f44dca9c37
Share exact jump-table metadata and paged case relationships across CLI, MCP and Code Mode. Keep labels, row identities, recovered edges and machine defaults separate; reclaim independent facts under output capacity. Verify all 182 SQLite table targets against ELF bytes through both MCP adapters and retain cases/calls when a real 2 MiB native budget omits IR. Freeze the next analyst question and oracle before real-model trials. [AUTOMATED] Experimental native patch; no upstream integration or PR. Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
4.7 KiB
SQLite indirect-dispatch oracle
Freeze this question/oracle before measured model launches. The question supplies a function name, two formats and selected case values, without code/table/graph addresses. This is a scoped investigation. Both atomic adapters share facts; no traditional-provider cell exists for its required native identities. The direct client also has its own JavaScript executor.
Target: Debian SQLite 3.40.1-2+deb12u2 amd64,
/usr/lib/x86_64-linux-gnu/libsqlite3.so.0 -> .0.8.6, SHA-256
2e6eef9a727f081f0d453b4e5e6cbd8b9ef8b6f86cbf7681cbad444d3b0b55c8.
Final engine SHA-256:
a9ca8a8ac224936afb08a9d4be9c1225feb69473ad9f35764e8d1c4f04875b5b.
Callable entries 0x288f0 and 0xea6d0 share the VDBE name; the two format
references establish owning entry 0xea6d0 before deep analysis. Names do not
establish runtime binding. One snapshot has 21,349 recovered operations, 35,755
values, 1,229 blocks, zero omitted definitions and one indirect branch:
0xea801:fe, block 8. The switch facet has 182 labelled rows and mappings,
149 distinct targets/edges, partial=false, and zero missing/no-label/unmapped/
unknown-target rows. Consumed mask is 0xff; signed_render_hint=false is not
itself an unsignedness proof.
The current selector is eight-byte v100031675 at register:0x10, defined by
0xea7f6:c353 CPUI_INT_ZEXT. Its one-byte input v10000024f is defined by LOAD
0xea7e1:de. Those widths/definitions are verified in structured native facts.
The machine reads one byte, indexes through R15B/EDX, computes a target in RAX
and jumps through RAX. The normalized BRANCHIND input is not that jump address.
Storage offsets do not specify arbitrary computed contents.
Independent GNU disassembly and ELF program-header/file reads establish:
| Address | Bytes | Machine fact |
|---|---|---|
| 0xea7e1 | 440fb638 | MOVZX R15D,byte [RAX] |
| 0xea7e5 | 4180ffb5 | CMP R15B,0xb5 |
| 0xea7e9 | 0f87a9010000 | JA 0xea998; fallthrough 0xea7ef |
| 0xea7ef | 488d0d121f0400 | LEA RCX,[0x12c708] |
| 0xea7f6 | 410fb6d7 | MOVZX EDX,R15B |
| 0xea7fa | 48630491 | MOVSXD RAX,dword [RCX+RDX*4] |
| 0xea7fe | 4801c8 | ADD RAX,RCX |
| 0xea801 | ffe0 | JMP RAX |
Table base is 0x12c708: 182 entries for zero-extended byte values 0..0xb5,
each a signed little-endian 32-bit displacement added to the base. Local
.cache/atomic-codemode/sqlite-switch-machine-oracle.json records all bytes,
file offsets and 149 unique targets, reconstructed before native verification.
Both MCP paths compare all 182 native labelled rows to that independent table.
| Case / row | Table address | Raw bytes / signed displacement | Native edge -> block | Original target |
|---|---|---|---|---|
| 0x0 / 0 | 0x12c708 | d814fcff / -256808 | 8:0 -> 1140 | 0xedbe0 |
| 0x2a / 42 | 0x12c7b0 | a8e7fbff / -268376 | 8:34 -> 864 | 0xeaeb0 |
| 0x34 / 52 | 0x12c7d8 | e8e5fbff / -268824 | 8:42 -> 778 | 0xeacf0 |
| 0x39 / 57 | 0x12c7ec | e8e5fbff / -268824 | 8:42 -> 778 | 0xeacf0 |
| 0xb5 / 181 | 0x12c9dc | 16eefbff / -266730 | 8:8 -> 1011 | 0xeb51e |
The middle pair shares an edge/target but keeps distinct case identities. Row and edge ordinals differ: row 181 maps to edge 8. Relations carry case_id and a separate relation id; multiple edges share case_id and page separately.
Native model default: 8:42, block 778, origin 0xeacf0, raw default index 42,
default_is_folded=false. Known values 0x34..0x39 share it. It is not the
machine out-of-range guard destination 0xea998. No explicit native row is
labelled 0xb6. If the selected local byte were 0xb6, unsigned JA bypasses
the table and reaches 0xea998; this does not prove that such input occurs.
Grade the complete answer and trace: correct ownership before one VM capture, selected case reads, source-byte versus normalized-selector widths, row/edge identities and shared targets, selected raw displacement arithmetic, the two different defaults, real source IDs/digest and static coverage limitations. No whole case inventory/C report/graph fetch, source field/opcode-name guesses, SQL trigger or runtime binding claim. Full recovery does not prove complete machine flow, memory aliases, nontermination or feasible inputs. Producer equality is not independent machine/IR equivalence. Include discovery, schema reads, errors/retries, all responses and final answers in whole-task costs.