path: root/tools/mme-audit/mme_audit.py

#!/usr/bin/env python3
"""mme-audit: offline audit of the vgsp MME golden overlay and replay streams.

Pure Python 3.10 stdlib. Inputs (all local, all public):
  * kernel/golden-mme-tu104.h                (golden slot library)
  * dmesg_live_*.log captures                (3D win / MME-WINRUN / MME-PRE)

What it checks (r1448-strategy 3.1):
  1. overlay simulation: golden_slot() accept rules, old (!gs->entry) vs new
     (entry 0 valid) under force=1 -> 54 before, 55 after
  2. grammar walk of every 3D win[...] / MME-WINRUN / MME-PRE[...] block:
     op 1/3/5 span, 0x114 IR loads, SA pairs; walk-end == len assertion
  3. call census per window (slot, off, payload)
  4. operand map over the mission slots: decode MME64 groups, flag
     LOAD-sourced method emissions and suspect method immediates
  5. cross-boot pair-emitted/elided/MISS/first-fault table
  6. slot-57 focus decode around the r1448b/c stall (IR 868..930)
"""
import argparse
import os
import re
import sys

# --------------------------------------------------------------------- golden

GOLDEN_SLOT_RE = re.compile(
    r"\[\s*(\d+)\]\s*=\s*\{\s*0x([0-9a-fA-F]+)u,\s*(\d+)u,\s*(\d+)u,\s*0x([0-9a-fA-F]+)u\s*\}")
GOLDEN_WORDS_RE = re.compile(
    r"golden_mme_tu104_words\[GOLDEN_MME_TU104_WORDS\]\s*=\s*\{(.*?)\n\};", re.S)

MISSION_SLOTS = [0, 2, 34, 39, 40, 48, 51, 57, 58]
SUSPECT_METHODS = [0x1614, 0x1618, 0x2054, 0x2058, 0x2094, 0x2098,
                   0x2154, 0x2158, 0x0d74, 0x0d78]

# MME64 layout (3-word groups), extracted from the observed disassembly
# convention: bits[95:64]=w0, [63:32]=w1, [31:0]=w2.
REG = ["R%d" % i for i in range(24)] + ["ZERO", "IMMED", "IMMEDPAIR",
                                        "IMMED32", "LOAD0", "LOAD1"]
OP = ["ADD", "ADDC", "SUB", "SUBB", "MUL", "MULH", "MULU", "EXTENDED", "CLZ",
      "SLL", "SRL", "SRA", "AND", "NAND", "OR", "XOR", "MERGE", "SLT", "SLTU",
      "SLE", "SLEU", "SEQ", "STATE", "LOOP", "JAL", "BLT", "BLTU", "BLE",
      "BLEU", "BEQ", "DREAD", "DWRITE"]
OUT = ["NONE", "ALU0", "ALU1", "LOAD0", "LOAD1", "IMMED0", "IMMED1",
       "RESERVED", "IMMEDHIGH0", "IMMEDHIGH1", "IMMED32_0"]


def regname(v):
    return REG[v] if v < 30 else "V%d" % (v - 32)


def mme64_decode(w0, w1, w2):
    val = (w0 << 64) | (w1 << 32) | w2

    def bits(hi, lo):
        return (val >> lo) & ((1 << (hi - lo + 1)) - 1)

    alus = []
    for base in (10, 46):
        alus.append((bits(base + 4, base), bits(base + 9, base + 5),
                     bits(base + 14, base + 10), bits(base + 19, base + 15),
                     bits(base + 35, base + 20)))
    outs = []
    for base in (82, 89):
        outs.append((bits(base + 2, base), bits(base + 5, base + 3)))
    return {
        "endNext": bits(0, 0), "predMode": bits(4, 1), "pred": bits(9, 5),
        "alu": alus, "out": outs,
    }


def mme64_text(d):
    parts = []
    for op, dst, s0, s1, im in d["alu"]:
        if (op, dst, s0, s1, im) == (0, 0, 0, 0, 0):
            continue
        parts.append("%s %s, %s, %s, 0x%04x" %
                     (OP[op], regname(dst), regname(s0), regname(s1), im))
    for meth, emit in d["out"]:
        if meth or emit:
            parts.append("OUT method-src=%s data-src=%s" %
                         (OUT[meth], OUT[emit]))
    if d["endNext"]:
        parts.append("endNext")
    if d["predMode"]:
        parts.append("pred=%s,%s" % (d["predMode"], regname(d["pred"])))
    return " | ".join(parts) if parts else "NOP"


def parse_golden(path):
    text = open(path, encoding="utf-8").read()
    pool = []
    m = GOLDEN_WORDS_RE.search(text)
    if m:
        pool = [int(t, 16) for t in re.findall(r"0x[0-9a-fA-F]+", m.group(1))]
    entries = {}
    for m in GOLDEN_SLOT_RE.finditer(text):
        entries[int(m.group(1))] = (int(m.group(2), 16), int(m.group(3)),
                                    int(m.group(4)), int(m.group(5), 16))
    return entries, pool


def golden_slot(entries, j, entry0_fix):
    """Model of gsp_phys_gr_golden_slot() (knob presumed on)."""
    if j >= 64 or j not in entries:
        return None
    entry, words, off, flags = entries[j]
    if not (flags & 0x1) or not words:
        return None
    if not entry0_fix and not entry:
        return None
    return entry, words, off, flags


PRESENT = 0x1
GMME_FLAGS = {0x2: "DRIVER", 0x4: "LIVE_VARIANT", 0x8: "GEFORCE"}


def overlay_sim(entries, pool):
    out = {}
    for fix in (False, True):
        overlaid, rejected = [], []
        for j in range(64):
            gs = golden_slot(entries, j, fix)
            (overlaid if gs else rejected).append(j)
        out[fix] = (sorted(overlaid), sorted(rejected))
    return out


# ------------------------------------------------------------------ walkers

def walk_stream(words):
    """Booter grammar walk: returns (ok, runs, image, calls, sa_pairs)."""
    runs, image, calls, sa_pairs = [], {}, [], {}
    off, n = 0, len(words)
    ok = True
    while off < n:
        h = words[off]
        op = (h >> 29) & 7
        cnt = (h >> 16) & 0xfff
        mthd = (h & 0x1fff) << 2
        span = 1
        if op in (1, 3, 5) and cnt:
            span = 1 + cnt
        if off + span > n:
            ok = False
            span = n - off
        runs.append((off, op, cnt, mthd, span))
        if mthd == 0x114 and span >= 3:
            pc = words[off + 1]
            code = words[off + 2:off + span]
            for i in range(len(code) // 3):
                image[pc + i] = tuple(code[3 * i:3 * i + 3])
        if 0x3800 <= mthd <= 0x39fc:
            j = (mthd - 0x3800) // 8
            kind = "DATA" if (mthd & 4) else "MACRO"
            payload = list(words[off + 1:off + span])
            calls.append((j, off, kind, mthd, payload))
        if mthd == 0x11c and span >= 3:
            sa_pairs[words[off + 1]] = words[off + 2]
        off += span
    return ok, runs, image, calls, sa_pairs


CRLF = re.compile(r"\[(\d+\.\d+)\]\s+vgsp-gr:\s+(.*)$")
WIN_RE = re.compile(r"3D win\[\s*(\d+)\]:\s+((?:[0-9a-fA-F]+ ?)+)")
WINRUN_DUMP_RE = re.compile(r"MME-WINRUN dump h=0x([0-9a-fA-F]+) push=0x([0-9a-fA-F]+) window=(\d+)")
WINRUN_RUN_RE = re.compile(
    r"MME-WINRUN off=([0-9a-fA-F]+) op=(\d+) cnt=(\d+) mthd=([0-9a-fA-F]+) d0=([0-9a-fA-F]+) d1=([0-9a-fA-F]+)")
PRE_RE = re.compile(r"MME-PRE\[\s*(\d+)\]:?\s+((?:[0-9a-fA-F]{8} ?)+)")


def parse_windows(path):
    """Yield dicts for each 3D win[], MME-WINRUN and MME-PRE[] block."""
    cur = None
    win_words, wr_runs, wr_meta = [], [], None
    pre_idx, pre_words = -1, []
    with open(path, encoding="utf-8", errors="replace") as fh:
        for line in fh:
            m = CRLF.search(line)
            if not m:
                continue
            ts, msg = m.group(1), m.group(2)
            m = WIN_RE.search(msg)
            if m:
                off = int(m.group(1))
                ws = [int(t, 16) for t in m.group(2).split()]
                if win_words and off != len(win_words) and off != 0:
                    yield {"kind": "win", "ts": ts, "words": win_words}
                    win_words = []
                if off == 0 and win_words:
                    yield {"kind": "win", "ts": ts, "words": win_words}
                    win_words = []
                win_words.extend(ws)
                continue
            m = WINRUN_DUMP_RE.search(msg)
            if m:
                if wr_meta and wr_runs:
                    yield {"kind": "winrun", "ts": ts, **wr_meta, "runs": wr_runs}
                wr_meta = {"h": int(m.group(1), 16), "push": int(m.group(2), 16),
                           "window": int(m.group(3))}
                wr_runs = []
                continue
            m = WINRUN_RUN_RE.search(msg)
            if m and wr_meta is not None:
                wr_runs.append((int(m.group(1), 16), int(m.group(2)),
                                int(m.group(3)), int(m.group(4), 16),
                                int(m.group(5), 16), int(m.group(6), 16)))
                continue
            m = PRE_RE.search(msg)
            if m:
                idx = int(m.group(1))
                ws = [int(t, 16) for t in m.group(2).split()]
                if pre_words and idx != pre_idx + len(pre_words):
                    yield {"kind": "pre", "ts": ts, "words": pre_words}
                    pre_words = []
                pre_words.extend(ws)
                pre_idx = idx
                continue
            if win_words:
                yield {"kind": "win", "ts": ts, "words": win_words}
                win_words = []
            if wr_meta and wr_runs is not None:
                # runs may legitimately be empty (dump with no decoded runs)
                yield {"kind": "winrun", "ts": ts, **wr_meta, "runs": wr_runs}
                wr_meta, wr_runs = None, []
            if pre_words:
                yield {"kind": "pre", "ts": ts, "words": pre_words}
                pre_words = []
    if win_words:
        yield {"kind": "win", "ts": ts, "words": win_words}
    if wr_meta:
        yield {"kind": "winrun", "ts": ts, **wr_meta, "runs": wr_runs}
    if pre_words:
        yield {"kind": "pre", "ts": ts, "words": pre_words}


def walk_winrun(window, runs):
    """Walk a decoded MME-WINRUN listing; returns (ok, calls, end)."""
    seen, calls, end = set(), [], 0
    for off, op, cnt, mthd, d0, d1 in runs:
        span = 1 + cnt if op in (1, 3, 5) and cnt else 1
        seen.add(off)
        if 0x3800 <= mthd <= 0x39fc:
            j = (mthd - 0x3800) // 8
            kind = "DATA" if (mthd & 4) else "MACRO"
            calls.append((j, off, kind, mthd, [d0, d1]))
        end = max(end, off + span)
    ok = end == window and len(seen) == len(runs)
    return ok, calls, end


# ------------------------------------------------------------ MME64 scanning

def scan_slot(entries, pool, slot):
    entry, words, off, flags = entries[slot]
    rows = []
    for i in range(words // 3):
        w = tuple(pool[off + 3 * i:off + 3 * i + 3])
        d = mme64_decode(*w)
        rows.append((entry + i, i, w, d))
    return rows


def operand_map(entries, pool):
    """For mission slots: flag emissions + suspect method constants."""
    sus2 = {m >> 2: m for m in SUSPECT_METHODS}
    out = []
    for slot in MISSION_SLOTS:
        if slot not in entries or not entries[slot][1]:
            continue
        for ir, idx, w, d in scan_slot(entries, pool, slot):
            tags = []
            for meth, emit in d["out"]:
                if emit in (3, 4):  # LOAD0/LOAD1 data source
                    tags.append("LOAD-sourced emission (method-src=%s)" % OUT[meth])
            for word in w:
                low = word & 0xfff
                if low in sus2 and sus2[low] != 0x0d74 and sus2[low] != 0x0d78:
                    tags.append("suspect method %#x (field 11:0 of %08x)" % (sus2[low], word))
            for op, dst, s0, s1, im in d["alu"]:
                if im in SUSPECT_METHODS:
                    tags.append("suspect imm %#x (ALU immed)" % im)
                if s0 == 24 and im == 0:  # ZERO + 0 immediate
                    tags.append("zero-operand ALU (src0=ZERO immed=0)")
            for t in tags:
                out.append((slot, ir, w, t, mme64_text(d)))
    return out


# ----------------------------------------------------------- log-level facts

FAULT_RE = re.compile(r'errString="([^"]+)"')
ESR_RE = re.compile(r"esr 80000000->badf1201")


def log_facts(path):
    f = {"path": path}
    counts = {"PAIR-DROP": 0, "PAIR-DROP-words": 0, "MISS-2054": 0,
              "GOLDEN": [], "esr": 0, "macros": {}, "faults": [],
              "trap2090": 0}
    with open(path, encoding="utf-8", errors="replace") as fh:
        for line in fh:
            if "MME-PAIR-DROP" in line:
                counts["PAIR-DROP"] += 1
                m = re.search(r"MME-PAIR-DROP (\d+) word", line)
                if m:
                    counts["PAIR-DROP-words"] += int(m.group(1))
            if "pair addr=0x2054" in line and "-> MISS" in line:
                counts["MISS-2054"] += 1
            m = re.search(r"MME-GOLDEN overlay (\d+) slot", line)
            if m:
                counts["GOLDEN"].append(int(m.group(1)))
            if ESR_RE.search(line):
                counts["esr"] += 1
            for m in re.finditer(r"macro-status=([0-9a-fA-F]{8})\(mpc=(\d+) mac=0x([0-9a-fA-F]+) run=(\d)\)", line):
                counts["macros"][int(m.group(2))] = counts["macros"].get(int(m.group(2)), 0) + 1
            if "trap=00002090" in line or "trap=80002090" in line:
                counts["trap2090"] += 1
            m = FAULT_RE.search(line)
            if m:
                counts["faults"].append(m.group(1).strip())
    f["counts"] = counts
    return f


# ------------------------------------------------------------------- report

def main():
    ap = argparse.ArgumentParser()
    here = os.path.dirname(os.path.abspath(__file__))
    repo = os.path.abspath(os.path.join(here, "..", ".."))
    ap.add_argument("--golden", default=os.path.join(repo, "kernel", "golden-mme-tu104.h"))
    ap.add_argument("--logs", nargs="*", default=[])
    ap.add_argument("--out", default="/tmp/opencode/r1449-audit.md")
    args = ap.parse_args()

    entries, pool = parse_golden(args.golden)
    present = sorted(j for j in entries if entries[j][3] & PRESENT and entries[j][1])
    absent = sorted(set(range(64)) - set(present))
    lines = []
    A = lines.append

    A("# r1449 MME offline audit (mme-audit)")
    A("")
    A("- golden: `%s` (%d words, %d present slots)" % (args.golden, len(pool), len(present)))
    A("- present: %s" % present)
    A("- absent : %s" % absent)
    A("")

    A("## 1. Overlay simulation (gsp_phys_gr_golden_slot + force overlay)")
    sim = overlay_sim(entries, pool)
    old_over, old_rej = sim[False]
    new_over, new_rej = sim[True]
    A("")
    A("| mode | overlaid | rejected (no golden) |")
    A("|---|---|---|")
    A("| pre-r1448 (`!gs->entry` rejects slot 0) | **%d** | %s |" % (len(old_over), old_rej))
    A("| r1448 (entry 0 valid) | **%d** | %s |" % (len(new_over), new_rej))
    A("")
    A("slot 0: %s" % ("golden entry=0x0 words=%d flags=%s (ACCEPTED after fix)" %
                      (entries[0][1], "+".join(n for b, n in GMME_FLAGS.items() if entries[0][3] & b))
                      if 0 in entries else "absent"))
    assert len(old_over) == 54 and len(new_over) == 55, "overlay sim mismatch"
    A("")
    A("ASSERT: 54 -> 55 after the entry-0 fix: OK")
    A("")

    A("## 2. Grammar walks (walk-end == len)")
    A("")
    A("| log | blocks | win | winrun | pre | end-mismatch | calls | 0x2054 | 0x2094 | 0x2154 |")
    A("|---|---|---|---|---|---|---|---|---|---|")
    wins = {}
    for path in args.logs:
        if not os.path.exists(path):
            A("| %s | MISSING | | | | | | | | |" % path)
            continue
        nw = nwr = npre = nmis = ncall = 0
        pair_counts = {0x2054: 0, 0x2094: 0, 0x2154: 0}
        win_calls = []
        for blk in parse_windows(path):
            if blk["kind"] == "win":
                ok, runs, image, calls, sa = walk_stream(blk["words"])
                nw += 1
                nmis += 0 if ok else 1
                ncall += len(calls)
                for j, off, kind, mthd, payload in calls:
                    win_calls.append((blk["ts"], j, off, kind, payload))
            elif blk["kind"] == "winrun":
                ok, calls, end = walk_winrun(blk["window"], blk["runs"])
                nwr += 1
                nmis += 0 if ok else 1
                ncall += len(calls)
                for off, op, cnt, mthd, d0, d1 in blk["runs"]:
                    if mthd in pair_counts:
                        pair_counts[mthd] += 1
                for j, off, kind, mthd, payload in calls:
                    win_calls.append((blk["ts"], j, off, kind, payload))
            elif blk["kind"] == "pre":
                ok, runs, image, calls, sa = walk_stream(blk["words"])
                npre += 1
                nmis += 0 if ok else 1
                ncall += len(calls)
        wins[path] = win_calls
        base = os.path.basename(path)
        A("| %s | %d | %d | %d | %d | %d | %d | %d | %d | %d |" %
          (base, nw + nwr + npre, nw, nwr, npre, nmis, ncall,
           pair_counts[0x2054], pair_counts[0x2094], pair_counts[0x2154]))
    A("")
    A("Note: dmesg_live_r1448.log carries both r1448b and r1448c boots "
      "(148098..148521 and 148520/148627 sentinels); the per-boot logs named "
      "r1448b/r1448c were not present at audit time.")
    A("")

    A("## 3. Call census (windows that called MME macros)")
    for path, calls in wins.items():
        if not calls:
            continue
        A("")
        A("### %s" % os.path.basename(path))
        A("")
        A("| ts | slot | off | kind | payload |")
        A("|---|---|---|---|---|")
        for ts, j, off, kind, payload in calls[:200]:
            A("| %s | %d | 0x%x | %s | %s |" %
              (ts, j, off, kind, " ".join("%08x" % p for p in payload[:8])))
        if len(calls) > 200:
            A("| ... | (%d more) | | | |" % (len(calls) - 200))
    A("")

    A("## 4. Operand map (mission slots; LOAD-sourced emissions + suspects)")
    A("")
    om = operand_map(entries, pool)
    if not om:
        A("no flagged instructions")
    else:
        A("| slot | IR | words | flag | decode |")
        A("|---|---|---|---|---|")
        for slot, ir, w, t, txt in om[:120]:
            A("| %d | %d | %08x %08x %08x | %s | %s |" % (slot, ir, w[0], w[1], w[2], t, txt))
        if len(om) > 120:
            A("| ... | | | (%d more) | |" % (len(om) - 120))
    A("")

    A("## 5. Cross-boot pair/fault table")
    A("")
    A("| log | PAIR-DROP n | words | 0x2054 MISS | overlay | esr badf1201 | trap 0x2090 | first faults |")
    A("|---|---|---|---|---|---|---|---|")
    for path in args.logs:
        if not os.path.exists(path):
            continue
        f = log_facts(path)
        c = f["counts"]
        A("| %s | %d | %d | %d | %s | %d | %d | %s |" %
          (os.path.basename(path), c["PAIR-DROP"], c["PAIR-DROP-words"],
           c["MISS-2054"], sorted(set(c["GOLDEN"])), c["esr"], c["trap2090"],
           "; ".join(c["faults"][:4]) if c["faults"] else "-"))
    A("")

    A("## 6. Slot-57 focus: golden body around the r1448b/c stall")
    A("")
    if 57 in entries and entries[57][1]:
        rows = scan_slot(entries, pool, 57)
        A("entry=0x%x words=%d instructions=%d" % (entries[57][0], entries[57][1], len(rows)))
        A("")
        A("| IR | idx | words | decode |")
        A("|---|---|---|---|")
        for ir, idx, w, d in rows:
            mark = ""
            if ir == 899:
                mark = " **<- r1448b stall (mpc=899)**"
            elif ir == 900:
                mark = " **<- r1448c stall (mpc=900)**"
            if idx < 14 or idx >= 20:
                A("| %d | %d | %08x %08x %08x | %s%s |" % (ir, idx, w[0], w[1], w[2], mme64_text(d), mark))
        A("")
    else:
        A("slot 57 absent from golden library")

    A("## 7. Method-name map for the pipeline family (0x2000 + j*64)")
    A("")
    names = {0x00: "SET_PIPELINE", 0x08: "PIPELINE_RESERVED_A",
             0x0c: "PIPELINE_REGISTER_COUNT", 0x10: "PIPELINE_BINDING",
             0x14: "PROGRAM_ADDRESS_A", 0x18: "PROGRAM_ADDRESS_B",
             0x1c: "PIPELINE_RESERVED_D", 0x20: "PIPELINE_RESERVED_E"}
    for m in (0x2054, 0x2090, 0x2094, 0x2098, 0x2154, 0x2158):
        j = (m - 0x2000) // 64
        off = (m - 0x2000) % 64
        A("- 0x%04x = SET_PIPELINE(%d) + 0x%02x = %s" % (m, j, off, names.get(off, "?")))
    A("")

    A("## 8. Stall-diagnosis evidence (r1448b/c residual)")
    A("")
    A("The MME-FAST `trap=<mthd> data=<d>` telemetry carries the method the FE")
    A("last processed. Calibration against the window runs:")
    A("")
    TRAP_RE = re.compile(r"trap=([0-9a-fA-F]{8}) data=([0-9a-fA-F]{8})")
    for path in args.logs:
        if not os.path.exists(path):
            continue
        wr_pairs, trap_pairs, stall = set(), set(), []
        with open(path, encoding="utf-8", errors="replace") as fh:
            for line in fh:
                m = WINRUN_RUN_RE.search(line)
                if m:
                    wr_pairs.add((int(m.group(4), 16), int(m.group(5), 16)))
                m = TRAP_RE.search(line)
                if m:
                    trap_pairs.add((int(m.group(1), 16) & 0x7fffffff,
                                    int(m.group(2), 16)))
                if "macro-status=" in line and ("mpc=899" in line or "mpc=900" in line):
                    stall.append(line.rstrip())
        hits = sorted(wr_pairs & trap_pairs)
        n2090_wr = sum(1 for line in open(path, encoding="utf-8", errors="replace")
                       if WINRUN_RUN_RE.search(line) and "mthd=2090" in line)
        n2090_trap = sum(1 for line in open(path, encoding="utf-8", errors="replace")
                         if "trap=00002090" in line or "trap=80002090" in line)
        A("### %s" % os.path.basename(path))
        A("")
        A("- window-run `(mthd,d0)` vs telemetry `(trap,data)` intersections: %s" %
          (" ".join("0x%x/0x%x" % p for p in hits[:8]) if hits else "none"))
        A("- `mthd=2090` window runs: **%d**; `trap=...2090` telemetry lines: **%d**" %
          (n2090_wr, n2090_trap))
        for s in stall[:6]:
            A("- stall: `%s`" % s)
        A("")

    A("## 9. Findings (synthesis)")
    A("")
    A("1. **Overlay completion:** the entry-0 fix takes the force overlay from")
    A("   54 to 55 slots (slot 0 SETUP_FIXED_CONST, entry 0x0, 15 words is the")
    A("   only slot the old `!gs->entry` reject skipped).")
    A("2. **r1448b/c residual:** the slots carried the program pairs (PAIR-DROP=0;")
    A("   `mthd=2054/2094/2154 d1=0x19b0900/0x19b0200/0x19b0000`); the MME was")
    A("   sampled at mpc=899 (r1448b, 3x then poison) / 900 (r1448c, 2x then")
    A("   trap) inside slot 57. NOTE: the clean r1443b boot passes through the")
    A("   same mpc=899/900 samples (and advances to mac=0x33), so the PC alone")
    A("   is not the anomaly - the differentiator is `trap=0x2090 data=0`")
    A("   (0 occurrences in r1443b/r1447/r1447c, 4 in r1448) followed by")
    A("   Class Error Offset 00002090 ErrorCode 4.")
    A("3. **0x2090 is macro-emitted, not client-emitted:** no window in any log")
    A("   contains `mthd=2090`; the trap field is calibrated against window runs")
    A("   (`mthd=22c d0=800` <-> `trap=0000022c data=00000800`). 0x2090 =")
    A("   SET_PIPELINE(2)+0x10 = PIPELINE_BINDING(2), the stage-2 binding in the")
    A("   same family as the carried pairs. It is emitted by the MME and")
    A("   rejected only in the pair-carried boots.")
    A("4. **Stall-site decode:** slot 57 IR 899 (idx 31) is an emission group")
    A("   `ADD R3,R3,IMMEDPAIR,0x08e4 | OUT method-src=IMMED0 data-src=LOAD0`;")
    A("   IR 903 repeats it; IR 900 (idx 32) is `JAL +0x1d` to the macro tail.")
    A("   LOAD0 is never written inside the slot-57 body (first read at IR 868")
    A("   as macro input word 0): the emitted binding payload is call-input")
    A("   dependent and null-capable - the rejected `data=0` snapshot is")
    A("   consistent with a zero call-input word on the stalling call.")
    A("5. **Next lever:** the carried-pair launch must satisfy the stage-2")
    A("   binding method (0x2090) the macro emits, or the emission must be")
    A("   bracketed by a valid stage-2 selector/binding state (the window writes")
    A("   `mthd=2080 SET_PIPELINE(2) d0=0x21 d1=0x20010850` but no 0x2090).")
    A("   Alternative: keep the r1447 pairs-elided shape for the calls-kept")
    A("   launch (it reached mpc=930/22) and carry the pairs only on held-call")
    A("   launches.")
    A("")

    text = "\n".join(lines) + "\n"
    with open(args.out, "w", encoding="utf-8") as fh:
        fh.write(text)
    print(text)
    print("wrote", args.out, file=sys.stderr)


if __name__ == "__main__":
    main()