From 2a731aa8b759df7263553ef9e9bc4980bcc1a889 Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Fri, 28 Aug 2026 13:07:02 +0000 Subject: [PATCH] re: the Time/Points record is not on the debriefing path - and a ring drainer matches the message bus Read 0x821A0AD0, the debriefing, end to end, resolving every call and string in code order. The word-B bit-setter sub_8219F2E8 is its FIRST call, before anything else; the function makes 44 calls and references exactly two strings, DEBRIEFING and BASE_INFO. No Time and no Points anywhere on this path - not in the debriefing, not in the bit-setter. Section 5.3's expectation that clearing a challenge stage records its metric alongside the bit is not supported by the code that clears it. The reach of that negative: the debriefing function and its directly-called bit-setter, both read whole; it does not rule out a store deeper inside one of the other 43 callees. 0x8219F670 turns out to be an online-state predicate: 88 bytes, no strings, reads the singleton, tests bit 1 of [0]+60, and if set passes [0]+64 to 0x824A9C90 and returns whether the result is 2. A connection or sign-in check, not a record store. The useful find is 0x8219F460, 368 bytes and self-recursive, which drains a ring based at r29+320 with element base +4, capacity +8, head +12 and count +16. Those are the corpus's documented message-bus offsets exactly - BACKLOG records sub_82175C20(bus+4, &msg) as a ring-buffer append with capacity +8, head +12, count +16 - and sub_82175C20 is the very notifier section 5.6 found the word-B writer calling with bit + 64. So the open question "ring-buffer PUSH, no handler" now has a candidate drainer with a byte-for-byte matching field layout, reached from the debriefing. What is NOT shown is that these are the same ring instance. The push targets bus+4, this drain targets r29+320. Matching offsets prove a shared container shape, not a shared object, and the identity needs the two base pointers tied together. All seventeen artefacts byte-identical. --- docs/re/BACKLOG.md | 26 ++++++++++++++++++ docs/re/challenge-mission-gate.md | 44 +++++++++++++++++++++++++++++++ 2 files changed, 70 insertions(+) diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md index 0af92849..da7785af 100644 --- a/docs/re/BACKLOG.md +++ b/docs/re/BACKLOG.md @@ -7120,3 +7120,29 @@ after B) before/after the setter and loops its 32 bits calling `0x82175C20` with โš ๏ธ **Against ยง5.3's prediction:** neither the writer nor its caller references `Time` or `Points` (0 both). It is the **bit-setter only**; the Time/Points record store is still unlocated. + +--- + +## โŒ๐Ÿ”‘ 2026-08-28 โ€” the Time/Points record is not on the debriefing path; a ring drainer matches the message bus + +Read `0x821A0AD0` (the debriefing) end to end. **The word-B bit-setter +`sub_8219F2E8` is its FIRST call**; the function makes 44 calls and references +exactly two strings, `DEBRIEFING` and `BASE_INFO`. + +โŒ **No `Time` or `Points` anywhere on this path** โ€” so ยง5.3's expectation that the +metric is recorded alongside the clear bit is not supported by the clearing code. +**Reach:** the debriefing and its bit-setter, read whole; a store deeper inside one +of the other 43 callees is not excluded. + +โœ… **`0x8219F670` is an online-state predicate** โ€” tests bit 1 of singleton +`[0]+60`, passes `[0]+64` to `0x824A9C90`, returns `result == 2`. + +๐Ÿ”‘ **`0x8219F460` (368 B, self-recursive) drains a ring based at `r29+320`** with +element base `+4`, capacity `+8`, head `+12`, count `+16` โ€” **the corpus's +documented message-bus offsets exactly** (`sub_82175C20(bus+4, &msg)` is the +append, capacity `+8`, head `+12`, count `+16`), and `sub_82175C20` is the same +notifier ยง5.6 found the word-B writer calling. The open ๐ŸŸก "ring-buffer PUSH, no +handler" now has a **candidate drainer with a matching layout**. + +๐ŸŸก **Not shown: same ring INSTANCE.** Push targets `bus+4`, drain targets +`r29+320`. Matching offsets prove a shared container *shape*, not a shared object. diff --git a/docs/re/challenge-mission-gate.md b/docs/re/challenge-mission-gate.md index e1bfa0e1..4d154ab7 100644 --- a/docs/re/challenge-mission-gate.md +++ b/docs/re/challenge-mission-gate.md @@ -626,3 +626,47 @@ announced one at a time โ€” an unlock-notification loop. caller references **`Time`** or **`Points`** (0 for both). ยง5.3 expected word B's writer to also store the stage's Time/Points record. **It does not โ€” this is the bit-setter only.** The record store is still unlocated. + +### 5.7 โŒ The Time/Points record is NOT on the debriefing path โ€” and a ring drainer turns up + +Reading `0x821A0AD0` (the debriefing) end to end, resolving every call and string +in code order: + +* **The word-B bit-setter `sub_8219F2E8` is its FIRST call** (`0x821A0B1C`), + before anything else. +* **44 calls, and exactly two strings in the whole function: `DEBRIEFING` and + `BASE_INFO`.** + +โŒ **No `Time`, no `Points`, anywhere on this path** โ€” not in the debriefing, not +in the bit-setter. ยง5.3's expectation that clearing a challenge stage records its +metric alongside the bit is **not supported by the code that clears it**. Reach of +this negative: the debriefing function and its directly-called bit-setter, read +whole; it does not rule out a store further down one of the other 43 callees. + +โœ… **`0x8219F670` is an online-state predicate.** 88 bytes, no strings: reads the +singleton, tests bit 1 of `[0]+60`, and if set passes `[0]+64` to `0x824A9C90` +and returns `result == 2`. A connection/sign-in check, not a record store. + +#### ๐Ÿ”‘ `0x8219F460` drains a ring with the message bus's exact field layout + +`0x8219F460` (368 B, self-recursive) pops from a ring based at `r29+320`: + +| offset from the ring base | role, from the code | +|---:|---| +| `+4` | element array base (`lwzx r10, r10, r8`) | +| `+8` | capacity (compared against head) | +| `+12` | head (incremented, wrapped to 0) | +| `+16` | count (`addic. r10, r10, -1`) | + +โš ๏ธ **Those are the corpus's documented message-bus offsets, exactly**: `BACKLOG` +records `sub_82175C20(bus+4, &msg)` as "a ring-buffer append (capacity `+8`, head +`+12`, count `+16`)". And **`sub_82175C20` is the very notifier ยง5.6 found the +word-B writer calling** with `bit + 64`. + +So the corpus's open ๐ŸŸก "ring-buffer PUSH, no handler" now has a **candidate +drainer with a byte-for-byte matching field layout**, reached from the debriefing. + +๐ŸŸก **Not shown: that these are the same ring *instance*.** The push targets +`bus+4`; this drain targets `r29+320`. Matching offsets prove a shared *shape* โ€” +the same container template โ€” not a shared object. **Same layout โ‰  same +instance**, and the identity needs the two base pointers tied together.