73 lines
5.2 KiB
Markdown
73 lines
5.2 KiB
Markdown
# Current-source ABI static capture report — run-35e59053176da458d8b46fea
|
|
|
|
## Result and provenance
|
|
|
|
The authoritative package is
|
|
`verify/results/research-completion-abi/run-35e59053176da458d8b46fea-repair1/`; its manifest records
|
|
27 positive objdump executions, all return code zero with nonempty stdout and empty stderr (118,734
|
|
stdout bytes, zero stderr bytes), and no failed checks. Paired source identity remained engine
|
|
`ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd` and RE
|
|
`e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f` before/after. Binary,
|
|
objdump, Python, save and parser identities are in the manifest and preflight.
|
|
|
|
The sibling directory without `-repair1` is a preserved failed recipe run. Its streams are valid,
|
|
but two checks incorrectly required the bad boundary stream to omit its terminal row. Actual objdump
|
|
retains a one-byte terminal row (`c2` or `74`) and replaces it with the complete row when the stop is
|
|
aligned. The repaired recipe tests equal preceding rows plus that replacement. This was a local test
|
|
predicate defect, not contradictory binary behavior and not a retroactive pass.
|
|
|
|
## Measured static observations
|
|
|
|
* Stop `0x00779913` emits truncated `779912: c2`; stop `0x00779915` emits complete
|
|
`779912: c2 04 00`, and authority through `0x00779930` includes the complete return plus cleanup at
|
|
`0x00779915`. Direct PE mapping independently reads `c20400` at VA `0x00779912`.
|
|
* The second boundary family reproduces truncated `74` at stop `0x00779a20`, complete `74 10` at
|
|
`0x00779a21`, then complete `8b cf` and `e8 28 6a ff ff` at stops `0x00779a23` and
|
|
`0x00779a28`. Direct PE bytes are `74108bcfe8286affff`.
|
|
* ObservedTech append/growth instructions use `0x2c`; PlayerEvent append/nested-copy/destruction use
|
|
`0x74`; TurnEvents append/prune use `0x18`. These are distinct concrete element strides.
|
|
* ObservedTech allocation multiplies count by `0x2c` and calls `0x00924fb6`; old-element growth and
|
|
PlayerEvent/string destruction paths call `0x00924faa`. PlayerEvent append calls copy constructor
|
|
`0x007693f0`; outer TurnEvents append calls nested copy `0x00779850`.
|
|
* Nested copy zeros the destination three-pointer header, distinguishes empty count from allocation,
|
|
allocates through `0x0078af40`, multiplies by `0x74`, calls range helper `0x007725a0`, writes the
|
|
copied end pointer, returns destination in EAX, and ends `ret 4`. Its captured unwind edge calls
|
|
`0x00629580` before the allocation-failure helper; this edge was exposed, not executed.
|
|
* Get/create scans every `0x18` bucket and retains the last matching `+4` turn. On miss it establishes
|
|
vptr and zero nested-vector pointers, calls outer append, calls nested-vector cleanup, then stores
|
|
the requested stack turn into stored-last `+4`; both returns are `ret 4`.
|
|
* Outer append separates capacity-growth and spare-capacity edges, copies source `+4`, advances source
|
|
to nested vector `+8`, deep-copies it, then increments end by `0x18`; it ends `ret 4`.
|
|
* Duplicate scan advances by `0x74`; after prior field comparisons it performs description comparison
|
|
at `0x0046f8c0`, caller-cleans two arguments, and reaches match return only when AL is zero. Thus the
|
|
fresh instructions remain consistent with description equality being required.
|
|
* Direct PE mapping reads three `0x7f7fffff` words at constructor-default VA `0x00af0dc8`. This is a
|
|
binary constant observation, not a newly parsed event record.
|
|
|
|
The manifest's direct-PE entries named `observed-stride`, `player-stride`, and `turn-stride` sampled
|
|
fixed addresses but were not used to establish strides; their names are overbroad. The stride facts
|
|
above come from the archived instruction rows. This limitation does not affect the boundary-byte or
|
|
constructor-default direct controls.
|
|
|
|
## Interpretation, dependencies, and limits
|
|
|
|
The measurements support the prior static interpretation that vector elements require construction
|
|
and nested/string ownership rather than raw header copy. Calling `0x00924fb6`, `0x00924faa`, or
|
|
`0x0046f8c0` remains an original-helper dependency with the original CRT/string layout. A standalone
|
|
implementation needs one coherent allocator/copy/destruction family; this capture does not show that
|
|
original allocations can safely cross a replacement boundary.
|
|
|
|
No game branch, allocation, constructor, destructor, throw, event post, ID assignment, record write,
|
|
container mutation, or RNG draw executed. The save was hashed, not parsed. Existing/miss,
|
|
spare/full-capacity, empty/nonempty, null/nonnull, short/long-string, normal/unwind, duplicate and
|
|
description-only-different states are instruction exposures only. Exact PostEvent caller inputs,
|
|
defaulting and total write order remain outside this bounded remeasurement.
|
|
|
|
## Independent falsification package
|
|
|
|
A fresh verifier should use its own recipe and fail-if-exists directory, bind the current paired
|
|
digest, repeat the negative/aligned/authority boundaries and direct PE reads, challenge at least one
|
|
additional boundary, and parse the archived save independently for named player/event containers,
|
|
elements, IDs, strings, FLT_MAX words, empty-player states and the actual RNG leaf. It must preserve
|
|
all runtime residuals and must not count this analyst capture or archived prior verifier output as an
|
|
independent cross-check.
|