# RPTP synthetic instruction catalog

- **Status date:** 2026-10-31
- **Scope:** narrow synthetic ELF32/EM_MIPS differential spike, not a complete R5900 implementation and not a compatibility list.
- **Provenance:** [ADR-0003](DECISIONS/ADR-0003-sealed-source-clean-room-policy.md), [PROVENANCE_PLAN.md](PROVENANCE_PLAN.md) and [REFERENCES.md](REFERENCES.md).
- **Gate status:** Gate 3 is not passed. This catalog records what the current synthetic tests actually exercise. A documented IR, candidate-only CFG analysis, conservative known-edge graph reachability and deterministic C++ lowering now exist for the same subset, including the `DADDIU` immediate, the `DADDU` full 64-bit register addition, the `SUBU` 32-bit register subtraction, the `ANDI`, `ORI`, `XORI`, `SLTI` and `SLTIU` immediates, the `LUI` shifted immediate, the `SLL` shift, the `AND`/`OR`/`XOR`/`NOR` register operations, the `SLT` signed comparison, the `SLTU` unsigned comparison and the aligned `LD`/`SD` doubleword pair; see [IR_CFG.md](IR_CFG.md). The `tools/rptp` decoder, host IR, oracle and generated-C++ path also supports the six ordinary branch forms `BLEZ`, `BGTZ`, `BLTZ`, `BGEZ`, `BLTZAL` and `BGEZAL` with their always-executed delay slots and unconditional link writes, and the eight branch-likely forms below with architectural delay-slot nullification; both families are cited to `RPTP-REF-015`. It also implements the nine doubleword shift forms `DSLL`, `DSLL32`, `DSLLV`, `DSRA`, `DSRA32`, `DSRAV`, `DSRL`, `DSRL32` and `DSRLV` below (`RPTP-REF-015` pages 168–176), which the legacy IR/lowering pipeline continues to reject. The same package implements the six byte and halfword memory forms `LB`, `LBU`, `LH`, `LHU`, `SB` and `SH`, and the native harness now executes them too; the evidence is described in the prose below instead of separate table rows because no table row records a separate generated-C++ differential for them yet. The native harness also executes the eight HI/LO integer forms `MFHI`, `MFLO`, `MTHI`, `MTLO`, `MULT`, `MULTU`, `DIV` and `DIVU` against an RPTP test-defined HI/LO model that matches the canonical oracle; they are prose-only here because no generated-C++ differential drives them yet, and the harness rejects nonzero reserved fields on `MULT`/`MULTU`/`DIV`/`DIVU` more strictly than the canonical decoder. The same package and the native harness also implement the four COP1 transfer forms `LWC1`, `SWC1`, `MFC1` and `MTC1` against an RPTP test-defined 32-entry 32-bit FPR bank; COP1 arithmetic, moves, conversions, `CFC1`, `CTC1` and `BC1` remain unsupported. Known-edge reachability adds no instruction or runtime behavior.

## Verification levels

- **Native differential:** the decoder, oracle and emitted C++ are exercised by a synthetic program; the generated native state equals the oracle state under a supported host compiler. The Windows/MSVC run is recorded in [VERIFICATION_LOG.md](VERIFICATION_LOG.md).
- **Native IR-lowering differential:** the validated IR is passed to a separate lowering module, the generated C++ state machine is compiled, and its native state equals the oracle state. This proves the synthetic-generated path only. The current tests are in `tests/test_ir_lowering.py`, `tests/test_instruction_logical.py`, `tests/test_instruction_lui.py`, `tests/test_instruction_register_logic.py`, `tests/test_instruction_nor.py`, `tests/test_instruction_slt.py`, `tests/test_instruction_sltu.py`, `tests/test_instruction_slti.py`, `tests/test_instruction_sltiu.py`, `tests/test_instruction_daddiu.py`, `tests/test_instruction_daddu.py`, `tests/test_instruction_sll.py`, `tests/test_instruction_subu.py` and `tests/test_instruction_ld_sd.py`.
- **Static IR/CFG:** the decoder feeds a host-Python IR and fail-closed block analysis. Known-edge graph traversal follows only recorded successors and does not prove native lowering, runtime behavior, dead code or function extents. The current tests are in `tests/test_ir_cfg.py` and `tests/test_cfg_reachability.py`.
- **Decode only:** the decoder recognizes the encoding but no native differential exists. No instruction currently has this status.
- **Unsupported:** the decoder rejects the encoding explicitly. Unsupported instructions are never silently skipped or lowered to an approximation.

## Supported synthetic subset

| Instruction | Encoding | Current model | Evidence | Limits |
|---|---|---|---|---|
| `ADDIU` | I-type opcode `0x09` | Sign-extend the 16-bit immediate; add the low 32 bits of `rs`; sign-extend the 32-bit result to the spike's 64-bit register array. | Gate 0 fixture and native differential; [GATE0_REVIEW.md](GATE0_REVIEW.md). | This is the spike's 32-bit model, not complete 64-bit R5900 arithmetic. |
| `DADDIU` | I-type opcode `0x19` | Sign-extend the 16-bit immediate, add it to the full modeled 64-bit `rs`, and retain the low 64 bits of the sum; integer overflow does not trap in this model. A write to `$zero` is discarded. | Separate synthetic fixture with positive and negative signed-32-bit boundary crossings, literal oracle assertions, native IR-lowering differential, modulo-64 boundary harness and malformed-metadata tests in `tests/test_instruction_daddiu.py`. | Added after the Gate 0 disposition. The operation is a narrow synthetic model cross-checked with `RPTP-REF-015`, not a complete R5900 compatibility claim. |
| `DADDU` | SPECIAL funct `0x2D`, `shamt=0` | Add the full modeled 64-bit `rs` and `rt`; retain the low 64 bits of the sum; integer overflow does not trap. A write to `$zero` is discarded. | Separate synthetic fixture with 64-bit wraparound, 32-bit boundary crossings, source/destination aliasing, literal oracle assertions, native IR-lowering differential, boundary helper harness and malformed-metadata tests in `tests/test_instruction_daddu.py`. | Added after the Gate 0 disposition. The operation is a narrow synthetic model cross-checked with `RPTP-REF-015`, not a complete R5900 compatibility claim. |
| `ADDU` | SPECIAL funct `0x21`, `shamt=0` | Add the low 32 bits of `rs` and `rt`; sign-extend the 32-bit result to 64 bits. | Gate 0 fixture and native differential. | No overflow trap and no 64-bit R5900 claim. |
| `SUBU` | SPECIAL funct `0x23`, `shamt=0` | Subtract the low 32 bits of `rt` from the low 32 bits of `rs` modulo 2^32; sign-extend the 32-bit result to 64 bits. A write to `$zero` is discarded. | Separate 20-instruction synthetic program, upper-bit truncation and wraparound cases, `INT32_MIN` boundary, source/destination aliasing, literal oracle assertions, native IR-lowering differential, boundary helper harness and malformed-metadata tests in `tests/test_instruction_subu.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The 32-bit subtract is cross-checked with `RPTP-REF-015`; that reference marks a non-word-value source UNPREDICTABLE, and this model resolves that case deterministically by truncating to the low 32 bits, matching the accepted `ADDU` model. No overflow trap, and `SUB` (funct `0x22`) and `DSUBU` (funct `0x2E`) remain unsupported. |
| `SLL` | SPECIAL funct `0x00`, `rs=0`, 5-bit `shamt` | Shift the low 32 bits of `rt` left by `shamt`, truncate to 32 bits and sign-extend the result into the spike's 64-bit register array. A write to `$zero` is discarded; nonzero `rs` is rejected and the all-zero word remains `NOP`. | Separate 17-instruction synthetic program, literal oracle assertions, native IR-lowering differential, helper boundary harness and malformed-metadata tests in `tests/test_instruction_sll.py`. | Added after the Gate 0 disposition. The 32-bit shift is cross-checked with `RPTP-REF-002`; the sign-extension bridge into the 64-bit register array is an RPTP test-defined model, not a complete R5900 claim. |
| `DSLL` | SPECIAL funct `0x38`, `rs=0` | Shift the low 64 bits of `rt` left by the 5-bit `shamt`; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `rs` is rejected. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 168. | Added after the Gate 0 disposition. The 64-bit width and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. |
| `DSLL32` | SPECIAL funct `0x3C`, `rs=0` | Shift the low 64 bits of `rt` left by `shamt + 32`; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `rs` is rejected. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 169. | Added after the Gate 0 disposition. The 64-bit width, `shamt + 32` amount and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. |
| `DSLLV` | SPECIAL funct `0x14`, `shamt=0` | Shift the low 64 bits of `rt` left by `GPR[rs] & 63`; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `shamt` is rejected fail-closed by the decoder and the native harness. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 170. | Added after the Gate 0 disposition. The 64-bit width, low-six-bit amount and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. The canonical decoder and the native harness both reject a nonzero reserved `shamt` fail-closed. |
| `DSRL` | SPECIAL funct `0x3A`, `rs=0` | Shift the low 64 bits of `rt` right by the 5-bit `shamt` with zero fill; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `rs` is rejected. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 174. | Added after the Gate 0 disposition. The 64-bit width and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. |
| `DSRL32` | SPECIAL funct `0x3E`, `rs=0` | Shift the low 64 bits of `rt` right by `shamt + 32` with zero fill; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `rs` is rejected. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 175. | Added after the Gate 0 disposition. The 64-bit width, `shamt + 32` amount and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. |
| `DSRLV` | SPECIAL funct `0x16`, `shamt=0` | Shift the low 64 bits of `rt` right by `GPR[rs] & 63` with zero fill; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `shamt` is rejected fail-closed by the decoder and the native harness. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 176. | Added after the Gate 0 disposition. The 64-bit width, low-six-bit amount and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. The canonical decoder and the native harness both reject a nonzero reserved `shamt` fail-closed. |
| `DSRA` | SPECIAL funct `0x3B`, `rs=0` | Shift the low 64 bits of `rt` right by the 5-bit `shamt`, replicating the sign bit; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `rs` is rejected. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 171. | Added after the Gate 0 disposition. The 64-bit width, sign replication and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. |
| `DSRA32` | SPECIAL funct `0x3F`, `rs=0` | Shift the low 64 bits of `rt` right by `shamt + 32`, replicating the sign bit; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `rs` is rejected. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 172. | Added after the Gate 0 disposition. The 64-bit width, `shamt + 32` amount, sign replication and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. |
| `DSRAV` | SPECIAL funct `0x17`, `shamt=0` | Shift the low 64 bits of `rt` right by `GPR[rs] & 63`, replicating the sign bit; replace the low 64 bits of `rd` and sign-extend bit 63 into the modeled 128-bit register pair. A write to `$zero` is discarded; nonzero `shamt` is rejected fail-closed by the decoder and the native harness. | Decode/CFG/IR/oracle assertions, native C++ differential and deterministic generated source in `tests/test_instruction_dshift.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 173. | Added after the Gate 0 disposition. The 64-bit width, low-six-bit amount, sign replication and 128-bit sign extension are RPTP test definitions; the legacy IR/lowering pipeline rejects it. The canonical decoder and the native harness both reject a nonzero reserved `shamt` fail-closed. |
| `AND` | SPECIAL funct `0x24`, `shamt=0` | Bitwise AND the full modeled 64-bit `rs` and `rt`; write `rd`. A write to `$zero` is discarded. | Separate 24-instruction register-logical program, oracle checks and native IR-lowering differential in `tests/test_instruction_register_logic.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The 64-bit operation width is an RPTP test-defined model, not a complete R5900 hardware claim. |
| `OR` | SPECIAL funct `0x25`, `shamt=0` | Bitwise OR the full modeled 64-bit `rs` and `rt`; write `rd`. A write to `$zero` is discarded. | Separate 24-instruction register-logical program, oracle checks and native IR-lowering differential in `tests/test_instruction_register_logic.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The 64-bit operation width is an RPTP test-defined model, not a complete R5900 hardware claim. |
| `XOR` | SPECIAL funct `0x26`, `shamt=0` | Bitwise XOR the full modeled 64-bit `rs` and `rt`; write `rd`. A write to `$zero` is discarded. | Separate 24-instruction register-logical program, oracle checks and native IR-lowering differential in `tests/test_instruction_register_logic.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The 64-bit operation width is an RPTP test-defined model, not a complete R5900 hardware claim. |
| `NOR` | SPECIAL funct `0x27`, `shamt=0` | Bitwise NOR the full modeled 64-bit `rs` and `rt`; write `rd`. A write to `$zero` is discarded. | Separate 16-instruction register-logical program, oracle checks and native IR-lowering differential in `tests/test_instruction_nor.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The 64-bit operation width is an RPTP test-defined model, not a complete R5900 hardware claim. |
| `SLT` | SPECIAL funct `0x2A`, `shamt=0` | Compare the full modeled 64-bit `rs` and `rt` as signed two's-complement values; write `1` to `rd` if `rs < rt`, otherwise `0`. A write to `$zero` is discarded. | Separate 20-instruction signed-comparison program, oracle checks, native IR-lowering differential and `INT64_MIN`/`INT64_MAX` helper boundary check in `tests/test_instruction_slt.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The signed 64-bit comparison is an RPTP test-defined model, not a complete R5900 hardware claim. |
| `SLTU` | SPECIAL funct `0x2B`, `shamt=0` | Compare the full modeled 64-bit `rs` and `rt` as unsigned integers; write `1` to `rd` if `rs < rt`, otherwise `0`. A write to `$zero` is discarded. | Separate 26-instruction unsigned-comparison program, oracle checks, native IR-lowering differential and unsigned-boundary helper checks in `tests/test_instruction_sltu.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The unsigned 64-bit comparison is an RPTP test-defined model, not a complete R5900 hardware claim. |
| `SLTI` | I-type opcode `0x0A` | Sign-extend the 16-bit immediate and compare it with the full modeled 64-bit `rs` as a signed two's-complement value; write `1` to `rt` if `rs < immediate`, otherwise `0`. A write to `$zero` is discarded. | Separate synthetic fixture, literal oracle assertions, native IR-lowering differential, signed-64/immediate-boundary checks and malformed-IR/lowering tests in `tests/test_instruction_slti.py`. | Added after the Gate 0 disposition; generic encoding/sign-extension/signed-comparison details are cross-checked with `RPTP-REF-014`. The full 64-bit model is test-defined, not a complete R5900 hardware claim. |
| `SLTIU` | I-type opcode `0x0B` | Sign-extend the 16-bit immediate, then compare the modeled 64-bit `rs` and immediate as unsigned integers; write `1` to `rt` if `rs < immediate`, otherwise `0`. A write to `$zero` is discarded. | Separate synthetic fixture, literal oracle assertions, native IR-lowering differential, sign-extension/`UINT64_MAX` boundary checks and malformed-IR/lowering tests in `tests/test_instruction_sltiu.py`. | Added after Gate 0; `RPTP-REF-014` confirms the combination of sign-extended immediate and unsigned comparison. The 64-bit model is test-defined, not a complete R5900 hardware claim. |
| `ANDI` | I-type opcode `0x0C` | Zero-extend the 16-bit immediate; bitwise AND with the full modeled 64-bit `rs`; write `rt` (bits 16..63 of result are zero). A write to `$zero` is discarded. | Separate synthetic logical-immediate program, oracle checks and native IR-lowering differential in `tests/test_instruction_logical.py`; 64-bit width boundary tests in `tests/test_instruction_logical_width.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The zero-extended 16-bit immediate model is synthetic. |
| `ORI` | I-type opcode `0x0D` | Zero-extend the 16-bit immediate; bitwise OR with the full modeled 64-bit `rs`; write `rt` (upper bits of `rs` are preserved). A write to `$zero` is discarded. | Separate synthetic ORI program and native differential in `tests/test_instruction_ori.py`; also exercised by `tests/test_instruction_logical.py` and `tests/test_instruction_logical_width.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. Full 64-bit logical operation corrected 2026-10-26 (P1 audit finding F1). |
| `XORI` | I-type opcode `0x0E` | Zero-extend the 16-bit immediate; bitwise XOR with the full modeled 64-bit `rs`; write `rt` (upper bits of `rs` are preserved). A write to `$zero` is discarded. | Separate synthetic logical-immediate program, oracle checks and native IR-lowering differential in `tests/test_instruction_logical.py`; 64-bit width boundary tests in `tests/test_instruction_logical_width.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. Full 64-bit logical operation corrected 2026-10-26 (P1 audit finding F1). |
| `LUI` | I-type opcode `0x0F`, with `rs=0` | Shift the raw 16-bit immediate left 16 bits, concatenate 16 zero bits, and sign-extend the 32-bit result to 64 bits. A write to `$zero` is discarded; nonzero `rs` is rejected. | Separate synthetic LUI program, oracle checks, IR metadata checks, malformed IR rejection and native IR-lowering differential in `tests/test_instruction_lui.py`. | Added after the Gate 0 disposition; it is not part of the accepted Gate 0 fixture scope. The shifted/sign-extended model is synthetic and limited to the listed reference. |
| `LW` | I-type opcode `0x23` | Sign-extend the 16-bit offset; form a 32-bit effective address; require 4-byte alignment and initialized guest memory; sign-extend the loaded word to 64 bits. An unaligned access fails closed before any byte is read. | Gate 0 fixture and native differential; unaligned runtime/oracle rejection, the no-partial-access check and cross-path coverage in `tests/test_runtime_execution.py`, `tests/test_cross_path_equivalence.py` and `runtime/tests/runtime_tests.cpp`. | The 4-byte alignment requirement is an RPTP fail-closed model policy, not a hardware alignment-exception, MMIO, TLB, cache or timing model. |
| `SW` | I-type opcode `0x2B` | Sign-extend the 16-bit offset; form a 32-bit effective address; require 4-byte alignment; store the low 32 bits of `rt`. An unaligned store fails closed before any byte is written. | Gate 0 fixture and native differential; unaligned runtime/oracle rejection, the no-partial-write check and cross-path coverage in `tests/test_runtime_execution.py`, `tests/test_cross_path_equivalence.py` and `runtime/tests/runtime_tests.cpp`. | The 4-byte alignment requirement is an RPTP fail-closed model policy, not a hardware alignment-exception, MMIO, TLB, cache or timing model. |
| `LD` | I-type opcode `0x37` | Sign-extend the 16-bit offset; form a 32-bit effective address; require 8-byte alignment and initialized guest memory for both words; combine the low word at the address and the high word at address + 4 into an unsigned 64-bit value without sign extension; a write to `$zero` is discarded after the read. | Separate 20-instruction doubleword program with literal oracle values, native IR-lowering differential, byte-pair boundary harness, unaligned/uninitialized/partial-word rejection and malformed-metadata tests in `tests/test_instruction_ld_sd.py`; runtime differential and fault tests in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`. | Added after the Gate 0 disposition. The two-word composition, 32-bit effective address and fail-closed alignment check are RPTP test definitions; `RPTP-REF-015` (LD p. 207) supports the encoding, the signed offset and the doubleword transfer, but not a 64-bit address wrap, TLB or compatibility-mode claim. |
| `SD` | I-type opcode `0x3F` | Sign-extend the 16-bit offset; form a 32-bit effective address; require 8-byte alignment; store the low 32 bits of `rt` at the address and the high 32 bits at address + 4. | Separate 20-instruction doubleword program with literal oracle values, native IR-lowering differential, byte-pair boundary harness, unaligned/crossing/unmapped rejection and malformed-metadata tests in `tests/test_instruction_ld_sd.py`; runtime differential and fault tests in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`. | Added after the Gate 0 disposition. The two-word split, 32-bit effective address and fail-closed alignment check are RPTP test definitions; `RPTP-REF-015` (SD p. 327) supports the encoding, the signed offset and the doubleword transfer, but not a 64-bit address wrap, TLB or compatibility-mode claim. `LDC2` (`0x36`) and `SDC2` (`0x3E`) remain unsupported. |
| `BEQ` | I-type opcode `0x04` | Compare the 64-bit register values; target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes. | Gate 0 fixture and native differential. | The static target must be inside the spike's code model. Full R5900 branch behavior is not claimed. |
| `BNE` | I-type opcode `0x05` | Compare the 64-bit register values; target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes. | Gate 0 fixture and native differential. | The static target must be inside the spike's code model. Full R5900 branch behavior is not claimed. |
| `BLEZ` | I-type opcode `0x06` | Compare the signed low 64 bits of `rs` with zero; `rs <= 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes on both outcomes. | Taken/not-taken cases for every plain form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_plain.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 83. | Added after the Gate 0 disposition. Architectural branch behavior only; the `tools/rptp_ir.py`/`tools/rptp_lower.py` pipeline has no `BLEZ` and rejects it. No branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BGTZ` | I-type opcode `0x07` | Compare the signed low 64 bits of `rs` with zero; `rs > 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes on both outcomes. | Taken/not-taken cases for every plain form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_plain.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 81. | Added after the Gate 0 disposition. Architectural branch behavior only; the legacy lowerer rejects it. No branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BLTZ` | REGIMM opcode `0x01`, `rt=0x00` | Compare the signed low 64 bits of `rs` with zero; `rs < 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes on both outcomes. | Taken/not-taken cases for every plain form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_plain.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 85. | Added after the Gate 0 disposition. Architectural branch behavior only; the legacy lowerer rejects it. No branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BGEZ` | REGIMM opcode `0x01`, `rt=0x01` | Compare the signed low 64 bits of `rs` with zero; `rs >= 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes on both outcomes. | Taken/not-taken cases for every plain form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_plain.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 76. | Added after the Gate 0 disposition. Architectural branch behavior only; the legacy lowerer rejects it. No branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BLTZAL` | REGIMM opcode `0x01`, `rt=0x10` | Compare the signed low 64 bits of `rs` with zero; `rs < 0` is taken. `GPR[31]` is written with `pc + 8` unconditionally, including when the branch is not taken; `rs = 31` is rejected fail-closed because the approved reference defines that result as UNPREDICTABLE; the rejection is an RPTP policy, not a modelled hardware exception. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes on both outcomes. | Taken/not-taken cases for every plain form, unconditional link assertions, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_plain.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 86. | Added after the Gate 0 disposition. Architectural branch behavior only; the legacy lowerer rejects it. No branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BGEZAL` | REGIMM opcode `0x01`, `rt=0x11` | Compare the signed low 64 bits of `rs` with zero; `rs >= 0` is taken. `GPR[31]` is written with `pc + 8` unconditionally, including when the branch is not taken; `rs = 31` is rejected fail-closed because the approved reference defines that result as UNPREDICTABLE; the rejection is an RPTP policy, not a modelled hardware exception. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes on both outcomes. | Taken/not-taken cases for every plain form, unconditional link assertions, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_plain.py`; runtime differential in `tests/test_runtime_execution.py` and `runtime/tests/runtime_tests.cpp`; cross-path coverage in `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 77. | Added after the Gate 0 disposition. Architectural branch behavior only; the legacy lowerer rejects it. No branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BEQL` | I-type opcode `0x14` | Compare the low 64 bits of `rs` and `rt` for equality; target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when the branch is taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 75. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BNEL` | I-type opcode `0x15` | Compare the low 64 bits of `rs` and `rt` for inequality; target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 91. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BLEZL` | I-type opcode `0x16` | Compare the signed low 64 bits of `rs` with zero; `rs <= 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 84. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BGTZL` | I-type opcode `0x17` | Compare the signed low 64 bits of `rs` with zero; `rs > 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 82. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BLTZL` | REGIMM opcode `0x01`, `rt=0x02` | Compare the signed low 64 bits of `rs` with zero; `rs < 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 89. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BGEZL` | REGIMM opcode `0x01`, `rt=0x03` | Compare the signed low 64 bits of `rs` with zero; `rs >= 0` is taken. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 80. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BLTZALL` | REGIMM opcode `0x01`, `rt=0x12` | Compare the signed low 64 bits of `rs` with zero; `rs < 0` is taken. `GPR[31]` is written with `pc + 8` unconditionally, including when the branch is not taken; `rs = 31` is rejected fail-closed because the approved reference defines that result as UNPREDICTABLE; the rejection is an RPTP policy, not a modelled hardware exception. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, unconditional link assertions, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 87. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `BGEZALL` | REGIMM opcode `0x01`, `rt=0x13` | Compare the signed low 64 bits of `rs` with zero; `rs >= 0` is taken. `GPR[31]` is written with `pc + 8` unconditionally, including when the branch is not taken; `rs = 31` is rejected fail-closed because the approved reference defines that result as UNPREDICTABLE; the rejection is an RPTP policy, not a modelled hardware exception. Target is `pc + 4 + (sign_extend(imm) << 2)` masked to 32 bits. The delay slot executes only when taken; otherwise it is nullified and execution continues at `pc + 8`. | Taken/not-taken cases for every likely form, unconditional link assertions, delay-slot register and memory effects, `$zero`, CFG successors, deterministic generated C++ and native differential in `tests/test_instruction_branch_likely.py`; [RPTP-REF-015](REFERENCES.md), p. 78. | Architectural likely-branch behavior only; no branch-prediction timing, exception or complete R5900 pipeline claim. |
| `J` | J-type opcode `0x02` | Combine the high four bits of `pc + 4` with the word's low 26-bit target field shifted left by two. The delay slot executes. | Gate 0 fixture and native differential. | The static target must be inside the spike's code model. |
| `JAL` | J-type opcode `0x03` | Write `pc + 8` to `ra`; jump to the J-type target; the delay slot executes. | Gate 0 fixture and native differential. | No full R5900 call convention or pipeline behavior is claimed. |
| `JR` | SPECIAL funct `0x08`, `rt=rd=shamt=0` | Set the next control target to the low 32 bits of `rs`; the delay slot executes. A target outside the code model halts the synthetic program. | Gate 0 fixture and native differential. | No return-address stack, speculation or exception behavior. |
| `NOP` | SPECIAL word `0x00000000` | No architectural effect. | Gate 0 fixture and native differential. | Only the encoded all-zero NOP is recognized. |
| `LWC1` | I-type opcode `0x31` | Load the aligned little-endian 32-bit word at `GPR[base] + sign_extend(imm)` into the low word of `FPR[ft]`. The upper word of the FPR is unchanged. | Decode fields, CFG, host IR `cop1_load`, literal oracle values, deterministic generated C++, runtime differential and cross-path coverage in `tests/test_instruction_cop1_transfers.py`, `tests/test_runtime_execution.py`, `runtime/tests/runtime_tests.cpp` and `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 228. | Architecture-level transfer only. The 32-entry 32-bit FPR bank, the 4-byte alignment requirement and fail-closed `EXEC_MEMORY_FAULT` policy are RPTP test definitions. FPU pipeline, rounding, denormals, exceptions and timing are not modeled. |
| `SWC1` | I-type opcode `0x39` | Store the low 32-bit word of `FPR[ft]` as an aligned little-endian word at `GPR[base] + sign_extend(imm)`. | Decode fields, CFG, host IR `cop1_store`, literal oracle values, deterministic generated C++, runtime differential and cross-path coverage in `tests/test_instruction_cop1_transfers.py`, `tests/test_runtime_execution.py`, `runtime/tests/runtime_tests.cpp` and `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 358. | Same non-goals as `LWC1`; unaligned `SWC1` fails closed. |
| `MFC1` | COP1 opcode `0x11`, `rs = MF = 0x00`, bits `10:0` zero | Sign-extend the low 32-bit word of `FPR[fs]` into the 64-bit `GPR[rt]`. A `rt` of zero is discarded. | Decode fields including reserved-bit rejection, CFG, host IR `fpr_read`, literal oracle values, deterministic generated C++, runtime differential and cross-path coverage in `tests/test_instruction_cop1_transfers.py`, `tests/test_runtime_execution.py`, `runtime/tests/runtime_tests.cpp` and `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 250. | The reference defines the 64-bit result as UNPREDICTABLE; sign-extension is an RPTP test definition, not a hardware claim. No FPU pipeline or exception behavior. |
| `MTC1` | COP1 opcode `0x11`, `rs = MT = 0x04`, bits `10:0` zero | Write the low 32-bit word of `GPR[rt]` into the low word of `FPR[fs]`. The upper FPR word is unchanged. | Decode fields including reserved-bit rejection, CFG, host IR `fpr_write`, literal oracle values, deterministic generated C++, runtime differential and cross-path coverage in `tests/test_instruction_cop1_transfers.py`, `tests/test_runtime_execution.py`, `runtime/tests/runtime_tests.cpp` and `tests/test_cross_path_equivalence.py`; [RPTP-REF-015](REFERENCES.md), p. 273. | Architecture-level transfer only; no FPU pipeline, rounding or exception behavior. `FPR0` is writable in this model. |

## Minimal IR, CFG and lowering coverage

[IR_CFG.md](IR_CFG.md) defines the additional contract for the same subset. It records raw words, normalized operands, explicit signed/zero-extended immediates, `$zero` destination handling, control-flow classes, direct targets, delay-slot ownership, deterministic basic blocks, candidate-only function entries and conservative known-edge graph traversal from an explicit block root. `tools/rptp_lower.py` consumes the validated IR and emits deterministic C++20 for the same synthetic model, with native differential coverage in `tests/test_ir_lowering.py`, `tests/test_instruction_logical.py`, `tests/test_instruction_lui.py`, `tests/test_instruction_register_logic.py`, `tests/test_instruction_nor.py`, `tests/test_instruction_slt.py` and `tests/test_instruction_sltu.py`, `tests/test_instruction_daddiu.py`, `tests/test_instruction_daddu.py`, `tests/test_instruction_sll.py`, `tests/test_instruction_subu.py` and `tests/test_instruction_ld_sd.py`.

The lowering tests cover the supported operations, both branch outcomes, direct and indirect control flow, delay slots, `$zero` writes, 32-bit wraparound, zero-extended logical immediates, signed `SLTI` and unsigned `SLTIU` immediate comparisons, the shifted/sign-extended LUI immediate, full modeled 64-bit register logical operations including NOR, signed 64-bit `SLT` comparison, unsigned 64-bit `SLTU` comparison, the full modeled 64-bit `DADDU` register addition, the 32-bit `SUBU` register subtraction, the 32-bit `SLL` shift, word memory load/store and the aligned `LD`/`SD` doubleword pair. A separate one-instruction fixture covers uninitialized-memory failure. The reachability tests cover only existing stored edges, unresolved indirect transfers and the explicit direct-call continuation caveat. These tests do not add product runtime behavior, runtime reachability, function extents or a complete R5900 model. Gate 3 remains in progress.

The separate `tools/rptp` package (decoder, host IR/CFG, oracle and deterministic C++ emitter) also implements the six ordinary branch forms `BLEZ`, `BGTZ`, `BLTZ`, `BGEZ`, `BLTZAL` and `BGEZAL`. Their CFG records both the direct target and the fallthrough, and the delay slot is part of the control block and executes on both outcomes. `tests/test_instruction_branch_plain.py` covers taken and not-taken cases for all six forms, delay-slot register and memory effects, `$zero`, unconditional link writes, the `rs = 31` rejection, deterministic generated source and a native differential against the oracle. The encodings, PC-relative target, conditions, always-executed delay slot, unconditional `GPR[31] = PC + 8` link and `rs = 31` restriction are cited to `RPTP-REF-015` pages 76, 77, 81, 83, 85 and 86; the low-64-bit comparison, 32-bit PC masking, trace/step accounting and fail-closed `rs = 31` rejection are RPTP test definitions. The native C++ execution harness in `runtime/src/execution.cpp` implements the same six forms; `runtime/tests/runtime_tests.cpp` and `tests/test_runtime_execution.py` add direct C++ cases and an independent CLI-versus-oracle differential, and `tests/test_cross_path_equivalence.py` executes them through the Python oracle, generated C++ and `rptp-run` on one shared program. The older `tools/rptp_ir.py`/`tools/rptp_lower.py` pipeline remains unchanged and does not implement these six forms; `BEQ`/`BNE` are its only conditional branches.

The separate `tools/rptp` package (decoder, host IR/CFG, oracle and deterministic C++ emitter) is the path that implements the eight branch-likely forms in this catalog. Its CFG records both the direct target and the fallthrough for every likely branch; nullification is an execution-time effect, not a reachability filter. `tests/test_instruction_branch_likely.py` covers taken and not-taken cases for all eight forms, delay-slot register and memory effects, `$zero`, unconditional link writes, the `rs = 31` rejection, deterministic generated source and a native differential against the oracle. The encodings, PC-relative target, conditions, take-only delay-slot execution and unconditional link write are cited to `RPTP-REF-015` pages 75, 78, 80, 82, 84, 87, 89 and 91; the low-64-bit comparison, 32-bit PC masking, trace/step accounting and fail-closed `rs = 31` rejection are RPTP test definitions. The native C++ execution harness in `runtime/src/execution.cpp` implements the same eight forms: a taken branch executes its delay slot once, a not-taken branch still validates the delay-slot word but skips its register, memory, trace and step effects and continues at `pc + 8`, and the link forms write `GPR[31] = pc + 8` on both outcomes. Direct C++ cases and an independent CLI-versus-oracle differential are in `runtime/tests/runtime_tests.cpp` and `tests/test_runtime_execution.py`. The older `tools/rptp_ir.py`/`tools/rptp_lower.py` pipeline described above remains unchanged and does not implement branch-likely forms.

The same `tools/rptp` package implements the nine doubleword shift forms `DSLL`, `DSLL32`, `DSLLV`, `DSRA`, `DSRA32`, `DSRAV`, `DSRL`, `DSRL32` and `DSRLV`. `tests/test_instruction_dshift.py` covers decoding, CFG support, host IR lowering, literal oracle results, deterministic generated source and a native differential against the oracle for every form, including the immediate `sa`/`sa + 32` amounts, the masked variable amount and arithmetic sign replication. The encodings, immediate and variable shift amounts and arithmetic sign replication are cited to `RPTP-REF-015` pages 168–176; the 64-bit width and 128-bit register-pair sign extension are RPTP test definitions. The native C++ execution harness in `runtime/src/execution.cpp` implements the same nine forms and rejects a nonzero reserved `rs` (immediate forms) or `shamt` (variable forms) with `EXEC_UNSUPPORTED_INSTRUCTION`; `runtime/tests/runtime_tests.cpp` and `tests/test_runtime_execution.py` add direct C++ cases and an independent CLI-versus-oracle differential with literal 64-bit results, and `tests/test_cross_path_equivalence.py` drives all nine forms through the Python oracle, generated C++ and `rptp-run` on one shared program. The canonical decoder and the native harness both reject a variable-form word whose reserved `shamt` is nonzero fail-closed (`valid=False`/`supported=False` with `Reserved encoding fields are non-zero.`, and `EXEC_UNSUPPORTED_INSTRUCTION` respectively); that reserved-field case was closed on 2026-10-31, while the E4 umbrella and its remaining failure classes stay open in [RISKS.md](RISKS.md). `SPECIAL` funct `0x15` is not a defined form and remains unsupported. The older `tools/rptp_ir.py`/`tools/rptp_lower.py` pipeline rejects all nine forms as unsupported; `tests/test_pipeline_path_contract.py` pins that rejection.

The same `tools/rptp` package implements the six byte and halfword memory forms `LB` (opcode `0x20`), `LH` (`0x21`), `LBU` (`0x24`), `LHU` (`0x25`), `SB` (`0x28`) and `SH` (`0x29`) through the decoder, host IR, oracle and deterministic emitter. The native C++ harness in `runtime/src/execution.cpp` executes them: `LB` sign-extends and `LBU` zero-extends the loaded byte into the 64-bit register model, `LH` sign-extends and `LHU` zero-extends two little-endian bytes, `SB` stores the low 8 bits at any address, and `LH`/`LHU`/`SH` require a 2-byte-aligned effective address and fail closed with `EXEC_MEMORY_FAULT` before any access; an access outside or across the single loaded segment also fails closed. The store log is chronological with an explicit byte width per entry (`1`, `2` or `4`; `SD` remains two width-4 entries), and `rptp-run` emits `"width"` next to `"address"` and `"value"`. Evidence: oracle cases and unaligned halfword failures in `tests/test_oracle_edges.py`; direct harness cases and an independent CLI-versus-oracle differential with literal loaded values and stored widths in `runtime/tests/runtime_tests.cpp` and `tests/test_runtime_execution.py`; width-aware normalizers in `tests/test_cross_path_equivalence.py` and `tests/test_native_legacy_equivalence.py`. The encodings and the signed offset follow `RPTP-REF-015`, but page numbers for these six entries are not recorded in this catalog; the 2-byte alignment requirement, the chronological width-tagged store log and the segment-boundary fault policy are RPTP test definitions. `LWL`, `LWR`, `SWL` and `SWR` remain unsupported, and the older `tools/rptp_ir.py`/`tools/rptp_lower.py` pipeline rejects all six forms.

## Retail boot-code census (read-only, 2026-10-29)

`tools/rptp_census.py` counts aligned 4-byte words in the file-backed `PT_LOAD` ranges of the boot executable inside owner-authorized ISOs and classifies each word with the current synthetic IR decoder. Unsupported words are reported only as raw encoding identifiers (`special_0xNN`, `regimm_0xNN`, `opcode_0xNN`); the tool assigns no instruction names and no semantics. The census reads in memory, writes nothing, has explicit boot-byte and word limits and reuses the inspector's validated ELF parser. It is planning input for Gate 3, not decoder support: no instruction becomes supported by being counted. Results for the eight authorized samples and the report contract are in [BOOT_CENSUS.md](BOOT_CENSUS.md); tests are in `tests/test_boot_census.py`.

## Explicitly unsupported

- All other opcodes, SPECIAL functions, immediate forms and register-field combinations are rejected with an explicit `Unsupported ...` diagnostic.
- The synthetic model implements only the four COP1 transfer forms in the table above. COP1 arithmetic, FPU moves and conversions, `CFC1`, `CTC1`, `BC1` and every other COP1 encoding remain unsupported and fail closed. The model does not implement MMI, COP0, exceptions, interrupts, TLB, caches, EE kernel services, IOP, DMA, VU, GS, SPU2, CDVD, controllers, memory cards, timers or hardware timing. It does not model an FPU pipeline, rounding modes, denormals or IEEE exception flags.
- The spike expects ELF32 little-endian `EM_MIPS`, one executable `PT_LOAD` segment and static control-flow targets inside that code model. It does not load retail PS2 executables.

## Verification commands

Through a Visual Studio developer environment for the MSVC path:

```powershell
python -m unittest tests.test_instruction_logical -v
python -m unittest tests.test_instruction_lui -v
python -m unittest tests.test_instruction_register_logic -v
python -m unittest tests.test_instruction_nor -v
python -m unittest tests.test_instruction_slt -v
python -m unittest tests.test_instruction_sltu -v
python -m unittest tests.test_instruction_ori -v
python -m unittest tests.test_instruction_daddu -v
python -m unittest tests.test_instruction_subu -v
python -m unittest tests.test_instruction_ld_sd -v
python -m unittest tests.test_instruction_branch_plain -v
python -m unittest tests.test_instruction_branch_likely -v
python -m unittest tests.test_instruction_dshift -v
python -m unittest tests.test_ir_cfg -v
python -m unittest tests.test_cfg_reachability -v
python -m unittest tests.test_ir_lowering -v
powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\run-msvc.ps1
```

The separate logical-immediate, LUI, register-logical, NOR, SLT, SLTU, DADDIU, DADDU, SUBU, ORI, LD/SD, ordinary-branch, branch-likely and doubleword-shift tests use runtime-generated synthetic ELFs and do not modify the registered Gate 0 fixture. The IR/CFG test also builds a synthetic ELF at test time and checks the unchanged Gate 0 and ORI hashes. The reachability tests use synthetic instruction maps and mutate no registered fixture. The lowering tests build separate synthetic ELFs and leave the registered fixture untouched. None of these additions modifies the registered Gate 0 fixture. The IR-lowering path is the only path that compiles generated C++ from the IR; the original spike remains a separate differential path.