# A register the routine never sets is still an input

## What to know

*2026-10-24, `FactionUpdate` 0x41a0fc, `faction_daily_target` 0x41a028, the Moth roll-out
0x41ae2f; Hardwar's `economy_world.py`.*

Watcom's register convention keeps every register a callee does not return in, so a value
a caller leaves in a register survives into the next call. Two economy routines take such a
value as an input without meaning to:

- **A counter that starts where the caller left it.** `0x41a028` counts the factories it may
  choose among in EDX, but pushes EDX and never clears it. Its caller last loaded EDX with
  the address of a local (`lea edx, [esp + 0x1c]`, for `msg_read`), so the count starts at a
  stack address, and the draw that follows (`rng_range(count - 1)`) wraps in 32 bits. The
  pseudocode shows a plain counter; only the disassembly shows the missing `xor edx, edx`.
  The port takes the address as an input (`count_start`), and the emulator varies the stack
  pointer per case so the test covers it. In a real run the value depends on where Windows
  put the main thread's stack: something to read from the running game.
- **An output pointer that aliases a counter.** The Moth roll-out passes the address of its
  own free-bay counter as the routine's EBX, and `0x419d20` writes the bay it took there.
  So the counter becomes the bay index and the loop stops early. Reading the callee alone
  shows an output; reading the caller alone shows a counter. Follow every pointer argument
  back to what it points at.

How to catch them: when a routine reads a register before writing it (EDX, EBX, ECX after
the pushes), find what the caller last put there, even across calls, since the calls keep
it. Under the emulator, run the routine from its real caller, or vary the register, rather
than calling it with clean registers: a clean EDX of 0 would have made `0x41a028` look
correct.