diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md index 36a33c52..8a2a6081 100644 --- a/docs/re/BACKLOG.md +++ b/docs/re/BACKLOG.md @@ -135,6 +135,24 @@ unknown, what evidence exists, and what the first step would be. Move an item in ๐ŸŸก **Still does not explain the unreached code** โ€” 0 of the 79 handler offsets are unreached run-starts. +* ๐ŸŸก **(2026-08-27) THE UNREACHED CODE โ€” five mechanisms eliminated, nothing in the + file names it. [isl-unreached-code](isl-unreached-code.md).** Inverting the question + (read what an unreached routine DOES) sharpened it. **Metric partly inflated:** of + 24901 unreached instructions in 564 runs, **458 are length-1** (111 a lone `ret` + stranded after `end_coroutine`) โ€” but the gap is real: **24443 instructions in 106 + runs**, up to **1526** long. It is live logic: Stage 26's biggest run calls + `builtin57(ADN110,1)` and `set_group_speed(ADN110,2,0)`. ๐Ÿ”‘ **NEW: `kill_coroutine` + (built-in 5) confirmed as a code-offset carrier โ€” 150/150 on-stream vs a 34.0 % + control** โ€” yet **0 unreached run-starts**, the fifth such result. Across **2757 + code references** from five mechanisms (`start_coroutine` 1765, timeline 675, + built-in 19 triggers 79, `kill_coroutine` 150, `0x1883` 88), **not ONE lands on an + unreached run-start.** โœ… Not a tool artefact: 1765/1765 `start_coroutine` entries + resolve, 0 outside a phase region, 0 dropped by the on-stream filter. ๐ŸŸก With the + earlier "the offset appears nowhere as a word in any encoding", these routines are + referenced by **nothing inside the `.ssb`** โ€” either unused in this build, or + entered from outside it. โ–ถ๏ธ **No static test I have devised can choose**; a runtime + probe on `sub_822737C8`'s third argument would. + ## โœ…โœ… SOLVED โ€” the mission freeze was a modal sign-in dialog (2026-08-26) `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the diff --git a/docs/re/isl-unreached-code.md b/docs/re/isl-unreached-code.md new file mode 100644 index 00000000..035718dd --- /dev/null +++ b/docs/re/isl-unreached-code.md @@ -0,0 +1,86 @@ +# ๐ŸŸก The unreached code โ€” five mechanisms eliminated, and nothing in the file names it + +Inverting the question (read what an unreached routine *does*, instead of testing +another candidate mechanism) sharpened this considerably without solving it. + +## โœ… The metric was partly inflated โ€” but only partly + +Over all 28 stages: **24 901 unreached instructions (15.0 %) in 564 runs.** + +| | | +|---|---| +| runs of length 1 | **458** | +| โ€ฆof those, a lone `ret` (op 20) | 111 | +| **instructions in runs longer than 1** | **24 443 โ€” 14.7 %** | + +The length-1 runs are dead terminators: a `ret` stranded after an +`end_coroutine`, with the *next* routine being a properly seeded entry. Stage 02's +first two "unreached routines", `0x000D8C` and `0x002C00`, are exactly this โ€” the +code immediately after each is the phase main entry and a timeline target. + +But they are only 458 instructions. **The gap is real: 106 runs, several of them +huge** โ€” 1526 (Stage 26), 1496 and 1481 (Stage 29), 1069, 904, 860. + +## โœ… And it is live mission logic + +Stage 26's 1526-instruction run: + +``` +004BD8: local[0] = 1 ; local[4] = 1 ; local[8] = 1 +004C08: call builtin57(ADN110, 0x1) +004C44: local[16] = 0.0 +004C60: call set_group_speed(ADN110, 0x2, 0) +``` + +Named units, named built-ins, staged arguments. Not padding, not scratch. + +## ๐Ÿ”ด FIVE mechanisms carry code offsets โ€” and none points at it + +Every construct in the file that names a routine has now been enumerated and +tested against the unreached run-starts: + +| mechanism | references | on the instruction stream | control | **unreached run-starts** | +|---|---|---|---|---| +| `start_coroutine` (built-in 1) | 1765 | 1765 (100 %) | โ€” | **0** | +| the phase TIMELINE | 675 | 675 (100 %) | 33.3 % | **0** | +| built-in 19's trigger handler | 79 | 79 (100 %) | 27.8 % | **0** | +| **`kill_coroutine` (built-in 5)** | **150** | **150 (100 %)** | **34.0 %** | **0** | +| the `0x1883` records | 88 | 82 (93 %) | โ€” | (they *were* the 5 exits) | + +`kill_coroutine` is new this iteration and confirms the corpus's reading โ€” its +`local[0]` is a phase-relative code offset, 150/150, values 13 740โ€ฆ221 048. + +**Across 2 757 code references, not one lands on an unreached run-start.** That +is not a near miss; it is a categorical absence. + +## โœ… Not a tool artefact + +The obvious suspicion is that my entry extractor drops targets. It does not: + +* **1765 of 1765** `start_coroutine` sites resolve โ€” **0 missed**. +* **0** entries land outside their phase's region. +* **0** entries are discarded by the "must be on the instruction stream" filter. + +## ๐ŸŸก Where that leaves it + +Combined with the earlier result that an unreached routine's offset appears +**nowhere in the file as a word**, in any encoding (phase-relative, absolute, and +both /4 forms, all at or below their controls), the conclusion is that these +routines are **referenced by nothing inside the `.ssb`**. + +Two readings remain, and this work does not choose between them: + +1. they are **unused in this build** โ€” compiled from source that the shipped + mission never enters; or +2. they are entered from **outside the file** โ€” a table in another pak, or engine + code holding an offset. + +โš ๏ธ Reading (1) is not comfortable with a 1526-instruction routine that +manipulates a named squadron, but "uncomfortable" is not evidence. + +## ๐ŸŸก Not settled + +* Which of the two readings is right. A runtime probe โ€” breaking on + `sub_822737C8` and logging its third argument through a mission โ€” would decide + it, and no static test I have devised can. +* Whether the 106 runs are one phenomenon or several.