Card DSH-1 - written 2026-09-26 14:50:56 -0700 (clock-read) BEFORE compiling
Function: _display_scenario_help. Change (A+B, both /Od-attested, same region):
 (A) text-box search as the /Od loop: for (text_box = widget->child; text_box && text_box->type !=
     _ui_widget_type_text_box; text_box = text_box->next) ; (empty body), replacing the break-in-body form;
 (B) the vassert expression as /Od tests it: text_box && text_box->type == _ui_widget_type_text_box (message text,
     line 2438 and file unchanged; a vassert with a message stringifies nothing, so January's .rdata cannot show it).
Files: dsh1.c (A+B), dsh1a.c (A), dsh1b.c (B) for the strip test.
Evidence: /Od halo_cache_symbols.exe 0x65fc70 +0x16b..+0x1e2 (read with od_dis.py): the loop exits on
`text_box == 0` or `type == 1` straight from its header test (je exit / je exit; jmp next), and the assert block
tests `cmp [t],0; je assert; movsx; cmp 1; je ok`. The scenario-name part of that /Od function is a later rewrite,
but the widget/text-box tail is the same code shape as January's and Aug-2001's bytes.
Mechanism prediction (allocator oracle, DSH-D0): January needs the const-1 web popped before string_index (forcing
string_index->ebx is EXACT and then const-1 takes edi, invisible). (B) adds const-1 references in the assert
condition (and the second type test threads away on the found path) -> pri(const-1) > pri(string_index) ->
string_index gets EBX -> EXACT. P(EXACT for A+B) ~45%; (A) alone likely inert or insufficient; (B) alone ~40%.
Risk: the assert's second test may survive as extra bytes (size change).

OUTCOME (appended 2026-09-26 14:51:27 -0700): _display_scenario_help STRICT EXACT for A+B and for B alone (gate --all 97/5/0; section
byte-identical dsh1 == dsh1b == January). A alone: section byte-identical to the lane source (inert, 96/6).
Oracle (dsh1b): const-1 web gains a 1x2 term from the assert's type test (pri -22 -> -20); string_index loses one more
live-through block (-22 -> -24); const-1 pops first and takes EDI (never emitted), string_index takes EBX = January.
Mechanism prediction HELD (B is the load-bearing, /Od-attested change; A is byte-inert and is stripped).
