From 28d5719ed7dbb4c44fa43886e34ca9ac635d698e Mon Sep 17 00:00:00 2001 From: Matthew Stanley <1379tech@gmail.com> Date: Mon, 22 Jun 2026 19:20:56 -0700 Subject: [PATCH] docs: splash->attract is first-divergence (CD RULED OUT) + ~17k crash note MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Investigated the splash softlock: the attract data loads CORRECTLY (consecutive CD-DMA dests hold different valid MIPS code; read_msf reached LBA 374). The cd_read_log 'lba' field misleadingly logs the SetLoc target (24) not the per-sector position — a tool bug (Rule 15) that cost a wrong 'CD stuck at LBA 24' hypothesis. So the splash->attract divergence is a true first-divergence in the scene-transition state machine ([0x1F8001A4] stuck at 0), upstream of the common 0x80050CE8 loop both recomp and oracle reach. Next: oracle PC-trace from the splash. Secondary: ~frame-17k silent crash (~8e9 dirty insns) - possible host-stack growth from the frame-1997 fix's re-dispatch on nested RFEs; also a regression-risk signal for the shared path. Co-Authored-By: Claude Opus 4.8 --- docs/TOMBA2_WHOOPEE_BAIL.md | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-) diff --git a/docs/TOMBA2_WHOOPEE_BAIL.md b/docs/TOMBA2_WHOOPEE_BAIL.md index 6c26e8df..8e9b86e5 100644 --- a/docs/TOMBA2_WHOOPEE_BAIL.md +++ b/docs/TOMBA2_WHOOPEE_BAIL.md @@ -13,13 +13,30 @@ longjmp at a BLOCK-RETURN pump left `cpu->pc=0`, which unwinds to the outermost and reads as a clean exit. Fix = restore the committed guest PC after the block-return pumps so the trampoline re-dispatches (details in the CORRECTION section below). -**NEW FRONTIER — splash→attract divergence.** The recomp lingers on the splash with its -**CD idle** (`reading=0`); the Beetle oracle on the same disc has moved on to the -**attract/intro gameplay** (3D scene: Tomba on a grassy field). BOTH sit at the same idle -PC `0x80050CE8` — so the recomp tracks the oracle's CODE but has diverged in game STATE: -the oracle's splash logic triggered the attract-scene CD load, the recomp's did not. -Likely a CD-streaming / scene-transition divergence (first-divergence work vs oracle @4380). -This is the path to the user's "through to attract" goal. +**NEW FRONTIER — splash→attract divergence (first-divergence, NOT a CD bug).** The recomp +softlocks on the splash; the Beetle oracle on the same disc reaches the **attract/intro +gameplay** (3D Tomba on a grassy field). BOTH sit at the same idle PC `0x80050CE8`, so the +recomp tracks the oracle's CODE but has diverged in game STATE. + +Investigated 2026-06-22 sess2: +- The splash main loop is at `0x80050C40+`; it pumps a 2-frame VBlank gate (counter + `0x800E809C` reset by `sh zero` @`0x80050C8C`, waited up to threshold byte `[0x1F800235]=2` + — works, reaches 2 between samples) and runs a state machine on `[0x1F8001A4]` (observed + stuck at 0). The state never advances to load/show the attract. +- **CD RULED OUT.** The attract data DOES load correctly: consecutive CD-DMA dest addresses + (`0x80041800`, `0x80042000`, …) hold DIFFERENT, valid MIPS code, and `read_msf` advanced to + LBA 374. The `cd_read_log` "lba" field misleadingly logs the SetLoc target (24) for every + DMA read, not the per-sector read position — a TOOL bug to fix (Rule 15): it cost a wrong + "CD stuck at LBA 24" hypothesis. The CD streaming/advance is fine. +- So the divergence is a true first-divergence in the splash state machine / scene-transition + decision, upstream of the common `0x80050CE8` loop. Next: oracle PC-trace from the splash + (psx-beetle @4380) to find the first divergent branch / state write that gates the attract. + +**SECONDARY: ~frame-17k crash.** With the frame-1997 fix the recomp runs ~16-17k frames on +the splash (≈8e9 dirty insns; ~470k insns/frame — the splash spin is expensive) then dies +silently (SEH; watchdog was off). Possible host-stack growth from the fix's re-dispatch on +NESTED block-return-pump RFEs (the restore fires ~1/22 frames) — must check (also a +regression-risk signal for the shared path). Re-run with watchdog + crash dumps armed. **PENDING GATES (before master-landing of the fix):** (1) T1/MMX6/Ape regression — the fix is in the SHARED dirty-pump path; argued low-risk (the restore only fires when a