From e24b46fbe8f0c5b930ee9b3b18e18dd29d19ed66 Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Tue, 25 Aug 2026 18:03:50 +0000 Subject: [PATCH] re: the trigger-queue pending count verified live -- 0 -> 1 -> 2 Read from a running Stage 02 mission: the container at ScriptPhase+272 has +20 moving 0 -> 1 -> 2 over the first two minutes while the phase ordinal stays 1. So +20 is a real count of currently registered triggers -- the script arming watches as it goes, and Stage 02 has 12 push_trigger sites -- and it is readable from /dev/shm with no debugger. First direct view of what the script is waiting for. Corrects one field from the static reading: +12 is not (only) a list head. It reads 0x000A0009, which is not a pointer, even though the push's 'addi r31, r30, 12' made list-head the obvious interpretation. Recorded as unresolved rather than kept quietly. --- docs/re/structures/isl-builtins.md | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/docs/re/structures/isl-builtins.md b/docs/re/structures/isl-builtins.md index 80eeff92..b5fa077a 100644 --- a/docs/re/structures/isl-builtins.md +++ b/docs/re/structures/isl-builtins.md @@ -270,4 +270,26 @@ readable from `/dev/shm` with no debugger. Watching it alongside which is exactly the moment the condition coroutines get started, and the thing every phase experiment so far has been blind to. -**Not yet verified live.** The layout above is read off the disassembly only. +### ✅ Verified live + +Read from a running Stage 02 mission (`ScriptPhase 0xBE14DD80`, container at +`0xBE14DE90`): + +``` ++272+12 = 0x000A0009 +272+16 = 0xBC28E620 (a node pointer) ++272+20 = 0 +272+24 = 0 + +[ 0.0s] pending=0 phase=1 finished=0 +[ 68.0s] pending=1 phase=1 finished=0 +[ 108.1s] pending=2 phase=1 finished=0 +``` + +**`+20` moves, 0 → 1 → 2**, while the phase ordinal stays 1. So it is a real +counter of **currently registered triggers** — the script arming watches as it +goes (Stage 02 has 12 `push_trigger` sites) — and it is readable live with no +debugger. That is the first direct view of *what the script is waiting for*. + +🟡 **`+12` is not a list head after all**, or not only that: it reads +`0x000A0009`, which is not a pointer. The `addi r31, r30, 12` in the push made +"list head" the obvious reading and the value does not support it. Recorded as +unresolved rather than quietly kept.