fabi/Syplheed-Reborn
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

re: the Time/Points record is not on the debriefing path - and a ring drainer matches the message bus

Browse Source 
Read 0x821A0AD0, the debriefing, end to end, resolving every call and string in
code order. The word-B bit-setter sub_8219F2E8 is its FIRST call, before anything
else; the function makes 44 calls and references exactly two strings, DEBRIEFING
and BASE_INFO.

No Time and no Points anywhere on this path - not in the debriefing, not in the
bit-setter. Section 5.3's expectation that clearing a challenge stage records its
metric alongside the bit is not supported by the code that clears it. The reach of
that negative: the debriefing function and its directly-called bit-setter, both
read whole; it does not rule out a store deeper inside one of the other 43
callees.

0x8219F670 turns out to be an online-state predicate: 88 bytes, no strings, reads
the singleton, tests bit 1 of [0]+60, and if set passes [0]+64 to 0x824A9C90 and
returns whether the result is 2. A connection or sign-in check, not a record
store.

The useful find is 0x8219F460, 368 bytes and self-recursive, which drains a ring
based at r29+320 with element base +4, capacity +8, head +12 and count +16. Those
are the corpus's documented message-bus offsets exactly - BACKLOG records
sub_82175C20(bus+4, &msg) as a ring-buffer append with capacity +8, head +12,
count +16 - and sub_82175C20 is the very notifier section 5.6 found the word-B
writer calling with bit + 64. So the open question "ring-buffer PUSH, no handler"
now has a candidate drainer with a byte-for-byte matching field layout, reached
from the debriefing.

What is NOT shown is that these are the same ring instance. The push targets
bus+4, this drain targets r29+320. Matching offsets prove a shared container
shape, not a shared object, and the identity needs the two base pointers tied
together.

All seventeen artefacts byte-identical.
This commit is contained in:
Sylpheed RE agent
2026-08-28 13:07:02 +00:00
parent f7a0cf47b1
commit 35538e3b5b
2 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
docs/re/BACKLOG.md
View File

@@ -7120,3 +7120,29 @@ after B) before/after the setter and loops its 32 bits calling `0x82175C20` with
⚠️ **Against §5.3's prediction:** neither the writer nor its caller references
`Time` or `Points` (0 both). It is the **bit-setter only**; the Time/Points record
store is still unlocated.
---
## ❌🔑 2026-08-28 — the Time/Points record is not on the debriefing path; a ring drainer matches the message bus
Read `0x821A0AD0` (the debriefing) end to end. **The word-B bit-setter
`sub_8219F2E8` is its FIRST call**; the function makes 44 calls and references
exactly two strings, `DEBRIEFING` and `BASE_INFO`.
❌ **No `Time` or `Points` anywhere on this path** — so §5.3's expectation that the
metric is recorded alongside the clear bit is not supported by the clearing code.
**Reach:** the debriefing and its bit-setter, read whole; a store deeper inside one
of the other 43 callees is not excluded.
✅ **`0x8219F670` is an online-state predicate** — tests bit 1 of singleton
`[0]+60`, passes `[0]+64` to `0x824A9C90`, returns `result == 2`.
🔑 **`0x8219F460` (368 B, self-recursive) drains a ring based at `r29+320`** with
element base `+4`, capacity `+8`, head `+12`, count `+16` — **the corpus's
documented message-bus offsets exactly** (`sub_82175C20(bus+4, &msg)` is the
append, capacity `+8`, head `+12`, count `+16`), and `sub_82175C20` is the same
notifier §5.6 found the word-B writer calling. The open 🟡 "ring-buffer PUSH, no
handler" now has a **candidate drainer with a matching layout**.
🟡 **Not shown: same ring INSTANCE.** Push targets `bus+4`, drain targets
`r29+320`. Matching offsets prove a shared container *shape*, not a shared object.