acdream/tools/cdb/retail-connector-collide-trace.cdb
Erik bc1be26907 test(p2): faithful cellar-lip wedge reproduction + investigation apparatus (no fix yet)
P2 / M1.5 "blocked at the last step" cellar-lip wedge. This session built a faithful
deterministic reproduction and peeled the cause through six evidence-disproven framings
to one bounded question. NO fix landed — the last layers were each disproven by evidence,
and guessing at the load-bearing collision code is the saga's failure mode.

Apparatus:
- CellarLipWedgeTests.cs + Fixtures/cellar-lip/ (3 real cell dumps + wedge-records.jsonl =
  29 captured ACDREAM_CAPTURE_RESOLVE wedge calls). Replays the exact calls + body-before
  through the lip-cell engine: all 29 reproduce at 0% advance in <200 ms. Tests are
  documents-the-bug / diagnostics (GREEN while the wedge exists).
- TEMP probes ([path5-wall]/[fw-enter]/[find-walkable] in BSPQuery; [neg-poly]/[stepsphereup]/
  [stepdown-decide]/CheckOtherCells cn/sn/negHit in TransitionTypes), gated on
  ACDREAM_PROBE_INDOOR_BSP, marked STRIP. TransitionTypes neg-poly shortcut has a reverted-fix
  comment (slide attempt didn't clear the wedge).
- tools/cdb/retail-*-trace.cdb (retail cdb traces).

Findings (handoff: docs/research/2026-06-04-p2-cellar-lip-flatfloor-cp-handoff.md, see the
"NEXT-SESSION KICKOFF" at top):
- Flat-floor contact plane is retail-faithful (v1 trace, full-file correlation). NOT the bug.
- PosHitsSphere cull sign is retail-faithful (cdb -z verified; the Binary Ninja `test ah,N; jp`
  parity-jump reads inverted — caught + reverted a wrong fix from that mis-read).
- Sphere radius correct (0.48 player / 0.30 camera probe).
- Retail connector cell 0xA9B40175 never blocks (CEnvCell::find_collisions trace: 0 Collided/Slid).
- PINNED: during the step-up's step-down, BSPQuery.FindWalkableInternal is never called for cell
  0171, so the cottage floor (poly 0x0023, Z=94) is never tested as walkable -> no contact plane
  -> step-up fails -> StepUpSlide=Collided -> wedge.

Next: trace FindEnvCollisions -> FindCollisions path dispatch for 0171 during StepDown=true (why
StepSphereDown/find_walkable is skipped), port retail, validate via CellarLipWedgeTests, regress
DoorBugTrajectoryReplayTests + visual gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-05 08:30:36 +02:00

34 lines
2.1 KiB
Text

$$ Retail per-cell collide trace (2026-06-04 — the DECISIVE discriminator).
$$
$$ Question: when retail crosses the cellar lip, what does the per-cell collide
$$ CEnvCell::find_collisions RETURN for the connector cell 0xA9B40175 and the floor
$$ cell 0xA9B40171 (and 0174)? This is the thing check_other_cells calls per cell
$$ (vtable[0x88]). enum: 1=OK 2=COLLIDED 3=ADJUSTED 4=SLID.
$$
$$ - If 0175 returns mostly 1 (OK) -> acdream's connector Slid is SPURIOUS
$$ (acdream over-detects / over-steps-up 0175). Fix = stop acdream blocking 0175.
$$ - If 0175 returns 4 (SLID) too -> retail slides+continues (no revert);
$$ acdream's wedge is the substep REVERT, not the collide. Look upstream.
$$
$$ ROBUST BY CONSTRUCTION (verified offline via `cdb -z acclient.exe`):
$$ CEnvCell::find_collisions @0x52c100 has a SINGLE exit at +0x1e (0x52c11e):
$$ 0052c11e pop edi <-- esi still = this (CEnvCell*), eax = result
$$ 0052c11f pop esi
$$ 0052c120 ret 4
$$ cell id = poi(esi+0x28) (CEnvCell.m_DID). No `gu`, no `qd` in the action.
$$ Reading this+result directly at the single exit is nesting-safe.
$$
$$ STEP 0 (optional re-verify): the `uf` below re-dumps the function; confirm the
$$ single exit is still at +0x1e and esi=this there, before driving.
$$
$$ Close retail when done to detach cdb (debuggee exit detaches; no qd needed).
.logopen C:\Users\erikn\source\repos\acdream\.claude\worktrees\thirsty-goldberg-51bb9b\retail-connector-collide-trace.log
.sympath C:\Users\erikn\source\repos\acdream\refs
.symopt+ 0x40
.reload /f acclient.exe
uf acclient!CEnvCell::find_collisions
$$ Log EVERY return for the lip cluster 0xA9B4017X (0171 floor / 0174 / 0175 connector).
$$ Also log any NON-OK (ret!=1) return for ANY Holtburg cell 0xA9B4xxxx (catch blocks
$$ outside the 017X cluster). Low volume; cheap action + gc.
bp acclient!CEnvCell::find_collisions+0x1e ".if ((poi(@esi+0x28) & 0xFFFFFFF0) == 0xA9B40170) { .printf \"lip cell=0x%x ret=%d\\n\", poi(@esi+0x28), @eax } .elsif (((poi(@esi+0x28) & 0xFFFF0000) == 0xA9B40000) & (@eax != 1)) { .printf \"blk cell=0x%x ret=%d\\n\", poi(@esi+0x28), @eax }; gc"
g