The Open-Questions Register

This is the exhaustive companion to the orientation-level Reimplementation Verdict & Open-Questions Map. Where that page is the navigable map — the defining subset a reader meets most often — this is the consolidated, categorized ledger of every residual unknown across the full corpus: the single document you open to ask "what is STILL not known, WHY is it unreachable by static analysis, and WHAT concrete artifact / dynamic run / license / corpus would close it." Every residual is tagged by closability and by confidence / wall, pinned to the page that owns it, and stated at its precise current state — narrowed where it has been narrowed, never overstated.

The tagging system ([CONF/PROV] and the closability classes) is the Confidence & Walls Model; the named-wall defining subset is that page's §4. The per-axis coverage accounting behind the five headline fractions is the Coverage Ledger. This register is the long-form why-unreachable + what-would-close-it for every row that ledger summarizes.

0. The headline thesis — read this first

NONE of the residuals in this register is a missing decode, a missing datapath, or a missing value-semantics. [HIGH/INFERRED]

The ISA decode is a certified-perfect, non-overlapping cover (1,534 / 1,534 shipped mnemonics, the canonical libisa-core.so encoder bit-exact). The datapaths are recovered — ~169/171 domain structs field-exact, every struct on the path a custom op travels. The value oracle is closed: all 864 / 864 module__xdref_ value leaves in libfiss-base.so are resolved to a per-element function, and ~95% are proven-by-execution against the live shipped simulator across ~2.09M differential comparisons with zero firmware value bugs found. This is the VAL-lane capstone verdict: value semantics 100% known + ~95% execution-validated.

What survives is therefore never a hole in the machine. Every residual below is a provenance / lineage / dynamic-state / v5-interior question — a driver, a checkout, a license key, a runtime capture, a v5 firmware image, or a follow-on static pass away. The machine is recovered; what is walled off is a runtime input, an absent generation's image, an out-of-config core, a license-gated observable, or the lineage behind a table that is itself validated truth.

This thesis is not a flourish; it is the falsifiable governing claim of the whole effort, and it is re-verified on three independent pages: the orientation map §B.3, the Confidence & Walls Model §3, and the capstone meta-finding §3. Across ~2.09M comparisons, every apparent value divergence root-caused to the reference model (nki numpy), the analyst's lift/SEM, the python harness, or an analyst's INFERRED reconstruction-form of a ROM — never once to the firmware. The differential was anchored to the executed binary, so a misreading on the measuring side could not masquerade as a firmware defect.

NOTE — what "closable" means here. A residual is a wall only when the artifact that would answer it is provably not in this corpus, or the answer is gated behind a runtime/license event no static read can trigger. An unfinished decode of a present, decodable function is a task, not a wall, and does not appear in this register. The closability tag names the one thing that would cross each wall:

Closability	What crosses it
closable-with-corpus	A different/fuller checkout containing the missing artifact (a later firmware image, an absent host library, an unshipped disassembler config). A corpus boundary, not a knowledge boundary.
closable-with-license	The capability is present and runnable in the shipped simulator but halts at a FlexNet check (AUTH::check_iss_licenses). A node-locked key crosses it; nothing else changes.
closable-with-hardware / runtime-capture	A value that exists only at runtime — a host-loaded table payload, a soft-float dispatch object populated by a device round-trip, a per-cycle ordering. A captured payload or a device run crosses it.
closable-with-static	A follow-on RE pass on the binary already in hand — present and drivable, only the analysis work unfinished. (A soft wall, listed for completeness.)
fundamental	No static corpus of this subsystem can answer it: the thing asked for does not exist in this subsystem (a scope boundary), or the data is structurally absent and only a bound is recoverable.

1. The consolidated register table

Every residual, grouped by closability, then by subsystem. Columns: the residual; its precise current state; the owning page; why static analysis cannot close it on this corpus; the concrete closer; and the confidence / wall tag. Literal | inside a cell is escaped \|.

The set is a fully-named ledger of twelve open questions (Q1–Q12) plus three carried secondaries (Q12a / Q12c / Q12e) and the four v5 firmware-internal walls (W1–W4) the orientation map carries on every Maverick claim — eighteen rows in total. None is a behavioral hole.

1.1 closable-with-corpus — a fuller/different checkout contains the artifact

1.2 closable-with-license — present-but-gated cycle / fault / observable-trace

1.3 closable-with-hardware / runtime-capture — a value that exists only at runtime

1.4 closable-with-static — a follow-on pass on the binary already in hand

1.5 fundamental — the artifact does not exist in this subsystem, or only a bound is recoverable

1.6 anti-fabrication markers — walls that aren't (named to forestall invention)

2. Roll-up by closability

The primary closability tag per residual (Q-rows and the four v5 walls; the v5 walls W1/W2/W3 are the standing interiors the verdict map carries, and W4 ≡ Q8):

The two fundamental rows are not unrecovered mechanisms: Q5 is a scope boundary (stochastic rounding is not a GPSIMD value-datapath feature) and Q12c is an absent-XML-body residual whose practical bound — the FLIX-slot + per-format mul-capable-slot model — is already sound. Every other row is a checkout, a key, a capture, or a follow-on pass away. [HIGH/INFERRED over the cited closers]

3. The SCOPE-named residuals, each at its precise current state

The task SCOPE names a specific set of residuals; each is registered above, but they warrant an explicit, do-not-overstate restatement because each is exactly the kind a downstream page is tempted to widen.

3.1 The v5 firmware-internal walls (W1–W4)

Maverick (v5) is header-OBSERVED only; flag each interior on every v5 claim, never fabricate across them. The orientation map develops these; here is the precise state of each.

• arch_id 36 is INFERRED, ct37 is OBSERVED — do not conflate. The OBSERVED anchor is coretype 37 (the cmp $0x25,%edi range-guard + the movabs $0x2020202000 bitmask setting bit 37 + the case 37 → maverick_libs switch arm @0x9b9050 + the 62 MAVERICK_*_get accessors — all re-confirmed this pass). arch_id 36 (0x24) is the coretype − 1 extrapolation; there is no cmp $0x24 anywhere (re-confirmed: 0 matches), and libncfw's get_image ladder routes 0x24 to the unsupported path. [ct37 HIGH/OBSERVED; arch_id 36 MED/INFERRED]

  CORRECTION — the coretype stride is irregular; only the arch_id relation is uniform. Do not assert a flat +8 coretype stride. The observed coretype set is {6, 13, 21, 29, 37} — that is +7 then +8, +8, +8 (6→13 is +7). What is uniform is arch_id = coretype − 1 ({0x05, 0x0c, 0x14, 0x1c, 0x24}), and it is that −1 relation — not any coretype stride — that extends the v5 arch_id to 36. A reimplementer reading "+8 stride" off the coretype axis mis-derives the floor. (The maverick-profile §1 table that states a "+8 coretype stride" is using the +8 that holds for 13→21→29→37; the 6→13 step is +7. Cite the −1 arch_id relation, not the coretype stride, as the invariant.)

• v5 Q7 geometry — INFERRED. The IRAM/DRAM geometry, the CSR bundle, the run-stall/DKL surface are the bounded extrapolation of the monotone v2–v4 scaling axes — not a read of v5 firmware. The structural reason it stays INFERRED: the v5 device-CSR headers are byte-identical to v4 (a negative OBSERVED), so there is no v5-specific surface to read, and no v5 KaenaHal slot in libnrt 2.31.x. [INFERRED]

• v5 D2D transport — INFERRED at the IP level. The remote-capable descriptor model is OBSERVED (REMOTE_*_INC, remote_core_id); the PHY/IP is named by neither header nor firmware, so the native-UCIe re-IP reading is CARRIED. [INFERRED · IP-level; CARRIED · PHY]

• v5 Q7_CC_TOP collective firmware — FILE-ABSENT. Re-confirmed: MAVERICK_Q7_CC_TOP*_get = 0. A genuine gap, not an unread region; the v5-specific dispatch bodies and native-UCIe D2D transport live in firmware images this checkout does not carry. The v4/v5-shared kernels ARE decoded via the Mariana images — only the v5-specific bodies are absent. [absence HIGH/OBSERVED]

• v5-body decode (the FLIX-desync overlap). Where a flat v5 NX region is present, the per-instruction bodies inside a FLIX-desynced span are read but tooling-bounded — table bases and string-anchored structures stay HIGH, the interior bindings sit at MED (the SX-FW-00 ceiling). [wall HIGH/OBSERVED; bodies MED]

QUIRK — the largest v5 structural delta is real and OBSERVED, not a wall. The ACT→DVE fold (Maverick ships no NX_ACT image; the activation datapath is re-homed onto DVE, with 0x23/0x25 newly armed on the DVE PROF CAM and ActivationReadAccumulator → DveReadAccumulator 0x9b) is a byte-grounded finding, and the QUANTIZE_MX 0xe3 engine-binding (DVE forward op; POOL hosts only the 0x7b dequant) is RESOLVED, not open. These are not residuals — they are the v5 facts the residuals sit between. Do not file them as unknowns.

3.2 FW-42 seed coefficients — NARROWED to exactly 2 half-ULP boundaries (Q12a)

CORRECTION (the single most important narrowing in this register) — carry FW-42 as TWO bytes, not "the whole table." An earlier framing held that the seed ROM's source coefficients are "not recoverable from this corpus," which a careless reader rounds up to "the seed table is unknown." That is wrong and overstates the wall. The transcendental-seed pass made both seed tables PROVEN-BY-EXECUTION: all 128 RECIP_Data8 + 128 RSQRT_Data8 bytes are read from .rodata AND reproduced bit-exact by the live recip0/rsqrt0 leaf over all 128 buckets at both fp16 and fp32, 0 mismatches. The .rodata table is OBSERVED / validated truth — a reimplementer copies those bytes and is correct by construction. What stays CARRIED is exactly: (i) the literal generator lineage (the program / fixed-point rounding that produced the bytes, in the out-of-carve FW-42 driver), and (ii) two entries where the analyst's recovered closed-form rounds one ULP off the ROM at a half-ULP boundary:

table	entry	shipped byte (re-confirmed)	closed-form	exact float	verdict
RECIP_Data8	i = 127	0x81 (129)	round(256/1.99609) = 128	128.2505	table = truth, form CARRIED
RSQRT_Data8	hi-range idx = 13	0xa5 (165)	164	164.4993 (near-tie)	table = truth, form CARRIED

So the wall moved from "the whole table is unverifiable lineage" to "254/256 bytes are closed-form-explained and execution-validated; 256/256 are execution-validated against the ROM; only 2 boundary roundings and the generator lineage are carried." The .rodata byte is the validated arbiter at both — the live leaf and the ROM agree; it is the INFERRED closed-form that misses by one ULP. This is D13 in the divergence catalog, and it lived on the measuring side, never the firmware. [HIGH/OBSERVED·exec — narrowing; CARRIED — 2 entries + lineage] closable-with-corpus (the FW-42 driver / a wider .rodata carve).

3.3 The recipqli full-context leg (Q1)

The single value-leaf residual in the entire 864-leaf oracle. 3 of 864 ≈ 0.35%. State it precisely: everything under the wall is proven — the 6-bit segment extract, the four QLI coefficient LUTs (base == ref, config-invariant), the two-substage split, the device round-trip. Only the value-producing soft-float FMA on top is gated, because it routes through a host soft-float dispatch object — call *0x38(%rax) ×2 where %rax derives from the saved xstate (arg0), re-confirmed at @0x87e518 / @0x87e5e9. A bare ctypes drive cannot populate slot 0x38: both NULL and zeroed xstate SIGSEGV (signal 11), fork-isolation-proven. The fp64 sub-stages (__0 @0x1b07e0, __1 @0x1b0870) tail-call the fp32 body and inherit the wall.

NOTE — this is the SIGSEGV-on-zeroed-state full-context leg, a driver gap, not a knowledge gap. The structure and tables are proven; only the live end-to-end value of three leaves is deferred. It is closable two ways: route a (the licensed full ISS single-stepping the leaf in cycle/turbo, reading the dest vreg via InstDone state introspection — closable-with-license) or route b (a live xstate from a device round-trip / the FW-42 full-iteration driver that populates the dispatch object — closable-with-hardware). The triage signature is exact: any leaf with call *0x..(%rax) where %rax came from xstate is heavy-leg-only — and recipqli is the only leaf in the entire oracle that carries it (fifteen seed-family leaves drive clean).

3.4 The FLIX-desync device interiors (corpus-wide MED ceiling)

The shipped device disassembler has IsaMaxInstructionSize = 32 and desyncs on the 512-bit FLIX/VLIW bundle stream: once mis-aligned, the cursor emits plausible-but-wrong per-instruction decodes until it resynchronizes. Everything above the desync line is HIGH — table bases, kernel_info entries, dispatch-table addresses, reset vectors, string-anchored structures, opcode membership — because those are cursor reads at known addresses that do not depend on a linear sweep. The per-instruction body bindings inside a desynced region are not byte-resolved.

NOTE — the methodology mitigates this without crossing it. Encoding is closed independently on the certified-perfect ISA cover; value semantics are closed by executing the simulator. Neither path walks the desynced linear stream. The desync limits narrative body-reading, not the encoding or value closures — which is why the corpus-wide value-semantics claim is unaffected by it. The wall has caught real errors (two desync literals mis-read as branch targets, later corrected — the flag doing its job). [wall HIGH/OBSERVED; interior bodies MED/OBSERVED] closable-with-corpus (a FLIX-aware disassembler config). This overlaps Q12c (Maverick FLIX interiors are the secondary, image-gated sub-case).

3.5 The empty MODULE_SCHEDULE reservation matrices (Q12c)

1994 / 1994 <MODULE_SCHEDULE> matrices are structurally empty in the shipped XML. The class-level 1+1 FLIX co-issue ceiling IS recovered (the 1564-record INSTR_SCHEDULE table); only the fine per-port single-issue reservation below it is unrecoverable, because the matrix bodies are simply not present.

GOTCHA — this is fundamental for the per-port claim, but the bound is sound. Do not fabricate a per-port matrix. No read of this XML produces bodies it does not contain. The correct substitute for a reimplementer's scheduler is the FLIX-slot + per-format mul-capable-slot model under the 1+1 ceiling. [empty HIGH/OBSERVED; per-port LOW]

4. What this register is not (the meta-finding, restated)

It bears repeating because it is the whole point: this register contains no missing decode, no missing datapath, and no missing value semantics. Read the table top to bottom and every residual falls into one of six honest boundaries:

• a driver away — Q1 (recipqli soft-float dispatch);
• a checkout away — W1/W2/W3, W4/Q8, Q2, Q7, Q9, Q11, Q12a (corpus items absent here);
• a license key away — Q3, Q4 (present-but-gated cycle/fault observables);
• a runtime capture away — Q6 (host-loaded PWP content), Q12e (value-immaterial ordering);
• a follow-on static pass away — Q10 (the C16 reassembly);
• or fundamentally out of scope — Q5 (stochastic rounding), Q12c (per-port reservation).

That partition is the answer to the register's framing question. Across ~2.09M differential comparisons the firmware value oracle had zero value defects; all thirteen catalogued divergences (D1–D13) lived in the reference model, the lift, the harness, or an inferred reconstruction-form — never the firmware. The value oracle is the arbiter, and the binary won every time. The residuals are honestly-flagged provenance / lineage / dynamic-state / v5-interior boundaries — the precise edge between what this reference proves today and what one key, one checkout, or one capture would unlock tomorrow.

5. Adversarial self-verification — the five strongest claims, re-challenged

Each re-tested against the committed pages and the binary before publishing; a claim survives only if a second independent witness agrees.

1. "None of the residuals is a missing decode / datapath / value-semantics." Challenge: could a residual secretly be a behavioral hole dressed as a provenance question? Re-test: the thesis is stated verbatim on three independent pages (orientation §B.3, confidence-model §3, capstone §3); the value oracle is closed at 864/864 (re-confirmed nm \| rg -c module__xdref_ = 864) with ~95% execution-validated and 0 firmware value bugs over ~2.09M comparisons; the encoding is a certified-perfect 1,534/1,534 cover; structs are ~169/171 field-exact. Every row in §1 names a corpus / license / capture / static / scope closer — not one names "a body we cannot decode." Survives. [HIGH/INFERRED]

2. "FW-42 is narrowed to exactly two half-ULP seed boundaries, not the whole table." Challenge: is this a real narrowing or a re-label? Re-test: both seed ROMs are read from .rodata (re-confirmed: RECIP_Data8[127] = 0x81, RSQRT_Data8 hi-idx=13 = 0xa5, tails …81 81 81 / b4 b3 b2 b0) and reproduced bit-exact by the live leaf (0 mismatches, both widths, transcendental-seed §4). 254/256 bytes are closed-form-explained and 256/256 are execution-validated; only the generator lineage and the two boundary roundings stay CARRIED. The narrowing is bounded and named, not asserted. Survives. [HIGH/OBSERVED·exec — narrowing; CARRIED — 2 entries + lineage]

3. "recipqli is the lone value-leaf wall; its full-context leg is the SIGSEGV-on-zeroed-state soft-float FMA." Challenge: could other leaves also fault, or could recipqli be drivable with a different shape? Re-test: nm confirms exactly 3 recipqli leaves (@0x87df20/0x1b07e0/0x1b0870 — re-confirmed); objdump confirms call *0x38(%rax) at the two cited sites (@0x87e518/0x87e5e9) and the 6-bit seg-extract (shr $0x19 / and $0x3f); NULL and zeroed xstate both SIGSEGV (fork-proven). All fifteen other seed-family leaves drive clean. The structure/tables/base == ref are proven; only the FMA value is gated. Survives. [HIGH/OBSERVED·exec]

4. "arch_id 36 is INFERRED; ct37 is OBSERVED — the split is real." Challenge: is 36 maybe byte-read after all, or 37 maybe also extrapolated? Re-test: ct37 has the cmp $0x25,%edi range-guard + the movabs $0x2020202000 bitmask (bit 37) + the maverick_libs @0x9b9050 switch arm + 62 MAVERICK_*_get$ accessors (re-confirmed this pass) — multiple independent witnesses. arch_id 36 has no cmp $0x24 anywhere (re-confirmed: 0 matches) and no v5 NCFW image (MAVERICK_Q7_CC_TOP*_get = 0). The split holds exactly. Survives. [ct37 HIGH/OBSERVED; arch_id 36 MED/INFERRED]

5. "v5 Q7_CC_TOP is FILE-ABSENT and the empty MODULE_SCHEDULE matrices are fundamental." Challenge: could either be an unread-but-present region rather than a true absence? Re-test: MAVERICK_Q7_CC_TOP*_get = 0 (re-confirmed — a positive absence, parallel to SUNDA's missing Q7_CC_TOP); the libncfw ladder compares only {0x05,0x0c,0x14,0x1c}. The MODULE_SCHEDULE matrices are 1994/1994 empty in the file — no read produces bodies the file does not contain; the 1+1 ceiling from the 1564-record INSTR_SCHEDULE table is the sound bound. Both are honest absences, not unfinished tasks. Survives. [absence HIGH/OBSERVED; per-port LOW]

All five survive re-challenge against the committed pages and the binary.

Single strongest CORRECTION on this page: carry FW-42 as exactly two .rodata bytes (RECIP_Data8[127] = 0x81, RSQRT_Data8 hi-idx=13 = 0xa5) plus the generator lineage — not "the whole seed table is unverifiable." Both seed ROMs are execution-validated (read from .rodata and reproduced bit-exact by the live leaf over all 128 buckets at both precisions, 0 mismatches); the recovered closed-form explains 254/256 bytes; the two that resist are half-ULP boundary roundings where the ROM byte is the validated truth and the closed-form is INFERRED and wrong by one ULP. A reimplementer ships the ROM bytes, not the formula, at exactly those two indices, and is correct everywhere. Overstating this wall as "the seed table is unknown" is the single easiest way to mis-rate a residual that is, in fact, 256/256 execution-validated.

6. See also

• The Reimplementation Verdict & Open-Questions Map — the orientation companion: the navigable map this register is the exhaustive long form of.
• The Confidence & Walls Model — the [CONF/PROV] tag system and the reference wall taxonomy (§3 closability, §4 the named-wall defining subset).
• The Coverage Ledger — the per-axis, per-lane coverage accounting behind the five headline fractions (the what-is-covered counterpart to this what-is-not).
• The residual-owning pages: VAL — transcendental seed (Q12a, the FW-42 narrowing) · VAL — capstone matrix (Q1, the recipqli wall; the value verdict) · VAL — regfile-bridge / divergence catalog (the D1–D13 catalog) · MAVERICK (NC-v5) profile (W1–W4) · ISS oracle synthesis (Q3/Q4, the license heavy leg) · collectives architecture-synthesis (Q11) · microarch synthesis (Q7, Q12c) · DMA descriptor model (Q12e) · DVE read-state (Q3, Q6).

Source: DX-SYN-09 (the consolidated residual synthesis); all constants re-confirmed against the shipped binaries this pass (lawful interoperability RE — recovered symbols/strings are binary-derived and citeable).