sots-re/findings/subsystems/snlv-measured.md

SnLv measured — the sensor branch is what refreshes Spica, and the contact level is 2, not 1

• Type: subsystem (live measurement)
• Status: verified for Spica; nvo-tshn-visible-owner.md §6's first bullet moves [H] → [V]
• Confidence: high. Hardware data-write watchpoint on the word itself, with the canary self-test passing and the determinism oracle reproduced byte for byte in the same run.
• Owner / date: lane L1 · 2026-09-08 · VM140
• Instrument: src/shim/hooks/watchpoints.cpp, new watch.mode=snlv, config shim.cfg.l1snlv, build 0117495-dirty-20260908T2113Z
• Answers: findings/subsystems/nvo-tshn-visible-owner.md §6 — "One arming line (sys+0x24 in slot 1 instead of _Mysize) settles it on the next VM run." It did.

---

0. The result

ServerSystem::IsKnownTo is AFlags bit || (PlyrIdx < 15 && ((SnLv >> 2*PlyrIdx) & 3) != 0 && HasResearched(CCC_AdvSens)). Lane W3 could not decide whether Spica's NVO record is refreshed through the AFlags term or the sensor term, because SnLv is not serialised and had never been measured.

On ref-turn2.sav, at the arming point, Spica has AFlags = 0x0 and SnLv = 0x00000200, i.e. contact level 2 for player index 4 — the very player its single NVO record is keyed to.

AFlags = 0 makes the first term false. The sensor term is therefore the only way IsKnownTo can return true for that pair, and the record is refreshed. The sensor branch is what refreshes Spica, measured rather than inferred.

1. The whole map, because it costs no debug register

Printing SnLv and its decoded per-player 2-bit fields for every system during the arming sweep is free. All 28 systems of ref-turn2.sav, at ApplyAllTurnCommands entry on the End Turn from turn 2 (only the non-zero rows shown; the other 20 systems read SnLv = 0):

system	AFlags	SnLv	non-zero levels
Hyperion	0x10	0x00000300	player 4 → 3
Gamma Cephei	0x01	0x00000003	player 0 → 3
Spica	0x00	0x00000200	player 4 → 2
Ke'Dolarra	0x02	0x0000000c	player 1 → 3
Koa?Vo	0x80	0x0000c000	player 7 → 3
Kaa?Vaalu	0x10	0x00000300	player 4 → 3
Markab	0x10	0x00000300	player 4 → 3
Kea?Pono	0x10	0x00008300	player 4 → 3, player 7 → 2
Ko'Rorkor	0x10	0x00000300	player 4 → 3

Two regularities fall out and neither was available from any save:

1. Level 3 occurs exactly where the AFlags bit is set, on all eight rows — which is the IsVisibleTo early-out of SensorPhase_ComputeContactLevel doing what lane W3 read.
2. Level 2 occurs exactly where it is not — Spica for player 4, Kea'Pono for player 7. So the non-visible contact state on this save is 2, and level 1 was never observed.

2. A correction: ComputeContactLevel does not return 1 there

ghidra/addresses.d/lane-w3.json records SensorPhase_ComputeContactLevel as "3 if IsVisibleTo (AFlags), else 1 if inside p's sensor envelope, else 0". The function has four return tails, read at instruction boundaries:

00850d18  mov eax,3        ; IsVisibleTo -> 3
00850e2f  mov eax,ecx      ; ecx = setne on an FPU range compare  -> 0 or 1
00850e47  lea eax,[edx+2]  ; edx = setne on the same compare      -> 2 or 3
00850e52  mov eax,2        ; -> 2

which pair is taken is selected by cl and by [ebx+0x10]. So the value set is {0,1,2,3} and the {0,1} pair is one of three tails, not the only alternative to 3. The measurement above lands on a 2 tail. IsKnownTo only tests != 0, so nothing downstream changes — but the constant in the prototype is wrong and would mislead anyone reimplementing the sensor phase.

3. Who writes it, and how often

DR1 watched Spica's sys+0x24 for the whole End Turn: 20 writes, every one from the same instruction.

trap EIP (Ghidra VA)	store site	value written	count
0x0086a78c	0x0086a789 mov [edi+0x24],edx	0x00000200 every time	20

0x0086a789 is exactly the pack site lane W3 named from static reading — the trap reports the instruction after the store, and 0x0086a789 + 3 = 0x0086a78c. Confirmed to the byte. The value never changed across the turn: the recompute is idempotent on this workload, which is why the absence of SnLv from the wire costs nothing on these saves and why no save could ever have shown it.

The enclosing loop at 0x0086a761..0x0086a79b walks GetGame()->Systems and calls ComputeContactLevel once per system, masking 3 << (2*idx) out and OR-ing the result in, guarded by [ebp-0x10] >= 0xf — the PlyrIdx < 15 test lane W3 read in IsKnownTo, here on the writing side. Twenty full sweeps of the systems vector happen in one End Turn.

4. TShn refreshed, in the same run, twice

DR0 watched Spica's NVO record at root+0x10 ({int16 touched, int16 TShn}): 4 writes, in two pairs, all with a SetVisibleOwner frame:

seq	trap EIP (VA)	word after the store	reading
8	0x0075b95a	0x00020003	touched := 3 (the new Frame), TShn still 2
9	0x0075b965	0x00030003	TShn := 3
20	0x0075b95a	0x00030003	same pair again
21	0x0075b965	0x00030003

Return addresses 0x0075bd4a / 0x0075bdc3 with 0x0086a806 on the stack put the caller chain in the sensor phase, next to the SnLv writer. This confirms three things lane W3 stated as a model: SetVisibleOwner stamps touched and TShn in two separate stores; it runs twice per turn for one (system, player) pair; and on this turn both are stamped with the new Frame.

5. Coverage — what this does NOT settle (rule 15)

• Bismol is not on this map. nvo-tshn-visible-owner.md §6's open question — which conjunct fails at Bismol — belongs to zuul-turn23-fleet23.sav, a different game with a different star list. This run settles the Spica half of that bullet and leaves the Bismol half open. The same config on the Zuul save answers it: the arming sweep prints every system's SnLv, so one launch and one End Turn is the whole experiment.
• One system watched, 28 printed. The 20 SnLv writes and the 4 TShn writes are Spica's. Every other system's row above is a read at arm time, not a watched write.
• SnLv never changed value during the turn, so nothing here says what a transition looks like or when a contact is lost.
• Level 1 was never observed. §2's four-tail reading is static; only 0, 2 and 3 have been seen.
• Per-thread blind spot. Debug registers are per-thread and the arm is on the turn thread only.
• ShareVisibleOwner still has never executed — no corpus save has an alliance (unchanged).

6. Instrument neutrality (rule 19)

The armed run is the oracle run: ref-turn2.sav, one End Turn, four watchpoints live and ~24 exception deliveries, plus the five lane-L1 hooks and lane Z's ledger:

file	size	sha256 prefix	historical
(Autosave EndTurn).sav	66,732	bb4fd9ac89f41e3b	identical
(Autosave).sav	67,219	978041acd168b56e	identical

Canary self-test: writes=1 traps=1 dr7=0xdddd0055 PASS.

7. Files

• Arming log (all 28 systems with SnLv decoded, the base probe, the canary): verify/results/shim/l1/watch-arm.txt
• Hit log: verify/results/shim/l1/watch-hits.txt
• Instrument: sots-engine wip/l1, src/shim/hooks/watchpoints.cpp (watch.mode=snlv), configs shim.cfg.l1snlv / shim.cfg.l1control