ID is present in the projected twelve
                // positions and in the projected learned-skill vector.
                if (type == 57) {
                    const int slot = *reinterpret_cast<int*>(node + 0x0C);
                    if (slot >= 0 && slot < 12) {
                        const auto id = entry.quick[slot];
                        if (id == 0 || id >= 512 || !entry.skills[id]) return 1;
                    }
                }
                continue;
            }
            if (type == 4) {
                if (condition == entry.actionStateCondition) ObserveNativeCombatState(entry);
                // Do not force the native mode gate closed. In aggressive mode
                // this used to answer 0 on every evaluation, which shows up as
                // the companion taking one step and stopping, so the native
                // decision is kept untouched.
                return original(condition);
            }
            // Native combat cooldown chains must skip empty slots and support
            // skills. They remain available through the leader support lane.
            if (type == 57) {
                if (condition == entry.buffCooldown) return original(condition);
                const int slot = *reinterpret_cast<int*>(node + 0x0C);
                if (slot >= 0 && slot < 12) {
                    const auto id = entry.quick[slot];
                    const auto purpose = dnf90_companion_quickbar::Classify(entry.job, id, entry.grow);
                    if (id >= 512 || !entry.skills[id] ||
                        !dnf90_companion_quickbar::CombatPurposeAllowed(entry.aiBehavior, purpose)) return 1;
                    for (std::size_t i = 0; i < entry.areaCooldownCount; ++i)
                        if (condition == entry.areaCooldowns[i] && !dnf90_companion_quickbar::IsAreaCombat(entry.job, id)) return 1;
                }
                return original(condition);
            }
            // r12 contains repeated fixed buff nodes in fallback branches.
            // One owned node selects the current quickbar; the remaining
            // fixed checks must not cast whichever skill moved into slot 5.
            if (condition != entry.buffCondition) return 1;
            const bool supportAllowed = dnf90_companion_quickbar::OrdinarySupportAllowed(entry.aiBehavior,
                NativeCombatRecentlyStarted(entry), entry.recentlyHurt);
            const int selected = supportAllowed ? dnf90_companion_quickbar::SelectSupportBuff(entry.job, entry.quick, entry.skills,
                [&](std::uint32_t id) {
                    return NativeSupportBuffHandled(entry, id);
                }, [&](std::size_t slot) { return QuickbarProgramReady(entry, slot); }, entry.grow) : -1;
            int chosen = selected;
            if (chosen < 0 && !entry.recentlyHurt && NativeLeaderNeedsHealing(entry)) {
                for (std::size_t slot = 0; slot < 12; ++slot) {
                    const auto id = entry.quick[slot];
                    const auto purpose = dnf90_companion_quickbar::Classify(entry.job, id, entry.grow);
                    if (id < 512 && entry.skills[id] &&
                        (purpose == dnf90_companion_quickbar::Purpose::Heal ||
                         purpose == dnf90_companion_quickbar::Purpose::DefensiveSupport) &&
                        QuickbarProgramReady(entry, slot)) { chosen = static_cast<int>(slot); break; }
                }
            }
            if (chosen < 0 && !entry.recentlyHurt && entry.selfHpPercent >= 0 &&
                entry.selfHpPercent < *entry.healThresholdParameter) {
                for (std::size_t slot = 0; slot < 12; ++slot) {
                    const auto id = entry.quick[slot];
                    if (id < 512 && entry.skills[id] &&
                        dnf90_companion_quickbar::Classify(entry.job, id, entry.grow) == dnf90_companion_quickbar::Purpose::SelfHeal &&
                        QuickbarProgramReady(entry, slot)) { chosen = static_cast<int>(slot); break; }
                }
            }
            if (chosen < 0 && supportAllowed) {
                chosen = dnf90_companion_quickbar::SelectSupportAwakening(entry.job, entry.quick, entry.skills,
                    [&](std::size_t slot) { return QuickbarProgramReady(entry, slot); }, entry.grow);
            }
            entry.supportActionPending = chosen >= 0;
            if (chosen >= 0) InterlockedIncrement(&g_supportSelections);
            if (chosen < 0) { entry.lastChosenSkill = 0; return 1; }
            *entry.buffSlotParameter = static_cast<float>(chosen);
            *reinterpret_cast<int*>(reinterpret_cast<std::uint8_t*>(entry.buffCooldown) + 0x0C) = chosen;
            const auto id = entry.quick[chosen];
            if (entry.lastChosenSkill != id) {
                Log("quickbar support selected source=%u actor=%p slot=%d skill=%u purpose=%u", entry.source,
                    entry.actor, chosen, id, static_cast<unsigned>(dnf90_companion_quickbar::Classify(entry.job, id, entry.grow)));
                entry.lastChosenSkill = id;
            }
            return 0;
        }
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("quickbar condition selection failed condition=%p code=0x%08X; preserving native decision", condition, GetExceptionCode());
    }
    return original(condition);
}

unsigned char __fastcall ProxyAICondition(void* condition, void* /*unusedEdx*/) {
    const auto original = g_originalAICondition;
    if (!original || !condition) return 0;
    // A town-return/retry can leave the quickbar condition pointer at a stale
    // low address (the observed 0x03508299 crash has ecx/esi=0x38). Never pass
    // that object into the native evaluator.
    if (reinterpret_cast<std::uintptr_t>(condition) < 0x10000) {
        Log("quickbar condition ignored stale pointer=%p", condition);
        return 0;
    }
    // Native skill readiness can evaluate another condition. Let that nested
    // call use the original evaluator instead of starting a second selection.
    if (g_quickbarSelectionActive) return original(condition);
    unsigned char result = 0;
    g_quickbarSelectionActive = true;
    __try {
        result = EvaluateQuickbarCondition(condition);
    } __finally {
        g_quickbarSelectionActive = false;
    }
    return result;
}

// Same encrypted ability-level assignment as sub_24DC280, using the native
// alignment-specific setters. Resolve all writers before changing any level.
using NativeLevelWriteFn = void (__thiscall*)(void*, const std::uint32_t*, void*);
NativeLevelWriteFn ResolveNativeLevelWriter(void* target) {
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    const uintptr_t alignment = reinterpret_cast<uintptr_t>(target) & 15;
    const uintptr_t rvas[] = {0x030DB910, 0x030DB990, 0x030DBA10, 0x030DBA90};
    const uintptr_t newRvas[] = {0x033DF130, 0x033DF1B0, 0x033DF230, 0x033DF2B0};
    const uintptr_t rva = alignment <= 12 && alignment % 4 == 0
        ? (g_native.newNative ? newRvas : rvas)[alignment / 4]
        : (g_native.newNative ? 0x033DF010 : 0x030DB7F0);
    const unsigned char signature[] = {0x55,0x8B,0xEC,0xA1,0xB0,0x74,0x2F,0x05,0x40,0x8B,0xD0,0xC1,0xEA,0x08};
    if (!g_native.newNative && memcmp(reinterpret_cast<void*>(base + rva), signature, sizeof(signature))) return nullptr;
    return reinterpret_cast<NativeLevelWriteFn>(base + rva);
}

bool SetLiveProjectionLevel(const LiveProjectionActor& entry, std::uint16_t level) {
    auto* actor = reinterpret_cast<std::uint8_t*>(entry.actor);
    auto* aic = reinterpret_cast<std::uint8_t*>(entry.aic);
    auto** table = *reinterpret_cast<void***>(actor);
    using AbilityFn = void* (__thiscall*)(void*, int);
    using UserInfoFn = void* (__thiscall*)(void*);
    void* ability = reinterpret_cast<AbilityFn>(table[g_native.kActorAbilityVtableOffset / 4])(actor, 0);
    auto* info = reinterpret_cast<std::uint8_t*>(
        reinterpret_cast<UserInfoFn>(table[g_native.kActorUserInfoVtableOffset / 4])(actor));
    // APC +CF4 (sub_24814B0) returns its AIC+0x100C UserInfo. Verify the
    // exact instance and its registered key (sub_1BF6D00), never a roster row.
    if (!ability || !info || info != *reinterpret_cast<void**>(aic + g_native.kAicUserInfoOffset) ||
        *reinterpret_cast<std::uint16_t*>(info + g_native.kUserInfoKeyOffset) != entry.key) return false;
    // sub_23EB0D0 draws Lv from UserInfo+0x18+0x14, independently of the
    // combat ability. Native APC refresh sub_34922A0 synchronizes the AIC
    // and UserInfo from actor+0x6F1C; keep all three current without rerunning
    // its spawn/stat/skill initialization or replacing this live actor.
    void* targets[] = {ability, aic + 0x1C, info + g_native.kUserInfoLevelOffset};
    NativeLevelWriteFn writers[3]{};
    for (std::size_t i = 0; i < 3; ++i) {
        writers[i] = ResolveNativeLevelWriter(targets[i]);
        if (!writers[i]) return false;
    }
    std::uint32_t value = level;
    for (std::size_t i = 0; i < 3; ++i)
        writers[i](targets[i], &value, reinterpret_cast<std::uint8_t*>(targets[i]) + 4);
    // Same plain assignment as the native APC level setter sub_2482890.
    *reinterpret_cast<std::uint32_t*>(actor + g_native.kActorSpawnLevelOffset) = value;
    return true;
}

// Apply the PVF stat blob carried by a userinfo mode1 body directly through the
// actor's own stats vtable. The native userinfo dispatcher cannot be used for
// projected APC actors (it faults while binding their UserInfo), while this
// path is the one the progression packet already exercises successfully.
bool ApplyProjectionStatVector(
    void* actor,
    const unsigned char* mode1,
    std::size_t mode1Length)
{
    constexpr std::size_t kMode1StatBlobOffset = 31;
    constexpr std::size_t kMode1StatBlobSize = 92;
    if (!actor || !mode1 ||
        mode1Length < kMode1StatBlobOffset + kMode1StatBlobSize) {
        return false;
    }
    auto** table = *reinterpret_cast<void***>(actor);
    using StatsFn = void (__thiscall*)(void*, const void*);
    using RecalculateFn = void (__thiscall*)(void*, int);
    alignas(16) unsigned char stats[kMode1StatBlobSize];
    memcpy(stats, mode1 + kMode1StatBlobOffset, sizeof(stats));
    memcpy(g_lastCompanionStatBlob, stats, sizeof(stats));
    g_hasLastCompanionStatBlob = true;
    {
        const auto* words = reinterpret_cast<const std::uint32_t*>(stats);
        Log("projection stat vector a=%u b=%u c=%u d=%u e=%u f=%u g=%u h=%u i=%u j=%u k=%u l=%u m=%u n=%u o=%u p=%u",
            words[0], words[1], words[2], words[3], words[4], words[5], words[6], words[7],
            words[8], words[9], words[10], words[11], words[12], words[13], words[14], words[15]);
    }
    reinterpret_cast<StatsFn>(table[g_native.kActorStatsVtableOffset / 4])(actor, stats);
    reinterpret_cast<RecalculateFn>(table[g_native.kActorRecalculateVtableOffset / 4])(actor, 1);
    return true;
}

bool ApplyLiveProjectionProgression(const dnf90_companion_projection::View& view) {
    if (!view.progression || !view.present) return false;
    for (auto& entry : g_liveProjectionActors) {
        if (entry.source != view.sourceCharacter || entry.revision != view.revision) continue;
        __try {
            if (!LiveProjectionActorPresent(entry) || view.level < entry.level) {
                Log("progression skipped source=%u reason=stale-or-retired-actor", view.sourceCharacter);
                return false;
            }
            if (!entry.keysReady || view.quickSkillCount != 12) return false;
            // The AIC is an instance copy created by ProxyAicCopy. Keep its
            // learned/quick vectors current for native room lifecycle reads,
            // while leaving template, name and all worn equipment untouched.
            auto* aic = reinterpret_cast<std::uint8_t*>(entry.aic);
            uintptr_t skillBegin = 0, skillEnd = 0, skillCapacity = 0;
            uintptr_t quickBegin = 0, quickEnd = 0, quickCapacity = 0;
            bool grew = false;
            if (!EnsureNativeVectorCapacity(aic, g_native.kAicSkillVectorObjectOffset, 8, view.skillCount,
                    g_native.kNativeSkillVectorAllocateRva, &skillBegin, &skillEnd, &skillCapacity, &grew) ||
                !EnsureNativeVectorCapacity(aic, g_native.kAicQuickSkillVectorObjectOffset, 8, view.quickSkillCount,
                    g_native.kNativeSkillVectorAllocateRva, &quickBegin, &quickEnd, &quickCapacity, &grew)) return false;
            // Validate/switch only our per-instance direct-key programs. Existing
            // skills keep their native objects/cooldowns; only changed ranks learn.
            if (!ApplyDynamicRuntimeKeyPrograms(entry.actor, view, entry.quick)) return false;
            for (std::size_t i = 0; i < 12; ++i)
                entry.quick[i] = dnf90_companion_projection::Read32(view.quickSkills + i * 8);
            if (!SetLiveProjectionLevel(entry, view.level)) {
                Log("progression skipped source=%u reason=level-userinfo-unavailable", view.sourceCharacter);
                return false;
            }
            auto** table = *reinterpret_cast<void***>(entry.actor);
            using ExpFn = void (__thiscall*)(void*, std::uint64_t, int);
            reinterpret_cast<ExpFn>(table[g_native.kActorExpVtableOffset / 4])(entry.actor, view.experience, view.level);
            using LearnFn = void (__thiscall*)(void*, std::uint32_t, std::uint32_t);
            unsigned learned = 0;
            for (std::size_t i = 0; i < view.skillCount; ++i) {
                const auto id = dnf90_companion_projection::Read32(view.skills + i * 8);
                const auto rank = dnf90_companion_projection::Read32(view.skills + i * 8 + 4);
                if (entry.skills[id] == rank) continue;
                reinterpret_cast<LearnFn>(table[g_native.kActorLearnVtableOffset / 4])(entry.actor, id, rank);
                entry.skills[id] = rank;
                ++learned;
            }
            using StatsFn = void (__thiscall*)(void*, const void*);
            using RecalculateFn = void (__thiscall*)(void*, int);
            alignas(16) unsigned char stats[92];
            memcpy(stats, view.mode1 + 31, sizeof(stats));
            reinterpret_cast<StatsFn>(table[g_native.kActorStatsVtableOffset / 4])(entry.actor, stats);
            reinterpret_cast<RecalculateFn>(table[g_native.kActorRecalculateVtableOffset / 4])(entry.actor, 1);
            if (view.skillCount) memcpy(reinterpret_cast<void*>(skillBegin), view.skills, view.skillCount * 8);
            memcpy(reinterpret_cast<void*>(quickBegin), view.quickSkills, view.quickSkillCount * 8);
            *reinterpret_cast<uintptr_t*>(aic + g_native.kAicSkillVectorOffset + 4) = skillBegin + view.skillCount * 8;
            *reinterpret_cast<uintptr_t*>(aic + g_native.kAicQuickSkillVectorOffset + 4) = quickBegin + view.quickSkillCount * 8;
            entry.lastChosenSkill = 0;
            Log("progression applied source=%u revision=%llu key=%u actor=%p level=%u->%u exp=%u learned=%u same_actor=1 display_level_synced=1",
                entry.source, entry.revision, entry.key, entry.actor, entry.level, view.level, view.experience, learned);
            entry.level = view.level;
            return true;
        } __except (EXCEPTION_EXECUTE_HANDLER) {
            Log("progression failed source=%u key=%u code=0x%08X", entry.source, entry.key, GetExceptionCode());
            return false;
        }
    }
    Log("progression skipped source=%u reason=spawn-identity-unavailable", view.sourceCharacter);
    return false;
}

void SetOriginalApcRegistration(void* original) {
    g_originalApcRegistration =
        reinterpret_cast<ApcRegistrationFn>(original);
    Log("projection registration hook original=%p enabled=%u",
        original, DirectOp40Enabled() ? 1u : 0u);
}

unsigned char __fastcall ProxyApcRegistration(
    void* self,
    void* /*unusedEdx*/,
    void* ownerActor,
    std::uint32_t flags,
    std::uint32_t objectKey,
    void* actor,
    std::uint32_t value5,
    std::uint32_t value6,
    std::uint32_t value7,
    std::uint32_t value8)
{
    ApcRegistrationFn original = g_originalApcRegistration;
    if (!original) {
        return 0;
    }
    // The 0x03508299 crash is the native APC registration reading
    // [self+0x18] with self=0x38 after a town return. Reject the stale object
    // before entering the native __thiscall function.
    if (reinterpret_cast<std::uintptr_t>(self) < 0x10000) {
        Log("APC registration ignored stale self=%p owner=%p actor=%p key=%u",
            self, ownerActor, actor, objectKey);
        return 0;
    }
    const unsigned char result = original(
        self, ownerActor, flags, objectKey, actor,
        value5, value6, value7, value8);
    if (ProjectionRegistrationContract::Matches(
            g_directLoopbackArmed,
            g_directLoopbackInReceive,
            static_cast<std::uint32_t>(GetCurrentThreadId()),
            static_cast<std::uint32_t>(g_armedThread),
            objectKey,
            actor,
            result)) {
        if (g_projectionApcObjectKey == 0 ||
            (g_projectionApcObjectKey == objectKey &&
             g_projectionApcActor == actor)) {
            g_projectionApcObjectKey =
                static_cast<std::uint16_t>(objectKey);
            g_projectionApcActor = actor;

            bool actorNameApplied = false;
            bool runtimeKeysApplied = false;
            dnf90_companion_projection::View view{};
            if (g_projectionAicApplied &&
                g_projectionPacketLength >=
                    dnf90_companion_projection::kPacketHeaderSize) {
                if (dnf90_companion_projection::DecodePacket(
                        g_projectionPacket,
                        g_projectionPacketLength,
                        &view) &&
                    view.present) {
                    runtimeKeysApplied =
                        ApplyDynamicRuntimeKeyPrograms(
                            actor, view);
                    RememberLiveProjectionActor(ownerActor, actor,
                        static_cast<std::uint16_t>(objectKey), view, runtimeKeysApplied);

                    if (view.nameUtf16 &&
                        view.nameUnits != 0 &&
                        view.nameUnits <=
                            dnf90_companion_projection::kMaxAicNameUnits) {
                        wchar_t actorName[
                            dnf90_companion_projection::kMaxAicNameUnits + 1] = {};
                        bool validName = true;
                        for (std::size_t i = 0; i < view.nameUnits; ++i) {
                            const std::uint16_t unit =
                                dnf90_companion_projection::Read16(
                                    view.nameUtf16 + i * 2);
                            if (unit == 0) {
                                validName = false;
                                break;
                            }
                            actorName[i] =
                                static_cast<wchar_t>(unit);
                        }
                        if (validName) {
                            actorName[view.nameUnits] = L'\0';
                            actorNameApplied =
                                AssignNativeRefWideString(
                                    reinterpret_cast<std::uint8_t*>(actor) +
                                        g_native.kActorDisplayNameOffset,
                                    actorName);
                        }
                    }
                }
            }
            Log("projection APC registered key=%u actor=%p owner=%p flags=0x%08X actor_name_applied=%u runtime_keys_applied=%u ai_behavior=%u ai_class=%u ai_combo=%u ai_preset_hash=%u",
                objectKey, actor, ownerActor, flags,
                actorNameApplied ? 1u : 0u,
                runtimeKeysApplied ? 1u : 0u,
                static_cast<unsigned int>(view.aiBehavior),
                static_cast<unsigned int>(view.aiClass),
                view.aiComboEnabled ? 1u : 0u,
                static_cast<unsigned int>(view.aiComboPresetHash));
        } else {
            Log("projection APC registration conflict previous_key=%u previous_actor=%p key=%u actor=%p",
                g_projectionApcObjectKey, g_projectionApcActor,
                objectKey, actor);
        }
    }
    return result;
}

// Class0 dispatch invokes callbacks that read global native reader state;
// passing a packet pointer alone does not bind its body. The real router
// (02261E30) binds packet diagnostics, cursor and remaining length separately.
using ProjectionReaderSetCursorFn = void (__cdecl*)(unsigned char*);
using ProjectionReaderSetLengthFn = void (__cdecl*)(int);
using ProjectionReaderSetPacketFn = void (__cdecl*)(unsigned char*, int);

int DispatchProjectionClass0(unsigned char* packet, std::size_t length) {
    if (!packet || length < dnf90_companion_projection::kPacketHeaderSize ||
        length > kProjectionNativePacketCapacity || !g_projectionClass0Dispatch) {
        return -1;
    }
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    auto* reader = reinterpret_cast<ProjectionNativeReaderState*>(base + g_native.kProjectionReaderStateRva);
    auto** errorCopy = reinterpret_cast<void**>(base + g_native.kProjectionReaderErrorCopyRva);
    auto setCursor = reinterpret_cast<ProjectionReaderSetCursorFn>(base + g_native.kProjectionReaderSetCursorRva);
    auto setLength = reinterpret_cast<ProjectionReaderSetLengthFn>(base + g_native.kProjectionReaderSetLengthRva);
    auto setPacket = reinterpret_cast<ProjectionReaderSetPacketFn>(base + g_native.kProjectionReaderSetPacketRva);
    const ProjectionNativeReaderState saved = *reader;
    void* const savedErrorCopy = *errorCopy;
    // The native packet setter owns/frees the error copy. Detach the outer
    // copy before binding, then let it free only this dispatch's copy.
    *errorCopy = nullptr;
    int result = -1;
    __try {
        setPacket(packet, static_cast<int>(length));
        setCursor(packet + dnf90_companion_projection::kPacketHeaderSize);
        setLength(static_cast<int>(length - dnf90_companion_projection::kPacketHeaderSize));
        result = g_projectionClass0Dispatch(g_projectionDispatcherArg, reinterpret_cast<int>(packet));
        Log("projection reader dispatch mode=%u key=%u body_length=%zu remaining=%d result=%d",
            packet[dnf90_companion_projection::kPacketHeaderSize], g_projectionApcObjectKey,
            length - dnf90_companion_projection::kPacketHeaderSize, reader->remaining, result);
    } __finally {
        setPacket(saved.packet, saved.packetLength);
        setCursor(saved.cursor);
        setLength(saved.remaining);
        *errorCopy = savedErrorCopy;
    }
    return result;
}

void SetProjectionClass0Dispatch(void* original) {
    const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    static const unsigned char cursorSignature[] = {
        0x55, 0x8B, 0xEC, 0x8B, 0x45, 0x08, 0xA3, 0x00, 0x85, 0x2F, 0x05, 0x5D, 0xC3
    };
    static const unsigned char lengthSignature[] = {
        0x55, 0x8B, 0xEC, 0x8B, 0x45, 0x08, 0xA3, 0x04, 0x85, 0x2F, 0x05, 0x5D, 0xC3
    };
    static const unsigned char packetSignature[] = {
        0x55, 0x8B, 0xEC, 0x8B, 0x45, 0x08, 0x8B, 0x4D, 0x0C,
        0xA3, 0x08, 0x85, 0x2F, 0x05, 0xA1, 0x28, 0x85, 0x2F, 0x05,
        0x89, 0x0D, 0x0C, 0x85, 0x2F, 0x05
    };
    if (!base || (!g_native.newNative && (memcmp(reinterpret_cast<void*>(base + g_native.kProjectionReaderSetCursorRva), cursorSignature, sizeof(cursorSignature)) ||
        memcmp(reinterpret_cast<void*>(base + g_native.kProjectionReaderSetLengthRva), lengthSignature, sizeof(lengthSignature)) ||
        memcmp(reinterpret_cast<void*>(base + g_native.kProjectionReaderSetPacketRva), packetSignature, sizeof(packetSignature))))) {
        g_projectionClass0Dispatch = nullptr;
        Log("projection class0 dispatcher disabled: native reader signature mismatch");
        return;
    }
    g_projectionClass0Dispatch =
        reinterpret_cast<Class0ProjectionDispatchFn>(original);
    Log("projection class0 dispatcher original=%p", original);
}

bool ReplacePendingProgression(const unsigned char* bytes, std::size_t length,
    const dnf90_companion_projection::View& update) {
    if (!bytes || length == 0 || length > kProjectionQueueMaxBytes) {
        return false;
    }
    dnf90_companion_projection::View pending{};
    unsigned char* target = nullptr;
    if (!g_projectionAicApplied && dnf90_companion_projection::DecodePacket(
            g_projectionPacket, g_projectionPacketLength, &pending) &&
        pending.sourceCharacter == update.sourceCharacter && pending.revision == update.revision) {
        memcpy(g_projectionPacket, bytes, length);
        g_projectionPacketLength = length;
        target = g_projectionPacket;
    } else {
        for (auto& queued : g_projectionQueue) {
            if (dnf90_companion_projection::DecodePacket(queued.packet.data(), queued.packet.size(), &pending) &&
                pending.sourceCharacter == update.sourceCharacter && pending.revision == update.revision) {
                g_projectionQueueBytes -= queued.packet.size();
                std::vector<unsigned char> replacement(bytes, bytes + length);
                queued.packet.swap(replacement);
                g_projectionQueueBytes += queued.packet.size();
                target = queued.packet.data();
                break;
            }
        }
    }
    if (!target) return false;
    target[dnf90_companion_projection::kPacketHeaderSize + 5] = dnf90_companion_projection::kFlagPresent;
    auto* plan = target + dnf90_companion_projection::kPacketHeaderSize + 68;
    std::uint32_t planWord = 0;
    if (pending.aiBehavior != 0) {
        target[dnf90_companion_projection::kPacketHeaderSize + 5] |= dnf90_companion_projection::kFlagAiPlan;
        planWord = pending.aiBehavior | (pending.aiComboEnabled ? 4u : 0u) |
            (static_cast<std::uint32_t>(pending.aiComboPresetHash) << 8) |
            (static_cast<std::uint32_t>(pending.aiClass) << 16);
    }
    memcpy(plan, &planWord, sizeof(planWord));
    Log("progression updated pending spawn source=%u level=%u", update.sourceCharacter, update.level);
    return true;
}

bool CaptureProjectionClass0Packet(
    int dispatcherArg,
    int packet)
{
    if (!Enabled() || !packet) return false;
    __try {
        const unsigned char* bytes =
            reinterpret_cast<const unsigned char*>(packet);
        const std::uint32_t packetLength =
            dnf90_companion_projection::Read32(bytes + 3);
        if (packetLength < dnf90_companion_projection::kPacketHeaderSize ||
            packetLength > sizeof(g_projectionPacket)) {
            return false;
        }
        dnf90_companion_projection::View view{};
        if (!dnf90_companion_projection::DecodePacket(
                bytes, packetLength, &view)) {
            return false;
        }
        if (view.progression) {
            if (!ApplyLiveProjectionProgression(view)) ReplacePendingProgression(bytes, packetLength, view);
            return true; // handled even when stale: never queue or summon
        }

        if (!view.present) {
            ClearQueuedProjections("private-clear");
            g_liveProjectionActors.clear();
            ClearCurrentProjectionPacket();
            g_retry.Cancel();
            Log("projection private packets cleared revision=%llu",
                static_cast<unsigned long long>(view.revision));
            return true;
        }

        if (g_projectionPacketLength != 0) {
            QueueProjectionPacket(bytes, packetLength, dispatcherArg);
            Log("projection private packet queued source=%u revision=%llu queue_depth=%zu queue_bytes=%zu high_water=%zu drops=%u",
                static_cast<unsigned int>(view.sourceCharacter),
                static_cast<unsigned long long>(view.revision),
                g_projectionQueue.size(), g_projectionQueueBytes,
                g_projectionQueueHighWater, g_projectionQueueDropCount);
            return true;
        }
        if (!LoadCurrentProjectionPacket(bytes, packetLength, dispatcherArg)) {
            return false;
        }
        if (g_armedActor != nullptr &&
            g_armedThread != 0 &&
            GetCurrentThreadId() == g_armedThread) {
            g_retry.Arm();
        }
        Log("projection private packet cached source=%u revision=%llu mode0=%zu mode1=%zu queue_depth=%zu queue_bytes=%zu high_water=%zu drops=%u retry_pending=%u",
            static_cast<unsigned int>(view.sourceCharacter),
            static_cast<unsigned long long>(view.revision),
            view.mode0Length,
            view.mode1Length,
            g_projectionQueue.size(), g_projectionQueueBytes,
            g_projectionQueueHighWater, g_projectionQueueDropCount,
            g_retry.Pending() ? 1u : 0u);
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("projection private packet capture exception code=0x%08X",
            GetExceptionCode());
        return false;
    }
}

void LogProjectionDecodeRejected(
    const unsigned char* bytes,
    std::size_t packetLength,
    const char* stage)
{
    if (!bytes) {
        Log("projection decode rejected stage=%s reason=null-packet",
            stage ? stage : "unknown");
        return;
    }
    __try {
        const std::uint32_t headerLength =
            dnf90_companion_projection::Read32(bytes + 3);
        const std::uint16_t opcode =
            dnf90_companion_projection::Read16(bytes + 1);
        if (packetLength < dnf90_companion_projection::kPacketHeaderSize) {
            Log("projection decode rejected stage=%s reason=short-header length=%zu header_length=%u opcode=%u",
                stage ? stage : "unknown", packetLength,
                static_cast<unsigned int>(headerLength),
                static_cast<unsigned int>(opcode));
            return;
        }
        const unsigned char* body =
            bytes + dnf90_companion_projection::kPacketHeaderSize;
        const std::size_t bodyLength =
            packetLength - dnf90_companion_projection::kPacketHeaderSize;
        if (bodyLength < dnf90_companion_projection::kBodyHeaderSize) {
            Log("projection decode rejected stage=%s reason=short-body length=%zu body_length=%zu header_length=%u opcode=%u magic=%08X",
                stage ? stage : "unknown", packetLength, bodyLength,
                static_cast<unsigned int>(headerLength),
                static_cast<unsigned int>(opcode),
                static_cast<unsigned int>(dnf90_companion_projection::Read32(body)));
            return;
        }
        const std::uint32_t mode0Length =
            dnf90_companion_projection::Read32(body + 16);
        const std::uint32_t mode1Length =
            dnf90_companion_projection::Read32(body + 20);
        const std::size_t nameUnits =
            dnf90_companion_projection::Read16(body + 58);
        const std::size_t equipmentCount =
            dnf90_companion_projection::Read16(body + 60);
        const std::size_t skillCount =
            dnf90_companion_projection::Read16(body + 64);
        const std::size_t quickSkillCount =
            dnf90_companion_projection::Read16(body + 66);
        const std::size_t dynamicBytes =
            nameUnits * 2u + equipmentCount * 4u +
            skillCount * 8u + quickSkillCount * 8u;
        const std::size_t mode0Offset =
            dnf90_companion_projection::kBodyHeaderSize + dynamicBytes;
        unsigned int mode0Key = 0;
        unsigned int mode0Byte0 = 0;
        unsigned int mode0Version = 0;
        if (mode0Offset < bodyLength) {
            mode0Byte0 = body[mode0Offset];
            if (bodyLength - mode0Offset > 2) {
                mode0Version = dnf90_companion_projection::Read16(
                    body + mode0Offset + 1);
            }
            if (bodyLength - mode0Offset >
                    dnf90_companion_projection::kMode0ObjectKeyOffset + 1) {
                mode0Key = dnf90_companion_projection::Read16(
                    body + mode0Offset +
                    dnf90_companion_projection::kMode0ObjectKeyOffset);
            }
        }
        Log("projection decode rejected stage=%s length=%zu header_length=%u opcode=%u body_length=%zu magic=%08X version=%u flags=%u source=%u revision=%llu mode0=%u mode1=%u name=%zu equip=%zu level=%u skills=%zu quick=%zu dynamic=%zu mode0_offset=%zu mode0_byte0=%u mode0_version=%u mode0_key=%u wanted=%zu",
            stage ? stage : "unknown", packetLength,
            static_cast<unsigned int>(headerLength),
            static_cast<unsigned int>(opcode), bodyLength,
            static_cast<unsigned int>(dnf90_companion_projection::Read32(body)),
            static_cast<unsigned int>(body[4]),
            static_cast<unsigned int>(body[5]),
            static_cast<unsigned int>(dnf90_companion_projection::Read16(body + 6)),
            static_cast<unsigned long long>(dnf90_companion_projection::Read64(body + 8)),
            static_cast<unsigned int>(mode0Length),
            static_cast<unsigned int>(mode1Length), nameUnits,
            equipmentCount,
            static_cast<unsigned int>(dnf90_companion_projection::Read16(body + 62)),
            skillCount, quickSkillCount, dynamicBytes, mode0Offset,
            mode0Byte0, mode0Version, mode0Key,
            dnf90_companion_projection::kBodyHeaderSize + dynamicBytes +
                static_cast<std::size_t>(mode0Length) +
                static_cast<std::size_t>(mode1Length));
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("projection decode rejected stage=%s reason=diagnostic-exception code=0x%08X",
            stage ? stage : "unknown", GetExceptionCode());
    }
}



void* ProjectionActorOverrideForObjectKey(std::uint16_t objectKey) {
    if (!Enabled() ||
        !ProjectionLookupContract::Matches(
            g_projectionApplyActive,
            objectKey,
            g_projectionApcObjectKey,
            g_projectionApcActor)) {
        return nullptr;
    }
    return g_projectionApcActor;
}

bool ProjectionMode0OwnerContextOverride() {
    // The native local constructor is not safe to force from the projection
    // hook: when the owner/context fields are not fully initialized it enters
    // a memcpy path with an invalid destination/length and terminates DNF.
    // Keep the owner hook diagnostic-only until the native context contract is
    // proven. Returning false preserves the stock comparison and fails closed.
    return false;
}

bool ApplyPendingProjection() {
    // Stage 2 is only valid after the per-instance AIC projection succeeded.
    // Before that point the APC is still the baseline template and must not
    // receive a scene-object projection.
    if (!g_projectionAicApplied) {
        return false;
    }
    if (!Enabled() ||
        !g_projectionPending ||
        !g_projectionClass0Dispatch ||
        g_projectionApcObjectKey == 0 ||
        g_projectionApcObjectKey == 0xFFFF ||
        g_projectionPacketLength <
            dnf90_companion_projection::kPacketHeaderSize ||
        g_projectionPacketLength > sizeof(g_projectionPacket)) {
        return false;
    }

    __try {
        dnf90_companion_projection::View view{};
        if (!dnf90_companion_projection::DecodePacket(
                g_projectionPacket,
                g_projectionPacketLength,
                &view) ||
            !view.present ||
            view.mode0Length >
                dnf90_companion_projection::kMaxProjectionBody ||
            view.mode1Length >
                dnf90_companion_projection::kMaxProjectionBody) {
            Log("projection cached private packet invalid length=%zu",
                g_projectionPacketLength);
            g_projectionPending = false;
            return false;
        }

        const std::size_t mode0PacketLength =
            dnf90_companion_projection::kPacketHeaderSize +
            view.mode0Length;
        const std::size_t mode1PacketLength =
            view.mode1Length != 0
                ? dnf90_companion_projection::kPacketHeaderSize +
                    view.mode1Length
                : 0;
        if (mode0PacketLength > sizeof(g_projectionMode0Packet) ||
            mode1PacketLength > sizeof(g_projectionMode1Packet)) {
            g_projectionPending = false;
            return false;
        }

        memset(g_projectionMode0Packet, 0, mode0PacketLength);
        memcpy(
            g_projectionMode0Packet,
            g_projectionPacket,
            dnf90_companion_projection::kPacketHeaderSize);
        g_projectionMode0Packet[0] = 0;
        dnf90_companion_projection::Write16(
            g_projectionMode0Packet + 1, 2);
        if (mode1PacketLength != 0) {
            memset(g_projectionMode1Packet, 0, mode1PacketLength);
            memcpy(
                g_projectionMode1Packet,
                g_projectionPacket,
                dnf90_companion_projection::kPacketHeaderSize);
            g_projectionMode1Packet[0] = 0;
            dnf90_companion_projection::Write16(
                g_projectionMode1Packet + 1, 2);
        }
        const std::uint32_t mode0PacketLength32 =
            static_cast<std::uint32_t>(mode0PacketLength);
        const std::uint32_t mode1PacketLength32 =
            static_cast<std::uint32_t>(mode1PacketLength);
        memcpy(g_projectionMode0Packet + 3,
            &mode0PacketLength32, sizeof(mode0PacketLength32));
        if (mode1PacketLength != 0) {
            memcpy(g_projectionMode1Packet + 3,
                &mode1PacketLength32, sizeof(mode1PacketLength32));
        }

        unsigned char* mode0 =
            g_projectionMode0Packet +
            dnf90_companion_projection::kPacketHeaderSize;
        unsigned char* mode1 =
            mode1PacketLength != 0
                ? g_projectionMode1Packet +
                    dnf90_companion_projection::kPacketHeaderSize
                : nullptr;
        memcpy(mode0, view.mode0, view.mode0Length);
        if (view.mode1Length != 0) {
            memcpy(mode1, view.mode1, view.mode1Length);
        }
        if (!dnf90_companion_projection::PatchTargetObjectKey(
                mode0, view.mode0Length,
                mode1, view.mode1Length,
                g_projectionApcObjectKey)) {
            Log("projection target-key patch rejected key=%u source=%u revision=%llu",
                g_projectionApcObjectKey,
                static_cast<unsigned int>(view.sourceCharacter),
                static_cast<unsigned long long>(view.revision));
            g_projectionPending = false;
            return false;
        }
        
        // Consume before native apply so any callback cannot replay the same
        // projection. The original APC5405 AIC/template is never written.
        g_projectionPending = false;
        int mode0Result = 0;
        int mode1Result = 0;
        bool mode1Exception = false;
        bool mode1Direct = false;
        bool mode0Exception = false;
        bool mode0Skipped = false;
        unsigned long mode1ExceptionCode = 0;
        unsigned long mode0ExceptionCode = 0;
        std::uintptr_t mode0ExceptionAddress = 0;
        std::uintptr_t mode0FaultAddress = 0;
        std::uintptr_t mode1ExceptionAddress = 0;
        std::uintptr_t mode1FaultAddress = 0;
        std::uintptr_t mode1Stack[8] = {};
        int mode1StackCount = 0;
        g_projectionApplyActive = true;
        __try {
            // Preserve the established stat-then-appearance order. Each call
            // binds its own native reader, so neither mode consumes the previous
            // network packet or the preceding projection's exhausted cursor.
            // Original mode has no mode1 body and applies appearance only.
            if (mode1PacketLength != 0 &&
                !g_projectionMode1Failed) {
                // The native userinfo dispatcher faults on APC actors in this
                // client build (fault 0x17 while binding the actor's UserInfo),
                // so the stat vector is applied through the actor's own stats
                // vtable instead — the same path the progression packet already
                // uses successfully. mode1's first 31 bytes are the header; the
                // 92-byte PVF stat blob follows it.
                __try {
                    if (ApplyProjectionStatVector(
                            g_projectionApcActor, view.mode1, view.mode1Length)) {
                        mode1Result = 0;
                        mode1Direct = true;
                        Log("projection stats applied directly key=%u actor=%p source=%u level=%u",
                            g_projectionApcObjectKey,
                            g_projectionApcActor,
                            static_cast<unsigned int>(view.sourceCharacter),
                            static_cast<unsigned int>(view.level));
                    } else {
                        mode1Result = DispatchProjectionClass0(
                            g_projectionMode1Packet, mode1PacketLength);
                    }
                } __except (CaptureProjectionException(GetExceptionInformation())) {
                    mode1Exception = true;
                    mode1ExceptionCode = GetExceptionCode();
                    mode1ExceptionAddress = g_lastProjectionExceptionAddress;
                    mode1FaultAddress = g_lastProjectionFaultAddress;
                    mode1StackCount = g_lastProjectionStackCount;
                    for (int slot = 0; slot < mode1StackCount; ++slot) {
                        mode1Stack[slot] = g_lastProjectionStack[slot];
                    }
                    mode1Result = -1;
                    g_projectionMode1Failed = true;
                }
            } else if (mode1PacketLength != 0) {
                mode1Result = -1;
            }
            // Opt-in experiment: replay the mode1 equipment create rows against
            // this APC actor.  The native reader is positioned at the row count
            // (body+124) and restored afterwards.  No-op unless the env flag is
            // set; the active projection path is unchanged.
            if (mode1PacketLength != 0 && mode1 && g_projectionApcActor) {
                void* companionAic = nullptr;
                for (auto& live : g_liveProjectionActors) {
                    if (live.actor == g_projectionApcActor) {
                        companionAic = live.aic;
                        break;
                    }
                }
                TryApplyCompanionEquipment(
                    g_projectionApcActor,
                    g_projectionMode1Packet,
                    mode1PacketLength,
                    mode1,
                    view.mode1Length,
                    companionAic);
            }
            __try {
                // This client build faults inside the native class0 dispatcher
                // with pc == fault == 0x18181818 (a data field used as a call
                // target), so mode0 never completes and each attempt leaves the
                // actor half-applied. Appearance was already absent while the
                // twelve key programs worked, therefore skip the dispatch
                // explicitly instead of crashing three times per projection.
                mode0Result = -2;
                mode0Skipped = true;
            } __except (CaptureProjectionException(GetExceptionInformation())) {
                mode0Exception = true;
                mode0ExceptionCode = GetExceptionCode();
                mode0ExceptionAddress = g_lastProjectionExceptionAddress;
                mode0FaultAddress = g_lastProjectionFaultAddress;
                mode0Result = -1;
            }
        } __finally {
            g_projectionApplyActive = false;
        }
        if (mode1Exception) {
            Log("projection mode1 dispatch exception source=%u revision=%llu key=%u code=0x%08X pc=%p fault=%p rva=0x%zX stack=%p,%p,%p,%p,%p,%p; continuing mode0",
                static_cast<unsigned int>(view.sourceCharacter),
                static_cast<unsigned long long>(view.revision),
                g_projectionApcObjectKey,
                mode1ExceptionCode,
                reinterpret_cast<void*>(mode1ExceptionAddress),
                reinterpret_cast<void*>(mode1FaultAddress),
                mode1ExceptionAddress > reinterpret_cast<std::uintptr_t>(GetModuleHandleW(nullptr))
                    ? mode1ExceptionAddress - reinterpret_cast<std::uintptr_t>(GetModuleHandleW(nullptr))
                    : 0,
                reinterpret_cast<void*>(mode1Stack[0]),
                reinterpret_cast<void*>(mode1Stack[1]),
                reinterpret_cast<void*>(mode1Stack[2]),
                reinterpret_cast<void*>(mode1Stack[3]),
                reinterpret_cast<void*>(mode1Stack[4]),
                reinterpret_cast<void*>(mode1Stack[5]));
        }
        if (mode0Exception) {
            ++g_projectionMode0RetryCount;
            if (g_projectionMode0RetryCount <= kProjectionMode0RetryLimit) {
                // The APC/AIC transaction already created this actor. Keep
                // its packet and retry only the safe-point projection instead
                // of arming another native summon for the same source.
                g_projectionPending = true;
                g_retry.Cancel();
                g_waitLogCount = 0;
                Log("projection mode0 dispatch exception retry source=%u revision=%llu key=%u code=0x%08X attempt=%u/%u actor=%p pc=%p fault=%p rva=0x%zX",
                    static_cast<unsigned int>(view.sourceCharacter),
                    static_cast<unsigned long long>(view.revision),
                    g_projectionApcObjectKey,
                    mode0ExceptionCode,
                    g_projectionMode0RetryCount,
                    kProjectionMode0RetryLimit,
                    g_projectionApcActor,
                    reinterpret_cast<void*>(mode0ExceptionAddress),
                    reinterpret_cast<void*>(mode0FaultAddress),
                    mode0ExceptionAddress > reinterpret_cast<std::uintptr_t>(GetModuleHandleW(nullptr))
                        ? mode0ExceptionAddress - reinterpret_cast<std::uintptr_t>(GetModuleHandleW(nullptr))
                        : 0);
                return false;
            }
            const std::uint16_t failedKey = g_projectionApcObjectKey;
            const bool hasNext = LoadNextQueuedProjection();
            g_waitLogCount = 0;
            if (hasNext) {
                g_retry.Arm();
                Log("projection mode0 dispatch exception drained source=%u revision=%llu key=%u code=0x%08X; advancing remaining=%zu actor=%p pc=%p fault=%p",
                    static_cast<unsigned int>(view.sourceCharacter),
                    static_cast<unsigned long long>(view.revision),
                    failedKey,
                    mode0ExceptionCode,
                    g_projectionQueue.size(),
                    g_armedActor,
                    reinterpret_cast<void*>(mode0ExceptionAddress),
                    reinterpret_cast<void*>(mode0FaultAddress));
            } else {
                g_retry.Cancel();
                Log("projection mode0 dispatch exception drained source=%u revision=%llu key=%u code=0x%08X actor=%p pc=%p fault=%p",
                    static_cast<unsigned int>(view.sourceCharacter),
                    static_cast<unsigned long long>(view.revision),
                    failedKey,
                    mode0ExceptionCode,
                    g_armedActor,
                    reinterpret_cast<void*>(mode0ExceptionAddress),
                    reinterpret_cast<void*>(mode0FaultAddress));
            }
            return false;
        }
        Log("projection applied source=%u revision=%llu key=%u actor=%p mode0_result=%d mode0_skipped=%u mode1_result=%d mode1_present=%u mode1_direct=%u apply_order=%s template_mutation=0",
            static_cast<unsigned int>(view.sourceCharacter),
            static_cast<unsigned long long>(view.revision),
            g_projectionApcObjectKey,
            g_projectionApcActor,
            mode0Result,
            mode0Skipped ? 1u : 0u,
            mode1Result,
            mode1PacketLength != 0 ? 1u : 0u,
            mode1Direct ? 1u : 0u,
		    mode1PacketLength != 0 ? "mode1_then_mode0" : "mode0_only");
		const bool hasNext = LoadNextQueuedProjection();
        g_waitLogCount = 0;
        if (hasNext) {
            g_retry.Arm();
            Log("projection queue advanced remaining=%zu actor=%p",
                g_projectionQueue.size(), g_armedActor);
        } else {
			g_retry.Cancel();
		}
        return true;
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        const std::uint16_t failedKey = g_projectionApcObjectKey;
        const unsigned long exceptionCode = GetExceptionCode();
        const bool hasNext = LoadNextQueuedProjection();
        g_waitLogCount = 0;
        if (hasNext) {
            g_retry.Arm();
            Log("projection apply exception recovered key=%u code=0x%08X remaining=%zu actor=%p",
                failedKey,
                exceptionCode,
                g_projectionQueue.size(),
                g_armedActor);
        } else {
            g_retry.Cancel();
            Log("projection apply exception drained key=%u code=0x%08X",
                failedKey,
                exceptionCode);
        }
        return false;
    }
}

void ArmFixedApc5405() {
    if (!Enabled()) {
        g_retry.Cancel();
        g_armedActor = nullptr;
        g_armedThread = 0;
        return;
    }
    // The new-native ready callback is not reached on every client build; arm
    // is the first point that is guaranteed to run on dungeon entry.  The
    // installer is idempotent and a no-op unless the probe/apply flag is set.
    InstallCompanionEquipmentProbe();
    uintptr_t base =
        reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    void* actor = nullptr;
    if (!ReadControlledActor(base, &actor)) {
        g_retry.Cancel();
        return;
    }
    g_armedActor = actor;
    g_liveProjectionActors.clear();
    g_armedThread = GetCurrentThreadId();
    g_waitLogCount = 0;
    ResetCurrentProjectionActorState();
    if (g_projectionPacketLength == 0 && !g_projectionQueue.empty()) {
        LoadNextQueuedProjection();
    }
    g_retry.Arm();
    Log("armed apc=5405 actor=%p projection_ready=%u queue_depth=%zu queue_bytes=%zu high_water=%zu drops=%u",
        actor, g_projectionPending ? 1u : 0u, g_projectionQueue.size(),
        g_projectionQueueBytes, g_projectionQueueHighWater,
        g_projectionQueueDropCount);
}

bool PollFixedApc5405() {
    if (!Enabled() || !g_retry.Pending()) return false;
    if (GetCurrentThreadId() != g_armedThread) return false;

    uintptr_t base =
        reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
    void* actor = nullptr;
    if (!ReadControlledActor(base, &actor) ||
        actor != g_armedActor) {
        CancelFixedApc5405();
        Log("cancelled reason=controlled-actor-changed armed=%p current=%p",
            g_armedActor, actor);
        return false;
    }

    bool routeReady = ValidateNativeRoute(base, actor);
    bool nativeReady = routeReady && NativeReady(base, actor);
    int sceneMode = -1;
    bool sceneReady =
        nativeReady && DungeonSceneReady(base, &sceneMode);
    if (!g_retry.ShouldSubmit(routeReady, nativeReady, sceneReady, g_projectionPending)) {
        if (g_waitLogCount < 8) {
            Log("waiting route_ready=%u native_ready=%u scene_ready=%u projection_ready=%u scene_mode=%d actor=%p",
                routeReady ? 1u : 0u,
                nativeReady ? 1u : 0u,
                sceneReady ? 1u : 0u,
                g_projectionPending ? 1u : 0u,
                sceneMode,
                actor);
            ++g_waitLogCount;
        }
        return false;
    }

    if (!Submit(base, actor)) {
        // Native exception is terminal for this run; do not duplicate-create.
        return false;
    }
    return true;
}

void NewNativeSafePoint(int opcode) {
    if (!g_native.newNative || !g_newNativeHooksReady) return;
    static thread_local bool active = false;
    if (active || g_projectionApplyActive || g_directLoopbackInReceive) return;
    active = true;
    __try {
        const uintptr_t base = reinterpret_cast<uintptr_t>(GetModuleHandleW(nullptr));
        void* actor = nullptr;
        const bool hasActor = ReadControlledActor(base, &actor);
        int mode = -1;
        const bool dungeon = DungeonSceneReady(base, &mode);
        if (g_armedActor && (!hasActor || actor != g_armedActor)) {
            CancelFixedApc5405();
            Log("new-native lifecycle cancelled reason=owner-changed opcode=%d mode=%d", opcode, mode);
        }
        // A room transition can temporarily leave mode 3. Keep that run's
        // identities and pause native work until the same owner is ready again.
        if (dungeon && hasActor) {
            if (!g_armedActor) ArmFixedApc5405();
            PollFixedApc5405();
            ApplyPendingProjection();
        }
    } __except (EXCEPTION_EXECUTE_HANDLER) {
        Log("new-native safe-point exception opcode=%d code=0x%08X", opcode, GetExceptionCode());
    }
    active = false;
}

void CancelFixedApc5405() {
    g_retry.Cancel();
    g_armedActor = nullptr;
    g_armedThread = 0;
    g_waitLogCount = 0;
    ClearQueuedProjections("cancel");
    g_liveProjectionActors.clear();
    ClearCurrentProjectionPacket();
}

} // namespace dnf90_companion_p0