Bound acquisition tri-lane to sweep and scorer callers

This commit is contained in:
Jan Petykiewicz 2026-04-18 22:03:52 -07:00
commit 78ccee53a3
2 changed files with 30 additions and 4 deletions

View file

@ -4638,6 +4638,7 @@ fn build_periodic_company_service_trace_report(
evidence: vec![
"0x0040cac0 is only the exact raw delta reader over [site+0x310/+0x338/+0x360]".to_string(),
"direct local binary inspection now shows 0x0040c9a0 as the deferred additive accumulator over [site+0x310/+0x338/+0x360], folding that tri-lane into [site+0x2b4/+0x2b8/+0x2bc], mirroring the nine-dword side array rooted at [site+0x2e4], and then clearing the tri-lane".to_string(),
"direct local caller census now shows 0x0040c9a0 only under the broad live-collection sweep 0x0040a3a1..0x0040a4d3, while 0x0040cac0 stays under weighted scoring or evaluation families such as 0x0040fcc0..0x0040fe28 and 0x00422c62..0x00422d3c".to_string(),
"the current binary write scan finds no direct placed-structure runtime writer for [site+0x310/+0x338/+0x360]".to_string(),
"current checked-in save owners still do not serialize those lanes directly, which rules down the known save seams while leaving a later restore family open".to_string(),
"0x00481430 -> 0x0047d8e0 repopulates the dynamic side-buffer route-entry list, three byte arrays, five proximity buckets, and trailing scratch band from stream without claiming the tri-lane".to_string(),
@ -4753,6 +4754,8 @@ fn build_periodic_company_service_trace_report(
.to_string(),
"0x0040c9a0 deferred additive accumulator/reset helper folding tri-lane [site+0x310/+0x338/+0x360] into [site+0x2b4/+0x2b8/+0x2bc] and mirroring the nine-dword side array rooted at [site+0x2e4]"
.to_string(),
"0x0040a3a1..0x0040a4d3 broad live-collection maintenance sweep calling 0x0040c9a0 once per live placed structure after sibling sweeps over companies, source records, and peer sites".to_string(),
"0x0040fcc0..0x0040fe28 and 0x00422c62..0x00422d3c weighted scoring families consuming 0x0040cac0 without grounding a tri-lane producer".to_string(),
"0x005c8c50 +0x40 stream-load callback 0x0040ce60 canonicalizing the site stem and re-entering 0x0040cd70 / 0x0045c150 for restored rows"
.to_string(),
"0x0052edf0 generic base constructor seeding [this+0x04] from caller arg 1".to_string(),
@ -4944,13 +4947,13 @@ fn build_periodic_company_service_trace_report(
"The create-side family is grounded separately too. City-connection direct placement already reaches the shared constructor/finalize strip 0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10, and the direct writer census now shows [site+0x276] writes clustering under create-side, acquisition-side, and bulk control-transfer families rather than under the known replay strip. So the remaining shellless gap is no longer 'how are new placed structures finalized?' or '[site+0x2a4] mystery'; it is specifically how restored existing rows regain the owner-company lane and cached tri-lane before acquisition-style consumers run.".to_string(),
);
notes.push(
"The tri-lane restore side is narrower now too. The checked-in dynamic side-buffer load owner 0x00481430 -> 0x0047d8e0 repopulates the route-entry list, three per-site byte arrays, five proximity buckets, and the trailing scratch band from stream, so that seam is no longer a plausible hidden owner for [site+0x310/+0x338/+0x360]. The remaining tri-lane question is now specifically a later restore family beyond the known triplet and side-buffer seams.".to_string(),
"The tri-lane restore side is narrower now too. The checked-in dynamic side-buffer load owner 0x00481430 -> 0x0047d8e0 repopulates the route-entry list, three per-site byte arrays, five proximity buckets, and the trailing scratch band from stream, so that seam is no longer a plausible hidden owner for [site+0x310/+0x338/+0x360].".to_string(),
);
notes.push(
"Direct local binary inspection now also gives the tri-lane one concrete runtime role: 0x0040c9a0 folds [site+0x310/+0x338/+0x360] into the local scalar band [site+0x2b4/+0x2b8/+0x2bc], mirrors the nine-dword side array rooted at [site+0x2e4], and then clears the tri-lane. Together with the existing delta reader 0x0040cac0, that makes the lane look like a deferred additive cache handed off by restore rather than an ordinary live service output.".to_string(),
"Direct local binary inspection now also gives the tri-lane one concrete runtime role: 0x0040c9a0 folds [site+0x310/+0x338/+0x360] into the local scalar band [site+0x2b4/+0x2b8/+0x2bc], mirrors the nine-dword side array rooted at [site+0x2e4], and then clears the tri-lane. Caller census keeps that role narrow too: 0x0040c9a0 only appears under the broad live-collection sweep 0x0040a3a1..0x0040a4d3, while 0x0040cac0 stays under weighted scoring/evaluation families such as 0x0040fcc0..0x0040fe28 and 0x00422c62..0x00422d3c. Together that makes the lane look like a deferred additive cache handed off by restore rather than an ordinary live service output.".to_string(),
);
notes.push(
"Direct local binary inspection now grounds the cached-candidate restore bridge too: the placed-structure stream-load owner 0x00413280 dispatches per-entry vtable slot +0x40 on the 0x005c8c50 specialization table, that slot resolves to 0x0040ce60, and 0x0040ce60 immediately re-enters 0x0040cd70 plus 0x0045c150. So the acquisition-side cached source/candidate bridge [site+0x3cc/+0x3d0] is no longer a generic restore mystery for stream-loaded rows; the remaining restored-row gaps are [site+0x276], [site+0x2a4], and the deferred tri-lane.".to_string(),
"Direct local binary inspection now grounds the cached-candidate restore bridge too: the placed-structure stream-load owner 0x00413280 dispatches per-entry vtable slot +0x40 on the 0x005c8c50 specialization table, that slot resolves to 0x0040ce60, and 0x0040ce60 immediately re-enters 0x0040cd70 plus 0x0045c150. So the acquisition-side cached source/candidate bridge [site+0x3cc/+0x3d0] is no longer a generic restore mystery for stream-loaded rows; the remaining restored-row gaps are [site+0x276] and the deferred tri-lane.".to_string(),
);
notes.push(
"Direct disassembly now tightens the remaining placed-structure lanes too: 0x0040cac0 is only the raw tri-lane delta reader over [site+0x310/+0x338/+0x360]; 0x0040d360 is only the exact subtype test [candidate+0x32] == 4; and the current binary write scan finds no direct placed-structure runtime writer for either [site+0x2a4] or [site+0x310/+0x338/+0x360], which now makes both lanes look payload/restore-owned rather than service-produced.".to_string(),
@ -27957,7 +27960,7 @@ mod tests {
let trace = build_periodic_company_service_trace_report(&analysis);
assert_eq!(trace.selected_company_id, Some(7));
assert_eq!(trace.atlas_candidate_consumers.len(), 9);
assert_eq!(trace.known_bridge_helpers.len(), 55);
assert_eq!(trace.known_bridge_helpers.len(), 57);
assert_eq!(trace.next_owner_questions.len(), 4);
assert_eq!(trace.companies.len(), 1);
assert_eq!(
@ -28100,6 +28103,14 @@ mod tests {
.iter()
.any(|line| line.contains("0x0040c9a0"))
);
assert!(
trace.near_city_acquisition_projection_hypotheses[1]
.evidence
.iter()
.any(|line| line.contains("0x0040a3a1..0x0040a4d3")
&& line.contains("0x0040fcc0..0x0040fe28")
&& line.contains("0x00422c62..0x00422d3c"))
);
assert!(
trace.near_city_acquisition_projection_hypotheses[2]
.evidence
@ -28452,6 +28463,17 @@ mod tests {
&& line.contains("[site+0x310/+0x338/+0x360]")
&& line.contains("[site+0x2b4/+0x2b8/+0x2bc]"))
);
assert!(
trace
.known_bridge_helpers
.iter()
.any(|line| line.contains("0x0040a3a1..0x0040a4d3") && line.contains("0x0040c9a0"))
);
assert!(trace.known_bridge_helpers.iter().any(
|line| line.contains("0x0040fcc0..0x0040fe28")
&& line.contains("0x00422c62..0x00422d3c")
&& line.contains("0x0040cac0")
));
assert!(
trace
.known_bridge_helpers

View file

@ -119,6 +119,10 @@ Working rule:
direct local binary inspection shows `0x0040c9a0` folding `[site+0x310/+0x338/+0x360]` into
`[site+0x2b4/+0x2b8/+0x2bc]`, mirroring the nine-dword side array rooted at `[site+0x2e4]`,
and then clearing the tri-lane
- caller census keeps that tri-lane role narrow:
`0x0040c9a0` only appears under the broad live-collection sweep
`0x0040a3a1..0x0040a4d3`, while `0x0040cac0` stays under weighted scoring or evaluation
families such as `0x0040fcc0..0x0040fe28` and `0x00422c62..0x00422d3c`
- the cached source/candidate bridge is now grounded on stream load too:
direct local binary inspection shows `0x00413280` dispatching per-entry vtable slot `+0x40`
on the `0x005c8c50` specialization table, that slot resolving to `0x0040ce60`, and