re: both trigger kinds watch a ROUTE -- the unit-reaches-route mechanism

The kind-0 condition tester sub_8226DAF8 resolves a symbol as well, but from
payload+4 rather than +28:

    8226DB14  rlwinm r10, r5, 2, 0, 29   ; r5 = payload+4, x4
    8226DB24  lwz    r11, 244(r30)       ; [phase+244] = symbol table 1
    8226DB3C  lwzx   r10, r10, r11
    8226DB50  addi   r4, r11, 4          ; -> the name string

Both appenders write local[12] into whichever slot their own path reads -- built-in 19
into +4, built-in 25 into +4 and +28 -- so the same operand is the symbol either way,
and it resolves cleanly:

    built-in 19   local[12] -> symtab 1   79 / 79   all symbol type 1
    built-in 25   local[12] -> symtab 1   25 / 25   all symbol type 1

isl-builtins.md records symtab-1 type 1 as the Route_* names, and the samples agree:
Route_ADN106_p1F, Route_ADN1xxe1_p1F, Route_ADS101_p1F, Route_TCN004_p1S.

So both built-ins register a trigger on a UNIT reaching a ROUTE -- payload+0 is the
unit, local[12] the route.  They differ only in the payoff: built-in 19 additionally
carries a handler routine (local[32] -> payload+28, kind 0 -> spawn) while built-in 25
carries none (kind 1 -> no spawn).  That is a third independent agreement with
isl.py's SYM1_SLOTS, which lists slot 12 for both and was derived from operand ranges
alone.

It also joins up with the closed REMAINING OB work, where the counter was measured to
rise at a squadron's route arrival time -- route triggers are the mechanism that would
do that.  Recorded as a connection, not a demonstration: nothing here traces a trigger
to that counter.

All artefacts regenerate byte-identical; documentation only.

Still unread: what the conditions actually COMPARE -- only sub_8226DAF8's first ~34
instructions are read, up to the name lookup, and sub_8226DC80 not at all -- and
payload+8, a computed value passed to both testers.  A waypoint index would fit it,
which is exactly why it is not being called one.
This commit is contained in:
Sylpheed RE agent
2026-08-27 08:00:22 +00:00
parent 3a56cc6998
commit 5670716566
2 changed files with 64 additions and 2 deletions

View File

@@ -167,13 +167,57 @@ conclusion**.
**The two built-ins register two kinds of trigger:** built-in 19 a trigger whose
payload is a *handler routine*, built-in 25 one whose payload is a *route*.
## ✅ BOTH trigger kinds watch a ROUTE
The kind-0 condition tester `sub_8226DAF8` resolves a symbol too — from
`payload+4`, not `+28`:
```
8226DB14 rlwinm r10, r5, 2, 0, 29 ; r5 = payload+4, x4
8226DB24 lwz r11, 244(r30) ; [phase+244] = SYMBOL TABLE 1
8226DB3C lwzx r10, r10, r11 ; resolve it
8226DB50 addi r4, r11, 4 ; -> the name string
8226DB54 bl 0x8217FA08
```
Both appenders write `local[12]` into the slot their path reads — built-in 19
into `+4`, built-in 25 into `+4` *and* `+28`. So the same operand is the symbol
in both cases, and it resolves:
| | `local[12]` through symbol table 1 | symbol type |
|---|---|---|
| built-in 19 | **79 / 79** | **all type 1** |
| built-in 25 | **25 / 25** | **all type 1** |
`isl-builtins.md` records symtab-1 **type 1 as the `Route_*` names** (1362
entries), and the samples bear it out: `Route_ADN106_p1F`, `Route_ADN1xxe1_p1F`,
`Route_ADS101_p1F`, `Route_TCN004_p1S`.
**So both built-ins register a trigger on a UNIT reaching a ROUTE**`payload+0`
is the unit, `local[12]` the route. They differ only in what happens when it
fires: built-in 19 additionally carries a **handler routine** (`local[32]`
`payload+28`, kind 0 → spawn); built-in 25 carries none (kind 1 → no spawn).
This also confirms `isl.py`'s `SYM1_SLOTS`, which lists slot 12 for **both** 19
and 25 and was derived from operand ranges alone — a third independent agreement
with that table.
🔑 It joins up with the closed `REMAINING OB` result, where the counter was
measured to rise **at a squadron's route arrival time**. Route triggers are the
mechanism that would do that. 🟡 Stated as a connection, not a demonstration —
nothing here traces a trigger to that counter.
## 🟡 Not settled
* ~~What the drain actually spawns.~~ ✅ Resolved above: built-in 19's nodes carry
a real routine offset at `+28`.
* ~~Whether `+24` selects between the two node kinds~~ ✅ It does — see above.
* **The two condition testers are unread**: `sub_8226DAF8` (kind 0) and
`sub_8226DC80` (kind 1), each gating its path on a `== 1` result.
* **What the conditions actually TEST.** Only `sub_8226DAF8`'s first ~34
instructions are read — up to the route-name lookup. What it compares the route
against, and the whole of `sub_8226DC80` (kind 1), are unread.
* **`payload+8`** is a computed value in both appenders (`r29-1` in built-in 19)
and is passed to both testers; a waypoint index would fit, which is exactly why
it is not being called one.
* **What the kind-1 path DOES with the route** past `sub_8217FA08` /
`sub_8218CC88` / `sub_8225FEA0` is unread.
* **The drain's second spawn site** (`0x8226DA10`) is in a later block and was