Worker B's maspsx structural limitation recorded: a region needing
addu-encoded moves (maspsx expands move->addu, GNU as expands move->or)
AND an assembler-filled jr slot cannot be matched with any single
maspsx= setting — this explains a family of epilogue residuals. B
verified in .s files. Two negatives with mechanisms (0x800254B0 alloc,
0x800751E8 with negu — evidence FOR the toolchain, finding-26 route).
B self-corrected an invented-address method error. Gate MATCH whole-
binary SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9.
Worker B matched 0x800F6330 (correcting my stale negative: destination is
0x8011AA18 via the signed-displacement finding-4 trap) and 0x80090B7C
(18th/19th first-attempt matches this cycle). Coordinator absorbed
0x80025070 (conditional dispatch wrapper). B's correction of its own
void-vs-valued epilogue tell accepted (0x800FBDC0 counterexample; the
shared-epilogue hypothesis stands untested — recorded as observation, not
rule). Gate MATCH whole-binary SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9.
Two more coordinator tier-2 wrappers, both first-try: 0x800A623C
(symbol-form constant + pass-through swap), 0x800A5CEC (guarded call with
zero in the jal slot). Gate MATCH whole-binary SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9.
Worker B: 0x8002E3A8 bare unused frame (16B of pure stack adjustment from a
removed local — reproduced by declaring char unused[16] and nothing else),
0x8010AAC0 pass-through with arg reorder, 0x8008FF58 six-arg rebuild,
0x800F79C0 virtual dispatch. Worker C: 0x800268C4 (D_ names), 0x800697C4,
0x800658FC (F20 displacement-fold lever), 0x800A5CC8 (overlap with the
coordinator's claim — C's registration stood). Gate MATCH whole-binary
SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9.
B's alignment-1 find closed 0x80013D04 first-attempt (lwl/lwr on provably
aligned addresses = declared-type alignment, not real alignment; Quad4
struct model). New symbol D_801219F4 (gp-relative address taken without
lui). Coordinator wrappers 0x800F8FC0/0x800A5CC8 (pass-through + constant-arg
delay-slot). Report negatives reconciled into the tracked index (0x800F9134,
0x80094370 now excluded by regenerated worklist). Gate MATCH whole-binary
SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9.
4 new (0x80082750, 0x8007EB8C, 0x800B34FC, 0x800C1EA8), 2 new gp symbols
(g_80122610, g_80122618) for the gp-relative table-address rows. Recorded
findings F17 (sra-vs-srl = signedness of the shifted value), F18
(inline mask strength-reduce -> bind to a local), F19 (address-shaped name
resolves implicitly but loses its gp marker -> use the registry's exact
name). Gate MATCH whole-binary SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9.
Per-guard inline reload of obj->p (finding-8 CSE prevention) + stack byte
argument (a1 was a 5th param at sp+16). Gate MATCH whole-binary SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9.
Worker C re-engaged on partition C closed 4 more (incl. 0x800450C4 which the
coordinator had recorded as a negative — C's source spelling beat the
coordinator's; the row is removed from the tracked index, the per-site
gp=-D_80121BFC override applied as recorded finding 16). 0x80065930 was
claimed by both C and the coordinator independently; skip-registered handled
the duplicate (coordinator's registration stood). Gate MATCH whole-binary
SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9. C's F15 (do/while
counter-init-first for bottom-tested search loops) and F16 (mirrored-layout
lever is per-GUARD, tested guard by guard) recorded for the cookbook.
Coordinator matched the 30-entry key/value pair-table lookup on the first
attempt (array spelling reproduced the two walked pointers). Gate MATCH
whole-binary SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9.
Coordinator absorbed partition B directly: 0x800F5AF8 (four pointer-slots
stored from constants — the globals at 0x8011A9E4 are POINTER VALUES read by
lw rt,sym then stored through, not direct symbol stores) and 0x80021FA8
(six 16-byte records, four fields zeroed via symbol+index, store-order fix).
0x800518BC recorded as a bounded return-merge negative. Gate MATCH
whole-binary SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9.
Worker A rotated out at 108 claims (+79 from its session) with a clean
handoff; final 4 rows verified MATCH by the coordinator. 18 new regions
gated MATCH whole-binary (c_regions=306, SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9), make check green.
P9-T4 checkpoint (>=290 total) CROSSED at 297 bodies.
All three workers have now rotated out; the coordinator absorbs the
remaining partitions. Negatives census now 34 report rows from A alone
(25 match-class + 9 bad-extent triage), with the bad-extent class verified
independently by the coordinator (disjoint from 288 registered regions;
7 worklist rows flagged incl. the runaway 0x801800C4/0x80180808 that were
never excluded because they are fallthrough-graded).
Handoff notes recorded: two high-value unattempted GTE rows (0x80101C2C,
0x80102FA4 — need raw lwc2/swc2 asm with memory operands), 8 lever findings
for the next charter (srl=sra-unsigned, slti-sltiu 16-bit tell, single-exit
result shape, struct-assignment for a0/a1 loads, maspsx=off scope x2, side-
effect statement order, lui/lw address arithmetic, CSE-preventing symbols).
The bad-extent detector is implemented in sf3_triage with synthetic tests;
the regenerated worklist will exclude the class.
Worker C rotated out on budget with a clean handoff (28 claims total, all
verified; 18 negatives with hypotheses). Its final 2 rows verified MATCH
(0x80101838 reopening closed via do/while + sentinel: this closes B's cycle-2
negative on the same address!; 0x8007C4A8). Handoff inheritance: orig.py
disassembly helper, F1-F14 findings confirmed, 2-byte free claim 0x800266A8
left with its exact hypothesis. Gate MATCH whole-binary SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9.
Worker A batch 9: if-conversion demo, pre-increment append, negate-magnitude,
guarded call pairs, epilogue-order-variant NEGATIVE 0x80100334 (finding 11's
'13 CRT sites' scoping corrected — this site is outside the CRT; recorded as
a third epilogue class data point), sched-tiebreak 0x8002515C. New symbol
D_80122160 (gp). Gate MATCH whole-binary SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9.
14 more regions merged and gated MATCH (c_regions=260, whole-binary SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9); make check green (AGREE + MATCH).
Full audit passed from clean state (CMP_OK, SHA-1, 223 tests, gate, extents).
Worker A: 12 more (tier-2 wrappers incl. 7-arg o32 forwarder, GTE-forwarder
adjacent to the registered maspsx=off 0x800F3160, and 0x80036380 — a
byte-proven 48-byte empty-frame registered under an honest limits header).
New: maspsx-conflict scope limit (finding 17 corrected: maspsx=off unsafe
for bodies with move pseudo-instructions — addu-vs-or expansion), alloc-
tiebreak negative 0x80019700.
Worker C: 2 boundary-crossing matches accepted under the decided policy
(verified work is claimable across regenerated partition edges); handoff
0x8010A748 accepted. F10 named-pointer base-first for register bases (closes
the F5 gap), F11 duplicate stores need volatile, F12 if-conversion is a
compiler class (0x80010418 exclusion recommended and accepted).
Collision policy decided: verified work is claimable regardless of the
regenerated partition boundary; overlapping staging is deduped by the merge.
All boundary crossings reported by the workers.
31 new regions merged and gated MATCH (whole-binary, SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9), make check green
(regions=246 disagreements=0 AGREE, c_regions=246 MATCH).
Worker A took the tier-2 lead the rotation pointed at: 29 new framed
wrapper/call bodies incl. jalr-indirect rows, argument-swap wrappers, and a
statement-order-around-side-effect fix (0x800198C0). New levers recorded:
lui/lw symbol address arithmetic check (carry-adjusted %hi), named-local
ordering around a side-effect store.
Worker C closed two retry rows from the negatives index: 0x80036AD8
(commutative-operand-order, the 0x8002DEB4-class) and 0x800B5CB4 (deferred
--g_80122068 family hypothesis, using the gp symbols staged in cycle 1).
Worklist regenerated with the 0x80012A10-family exclusion (worker C
recommendation): --exclude 0x80012A10 --exclude 0x80012AE0, pool 1,666,
named exclusions 5; partitions re-proved disjoint (556/555/555).
Worker B rotated out (budget) with a clean handoff: 13 promoted claims, 18
negative entries in report.tsv, four named cheap closes for fresh context,
and a P9-T5 lead (trapping arithmetic in un-extented gaps, verified by the
coordinator: 275 gap words vs 661 in-extent words). No replacement session
available; the coordinator absorbs partition B per the plan's fallback.
Coordinator-verified every staged claim with its own range runs (57/57 MATCH,
one required the staged gp symbol g_80122158). Merged to a candidate, whole-
binary gate MATCH at c_regions=215, differing_bytes=0, SHA-1
e173426c157384ebf1b6caf8c6fea18a85a14af9; promoted; make check green
(regions=215 disagreements=0 result=AGREE, c_regions=215 MATCH, 223 tests).
Workers: A 23, B 13, C 21 claims. New symbols: g_80122158/g_80122068/
g_8012277C/g_80122738 (gp-marked, worker C request). Override additions:
0x80104C38 maspsx=off (verified 1-byte DIFF with maspsx on at the loop
back-edge, finding 17 family).
gtemac.h GTE control map corrected after two workers' independent decodes
and coordinator raw-word verification: the executable's control registers
are the standard map UNshifted for 0..5 (rotation matrix, 0x80101CAC) and
standard+7 from RBK onward (3 RBK .. 8 DQB); light matrix is 6..0,
far colour 1..3, H 6, DQA 7, DQB 8. Cookbook finding 24's label
for 3..5 was wrong; the numbers were always right. Added gte_ldH,
gte_ldRT1RT2..gte_ldRT33; func_8001AE3C.c updated to the corrected
RBK/GBK/BBK macros (re-verified MATCH); 0x80102FD4 and 0x80101CAC rewritten
to macro form (re-verified MATCH).
Recorded negatives: A 4 (cond-value-ifconv, alloc-scheduling, cc1-fold,
strength-reduce+loop-rotate), B 7 (incl. exit-duplication, load-use-nop
GTE alloc class, finding-4 sign-adjust trap), C 6 (incl. delay-slot-fill
class, cc1-scheduler-bound). All deployed from src/.
5 new matches from worker A (func_800F75D0, func_80026180, func_8003768C,
func_80089D14, func_800681A4) -> 158 regions / 149 distinct bodies, candidate gate
0 differing bytes, make check green.
MATCHING_CONVENTIONS.md now records the four per-region override keys with the
byte-level measurement behind each (cc1=, as=, gp=-NAME, maspsx=off), the
inline-assembly convention as the developer decided it (accepted for coprocessor
and kernel instructions, documented per file, integer logic in C, no .word lumps,
and a register-name binding is not inline assembly), the rule that an unmatched
draft does not stay in src/, and the worklist classes that are excluded outright
with counted reasons.
0x80019B6C is the one-byte commutative-operand row that workers A and B both left
open; worker C closed it by counting the loop down from 272 with `i >= 0` and
using a byte offset into a char array, rather than the scaling form.
Registry: 153 regions. make check green at 203 tests, regions=153
disagreements=0, c_regions=153.
Worker C also removed its own unmatched g0013 draft from src/ citing the
"unmatched code stays fallback" convention, preserving it in the ignored staging
path with its evidence. Nothing referenced it.
Worker C found the strongest structural signal of the phase and asked me to act
on it rather than merely record it. I re-derived the census independently before
acting: 50 of the 1,937 exact extents contain trapping add/sub (funct 0x20/0x22,
410 instructions) and 0 of the 144 then-registered regions does. All four
unmatched duplicate groups are inside the class. Ten cc1 builds plus the real
CC1PSX 4.0-4.6 over ~30 C shapes and 15 flags never emit the trapping forms, and
-ftrapv is rejected by all of them.
tools/sf3_triage now detects the class and excludes it by default
(excluded_trapping_arith=50, --allow-trapping to list it), with three synthetic
tests, so no worker can spend budget on it by accident. Recorded as cookbook
finding 26 with the neg-macro clue that points at a macro-print-style difference
rather than a source difference. The class is now the best candidate for part of
the unresolved library-versus-game-code boundary - a hypothesis, not a claim.
Also recorded: worker A's maspsx load-delay defect (its predicate tests whether
the next instruction loads FROM the register, not whether it reads it at all, so
a load followed by a store of that register gets no delay nop), four mechanical
layout tells, and the struct-assignment lever for the base-in-register class.
Finding 22 is refined with worker C's third spelling: the written order of the +
operands decides the emitted addu order.
Cycle 5 merge: 65 claims, 8 accepted, 57 skipped, 0 rejected. Candidate gate
c_regions=152, 0 differing bytes; promoted; make check green at 203 tests.
Distinct matched bodies: 143.
Developer decision: inline assembly is accepted for coprocessor and kernel
instructions, documented per file. The boundary already applied: the stack
accessor (register int sp __asm__("$29"), a register-name binding rather than an
instruction) was treated as pure C and merged earlier; these 7 regions each carry
one __asm__ volatile statement in the re-derived SDK-macro form, with the integer
logic in C and the epilogue and scheduling produced by cc1 and maspsx. No .word
lumps and no whole-function assembly.
7 regions: 0x80103A94 (cfc2), 0x80103B60 (ctc2), 0x800F3E70 (mtc2/mfc2),
0x80109778 (two ctc2), 0x8001AE3C (three ctc2), 0x80103FCC and 0x80103FEC (BIOS
stubs, whose 16-byte extents come from the syscall-terminator fix).
include/gtemac.h is tracked as the provenance record for the re-derived
encodings and the control-register map. It is worker C's own derivation from the
observed bytes, with no SDK text; the staged sources are self-contained and do
not depend on it yet.
Candidate gate: c_regions=144, 0 differing bytes, SHA-1 e173426c. Promoted, then
make check green. Distinct matched bodies: 135.
22 claims accepted (worker A's 8 new + 9 gp rows, worker C's 6 pure-C rows),
28 skipped as already registered, 0 rejected. Candidate gate c_regions=137, 0
differing bytes, SHA-1 e173426c; promoted, then make check green (200 tests,
regions=137 disagreements=0).
Worker C closed two duplicate groups that other sessions had left as near-matches:
- g0007 (0x800F7FB4 x3 addresses): the unexplained 8-byte frame was cc1 loop
restructuring, not a calling-convention need. `for (i = n-1; i != -1; i--) *p++ = 0;`
makes cc1 emit an unused subu/addu sp pair; an explicit guard plus a do/while
gives the exact 36 bytes.
- g0030 (0x8009E8D0 x2 addresses): the abs-of-3-component-difference function
that workers A and B both recorded as near-matches.
The two BIOS stubs are still policy-gated (they need an inline-asm statement) and
are not in this merge. Distinct matched bodies: 128.
Two harness gaps were closed as per-region overrides, both found by the workers
and implemented by the coordinator:
1. maspsx=off. Worker A isolated the $at-macro-store-in-the-jr-delay-slot shape
with a decisive experiment: cc1 emits an empty delay slot, maspsx fills it with
a nop, and GNU as in reorder mode fills it properly by moving the last half of
the expanded store. Six regions need this, including 0x800F3160 -- Phase 5's
first recorded bounded negative, unreachable for three phases -- and 0x800F8AEC,
0x800F8B58, 0x800F8B6C, 0x800F8FE4, 0x80102B10. Worker B reverse-engineered the
same mechanism independently from the cc1 output.
2. gp=-NAME. The gp marker is per symbol, but the original's access form is per
SITE: 0x80121F84 is read gp-relative at 0x800A80BC and written absolutely at
0x8002D288, in the same function. A byte search confirmed 6 gp-relative
accesses at d=0x64c, so worker B's census row was right and worker A's source
was right; only a per-region exclusion can express both. This makes cookbook
finding 10 incomplete.
Both overrides are validated (199 tests, 10 added), and sf3_merge gained
--skip-registered because a worker's claims file is naturally cumulative.
Cycle-2 merge: 66 claims, 58 accepted, 8 skipped, 0 rejected. Candidate gate:
c_regions=115, 0 differing bytes, SHA-1 e173426c. Promoted, then make check green:
199 tests, regions=115 disagreements=0, c_regions=115 MATCH.
Distinct matched bodies: 51 -> 109, past the phase milestone of 70.
P8-T2's protocol record plus worker B's cycle-1 merge.
Worker B verified 8 claims (7 bodies: g0029 is a two-address duplicate group).
It also classified its whole 946-row partition off one objdump and found that 226
rows (24%) access gp-relative globals, staging 335 distinct addresses. Those were
checked before use: every row is arithmetically exact under the list's decimal d
column (335 rows, 0 errors), and four sampled globals were confirmed against my
own Ghidra disassembly (0x564(gp) -> 0x80121E9C and three others). A risk check
for whether a new gp marker could change an already-matched region found only
worker A's unclaimed in-progress files, so no registered region is affected.
323 rows were new (12 already present), taking config/symbols.tsv to 354 rows and
unblocking a quarter of worker B's partition.
Candidate gate: c_regions=57, 0 differing bytes, SHA-1 e173426c. Promoted, then
make check green: 189 tests, regions=57 disagreements=0, c_regions=57 MATCH.
Distinct matched bodies: 34 -> 51.
Worker B also deferred 0x8001D98C (g0053, 436B, GTE 3x3 transform) into the
bounded GTE class, and recorded two byte-proven cookbook findings: BCD nibble
pairs must be their own parenthesised subexpression (a pure association tell, 9
shifted bytes), and a constant absolute address in a load folds the
carry-adjusted low half into the load displacement rather than using lui+ori.
P8-T2 plus the first verified cycle-1 merge.
tools/sf3_merge validates worker claims before anything tracked changes: a claim
is accepted only if its extent exists in the derived extents table and is graded
exact with exactly the claimed end, its source is a repo-relative
src/func_XXXXXXXX.c that exists, and it overlaps neither the registry nor another
worker's claim. Rejections are reported with reasons and nothing is written.
The workflow it enables is stronger than the plan's wording: merge to a CANDIDATE
registry, gate the candidate, and promote only on MATCH, so the tracked registry
never contains an unverified claim.
Worker A reported 10 claims (target 8) and correctly refused to edit the shared
symbol registry itself, instead requesting 9 gp-marked rows; each was checked
arithmetically as gp + d. Candidate gate: c_regions=49, 0 differing bytes, SHA-1
e173426c. Promoted, then make check green: 189 tests, regions=49
disagreements=0, c_regions=49 MATCH.
Worker A also reported a significant blocker: two of the remaining duplicate
groups are GTE (COP2) bodies -- 0x80018CB0 (3 addresses) and 0x8001084C (2
addresses, the 712-byte shared body) -- plus 0x80103A94 and 0x80103B60. That is
four GTE functions, which raises the value of the bounded SDK-shape
investigation in P8-T5.
Both batch targets are met in one pass: 22 new bodies (23 including the P7-T5
match), taking the project from 11 distinct bodies to 34 -- past the phase
milestone of 30 -- across 39 registered regions.
The batch is dominated by the small leaf shapes the worklist ranks first:
empty function (4 duplicate addresses), byte/halfword/word setters, field
getters, a word-buffer clearer, and eight gp-relative getters/setters. Every one
was byte-identical on the first or second attempt, and every extent came from
tools/sf3_extents rather than a hand-derived end.
Three shapes needed diagnosis, and two were solved:
- 0x8003636C was 16 bytes instead of 12 because `return 1` forced a second
`li v0,1` into the delay slot; the original leaves 1 in v0 as scratch, so the
function is `void`.
- 0x800F7FB4 needed the parameter reused as the loop counter.
Four candidates are recorded as bounded negatives or deferrals rather than
guesses:
- 0x800F7FB4: the loop body reproduces exactly, but the original has no frame
and every tested formulation allocates 8 bytes (five C forms, and an
-O1/-O2/-O3/-fomit-frame-pointer matrix). Stopped after two distinct attempts.
- 0x800F8AEC: the original schedules `lui` / `jr ra` / `addiu` with the low half
in the delay slot; the reconstruction emits `lui` / `addiu` / `jr ra` / `nop`.
- 0x80010810: GTE (COP2) code needing the SDK's GTE macros, which the build has
no headers for.
- 0x800FB5D4 (`move v0,sp`) and 0x80103FCC/0x80103FEC (BIOS `syscall` wrappers)
and 0x8001EAFC (a shared jump block, not a standalone function).
make gate: c_regions=39, 0 differing bytes, SHA-1 e173426c. Extents verify agrees
on all 39 regions. 168 synthetic tests.
Every cross-reference used to need a hand-written config/symbols.tsv row, which
does not scale to a batch. A symbol whose name is an address now resolves to that
address with no row: func_XXXXXXXX, D_XXXXXXXX, g_XXXXXXXX, lbl_XXXXXXXX. This is
the convention the registry already used, applied without the row.
The names come from the object's own undefined-symbol list (nm -u), not from a
guess about the source, so a name the source defines but never references is
never mistaken for one needing resolution. A registry row still wins, which is
how a gp marker or a real name is attached. Anything neither registered nor
address-shaped now fails before the link with a message naming the symbol and the
fix, instead of a bare ld diagnostic.
First match from the worklist: func_800F8F9C (36 bytes, worklist rank 3), a
duplicate-group representative with a frame and a call. It matched on the first
attempt and is registered twice (0x800F8F9C, 0x80109314) against one source, so
two functions were matched for one body. Its callee needed no registry row.
Ghidra's independent body agrees with the derived extent.
make gate: c_regions=14, 0 differing bytes, SHA-1 e173426c. 168 synthetic tests.
P5-T5. Part A: the entry [0x800FB368,0x800FB410) is not compiler output. The
return address is round-tripped through an absolute global around the first
call, the range ends in break, the stack pointer is built from linker globals,
and the clear loop falls through with no jr ra. Two bounded compile experiments
failed and were stopped; the entry stays fallback and no C is claimed.
Part B: first byte-identical C match -- func_80017AD4 at 0x80017AD4..0x80017AE8
(20 bytes), src/func_80017AD4.c, registered in config/regions.tsv. make gate
reports c_regions=1, 0 differing bytes, SHA-1 e173426c157384ebf1b6caf8c6fea18a85a14af9.
Body is unique with one caller at 0x80014C14; a shared-tail near-miss was
checked and rejected as a duplicate. The Phase 3 baseline is unaffected.
Records six codegen findings, notably that GNU as expands the la macro with ori
while the original assembler (ASPSX 2.81) uses addiu, so la-using functions will
need maspsx. No ROM-derived material is tracked.
Christopher Williams