144 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
ReaperOfVeriod	1f903efe23	An external decomp turns two overlay constants from measured into named ... OpenRAC/rac2-gc-decomp is the same disc as ours, verified rather than assumed: ours 3,828,350,976 9db2e33e...b1ce5 theirs 3,828,350,976 9db2e33e...b1ce5 Vendored read-only under vendor/ (already gitignored) and added to PROVENANCE. It names two constants this parser had measured but never explained: * overlay.bin +0x00 = 1,735,808 = 0x1A7C80, the .lit load base. It is constant across all 27 levels because every level's literal section loads at the same address. So the first header word is the load base of the section the file IS, which also establishes that overlay.bin is that section -- it holds both code and the debug string pool. $gp = 0x1AEFF0 comes with it, and that closes the roadmap's open "$gp for this game" item. The program around it is seven sections -- .lit .bss .data vtbl camvtbl sndvtbl .text -- which is precisely the "seven-section parser and relocation" Phase 3 item for this format. Known target now rather than a guess. I then tested the obvious follow-up and it is wrong: if +0x00 is the .lit load base, +0x0c ought to be the .lit size. It is SMALLER than the file on 16 of 27 levels, by up to 8.9% (level11: file 3,151,128 vs 2,870,792). Excluded by sign, not by a near miss. Still unnamed. Collision: still blocked, but no longer blocked on tooling. The decomp names Camera_CollPrimTest(void *prim, void *grid) without decompiling it, so the cell layout is not handed over. What it does supply is $gp, and that is enough to start. "Camera_CollPrimTest WARNING! - grid out of bounds! (RAR)" is at overlay+0xd18, the only copy in the file, so: string overlay+0xd18 -> RAM 0x1a8998; delta to $gp -0x6658; $lo 0x99a8 MIPS puts the $lo half in bytes 1..3 of a 4-byte instruction. Searching the whole overlay instruction-aligned gives exactly ONE hit: 0x354cc8 (overlay+0x1ad048) One occurrence in 2.75 MB of code is unambiguous: that is the instruction materialising the assert string, and its enclosing function is Camera_CollPrimTest. That is the route in, and it needs no symbols. tools/overlay-anchors does this step, dependency-free. I started this with capstone for the disassembly proper and dropped it: capstone 0.14 does not re-export Mode/Endian from a public path, and an excluded-from-the-workspace native dependency is a poor trade for a step that does not need one yet. The anchor search is pure byte work, so it is pure Rust. No native dependency is added anywhere, and the tool is an ordinary workspace member. Surveyed the rest of that project against our open items: no volume structures, no tie vertex layouts, no SBlk/DAW fields, no wavelet tables. It is a guide to the code, not a replacement for reading it.	2026-10-13 07:07:21 +02:00
ReaperOfVeriod	26a0918178	Gate the PCSX2 claims as tests; two corrections fall out of writing them ... The audit two commits ago listed three claims as "not assertable here -- needs a savestate". With PCSX2 running they are assertable, so they now are. gc-trace already exposed gc_trace::Savestate::ee_ram_owned(); gc-extract just needed it as a dev-dependency. Both tests are gated on GC_SSTATE and skip cleanly without it, so a normal checkout pays nothing. Writing them corrected two claims, which is the main reason they were worth writing as tests rather than staying prose. 1. The collision payload is NOT "byte-for-byte identical". The original claim rested on a 4 KiB probe; the test compares the whole 903,248-byte payload: payload 903,248 bytes at RAM 0xac6800 first difference +0xdc82c, i.e. 903,212 bytes in bytes that differ 6 (0.00%) 903,212 of 903,248 bytes are verbatim and 6 are not, all in the final 36. "Verbatim" was an overclaim on a probe that never looked at the tail. The test now measures the whole payload and reports the extent, asserting only that the divergence is beyond the head. 2. The tfrag relocation base is the TABLE address, not the block base. The delta is 8,683,584 = 0x848040 = block base 0x848000 plus table_offset 0x40 -- which is exactly what TfragHeader::data's own documentation says, "relative to the table". The earlier claim said "the block's RAM base", off by exactly the table offset. Also: +0x10 and +0x38 do NOT share one constant. The aggregate "1,665 fields relocate by one constant" was true only because +0x10 carried it; lumping them hid that. The test asserts +0x10 and REPORTS +0x38's delta rather than assuming. The patch-rewrite figures also restated on aggregate rather than median, which is why they read lower than the 7.80%/8.12% medians recorded earlier: patch bytes rewritten -- cannot morph 1.9% of 334, can morph 2.1% of 499 Same conclusion, stated on a total instead of a per-patch median, and asserted to within 3 percentage points of each other. Net: the audit table in docs/formats/core-data-regions.md now has no "prose only" rows for disc-or-savestate-readable claims.	2026-10-13 06:59:22 +02:00
ReaperOfVeriod	9f938f47de	Assert the tie vertex layout finding in a test, and audit which claims are asserted ... The i16[3] high-byte finding -- the most recent and most subtle result of this stretch, and the one I corrected twice -- lived only in prose. Two commits is exactly how long a claim can sit unasserted before it drifts. It now has a test: tie_vertex_layout_is_selected_by_i16_3_high_byte which reproduces the figures exactly and, importantly, asserts both directions: (4,5) and (6,7) are above 0.85 and 0.80 in the ordinary group, (6,7) is BELOW 0.99 so it cannot silently become the constant I once mistook it for, (0,1) and (2,3) are under 0.20, and every pair in the non-zero group is under 0.15. A future change in either layout now fails loudly. Also audited the rest of this session's claims against the test suite and recorded the result in the format doc: tie vertex element is 16 bytes asserted layout selected by i16[3] HIGH byte asserted (this commit) blocks self-delimiting on 0xf6 asserted per-block packets == 0 means no block at that LOD asserted packets[0] == 256 on 1,864 of 1,864 asserted chunk record length uniform per chunk asserted moby class IDs in one body slot per type asserted collision payload verbatim in RAM NOT assertable here -- needs a savestate tfrag patch bytes all rewritten by LOD same morphing is unobservable in that image same The split is deliberate: disc-readable claims are asserted against the disc, savestate-dependent ones live in plan/pcsx2-verification.md with their method. What is not acceptable is a disc-readable claim living only in prose -- which is how the tie i16[3] finding spent two commits before it had a test, and how several older claims drifted before the roadmap reconciliation caught them.	2026-10-13 06:54:52 +02:00
ReaperOfVeriod	922248a4ec	Tie: the element layout differs by i16[3] high byte, and (6,7) is a real pair ... Two results, one of them a correction. 1. "(6,7) is just the constant 4096/0 pair, not a texcoord" -- wrong. It looked like an artifact because a constant is trivially a pair of multiples of 4096. But partitioned by i16[3]'s high byte it is a genuine fixed-point pair in its own right: i16[3] high byte ZERO (n = 89,341) divisor rate by slot pair pair /1 /4 /16 /256 ( 0, 1) 100.0% 11.5% 4.6% 3.3% baseline ( 2, 3) 100.0% 11.0% 4.5% 3.3% baseline ( 4, 5) 100.0% 92.9% 92.0% 91.8% the texcoords ( 6, 7) 100.0% 89.5% 87.3% 86.5% a SECOND fixed-point pair If (6,7) were a constant it would score 100%, not 89.5%. The constant is the common case WITHIN it, not the whole of it -- which is exactly the distinction the constant-artifact lesson is about, and I applied it backwards last time. So the ordinary element carries TWO fixed-point pairs, (4,5) and (6,7), with (0,1) and (2,3) at baseline. What (6,7)'s role is remains open -- second UV set, normal, or a zero-heavy fixed-point pair all fit. 2. The element LAYOUT differs between the three cases. Scoring all four slot pairs within the non-zero high-byte group, no pair stands out: i16[3] high byte NON-ZERO (n = 6,271) pair /1 /4 /16 /256 ( 0, 1) 100.0% 4.6% 3.5% 0.7% ( 2, 3) 100.0% 2.0% 0.6% 0.0% ( 4, 5) 100.0% 1.9% 0.3% 0.1% ( 6, 7) 100.0% 7.5% 5.7% 4.5% Best is 7.5% against a 2-5% baseline. So for those 6,271 vertices the 16 bytes are not laid out as position/texcoord/normal at all -- a different element shape, selected by the high byte. This also explains why the global slot-pair score looked ambiguous to begin with: pooling the two layouts averages a 92% pair and a 7% pair into one number that describes neither. Fourth time this session that partitioning produced the answer rather than merely bounding it.	2026-10-13 06:53:22 +02:00
ReaperOfVeriod	ed3e85a0f2	Refine the tie texcoord finding: it is i16[3]'s HIGH byte that selects ... The previous commit said i16[3] selects the texcoord encoding. That was right but loose -- it is specifically the HIGH BYTE, and the low byte is a separate thing. Grouped by the high byte across the same 95,612 vertices on levels 0-2: i16[3] high byte n % / 16 % / 256 0x00 89,341 92.0% 91.8% 0x03 5,344 0.0% 0.0% 0x04 71 0.0% 0.0% 0x40 58 5.2% 0.0% 0x02 47 2.1% 2.1% 0x19, 0x05, 0x20, ... the remaining 73 A high byte of zero is the ordinary case -- 89,341 of 95,612, 93.4% -- at 92%. EVERY other high byte scores at or near zero. The split is on the byte, not on the value: i16[3] of 1 and of 771 differ only in the high byte and behave completely differently. Within the all-zero case there is a third distribution: i16[3] == 0 exactly (5,851 vertices) scores 62% at 16 and 61% at 256, against 92% for 1..255. So three cases, selected by the high byte and then the low: high 0x00, low 0x00 5,851 a third distribution, 62% at 1/16 high 0x00, low 1..255 83,490 the ordinary case, 92% at 1/4096 high non-zero 6,271 0%, an encoding this reading does not see The 6,271 matches the figure quoted last commit for "vertices using an encoding this reading does not see", and the two group counts sum consistently with the committed test's 95,612 -- so this refines the finding rather than changing it. A measurement trap worth recording: the all-zero case is a SUBSET of high byte 0x00, so summing the per-high-byte groups double-counts it. An intermediate total came out at 100,792 against the true 94,941 for those groups; the committed test's figure is the one to trust.	2026-10-13 06:50:08 +02:00
ReaperOfVeriod	e27c40e738	Explain the tie texcoord residual: i16[3] selects the encoding ... The texcoords are 12-bit fixed on 82.5% of vertices, not 100%, and the residual had no explanation. Grouped by the vertex's i16[3] slot across 95,612 vertices on levels 0-2, the buckets separate completely: i16[3] n % / 4096 % / 256 negative 333 1.2% 1.2% == 0 5,851 29.2% 60.7% 1..63 28,884 92.7% 94.3% 64..255 54,606 92.3% 93.8% 256..511 8 0.0% 0.0% 512..1023 5,391 0.0% 0.0% >= 1024 539 0.2% 0.2% The residual is fully accounted for. 87.3% of vertices sit in 1..255 at about 92.5% fixedness, contributing 0.873 * 0.925 = 80.8 points; the 5,851 at i16[3] == 0 contribute 1.8 more. That is the 82.5% measured, to the point. The remaining ~6% are not 12-bit fixed at all. i16[3] >= 256, and negatives, score 0% at BOTH 4096 and 256 -- 6,271 vertices in an encoding this reading does not see. And i16[3] == 0 scores 29.2% at 4096 but 60.7% at 256, which is a third distribution rather than a weaker version of the same one. What this establishes: i16[3] is a per-vertex packed attribute whose value SELECTS HOW the texcoord pair is stored, rather than an independent field sitting beside the texcoords. 1-255 is the ordinary case, 0 is special, 256-and-up and negatives are a different encoding. What those three cases MEAN is still open -- texture index, normal index, flag or a combination -- but it is now a field whose role is known, which is more than "packed word". Worth noting the shape of the claim this replaces: "the texcoords are 12-bit fixed at i16[4]/i16[5], 73.6% of the time, unexplained". The field position was right; the 73.6% was a population average over three encodings. Partitioning by the one variable that separates them turns a mystery into a lookup -- rule 3a again, and the third time this session that partitioning a mystery produced the answer rather than merely bounding it.	2026-10-13 05:19:06 +02:00
ReaperOfVeriod	3ee0b3d0dc	Disprove that morphing causes the tfrag byte changes: LOD selection does ... Read the whole tfrags block from RAM -- 4,379,200 bytes at 0x848000 -- and compared every one of the 833 patches against its disc copy, grouped by whether it CAN morph: patches with NO morphing entries 334 differing: max 10.59%, median 7.80% patches WITH morphing entries 499 differing: max 10.49%, median 8.12% patches 100% identical to disc 0/334 and 0/499 The two groups are indistinguishable. Morphing is NOT what changes the bytes, and this disproofs the claim two commits ago that the 8.6% was "morphed positions with topology and UVs left verbatim". If it were, the 334 patches with no morphing entries would be untouched -- and none of them is. Nor is it a pointer relocation: the differing bytes fall in short structured runs (257-263, 272-277, 305 on patch 0) whose u32 deltas share no common value. The explanation consistent with everything measured is that the loader REGENERATES each patch's VU packet stream for the LOD tier it selected. That happens to every patch, morphing or not -- and it is why morphing shows no signal. This also settles the verification route, which the previous commit left as "needs the camera distance at the savestate". It does not, and no camera distance would help: this memory image shows the LOD-selected form rather than the morph state, so there is nothing in it to solve a weight against. Verifying the derivation needs a captured frame at a known view distance instead. What is established now, all measured on the full population rather than inferred from one patch: - data and cube_ofs are relocated pointers, delta 0x848000, on all 833 records - every patch's bytes are rewritten, ~8%, by LOD-driven packet regeneration - morphing is not observable in this memory image - 833 of 833 patches parse; 499 of 833 have morphing entries; 43,613 vertex-info entries across the level	2026-10-13 05:14:40 +02:00
ReaperOfVeriod	aff977e8c5	Correct the tfrag pointer-field claim, and show morphing regenerates VU packets ... Two corrections to the previous commit, both from continuing the RAM comparison. 1. The previous commit said the RAM comparison "names two fields the disc-side work had left as data and an unnamed word". It does not. +0x10 is TfragHeader::data and +0x38 is TfragHeader::cube_ofs, both already named in the struct. What RAM adds is that both are POINTERS -- relocated by adding the block's RAM base -- rather than plain offsets. That is still worth knowing, but it is not a naming. 2. The previous commit attributed the 8.6% of rewritten bytes to "morphed positions with topology and UVs left verbatim". That is wrong, and patch 1 shows why. Comparing 4 KiB, disc 0xdf60 against RAM 0x855f60: bytes differing 354 of 4,096 = 8.6% contiguous runs 120 longest run 8 bytes extent +0xc1 through the end of the window Patch 1 has 83 positions and 83 vertex-info entries, of which 13 morph. If morphing rewrote position fields alone, the differing bytes would be a 13/83 slice of a 498-byte position array -- a couple of dozen bytes in one contiguous region. Instead 354 bytes differ, spread over 120 short runs across the whole window. So the loader is not patching positions in place: it REGENERATES the VU packet stream for the current morph state. That is what morphing is on this hardware -- VU1 GIF packets, not a CPU-side vertex array. Consequence for verification, and the reason this is worth committing rather than just noting: the plan of "map RAM vertices to disc indices and solve for the weight" does not work against this memory image. The positions are inside regenerated packets, so there is no stable per-vertex correspondence to read a weight out of. Verifying the morph weight against the original needs the CAMERA DISTANCE at the savestate, so the weight can be computed from the derivation and compared with the rendered result, rather than read back out of RAM. Population figures gathered on the way: 833 of 833 patches parse, carrying 43,613 vertex-info entries; 499 of 833 patches have at least one morphing entry, and patch 0 -- the first record -- is base-only with none. Also fixed a measurement error mid-run: I compared patch 1 at disc 0xdf60 against RAM 0x855f00, off by 0x60, and got "every byte differs". The corrected base is 0x855f60.	2026-10-13 05:08:08 +02:00
ReaperOfVeriod	93591a79de	Verify the tfrag record framing against RAM: two pointer fields, morphed vertices ... The tfrags block header -- table_offset 0x40, tfrag_count 833, lod_distance 32.0 -- hits once in the level-0 savestate at RAM 0x848000, so disc offset 0 maps to RAM 0x848000 and the block can be compared position for position. Result 1: exactly two fields per record are rewritten. Comparing all 833 64-byte table records field by field: records compared 833 u32 fields differing 1,665 = 833 x 2, and no others their offsets +0x10 and +0x38, on every record relocation delta 8,683,584 = 0x848000, on 833 of them So +0x10 and +0x38 are block-relative pointers and the loader adds the block's RAM base to each. Every other byte of all 833 records is verbatim. Six fields differ by 0xF80000 and 0x1F00000 instead -- three records pointing into a different buffer, recorded rather than averaged. This names two fields the disc-side work had left as `data` and an unnamed word. Result 2: behind the pointers, about 8.6% of bytes are rewritten. Following record 0's +0x10 to disc 0xd040 / RAM 0x855040 and comparing 16 KiB: 14,977 bytes identical, 1,407 differ = 8.6%. The differences spread across many field positions rather than concentrating, which is what morphed POSITIONS look like -- topology, UVs, counts and command lists stay verbatim while a fraction of the position bytes move. 8.6% is about half of a 16-byte vertex's six position bytes, consistent with roughly half the vertices in this patch mid-morph at the saved camera distance. Not established: that the morphed bytes match resolve_vertex's formula. That needs mapping RAM vertices to disc vertex indices and solving for the weight, which is the next step -- but the framing is now known well enough to attempt it, and the two pointer fields are confirmed rather than inferred. This also answers the "is morphing real?" question that made the earlier tfrags probe fail to match RAM: the tfrags block is not verbatim in RAM, because both its table pointers are relocated and its vertex positions are morphed.	2026-10-13 05:04:25 +02:00
ReaperOfVeriod	6d0c1b6fd1	Close out tfrag on the disc side, and fix two stale "not recovered" claims ... Picked tfrag morph targets from the open list and found the premise was wrong. There are no morph targets in this format. Morphing is a blend toward the midpoint of the vertex's two PARENT vertices -- g[parent1_position] and g[parent2_position] -- which are other vertices in the same tfrag. The engine implements exactly that in resolve_vertex, and it is covered by morphing_blends_toward_the_parent_midpoint plus morph_weight_runs_from_zero_to_one_across_its_band and collapse_distances_are_the_far_edge_of_each_band. So "morph targets unrecovered" was never a gap; it named a thing that does not exist in the format. Strip bookkeeping is likewise already there: TfragStrip carries vertex_count_and_flag, and tfrag_triangles walks the strip command lists and index arrays to build triangles. That was the other half of the same roadmap entry. Coverage, all passing: 36 tfrag tests, 9 texture tests, 23 gc-engine tests. The real-disc texture test decodes all 1595 level textures, with pixels and mip levels, so the module doc's "not yet recovered: the texel data the texture table points into" is also stale. Two stale claims corrected: 1. crates/gc-formats/src/tfrag.rs said "Not yet recovered: the LOD switch and morph rules in TfragProc, and the texel data the texture table points into. See docs/plan/tfrag.md." The rules are recovered and tested, the texels are decoded, and docs/plan/tfrag.md DOES NOT EXIST -- a dangling reference to a file that was never written. 2. docs/roadmap.md marked tfrag partial with "Still open: morph targets and the strip/chain bookkeeping". Neither is open. The honest replacement for both is what is genuinely not claimed: the LOD switch distances, morph weight and collapse edge are DERIVED from the data -- tiers are classified from the four V4_8 parent arrays, the weight runs zero to one across each tier's band -- but have not been checked against PCSX2 the way the lighting pass was. That is a verification gap, not a parsing gap, and it needs a frame captured at a known view distance rather than more disc-side measurement.	2026-10-13 04:50:28 +02:00
ReaperOfVeriod	d56b439502	Exclude the collision segmentation theories on the full population, and name the ... unblock Continuing on the verbatim payload with the grid known. Cells are not zero-separated. Counting maximal runs of non-zero u16 across the whole payload: level 0 363 cells 15,115 runs mean run 25.3 u16 level 1 384 cells 24,647 runs mean run 51.5 u16 level 2 53 cells 31,512 runs mean run 30.3 u16 Two to three orders of magnitude apart, so a zero run is not a cell boundary. Cells are not uniform blocks either: level 0 averages 2,488 bytes per cell and level 2 averages 43,684, which cannot both be one fixed-size record. The run lengths are not records. Their histogram has a long tail of near-power-of-two values -- 2,140, 1,184, 840, 816, 628, 604, 562 -- which is what you get when a run is bounded by a single zero byte inside otherwise dense data, not by a delimiter. With the 18%-zeros finding, the payload reads as dense data with sparse holes rather than a delimited sequence. So all three segmentation theories are now excluded on the full population rather than on a sample: not ascending u32 tables, not zero-run delimiters, not fixed stride. What would actually unblock this: overlay.bin IS the game's own code, and the collision parser is in it. Camera_CollPrimTest WARNING! - grid out of bounds! (RAR) was located in the debug string pool earlier, and that string is inside the collision routine. So the format is recoverable -- but not by measuring bytes. It needs disassembly of that routine, or an R&C2 reference for the collision cell record. Stating that plainly is worth more than another scan. The disc-side measurement space for collision is exhausted: the bytes are available, verbatim, the grid is known, and three independent segmentation theories have failed on the whole population. Further probing without the loader's own logic will not converge.	2026-10-13 04:46:10 +02:00
ReaperOfVeriod	338af9b7bd	Fix the collision grid dims, and disprove two sample artifacts in the payload ... With the payload confirmed verbatim in RAM, the disc bytes can be read directly. The grid dimensions are the first two u16 of the payload: level 0 is 11 x 33 = 363 cells, level 1 24 x 16 = 384, level 2 1 x 53 = 53. Level 2 being one cell wide is worth noting -- the grids are not all similar in shape. Two readings disproved, both by measuring the whole payload instead of a sample. An ascending u32 offset table. A probe from payload +1024 reads f4ae0000 40af0000 c4b2000020b20000, which is three ascending values before the fourth goes down (0xb2c4 to 0xb220). Read as a table, that was a three-value impression. Scanning all three levels for maximal ascending u32 runs of 8 or more entries finds zero, on every level. A global alternating-zero stride. The head of level 0 shows an obvious (value, 0) pattern from about i16[37]: [32..] [1808, 1872, 2198, 0, 34, 86, 25848, 1, 25824, 1, -13028, 0, -12284, 0, -12228, 0, -12716, 0, ...] Measured over the whole payload, both alignments score far below what that sample suggests: even-slot aligned 18% second-half zero, odd-slot aligned 13%. The sample again. What the global numbers do say is that the payload is heavily zero-bearing -- 18% against a chance rate of about 0.0015% -- which is what a sparse or variable-length encoding looks like, and consistent with the variable-length reading established earlier. The 18-against-13 split is a real alignment preference but a weak one. The cell layout is still undecoded. The useful position now is that the bytes can be read as they are and that they are sparse and variable-length rather than fixed-stride, so the next attempt should look for a terminator-delimited walk through the sparse region rather than for a record size.	2026-10-13 04:44:09 +02:00
ReaperOfVeriod	d5e637930b	Show the collision payload is verbatim in RAM, and retract the "not in RAM" claim ... This overturns the premise collision work was blocked on. Searching the level-0 savestate for a probe from collision payload +1024 hits at 0xac6c00; a probe from +64 hits at 0xac6840. The difference is 0x3C0 = 960, which is exactly 1024 - 64, so the payload sits at a fixed relative address -- RAM 0xac6800 for the disc address 0x27e800 -- and reading it back is byte-for-byte the disc's own bytes: RAM 0xac6800 0b 00 21 00 b6 08 ad 08 a4 08 6b 08 38 08 63 07 disc 0x27e800 0b 00 21 00 b6 08 ad 08 a4 08 6b 08 38 08 63 07 Nothing is reshaped. That is the opposite of the tie block, where the loader relocates a pointer inside each record. The retraction. The previous note reads: "level 1's 24 x 16 grid dimensions appear in memory, level 0's 11 x 33 appear nowhere, so disc-side decoding has to work against the reshaped form." Level 0's dimensions ARE in RAM, at 0xac6800 -- 0b 00 and 21 00 are the first two bytes of the block, 11 and 33. The search that missed them looked for 0b 00 00 00 21 00 00 00, the dimensions as a pair of u32s. They are stored as two u16s, so that pattern never occurs. So the negative result was an artifact of the search pattern, not evidence about the data -- and it was then used as a premise for several rounds of disc-side work. Both lessons were already written down in AGENTS.md and both were re-learned: a negative from a byte search bounds the search, not the format; and the control here is one command -- read the predicted RAM address and compare it to the disc -- which would have shown the verbatim copy immediately. Also recorded while mapping it: the payload contains ascending u32 offset tables from +1024 onward, and its first two bytes are the grid dimensions, so level 0's grid is 11 x 33. The cell layout itself is still undecoded, but the blocker is gone: disc-side decoding no longer has to work against a reshaped form.	2026-10-13 04:40:01 +02:00
ReaperOfVeriod	180fc27b04	Locate the tie texcoord field at i16[4]/i16[5], and rule out the (6,7) artifact ... Scoring each adjacent i16 slot pair of the 16-byte tie vertex for 12-bit fixedness over 36,501 level-0 vertices locates the fields: (i16[0], i16[1]) 1.1% not a texcoord (i16[2], i16[3]) 4.8% not a texcoord (i16[4], i16[5]) 73.6% <- the texcoords (i16[6], i16[7]) 76.6% <- the near-constant 4096/0 pair (6,7) scores HIGHER and is not a texcoord. It is the near-constant 4096, 0 pair: 4096 is 1.0 in 12-bit fixed and 0 is zero, so both are trivially multiples of 4096. That is the constant artifact again -- a fixed pair would score 100% anywhere. The field is (4,5), with (0,1) and (2,3) ruled out at 1.1% and 4.8%. The first four slots span the full i16 range with 10,803 to 13,421 distinct values each, so they are neither texcoords nor small fields. The vertex base is confirmed to be vert_ofs alone. Adding the shader or control region makes it worse -- vert_ofs only 73.6% bfc + vert_ofs 69.8% bfc + control_count*control_size + vert_ofs 66.7% -- so the 73.6% residual is not a mislocated base. Worth recording because vert_ofs (3..7) numerically overlaps the shader region (5*shader_count, 5..20 quadwords), which made a combined base look plausible; measurement says the simple one is right. The test asserts (4,5) above 60% and (0,1)/(2,3) below 5%/15%, and names the (6,7) artifact in its failure message so the higher-scoring pair cannot be mistaken for the answer later.	2026-10-13 04:30:45 +02:00
ReaperOfVeriod	35b087c882	Establish the tie vertex element is 16 bytes, and correct the roadmap's tie entry ... With TieRecord identified as RAC1's TiePacketHeader, each record's leading word points at its packet in the block payload. Following it and stepping vert_size elements from vert_ofs reaches the vertices: 95,612 of them on levels 0-2. Element size settled by comparison, not assumed. Requiring the texcoord pair to be 12-bit fixed -- both words multiples of 4096, which is how 0x1000 = 1.0 reads: element 16 bytes : 78,919 / 95,612 = 82.5% element 8 bytes : 45,661 / 95,612 = 47.8% element 12 bytes : 44,834 / 95,612 = 44.8% Sixteen wins by a factor of 1.7 over the nearest alternative. Observed layout, 8 x i16: the first three slots span the full i16 range with 10,803-13,421 distinct values each; i16[4] and [5] are the texcoords and are both multiples of 4096 on 82.5%; i16[6] reads 4096 on 85.8% and i16[7] reads 0 on 84.0%. Not established: what any field means, and why the texcoord rate is 82.5% rather than 100%. The residual tracks record shape -- (shaders 2, control 7, size 2) hits 60%, (shaders 1, control 18, size 5) hits 89% -- so it is not one bad block but something per-packet this reading does not capture. Worth recording that this is the OPPOSITE of what the disc alone concluded two commits ago. Reading the header word at +0x00 as an element count gave 0 of 922 blocks dividing; it is the byte offset to the payload, so the table it bounds has 16-byte records. The number was right and the reading was wrong, which is what the packet-header identification corrected. The roadmap's tie entry was also stale -- it still said "a 16-byte record is withdrawn", which the packet-header work had already reversed. Rewritten from the commits: both indirections, self-delimiting blocks, the TiePacketHeader identification with its 15,219/15,219 rule, the 16-byte vertex element, and what remains open. A test asserts the element size against both alternatives so the 82.5% figure cannot be quietly replaced by an assumption.	2026-10-13 04:27:54 +02:00
ReaperOfVeriod	54862b64ee	Identify the tie record as RAC1's TiePacketHeader, and retract a formula ... The 16-byte tie record is R&C1's TiePacketHeader offset for offset: a data pointer at +0, then R&C1's byte fields at +4 through +0x10. The identification is not a resemblance but R&C1's own rule -- bfc_distance == 5 * shader_count -- holding on all 15,219 records of all 2,177 blocks on all 27 levels. Measured over the same set, and reported rather than asserted where it is not universal: bfc_distance == 5 * shader_count 15219 / 15219 vert_ofs <= vert_size all scissor_size <= scissor_ofs all control_size <= control_count all color_ofs == vert_size 12640 / 15219 color_ofs == vert_ofs + vert_size 0 / 15219 color_count, strip_count, strip_vertex_count zero 15089 / 15077 / 15078 R&C1's rule for the colour offset holding on none of them is the interesting line: the two games use that field differently, so it is named color_ofs for what this game's majority reads as and the 2,579 exceptions are counted rather than averaged away. TieRecord parses all twelve fields, invariants_hold asserts only the universal four, and the disc test counts the rest. A packet-length formula is withdrawn rather than softened. (vert_ofs + vert_size + scissor_ofs + scissor_size) * 16 was measured at 61 of 61 pairs and is not reproduced on the correct blocks -- 0 of 13,042. The block set was the error, not the arithmetic: the script that produced the 61 read packets[2] where packets[1] was meant, so it measured 461 blocks instead of the 2,177 the class tables define, and the formula agreed perfectly with a population that was not the tie blocks. TieRecord::packet_bytes goes with it, and the retraction is recorded in the format doc and in the struct. That misread also explains why the earlier RAM verification saw different numbers for the two inputs -- same lesson as rule 3, arriving through a wrong subscript instead of a wrong span.	2026-10-13 04:22:38 +02:00
ReaperOfVeriod	4e90c282ad	Make the tie record relocation a command, and verify it on two levels ... The relocation rule from the previous commit was established by a script that lived in a shell history, which means the next person would have had to rediscover it. It is now `gc-trace verify-tie-records <unpacked-dir> <level> <class> <lod> <src>`: resolve the class, parse the block, search the RAM image for the loaded record table, report what it found, and exit 0 only when every record's pointer has become table + word and every field byte is verbatim. Swept over every (class, lod) slot of two levels, from PCSX2 savestates: level 0: 87 slots with a block, 87 verified, 0 mismatched, 61 absent level 1: 104 slots with a block, 104 verified, 0 mismatched, 78 absent So the rule holds on every LOD block of two levels the game had loaded, which is what makes the record layout a finding rather than a reading of one block. Writing the command also caught an off-by-one in the parser it exercises: TieBlockHeader::records started its slice after the 16-byte header, but the header IS the first record -- the table runs from the block start to data_offset, and a block with data_offset 0x50 holds five records, the first being the header itself and its pointer naming where the payload begins. Found because the tool's first run relocated nothing while the same check in a script had passed; the unit test fixture was wrong in the same way and is fixed. Two operational notes now in the format doc: the live emulator is not a stable input (verifying level 1 over PINE matched 104 of 104 while the user was on that planet, and the same command minutes later found no matching copy because they had returned to level 0 -- a miss there is not a counterexample, so the report says "no copy matched" rather than "failed"), and a class index past the table count is an error rather than a mismatch, so a sweep should stop at the level's class count rather than a round number.	2026-10-12 15:24:48 +02:00
ReaperOfVeriod	e6eecb871f	Decode the tie LOD block: it is a table of 16-byte records ... The tie block's word at +0x00 was read as an element count, and the reading failed in a way worth recording: the payload length divided by it is a whole number on 0 of 922 blocks, at any record size and any header up to 512 bytes. That is the correct measurement of the wrong hypothesis -- the word never described the payload. Range measured: every LOD block of level 1 whose word is a non-zero multiple of 16, plus the two read by hand in full. Method: locate each block's record table in PCSX2's RAM by its twelve field bytes, which are the only distinctive 12-byte run in a block, then compare every record against its disc copy. Each block has several copies in RAM, and the one that matches is the loaded one -- checking the first hit is what made the first attempt report 0 of 16. Result: on 16 of 16 blocks, every record's leading word has become table_address + word, and the other twelve bytes are byte-identical to the disc. So a block is [16-byte header][record table][vertex payload], the records are 16 bytes -- a leading u32 pointer plus twelve bytes of fields -- and the header's word at +0x00 is the byte offset from the block start to the payload, that is, the length of the table. That is what the multiple-of-16 was: the table holds 16-byte records. It is never zero because there is always at least the first record, and its 42 distinct values are table lengths. Each record's pointer is relative to the table start, relocated at load to table + word. TieBlockHeader::data_offset and TieBlockHeader::records carry it, bound by the offset, with TieRecord for the twelve field bytes, and the disc test asserts the table is bounded on every block. What the records' fields name and what the payload holds are still open -- the payload is known to be variable-length, float-shaped, not LZ77 and not VIF1.	2026-10-12 07:17:41 +02:00
ReaperOfVeriod	c2af0528e3	Correct the chunk loader finding and decode a record field ... The loader note said every record gains a 02 00 prefix in RAM. It does not: the word is the record's own leading field, already on the disc at every record. What the loader changes is the pointer -- it addresses the word, two bytes earlier than the disc's table -- and that pointer shift is what made the bytes look inserted. Measured, in order: - the two bytes before a payload are identical in core_data and in RAM, record for record: 02 00 on level 0's 90-record chunk at 0x100b302, 08 00 on the level's first chunk. Nothing is inserted; - the RAM table's low 24 bits are the payload's minus 2, consistently, so the record is [leading u16][two index bytes][payload] and the loaded table addresses the leading word. That is also why the index bytes read as +2 from the pointer -- the same +2 the earlier RAM result quotes; - the word is a field, not a pad: uniform across a chunk's records on 1,439 of 1,509 chunks (None on the 70 that vary, reported rather than averaged), fixed within all 71 chunk types, and only ever 1, 2, 4, 6, 8 or 10 -- 554 chunks carry 2, 520 carry 4. Two readings of the value were measured and disproved, so they are recorded as disproved rather than left as candidates: it is not an entry count (the payload divided by it leaves 57 distinct fractional "sizes", and 162 chunks do not divide at all), and it is not the number of distinct leading bytes (agrees on 0 of 1,506 chunks). Chunk gains `prefix: Option<u16>`, and the disc test asserts the uniformity, the per-type fixity and the value set. The scratch example that produced the per-type class-ID table is dropped now that the same scan is a committed test, which also lands here: moby class IDs sit in one body slot per chunk type, with the slot varying by type and the distinct >= 4 filter load-bearing -- without it the top slots are constants that read as 305x because any value below the moby count counts as a hit.	2026-10-12 06:00:29 +02:00
ReaperOfVeriod	8147110377	Bring the roadmap's chunk section up to date ... Four commits of chunk work -- uniform record length, the leading-byte phase counter, the two-byte record index, and the PCSX2 RAM findings -- were written to docs/formats/core-data-regions.md and docs/plan/pcsx2-verification.md but never reached the roadmap, because the scripted replacements kept missing their target text and I did not check that they had applied. That is the staleness complained about earlier recurring through a different route: not a missing edit, but a silently-failed one. The tie, collision and level_overlay entries had landed; only the chunk ones had not. Rewritten from the commits rather than from memory, and the numbers are the ones the tests assert: 1,509 chunks, 34,491 records, uniform length 1,509/1,509, phase counter 1,262/1,509, index rule 1,235/1,509, RAM prefix 02 00 on 90/90.	2026-10-12 04:32:43 +02:00
ReaperOfVeriod	2c4bbdc600	Use PCSX2 RAM to recover the chunk loader's transformation ... This is what RAM was needed for: nothing about the loader's transformation is recoverable from the disc. Anchor: a 32-byte probe from inside a chunk record in level 0's core_data, searched in the level-0 savestate. It hits at 0x18538a8 and the record's first bytes at 0x185387e -- exactly chunk_base + record_offset, no rescaling. So the chunk payload is copied VERBATIM; unlike collision and the shrub packet tables it is not expanded or repacked. Result 1: the offset table is rewritten to absolute EE addresses. disc: f000057c f00006b0 f00007e4 f0000914 RAM: 0xf185387c 0xf18539b0 0xf1853ae4 0xf1853c14 The 0xf0000000|low24 tag becomes 0xf1850000|low24 -- tag replaced by the chunk's load base, low 24 bits untouched. Consecutive deltas agree exactly (0x134, 0x134, 0x130), which is why the disc-side stride is approximate rather than constant. Result 2: every record gains a constant 2-byte prefix 02 00, and the rewritten table points at THAT rather than at the record data. Walking all 90 records from the RAM dump: prefix 02 00 on 90 of 90; the disc's index bytes preserved unchanged at +2/+3 on 90 of 90. Result 3, the useful one: the byte at +2 takes exactly 0, 16, 32, ... 240 -- the 16 values index_rule predicts for step = 16, phase = 0. The mixed-radix record index derived from the disc is corroborated on the running game's own copy of the chunk. That is a disc-derived claim validated against the game, which is the strongest form of check available here. On disc a chunk is [16-byte header][10 zero bytes][tagged offset table][records]. In RAM it is [16-byte header][10 zero bytes][absolute-pointer table][records each prefixed with 02 00]. The 02 00 is unexplained -- possibly a record type or an alignment the loader needs -- but it is constant, so like the two index bytes it carries no per-record information.	2026-10-12 04:32:07 +02:00
ReaperOfVeriod	e2b12a2e52	Rule out a count field in chunk record bodies; correct a six-record impression ... With the record framing settled (leading two bytes = record index), the body is bytes 2..len. Four probes, mostly negative, recorded so the next attempt does not repeat them. No count field. For every chunk type, every u16 and u32 position in the first 64 body bytes, at element strides 1,2,3,4,6,8,12,16: does the stored value equal (record_len - offset) / stride on 90%+ of records? No type produced a hit. The record does not carry an element count near its head. The body is dense, not float-dominated. For the largest type (2430 records, 326-byte bodies): f32 reads within +/-5000 of origin 74%, uniform-random control 49%, zero-byte fraction 13%. Above baseline but far short of the tie blocks (53-64% against 16%, with 43% zero bytes). There is an index-like region near the tail. In the largest type, 12 of 163 u16 slots have a maximum below 0x1000 -- too small for float or half-float, so those look like indices or small counts -- clustered at slots 111-121 and 130-131. A sample-size correction. Dumping six records of one chunk showed slots 112-119 zero on every record plus a long run of other constants, which reads as "the record is mostly a per-chunk template". Measured across the 1,171 chunks with at least 8 records: 15,422 of 164,390 u16 slots are constant across their chunk, 9.4%, and 0 of 1,171 chunks are entirely constant. So 9.4%, and no chunk is a template. Six records looked like a majority because that chunk's tail carries shared constants. Per type the figure ranges from 9.4% overall to 55.6% on one type, so it is reported per type as well as pooled -- the pooled figure alone would hide that spread, which is the same trap rule 3a describes.	2026-10-12 04:27:54 +02:00
ReaperOfVeriod	28680b4be3	Show the first two chunk-record bytes encode the record's own index ... Continuing from the phase counter. Within a chunk: i : 0 1 2 3 4 5 6 7 8 9 10 11 ... 15 16 17 ... byte0: 0 16 32 48 64 80 96 112 128 144 160 176 ... 240 0 16 32 byte1: 0 0 0 0 0 0 0 0 0 0 0 0 ... 0 1 1 1 byte0 is step*(j mod g) and byte1 is (j / g), where g = 256/step and j = index + phase. The pair is the record's index in mixed radix: byte0 carries the low digits scaled by step, byte1 the quotient. Measured over all 27 levels: 1,235 of 1,509 chunks fit this on both bytes. Byte 0 alone fits 1,262, so the 27-chunk difference are chunks whose first byte follows the rule and whose second does not. On 1,235 chunks a record knows its own position and the two leading bytes hold no per-record information. ResolvedChunk::index_rule returns the (step, phase) only when the whole chunk fits on BOTH bytes, so the 274 that do not stay distinguishable and nothing skips a leading byte on a rule that does not apply to it. A number that moved when the implementation changed: a first probe reported 1,181; the committed method reports 1,235. The method is right. The probe accumulated ok0/ok1 flags across candidate phases with an early-exit that could skip a phase which would have matched both bytes, and it also disagreed with bucket_rule on the byte-0 count (1,208 against 1,262), which is what gave it away. Recorded because both numbers came from the same run and only the discrepancy exposed the probe as wrong. The lesson is narrow: when a one-off probe and a committed helper disagree, check the probe first.	2026-10-12 04:25:44 +02:00
ReaperOfVeriod	79914c420e	Show the chunk record's leading byte is a per-chunk phase counter; every chunk ... has a uniform record length Follows the alignment result and settles what the leading byte is. Within one chunk the leading byte steps by a constant and wraps: offsets: 1420 1748 2072 2392 2716 3044 3372 3700 4028 4352 ... byte0: 0 16 32 48 64 80 96 112 128 144 ... Sweeping every (step, phase) over all 27 levels: fully explained: 1,262 of 1,509 chunks by step: 8 -> 51 chunks, 16 -> 554, 32 -> 520, 64 -> 137 unexplained: 247 chunks across 11 chunk types So on 1,262 chunks the leading byte carries no per-record information: it is a deterministic function of the record's index and the chunk's phase, which is a position marker rather than data. That is why the earlier "16 discrete values, uniform counts" pattern appeared at all. ResolvedChunk::bucket_rule returns the (step, phase) when the whole chunk fits and None otherwise, so the 247 unexplained chunks stay distinguishable and nothing skips a leading byte on the strength of a rule that does not apply to it. Every chunk has a uniform record length: 1,509 of 1,509. Length varies BETWEEN chunks of a type -- one type runs 76 to 104 bytes -- but never within one. This withdraws the previous commit's "variable-length type", which came from pooling minlen/maxlen across all of a type's records at once. That is the pooled-claim error rule 3a exists to prevent, and it is the third time this session a pooled measurement produced a claim that partitioning reversed. The type is not variable-length; the chunk is fixed-length and different chunks differ.	2026-10-12 04:21:32 +02:00
ReaperOfVeriod	a9bf74fc10	Characterise all 77 chunk types: record byte 0 is a bucket index, not data ... Characterised every chunk type -- 77 of them, 1,509 chunks, 34,491 records, all 27 levels. Byte 0 of every record is a small aligned index, not record content. It takes 16 discrete values per chunk type (0x00, 0x10, ... 0xf0) with near-uniform counts WITHIN each type. Uniform weighting is the tell: a running byte offset would weight the buckets unevenly, because records differ in size. type_id recs len byte0 0x007d7ec438 2430 328 0x00:162 0x10:162 0x20:162 ... 0xf0:135 0x00429ec43d 2079 368 0x00:162 0x10:135 0x20:135 ... 0xf0:108 0x00d76cc453 810 108 0x00:27 0x08:27 0x10:27 ... 0xe8:27 <- steps by 8 The alignment step is per type, not global. The leading byte is a multiple of 8 on 34,432 of 34,491 records but a multiple of 16 on only 33,349 -- the 1,142-record difference falls in seven types, four of which step by 8. 59 records in three types break even the 8-byte rule, and that is where the variable-length type lives: 0x00f2ef4275, records 76 to 104 bytes, no single stride to align to. What the bucket indexes is NOT named. It is reported as CHUNK_RECORD_ALIGNMENT and record_is_aligned rather than as a parsed field, because naming it would be a guess while the invariant is solid. The test pins the exact exception set -- 59 records across 3 types -- so a change there fails loudly. A measurement I initially got wrong: the first version of the constant claimed a 16-byte multiple on 34,432 records. 34,432 is the multiple-of-8 count; the multiple-of-16 count is 33,349. Right number, wrong label, and the test caught it. That is the second time this session a correct number carried a wrong label, after the tie four-value retraction. Both times the assertion did, which is the argument for putting these numbers in tests rather than only in prose. Still open: what the bucket indexes, and the remaining record fields.	2026-10-12 04:18:55 +02:00
ReaperOfVeriod	291153a0d9	Find the tie LOD block terminator; packets == 0 means no block at that LOD ... parse_tie_block walks to a 0xf6 terminator that every real block carries, on 2177 of 2177 across all 27 levels, followed by zero padding. This is what makes the blocks parseable: packets[1] bounds one on only 461 of 1864 classes, so the terminator is the only general way to find one. The terminator was worth a control, because 0xf6 could have been byte-frequency coincidence. It occurs in payloads at 0.83x the uniform rate -- slightly LESS often than chance -- while the last non-zero byte is 0xf6 on 909 of 922 blocks in the first subset, against 17 of 922 for the same blocks cut at a random point. So it is a terminator, not a common byte. packets == 0 means the class has NO block at that LOD: of 3,728 (class, LOD) slots, 2177 point at a block and 1551 are exactly zero. Corrected header, over all 2177: +0x00 count multiple of 16 on all; 42 distinct; never zero +0x02 zero on all +0x04 exactly four values: 0x501 (1069), 0xa02 (720), 0xf03 (350), 0x1404 (38) +0x06 16 distinct, never zero +0x08 180 distinct, never zero +0x0a 61 distinct, never zero +0x0c 125 distinct, never zero, clustered 0x043f..0x0443 +0x0e 11 distinct, zero on 2162 -- the only non-universal field +0x0c clusters around 1087-1091, close enough to a block length to be worth stating, but it is NOT the length: the difference against the true payload length scatters from -12 to -172. A correction to the previous commit. It reported 3,728 blocks all terminating and packed_texture taking 842 distinct values, and on that basis retracted the four-value claim. Both numbers were wrong the same way: the scan did not skip packets == 0, so it computed class_base + 0 and walked forward from the CLASS BODY, finding a terminator there by accident. That contaminated 1551 of the 3728. With the zeros excluded the slot takes exactly four values on all 2177 blocks. The four-value claim was right; my retraction of it was wrong; and the retraction was made on a number from the same contaminated set. A retraction is not automatically better than the claim it retracts -- it needs its own bounds. Still open: the payload's records. Established this round: blocks are self-delimiting, absent LODs are marked by a zero packets word, and the header is fully characterised. Not established: any record boundary inside the payload, which stays variable-length.	2026-10-12 04:13:52 +02:00
ReaperOfVeriod	02342de31b	Decode the tie LOD block header; establish the payload is variable-length ... TieBlockHeader parses the block's own 16 bytes, measured over the 922 blocks where "the next packets offset ends this block" holds, across all 27 levels. A real-disc test asserts every figure. +0x00 count multiple of 16 on 922/922; 16..2096; 72 distinct disc-wide +0x02 zero on 922/922 +0x04 ONE OF FOUR VALUES DISC-WIDE: 0x501, 0xa02, 0xf03, 0x1404 +0x06 15 distinct, 0x0206..0x0512 +0x08 135 distinct, 0x0b05..0x4ee4 +0x0a 45 distinct +0x0c 94 distinct, 0x010e..0x0553 +0x0e zero on 914/922 +0x04 is packed rather than a magnitude: four values across the whole disc with the two bytes moving independently, low 1-4 and high 5/10/15/20 in lockstep. That it is a texture index paired with a scale is a guess; that it is two fields is not. The count is not a record count -- block_size minus the header is divisible by it on 0 of 922, for any record size and any header up to 512 bytes. On the payload, a control was needed and changed the answer. Reading blocks as 3 x f32 triples, 53-64% of reads land within +/-5000 of origin, against 16% for a uniform-random control of identical length. So the content is float-shaped and genuinely not random. But the rate is flat across every start offset and every stride tried, 53-65% throughout. A statistic that cannot separate the right stride from the wrong one cannot identify a stride -- rule 4's exact case. Flatness plus a count that does not tile means the records are variable length. That killed two readings. A VIF1 command walk consumes 0 of 88 blocks exactly, so it is not a VIF1 CPU-format stream. wad::decompress rejects the block at every start offset, so it is not WAD LZ77. Scanning every (start, stride) pair from 0x10 to 0x7f for byte positions with a small distinct-value vocabulary finds none: every position takes all 256 values at every alignment. For float payload that is expected, so the scan found nothing rather than confirming anything -- worth saying, because "no fields found" here is uninformative, not evidence against fields. Still open: what the payload holds. Established: variable-length, float-shaped, non-random, not LZ77, not VIF1. Not established: any record boundary.	2026-10-12 04:09:08 +02:00
ReaperOfVeriod	881fd48e9a	Withdraw the 16-byte tie record claim: block size is a multiple of 16, not records ... The previous commit inferred a 16-byte record from "922 of 922 consecutive block sizes are a multiple of 16". That inference does not hold, and the claim is withdrawn rather than softened. What survives: - Every one of those 922 blocks opens with a u32 that is positive and a multiple of 4, on 922 of 922, ranging 48 to 1744 with 17 distinct values across level 0's LOD0 blocks. The block opens with a count, not a size and not a pointer. - Reading that u32 as a byte size and chaining to the next block lands exactly on the next block start on 0 of 1383 blocks. Not a size chain. - Assuming [header][count][count uniform records] and solving for the record size gives no answer: no record size tiles the block for any header size up to 512 bytes. Not 16, not 12, not 8. - Reading the block as uniform 16-byte units gives fields spanning their entire legal range -- u32@0 from -2139029504 to 2139029587, u16@8 and u16@10 both 0..65535, and 8969 distinct values in i16@0 on level 0. Uniform units would not produce that. So the 16 is a property of the block size, not of a record. The earlier commit also claimed a record size "on the classes where it can be measured"; those classes are still correctly identified, but what they measure is the block size. The strict-increase disproof from two commits ago stands untouched and is what should have prevented this: the word at +0 was already known not to behave, so treating 16-byte units as records contradicted a measurement sitting in the same file. Divisibility is arithmetic; it is not evidence of a record boundary. Roadmap updated to say block sizes are established and the record layout is not, with the three measurements that rule the 16-byte reading out.	2026-10-12 03:56:41 +02:00
ReaperOfVeriod	855e640f39	Establish the 16-byte tie record on measurable classes; packets[0] is a constant ... The previous commit reported "3580 non-empty LOD blocks compute as divisible by 16" and then said the figure should not be trusted, because it came from the "next packets offset ends this block" rule. That rule is unsound: packets is strictly increasing on only 461 of 1864 classes. On the other 1403 the two offsets are unordered and cannot both be block starts into one ascending region. Restricting to the 461 classes where the rule does hold, 922 of 922 consecutive block sizes are a multiple of 16. That is the evidence for a 16-byte record, and it is now scoped to the subset where it can be checked rather than claimed over all 1864. The other 1403 are unmeasured, not measured-and-different. packets[0] is a constant, not an offset: it reads 256 on 1864 of 1864 classes, while packets[1] and packets[2] vary widely and land at different addresses in core_data on every class. Read as a block start, 256 points just past the 0x48-byte header -- which is how it was being used, and exactly how a field gets mistaken for a pointer. It is now TIE_PACKETS0 and nothing depends on it. Still not decoded: what the 16 bytes hold. i16[0] at +4 takes 8969 distinct values on level 0 and is not the two-valued field a 12-unit sample suggested; the word at +0 is not a run offset. The test pins all four numbers -- packets[0] constant, the 922/922 divisibility, the 461/1864 ordering, and the 0/1864 monotonic disproof -- and asserts that the ordering is *not* universal, so a future change there fails loudly instead of quietly invalidating the record size.	2026-10-12 03:50:42 +02:00
ReaperOfVeriod	60e3f129d8	Resolve both tie indirections on all 1,864 classes, and disprove a sample artifact ... resolve_tie_class walks the chain, which is two steps and both are easy to get wrong: 1. The tie class table lives in core_index.bin, not core_data.bin. On level 0 the tables chain as moby at 192, 238 x 32 bytes later tie at 7808, 74 x 32 later shrub at 10176, which closes. Reading the same table out of core_data.bin produces plausible garbage rather than an error. 2. ClassEntry::offset_in_asset_wad addresses core_data.bin, despite the field name and despite core_data.wad sitting alongside it. Verified: all 1864 tie classes resolve, o_class agreeing on every one, and all 5592 LOD block offsets land inside core_data. Disproved, and this is the part worth reading: the word at +0 of a 16-byte unit inside an LOD block. On the first twelve units of level 0's class 0 it rises strictly -- 288, 1520, 2848, 3968, 5088, 6096, 7312, 8528, 9792, 10976, 12016, 13072 -- which reads exactly like a linked list, and the accompanying i16s looked quantised, two distinct values in i16[0] and three in i16[1]. Across the population it is strictly increasing on 0 of 1864 blocks, and i16[0] takes 8969 distinct values on level 0 alone rather than two. The sample was twelve units out of 1,724,334. Both the monotonic reading and the quantisation were artifacts of that sample. That is the pooled-claim error AGENTS.md rule 3a exists to prevent, committed almost verbatim: the first twelve units looked clean, and I was one step from writing "u32[0] is a linked list of runs" into a format spec. The test now asserts the disproof, so it cannot creep back. Not established: the block's record size. 3580 non-empty LOD blocks compute as divisible by 16, but some packets offsets run backwards, so the "next offset delimits this block" end is wrong for them and that figure should not be trusted. The tie layout stays partial: indirections and header done, records not.	2026-10-12 03:47:49 +02:00
ReaperOfVeriod	e5d267a810	Reconcile roadmap.md with the parsers that actually exist ... Findings were going to docs/plan/level-assets.md and docs/formats/*.md while roadmap.md kept listing work as open that has been done for some time. The worst case was occlusion appearing twice: open at one line with "2 to 25 sectors, small enough to read whole", and done further down with 412521 cells over 140939 masks. The open line is deleted. Also corrected: - tfrag was listed flatly open while six tfrag entries beneath it were checked. Now partial: format, topology, textures, LOD, normals and colour are done; morph targets and strip/chain bookkeeping are not. - sky was lumped in with volumes as open. Sky is done -- 149 sub-objects across 27 levels -- so it has its own entry, keeping the word at +0x0c documented as not a count, since it disagrees with the table on most levels and reads 196617 on level 2 against 4 sub-objects. - level_overlay was open. It now has a parser and a 27/27 test, so it is partial rather than done: header, constant block and level data parse, +0x10..+0x1220 is identical on every level, and the word at +0x0c falls below the file length on 17 levels and above on 10. The header words are still unnamed and the Phase 3 seven-section parser is untouched. - sound_bank was flatly open. It is partial: container framing parses and bounds are verified on 27/27, but the SBlk record fields are not decoded and DAW shows no stride, consistent with ADPCM. - tie now records what is actually known, including the two indirection chains that have not been walked: class table entries point into core_data.wad, and the header's packets[0..3] resolve against the lump base. Level 0 has 74 tie, 238 moby and 7 shrub classes. - collision now separates the header, which is decoded, from the cell layout, which is not -- including the 17-entry table at +5932 against a 75-cell grid and the disproved 64-byte RAM stride. - moby_anim records the negative result: per-chunk-type record counts are level-independent, so nothing in the chunk set is keyed by moby class. The "Where we are" section now states plainly what has parsers and that what remains open is naming rather than locating, and names the five types with no decoded fields. Reading that list is how you would have known to ask. Phase 2 remains in progress. Volumes and moby_anim have no located structure and SBlk records, tie vertices and collision cells have located structure without decoded fields.	2026-10-12 03:43:44 +02:00
ReaperOfVeriod	d8b8ccc6d4	Follow the gameplay.bin pointers: they address position and direction arrays ... Where the pointers go. Following them shows what gameplay.bin indexes. The leading table is 39 words, all of which land inside the file, and three clusters dominate: near 150000, near 800000 and near 1050000. The region near 797808 is position data -- 31 consecutive plausible floats that group cleanly into xyz triples: 246.948 201.015 73.867 | 88.240 186.000 302.598 | 107.712 12.723 183.125 353.591 126.365 19.962 | 182.068 374.001 122.567 | 116.961 265.001 437.866 and the region near 797456 is direction data -- unit-length vectors: 0.969 0.945 0.733 | -0.120 0.433 0.250 | -0.866 0.000 0.267 So the file's leading words are a table of pointers into float arrays, not a flat list of small integers. The earlier reading of it as "u32 pointers holding nothing" was too quick: it is a pointer table into data that is present. Volumes remain unlocated. The position arrays are the right shape to bound a volume and nothing yet shows the volume records themselves.	2026-10-12 03:36:55 +02:00
ReaperOfVeriod	b17ec17127	Rule out the moby_anim instance-table reading of the chunk types ... moby_anim was the one post-shrub chunk type with a concrete reason to exist: an instance table would have to scale with the level's moby class count, so comparing per-type record counts against that count was the obvious test. It fails, and the way it fails is itself the result: per-type record counts are level-independent. The same types report the same counts on every level tried: type_id level0 level1 level2 level3 0x007d7ec438 90 90 90 90 0x00d3d8c4a9 90 90 90 90 0x00429ec43d 77 77 77 77 0x0053c8c4aa 77 77 77 77 0x007626c4a4 50 50 50 50 0x00fb88c462 47 47 47 47 Across all 27 levels there are 77 distinct chunk types, the largest at 2430 records total -- exactly 90 x 27. What that rules out: nothing in this chunk set is a per-moby-class instance table, because those counts would vary by level the way the moby class counts do. So whatever holds moby animation data is either keyed by something other than the class count, or it is not among these chunk types. Also visible: the types pair up. 0x007d7ec438 and 0x00d3d8c4a9 both report 90 on every level; 0x00429ec43d and 0x0053c8c4aa both report 77. Two chunk types carrying identical, constant record counts on every level is a signature of two views of the same fixed table rather than two independent tables that happen to agree. Still open: the pairings are described but not explained, and no type has been named. The Moby class-ID enrichment from earlier stands separately -- 9493 hits against 246.1 expected is real, and the class arrays are contiguous per type, but that identifies where classes are referenced, not which chunk is moby_anim.	2026-10-12 03:33:52 +02:00
ReaperOfVeriod	02ced5ee83	Parse the per-level overlay: header, constant block, level data ... level_overlay was the least-characterised file in the level set -- no parser, no located structure. It now has gc_formats::overlay and a real-disc test over all 27 levels: overlay: 27 levels; field_00 1735808, field_08 1; field_04 37540..=45308, field_0c 2763912..=3027336 (17 below the file length, 10 above); +0x10..0x1220 identical on all The header is four words. +0x0c is not the file length: it was recorded as one on the strength of the first levels measured, where it sat near the file end, but across all 27 it falls on both sides -- below on 17, above on 10 -- so it is an ordinary level-specific word. The test asserts this, being the claim most worth pinning. The common prefix is 4 bytes, not the whole header: +0x00 is constant at 1735808 while +0x04 and +0x0c vary. Everything from +0x10 to +0x1220 -- 4624 bytes -- is byte-identical on all 27 levels. Still not named: what any of the four header words means, and how the level-specific tail is structured. The module reports them as fields. Also records in docs/plan/pcsx2-verification.md that the 64-byte RAM stride from the previous commit is disproved. A 415 KB dump of level 1 finds the longest such run at 27 records, not 384, and those are identity matrices -- 27 of them, one per level. It is a per-level transform table, not the collision grid, and the 20.0 reported there was a coincidence.	2026-10-12 03:32:02 +02:00
ReaperOfVeriod	bd012efe71	Find a 64-byte collision record stride in RAM, and record a savestate search pitfall ... Searching the savestates for the collision grid dimensions as a u32 pair -- level 0's 11 x 33 and level 1's 24 x 16 -- puts level 1's at several RAM addresses and level 0's nowhere. So the grid dimensions are not held in RAM as adjacent u32s, and the collision payload is reshaped on load, as the shrub packet tables are. A nearby region of level 1's RAM does show structure. At 0x12e048c and 0x12e04cc, 64 bytes apart: 28 01 00 00 | 92 ff 00 00 | 04 00 a0 41 | ... 296 -110 20.0f Searching for that shared 12-byte tag finds a consecutive run at a 64-byte stride in slot 2: 0x12df390 0x12df3d0 +0x40 0x12df410 +0x40 plus scattered singles elsewhere. Slot 1 has the tag at four addresses not on a 64-byte stride, so the two levels lay it out differently. What this is: a 64-byte record carrying two small signed values and a float reading exactly 20.0 -- the shape of a per-cell entry with coordinates and a radius or half-extent, which is what the collision grid would hold. What this is not: it is not decoded. Three consecutive records is not enough to establish a stride, the tag matches only a few records rather than a whole grid, and 20.0 may be coincidence. Level 1's grid is 384 cells; nothing here has been shown to count to 384. Method note: savestates are compressed on disk, so a byte scan of the file finds nothing. All RAM search must go through gc-trace find --state, which decompresses first -- scanning the file directly reports zero hits for a sequence that demonstrably exists in memory.	2026-10-12 03:27:14 +02:00
ReaperOfVeriod	d3e1475f64	Characterise gameplay.bin as a flat pointer table, and record volumes as unlocated ... Range measured: the first 40 u32 and the whole file, on levels 0 and 1 -- 1872256 and 2006400 bytes. Result: the file is a flat array of u32, opening with a small count then a run of ascending offsets, terminating on a zero: level 0 336 797472 798832 799136 464 150672 150688 314800 479920 ... ... 1847600 1845456 797808 1829056 160 1849088 1249808 1847616 0 level 1 496 799904 800128 800432 624 151152 151168 315680 481456 ... ... 1984496 1982400 800112 1966000 160 1988160 1303456 1984512 0 Both levels carry the same shape. The sentinel 160 appears at u32 index 34 on both and the zero terminator at index 38 on both, with counts 336 against 496 and 464 against 624 at the head. The leading ~38 words are a structured header whose layout is level-independent apart from its sizes. The offsets cluster into groups -- near 800000, 150000, 1050000, 1800000 -- which is what a table of pointers into several buffers looks like. Not decoded: what the pointers point into, what 160 is, and why the zero terminator sits at the same index on both levels. No gc_formats module exists for this yet; it is characterised, not parsed. On volumes: nothing resembling volumes was found here. gameplay.bin is u32 pointers throughout and holds no float data in its first 64 words read as f32 -- 59 of 64 are denormals, i.e. small integers reinterpreted. Volumes remain unlocated on the disc; nothing in the regions examined so far presents itself as one.	2026-10-12 03:19:03 +02:00
ReaperOfVeriod	575d1a5bdd	Correct the overlay strings from a table to a pool ... The previous commit described a "debug string table on 16-byte alignment". It is not a table. Dumping the 32 bytes before each run shows most are the tail of the previous string: +3104 "host0:r:/rc2/shock/wavetable.bin" 32 chars +3120 "ck/wavetable.bin" its own tail +3152 "/i5/shock/wavetable1.bin" +3168 "ble1.bin" its own tail and the 32-byte prefixes are 327 distinct out of 332 -- essentially all different, because they are just the preceding string's bytes. There is no per-record header here. It is one contiguous pool of debug text, and the 16-byte alignment is a property of how the pool was laid out, which makes continuations land on boundaries and read as separate entries. The count of 332 "strings" was therefore inflated by the same effect: it counts continuations as entries. The substance is unchanged and still useful -- the pool carries the game's own debug text, including "Camera_CollPrimTest WARNING! - grid out of bounds! (RAR)", which is direct evidence for reading the collision payload's two leading u16 as grid dimensions, and the wavetable.bin paths, which bear on the sound bank framing. Only the framing was wrong. The pool is located and counted but not parsed, and there is no gc_formats module for it. The +0x18/+0x20 names are section names but their structure is not established, and it is not shown that they index anything.	2026-10-12 03:17:50 +02:00
ReaperOfVeriod	a5a33b9bc0	Locate level_overlay's sections and a 16-aligned debug string table ... level_overlay was on the open list with no parser and no located structure. It now has a header naming two sections and a string table. Range measured: overlay.bin on levels 0, 1 and 2 -- 2751268, 2763668 and 2928424 bytes. Result 1: the file opens with section names. +000: 80 7c 1a 00 | dc 99 00 00 | 01 00 00 00 | 88 3b 2a 00 +010: 00 00 00 00 | 00 00 00 00 | "crap\n" | 00 00 00 00 00 +020: "system misc" 00 00 00 00 00 00 00 00 00 +030: 20 80 ff 40 | 00 60 cf 00 | 64 00 | 46 00 | 19 00 00 00 u32@+0x00 is 1735808 on all three levels, +0x08 is 1, and the bytes at +0x18 and +0x20 spell "crap" and "system misc". Result 2: a debug string table on 16-byte alignment. 332 such strings on level 0, 362 on level 1, 351 on level 2, first at +0x20 and last between 1.3 MB and 2.5 MB. They are the game's own debug text: host0:r:/rc2/shock/wavetable.bin host0:z:/i5/shock/wavetable1.bin unloaded sound bank %#010x Camera_CollPrimTest WARNING! - grid out of bounds! (RAR) render setup sky draw pre effects pre 2 effects Camera_CollPrimTest WARNING! - grid out of bounds! (RAR) is direct evidence for the collision reading. It is the game's own string, naming a grid and a collision test, and it is why the two leading counts in the collision payload are worth continuing to treat as grid dimensions despite not sizing the payload. The wavetable.bin paths also confirm the sound bank is loaded from named files, which bears on the SBlk/DAW framing. Not done: the string table is located and counted but not parsed -- the records preceding each string have not been identified, so there is no gc_formats module for it yet. The +0x18/+0x20 names are section names but their structure is not established, and it is not yet shown that they index anything.	2026-10-12 03:11:25 +02:00
ReaperOfVeriod	e58ab0e815	Correct the collision table's extent: 17 entries, deltas rise then fall ... +5932 is the table's start, not a point inside it: walking backwards, no predecessor satisfies "ascending with a delta under 4096". The run is 17 entries, not 19 -- the earlier 19 counted two entries past the jump. The deltas are 204 212 216 224 224 228 228 228 224 220 216 200 96 96 100 96 then a jump of 41484 to 190508. The deltas rise and then fall -- a symmetric profile, not a monotone one. That weakens the prefix-sum reading: a cumulative offset table has no reason to come back down, whereas cell contents that grow and shrink as the table walks across a level would. 17 against a 75-cell grid, and 75 - 17 = 58. No arithmetic relating the two has been found. The earlier guess that 19 related to 3x25 did not survive re-measurement and is not carried forward. Still open. 17 entries may not correspond to the grid at all -- the table may cover something else, or a subset of cells. Resolving it needs either the same offset found in other levels at a position the leading counts predict, or a reason for 17. Neither exists yet, and this is where the measurement trail goes cold on collision.	2026-10-12 03:08:03 +02:00
ReaperOfVeriod	b66e77855c	Locate a per-cell offset table in collision, on level 4 ... Range measured: longest strictly-ascending u32 run (delta under 65536) in each level's collision payload, levels 0 to 5. Level 4 is the clean case. Grid 3x25, payload 2660608, and at payload +5932 a run of 19 entries whose values are all inside the payload, starting at 146012: deltas 204, 212, 216, 224, 224, 228, 228 The deltas grow monotonically, which is the signature of a prefix sum over records of increasing size -- what a per-cell offset table looks like when cell contents vary. The others are not: level 0 11x33 +21232 17 8193, 24575, 8192, 8192 multiples of 8192, coincidental on dense data level 1 24x16 +41452 29 32771, 57339, 24575 wild, no trend level 2 1x53 +13752 49 24, 64, 396, 104 in-region but irregular level 3 19x31 +667152 18 769, 257, 257, 257 values ~5.2e8, far outside the payload level 4 3x25 +5932 19 204, 212, 216, 224 growing, in-region Only level 4's run has both properties a prefix sum needs: values inside the payload, and deltas that grow. What this does not give: level 4's run is 19 entries against 75 grid cells, so it is not one offset per cell -- either most cells share an offset, are empty, or the table covers something other than the grid. Nothing measured picks between those. Next to check: whether 19 relates to 3x25 by any arithmetic, and whether the same offset at +5932 exists in other levels at a position given by their leading counts. Neither has been tried.	2026-10-12 03:03:18 +02:00
ReaperOfVeriod	2569cc06ab	Decode the collision payload's leading two counts ... Range measured: the first four bytes of the payload on all 19 levels that carry a non-empty one. Result: two u16 at payload +0 and +2, both non-zero on all 19, ranging 1..74 and 13..112, products 53 to 3256. level 0 11 x 33 = 363 payload 903248 level 1 24 x 16 = 384 payload 2800496 level 2 1 x 53 = 53 payload 2315296 level 7 40 x 35 = 1400 payload 4049232 level 9 74 x 44 = 3256 payload 2518352 level 13 2 x 64 = 128 payload 3333520 level 26 27 x 112 = 3024 payload 652176 Reported as two counts, not as a named grid. They have the shape of collision grid dimensions -- bounded, both non-zero, products in the hundreds to thousands -- but nothing measured ties the product to the payload size or to any per-cell stride. Level 2's 1 x 53 giving a 2.3 MB payload and level 26's 27 x 112 giving 652 KB shows the product does not size the payload, so either cells vary wildly in size or these are not grid dimensions. Naming them width and depth would be a reading, not a measurement. After the two counts comes a run of u16 that stays below 8192 for 30 to 58 entries depending on level, always an even count, and is not ascending. That is where the per-cell table most likely starts, and it is the next thing to resolve. Exposed as CollisionHeader::first and ::second. They live in the payload rather than the header, so CollisionHeader::region fills them in and the bare CollisionHeader::parse leaves them zero -- documented at the call site so the difference is not mistaken for an absence.	2026-10-12 02:58:46 +02:00
ReaperOfVeriod	72bbd5da38	Rule out GS packet framing in tie, with a control that nearly fooled me ... Range measured: level 0, the 73 tie span bodies (bytes +0x40 onward), 2585856 bytes pooled. Per-position distinct counts, an autocorrelation scan against a shuffled control, and a GS GIF tag test. Result 1: the bodies are dense. Every one of the 16 slot positions takes 245 to 256 distinct values, byte 15 zero on 81.3% and byte 7 zero on 78.8%. The best stride peak is 48 at +0.097, barely above 16 at +0.095 -- no period. Result 2: no GS GIF framing at 16-byte alignment. Testing whether byte 15's low three bits fall in 0..4, the GS tag range, gives 97.0%. That looked like a strong hit until the control was done properly. A uniform shuffle gives 62.6%, exactly 5/8, what a random byte predicts -- so the naive comparison reads as a 34-point excess. The distribution-matched null is 97.0%, identical to the observation. The whole excess was that byte 15 is 81% zero and (0 & 7) <= 4 is always true. Recomputed per alignment the null tracks the observation everywhere: align 0 97.0% align 4 75.7% align 8 96.7% align 2 75.5% align 12 89.3% This is the control rule earning its place a second time. A uniform shuffle is not a matched control when the data is skewed, and AGENTS.md already says so; the near-miss was reading 62.6% as a baseline without checking what the data's own distribution predicts. The tie bytes concentrate on 0, 1, 2, 3 and 63 -- suggestive in isolation -- and still carry no framing. What this rules out: the tie bodies are not GS GIF packet streams at 16-byte alignment and carry no measurable periodicity. With every slot position taking ~256 distinct values they are dense data -- fat vertices, as the roadmap expects -- and locating the vertex layout needs a reference for this game's instanced geometry format, not another stride scan.	2026-10-12 02:56:58 +02:00
ReaperOfVeriod	86ff2e6052	Measure tie spans: a constant first word and three quantized floats ... Range measured: all 1864 tie spans across 27 levels, read at each class entry's geometry offset. Method: read +0x00, +0x0c and the three f32 at +0x10, +0x14, +0x18, and count distinct values per position. Result: u32@+0x00 takes exactly one value across all 1864 spans: 0x00000100, 256 +0x0c takes 83 distinct values, so it is not constant the three floats take 103 distinct triples built from 42 distinct values, and those values are round -- 4, 8, 9, 10, 12, 15, 16, 18, 20, 24, 25, 30 with only 10 of the 42 exact powers of two Two level 0 spans open: +000 00000100 00005070 000065c0 07050612 +010 41400000 41c80000 42200000 00009460 +000 00000100 00007ca0 0000a040 0605091e +010 41400000 41c80000 42200000 0000ddf0 This rules out the bounding-box reading. A box would take continuous values; these come from a 42-value set of round numbers, so they are authored or quantised quantities -- a grid, a size class, or LOD thresholds -- and nothing measured separates those. Correction: these floats were previously read as a bounding-box minimum, from level 0's first two spans happening to share (12.0, 25.0, 40.0). That triple holds on 266 of 1864 spans, not all of them, and the value set is quantised. Not decoded: what the three floats are, what 0x100 at +0x00 counts, and what the 83 values at +0x0c are.	2026-10-12 02:52:45 +02:00
ReaperOfVeriod	32a24574be	Identify data.bin as the level file descriptor, not geometry ... data.bin is the largest per-level file -- 13.3 MB on level 0, 4.2 to 21.9 MB across the disc -- and had been characterised only as "4-byte structured". Range measured: the first 64 u32 of data.bin on levels 0, 1, 2 and 5, compared against the actual byte lengths of the other extracted level files. Method: read the first 64 u32 and look for any equal to the size of core_index.bin, gs_ram.bin, overlay.bin, gameplay.bin, sound_bank.bin or core_data.bin. Result: three exact matches, at the same indices on every level. u32 index 1 overlay.bin 2751268 2763668 2928424 2863676 u32 index 3 core_index.bin 31600 34016 33808 23536 u32 index 5 gs_ram.bin 518656 569344 513024 434176 Each is the exact byte length of the named file and each lands on the same index on all four levels. Three coincidences at fixed positions is not a coincidence. So data.bin is a descriptor for the level's other files, not geometry in its own right. The roadmap's "the large one: 4.2 to 21.9 MB of geometry per level" entry was wrong and is corrected. The intervening indices 0, 2 and 4 hold values that are not file sizes and their meaning is not established; they are plausibly offsets, but no cumulative-sum or offset+size relation has been checked yet. What follows the descriptor is still unknown, and the file is large enough that the descriptor is unlikely to be all of it.	2026-10-12 02:50:24 +02:00
ReaperOfVeriod	5610d173b0	Narrow the collision header to two fields plus a third used by five levels ... Range measured: all 27 levels that carry collision, reading the 0x40-byte header each. Method: read +0x00, +0x04 and +0x08, then check +0x08..+0x40 for zero. Result: u32@+0x00 is 0x40 on 27 of 27 -- the header is self-sizing u32@+0x04 is the payload size, 20 distinct values across the disc bytes +0x08..+0x40 zero on 22 of 27 Five levels carry a large non-zero word at +0x08: level 7 1248048 level 12 2541616 level 9 1766832 level 13 3376592 level 14 4060640 So the header is not two fields and 56 bytes of padding: there is a third field most levels leave at zero and five use. Whether it is a size, an offset or a second block's length is not established, and nothing measured here separates those readings. Exposed as CollisionHeader::field_08. Correction: the collision header was previously described as self-describing across its full 0x40, which is true for 22 levels and overstates the case for the other five. Still not decoded: the payload. It contains ascending u32 runs on levels 0 and 2 -- level 0 at +280 with deltas 12, 12, 12 then a jump, level 2 at +13868 with deltas 204, 204, 200, 196 -- but irregular deltas fit neither a flat table nor a simple stride, and level 1's apparent run is a byte-shift false positive. Nothing about the payload is asserted.	2026-10-12 02:49:25 +02:00
ReaperOfVeriod	51348b214d	Report the sky reserved-word count in the test output ... 20 of 149 sky sub-objects carry a non-zero word where the other 129 are zero, so the reserved area is not uniformly padding. Reporting it rather than asserting it, and clearing three clippy warnings from the unused counter.	2026-10-12 02:43:40 +02:00
ReaperOfVeriod	681e7e62ef	Parse the sky block: 149 sub-objects with a bounding sphere, and correct the count field ... Range measured: all 27 levels, each sky region from the core index's sky offset to the next region. Method: read the 32-bit offset table at +0x20, bounded by staying inside the region, and parse each sub-object it names. Result: 149 sub-objects across 27 levels. Each opens with a count, then a bounding sphere of four floats at +0x10, then a texture offset at +0x20 and dimensions at +0x24/+0x26: +000: 26 00 00 00 | 00 00 00 00 00 00 00 00 00 00 00 00 +010: e0 8d b2 c1 | 9f d6 f6 3d | ef fc fb be | 1c 61 4e 41 +020: 90 99 05 00 | 1d 00 | 1d 00 | 00 00 e8 00 ... Count 1 to 38, width 3 to 81, radius 1.95 to 14.56, and the radius is positive on 149 of 149 -- the same sphere shape and the same reasoning as the shrub class header's. Correction to an earlier claim: the word at +0x0c is not the sub-object count. It reads 5 on level 0 where the table holds 6 entries, 3 on level 1 against 4, 7 on level 3 against 8, and 196617 on level 2 against 4. Across the disc offsets.len() == count+1 holds on 10 of 27 levels. The field is reported as SkyHeader::field_0c and nothing depends on it; the offset table enumerates the sub-objects and is self-limiting. That earlier claim came from level 0 alone, where 5 against 6 looked like a consistent off-by-one. It is not an off-by-one -- it is a field that happens to be small on most levels and is not a count at all. gc_formats::sky parses the header and the sub-objects. The gated test asserts the sphere is finite, the radius positive where positive at all, the dimensions non-zero, and the sub-object list non-empty on every level.	2026-10-12 02:43:28 +02:00
ReaperOfVeriod	bbce492c91	Establish that the loader produces the RAM packet forms, not the disc ... Everything previously reported about five-block sub-lists and fixed-point payloads was read out of the running game. Checking the same packets on disc settles what the disc actually stores. Range measured: level 0, all 29 packets named by the +0x40 tables of the 6 bounded spans, read at their span-relative offsets; 1636 whole 16-byte records after the 16-byte header. Neither RAM form exists on disc: disc RAM 00 00 00 30 per exactly 1 exactly 5 sub-list packet blocks at 0/32/64 0 of 10 11 of 11 fixed-point byte3 0 of 19 100% == 0x80 The 29 packets split 10 sub-list / 19 fixed-point by whether they contain 00 00 00 30 at all, and not one of the ten has the block structure, and not one of the nineteen has the fixed-point marker. The disc body is a compact 16-byte record stream: +000: 04 04 00 01 | 00 00 00 00 | 00 00 00 05 | 00 80 0e 6c +010: 02 00 00 00 | 05 00 00 00 | 32 00 00 00 | 0e 00 00 00 +020: 09 00 00 00 | 00 40 3e 30 | 12 04 00 00 | 05 00 00 00 +030: 09 00 00 00 | 00 40 3e 30 | 12 04 00 00 | 21 00 00 00 Small u32 fields and a repeating 00 40 3e 30 12 04 00 00. Per position over all 1636 records the same two outliers hold: byte 7 takes 4 distinct values and byte 15 takes 2, against 101 to 153 everywhere else. Byte 7 is per-record, not per-packet: the first record of all 29 packets has byte 7 = 0x00. The four-value vocabulary varies within a packet body rather than tagging the packet, which is why grouping packets by it never separated the two kinds. Consequence for Phase 2: the payload is encoded on disc and expanded at load, so a disc parser can bound it and check its signature but cannot read it as either RAM form. Decoding it means reversing the expansion, not re-describing what the loader produced. That is the honest boundary of what is known.	2026-10-12 02:37:55 +02:00
ReaperOfVeriod	5ade83cf0a	Parse the shrub packet header, a fixed signature on all 2056 disc packets ... The packets found by the +0x40 table have a header the whole disc agrees on. Range measured: every packet on the disc -- 2056 of them, across the 334 successor-bounded spans -- read at each packet's span-relative offset. bytes 0-3 04 04 00 01 2056 / 2056 bytes 4-7 zero 2056 / 2056 byte 8 zero 2056 / 2056 byte 11 0x05 2056 / 2056 size % 16 zero 2056 / 2056 Zero exceptions on any of the five. And the loader fills the rest in. Read back out of the running game the same records carry byte 8 as a count (0x0b to 0x29 observed), byte 11 as one of four tag values, and bytes 12-15 as an absolute EE RAM pointer where the disc has a span-relative offset. Bytes 8-15 are rewritten wholesale on load. That settles what the disc header is for. It carries no count of its own, and the count the RAM copy has is the +0x40 table's count arriving by another route. The disc header is a signature; the RAM header is populated state. ShrubPacketHeader::parse and Shrub::packet_headers() expose this. parse returns None unless all the invariants hold, rather than a default, so a packet that does not match is reported as not-understood instead of half-interpreted. The gated test asserts all four header invariants and the size alignment on every packet of every bounded span. This is the first piece of the mesh packet format represented in gc-formats; everything known about the packet payloads so far is RAM measurement, since the disc form of bytes 8-15 is rewritten at load.	2026-10-12 02:35:00 +02:00
ReaperOfVeriod	af0b1aa949	Repeat the packet measurements per level, correcting two over-general claims ... The five-block result was measured on level 0 only. Rule 3a asks for the same measurement per partition, so it was repeated on level 1's savestate before being written up as a property. Range measured: savestate slot 2 (level 1), RAM 0x22a000..0x28f52f, 415024 bytes, then six of its pointer-bearing records read to count*16. The six sampled pointers split 3/3 between the two payload kinds: 00949430 41 00 00 00 30 sub-list 009496c0 13 69 b0 bf 80 fixed-point 00957970 36 00 00 00 30 sub-list 00957bb0 10 58 7e 8d 80 fixed-point 0095b740 12 37 49 41 80 fixed-point 0095d6d0 57 00 00 00 30 sub-list Taking all six as sub-list gives 3/6 with five blocks. Taking only the three that actually open 00 00 00 30 gives 3/3, with the first three blocks at 0, 32, 64 in all three. The three fixed-point payloads have zero such blocks, as expected. The earlier 3/6 was my sampling, not a counterexample -- the six pointers were never all the same kind of object. Combined: 11 of 11 sub-list payloads across both levels have exactly five blocks, the first three at offsets 0, 32, 64. The fixed-point payloads have an exact signature: byte 3 of every 4-byte group is 0x80 in 100% of cases -- 52/52, 40/40, 48/48 over the first 512 bytes of the three level 1 samples, and the same across all nine level 0 payloads. That separates the two payload kinds without the record tag, which does not select them. Correction: level 1's record tags are not level 0's. The same scan finds 18 04 04 00 01 headers against 19, plus 6 02 01 00 01 against 10, and byte 11 is no longer constant: 0x30 on 10, 0x00 on 5, 0x20 on 2, 0xbc on 1, where level 0 had 0x30 on all 19. "Byte 11 is 0x30, constant" was a level-0 partition result written up as universal; across both levels it takes four values. Fixed-point payload entropy over all nine level 0 payloads is 5.51 to 5.89 bits per byte against 8.0 for uniform, and the mean of the s16 reading varies per payload from -82 to -907 -- structured, and consistent with vertex positions relative to a per-payload origin. Not established: what the five blocks are, and how the fixed-point data decodes to vertices. Its entropy is far below random, so it is compressed or permuted rather than stored plainly, and the permutation table seen once in 0x009376f0 remains unexplained.	2026-10-12 02:31:27 +02:00