christopher/Syphon_Filter_3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

phase8: record cycle 3, the SDK-shape verdict, and the worker negative results

Browse Source 
Cycle 3 merged 22 claims (worker A's 8 new plus 9 gp rows, worker C's 6 pure-C
rows) at 137 regions / 128 distinct bodies, and closed every near-miss that
Phases 5-7 recorded in the reachable set: 0x800F3160, 0x800F8AEC, 0x800F8B58/6C,
0x800F8FE4, 0x80102B10 (maspsx=off), 0x800F7FB4 x3 (a cc1 loop-shape artifact),
0x8009E8D0 x2 (ordinary matching).

Worker C's SDK-shape investigation refuted its own premise: the COP2 shapes are
reachable, the blocker was never the missing SDK headers, and the stack accessor
needs no asm at all. The 8 COP2/syscall regions are parked pending the
developer's inline-asm convention decision.

Recorded as results, not footnotes: three rules that were tested and bounded. The
commutative-operand rule's direction is right but its trigger fails for a literal
base in a counted loop; the do/while loop rewrite does not transfer to
0x800FBF5C; and the reorg class is a cc1 reorder thread-fill decision that no
assembler can perform for a conditional branch, so it is a bounded negative
rather than a harness gap.
This commit is contained in:
Christopher Williams
2026-09-23 23:16:08 -04:00
parent 2775d2e077
commit 18e784df39
1 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
phase-ends/CURRENT_PHASE.md
+53
View File
@@ -194,6 +194,59 @@ region.
`Rules check — re-read complete. Continuing with P8-T5 coordination.`
## P8-T4b — Cycle 3 verified (2026-09-23)
| Merge | Claims | Accepted | Skipped | Rejected | Result |
|---|---|---|---|---|---|
| Cycle 3 | 50 (A 44 cumulative, C 6 pure-C) | 22 | 28 | 0 | candidate gate `c_regions=137`, 0 differing, `MATCH`; promoted; `make check` green |
**137 regions / 128 distinct bodies.** Every near-miss recorded by Phases 5–7 in the reachable set is now
closed:
| Was | Now | Mechanism |
|---|---|---|
| `0x800F3160` — "no tested compiler + assembler pair reproduces its store-in-delay-slot scheduling" (Phase 5) | matched | `maspsx=off` |
| `0x800F8AEC`, `0x800F8B58`, `0x800F8B6C`, `0x800F8FE4`, `0x80102B10` | matched | `maspsx=off` |
| `0x800F7FB4` ×3 addresses — "loop body exact, unexplained 8-byte frame" (Phase 7) | matched | explicit guard + do/while: the frame was a **cc1 loop-shape artifact** |
| `0x8009E8D0` ×2 addresses (g0030) — near-match for two workers | matched | ordinary matching |
| the 8 COP2/syscall bodies | **parked** | waiting on the inline-asm convention decision |
## P8-T5 — the SDK-shape investigation: solved, with a policy gate (2026-09-23)
Worker C's bounded investigation **refuted the premise of the class**: the COP2 shapes are reachable, and
the blocker was never the missing SDK headers.
- 8 regions verified: `0x80103A94` (`cfc2`), `0x80103B60` (`ctc2`), `0x800F3E70` (`mtc2`/`mfc2`),
`0x80109778` (two `ctc2`), `0x8001AE3C` (three `ctc2`), `0x800FB5D4` (stack accessor), `0x80103FCC` and
`0x80103FEC` (BIOS stubs).
- Byte-proved toolchain facts: GNU `as -march=r3000` accepts `cop2 <25-bit cmd>`, `mtc2`, `mfc2`, `cfc2`,
`ctc2`, `lwc2`, `swc2` and `syscall`; maspsx passes inline-asm text through untouched; cc1 accepts
`__asm__ volatile` with these mnemonics; and the control-register map used by this executable is recorded
with proof (`$13/$14/$15` = LR1LR2/LR3LG1/LG2LG3, `$24/$25` = OFX/OFY, `$26` = H, `$28` = DQB; data
`$0` = VXY0, `$1` = VZ0, `$14` = SXY2, `$19` = SZ3, `$30` = LZCS, `$31` = LZCR; `nRTPS` = `0x180001`).
- The stack accessor needs **no asm at all**: `register int sp __asm__("$29"); return sp;` is a documented
GNU C register binding and produces the exact body. Merged as pure C.
- **Parked pending the developer's convention decision** (6 COP2 bodies + 2 BIOS stubs): each contains a
one-line inline-asm statement in SDK-macro form, with the integer logic in C and all scheduling produced
by cc1/maspsx. No `.word` lumps and no whole-function asm.
- `g0013` (`0x80010810`) stays unclaimed as a documented near-match: ~30 source shapes, 13 flag sets and 6
compilers all produce the same 1-instruction-shorter body, so the residual is a local-alloc copy-coalescing
tie-break. Option (ii), a pinned register, was correctly rejected as distorting allocation rather than
reproducing the source.
- Verdict on the big groups: `g0026` (120B ×3), `g0053` (436B ×2), `g0061` (712B ×2) are **ordinary
matching** now that COP2 is reachable — not a blocked class. Worker C is on `g0026`.
## Worker negative results, recorded so they do not over-generalise
Both new rules were tested by worker B against its own open rows before being treated as rules, and both
came back **negative** outside their original scope. This is recorded as a result, not a footnote.
| Rule | Tested on | Outcome |
|---|---|---|
| Commutative operand order, named-pointer spelling | `0x80019B6C` | Direction right, **trigger wrong** for a literal base inside a counted loop: direct spelling 1 byte off (best known), named-pointer spelling *worse* at 16 bytes. Scope limited to a symbol/gp base. |
| Loop-shape rewrite (do/while) | `0x800FBF5C` | **No change** — that row has no frame in either spelling and is one instruction short for another reason. Scoped to "an unexplained frame can be a loop-shape artifact". |
| Reorg / delay-slot-fill class | `0x800FF47C`, `0x800FFBBC` | **Not** the maspsx class. cc1 wraps a deliberate slot instruction in `.set noreorder`/`.set nomacro`; where the wrapper is absent cc1 wants a `nop`, and a conditional-branch fill is never semantics-preserving, so no assembler can do it. Bounded negatives. |
## Notes and limits
- Three sessions share one worktree. The safety property is that a worker's claim is never trusted: the