From d27bf549988753d25496d7284be9bc420f0321a5 Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Thu, 27 Aug 2026 08:00:22 +0000 Subject: [PATCH] re: both trigger kinds watch a ROUTE -- the unit-reaches-route mechanism The kind-0 condition tester sub_8226DAF8 resolves a symbol as well, but from payload+4 rather than +28: 8226DB14 rlwinm r10, r5, 2, 0, 29 ; r5 = payload+4, x4 8226DB24 lwz r11, 244(r30) ; [phase+244] = symbol table 1 8226DB3C lwzx r10, r10, r11 8226DB50 addi r4, r11, 4 ; -> the name string Both appenders write local[12] into whichever slot their own path reads -- built-in 19 into +4, built-in 25 into +4 and +28 -- so the same operand is the symbol either way, and it resolves cleanly: built-in 19 local[12] -> symtab 1 79 / 79 all symbol type 1 built-in 25 local[12] -> symtab 1 25 / 25 all symbol type 1 isl-builtins.md records symtab-1 type 1 as the Route_* names, and the samples agree: Route_ADN106_p1F, Route_ADN1xxe1_p1F, Route_ADS101_p1F, Route_TCN004_p1S. So both built-ins register a trigger on a UNIT reaching a ROUTE -- payload+0 is the unit, local[12] the route. They differ only in the payoff: built-in 19 additionally carries a handler routine (local[32] -> payload+28, kind 0 -> spawn) while built-in 25 carries none (kind 1 -> no spawn). That is a third independent agreement with isl.py's SYM1_SLOTS, which lists slot 12 for both and was derived from operand ranges alone. It also joins up with the closed REMAINING OB work, where the counter was measured to rise at a squadron's route arrival time -- route triggers are the mechanism that would do that. Recorded as a connection, not a demonstration: nothing here traces a trigger to that counter. All artefacts regenerate byte-identical; documentation only. Still unread: what the conditions actually COMPARE -- only sub_8226DAF8's first ~34 instructions are read, up to the name lookup, and sub_8226DC80 not at all -- and payload+8, a computed value passed to both testers. A waypoint index would fit it, which is exactly why it is not being called one. --- docs/re/BACKLOG.md | 18 ++++++++++ docs/re/structures/isl-trigger-node.md | 48 ++++++++++++++++++++++++-- 2 files changed, 64 insertions(+), 2 deletions(-) diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md index c9fef6d1..ca5bcc9a 100644 --- a/docs/re/BACKLOG.md +++ b/docs/re/BACKLOG.md @@ -170,6 +170,24 @@ unknown, what evidence exists, and what the first step would be. Move an item in testers, what the kind-1 path does with the route, and the drain's second spawn site `0x8226DA10`. +* ✅ **(2026-08-27) BOTH trigger kinds watch a ROUTE. + [structures/isl-trigger-node](structures/isl-trigger-node.md).** The kind-0 + condition `sub_8226DAF8` resolves a symbol from **`payload+4`** through + `[phase+244]` = symtab 1 (`rlwinm r10,r5,2,0,29; lwz r11,244(r30); lwzx`), and + both appenders write `local[12]` into the slot their own path reads. **`local[12]` + resolves 79/79 (built-in 19) and 25/25 (built-in 25), every one symbol TYPE 1 = + `Route_*`** (`Route_ADN106_p1F`, `Route_ADS101_p1F`, `Route_TCN004_p1S`). So both + register **a trigger on a UNIT reaching a ROUTE** (`payload+0` = the unit); they + differ only in the payoff — built-in 19 also carries a **handler routine** + (`local[32]`→`+28`, kind 0 → spawn), built-in 25 carries none (kind 1 → no spawn). + Third independent agreement with `SYM1_SLOTS`, which lists slot 12 for both. + 🔑 Joins up with the closed `REMAINING OB` result (the counter rises **at a + squadron's route arrival time**) — 🟡 stated as a connection, not a demonstration. + 🟡 Still unread: what the conditions COMPARE (only `sub_8226DAF8`'s first ~34 + instructions are read, up to the name lookup; `sub_8226DC80` entirely), and + `payload+8` (a computed value passed to both testers — waypoint-index shaped, + which is why it is not being called one). + ## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26) `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the diff --git a/docs/re/structures/isl-trigger-node.md b/docs/re/structures/isl-trigger-node.md index 332a01a8..9606cd44 100644 --- a/docs/re/structures/isl-trigger-node.md +++ b/docs/re/structures/isl-trigger-node.md @@ -167,13 +167,57 @@ conclusion**. **The two built-ins register two kinds of trigger:** built-in 19 a trigger whose payload is a *handler routine*, built-in 25 one whose payload is a *route*. +## ✅ BOTH trigger kinds watch a ROUTE + +The kind-0 condition tester `sub_8226DAF8` resolves a symbol too — from +`payload+4`, not `+28`: + +``` +8226DB14 rlwinm r10, r5, 2, 0, 29 ; r5 = payload+4, x4 +8226DB24 lwz r11, 244(r30) ; [phase+244] = SYMBOL TABLE 1 +8226DB3C lwzx r10, r10, r11 ; resolve it +8226DB50 addi r4, r11, 4 ; -> the name string +8226DB54 bl 0x8217FA08 +``` + +Both appenders write `local[12]` into the slot their path reads — built-in 19 +into `+4`, built-in 25 into `+4` *and* `+28`. So the same operand is the symbol +in both cases, and it resolves: + +| | `local[12]` through symbol table 1 | symbol type | +|---|---|---| +| built-in 19 | **79 / 79** | **all type 1** | +| built-in 25 | **25 / 25** | **all type 1** | + +`isl-builtins.md` records symtab-1 **type 1 as the `Route_*` names** (1362 +entries), and the samples bear it out: `Route_ADN106_p1F`, `Route_ADN1xxe1_p1F`, +`Route_ADS101_p1F`, `Route_TCN004_p1S`. + +**So both built-ins register a trigger on a UNIT reaching a ROUTE** — `payload+0` +is the unit, `local[12]` the route. They differ only in what happens when it +fires: built-in 19 additionally carries a **handler routine** (`local[32]` → +`payload+28`, kind 0 → spawn); built-in 25 carries none (kind 1 → no spawn). + +This also confirms `isl.py`'s `SYM1_SLOTS`, which lists slot 12 for **both** 19 +and 25 and was derived from operand ranges alone — a third independent agreement +with that table. + +🔑 It joins up with the closed `REMAINING OB` result, where the counter was +measured to rise **at a squadron's route arrival time**. Route triggers are the +mechanism that would do that. 🟡 Stated as a connection, not a demonstration — +nothing here traces a trigger to that counter. + ## 🟡 Not settled * ~~What the drain actually spawns.~~ ✅ Resolved above: built-in 19's nodes carry a real routine offset at `+28`. * ~~Whether `+24` selects between the two node kinds~~ ✅ It does — see above. -* **The two condition testers are unread**: `sub_8226DAF8` (kind 0) and - `sub_8226DC80` (kind 1), each gating its path on a `== 1` result. +* **What the conditions actually TEST.** Only `sub_8226DAF8`'s first ~34 + instructions are read — up to the route-name lookup. What it compares the route + against, and the whole of `sub_8226DC80` (kind 1), are unread. +* **`payload+8`** is a computed value in both appenders (`r29-1` in built-in 19) + and is passed to both testers; a waypoint index would fit, which is exactly why + it is not being called one. * **What the kind-1 path DOES with the route** past `sub_8217FA08` / `sub_8218CC88` / `sub_8225FEA0` is unread. * **The drain's second spawn site** (`0x8226DA10`) is in a later block and was