From c28721b5c4ad8b8c5d4a2f996c53e796d1e6cb69 Mon Sep 17 00:00:00 2001 From: Jan Petykiewicz Date: Sat, 18 Apr 2026 18:47:41 -0700 Subject: [PATCH] Prioritize peer-site restore caller strip --- crates/rrt-runtime/src/smp.rs | 12 ++++++------ docs/rehost-queue.md | 12 +++++++++--- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs index cfb8e7b..cb6043b 100644 --- a/crates/rrt-runtime/src/smp.rs +++ b/crates/rrt-runtime/src/smp.rs @@ -4109,6 +4109,8 @@ fn build_periodic_company_service_trace_report( .to_string(), "0x00456072 fixed 0x55f2 callback forwarding three local dwords plus unit scalars into 0x00455b70" .to_string(), + "0x0045c36e / 0x0045da65 / 0x0045e0fc dense 0x00456100 caller family over stack-backed buffers and default scalar lanes" + .to_string(), "0x00485819 typed placed-structure caller of 0x0052edf0 via 0x530640-style argument bundle" .to_string(), "0x00490a79 chooser-side caller of 0x00455b70 with literal selector 0x005cfd74 and fallback seed 0x005c87a8" @@ -4117,7 +4119,7 @@ fn build_periodic_company_service_trace_report( "0x00409950 linked-transit roster sibling owner".to_string(), ]; let next_owner_questions = vec![ - "Which concrete 0x00455b70 caller shape applies to the live class-0 site rows that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 consume, now that 0x0052edf0 ownership is grounded and the remaining question is the selector-source lane feeding arg 3 (with arg 1 as fallback)?".to_string(), + "Whether the dense 0x0045c36e / 0x0045da65 / 0x0045e0fc caller family over 0x00456100 is the actual live class-0 site-row restore strip that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 depend on, and if so which persisted lane from those stack-backed buffers feeds the selector arg 3 into 0x00455b70 (with arg 1 as fallback)?".to_string(), "How much of the linked-peer refresh path is strictly post-load versus recurring runtime maintenance now that 0x004133b0 reaches 0x0040ee10 -> 0x0040edf6 -> 0x00480710 during bring-up and 0x004160aa also re-enters 0x0040ee10 later?".to_string(), "Which persisted linkage fields behind 0x0047efe0, [region+0x2a4], and [region+0x276] are sufficient to rehost the 0x004014b0 proximity-and-news branch without shell state?".to_string(), "Which infrastructure consumer above the grounded 0x38a5 seam actually drives the linked-transit branch that 0x00409950 follows?".to_string(), @@ -4282,7 +4284,7 @@ fn build_periodic_company_service_trace_report( "Direct disassembly now closes the negative persistence side too: the direct 0x36b1 per-record callbacks serialize the shared base scalar triplets rooted at [this+0x206/+0x20a/+0x20e] plus the subordinate payload callback strip, while the 0x4a9d/0x4a3a/0x4a3b side-buffer owner only persists route-entry lists, three byte arrays, five proximity buckets, and the sampled-cell list. That means neither checked-in save owner seam currently persists the core peer-site identity fields [site+0x04], [site+0x2a8], or [peer+0x08] directly.".to_string(), ); notes.push( - "The replay strip is tighter now too. 0x00444690 is the current late world bring-up caller of 0x004133b0, that outer owner drains queued site ids through 0x0040e450 and then sweeps every live placed structure through 0x0040ee10, and 0x0040ee10 itself reaches 0x0040edf6 -> 0x00480710 plus the later 0x0040e360 follow-on. A separate runtime path at 0x004160aa also re-enters 0x0040ee10 later. So [peer+0x08] replay is no longer the open question, and [site+0x04] itself is no longer an owner mystery either: 0x00455b70 feeds 0x0052edf0 with arg 3 as the primary selector and arg 1 as fallback, while grounded caller shapes now include the local wrapper 0x00456100, the fixed 0x55f2 callback 0x00456072, and the chooser-side path 0x00490a79. The remaining non-hook target is which of those caller families, or which still-unmapped sibling, actually seeds the live site rows that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 consume.".to_string(), + "The replay strip is tighter now too. 0x00444690 is the current late world bring-up caller of 0x004133b0, that outer owner drains queued site ids through 0x0040e450 and then sweeps every live placed structure through 0x0040ee10, and 0x0040ee10 itself reaches 0x0040edf6 -> 0x00480710 plus the later 0x0040e360 follow-on. A separate runtime path at 0x004160aa also re-enters 0x0040ee10 later. So [peer+0x08] replay is no longer the open question, and [site+0x04] itself is no longer an owner mystery either: 0x00455b70 feeds 0x0052edf0 with arg 3 as the primary selector and arg 1 as fallback, while grounded caller shapes now include the local wrapper 0x00456100, the fixed 0x55f2 callback 0x00456072, and the chooser-side path 0x00490a79. The current leading restore-family hypothesis is the dense 0x0045c36e / 0x0045da65 / 0x0045e0fc caller strip above 0x00456100, because those callers repeatedly allocate 0x23a rows, pass stack-backed buffers, and use the same default scalar lanes. The remaining non-hook target is to confirm whether that family seeds the live site rows that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 consume, and to name the persisted selector lane inside that wrapper bundle.".to_string(), ); SmpPeriodicCompanyServiceTraceReport { @@ -25943,7 +25945,7 @@ mod tests { let trace = build_periodic_company_service_trace_report(&analysis); assert_eq!(trace.selected_company_id, Some(7)); assert_eq!(trace.atlas_candidate_consumers.len(), 7); - assert_eq!(trace.known_bridge_helpers.len(), 34); + assert_eq!(trace.known_bridge_helpers.len(), 35); assert_eq!(trace.next_owner_questions.len(), 4); assert_eq!(trace.companies.len(), 1); assert!(trace.atlas_candidate_consumers.iter().any(|line| { @@ -25952,9 +25954,7 @@ mod tests { && line.contains("peer-site boolean/selector pair") })); assert!(trace.next_owner_questions.iter().any(|line| { - line.contains("0x00455b70") - && line.contains("live class-0 site rows") - && line.contains("arg 3") + line.contains("0x0045c36e") && line.contains("0x00456100") && line.contains("arg 3") })); assert!(trace.next_owner_questions.iter().any(|line| { line.contains("0x004160aa") diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md index b5a8635..378b943 100644 --- a/docs/rehost-queue.md +++ b/docs/rehost-queue.md @@ -72,6 +72,9 @@ Working rule: selector/fallback bundle before calling `0x00455b70` - `0x00456072` is a fixed `0x55f2` callback that forwards three local dwords plus unit scalars into `0x00455b70` + - `0x0045c36e / 0x0045da65 / 0x0045e0fc` are concrete callers of `0x00456100`, repeatedly + allocating `0x23a` rows, forwarding stack-backed buffers, and using the same default scalar + lanes - `0x00485819` is one typed placed-structure caller of `0x0052edf0` through the generic three-arg wrapper `0x00530640` - `0x00490a79` is one chooser-side caller of `0x00455b70`, feeding literal selector @@ -79,7 +82,8 @@ Working rule: So the next owner question is no longer “what does the acquisition branch do?” or “which post- load owner replays linked-site refresh?” but “which concrete `0x00455b70` caller family applies to the live site rows, and which persisted lane becomes the selector bundle that ultimately - seeds `[site+0x04]`?” + seeds `[site+0x04]`?” The current leading restore-family hypothesis is the dense + `0x0045c36e / 0x0045da65 / 0x0045e0fc -> 0x00456100 -> 0x00455b70` strip. - Make the next static/rehost slice the peer-site rebuild seam above persistence, not another save scan: - treat `0x00444690 -> 0x004133b0 -> 0x0040e450 / 0x0040ee10 -> 0x0040edf6 -> 0x00480710` as @@ -90,8 +94,10 @@ Working rule: - treat `0x00455b70` as the checked-in specialization constructor that maps selector/fallback bundle lanes into that field owner - distinguish which `0x00455b70` caller family actually seeds the live site rows before - `0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50` consume the resulting selector, and name - the persisted lane that reaches its selector arg `3` + `0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50` consume the resulting selector, with the + current first target being the dense `0x0045c36e / 0x0045da65 / 0x0045e0fc -> 0x00456100` + family + - name the persisted lane that reaches selector arg `3` inside that wrapper bundle - Use the higher-layer probes as the standard entry point for the current blocked frontier instead of generic save scans: `runtime inspect-periodic-company-service-trace `,