Five Lua API gaps, settled at the bytes.
- `FrameXML_Debug` sets its flag only from a number (`0x488440`); it always returns the flag.
- The eight debug globals exist and return nothing (`0x83de68` rows).
- `GetTalentTabInfo` returns the tab's SpellIcon path (`0x4f30d0`).
- `SetEuropeanNumbers` stores its flag (`[0xcf4d24]`). The flag survives a reload. FontString and Button `SetText` swap `.` and `,` inside a number under the exact byte tests of `0x771c50`.
- The protected-action gate (`0x494a50`) fires `MACRO_ACTION_FORBIDDEN` or `ADDON_ACTION_FORBIDDEN`. It covers the 23 tag-0 movement calls, PitchUp/Down included, by context: a `RunScript` chunk, an insecure addon's files, inline scripts and binding bodies, or the client's own. Stack scan; the unmodelled taint cases are listed in `taint.rs`.
Tests: a test for each fact, including the gate through `LoadAddOn` of a real chain addon.
Fixes#60Fixes#410Fixes#162Fixes#566Fixes#486🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sam Sung
b220d6a41c