The engine's whole vocabulary is recoverable
Measured
The game's executable contains a dispatch table naming all 1,906 operators the scripts can call, each with its entry point. Pulling that table out replaced a guess-by-shape heuristic with a real list: about 98.5% of the heuristic's candidates turned out to be genuine, and roughly 33 names per install were coincidence.
It also shows how much engine surface the scripts never touch.