re: A/B in the trigger test -- searched, not settled, and the matrix reading excluded

Ran the "who writes this" move on the two 3-double vectors the trigger condition pulls
out of the unit record.  It did not settle them, and it is worth recording why.

99 sites across 40 functions write +32/+40/+48; 16 sites across 13 write +64/+72/+80;
six functions write both.  The most inviting is sub_821AD218, which is a float-to-double
widening copy of exactly 16 floats -- lfs from r4+0..60, stfd to r3+0..120.  Sixteen
floats is a 4x4 matrix, under which +32/+40/+48 is row 1 and +64/+72/+80 is row 2,
making A and B basis vectors rather than positions.  That is a tidy story and it is
wrong for this record.

The disproof was already in hand: sub_8226DAF8 reads `lwz r10, 100(r11)`, a WORD at
+100, which falls inside where a 16-double matrix's row 3 (+96..+120) would sit.  A
second writer, sub_8226A348 -- same built-in shape, [phase+324] indexed by local[4]
with the rec+4 liveness check -- confirms a mixed layout: words at +0/+4/+8/+12/+16 and
at +80, doubles only at +32/+40/+48.

So these offsets recur at the same positions in several unrelated object layouts, and
nothing found here ties a specific writer to the object the trigger actually reads.

A and B stay unnamed.  That is the second tidy reading rejected for them, after
previous/current-position.

All artefacts regenerate byte-identical; documentation only.
This commit is contained in:
Sylpheed RE agent
2026-08-27 08:21:58 +00:00
parent 70df1c3a1b
commit eda1f3e368
2 changed files with 31 additions and 0 deletions

View File

@@ -218,6 +218,21 @@ unknown, what evidence exists, and what the first step would be. Move an item in
▶️ Trigger work remaining is peripheral: which unit-record fields A and B are, slot
60 past the `t < 0` rejection, `payload+8`, and the kind-1 path in the drain.
* 🔎🔴 **(2026-08-27) A/B in the trigger test: SEARCHED, NOT SETTLED — and the tidy
reading is EXCLUDED. [structures/isl-trigger-node](structures/isl-trigger-node.md).**
The "who writes this" move found **99 sites in 40 functions** writing `+32/+40/+48`
and 16 in 13 writing `+64/+72/+80`; six functions write both. The inviting one,
`sub_821AD218`, widens **exactly 16 floats to 16 doubles** (`lfs r4+0…60`
`stfd r3+0…120`) — a **4×4 matrix**, which would make A and B rows 2 and 1, i.e.
BASIS VECTORS not positions. 🔴 **Wrong for the trigger's record**, disproved by
evidence already in hand: `sub_8226DAF8` reads **`lwz r10, 100(r11)`, a WORD at
+100**, inside where a 16-double matrix's row 3 (+96…+120) would be. `sub_8226A348`
(same built-in shape) confirms a MIXED layout — words at `+0/+4/+8/+12/+16` and
**`+80`**, doubles only at `+32/+40/+48`. So these offsets recur across several
unrelated object layouts and nothing ties a writer to the trigger's object.
**A and B stay unnamed** — the second tidy reading rejected for them, after
previous/current-position.
## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
`XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the

View File

@@ -290,6 +290,22 @@ spawn. The trigger mechanism is now read end to end.
* ~~What the kind-0 condition tests~~ ✅ Read. ~~`sub_8226DC80` (kind 1)~~ ✅ Read —
the same test with an inline distance pre-filter.
* **Which unit-record fields A and B are** — `rec+64/72/80` vs `rec+32/40/48`.
🔎 **Searched, not settled — and one tidy reading positively excluded.** The
"who writes this" move found **99 sites in 40 functions** writing `+32/+40/+48`
and 16 sites in 13 writing `+64/+72/+80`, with six functions writing both. The
most inviting of them, `sub_821AD218`, is a **float→double widening copy of
exactly 16 floats** (`lfs r4+0…60``stfd r3+0…120`) — a **4×4 matrix**, in
which `+32/+40/+48` would be row 1 and `+64/+72/+80` row 2, i.e. basis vectors
rather than positions.
🔴 **That reading is wrong for the trigger's record**, and the disproof was
already in hand: `sub_8226DAF8` reads **`lwz r10, 100(r11)` — a WORD at +100**,
which falls inside where a 16-double matrix's row 3 (+96…+120) would sit. A
second writer, `sub_8226A348` (same built-in shape: `[phase+324]` by `local[4]`,
`rec+4` liveness), confirms a mixed layout — words at `+0/+4/+8/+12/+16` and
**`+80`**, doubles only at `+32/+40/+48`.
So `+32/+40/+48` appears at the same offsets in **several unrelated object
layouts**, and nothing ties a specific writer to the object the trigger reads.
A and B stay unnamed.
* **The rest of slot 60** past the `t < 0` rejection (a second constant at
`0x820B0000+25192` is loaded next).
* **`payload+8`** is a computed value in both appenders (`r29-1` in built-in 19)