From cd3031c3f99af148c6bb75bf185bb960ced3e179 Mon Sep 17 00:00:00 2001 From: Christopher Williams Date: Fri, 25 Sep 2026 07:34:30 -0400 Subject: [PATCH] phase12: record second-batch checkpoint 4 --- docs/MATCHING_COOKBOOK.md | 17 ++++++++++++ phase-ends/CURRENT_PHASE.md | 19 ++++++------- phase-ends/logs/Phase12.md | 53 +++++++++++++++++++++++++++++++++++++ 3 files changed, 80 insertions(+), 9 deletions(-) diff --git a/docs/MATCHING_COOKBOOK.md b/docs/MATCHING_COOKBOOK.md index b62f98b..a9dcade 100644 --- a/docs/MATCHING_COOKBOOK.md +++ b/docs/MATCHING_COOKBOOK.md @@ -3408,3 +3408,20 @@ an unsigned global comparison and a `short` return to select `sltiu` and the fin These are the same structural-first discipline as finding 192, applied to rows small enough that a single mistaken offset or return edge dominates the entire comparison. + +### 195. Absolute bases and deliberate reloads are source-level facts (solo, Phase 12) + +The fourth checkpoint adds two useful confirmations. `0x8006F6F4` only matched after the absolute +bases were corrected to `0x80133230/34/38` and `0x801332A0/A4/A8`; a nearby-looking `0x801323xx` +reading produced a plausible 136-byte candidate with nine differing bytes. `0x800475CC` required +repeated direct reads through `a1+0x0C` rather than reusing a pair pointer, and the three-element +halfword array supplied the exact 8-byte frame and stack stores. + +> **When a direct candidate is close, re-derive every absolute address from the `lui` immediate +> plus displacement, and preserve apparent reloads instead of letting ordinary C common-subexpression +> elimination collapse them.** A large base-digit typo and a reused pointer can look like scheduler +> noise, but both are source/dataflow errors. + +The explicit-label form used by `0x80066DA0` is a related control-flow lever: when an ordinary +conditional emits the opposite branch polarity, a named label can preserve the target's basic-block +order without inline assembly or a non-default compiler flag. diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md index a1f3f88..a466239 100644 --- a/phase-ends/CURRENT_PHASE.md +++ b/phase-ends/CURRENT_PHASE.md @@ -6,18 +6,19 @@ ## STATE — SOLO CONTINUATION, 2026-09-24 (current) -**707 bodies / 716 regions**, from 685 / 694 at the last session stop — **+22 bodies / +22 regions**. -The Phase 12 milestone remains 750 bodies, so **+43 remains**. The promoted whole-binary gate is green: -`c_regions=716`, `differing_bytes=0`, SHA-1 +**711 bodies / 720 regions**, from 685 / 694 at the last session stop — **+26 bodies / +26 regions**. +The Phase 12 milestone remains 750 bodies, so **+39 remains**. The promoted whole-binary gate is green: +`c_regions=720`, `differing_bytes=0`, SHA-1 `e173426c157384ebf1b6caf8c6fea18a85a14af9`; 344 synthetic tests pass and extents report -`regions=716 disagreements=0 result=AGREE`. +`regions=720 disagreements=0 result=AGREE`. -The requested second batch of 20 is underway. Twelve additional bodies are now matched: +The requested second batch of 20 is underway. Sixteen additional bodies are now matched: `0x800BC9C4`, `0x800BC8C4`, `0x8006BB0C`, `0x8002D17C`, `0x801029A0`, `0x80055958`, -`0x80023A4C`, `0x8006BA3C`, `0x80086DBC`, `0x8007759C`, `0x800B6CB4`, and `0x80029E88`. -Worklist regeneration is now 966 rows; `excluded_already_registered=714` continues the -already-characterised two-row registry lag and is not a correctness issue because the 716-region - gate proves the registry simultaneously. +`0x80023A4C`, `0x8006BA3C`, `0x80086DBC`, `0x8007759C`, `0x800B6CB4`, `0x80029E88`, +`0x800AC648`, `0x8006F6F4`, `0x80066DA0`, and `0x800475CC`. Worklist regeneration is now +962 rows; `excluded_already_registered=718` continues the already-characterised two-row +registry lag and is not a correctness issue because the 720-region gate proves the registry +simultaneously. ## STATE — SESSION STOP, 2026-09-24 23:35 (historical; superseded by the state above, kept for provenance) **685 bodies / 694 regions**, from 602 / 611 at the Phase 11 close — **+83 bodies**. **Milestone 750 was NOT diff --git a/phase-ends/logs/Phase12.md b/phase-ends/logs/Phase12.md index 19bebeb..a08e7aa 100644 --- a/phase-ends/logs/Phase12.md +++ b/phase-ends/logs/Phase12.md @@ -2165,6 +2165,43 @@ confirmed. **Batch checkpoint: 12 additional bodies / 12 regions matched; current count 707 bodies / 716 regions.** +### Batch task 13 — `0x800AC648` (76 B) MATCH + +* Exact extent: `0x800AC648..0x800AC694`, 76 bytes, grade `exact`. +* Uses the sanctioned scratchpad-stack macros to call `func_800ABA28`, switch to + `0x1F8003DC`, call `func_800BBDF8` with the preserved s0 argument, and restore the original + stack pointer. +* Tracked source md5: `3a5ae990da5c6b4d39291b2b3e95feae`; fresh range and candidate gate were + zero-difference. Promoted gate: 717 regions; `make check` passed. + +### Batch task 14 — `0x8006F6F4` (136 B) MATCH + +* Exact extent: `0x8006F6F4..0x8006F77C`, 136 bytes, grade `exact`. +* Direct absolute globals at `0x80133230/34/38` and `0x801332A0/A4/A8` reproduce the V4 copy, + signed half-scaled corrections, and repeated address materializations. The temporary symbol + overlay used during validation was promoted by address-named source symbols without adding + registry rows. +* Tracked source md5: `d854d91de96ca56f49853efcf7e3bc3b`; fresh range and candidate gate were + zero-difference. Promoted gate: 718 regions; `make check` passed. + +### Batch task 15 — `0x80066DA0` (140 B) MATCH + +* Exact extent: `0x80066DA0..0x80066E2C`, 140 bytes, grade `exact`. +* The special index-23 arm uses an explicit nonzero-to-zero-store label, and the global halfword + is read as an absolute address rather than through its gp-marked registry alias. +* Tracked source md5: `3da4e2503976d3fc597265c325ea3194`; fresh range and candidate gate were + zero-difference. Promoted gate: 719 regions; `make check` passed. + +### Batch task 16 — `0x800475CC` (116 B) MATCH + +* Exact extent: `0x800475CC..0x80047640`, 116 bytes, grade `exact`. +* A three-halfword local array plus repeated `a1+0x0C` expressions reproduces the target's + deliberate pointer reloads, 8-byte frame, sign-extended output words, and sentinel return. +* Tracked source md5: `23ef33015df4f8df0dadde8d7029d2dc`; fresh range and candidate gate were + zero-difference. Promoted gate: 720 regions; `make check` passed. + +**Batch checkpoint: 16 additional bodies / 16 regions matched; current count 711 bodies / 720 regions.** + ### Bounded attempts in the second batch — stopped without registration * `0x800321F8`: explicit branch/goto and register-binding forms reached 80/88/92-byte variants but @@ -2200,3 +2237,19 @@ confirmed. was promoted in this batch. * `0x80070454`: exact 72-byte initializer remained one call-block delay `nop` short after bounded goto and nested-call forms. +* `0x80057E04`: the 120-byte linked-record updater was reduced to exact length but retained + frame/order differences after typed and raw-pointer forms; no source was promoted. +* `0x800C110C`: pointer indirections and V4 loop were exact in structure, but the candidate + retained a four-byte tail scheduler gap; no source was promoted. +* `0x800AA0A0`: the four-argument ABI and tree walk were reconstructed, but the target's + pre-branch v1 move and accumulator placement remained different; no source was promoted. +* `0x800683E4`: the four-argument fallback shape was length-correct but retained branch polarity + and load-delay differences; no source was promoted. +* `0x800AD068`: the interleaved 4/halfword insertion loop reached exact length but retained + count-copy and pointer-setup register-order differences; no source was promoted. +* `0x800FECF8`: `/127` and `/16383` magic arithmetic was identified, but the fixed table base + still folded into a direct indexed load; no source was promoted. +* `0x8010806C`: the 16-step clear loop had the right body but retained the alternate epilogue + shape and address split; no source was promoted. +* `0x80072D0C`: the 60-byte node search was structurally reconstructed but retained frame and + loop-layout differences; no source was promoted.