sots-re/findings/subsystems
alex ae47971316 AI4: what an AI turn emits, and what each command costs in ModCount
Joins the emission side (lanes AI1-AI3) to the counting side (A2, W2). Three
results.

The cost of applying a command is a property of its list, and the boundary is
sharp: lists 1-16 each advance ModCount once per element, lists 17-27 never do.
Four of the six prologue gates bump, one is free, and the sixth has no applier
anywhere in the application path -- its cost is unknown, not zero. The batch
applies the twenty-seven lists in a fixed order that is neither list nor offset
order, with the six gates split across three separate per-player loops at three
different points, and four of the sixteen bumps inlined into the batch rather
than living in a handler, which is why a call-graph sweep under-counts them.

Lane W2's four unnamed handler EIPs are named, and so are its two inlined ones,
and the ten measured command bumps then decompose with zero residual. Four of the
ten are the research-rate gate, one per submitted block, and one of those four is
the human's. Two are list 14, on a turn that moved exactly one fleet -- which
confirms lane AI2's P1 (an AI fleet order deposits two fleet-task elements where
the interface deposits one) from the counter side, at no VM cost.

The reference game is not what the record says. ref-turn2.sav IS turn2-state.sav;
there are THREE AI players, not one, and the two dormant ones do run -- all three
set a research rate and picked a research target on turn 1; and the four
monster-faction players submit no command block at all, which is the first direct
evidence that they have no client rather than an empty task list.

Prediction committed for turn1-state: the same 12, out of a different set of
commands -- 4 rate gates, 3 research targets, and three orders from the one AI
with an empire, which are predicted to be a new design, a build order and a
system-rates command, with NO fleet order on turn 1. The trap multiset it
predicts contains two EIPs W2 has never seen and omits three it did, so it is
cheap to falsify: one save swap on W2's unchanged watchpoint module.

Also: phase 2 of the AI's turn is Hiver-only (a fifth cross-check on the species
reading, and the reason one prologue gate has never been observed set), phases
29-33 are dead because the submit latches the client before it builds the send
buffer, and cl_SetResearchTarget is AI-only surface with exactly one caller.

14 addresses in ghidra/addresses.d/lane-ai4.json; validated to a scratch path,
1,138 -> 1,152, no duplicate names.
2026-09-08 16:27:58 -04:00
..
.keep.md scaffold RE campaign: board, backlog, findings template, verify tree 2026-09-07 14:40:44 -04:00
ai-order-emission.md AI4: what an AI turn emits, and what each command costs in ModCount 2026-09-08 16:27:58 -04:00
ai-stepping-and-passes.md findings: lane AI3 -- the AI stepping order is save player order, and pass 0 writes nothing 2026-09-08 15:29:53 -04:00
ai-task-system.md lane AI2: the AI's task selection loop, the priority table, and the order-method -> TurnCommands map 2026-09-08 14:43:41 -04:00
ai-turn-logic.md lane H: five live probes, the oracle restored, and a harness perturbation bisected to one hook 2026-09-08 13:53:36 -04:00
battle-load-profile.md battle-load: profile filed, bug parked; sampler + resume recipe kept 2026-09-07 16:43:14 -04:00
data-model.md data-model: fix example section path (CRAIC, caught by vfs oracle) 2026-09-07 17:41:45 -04:00
data-parsers.md verify: mars data parsers proven 100% on 1595 files; catalogs; tech-tree graph 2026-09-07 15:22:55 -04:00
determinism-oracle.md lane H: five live probes, the oracle restored, and a harness perturbation bisected to one hook 2026-09-08 13:53:36 -04:00
eventlive-verification.md lane V: live verification of the event-posting model against an advance prediction 2026-09-08 05:59:22 -04:00
events.md lane EV: what a turn actually posts, and two corrections to events.md 2026-09-08 15:40:07 -04:00
formula-gaps.md income-term: the output -> money chain read from the instruction stream; the BnkEl oracle goes 6/25 -> 25/25 2026-09-08 13:49:48 -04:00
fpu-precision-sensitivity.md lane F: x87 precision sensitivity measured; STATE_CHECKSUM 3.5 closed 2026-09-08 05:07:53 -04:00
golden-trace-recapture.md lane X: x86 displacement xref scanner; pin sizeof(ObservedTech) and its append site 2026-09-08 04:44:18 -04:00
income-term.md lane C3: ComputeOutput on the turn path -- the money ComputeBudget actually sums 2026-09-08 14:50:50 -04:00
loader-prototypes.md lane S: std::string is 0x1c binary-wide; ObservedTech element fully mapped 2026-09-08 05:09:33 -04:00
movefleet-position-rounding.md lane M: MoveFleet position rounding closed; VM140 released; types 2-5 still uncovered 2026-09-08 03:51:39 -04:00
multiplayer-gamespy.md board: lane P2 nav classifier; type 2 is the Liir drive, a naming error not a gap 2026-09-08 12:45:27 -04:00
multiplayer-tier0-verified.md lane W2: VM housekeeping notes for the multiplayer recipe (SOTSUI2 left registered, SOTSB staged not registered, -ExecutionPolicy Bypass gotcha) 2026-09-08 15:26:42 -04:00
observedtech-append.md lane S: std::string is 0x1c binary-wide; ObservedTech element fully mapped 2026-09-08 05:09:33 -04:00
output-term.md lane C3: ComputeOutput on the turn path -- the money ComputeBudget actually sums 2026-09-08 14:50:50 -04:00
output-turn-path.md lane G3: civilian growth read and measured; out[6] is not a repair number 2026-09-08 15:53:08 -04:00
path-solver.md lane P2: the path solver read from the instruction stream, and OrderFleetMove's three failure bits 2026-09-08 12:43:34 -04:00
population-growth.md lane G3: civilian growth read and measured; out[6] is not a repair number 2026-09-08 15:53:08 -04:00
rcex-explained.md lane W2: multiplayer Tier 0 played end to end with no server; ModCount/Frame/Status watchpoints; rcex explained 2026-09-08 15:23:52 -04:00
running-the-game.md verified: real saves parse; ServerPlayer/StarFleet/StarShip confirmed, ServerSystem conditional gaps listed; game-run recipe 2026-09-07 16:09:28 -04:00
setresearched-cascade.md lane U: the unlock cascade, implemented and live-verified 2026-09-08 06:57:37 -04:00
ship-construction.md findings: ship construction -- the build queue read byte for byte, and the missing destroyer is the AI's 2026-09-08 14:54:03 -04:00
strategic-turn-internals.md lane T2: the treaty-turn stamp, and Player.Status's real writer 2026-09-08 14:52:44 -04:00
strings-and-config.md strings/config: battle-load smoking gun (affinity), lockstep sim, net map, Mods override 2026-09-07 14:58:36 -04:00
system-visibility-prediction.md lane E3: the prediction's outcome, leaf for leaf 2026-09-08 13:39:30 -04:00
system-visibility-record.md lane E3: the per-system visibility record read from the instruction stream, and the prediction before the build 2026-09-08 13:26:46 -04:00
tech-effects.md b2 static findings: tech effects corrections, full g_TechIdNames dump; contract 176->211 2026-09-08 00:01:04 -04:00
treaty-turn-stamp.md lane T2: re-measure H02 on main 2fd0852 (C3 + B6 merged) -- same +26 / +14 / +12x3, 0 regressed, so the phase is orthogonal to both 2026-09-08 15:04:36 -04:00
ui-screen-map.md board: lane P2 nav classifier; type 2 is the Liir drive, a naming error not a gap 2026-09-08 12:45:27 -04:00
unlock-cascade.md lane K: StrategyServer::OnAllCombatDone_Tail mapped, 36 phases from the instruction stream 2026-09-08 08:47:08 -04:00