diff --git a/Makefile b/Makefile index a5c3d5560..1bba12362 100644 --- a/Makefile +++ b/Makefile @@ -679,6 +679,9 @@ endif # ld_interleave to place the migrated .rodata between the pre/post data-tail chunks (the # data->rodata->data sandwich; cookbook §8). _JTBL_INTERLEAVE holds the --front/--tail # object basenames (set per overlay in config/overlays.mk). Empty for overlays with no carve. + # NOTE (P31 S72): this --front/--tail form is the OVERLAY path only. main is driven by the + # --order call in the BINARY=main branch above — its island is 7 pieces, which --front/--tail + # cannot express (cookbook §426/§431). ifneq ($(JTBL_INTERLEAVE),) $(PYTHON) tools/ld_interleave.py --section .$(BINARY) $(JTBL_INTERLEAVE) $(LD_SCRIPT) endif diff --git a/docs/matching-cookbook.md b/docs/matching-cookbook.md index eac317c5c..0308efb9b 100644 --- a/docs/matching-cookbook.md +++ b/docs/matching-cookbook.md @@ -33880,7 +33880,7 @@ hashes, and `gate_main`'s R40 baseline control **rebuilds the tree green immedia failure**, overwriting `build/us/SLUS_007.26` and its map — so the one artifact that could localize the divergence was destroyed every time, before anyone could look at it. `tools/main_diff_locate.py` (new) attributes the differing bytes to symbols via the linker map; `gate_main` now preserves the red -image first and prints **BODY REJECT / PLUMBING REJECT / MIXED**. +image first and prints FOUR verdicts — **BODY REJECT / TABLE REJECT (§405-A, the dominant residual on main's switch functions, §433) / PLUMBING REJECT / MIXED**. **THE DERIVED OVERLAY THAT NAMES A SHIFT INSTANTLY.** splat names a symbol by its address, so `linked_address != name_address` **is** the shift, with no reference build to diff against: @@ -33918,7 +33918,7 @@ instructions, 48%)** are switch functions. Span A unlocks 8 of them. The other t | span | tables | owning functions | |---|---|---| -| `0x80072E44-0x80073140` | 14 | ~10, incl. `SaveLoadRoutine` (1139 ins) and `func_8003388C` (663) | +| `0x80072E44-0x80073140` | 14 | ~10, incl. `func_8003388C` (663). `SaveLoadRoutine` (1165) is in this span but is NOT unlockable by drafting — §434 frame pair, route = §265 pair transcription | | `0x800732A0-0x8007344C` | 8 | ~8, incl. `StreamLoadStateMachine` | | `0x80073494-0x80073514` | 4 | — | @@ -34264,7 +34264,7 @@ changes that: * `func_8002B0B4` (76 ins) has **no epilogue** — every exit is a raw `j` into a label inside its sibling, or a computed `jr $v0` through `jtbl_80072E44` whose entries land there too. -* `SaveLoadRoutine` (1139 ins) has **no prologue** — its first live read is `andi $v1, $s0, 7` on an +* `SaveLoadRoutine` (1165 ins) has **no prologue** — its first live read is `andi $v1, $s0, 7` on an `$s0` it never loads — and it **owns the epilogue** of the 0x40 frame: `lw $ra,0x38($sp)` / `lw $s3..$s0` / `addiu $sp,$sp,0x40` / `jr $ra`. diff --git a/docs/memory-map.md b/docs/memory-map.md index 6998f72ee..b7d869fb0 100644 --- a/docs/memory-map.md +++ b/docs/memory-map.md @@ -306,7 +306,7 @@ said "≈0x80063045"; the exact string starts, including the backslash, are belo | Address | Symbol/Name (proposed) | Region | Source/Provenance | Confidence | Notes | |---|---|---|---|---|---| | 0x800638FA | `BodyStatLevelTable` | US | AP-world `client.py` (`0x0638FA + 16*level`) | reported | 16-byte records indexed by level; inside EXE static data — verify in Ghidra | -| 0x80072DF0 | `saveHeaderTemplate` | US | **VERIFIED live (T6b 2026-06-14; RAM==EXE)** | **verified** | PS1 memcard save-header template: `Hero` default name (SJIS full-width) @+0; memcard **filename** `BASLUS-00726MUSASHI` @+0xC; **title** `ＢＲＡＶＥ　ＦＥＮＣＥＲ　ＭＵＳＡＳＨＩ` (SJIS) @+0x20; save/load **handler code ptrs** 0x8002B154 / 0x8002B1AC / 0x8002BEA4 @+0x54. Anchors Q#5 | +| 0x80072DF0 | `saveHeaderTemplate` | US | **VERIFIED live (T6b 2026-06-14; RAM==EXE)** — **CORRECTED P31 S73: the row's extent is WRONG past +0x54.** 0x80072DF0+0x54 = 0x80072E44 is `jtbl_80072E44`, `func_8002B0B4`'s SaveLoadRoutine dispatch table and the first 12 bytes of the S72 span-B `.rodata` carve — not part of this template. The "handler code ptrs" it described are that jump table's entries. Treat this row as verified only up to +0x54. | **verified (extent corrected)** | PS1 memcard save-header template: `Hero` default name (SJIS full-width) @+0; memcard **filename** `BASLUS-00726MUSASHI` @+0xC; **title** `ＢＲＡＶＥ　ＦＥＮＣＥＲ　ＭＵＳＡＳＨＩ` (SJIS) @+0x20; save/load **handler code ptrs** 0x8002B154 / 0x8002B1AC / 0x8002BEA4 @+0x54. Anchors Q#5 | | ~EXE+0x62620 | overlay/script pointer table | **JP** | jywjyw `note.md` (JP EXE file offset) | reported (**JP-only — re-derive for US**) | EXE-side pointer table tied to the resident script blob (§4). US analogue **TBD** — Phase 3 | ---