// Included inside 90CN.cpp's namespace after its existing patch helpers.
// Only the evidenced UI update iterator call-site is patched, never the CRT.
uintptr_t g_uiIteratorNativeAdvance = 0;
uintptr_t g_uiIteratorAdvanceResume = 0;
uintptr_t g_uiIteratorNextBucket = 0;
volatile LONG g_uiIteratorInvalidations = 0;
int __stdcall CanAdvanceUiUpdateIterator(unsigned int bucket,
    const uintptr_t* owner, const uintptr_t* iterator)
{
    dnf90::UiIteratorSnapshot s = {};
    __try {
        s.owner = reinterpret_cast<uintptr_t>(owner);
        if (owner && iterator) {
            s.proxy = owner[0]; s.iteratorProxy = iterator[0];
            s.begin = owner[1]; s.end = owner[2]; s.current = iterator[2];
            if (s.proxy && s.iteratorProxy == s.proxy)
                s.proxyOwner = *reinterpret_cast<const uintptr_t*>(s.proxy);
        }
    } __except (EXCEPTION_EXECUTE_HANDLER) { s.proxyOwner = 0; }
    if (dnf90::CanAdvanceUiIterator(s)) return 1;
    LONG n = InterlockedIncrement(&g_uiIteratorInvalidations);
    if (n <= 16) LogLine("ui-update iterator invalidated bucket=%u owner=%08X "
        "proxy=%08X iter_proxy=%08X begin=%08X end=%08X current=%08X "
        "action=defer_remaining_bucket_until_next_frame hit=%ld",
        bucket, s.owner, s.proxy, s.iteratorProxy, s.begin, s.end, s.current, n);
    return 0;
}
__declspec(naked) void ProxyUiUpdateIteratorAdvance()
{
    __asm {
        // Entry is a JMP replacing CALL; result pointer and dummy are on stack.
        push eax
        push ecx
        push edx
        push ecx
        push dword ptr [ebp - 14h]
        push dword ptr [ebp - 1Ch]
        call CanAdvanceUiUpdateIterator
        test eax, eax
        pop edx
        pop ecx
        pop eax
        jz invalidated
        call dword ptr [g_uiIteratorNativeAdvance]
        jmp dword ptr [g_uiIteratorAdvanceResume]
    invalidated:
        // Native ++ would have consumed two arguments (ret 8). Do not compare
        // an invalid iterator again; the next bucket constructs a fresh one.
        add esp, 8
        jmp dword ptr [g_uiIteratorNextBucket]
    }
}
bool InstallUiIteratorAdvanceCompatibility()
{
    const uintptr_t site = g_dnfBase + 0x02BF2732;
    static const unsigned char kLoopContract[] = {
        0x8B,0x0F,0x8B,0x11,0x8B,0x42,0x10,0xFF,0xD0,0x6A,0x00,
        0x8D,0x4D,0xB4,0x51,0x8D,0x4D,0xD4,0xE8,0x19,0x02,0x7F,0xFD,
        0xE9,0x77,0xFF,0xFF,0xFF,0x8B,0x45,0xE4,0x83,0x45,0xEC,0x14,
        0x40,0x89,0x45,0xE4,0x3D,0x87,0x04,0x00,0x00,0x0F,0x8C,0x55,0xFF,0xFF,0xFF
    };
    static const unsigned char kBeginContract[] = {
        0x55,0x8B,0xEC,0x8B,0x45,0x08,0x8B,0x51,0x04,0x8B,0x09,
        0xC7,0x40,0x04,0,0,0,0,0x89,0x50,0x08,0x89,0x08,0x5D,0xC2,0x04,0
    };
    static const unsigned char kAdvanceContract[] = {
        0x55,0x8B,0xEC,0x8B,0x45,0x08,0x8B,0x11,0x56,0xC7,0x00,0,0,0,0
    };
    if (!BytesMatch(reinterpret_cast<unsigned char*>(g_dnfBase+0x02BF2720),
            kLoopContract,sizeof(kLoopContract)) ||
        !BytesMatch(reinterpret_cast<unsigned char*>(g_dnfBase+0x00A44ED0),
            kBeginContract,sizeof(kBeginContract)) ||
        !BytesMatch(reinterpret_cast<unsigned char*>(g_dnfBase+0x003E2950),
            kAdvanceContract,sizeof(kAdvanceContract))) {
        LogLine("ui-update iterator compatibility disabled: native signature mismatch");
        return false;
    }
    g_uiIteratorNativeAdvance = g_dnfBase + 0x003E2950;
    g_uiIteratorAdvanceResume = g_dnfBase + 0x02BF2737;
    g_uiIteratorNextBucket = g_dnfBase + 0x02BF273C;
    DWORD oldProtection = 0;
    if (!VirtualProtect(reinterpret_cast<void*>(site),5,PAGE_EXECUTE_READWRITE,&oldProtection)) {
        LogLine("ui-update iterator compatibility protection failed error=%lu",GetLastError());
        return false;
    }
    unsigned char jump[5] = {0xE9};
    *reinterpret_cast<int32_t*>(jump+1) = static_cast<int32_t>(
        reinterpret_cast<intptr_t>(&ProxyUiUpdateIteratorAdvance)-static_cast<intptr_t>(site+5));
    memcpy(reinterpret_cast<void*>(site),jump,sizeof(jump));
    DWORD ignored = 0;
    VirtualProtect(reinterpret_cast<void*>(site),5,oldProtection,&ignored);
    FlushInstructionCache(GetCurrentProcess(),reinterpret_cast<void*>(site),5);
    LogLine("ui-update mutation-safe iterator installed site=%08X next_bucket=%08X",site,g_uiIteratorNextBucket);
    return true;
}