From 491c66e7428e0e8bb71271fb004b5ac98a10e4f4 Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Thu, 27 Aug 2026 11:40:29 +0000 Subject: [PATCH] re: Stage30-33 do not exist; AIParams is missing for exactly the tutorials Probing pak entry names with name_hash across all 41 paks: UnitGroup_SNN.tbl exists for exactly S01-S16 and S18-S29 = 28 stages. S17 and S30-S33 are absent, so the 33-entry STAGENN_UNIT_MAX table is headroom over a 28-stage game. Control is built in: 28 hits from 33 probes shows the loop resolves entry names. Corroboration that fell out of it: AIParams_SNN.tbl exists for S01-S16 and S24-S29 but is missing for exactly S18-S23 -- the six stages the corpus identified as tutorials by a completely different route (their lone guard is request_next() != 1). Two unrelated methods, same six. Stage_SNN.tbl probes find 0, which is expected: stagetbl.py documents that the per-stage record is not name-addressed. Drops the [phase+356]/[phase+360] consumer question: 243 non-stack lwz reads from those offsets image-wide, and the only ISL-region hits are the two writers plus two vtable calls. Not a cheap static question. Docs only; artefacts byte-identical. --- docs/re/BACKLOG.md | 25 +++++++++++++++++ docs/re/structures/isl-condition-builtins.md | 29 ++++++++++++++++++++ 2 files changed, 54 insertions(+) diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md index 52f8a33e..ed74f715 100644 --- a/docs/re/BACKLOG.md +++ b/docs/re/BACKLOG.md @@ -692,6 +692,31 @@ unknown, what evidence exists, and what the first step would be. Move an item in 🟑 Still open: who CONSUMES `[phase+356]`/`[phase+360]`; whether `Stage30`–`Stage33` exist; and the fallbacks behind the other 64 sections. +* βœ…πŸŸ‘ **(2026-08-27) `Stage30`–`Stage33` DO NOT EXIST β€” the 33-slot table is + headroom; and the `[phase+356]/[phase+360]` consumer is NOT findable by offset. + [structures/isl-condition-builtins](structures/isl-condition-builtins.md).** + βœ… Probing pak entry names (`name_hash` β€” the right hash for *entry* names) + across all 41 paks: **`UnitGroup_SNN.tbl` exists for exactly S01–S16 and + S18–S29 = 28 stages**; S17 and S30–S33 absent. The control is built in β€” 28 + hits from 33 probes proves the loop resolves entry names. So the 33-entry + `STAGENN_UNIT_MAX` table is oversized headroom over a 28-stage game, and the + gate's `!= 16` skip of STAGE17 lines up with a stage that genuinely has no data + of any kind. + πŸ”‘ **An independent corroboration fell out of it.** `AIParams_SNN.tbl` exists + for S01–S16 and S24–S29 (22) β€” **missing for exactly S18–S23**, precisely the + six stages the corpus identified as the TUTORIALS by a completely different + route (their only dominating condition is `request_next() != 1`). Tutorials + ship no AI parameters. Two unrelated methods, same six stages. + 🟑 `Stage_SNN.tbl` probes find 0 β€” expected, not a failure: `stagetbl.py` + documents that the per-stage record is *not* name-addressed and must be found + by content. + πŸ”΄ **Dropping the `[phase+356]`/`[phase+360]` consumer.** Image-wide there are + **243 non-stack `lwz` reads from +356/+360**, across UI, sound, render and + script code β€” the offsets are far too common to attribute. Inside the ISL region + the only hits are the two writers plus two **vtable calls** (`0x82273400` slot + 90, `0x82290ED8`). This needs type information the offset index does not carry; + it is not a cheap static question and should not be reopened as one. + ## βœ…βœ… SOLVED β€” the mission freeze was a modal sign-in dialog (2026-08-26) `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the diff --git a/docs/re/structures/isl-condition-builtins.md b/docs/re/structures/isl-condition-builtins.md index 65118457..b591d0d3 100644 --- a/docs/re/structures/isl-condition-builtins.md +++ b/docs/re/structures/isl-condition-builtins.md @@ -424,6 +424,35 @@ word-hit might be real is settled: it is not a record key. > β‡’ **`PLANE = 200` / `VESSEL = 20` for every stage** β€” now on a controlled test > rather than a scan whose reader had never been checked. +### βœ… (2026-08-27) `Stage30`–`Stage33` do not exist β€” the 33-slot table is headroom + +Probing the pak entry names (`name_hash`, the right hash for *entry* names) for +each stage-table family across all 41 paks: + +| family | stages present | +|---|---| +| `stage\UnitGroup_S%02d.tbl` | **01–16, 18–29 β€” 28 stages** | +| `stage\AIParams_S%02d.tbl` | 01–16, **24–29 β€” 22 stages** | +| `stage\Stage_S%02d.tbl` | 0 β€” expected; `stagetbl.py` documents that the per-stage record is *not* name-addressed | + +The control is built in: 28 hits out of 33 probes for `UnitGroup`, so the loop +resolves entry names correctly. **S17 and S30–S33 are absent**, so the 33-entry +`STAGENN_UNIT_MAX` table is oversized headroom over a 28-stage game. + +πŸ”‘ **An independent corroboration falls out of the second row.** `AIParams` is +missing for exactly **S18–S23** β€” precisely the six stages this page identifies +as the tutorials by a completely different route (their only dominating +condition is `request_next() != 1`). Tutorials ship no AI parameters. + +### 🟑 Who consumes `[phase+356]` / `[phase+360]`: not findable by offset + +Image-wide there are **243 non-stack `lwz` reads from +356/+360**, spread across +the UI, sound, render and script subsystems β€” the offsets are far too common to +attribute. Inside the ISL region the only hits are the two writers in +`sub_82261F70` and two **vtable calls** (`0x82273400` slot 90, `0x82290ED8`). +Dropping this sub-item: it needs type information the offset index does not +carry. + 🟑 Its neighbours belong to the same cluster: `builtin103` reads `[phase+10156]` and `[phase+10152]` (9 and 7 writers), and a sibling vtable stub clears `[phase+10152]`. The shape is an engineβ†’script status trio, but that is a