B2 verified live; record the RollResearchEvent draw as behaviourally unproven

campaign/DASHBOARD.md

@@ -1,19 +1,19 @@
 # SotS RE campaign — coverage dashboard
 
-Generated 2026-09-08 04:58 UTC · `sots-re` @ 4d53502,2026-09-08 · `sots-engine` @ 89c0013,2026-09-08 (59 commits) · regenerate with `tools/dashboard.py`
+Generated 2026-09-08 05:19 UTC · `sots-re` @ ee43e96,2026-09-08 · `sots-engine` @ b925944,2026-09-08 (62 commits) · regenerate with `tools/dashboard.py`
 
 > **North star:** A functional reimplementation of the engine — behavior-equivalent, NOT byte-for-byte
 
 ## 1. Map coverage (campaign/board.md)
 
-60 targets · mapped-or-better **46/60** `[████████░░] 77%` · verified **29/60** `[█████░░░░░] 48%`
+61 targets · mapped-or-better **47/61** `[████████░░] 77%` · verified **30/61** `[█████░░░░░] 49%`
 
 | Status | Count | % |
 |---|---:|---:|
-| verified | 29 | 48% |
+| verified | 30 | 49% |
 | mapped | 17 | 28% |
-| in-progress | 3 | 5% |
-| backlog | 9 | 15% |
+| in-progress | 2 | 3% |
+| backlog | 10 | 16% |
 | blocked | 1 | 2% |
 
 | Type | verified | mapped | in-progress | backlog | blocked | total |
@@ -22,8 +22,8 @@ Generated 2026-09-08 04:58 UTC · `sots-re` @ 4d53502,2026-09-08 · `sots-engine
 | control-flow | 0 | 2 | 0 | 0 | 0 | 2 |
 | subsystems | 2 | 6 | 1 | 3 | 1 | 13 |
 | engine | 10 | 0 | 0 | 0 | 0 | 10 |
-| verify | 4 | 2 | 1 | 3 | 0 | 10 |
-| phase2 | 4 | 1 | 1 | 2 | 0 | 9 |
+| verify | 4 | 2 | 1 | 4 | 0 | 11 |
+| phase2 | 5 | 1 | 0 | 2 | 0 | 9 |
 | meta | 4 | 4 | 0 | 1 | 0 | 9 |
 
 ## 2. Binary understanding
@@ -54,10 +54,10 @@ Generated 2026-09-08 04:58 UTC · `sots-re` @ 4d53502,2026-09-08 · `sots-engine
 | `mars/stream` | 3,703 | 6 | 222 | yes | mars-stream.md |
 | `mars/text` | 899 | 8 | 245 | yes | mars-text.md |
 | `mars/vfs` | 788 | 9 | 140 | yes | mars-vfs.md |
-| `shim` | 6,663 | 0 | 0 | direct (WIN32) | M0.md |
-| `shim/hooks` | 4,520 | 0 | 0 | direct (WIN32) | M0.md |
+| `shim` | 6,737 | 0 | 0 | direct (WIN32) | M0.md |
+| `shim/hooks` | 4,594 | 0 | 0 | direct (WIN32) | M0.md |
 | `shim/trace` | 1,836 | 8 | 248 | direct (WIN32) | shim-trace.md |
-| **total** | **26,735** | **88** | **2805** | | |
+| **total** | **26,883** | **88** | **2805** | | |
 
 Board `engine:` rows: verified **10**, mapped 0, in flight 0 (of 10) — verified & merged `[██████████] 100%`
 
@@ -94,10 +94,10 @@ Most recent open:
 
 ## 8. Delta since previous dashboard
 
-- verified targets: 29 → 29 (+0) · mapped-or-better: 46 → 46 (+0)
-- engine LOC: 22,621 → 26,735 (+4,114) · test files: 88 → 88 (+0) · checks: 2,718 → 2,805 (+87)
-- addresses verified: 202 → 317 (+115) · recovered layouts: 21 → 21 (+0) · open questions: 27 → 27 (+0)
+- verified targets: 29 → 30 (+1) · mapped-or-better: 46 → 47 (+1)
+- engine LOC: 26,735 → 26,883 (+148) · test files: 88 → 88 (+0) · checks: 2,805 → 2,805 (+0)
+- addresses verified: 317 → 317 (+0) · recovered layouts: 21 → 21 (+0) · open questions: 27 → 27 (+0)
 
 ---
 warnings: board.md line 66: unknown status 'code-complete' for 'P2-B4 colony + movement (behavioral)'; mars-rng.md: no oracle total row parsed; mars-stream.md: no oracle total row parsed; mars-vfs.md: no oracle total row parsed
-<!-- dashboard-metrics {"verified": 29, "mapped_plus": 46, "targets": 60, "loc": 26735, "tests": 88, "checks": 2805, "addr_verified": 317, "addr_total": 324, "layouts": 21, "open_q": 27} -->
+<!-- dashboard-metrics {"verified": 30, "mapped_plus": 47, "targets": 61, "loc": 26883, "tests": 88, "checks": 2805, "addr_verified": 317, "addr_total": 324, "layouts": 21, "open_q": 27} -->

campaign/board.md

@@ -54,14 +54,15 @@ Status flow: `backlog → in-progress → mapped → verified` (or `blocked`).
 | strategic formula gaps | subsystem | verified | high | 100% | 2026-09-07 | findings/subsystems/formula-gaps.md: all 8 answered with code (bankruptcy 3.3 on BnkPr, linear hazard, money tail, pbon, slider, [6] net, no speed clamp, decay hits current) |
 | engine: game/design | engine | verified | high | 100% | 2026-09-07 | merged; see ShipDesignDef row |
 | P2-B1 ComputeBudget (behavioral) | phase2 | verified | high | 90% | 2026-09-08 | LIVE + GREEN: 4,623 calls traced, 4,437 compared 0 divergences (all 8 End-Turn calls identical on 22 slots), REPLACE fed the game its budget for a full turn and the End-Turn oracle reproduced byte-for-byte. Corrections: out-param is int[22] not int[25] (next 3 words are a std::vector); researchMoneyKept only charged with a research target (real bug). Coverage: 8 slots verified on varied values, 8 slots always 0 in this save (expenses/aid/debt tail UNTESTED), 6 are inputs by construction |
-| P2-B2 OnTechResearched (behavioral) | phase2 | in-progress | med | 70% | 2026-09-08 | CODE-COMPLETE (engine f28c639), dist-b2 staged, ctest 28/28. TEN static corrections: all float32 w/ widened literals; AI-bonus values 0.5 (odds .1/.2); PrGtTrf is int; +0x308 is a POINTER (RAD>REND>RIP first-hit, no species gate); undocumented sticky mask at +0x1a4; capture-designs/design-masks/bore are tail checks on EVERY completion; NO already-researched guard (our early-return would have made every call a no-op); *(int*)TechDef is not a TechId; full g_TechIdNames dump found XenoTechId(Proliferate,Morrigi) returning the HUMAN node-track tech (block is 5 not 6). NEEDS VM window (queued behind B3) |
+| P2-B2 OnTechResearched (behavioral) | phase2 | verified | high | 80% | 2026-09-08 | LIVE: 3 completions compared, 0 divergences (incl. one tech absent from the effects table = tail-only, the case an early return would have broken). float32 CONFIRMED ON THE GAME bit-for-bit (con_mod 1.0->0.899999976 = (float)(x+(double)0.1f)). Found B3's rolling effect: ServerPlayer::RollResearchEvent draws one NextFloat at the top of the callback - modelled + RNG region declared, but the branch never fired here so NOT behaviourally proven. KNOWN GAP: ours posts no events and the player event list is still undeclared, so the clean compare bounds the economy fields only and the replace/oracle pass was deliberately run on a no-completion turn (weak check) |
 | P2-B3 ProcessResearch (behavioral, RNG) | phase2 | mapped | high | 85% | 2026-09-08 | LIVE, PARTIAL PASS: 15 calls compared, 13 zero-divergence; RNG post-state matched 14/15 incl. every roll (validates MT19937 + draw mapping + odds together). 2 divergences are the declared SetResearched boundary. ORACLE FAILS by exactly one item across 40,300: an unposted EVENT_RESEARCH_OVERBUDGET - compare was blind because the event list was never a declared region. fpu_cw=0x127f => 53-bit double, x87 question SETTLED. No Zuul in the save: double roll still disassembly-only |
 | RNG signatures (Ghidra) | meta | verified | high | 100% | 2026-09-08 | Seed/Twist/NextFloat/NextInt verified; draw = y/(2^32-1); NextInt [0,n] inclusive; lazy twist; left@+0x9c4. RUNTIME CONFIRMED: fpu_cw=0x127f (53-bit double, round-nearest) - our next_float model is right, float_from_pc24 is an unused contingency |
 | engine: game/effects | engine | verified | high | 100% | 2026-09-08 | merged: TechId enum (196 slots @10000+i), 44 ids with typed strategic effects, species flag bits, ApplyTechEffect; 254 checks |
-| VM140 exclusivity (lab rule) | meta | verified | high | 100% | 2026-09-08 | one agent at a time. Holder: B2. QUEUE: B4. Non-holders build /srv/re-lab/build/sots-engine-<lane>, stage dist-<lane>, deploy C:\SOTS\shimdist-<lane>. NOTE: Windows Update dialog can hide a crash dialog and mimic a hang |
+| VM140 exclusivity (lab rule) | meta | verified | high | 100% | 2026-09-08 | one agent at a time. Holder: B4 (window open). QUEUE: empty. Windows Update now DISABLED/paused on the VM (was rebooting mid-run). Non-holders build /srv/re-lab/build/sots-engine-<lane>, stage dist-<lane>, deploy C:\SOTS\shimdist-<lane> |
 | Zuul double-roll (behavioural) | verify | backlog | — | 0% | 2026-09-08 | CONFIRMED NEEDED: ref-turn2 has only species 0 and 2, so the double roll is verified by disassembly + host tests only. Needs one compare from a species-5 save; the check is just that `left` drops by 2 not 1 |
 | budget tail coverage (expenses/aid/debt) | verify | backlog | — | 0% | 2026-09-08 | 8 ComputeBudget slots were always 0 in ref-turn2 (no sliders, no aid, no debt, no handicap). Need a save with expense sliders, a debtor and a research-aid treaty to exercise ExpenseTotal + the aid/bonus tail |
 | hook GetDifficultyMods | meta | backlog | — | 0% | 2026-09-08 | B1 derived the two difficulty rows from trace values (AI maintenance divisor 3, research x1.5) instead of snapshotting them; hook it properly so they stop being constants |
 | section-loader compare crash | verify | backlog | — | 0% | 2026-09-08 | SectionDictionary compare crashes the engine while the identical weapon path succeeds -> fault is in re-running LoadSection, not the manifest reader. Next boundary: hook LoadSection itself. docs/M2.md has 3 ranked leads |
 | P2-B4 colony + movement (behavioral) | phase2 | code-complete | med | 70% | 2026-09-08 | CODE-COMPLETE (engine 89c0013), dist-b4 staged, ctest 30/30. Verified 3 signatures (ProcessTurn takes NO stack arg - Ghidra's 2nd param was fiction, would have crashed). 22 corrections incl: population growth has NO pop/capacity term (base is a suitability ratio through pow()) - our model was wrong in SHAPE; range margin is +0.05f not -0.05 (fleets stopped 0.1 short); failed jump SCATTERS around the destination (2nd draw); AccrueSystemBonus gate is ntdev not rbtn; rounding is fistp ties-to-even; only ProcessRebellion draws RNG in a colony turn. NO replace/oracle this milestone (input boundary, deliberate). UNTESTED sub-paths: plague, rebellion, slaves, terraform, addiction, unowned decay, jumps, gate teleports, node-line travel, stranded fleets |
 | harness gap: undeclared side-effect lists | verify | in-progress | — | 0% | 2026-09-08 | AUDIT LANE RUNNING: a clean compare can be silently incomplete (B3's unposted event). Auditing every descriptor for undeclared writes (event/message lists, vector/map appends, writes through pointers, globals) and making unmodelled coverage structurally visible in the trace + tracecmp report |
+| RollResearchEvent draw (behavioural) | verify | backlog | — | 0% | 2026-09-08 | ServerPlayer::RollResearchEvent draws one NextFloat when the completing def is the current target and +0x3b4 is set. Region declared, ours reproduces it, but the branch never fired on ref-turn2 - needs a workload that sets research_roll_pending |