From 7e9394f691df5ba1bfdfd603288c8d840bebeda1 Mon Sep 17 00:00:00 2001
From: Drew T <50529377+Druthulu@users.noreply.github.com>
Date: Fri, 7 Aug 2026 15:13:50 -0600
Subject: [PATCH] =?UTF-8?q?fix(phase-30=20S45=20p4):=20R14=20correction=20?=
 =?UTF-8?q?=E2=80=94=20the=20MAIN/7/SC03-trio=20'loader=20fn'=20leads=20we?=
 =?UTF-8?q?re=20scanner=20phantoms?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- the quick hi/lo sweep paired lui/lo16 WITHOUT tracking base registers -> phantom refs
  (0x800AE868 read where the true target was 0x8018E868); register-tracked rescan: the ONLY
  literal loc-table ref fleet-wide is SC02/9's (solved)
- standing truth: MAIN/7, MAIN/9, SC03/53/54/56 all load via table-INDEXED paths; homework
  respecified (descriptor-data hunt + ResourceGetCdLoc/StreamLoad index math)
- fn 0x80161E08's real gate: currentLocationId vs {0x3012,0x3054,0x3079,0x3096} — the
  'variable 0x800C3054' never existed; cookbook §155 (track the register)
---
 docs/matching-cookbook.md   |  9 +++++++++
 docs/memory-map.md          | 18 ++++++++++++++++++
 phase-ends/CURRENT_PHASE.md |  8 ++++++++
 3 files changed, 35 insertions(+)

diff --git a/docs/matching-cookbook.md b/docs/matching-cookbook.md
index 7e349aaef..cd57b4c11 100644
--- a/docs/matching-cookbook.md
+++ b/docs/matching-cookbook.md
@@ -10544,3 +10544,12 @@ scale.)
 
 **Symptom lines for the index:** **"sig_image bootstrap finds 0 functions"** · **"a payload with a
 small integer first word"** · **"where does this blob load"** · **"a huge type-1 module"**.
+
+## §155 — hi/lo literal scanning MUST track base registers (S45)
+A "find who references address X" sweep that pairs any `lui` with any later lo16-bearing op in a
+window produces PHANTOM cross-references: the lo16 may ride a DIFFERENT base register (e.g.
+`lui $s2,0x800B … lui $at,0x8019; sw $s1,-0x1798($at)` — the window-pairer reads 0x800AE868, the
+truth is 0x8018E868). One such phantom steered an evening of MAIN/7 hunting (S45). Track the
+register: record `lui rt → hi`, match only ops whose BASE is that rt (addiu rs==rt / mem-op
+base==rt), invalidate on clobber. Register-blind results are candidates for triage only, never
+evidence (G3/R14). The corrected pattern lives in the S45 rescan (checkpoint p4 → tools).
diff --git a/docs/memory-map.md b/docs/memory-map.md
index 14dd092ee..78971876b 100644
--- a/docs/memory-map.md
+++ b/docs/memory-map.md
@@ -687,3 +687,21 @@ confirmed data). MAIN/9 shares id 0x2D with slot-A module MAIN/39 (an alternate
   MAIN/9 has NO literal table reference anywhere (table-indexed loader). Homework: trace
   0x800C3054's writer, identify the 3 host overlays' locations, decode the SC03/53 loader in
   ov_SC03_104 (@0x80161FBC), find MAIN/9's indexed loader.
+
+### S45 part 4 — CORRECTION (R14/R35): the "MAIN/7 & SC03-trio loader" leads were scanner artifacts
+The §S45-part-3 claims that MAIN/7's loader is fn @0x80161E08 (ov_SC03_126/SC04_021/SC05_019,
+"gate 0x800C3054 ∈ {0x3012,0x3079,0x3096}") and that SC03/53's loader is @0x80161FBC in
+ov_SC03_104 are **REFUTED**. The quick hi/lo scanner paired `lui`/`lo16` operands **without
+tracking base registers**; a proper register-tracked rescan (rabbitizer-checked disasm) shows:
+- fn 0x80161E08 compares **currentLocationId (0x800B9A08)** against location ids {0x1A-guard,
+  0x3012, **0x3054**, 0x3079, 0x3096} — the "variable 0x800C3054" never existed (0x3054 is a
+  compared CONSTANT), and its stores target 0x8018E868, not the loc-table.
+- **The only register-verified literal loc-table reference in the entire fleet is SC02/9's**
+  (the universal wrapper helper `func_80128998`, solved).
+**Standing truth: MAIN/7, MAIN/9, SC03/53/54/56 have ZERO literal loc-table references anywhere
+— all five load via table-INDEXED paths** (the resourceIdMap / `D_80068B60` descriptor route +
+per-overlay IDXTAB/DESTPTR, per the original §S44 finding). Next-session homework: hunt the
+DESCRIPTOR DATA (records carrying global indices 7, 9, 231, 232, 234) and decode
+`ResourceGetCdLoc`/`StreamLoadStateMachine`'s index math — a structured-data hunt, still fully
+static. Tooling lesson (cookbook §155): a hi/lo literal scanner MUST track base registers;
+window-paired lui/lo16 produces convincing phantom cross-references.
diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md
index f5a63a9a9..f93bf8710 100644
--- a/phase-ends/CURRENT_PHASE.md
+++ b/phase-ends/CURRENT_PHASE.md
@@ -193,6 +193,14 @@ arithmetic → one targeted load) AND retro-verified by Phase-3's `ram_castle.bi
 build. Loc-id map appended to `docs/debug-menu-list.txt`; memory-map §S45 part 3 has the
 decoded leads for the last 5.
 
+## ⚠️ p4 CORRECTION (R14/R35 — read BEFORE the homework below): the per-file "loader fn"
+leads in p3 were PHANTOMS from a register-blind hi/lo scanner (memory-map §S45 part 4 +
+cookbook §155). Register-tracked truth: **all five remaining files load via table-INDEXED
+paths; zero literal loc-table refs exist fleet-wide** (only SC02/9's, solved). The real
+homework: hunt descriptor DATA rows carrying global indices {7, 9, 231, 232, 234} + decode
+ResourceGetCdLoc / StreamLoadStateMachine / D_80068B60 index math + per-overlay IDXTAB/DESTPTR.
+Items 1-2 below are struck; item 3 (MAIN/9 indexed) was right all along and now covers all 5.
+
 ## ▶ THE LAST 5 = STATIC-RE HOMEWORK (not emulator work — Drew's framing, adopted)
 1. **MAIN/7:** loader fn @0x80161E08 in ov_SC03_126/ov_SC04_021/ov_SC05_019; gates on global
    0x800C3054 ∈ {0x3012,0x3079,0x3096} (ids sit in unlisted menu-gap scenes). TRACE the writer