From 510dcf29d86792478ae04f2ab7bbd6e6881879c8 Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Wed, 26 Aug 2026 01:38:08 +0000 Subject: [PATCH] =?UTF-8?q?re:=20built-ins=2026/28/29=20are=20one=20family?= =?UTF-8?q?=20=E2=80=94=20and=20damage=5Funit=20looks=20mis-named?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Method-diffing settled the structure but not the semantics, so nothing is named this time. 26 damage_unit vt76 sub_8226ACD0 (67) opcode 800 97 sites 28 vt84 sub_82268F98 (69) opcode 801 410 sites 29 vt88 sub_822690B0 (69) opcode 802 164 sites 101 vt276 sub_822691C8 (78) opcode 802 133 sites (broadcast) 28 and 29 differ in two words only -- the opcode (0x21BA vs 0x22BA) and a descriptor pointer 8 bytes apart -- and are otherwise instruction-identical. All three take (unit, double). 26 differs from both by one guard: it rejects only state 3, while 28 and 29 reject states 1 and 3. The operand distributions separate them: 26 97 sites 7 distinct [0, 100] 0 x69, 80 x10, 100 x6 28 410 sites 13 distinct [0, 2000] 200 x116, 120 x76, 300 x74 29 164 sites 6 distinct [0, 100] 0 x64, 100 x53, 50 x38 26 and 29 are percentage-shaped; 28 is an absolute quantity an order of magnitude larger. That casts doubt on an existing name. damage_unit (26) passes 0 in 69 of its 97 calls -- dealing zero damage is a no-op, so 71% of its call sites would do nothing, while SETTING a percentage-valued property to 0 is a natural thing to do 69 times. 29 has the same shape. The name predates this session and I have not withdrawn it, but it should not be relied on. Where this stopped: the three commands' descriptors at 0x820A8D10/+8/+16 point into 0x8210E5xx, which is BELOW the disassembly DB's range (it starts at 0x82150000) and holds no code, so that route cannot reach an execute method. Opcodes 800-802's semantics need the interpreter command table instead. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE --- docs/re/structures/isl-builtins.md | 45 ++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/docs/re/structures/isl-builtins.md b/docs/re/structures/isl-builtins.md index 779ffee..fa2cc8b 100644 --- a/docs/re/structures/isl-builtins.md +++ b/docs/re/structures/isl-builtins.md @@ -140,6 +140,51 @@ and spread checks but its maximum *exceeds* the table — flag indices run 0..31 against symbol tables as small as 40 — so it is excluded, and the disassembler now declines to resolve it rather than printing an invented name. +### 🟡 Built-ins 26 / 28 / 29 are one family — and `damage_unit` looks mis-named + +Method-diffing put the structure beyond doubt but did not reach the semantics. + +| built-in | vtable slot | method | opcode | sites | +|---|---|---|---|---| +| 26 `damage_unit` | 76 | `sub_8226ACD0` (67) | **800** | 97 | +| **28** | 84 | `sub_82268F98` (69) | **801** | 410 | +| **29** | 88 | `sub_822690B0` (69) | **802** | 164 | +| 101 | 276 | `sub_822691C8` (78) | 802 (broadcast) | 133 | + +**28 and 29 differ in two words only** — the opcode (`0x21BA` vs `0x22BA`) and a +descriptor pointer 8 bytes apart. Otherwise instruction-identical. All three take +`(unit, double)`. + +26 differs from both by one guard: it rejects only state 3, while **28 and 29 +reject states 1 and 3** (2 = active, 1/3/4 = gone/dead/invalid). + +#### The operand distributions separate them + +| built-in | n | distinct | range | most common | +|---|---|---|---|---| +| 26 | 97 | 7 | **[0, 100]** | **0 ×69**, 80 ×10, 100 ×6 | +| 28 | 410 | 13 | **[0, 2000]** | 200 ×116, 120 ×76, 300 ×74 | +| 29 | 164 | 6 | **[0, 100]** | **0 ×64**, 100 ×53, 50 ×38 | + +26 and 29 are percentage-shaped; 28 is an absolute quantity an order of magnitude +larger. + +#### 🟡 `damage_unit` (26) is doubtful + +**69 of its 97 calls pass 0.** Dealing zero damage is a no-op, so 71 % of the +call sites would do nothing. *Setting* a percentage-valued property to 0 is a +perfectly natural thing to do 69 times, and 29 has the same shape (0 ×64 of 164). +The existing name predates this session and is not withdrawn, but it should not +be relied on. + +#### ❌ Where this stopped + +The three commands' descriptors sit at `0x820A8D10` / `+8` / `+16`. Following +them lands on data pointing into `0x8210E5xx`, which is **below the disassembly +DB's range** (it starts at `0x82150000`) and contains no code — so that route +does not reach an execute method. Reaching opcodes 800–802's semantics needs the +interpreter's command table, not the command objects. + ### ✅ Built-in 108 is `deploy_squadron_ex` — `deploy_squadron` plus a `1 << n` selector 1146 sites in 22 stages, the second-largest unnamed built-in. Its method