From 3219504e9d6a709d904969738db9cd1df7b34fbe Mon Sep 17 00:00:00 2001 From: Christopher Williams Date: Thu, 24 Sep 2026 23:28:29 -0400 Subject: [PATCH] phase12: record second-batch checkpoint --- docs/MATCHING_COOKBOOK.md | 16 ++++++++++ phase-ends/CURRENT_PHASE.md | 18 +++++------ phase-ends/logs/Phase12.md | 62 +++++++++++++++++++++++++++++++++++++ 3 files changed, 86 insertions(+), 10 deletions(-) diff --git a/docs/MATCHING_COOKBOOK.md b/docs/MATCHING_COOKBOOK.md index 69e04b8..5f93b02 100644 --- a/docs/MATCHING_COOKBOOK.md +++ b/docs/MATCHING_COOKBOOK.md @@ -3360,3 +3360,19 @@ declaration order are likewise required for the address form and sp+24/sp+40 loc > **When a call follows a batch copy, reconstruct the live values at the call from the register > dataflow, not from the values that happen to be copied first. A five-argument prototype can > preserve incoming registers while its final argument travels on the stack.** + +### 192. Frame-pinned body matching: fix the missing guard before tuning registers (solo, Phase 12) + +Four consecutive second-batch matches show a repeatable order: derive the body from the exact +instruction/dataflow, then add only the missing source construct. `0x800BC9C4` needed a do/while +V4 assignment plus byte-offset arithmetic; `0x800BC8C4` needed both call pairs under the actual +nonpositive-counter guard; `0x8006BB0C` needed its outer null check; and `0x8002D17C` needed the +queue pointer bound to a1. In each case the frame/call structure made the remaining register +residual small and local. + +> **When a candidate is a few instructions short, first search for a missing guard, loop shape, +> or pointer level in the decoded control flow. Do not start with register-binding permutations +> until the structural body and frame are reproduced.** + +This is a companion to findings 43/45/49: branch polarity, named liveness, and register allocation +are still required, but they are the second line of attack after a structural omission is found. diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md index 013b445..92dbd11 100644 --- a/phase-ends/CURRENT_PHASE.md +++ b/phase-ends/CURRENT_PHASE.md @@ -6,18 +6,16 @@ ## STATE — SOLO CONTINUATION, 2026-09-24 (current) -**695 bodies / 704 regions**, from 685 / 694 at the last session stop — **+10 bodies / +10 regions**. -The Phase 12 milestone remains 750 bodies, so **+55 remains**. The promoted whole-binary gate is green: -`c_regions=704`, `differing_bytes=0`, SHA-1 +**699 bodies / 708 regions**, from 685 / 694 at the last session stop — **+14 bodies / +14 regions**. +The Phase 12 milestone remains 750 bodies, so **+51 remains**. The promoted whole-binary gate is green: +`c_regions=708`, `differing_bytes=0`, SHA-1 `e173426c157384ebf1b6caf8c6fea18a85a14af9`; 344 synthetic tests pass and extents report -`regions=704 disagreements=0 result=AGREE`. - -The requested ten successful matches are complete. The tenth is `0x80095CF8` (124 bytes), which -closes the two-vector copy/call row by preserving the original's five-argument dataflow: incoming -`a0`, record pointer, two local-vector addresses, and stack zero. Worklist regeneration is now 978 -rows; `excluded_already_registered=702` continues the already-characterised two-row registry lag and -is not a correctness issue because the 704-region gate proves the registry simultaneously. +`regions=708 disagreements=0 result=AGREE`. +The requested second batch of 20 is underway. Four additional bodies are now matched: +`0x800BC9C4`, `0x800BC8C4`, `0x8006BB0C`, and `0x8002D17C`. Worklist regeneration is now 974 +rows; `excluded_already_registered=706` continues the already-characterised two-row registry lag and +is not a correctness issue because the 708-region gate proves the registry simultaneously. ## STATE — SESSION STOP, 2026-09-24 23:35 (historical; superseded by the state above, kept for provenance) **685 bodies / 694 regions**, from 602 / 611 at the Phase 11 close — **+83 bodies**. **Milestone 750 was NOT diff --git a/phase-ends/logs/Phase12.md b/phase-ends/logs/Phase12.md index b1a2394..4fe941c 100644 --- a/phase-ends/logs/Phase12.md +++ b/phase-ends/logs/Phase12.md @@ -2054,3 +2054,65 @@ confirmed. `excluded_already_registered=702`, preserving the known two-row lag. **Final count after the tenth successful body: 695 bodies / 704 regions (+93 bodies from the Phase 12 open baseline).** + +## SECOND SOLO BATCH — 20-BODY REQUEST + +### Batch task 1 — `0x800BC9C4` (80 B) MATCH + +* Exact extent: `0x800BC9C4..0x800BCA14`, 80 bytes, grade `exact`. +* A do/while V4 assignment supplies the four-load/four-store body; the end pointer is formed + through a byte pointer so 0x14F0 is not scaled as an int-pointer displacement. A source-bound + a3 pointer and the corrected destination displacement 0x30F4 close the register/address fields. +* Tracked source md5: `b960c0bf2d79891843acebf2f220fcfe`; fresh range and candidate whole-binary + gate were both zero-difference. Promoted gate: 705 regions, SHA-1 unchanged; `make check` passed. + +### Batch task 2 — `0x800BC8C4` (156 B) MATCH + +* Exact extent: `0x800BC8C4..0x800BC960`, 156 bytes, grade `exact`. +* The adjacent `0x800BC960` call pattern transfers with the counter increment and new callees. The + decisive semantic correction is that both call pairs are nested under `v <= 0`; a positive old + counter jumps to the epilogue. +* Tracked source md5: `558981805f2a0503029e288e43ca6d7b`; fresh range and candidate gate were + zero-difference. Promoted gate: 706 regions; `make check` passed. + +### Batch task 3 — `0x8006BB0C` (124 B) MATCH + +* Exact extent: `0x8006BB0C..0x8006BB88`, 124 bytes, grade `exact`. +* The missing outer null check on a0 was the only structural correction. A V4 assignment produces + the four-word copy, followed by the target's conditional flag clear and same-pointer callback. +* Tracked source md5: `abe883e5d229df0ce40cf91534f2d923`; fresh range and candidate gate were + zero-difference. Promoted gate: 707 regions; `make check` passed. + +### Batch task 4 — `0x8002D17C` (124 B) MATCH + +* Exact extent: `0x8002D17C..0x8002D1F8`, 124 bytes, grade `exact`. +* The queue loop is reproduced with item-counter decrement, callback clear, queue update, and + indirect call. The final correction is an explicit `$5` binding for the current queue link, + matching the target's a1 allocation through the loop-back branch. +* Tracked source md5: `aa3f06f4b3409f426afdc3875d833ec9`; fresh range and candidate gate were + zero-difference. Promoted gate: 708 regions; `make check` passed. + +**Batch checkpoint: 4 additional bodies / 4 regions matched; current count 699 bodies / 708 regions.** + +### Bounded attempts in the second batch — stopped without registration + +* `0x800321F8`: explicit branch/goto and register-binding forms reached 80/88/92-byte variants but + did not reproduce the target's three-block 96-byte epilogue/delay shape. +* `0x8006F6F4`: direct globals and a v0 destination pointer did not reproduce the target's batched + four-word copy plus repeated absolute-field address forms. +* `0x8002D9E0`: frameless/global, literal-base, and register-bound forms changed the target's + compact byte-indexed table loop; no candidate matched. +* `0x800A4F20`: loop and unsigned-byte forms were 112/116/124 bytes rather than 108. +* `0x80052FF4`: reached the exact 112-byte length but retained a six-byte constant-materialization + residual; no inline instruction was forced. +* `0x80026460`: frameless linked-list forms retained a shared-epilogue/register tie. +* `0x80050674`: staged 112-byte source remained one register-field byte different after bounded + pointer-sum and binding variants. +* `0x800801B4`: table/indirect-call forms differed in address materialization and length. +* `0x8002DCA8`: reached 108 bytes and four differing bytes; the remaining `move v0,a1` branch-delay + copy resisted named-result and decrement live-range forms. +* `0x8002FCD0`: goto/switch dispatcher forms did not preserve all three case exits. +* `0x80023CAC`: six-product arithmetic matched its first 132 bytes; the target's dead-looking + `a1[0]`/`sltiu` tail was not reproduced by tested liveness forms. +* `0x800801B4`, `0x8002D17C` source staging variants not promoted are ignored; only the four tracked + sources above are registered.