From 85ae47d4a19ae7c655f700760efb9174379a950f Mon Sep 17 00:00:00 2001 From: Christopher Williams Date: Thu, 24 Sep 2026 00:46:59 -0400 Subject: [PATCH] =?UTF-8?q?phase9:=20P9-T5=20bounded=20investigation=20?= =?UTF-8?q?=E2=80=94=20route=20(a)=20closed,=20gap=20census=20+=20library-?= =?UTF-8?q?code=20evidence=20recorded?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- phase-ends/CURRENT_PHASE.md | 43 +++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md index bba0a5d..b5de50c 100644 --- a/phase-ends/CURRENT_PHASE.md +++ b/phase-ends/CURRENT_PHASE.md @@ -202,3 +202,46 @@ excluded_no_extent=0 excluded_trapping_arith=50 - P9-T5's trapping-arithmetic lead (worker B handoff) verified: 275 trapping words in un-extented gaps vs 661 inside extents — the finding-26 census is under-measured; the gap population is a bounded P9-T5 target. + +## P9-T5 — Trapping-arithmetic investigation (bounded, complete) + +**Route (a): can any available cc1 produce the trapping forms? → CLOSED as negative, with byte evidence.** +Probe `neg_fun(x){return -x;} sub_fun(a,b){return a-b;}` compiled by all ten +open cc1s (2.5.7, 2.6.0, 2.6.3, 2.7.2, 2.7.2-psx, 2.7.2-cdk, 2.8.0, 2.8.1, +2.91.66, 2.95.2) at both -O0 and -O2: **zero** trapping `add`/`sub`/`neg` +instructions anywhere. Every build prints `subu $3,$0,$2` for negation and +`subu`/`addu` for arithmetic — none emit the `neg` macro GNU as would expand to +the trapping `sub`. The original's trapping `sub` (funct 0x20/0x22 at +0x8001F4E4-family) is NOT C from any available compiler. Finding 26's matrix +is now confirmed independently with direct .s inspection. + +**Census corrected and widened (worker B's gap lead verified):** +| Population | Trapping words | +|---|---| +| In extents (finding 26's 50 bodies) | 661 | +| In un-extented gaps | 281 | +| **Total** | **942** | +| Inside registered regions | **0** | + +The class is fully disjoint from the matched corpus. Concentrated in +`0x80010000..0x80030000` (480 words; runs at 0x8001FDA0 27 words and the +repeated 4-word 0x8001F4F4 pattern) and scattered later bands. The code is +REAL — coherent fixed-point/GTE-loader routines mixing trapping `sub` with +`addu` (`0x8001FD40` region loads GTE regs through 0x1f800010). This is +library code from a different (likely hand-assembled or SN32/PsyQ-3.x-era) +toolchain — the best current evidence for part of the unresolved +library-versus-game boundary. + +**Route (b): per-region transform.** The remaining path is a documented +harness transform that rewrites a matched assembly stub's `sub`/`neg` (or a +`sf3_match` post-pass emitting the trapping encodings) into the original +bytes. This is a CONVENTION DECISION FOR THE DEVELOPER, not the coordinator's +to take (plan P9-T5 route b is explicit): **report, do not implement +unilaterally.** Recommended shape if approved: an assembly-authored region +with an explicit per-region marker (analogous to maspsx=off), never a C +source lying about `addu`. The class stays excluded from the worklist until +then (46-trapping exclusion count). + +**Deliverable for P9-T8:** cookbook finding 26 updated with the gap census +(942 vs 661), the direct probe evidence, and the 0x8001FDA0/0x8001F4F4 +cluster addresses as the class's strongest members.