diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs index 7409820..609ead1 100644 --- a/crates/rrt-runtime/src/smp.rs +++ b/crates/rrt-runtime/src/smp.rs @@ -3669,6 +3669,7 @@ fn build_region_service_trace_report( evidence: vec![ "atlas already bounds this owner as the direct consumer of [region+0x276], [region+0x302], and [region+0x316]".to_string(), "the new region trace already proves the record envelope and profile subcollection, so the remaining gap is the separate persisted latch seam rather than the service owner".to_string(), + "direct disassembly now shows 0x004358d0 calling 0x00420030 twice plus 0x00420280, resolving the linked company through 0x0047efe0, posting company stat slot 4, and then clearing [region+0x276] while stamping [region+0x302] or [region+0x316]".to_string(), ], blockers: vec![ "persisted owner seam for [region+0x25e/+0x276/+0x302/+0x316]".to_string(), @@ -3864,6 +3865,7 @@ fn build_infrastructure_asset_trace_report( ), "atlas already bounds these helpers under the literal Infrastructure owner".to_string(), "the side-buffer corpus is disjoint from the placed-structure triplet corpus, so a separate child/rebuild family is more plausible than a compact alias".to_string(), + "direct disassembly now shows 0x0048a1e0 cloning the first child triplet bands through 0x52e880/0x52e720, destroying the prior child, seeding a new literal Infrastructure child through 0x455b70 with payload seed 0x5c87a8, attaching through 0x5395d0 or 0x53a5d0, and republishing the two bands through 0x52e8b0/0x530720".to_string(), ], blockers: vec![ "exact compact-prefix regime semantics".to_string(), diff --git a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md index 8ec99a9..4942e0f 100644 --- a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md +++ b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md @@ -73,7 +73,18 @@ The same brush strip is tighter now too: `[region+0x316]` is still clear, the same owner publishes one alternate one-shot notice from the same amount and region scalar before setting `[region+0x316]`. So the pending-region bonus lane is no longer just a queued setup artifact: it has a concrete later service owner and an explicit - shell-facing fallback above the same queue family now too. That narrows the next closure target + shell-facing fallback above the same queue family now too. Direct disassembly tightens the + bridge below that owner as well: `0x004358d0` first requires `[region+0x276]`, then drives two + separate `0x00420030` gate calls plus one `0x00420280` first-match selector before resolving the + linked company through `0x0047efe0`; only after that does it emit the success-side company/stat + update or the one-shot fallback notice. The peer helper itself is more concrete now too: + `0x00420030` walks collection `0x006cec20`, applies the class match through `0x0042b2d0`, uses + the optional linked-company filter through `0x0047efe0`, keeps the station-or-transit gate + `0x0047fd50`, and then tests the candidate status branch through `0x0047de00 -> 0x0040c990` + before reporting success. The paired selector `0x00420280` is the same scan with the same + filters, but returns the first matching site id instead of a boolean. So the remaining region gap + is now squarely the persisted latch/id seam, not the live peer/service logic itself. + That narrows the next closure target as well: ordinary-save probes can stop treating `[world+0x66a6]` persistence as the primary blocker, because the checked-in negative results on `q.gms`, `p.gms`, and `Autosave.gms` now make the pending-bonus owner plus its peer/linkage strip the first safe static target instead. The diff --git a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md index a8360dd..8fed13f 100644 --- a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md +++ b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md @@ -2911,6 +2911,16 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` The smaller attach helper `0x00490a3c` is now bounded too: it conditionally allocates one `Infrastructure` child from a caller-supplied payload stem, attaches it to the current owner, and then seeds three caller-supplied position lanes through `0x00539530` and `0x0053a5b0`. The + direct disassembly now makes that strip more concrete than the earlier structural note alone: + `0x0048a1e0` really does clone the first child through paired triplet readers + `0x0052e880/0x0052e720`, destroys the prior child through vtable slot `+0x18(0)`, allocates the + new `0x23a` object, seeds it through `0x00455b70` with literal payload seed `0x005c87a8`, and + then republishes the two sampled triplet bands through `0x0052e8b0` and `0x00530720` after + attaching through `0x005395d0`. The non-clone branch still seeds the same literal + `Infrastructure` child but attaches through `0x0053a5d0` instead. That means the next unknown is + no longer whether this strip owns the child/rebuild seam at all, but which side-buffer prefix + groups feed the clone-or-payload choice before the later route/local-runtime family runs. + The remaining closure target above the grounded `0x38a5` side-buffer seam is therefore narrower now: the next safe static pass should start at this exact attach/rebuild strip, not at the whole placed-structure family. The key open questions are whether the compact-prefix/name-pair groups diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md index b211fe8..b724111 100644 --- a/docs/rehost-queue.md +++ b/docs/rehost-queue.md @@ -40,6 +40,12 @@ Working rule: first owner-visible bridge from the side-buffer seam into route-entry rebuild; and which child fields or grouped rows absorb the side-buffer payload before `0x00448a70/0x00493660/0x0048b660` become relevant. +- Targeted disassembly now tightens that strip further: `0x0048a1e0` clones the first child through + `0x0052e880/0x0052e720`, destroys the prior child, seeds a literal `Infrastructure` child + through `0x00455b70` with payload seed `0x005c87a8`, and republishes the two sampled bands + through `0x0052e8b0/0x00530720` after attaching through `0x005395d0`; the non-clone branch + attaches through `0x0053a5d0`. So the next unknown is no longer whether this strip owns the + child/rebuild seam, but which `0x38a5` compact-prefix groups drive the clone-vs-payload choice. - Reconstruct the save-side region record body on top of the newly corrected non-direct tagged region seam (`0x5209/0x520a/0x520b`, stride hint `0x06`, `Marker09` record stems) now that the `0x55f3` payload is known to be fully consumed by the embedded profile collection on grounded @@ -69,6 +75,14 @@ Working rule: how far the grounded city-connection peer/linkage helpers (`0x00420030/0x00420280`, `0x0047efe0`) can be reused directly before the transient queued-notice family matters again. +- Targeted disassembly now tightens that strip too: `0x004358d0` calls `0x00420030` twice plus + `0x00420280`, then resolves the linked company through `0x0047efe0`, posts company stat slot `4` + on success, and stamps `[region+0x302]` or `[region+0x316]` while clearing `[region+0x276]`. + `0x00420030` itself now reads as the real peer gate over collection `0x006cec20`, combining + `0x0042b2d0`, the optional company filter through `0x0047efe0`, the station-or-transit gate + `0x0047fd50`, and the status branch `0x0047de00 -> 0x0040c990`; `0x00420280` is the same scan + returning the first matching site id. So the remaining unknown is the persisted latch/id seam, + not the live peer/service logic. - Reconstruct the save-side placed-structure collection body on top of the newly grounded `0x36b1/0x36b2/0x36b3` header seam so the blocked city-connection / linked-transit branch can stop depending on atlas-only placed-structure and local-runtime refresh notes, especially the