# Ch303 closeout — caller-loop autopsy; verdict `channel_loop_returns_ignored`

**Status:** Closed. Observation-only chapter per Codex's framing.
No RTL, no new HLE cases. **Named verdict:**
`channel_loop_returns_ignored` for the syscall 0x6B path. The
disassembly also revealed the complete bounded set of remaining
syscall-wrapper functions, which lets Ch304 batch with confidence.

## Key structural finding: these are wrapper TABLES, not loops

The regions Codex pointed at are **tables of 4-instruction
syscall-wrapper leaf functions**, each of the form:

```
addiu $v1, $zero, <syscall_num>
syscall
jr    $ra
nop
```

### Table 1 — `0x00111D40..0x00111D9C`

| Wrapper PC | $v1 set | syscall | status |
|------------|---------|---------|--------|
| 0x00111D40 | -67 (0xFFFFFFBD) | i-variant of 67 (0x43) | **unhandled** |
| 0x00111D50 | 68 (0x44) | 0x44 | **unhandled** |
| 0x00111D60 | 107 (0x6B) | 0x6B | **current blocker** |
| 0x00111D70 | 118 (0x76) | 0x76 | **unhandled** |
| 0x00111D80 | 119 (0x77) | 0x77 | done Ch297 |
| 0x00111D90 | 121 (0x79) | 0x79 | done Ch296 |

### Table 2 — `0x00112A50..0x00112A8C`

| Wrapper PC | $v1 set | syscall | status |
|------------|---------|---------|--------|
| 0x00112A50 | 18 (0x12) | 0x12 | done Ch290 |
| 0x00112A60 | 19 (0x13) | 0x13 | done Ch302 |
| 0x00112A70 | 22 (0x16) | 0x16 | done Ch291 |
| 0x00112A80 | 23 (0x17) | 0x17 | done Ch301 |

**Table 2 is fully handled.** Table 1 has **4 remaining**: the
i-variant -67, 0x44, 0x6B, 0x76.

## The 0x6B caller IGNORES the return value

The immediate caller of the 0x6B wrapper is a function at
`0x00111B00`:

```
0x111b00: daddu $s1, $a0, $zero      ; save $a0
0x111b08: daddu $s0, $a1, $zero      ; save $a1
0x111b0c: lw    $v0, -16392($v1)     ; load a counter
0x111b10: addiu $v0, $v0, 1          ; ++counter
0x111b14: jal   0x00111330           ; helper
0x111b18: sw    $v0, -16392($v1)     ; store counter (delay slot)
0x111b1c: jal   0x00111d60           ; ← call syscall_0x6B wrapper
0x111b20: nop                        ; (delay slot)
0x111b24: daddu $a1, $zero, $zero    ; $a1 = 0  ← does NOT read $v0
0x111b28: addiu $a2, $zero, 112      ; $a2 = 112
0x111b2c: jal   0x00110b88           ; next call (args set, $v0 ignored)
0x111b30: daddu $a0, $sp, $zero      ; (delay slot)
```

**After `jal 0x00111d60` returns, the very next real instruction
(0x111b24) overwrites $a1 with 0 and sets up args for a different
call — `$v0` from the 0x6B syscall is never tested or consumed.**

→ For the 0x6B path: `channel_loop_returns_ignored`.

## The 0x112A00 driver IS a loop, and it DOES capture $v0

For completeness (Codex asked about loop shape generally), the
function at `0x00112A00` is a genuine loop:

```
0x112a00: jal   0x00112a80           ; call syscall_0x17 wrapper
0x112a04: daddu $a0, $s1, $zero      ; (delay) $a0 = $s1
0x112a08: daddu $s1, $v0, $zero      ; $s1 = $v0  ← CAPTURES return
0x112a0c: sync
0x112a10: bne   $s0, $zero, 0x112a30 ; loop-control on $s0 (NOT $v0)
0x112a18: daddu $v0, $s1, $zero      ; return $s1
0x112a28: jr    $ra
...
0x112a30: jal   0x00111c60
0x112a38: beq   $zero, $zero, 0x112a1c
0x112a40: jal   0x00111c10
0x112a48: beq   $zero, $zero, 0x112a00  ; ← loop back to top
```

So this loop **captures $v0 into $s1** and threads it forward (as
$a0 for the next iteration, or as the function's return value).
However:
- It drives **syscall 0x17** (already HLE'd to return 0).
- qbert **progressed +87 retires** with that 0 return — so a 0
  return is tolerated here.
- The loop EXIT is gated by `$s0` (0x112a10 `bne $s0,$0`), not by
  the syscall return value.

So even the loop that *captures* $v0 doesn't *gate* on it — it
just propagates it. Returning 0 is consistent with observed
forward progress.

## $a0=5 is constant — NOT a per-channel iteration

Across every observed call (0x17, 0x13, 0x6B), `$a0 = 5` is
constant. If this were a `for (ch=0..N)` loop, $a0 would vary.
It doesn't. **This is channel-5-specific initialization, not a
loop over all channels.** The `count=2` for 0x17/0x13 comes from
the 0x112A00 driver looping twice (gated by $s0), not from
iterating channel ids.

## Verdict, per Codex's enum

| Verdict | Fit? |
|---------|------|
| `channel_loop_returns_ignored` | **YES (best)** — the 0x6B caller at 0x111B24 discards $v0; the 0x112A00 loop captures but tolerates 0. |
| `channel_loop_checks_v0` | Partial — the 0x112A00 loop *captures* $v0, but doesn't *gate* on it (loop exit is on $s0), and 0 has been tolerated. |
| `channel_loop_waits_on_event` | No — no spin; qbert progresses each chapter. |
| `channel_loop_unbounded` | No — the wrapper tables are finite; remaining set is exactly {-67, 0x44, 0x6B, 0x76}. |
| `channel_loop_shape_unknown` | No — fully decoded. |

**Pick: `channel_loop_returns_ignored`.** The current blocker
(0x6B) discards its return; the one loop that captures a syscall
return ($v0→$s1) tolerates 0 and gates its exit on a different
register.

## Ch304 framing — batch the bounded remaining set

The autopsy proves the remaining unhandled syscalls in these
init tables form a **finite, enumerable set of 4**:

1. **0x6B** (107) — current blocker, return ignored.
2. **0x76** (118) — same wrapper table, almost certainly same
   "ignored return" treatment.
3. **0x44** (68) — same table.
4. **-67 / 0xFFFFFFBD** — i-variant (interrupt-context) of
   syscall 67 (0x43). Negative-$v1 convention. Needs a dispatcher
   case matching the 32-bit value `0xFFFFFFBD` (or a "negative
   $v1 → treat as i-variant" decode if more i-variants surface).

**Recommendation:** Ch304 adds `$v1 == 0x6B` → $v0=0 (the proven
blocker). Then — given the autopsy shows the bounded set —
**Ch305 could batch 0x76, 0x44, and the -67 i-variant** in one
chapter, since they're all in the same wrapper table and the
0x6B caller pattern (ignored return) is representative.

Per Codex's "prefer the closeout propose Ch304 rather than
combine," I'm NOT adding any HLE case in Ch303. Ch304 = add 0x6B
alone, confirm qbert reaches 0x76 (or 0x44 or -67) next, then
Ch305 batches the rest if the pattern holds.

One caution for the -67 i-variant: our dispatcher currently
matches exact unsigned $v1 values. -67 arrives as $v1 =
0xFFFFFFBD. A naive `32'h0000_0043` case would NOT match it. The
i-variant needs either its own `32'hFFFF_FFBD` case or a
sign-aware decode. Flag for whoever frames the -67 chapter.

## Files

- `/tmp/ch294_disasm.py` — disassembler retargeted across
  0x00111D40, 0x00112A00, 0x00111B00, 0x00111300 windows. Same
  one-shot diagnostic.
- This closeout.

## Pattern note — autopsy prevented trap-by-trap guessing

This is the value Codex predicted: instead of discovering 0x6B,
0x76, 0x44, -67 one trap at a time across four chapters, the
single caller-loop autopsy enumerated the complete remaining set
AND established that returns are ignored. Ch304+Ch305 can now
clear the whole init-table sequence in two chapters with
confidence rather than four blind ones.

## Regression

Unchanged at **177/177** — no RTL or TB changes in Ch303.