From b63e6cc8afbca401353e5e25e7695bc71f23c8e9 Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Thu, 27 Aug 2026 08:21:58 +0000 Subject: [PATCH] re: A/B in the trigger test -- searched, not settled, and the matrix reading excluded Ran the "who writes this" move on the two 3-double vectors the trigger condition pulls out of the unit record. It did not settle them, and it is worth recording why. 99 sites across 40 functions write +32/+40/+48; 16 sites across 13 write +64/+72/+80; six functions write both. The most inviting is sub_821AD218, which is a float-to-double widening copy of exactly 16 floats -- lfs from r4+0..60, stfd to r3+0..120. Sixteen floats is a 4x4 matrix, under which +32/+40/+48 is row 1 and +64/+72/+80 is row 2, making A and B basis vectors rather than positions. That is a tidy story and it is wrong for this record. The disproof was already in hand: sub_8226DAF8 reads `lwz r10, 100(r11)`, a WORD at +100, which falls inside where a 16-double matrix's row 3 (+96..+120) would sit. A second writer, sub_8226A348 -- same built-in shape, [phase+324] indexed by local[4] with the rec+4 liveness check -- confirms a mixed layout: words at +0/+4/+8/+12/+16 and at +80, doubles only at +32/+40/+48. So these offsets recur at the same positions in several unrelated object layouts, and nothing found here ties a specific writer to the object the trigger actually reads. A and B stay unnamed. That is the second tidy reading rejected for them, after previous/current-position. All artefacts regenerate byte-identical; documentation only. --- docs/re/BACKLOG.md | 15 +++++++++++++++ docs/re/structures/isl-trigger-node.md | 16 ++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md index 326c9385..733b08ea 100644 --- a/docs/re/BACKLOG.md +++ b/docs/re/BACKLOG.md @@ -218,6 +218,21 @@ unknown, what evidence exists, and what the first step would be. Move an item in ▢️ Trigger work remaining is peripheral: which unit-record fields A and B are, slot 60 past the `t < 0` rejection, `payload+8`, and the kind-1 path in the drain. +* πŸ”ŽπŸ”΄ **(2026-08-27) A/B in the trigger test: SEARCHED, NOT SETTLED β€” and the tidy + reading is EXCLUDED. [structures/isl-trigger-node](structures/isl-trigger-node.md).** + The "who writes this" move found **99 sites in 40 functions** writing `+32/+40/+48` + and 16 in 13 writing `+64/+72/+80`; six functions write both. The inviting one, + `sub_821AD218`, widens **exactly 16 floats to 16 doubles** (`lfs r4+0…60` β†’ + `stfd r3+0…120`) β€” a **4Γ—4 matrix**, which would make A and B rows 2 and 1, i.e. + BASIS VECTORS not positions. πŸ”΄ **Wrong for the trigger's record**, disproved by + evidence already in hand: `sub_8226DAF8` reads **`lwz r10, 100(r11)`, a WORD at + +100**, inside where a 16-double matrix's row 3 (+96…+120) would be. `sub_8226A348` + (same built-in shape) confirms a MIXED layout β€” words at `+0/+4/+8/+12/+16` and + **`+80`**, doubles only at `+32/+40/+48`. So these offsets recur across several + unrelated object layouts and nothing ties a writer to the trigger's object. + **A and B stay unnamed** β€” the second tidy reading rejected for them, after + previous/current-position. + ## βœ…βœ… SOLVED β€” the mission freeze was a modal sign-in dialog (2026-08-26) `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the diff --git a/docs/re/structures/isl-trigger-node.md b/docs/re/structures/isl-trigger-node.md index 88b9975d..26defacc 100644 --- a/docs/re/structures/isl-trigger-node.md +++ b/docs/re/structures/isl-trigger-node.md @@ -290,6 +290,22 @@ spawn. The trigger mechanism is now read end to end. * ~~What the kind-0 condition tests~~ βœ… Read. ~~`sub_8226DC80` (kind 1)~~ βœ… Read β€” the same test with an inline distance pre-filter. * **Which unit-record fields A and B are** β€” `rec+64/72/80` vs `rec+32/40/48`. + πŸ”Ž **Searched, not settled β€” and one tidy reading positively excluded.** The + "who writes this" move found **99 sites in 40 functions** writing `+32/+40/+48` + and 16 sites in 13 writing `+64/+72/+80`, with six functions writing both. The + most inviting of them, `sub_821AD218`, is a **floatβ†’double widening copy of + exactly 16 floats** (`lfs r4+0…60` β†’ `stfd r3+0…120`) β€” a **4Γ—4 matrix**, in + which `+32/+40/+48` would be row 1 and `+64/+72/+80` row 2, i.e. basis vectors + rather than positions. + πŸ”΄ **That reading is wrong for the trigger's record**, and the disproof was + already in hand: `sub_8226DAF8` reads **`lwz r10, 100(r11)` β€” a WORD at +100**, + which falls inside where a 16-double matrix's row 3 (+96…+120) would sit. A + second writer, `sub_8226A348` (same built-in shape: `[phase+324]` by `local[4]`, + `rec+4` liveness), confirms a mixed layout β€” words at `+0/+4/+8/+12/+16` and + **`+80`**, doubles only at `+32/+40/+48`. + So `+32/+40/+48` appears at the same offsets in **several unrelated object + layouts**, and nothing ties a specific writer to the object the trigger reads. + A and B stay unnamed. * **The rest of slot 60** past the `t < 0` rejection (a second constant at `0x820B0000+25192` is loaded next). * **`payload+8`** is a computed value in both appenders (`r29-1` in built-in 19)