re: derive UNIT_ARG from the implementations -- 31 built-ins take a unit, not 31 of 55
isl.py's UNIT_ARG decides whether a built-in's slot-4 operand prints as a unit name or a raw number. It was inferred statistically from operand ranges and, by its own comment, listed a slot "only when the ratio stayed below 1.0" -- conservative. The vtable base makes it a lookup instead: every unit-taking built-in's implementation opens with lwz 324(phase) / lwz 4(argbase) / rlwinm 2,0,29 / lwzx / lwz 4(rec). Read directly for all 147: implementation indexes [phase+324] by an argument 55 of the statistical set's 31, confirmed 31 (zero false positives) UNIT_ARG claims a unit, implementation does not 0 implementation says unit, UNIT_ARG missed it 24 The 24 include builtin80, group_ratio_pct, is_engaged, set_unit_flags, squadron_trace, wait_units_ready and deploy_and_wait. Hand-verified by reading builtin7, 16, 80, 105, 117 and 136. Recorded because it nearly passed: my FIRST control -- whether the additions' operands resolve to a symbol-table-2 index -- is worthless. The additions score 100.0%, but so do the 31 baseline (100.0%) AND the 92 built-ins in neither set (99.3%). Symtab 2 is dense enough that almost any small integer lands in it. A control the negative class also passes is not evidence. The control that discriminates is the tag word: a symbol operand is a two-word pair whose first word is the constant 1, so slot0 == 1 exactly when slot 4 is a unit -- 100.0% (13677 calls) / 100.0% (140) / 2.5% (2903). A 40x separation. Artefacts: isl-stage02.txt and -phase-ends.txt regenerate byte-identical; -conditions changes on 28 sites, every diff line pairing, each a raw number becoming a unit name. Left unnamed on purpose: all 24. builtin80 returns a small enum (tested 0..4 in a switch) but its body past the liveness check is unread; builtin103 is a predicate over [phase+10152]/[phase+10156]; builtin105 tests a unit record's +16 against 4.
This commit is contained in:
Sylpheed RE agent
@@ -1438,6 +1438,17 @@ premise was wrong.**
|
||||
exact, and seeding the tracker at coroutine ENTRIES (`start_coroutine`'s target
|
||||
is staged slot 0) would resolve the LHS. ▶️ **Still open:** the 35 unnamed built-ins (`builtin16` 132
|
||||
sites, `builtin105` 117, `builtin103` 115 — each now a vtable-slot lookup);
|
||||
✅ **(2026-08-27) partial — [structures/isl-unit-args](structures/isl-unit-args.md):**
|
||||
reading the implementations shows **55** built-ins take a unit at `local[4]`,
|
||||
not 31. All 31 of the statistical set are confirmed (**zero false positives**);
|
||||
it missed **24**, incl. `builtin80`, `group_ratio_pct`, `is_engaged`,
|
||||
`set_unit_flags`, `squadron_trace`, `wait_units_ready`. ⚠️ My first control
|
||||
(operands resolving to a symtab-2 index) was **worthless** — the 92 built-ins
|
||||
in neither set also score 99.3 %. The control that works is the **tag word**:
|
||||
`slot0 == 1` in 100.0 % / 100.0 % / **2.5 %**. Artefacts: calls + phase-ends
|
||||
byte-identical, conditions changes on 28 sites (raw number → unit name).
|
||||
Still unnamed: all 24. `builtin103` is a predicate over `[phase+10152]` and
|
||||
`[phase+10156]` (no unit arg); `builtin105` tests a unit record's `+16` == 4.
|
||||
which condition guards each `END_PHASE` (needs the control flow between them);
|
||||
the vtable's length. The condition lives in the `op10`/`op13` poll loop upstream of
|
||||
the outro — e.g. phase 3 polls `unit_state(ADT308)` and branches back to
|
||||
|
||||
@@ -539,12 +539,12 @@ the right-hand side is evaluated (its result lands in `special[0]`),
|
||||
0x01B554 if dist_lt(TCT206, ADN231, 20000) == 1 -> 0x1B598
|
||||
0x01B5E0 if hp_pct_test(ADN232, 0, 0) == 1 -> 0x1B680
|
||||
0x01B66C if dist_lt(TCT206, ADN232, 20000) == 1 -> 0x1B6B0
|
||||
0x01B6C0 if builtin80(1, 117) == 0 -> 0x1AC74
|
||||
0x01B6D4 if builtin80(1, 117) == 1 -> 0x1B140
|
||||
0x01B6E8 if builtin80(1, 117) == 2 -> 0x1B258
|
||||
0x01B6FC if builtin80(1, 117) == 3 -> 0x1B370
|
||||
0x01B710 if builtin80(1, 117) == 4 -> 0x1B488
|
||||
0x01B724 if builtin80(1, 117) == 5 -> 0x1B5A0
|
||||
0x01B6C0 if builtin80(TCT206) == 0 -> 0x1AC74
|
||||
0x01B6D4 if builtin80(TCT206) == 1 -> 0x1B140
|
||||
0x01B6E8 if builtin80(TCT206) == 2 -> 0x1B258
|
||||
0x01B6FC if builtin80(TCT206) == 3 -> 0x1B370
|
||||
0x01B710 if builtin80(TCT206) == 4 -> 0x1B488
|
||||
0x01B724 if builtin80(TCT206) == 5 -> 0x1B5A0
|
||||
0x01B77C if hp_pct_test(TCN207, 0, 0) != 1 -> 0x1B79C
|
||||
0x01B7D4 if unit_alive(ADN201) != 1 -> 0x1B8A4
|
||||
0x01B840 if dist_lt(TCN207, ADN201, 15000) != 1 -> 0x1B8A4
|
||||
@@ -566,12 +566,12 @@ the right-hand side is evaluated (its result lands in `special[0]`),
|
||||
0x01C090 if dist_lt(TCN207, ADN231, 20000) == 1 -> 0x1C0D4
|
||||
0x01C11C if hp_pct_test(ADN232, 0, 0) == 1 -> 0x1C1BC
|
||||
0x01C1A8 if dist_lt(TCN207, ADN232, 20000) == 1 -> 0x1C1EC
|
||||
0x01C1FC if builtin80(1, 101) == 0 -> 0x1B7B0
|
||||
0x01C210 if builtin80(1, 101) == 1 -> 0x1BC7C
|
||||
0x01C224 if builtin80(1, 101) == 2 -> 0x1BD94
|
||||
0x01C238 if builtin80(1, 101) == 3 -> 0x1BEAC
|
||||
0x01C24C if builtin80(1, 101) == 4 -> 0x1BFC4
|
||||
0x01C260 if builtin80(1, 101) == 5 -> 0x1C0DC
|
||||
0x01C1FC if builtin80(TCN207) == 0 -> 0x1B7B0
|
||||
0x01C210 if builtin80(TCN207) == 1 -> 0x1BC7C
|
||||
0x01C224 if builtin80(TCN207) == 2 -> 0x1BD94
|
||||
0x01C238 if builtin80(TCN207) == 3 -> 0x1BEAC
|
||||
0x01C24C if builtin80(TCN207) == 4 -> 0x1BFC4
|
||||
0x01C260 if builtin80(TCN207) == 5 -> 0x1C0DC
|
||||
0x01C2B8 if hp_pct_test(TCN208, 0, 0) != 1 -> 0x1C2D8
|
||||
0x01C310 if unit_alive(ADN201) != 1 -> 0x1C3E0
|
||||
0x01C37C if dist_lt(TCN208, ADN201, 15000) != 1 -> 0x1C3E0
|
||||
@@ -593,12 +593,12 @@ the right-hand side is evaluated (its result lands in `special[0]`),
|
||||
0x01CBCC if dist_lt(TCN208, ADN231, 20000) == 1 -> 0x1CC10
|
||||
0x01CC58 if hp_pct_test(ADN232, 0, 0) == 1 -> 0x1CCF8
|
||||
0x01CCE4 if dist_lt(TCN208, ADN232, 20000) == 1 -> 0x1CD28
|
||||
0x01CD38 if builtin80(1, 104) == 0 -> 0x1C2EC
|
||||
0x01CD4C if builtin80(1, 104) == 1 -> 0x1C7B8
|
||||
0x01CD60 if builtin80(1, 104) == 2 -> 0x1C8D0
|
||||
0x01CD74 if builtin80(1, 104) == 3 -> 0x1C9E8
|
||||
0x01CD88 if builtin80(1, 104) == 4 -> 0x1CB00
|
||||
0x01CD9C if builtin80(1, 104) == 5 -> 0x1CC18
|
||||
0x01CD38 if builtin80(TCN208) == 0 -> 0x1C2EC
|
||||
0x01CD4C if builtin80(TCN208) == 1 -> 0x1C7B8
|
||||
0x01CD60 if builtin80(TCN208) == 2 -> 0x1C8D0
|
||||
0x01CD74 if builtin80(TCN208) == 3 -> 0x1C9E8
|
||||
0x01CD88 if builtin80(TCN208) == 4 -> 0x1CB00
|
||||
0x01CD9C if builtin80(TCN208) == 5 -> 0x1CC18
|
||||
0x01D200 if hp_pct_test(ADN201, 0) != 1 -> 0x1D244
|
||||
0x01D27C if unit_alive(TCN207) != 1 -> 0x1D34C
|
||||
0x01D2E8 if dist_lt(ADN201, TCN207, 15000) != 1 -> 0x1D34C
|
||||
@@ -614,11 +614,11 @@ the right-hand side is evaluated (its result lands in `special[0]`),
|
||||
0x01D9EC if dist_lt(ADN201, TCN208, 20000) == 1 -> 0x1DA30
|
||||
0x01DAA8 if builtin7(ADN201, 1, Route_ADN201_p2S, 4294967295, 500, 0) != 1 -> 0x1DB48
|
||||
0x01DBC0 if dist_lt(ADN201, TCT206, 20000) == 1 -> 0x1DC04
|
||||
0x01DC1C if builtin80(1, 3) == 0 -> 0x1D258
|
||||
0x01DC30 if builtin80(1, 3) == 1 -> 0x1D5E8
|
||||
0x01DC44 if builtin80(1, 3) == 2 -> 0x1D810
|
||||
0x01DC58 if builtin80(1, 3) == 3 -> 0x1DA38
|
||||
0x01DC6C if builtin80(1, 3) == 4 -> 0x1DC0C
|
||||
0x01DC1C if builtin80(ADN201) == 0 -> 0x1D258
|
||||
0x01DC30 if builtin80(ADN201) == 1 -> 0x1D5E8
|
||||
0x01DC44 if builtin80(ADN201) == 2 -> 0x1D810
|
||||
0x01DC58 if builtin80(ADN201) == 3 -> 0x1DA38
|
||||
0x01DC6C if builtin80(ADN201) == 4 -> 0x1DC0C
|
||||
0x01DCC4 if hp_pct_test(ADN202, 0, 0) != 1 -> 0x1DD08
|
||||
0x01DD4C if hp_pct_test(ADN207, 0) != 1 -> 0x1DD6C
|
||||
0x01DDA4 if unit_alive(TCN207) != 1 -> 0x1DE74
|
||||
@@ -639,11 +639,11 @@ the right-hand side is evaluated (its result lands in `special[0]`),
|
||||
0x01E7D4 if builtin7(ADN207, 1, Route_ADN207_p2S, 3, 55, 0) != 1 -> 0x1E914
|
||||
0x01E80C if unit_alive(TCN208) != 1 -> 0x1E8AC
|
||||
0x01E98C if dist_lt(ADN207, TCT206, 20000) == 1 -> 0x1E9D0
|
||||
0x01E9E8 if builtin80(1, 42) == 0 -> 0x1DD80
|
||||
0x01E9FC if builtin80(1, 42) == 1 -> 0x1E1D4
|
||||
0x01EA10 if builtin80(1, 42) == 2 -> 0x1E49C
|
||||
0x01EA24 if builtin80(1, 42) == 3 -> 0x1E764
|
||||
0x01EA38 if builtin80(1, 42) == 4 -> 0x1E9D8
|
||||
0x01E9E8 if builtin80(ADN207) == 0 -> 0x1DD80
|
||||
0x01E9FC if builtin80(ADN207) == 1 -> 0x1E1D4
|
||||
0x01EA10 if builtin80(ADN207) == 2 -> 0x1E49C
|
||||
0x01EA24 if builtin80(ADN207) == 3 -> 0x1E764
|
||||
0x01EA38 if builtin80(ADN207) == 4 -> 0x1E9D8
|
||||
0x01F78C if unit_state(ADN201) != 1 -> 0x1F7F8
|
||||
0x01F7E4 if unit_state(TCT206) == 1 -> 0x1F804
|
||||
0x01F85C if dist_lt(ADN201, TCT206, 10000) != 1 -> 0x1FA7C
|
||||
|
||||
93
docs/re/structures/isl-unit-args.md
Normal file
93
docs/re/structures/isl-unit-args.md
Normal file
@@ -0,0 +1,93 @@
|
||||
# ✅ Which built-ins take a unit — read from the implementations, and the old set was short
|
||||
|
||||
`isl.py`'s `UNIT_ARG` decides whether a built-in's slot-4 operand is printed as
|
||||
a **unit name** or as a raw number. It was built **statistically**, from operand
|
||||
ranges, and its own comment says slots were listed *"only when the ratio stayed
|
||||
below 1.0"* — i.e. only when every observed value resolved. That is
|
||||
conservative, and it was.
|
||||
|
||||
## The direct method
|
||||
|
||||
[`isl-builtin-dispatch`](isl-builtin-dispatch.md) makes this a lookup: a
|
||||
built-in's stub tail-calls a fixed slot of the `ScriptPhase` vtable at
|
||||
`0x820A84BC`, so the implementation can simply be read. Every unit-taking
|
||||
built-in opens the same way — this is `unit_state`, `builtin80`, `builtin117`
|
||||
and `builtin136`, character for character:
|
||||
|
||||
```
|
||||
lwz r10, 324(r31) ; the unit array
|
||||
lwz r11, 4(r30) ; r30 = the local[] base, so this is local[4]
|
||||
rlwinm r11, r11, 2, 0, 29 ; x4
|
||||
lwzx r11, r11, r10 ; -> the record
|
||||
lwz r11, 4(r11) ; the handle
|
||||
cmpli cr6, 0, r11, 0x0 ; "is this squadron gone?"
|
||||
```
|
||||
|
||||
## ✅ Result: 31 → 55
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| built-ins whose implementation indexes `[phase+324]` by an argument | **55** |
|
||||
| of the statistical set's 31, confirmed | **31 — all of them** |
|
||||
| **UNIT_ARG claims a unit, the implementation does not** | **0** |
|
||||
| **implementation says unit, UNIT_ARG missed it** | **24** |
|
||||
|
||||
The 24: `21, 22, 23, 32, 42, 44, 46 (squadron_trace), 49, 50, 51, 55, 60, 61,
|
||||
72 (group_ratio_pct), 80, 83, 94 (is_engaged), 101, 109 (set_unit_flags), 117,
|
||||
136, 137 (wait_units_ready), 141, 142 (deploy_and_wait)`.
|
||||
|
||||
Zero false positives is worth stating on its own: the statistical method was
|
||||
**right about everything it claimed** and only too cautious about what it
|
||||
omitted.
|
||||
|
||||
## ⚠️ The first control I chose was worthless — recorded because it nearly passed
|
||||
|
||||
I first checked whether the additions' slot-4 operands resolve to a symbol-table-2
|
||||
index. They did, **100.0 %** — and it means nothing:
|
||||
|
||||
| set | operands resolving to a symtab-2 unit |
|
||||
|---|---|
|
||||
| the 31 baseline | 100.0 % |
|
||||
| the 24 additions | 100.0 % |
|
||||
| **the 92 built-ins in neither set** | **99.3 %** |
|
||||
|
||||
Symbol table 2 is dense enough that almost any small integer lands in it, so the
|
||||
test does not discriminate. A control that the negative class also passes is not
|
||||
evidence, and this one was one careless glance from being written up as proof.
|
||||
|
||||
## ✅ The control that does discriminate
|
||||
|
||||
`isl-builtins.md` documents that a symbol operand is a **two-word pair** — a tag
|
||||
holding the constant 1, then the index. So slot 0 should be 1 exactly when
|
||||
slot 4 is a unit:
|
||||
|
||||
| set | calls with `slot0 == 1` |
|
||||
|---|---|
|
||||
| the 31 baseline | **100.0 %** (13 677 calls) |
|
||||
| the 24 additions | **100.0 %** (140 calls) |
|
||||
| the 92 in neither set | **2.5 %** (2 903 calls) |
|
||||
|
||||
A 40× separation, and the additions sit exactly on the positive class.
|
||||
|
||||
## Effect on the artefacts
|
||||
|
||||
`data/isl-stage02.txt` and `-phase-ends.txt` regenerate **byte-identical**;
|
||||
`-conditions.txt` changes on 28 sites, every diff line pairing, all of them a
|
||||
raw number becoming a unit name:
|
||||
|
||||
```
|
||||
- 0x01B6C0 if builtin80(0x8B) == 0 -> + 0x01B6C0 if builtin80(TCT206) == 0
|
||||
```
|
||||
|
||||
## 🟡 Not settled
|
||||
|
||||
* **The 24 are still unnamed.** Knowing an argument is a unit is not knowing what
|
||||
the built-in does. `builtin80` (69 operands disc-wide) is tested against
|
||||
0, 1, 2, 3, 4 in a switch chain, so it returns a small enumeration — but I am
|
||||
not naming it from that, and its body past the liveness check is unread.
|
||||
* `builtin103` (`0x8226BFA8`) is a predicate over **`[phase+10152]` and
|
||||
`[phase+10156]`**, neighbours of a value read out at `+10160`; it takes no unit.
|
||||
The fields have 9, 7 and 1 writers respectively, none of them read.
|
||||
* `builtin105` (`0x8226BFF0`) tests a unit record's **`+16` against 4**. What
|
||||
`rec+16` holds is not established — `isl-builtins.md` only rules out its being
|
||||
what `unit_state` reads.
|
||||
@@ -178,8 +178,22 @@ def symbols(b, which):
|
||||
# spread tests but its maximum EXCEEDS the table (flag indices run 0..31 against
|
||||
# tables as small as 40), so it is excluded. Slots are only listed here when the
|
||||
# ratio stayed below 1.0.
|
||||
UNIT_ARG = {2, 3, 7, 12, 15, 16, 18, 19, 20, 24, 25, 26, 28, 29, 30, 47, 48,
|
||||
56, 57, 58, 63, 69, 70, 79, 91, 92, 95, 105, 108, 128, 143}
|
||||
# DERIVED FROM THE IMPLEMENTATIONS, not from operand ranges. Each of these
|
||||
# built-ins resolves to a ScriptPhase vtable slot whose body does
|
||||
# lwz rX, 324(rPhase) ; the unit array
|
||||
# lwz rY, 4(rArgBase) ; local[4]
|
||||
# rlwinm rY, rY, 2, 0, 29 ; x4
|
||||
# lwzx ... ; -> the record
|
||||
# The previous set was inferred statistically from operand ranges and listed a
|
||||
# slot only "when the ratio stayed below 1.0", so it was CONSERVATIVE: all 31 of
|
||||
# its entries are confirmed here (zero false positives) but it MISSED 24 more.
|
||||
# Control, over all 28 stages: slot 0 is the tag constant 1 in 100.0% of the
|
||||
# original 31's calls, 100.0% of the 24 additions', and only 2.5% of the 92
|
||||
# built-ins in neither set.
|
||||
UNIT_ARG = {2, 3, 7, 12, 15, 16, 18, 19, 20, 21, 22, 23, 24, 25, 26, 28, 29, 30,
|
||||
32, 42, 44, 46, 47, 48, 49, 50, 51, 55, 56, 57, 58, 60, 61, 63, 69,
|
||||
70, 72, 79, 80, 83, 91, 92, 94, 95, 101, 105, 108, 109, 117, 128,
|
||||
136, 137, 141, 142, 143}
|
||||
UNIT_ARG2 = {2, 18, 47, 48, 56, 79, 95, 128} # a SECOND unit index at blob[12]
|
||||
UNIT_ARG3 = {128} # and a third at blob[20]
|
||||
UNIT_SLOTS = {4: UNIT_ARG, 12: UNIT_ARG2, 20: UNIT_ARG3}
|
||||
|
||||
Reference in New Issue
Block a user