fabi/Sylpheed
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

re: both trigger kinds watch a ROUTE -- the unit-reaches-route mechanism

Browse Source 
The kind-0 condition tester sub_8226DAF8 resolves a symbol as well, but from
payload+4 rather than +28:

    8226DB14  rlwinm r10, r5, 2, 0, 29   ; r5 = payload+4, x4
    8226DB24  lwz    r11, 244(r30)       ; [phase+244] = symbol table 1
    8226DB3C  lwzx   r10, r10, r11
    8226DB50  addi   r4, r11, 4          ; -> the name string

Both appenders write local[12] into whichever slot their own path reads -- built-in 19
into +4, built-in 25 into +4 and +28 -- so the same operand is the symbol either way,
and it resolves cleanly:

    built-in 19   local[12] -> symtab 1   79 / 79   all symbol type 1
    built-in 25   local[12] -> symtab 1   25 / 25   all symbol type 1

isl-builtins.md records symtab-1 type 1 as the Route_* names, and the samples agree:
Route_ADN106_p1F, Route_ADN1xxe1_p1F, Route_ADS101_p1F, Route_TCN004_p1S.

So both built-ins register a trigger on a UNIT reaching a ROUTE -- payload+0 is the
unit, local[12] the route.  They differ only in the payoff: built-in 19 additionally
carries a handler routine (local[32] -> payload+28, kind 0 -> spawn) while built-in 25
carries none (kind 1 -> no spawn).  That is a third independent agreement with
isl.py's SYM1_SLOTS, which lists slot 12 for both and was derived from operand ranges
alone.

It also joins up with the closed REMAINING OB work, where the counter was measured to
rise at a squadron's route arrival time -- route triggers are the mechanism that would
do that.  Recorded as a connection, not a demonstration: nothing here traces a trigger
to that counter.

All artefacts regenerate byte-identical; documentation only.

Still unread: what the conditions actually COMPARE -- only sub_8226DAF8's first ~34
instructions are read, up to the name lookup, and sub_8226DC80 not at all -- and
payload+8, a computed value passed to both testers.  A waypoint index would fit it,
which is exactly why it is not being called one.
This commit is contained in:
Sylpheed RE agent
2026-08-27 08:00:22 +00:00
parent af9e8006b6
commit d27bf54998
2 changed files with 64 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
docs/re/BACKLOG.md
View File

@@ -170,6 +170,24 @@ unknown, what evidence exists, and what the first step would be. Move an item in
testers, what the kind-1 path does with the route, and the drain's second spawn
site `0x8226DA10`.
* ✅ **(2026-08-27) BOTH trigger kinds watch a ROUTE.
[structures/isl-trigger-node](structures/isl-trigger-node.md).** The kind-0
condition `sub_8226DAF8` resolves a symbol from **`payload+4`** through
`[phase+244]` = symtab 1 (`rlwinm r10,r5,2,0,29; lwz r11,244(r30); lwzx`), and
both appenders write `local[12]` into the slot their own path reads. **`local[12]`
resolves 79/79 (built-in 19) and 25/25 (built-in 25), every one symbol TYPE 1 =
`Route_*`** (`Route_ADN106_p1F`, `Route_ADS101_p1F`, `Route_TCN004_p1S`). So both
register **a trigger on a UNIT reaching a ROUTE** (`payload+0` = the unit); they
differ only in the payoff — built-in 19 also carries a **handler routine**
(`local[32]`→`+28`, kind 0 → spawn), built-in 25 carries none (kind 1 → no spawn).
Third independent agreement with `SYM1_SLOTS`, which lists slot 12 for both.
🔑 Joins up with the closed `REMAINING OB` result (the counter rises **at a
squadron's route arrival time**) — 🟡 stated as a connection, not a demonstration.
🟡 Still unread: what the conditions COMPARE (only `sub_8226DAF8`'s first ~34
instructions are read, up to the name lookup; `sub_8226DC80` entirely), and
`payload+8` (a computed value passed to both testers — waypoint-index shaped,
which is why it is not being called one).
## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
`XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the

48
docs/re/structures/isl-trigger-node.md
View File

@@ -167,13 +167,57 @@ conclusion**.
**The two built-ins register two kinds of trigger:** built-in 19 a trigger whose
payload is a *handler routine*, built-in 25 one whose payload is a *route*.
## ✅ BOTH trigger kinds watch a ROUTE
The kind-0 condition tester `sub_8226DAF8` resolves a symbol too — from
`payload+4`, not `+28`:
```
8226DB14 rlwinm r10, r5, 2, 0, 29 ; r5 = payload+4, x4
8226DB24 lwz r11, 244(r30) ; [phase+244] = SYMBOL TABLE 1
8226DB3C lwzx r10, r10, r11 ; resolve it
8226DB50 addi r4, r11, 4 ; -> the name string
8226DB54 bl 0x8217FA08
```
Both appenders write `local[12]` into the slot their path reads — built-in 19
into `+4`, built-in 25 into `+4` *and* `+28`. So the same operand is the symbol
in both cases, and it resolves:
| | `local[12]` through symbol table 1 | symbol type |
|---|---|---|
| built-in 19 | **79 / 79** | **all type 1** |
| built-in 25 | **25 / 25** | **all type 1** |
`isl-builtins.md` records symtab-1 **type 1 as the `Route_*` names** (1362
entries), and the samples bear it out: `Route_ADN106_p1F`, `Route_ADN1xxe1_p1F`,
`Route_ADS101_p1F`, `Route_TCN004_p1S`.
**So both built-ins register a trigger on a UNIT reaching a ROUTE** — `payload+0`
is the unit, `local[12]` the route. They differ only in what happens when it
fires: built-in 19 additionally carries a **handler routine** (`local[32]` →
`payload+28`, kind 0 → spawn); built-in 25 carries none (kind 1 → no spawn).
This also confirms `isl.py`'s `SYM1_SLOTS`, which lists slot 12 for **both** 19
and 25 and was derived from operand ranges alone — a third independent agreement
with that table.
🔑 It joins up with the closed `REMAINING OB` result, where the counter was
measured to rise **at a squadron's route arrival time**. Route triggers are the
mechanism that would do that. 🟡 Stated as a connection, not a demonstration —
nothing here traces a trigger to that counter.
## 🟡 Not settled
* ~~What the drain actually spawns.~~ ✅ Resolved above: built-in 19's nodes carry
a real routine offset at `+28`.
* ~~Whether `+24` selects between the two node kinds~~ ✅ It does — see above.
* **The two condition testers are unread**: `sub_8226DAF8` (kind 0) and
`sub_8226DC80` (kind 1), each gating its path on a `== 1` result.
* **What the conditions actually TEST.** Only `sub_8226DAF8`'s first ~34
instructions are read — up to the route-name lookup. What it compares the route
against, and the whole of `sub_8226DC80` (kind 1), are unread.
* **`payload+8`** is a computed value in both appenders (`r29-1` in built-in 19)
and is passed to both testers; a waypoint index would fit, which is exactly why
it is not being called one.
* **What the kind-1 path DOES with the route** past `sub_8217FA08` /
`sub_8218CC88` / `sub_8225FEA0` is unread.
* **The drain's second spawn site** (`0x8226DA10`) is in a later block and was