diff --git a/.run/P36/agents/METHOD_S103.md b/.run/P36/agents/METHOD_S103.md
index 0959385fb..325ecbc3e 100644
--- a/.run/P36/agents/METHOD_S103.md
+++ b/.run/P36/agents/METHOD_S103.md
@@ -354,3 +354,20 @@
     - Two of six closed by grepping the TU for a distinctive constant and porting the lever-free sibling's spelling verbatim
       (`related.txt` had neither) — R71 first, tables second. `--try TU FN FILE` WITHOUT `--body` scores a spliced whole TU: that is
       how a prototype/signature change is tested read-only.
+24. **S105 f10 (`ov_SC06_006_jr_8017DB90`, 4 of 4 plain C, zero levers) — THREE of four were TYPE changes no statement generator reaches:**
+    - A pointer whose block mixes pointer STORES with a global LOAD: raw-pointer stores are scalar varying MEMs, so `anti_dependence`
+      (`sched.c:845-866`, `memrefs_conflict_p` `:614`) pins every load above every store and the boosted `lui` lands beside its
+      consumer (the constant out-ranks the flags load in `qty_compare_1`); a body-local STRUCT type with `mem/s` field accesses
+      (`expr.c:4873-4888`) drops the edge, the `lui` rises, the ranks flip. ~1,000 raw-pointer spellings had best 2.
+    - A laundered global base `p = &SYM`: cast it to a body-local struct (`pa = (Shake *)&D_801F8A10;`) and read fields — cse never
+      replaces a plain REG address (cost 1) with the symbol (cost 2, `find_best_addr` `cse.c:2622-2740`, `mips.c:1600`), so offset-0
+      reads stay `lh 0(rBase)` without a launder while `(plus p 2)` folds absolute; the target's RE-READ after pointer stores is
+      `note_mem_written` → `invalidate_memory` (`cse.c:1707-1715`) invalidating only `in_struct` entries.
+    - `p[k]` read beside `w = *(u32 *)p` and OR-ed with a piece of `w` → `((w >> 8k) & 0xFF)`: combine's `make_extraction` (MEM
+      case) folds it to the same `lbu`, the orphaned shift temp supplies the 8-byte frame — delete the pad beside it (the `src/800.c`
+      siblings spell it this way; R71 across ALL of `src/`).
+    - A delay-slot ALU insn built from the compare's own operands whose destination is "wrong" through the following block →
+      `if (c) { d = E; goto L; }` (the difference in its own then-block becomes a global pseudo; reorg fills the slot from it); and
+      d12 as a two-statement rule (`n = byte; n = tbl[n]; n -= 1;` — the one-statement form loads into a temp). `if (X - Y > 0)` is
+      NOT folded to `X > Y` by gcc 2.7.2 — a probe for "the difference is computed before the branch".
+    - **Ask the (g) structs question BEFORE enumerating statement orders whenever a block mixes pointer stores and a global load.**
diff --git a/.run/P36/census/lever_census.json b/.run/P36/census/lever_census.json
index 6356cee11..21e97d1ac 100644
--- a/.run/P36/census/lever_census.json
+++ b/.run/P36/census/lever_census.json
@@ -62,7 +62,7 @@
    "instruction/direct": 202,
    "instruction/via-macro": 22,
    "keepalive/direct": 328,
-   "launder/direct": 577,
+   "launder/direct": 576,
    "launder/via-macro": 42,
    "verbatim-body/direct": 2682
   }
@@ -115,23 +115,23 @@
  },
  "classes": {
   "A": {
-   "bodies": 1332,
-   "distinct_bodies": 501,
+   "bodies": 1328,
+   "distinct_bodies": 497,
    "file_scope": 0,
-   "in_bodies": 2157,
+   "in_bodies": 2152,
    "kinds": {
-    "pin": 2157
+    "pin": 2152
    },
-   "marked": 2157,
-   "sites": 2157,
+   "marked": 2152,
+   "sites": 2152,
    "tus": 1075,
    "unmarked": 0
   },
   "B": {
-   "bodies": 4599,
-   "distinct_bodies": 666,
+   "bodies": 4598,
+   "distinct_bodies": 665,
    "file_scope": 13,
-   "in_bodies": 11171,
+   "in_bodies": 11170,
    "kinds": {
     "asm-body": 13,
     "barrier": 241,
@@ -140,11 +140,11 @@
     "gte-unsigned": 270,
     "instruction": 224,
     "keepalive": 328,
-    "launder": 619,
+    "launder": 618,
     "verbatim-body": 2682
    },
-   "marked": 2359,
-   "sites": 11184,
+   "marked": 2358,
+   "sites": 11183,
    "tus": 1425,
    "unmarked": 8825
   },
@@ -250,9 +250,9 @@
  "coverage": {
   "asm": {
    "comment_dead": 6781,
-   "live": 14985,
+   "live": 14979,
    "macro_block": 194,
-   "raw": 21960
+   "raw": 21954
   },
   "attribute": {
    "comment_dead": 0,
@@ -268,9 +268,9 @@
   },
   "register": {
    "comment_dead": 8575,
-   "live": 2207,
+   "live": 2202,
    "macro_block": 18,
-   "raw": 10800
+   "raw": 10795
   },
   "volatile": {
    "comment_dead": 2607,
@@ -291,15 +291,15 @@
   "via_macro": 94,
   "what": "GTE ops whose clobbers exceed the canonical macro's (a scheduling steer): class-B levers INSIDE the headline number since T5 (2026-09-09), marked, 0 at the close"
  },
- "head": "c2455f5d3",
+ "head": "ff22c1fba",
  "headers": 3181,
  "levers_AB": {
-  "asm": 1875,
-  "bodies": 1989,
-  "distinct_bodies": 683,
-  "marked": 4032,
-  "pins": 2157,
-  "sites": 4032,
+  "asm": 1874,
+  "bodies": 1985,
+  "distinct_bodies": 679,
+  "marked": 4026,
+  "pins": 2152,
+  "sites": 4026,
   "unmarked": 0,
   "what": "register pins + asm statements excluding GTE ops: the classes the phase drives to 0"
  },
@@ -446,17 +446,17 @@
    "$17": 26,
    "$18": 26,
    "$19": 16,
-   "$2": 755,
+   "$2": 753,
    "$20": 7,
    "$21": 5,
    "$22": 3,
    "$23": 6,
    "$25": 1,
-   "$3": 157,
+   "$3": 156,
    "$4": 489,
-   "$5": 370,
+   "$5": 369,
    "$6": 59,
-   "$7": 25,
+   "$7": 24,
    "$8": 23,
    "$9": 21,
    "7": 1,
@@ -464,29 +464,29 @@
    "a1": 2,
    "v0": 1
   },
-  "sites": 2157,
+  "sites": 2152,
   "sp": 0,
   "spelling": {
-   "__asm__": 2136,
+   "__asm__": 2131,
    "asm": 21
   },
   "volatile_qualified": 0,
   "zero": 54
  },
- "src_stamp": "2a1915c572d26c16",
+ "src_stamp": "c09a5e151b9e2105",
  "tus": 4121,
  "unclassified": 0,
  "union_AD": {
-  "bodies": 5755,
+  "bodies": 5751,
   "by_kind": {
    "main": 124,
    "md": 105,
-   "ov": 5361,
+   "ov": 5357,
    "resident": 6,
    "shared": 159
   },
   "copies_in_multi": 4849,
-  "distinct_bodies": 1016,
+  "distinct_bodies": 1012,
   "multi_copy_classes": 110
  },
  "verbatim_excluded": {
diff --git a/.run/P36/census/lever_census.txt b/.run/P36/census/lever_census.txt
index ffa4870a5..ff2f11b3d 100644
--- a/.run/P36/census/lever_census.txt
+++ b/.run/P36/census/lever_census.txt
@@ -1,26 +1,26 @@
 lever_census: 218 binaries · 4,121 TUs + 3,181 headers · coverage OK · unclassified 0 · verbatim excluded 13 fn / 14 sites (manifest 13)
-  coverage asm       raw  21960 = live  14985 + macro-block   194 + comment/dead  6781
-  coverage register  raw  10800 = live   2207 + macro-block    18 + comment/dead  8575
+  coverage asm       raw  21954 = live  14979 + macro-block   194 + comment/dead  6781
+  coverage register  raw  10795 = live   2202 + macro-block    18 + comment/dead  8575
   coverage volatile  raw   4372 = live   1683 + macro-block    82 + comment/dead  2607
   coverage builtin   raw    599 = live    445 + macro-block     0 + comment/dead   154
   coverage attribute raw     76 = live     76 + macro-block     0 + comment/dead     0
   class  sites  in-bodies  file-scope  bodies  distinct  TUs  marked  unmarked   kinds
-  A pins         2157      2157          0    1332       501  1075    2157         0   {'pin': 2157}
-  B asm         11184     11171         13    4599       666  1425    2359      8825   {'gte': 6357, 'gte-lever': 450, 'gte-unsigned': 270, 'barrier': 241, 'launder': 619, 'instruction': 224, 'asm-body': 13, 'keepalive': 328, 'verbatim-body': 2682}
+  A pins         2152      2152          0    1328       497  1075    2152         0   {'pin': 2152}
+  B asm         11183     11170         13    4598       665  1425    2358      8825   {'gte': 6357, 'gte-lever': 450, 'gte-unsigned': 270, 'barrier': 241, 'launder': 618, 'instruction': 224, 'asm-body': 13, 'keepalive': 328, 'verbatim-body': 2682}
   C volatile     1589      1437        152     495        94   609      14      1575   {'decl-body': 58, 'decl-file': 152, 'cast': 1377, 'param': 2}
   D register       50        50          0      47        47     6       0        50   {'register': 50}
   E asm-label    7802      1370       6432    1100       161  2090       0      7802   {'asm-label': 7802}
   F builtin       445       445          0     428        27   302       0       445   {'builtin': 445}
   G attribute      76         1         75       1         1    40       0        76   {'attribute': 76}
-  UNION A–D: 5,755 bodies · 1,016 distinct (addresses normalized) · 110 multi-copy classes holding 4,849 bodies · by kind {'ov': 5361, 'main': 124, 'shared': 159, 'md': 105, 'resident': 6}
-  THE PHASE'S NUMBER (pins + asm statements, GTE excluded): 4,032 sites in 1,989 bodies (683 distinct) · marked !FAKE 4,032 · UNMARKED 0
+  UNION A–D: 5,751 bodies · 1,012 distinct (addresses normalized) · 110 multi-copy classes holding 4,849 bodies · by kind {'shared': 159, 'ov': 5357, 'md': 105, 'main': 124, 'resident': 6}
+  THE PHASE'S NUMBER (pins + asm statements, GTE excluded): 4,026 sites in 1,985 bodies (679 distinct) · marked !FAKE 4,026 · UNMARKED 0
   orphan !FAKE markers (no pin/asm site on the line nor below): 0
   marked ordinary-C fakes kept by Drew's S104 ruling (a) (`do { } while (0)`, dead initialisers; NOT levers): 53
   GTE levers (clobbers beyond the canonical macro's): 450 sites (94 via a variant macro, 356 direct) · marked 450 · UNMARKED 0 · unsigned GTE statements 270
   per-TU asm macro definitions outside the GTE header: 314 {'gte': 150, 'launder': 154, 'instruction': 9, 'barrier': 1} (GTE variants 64)
-  pins: 2,157 · $0 54 · $sp 0 · with initializer 201 · volatile-qualified 0 · bare-name 6 · spellings {'__asm__': 2136, 'asm': 21}
+  pins: 2,152 · $0 54 · $sp 0 · with initializer 201 · volatile-qualified 0 · bare-name 6 · spellings {'__asm__': 2131, 'asm': 21}
   whole-body asm routines in C shells, manifest PERMANENT (hand asm, NOT levers): 22 routines · 2,682 sites (2,660 private copies + 22 shared headers); asm-bodies NOT permanent (levers): 13 site(s) ['func_8001E378:DECOMPILE-NOW', 'func_80020F34:DECOMPILE-NOW', 'func_800249F0:DECOMPILE-NOW', 'func_80025CBC:DECOMPILE-NOW', 'func_80026514:UNCERTAIN', 'func_800268D0:UNCERTAIN', 'func_80027058:DECOMPILE-NOW', 'func_80027200:DECOMPILE-NOW', 'func_800CBA44:DECOMPILE-NOW', 'func_8017D810:DECOMPILE-NOW', 'func_8017E26C:UNCERTAIN', 'func_80184440:DECOMPILE-NOW', 'func_801A3BCC:DECOMPILE-NOW']
-  asm kinds: {'asm-body/direct': 13, 'barrier/direct': 241, 'gte/direct': 197, 'gte/via-macro': 6160, 'gte-lever/direct': 356, 'gte-lever/via-macro': 94, 'gte-unsigned/direct': 270, 'instruction/direct': 202, 'instruction/via-macro': 22, 'keepalive/direct': 328, 'launder/direct': 577, 'launder/via-macro': 42, 'verbatim-body/direct': 2682}
+  asm kinds: {'asm-body/direct': 13, 'barrier/direct': 241, 'gte/direct': 197, 'gte/via-macro': 6160, 'gte-lever/direct': 356, 'gte-lever/via-macro': 94, 'gte-unsigned/direct': 270, 'instruction/direct': 202, 'instruction/via-macro': 22, 'keepalive/direct': 328, 'launder/direct': 576, 'launder/via-macro': 42, 'verbatim-body/direct': 2682}
   instruction mnemonics: {'la': 136, 'addiu': 22, 'addu': 22, 'RTP_SND': 22, '.section': 7, 'lui': 3, 'lh': 3, 'and': 2, 'mult': 1, 'mfhi': 1, 'sll': 1, 'li': 1, 'lw': 1, 'nop': 1, 'srl': 1}
   gte mnemonics: {'gte_ldv0': 759, 'gte_stlvnl': 593, 'gte_stsxy': 448, 'gte_rtps': 439, 'gte_stflg': 415, 'gte_rtpt': 352, 'gte_SetRotMatrix': 253, 'gte_stsxy3': 236, 'gte_SetTransMatrix': 231, 'gte_rtv0tr': 229, 'gte_ldv3c': 184, 'gte_ldv3': 177, 'gte_stsv': 161, 'lwc2': 158, 'gte_stsz4': 149, 'gte_stsz3': 147, 'gte_stszotz': 134, 'gte_dpcl': 134, 'gte_stclmv': 114, 'gte_stsxy3_f3': 111, 'gte_nclip': 108, 'gte_stopz': 108, 'gte_stsxy3c': 108, 'gte_rtir': 81, 'gte_stsxy3_ft3': 79, 'gte_ldclmv': 78, 'gte_avsz4': 56, 'gte_stotz': 52, 'gte_ldrgb': 30, 'gte_nccs': 25}
   asm-bearing macro definitions: 314 (20 names, 3 with >1 text) kinds {'gte': 150, 'launder': 154, 'instruction': 9, 'barrier': 1}
diff --git a/docs/lever-progress.tsv b/docs/lever-progress.tsv
index 7d33a1257..c2e9ee00d 100644
--- a/docs/lever-progress.tsv
+++ b/docs/lever-progress.tsv
@@ -74,3 +74,4 @@ date	milestone	head	sites_AB	pins	asm	bodies_AB	distinct_AB	marked	unmarked	gte_
 2026-09-11	S105 f8 (5)	36be9acef	4046	2163	1883	1995	689	4046	0	450	314	1589	50	7801	445	76
 2026-09-11	S105 comment-strip regen (2)	3d6111828	4044	2163	1881	1993	687	4044	0	450	314	1589	50	7801	445	76
 2026-09-11	S105 f9 (6)	c2455f5d3	4032	2157	1875	1989	683	4032	0	450	314	1589	50	7802	445	76
+2026-09-11	S105 f10 (4)	ff22c1fba	4026	2152	1874	1985	679	4026	0	450	314	1589	50	7802	445	76
diff --git a/docs/levers.md b/docs/levers.md
index c857d8086..2ef3ff039 100644
--- a/docs/levers.md
+++ b/docs/levers.md
@@ -120,6 +120,7 @@ counted, not marked). E, F and G belong to the canonical type layer and are the
 | 2026-09-11 | S105 f8 (5) | 2163 | 1883 | **4046** | 1995 | 689 | 450 | 314 | 1589 | 50 | 7801 | 445 | 76 | `36be9acef` |
 | 2026-09-11 | S105 comment-strip regen (2) | 2163 | 1881 | **4044** | 1993 | 687 | 450 | 314 | 1589 | 50 | 7801 | 445 | 76 | `3d6111828` |
 | 2026-09-11 | S105 f9 (6) | 2157 | 1875 | **4032** | 1989 | 683 | 450 | 314 | 1589 | 50 | 7802 | 445 | 76 | `c2455f5d3` |
+| 2026-09-11 | S105 f10 (4) | 2152 | 1874 | **4026** | 1985 | 679 | 450 | 314 | 1589 | 50 | 7802 | 445 | 76 | `ff22c1fba` |
 
 ### The campaign — every batch, from the ledger (derived on every render)
 
@@ -431,7 +432,8 @@ counted, not marked). E, F and G belong to the canonical type layer and are the
 | `s105_f8` | 2026-09-11 | E | 0 | 0 | 0 | 11 | 5 |
 | `s105_comment6` | 2026-09-11 | E | 0 | 0 | 0 | 2 | 2 |
 | `s105_f9` | 2026-09-11 | E | 0 | 0 | 0 | 12 | 4 |
-| **total** | | | **17,122** | **20,778** | **283** | **30,392** | **10,757** |
+| `s105_f10` | 2026-09-11 | E | 0 | 0 | 0 | 6 | 4 |
+| **total** | | | **17,122** | **20,778** | **283** | **30,398** | **10,761** |
 
 *Generated by `tools/lever_progress.py --render` from `.run/P36/census/lever_census.json` and `.run/P36/delever/ledger.jsonl`; the series lives in `docs/lever-progress.tsv` (R75: published numbers are generated, never typed).*
 
diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md
index ec7a75847..e728dccf1 100644
--- a/phase-ends/CURRENT_PHASE.md
+++ b/phase-ends/CURRENT_PHASE.md
@@ -2107,13 +2107,24 @@ accumulate here as the phase produces them.**
   4,032 pin/asm sites, 4,032 marked !FAKE, 0 UNMARKED — OK` (exit 0) → snapshot (4,044 → **4,032**). **Session: 48 of 48 drawn classes
   at 0.** New parked-by-name: func_80180A54 (signature), func_80186CE0 (carve: one record table for `D_801AFBD8..EC`).
 
-## 🛑 SESSION CHECKPOINT — S105 (2026-09-11, FINAL — the session's last commit follows this): T0–T6 ☑, **T7 RUNNING at Drew's cap of ONE agent (was two)**. 4,152 → **4,032 sites** this session (−120); 9 TU batches f1–f9, **48 of 48 drawn classes at 0** (35 plain C, 3 do-while-only, 10 minimum-lever incl. 4 parked signature changes + 1 parked carve), ALL banked — **f10 (ov_SC06_006, 4 classes) IN FLIGHT**; generators **R44–R46** + R22 fixed three ways (4 free banks, 3 of them shared headers on 141 objects); R22 `check-all: 218 passed, 0 failed of 218` at `c2455f5d3` | `lever_census --check` exit 0 (4,032 marked, 0 UNMARKED, 0 orphans)
+- **S105 (cont.) — f10 landed: 4 of 4 plain C, zero levers — three of them TYPE changes; R22 218/218; 4,032 → 4,026.** f10
+  (`ov_SC06_006_jr_8017DB90`, ≈325k tokens, 39 min): `func_80180AE8` 4 → 0 (a body-local struct type for the entity pointer — `mem/s`
+  field stores drop sched's anti-dependence, `sched.c:845-866` / `expr.c:4873-4888`; ~1,000 raw-pointer spellings had best 2),
+  `func_8017E078` 16 → 0 (`((w >> 8) & 0xFF)` for a byte read beside the word — combine's `make_extraction`; the main siblings' spelling;
+  pad deleted), `func_80180FE8` 17 → 0 (a struct-typed CAST of the laundered global base; launder + `$7` pin → 0), `func_8017E734` 21 → 0
+  (the byte and its table index as one variable + the difference in its own then-block). `bank_list.sh`: `IDENTICAL … KEPT` ×4
+  (`d89dc0c47`…`ff22c1fba`). f11 (`ov_SC06_018`, 4 classes) launched first. METHOD step 24 — **the structs question before statement
+  enumeration** (three of four closes were types: Drew's struct hypothesis proven again, now on a location overlay's entity pointer). R22
+  (`.run/P36/s105/r22_j.log`) **`check-all: 218 passed, 0 failed of 218`** (82 s) → baseline at `ff22c1fba` → `lever_census --check: 4,026
+  pin/asm sites, 4,026 marked !FAKE, 0 UNMARKED — OK` (exit 0) → snapshot (4,032 → **4,026**). **Session: 52 of 52 drawn classes at 0.**
+
+## 🛑 SESSION CHECKPOINT — S105 (2026-09-11, FINAL — the session's last commit follows this): T0–T6 ☑, **T7 RUNNING at Drew's cap of ONE agent (was two)**. 4,152 → **4,026 sites** this session (−126); 10 TU batches f1–f10, **52 of 52 drawn classes at 0** (39 plain C, 3 do-while-only, 10 minimum-lever incl. 4 parked signature changes + 1 parked carve), ALL banked — **f11 (ov_SC06_018, 4 classes) IN FLIGHT**; generators **R44–R46** + R22 fixed three ways (4 free banks, 3 of them shared headers on 141 objects); R22 `check-all: 218 passed, 0 failed of 218` at `ff22c1fba` | `lever_census --check` exit 0 (4,026 marked, 0 UNMARKED, 0 orphans)
 
 ### 0. How to use this block — READ THIS FIRST
 A fresh session reads CLAUDE.md's load order, replays this block verbatim, confirms the effort (S105 ran at `/effort high` on Opus 5 1M;
 every agent on Opus) and executes §2. **Drew's cap is ONE agent at a time** (his last retune, after the S105 close: "continue here. max
-concurrent agents of 1 now"). What may be in flight when this is read: **f10** (`src/ov_SC06_006/ov_SC06_006_jr_8017DB90.c`, 4 classes —
-`BRIEF_f10.md` names them) — a dead session's agent leaves `body.c` +
+concurrent agents of 1 now"). What may be in flight when this is read: **f11** (`src/ov_SC06_018/ov_SC06_018_jr_80187AEC.c`, 4 classes —
+`BRIEF_f11.md` names them); `BRIEF_f12.md` (ov_SC07_002, 3 classes) is built and waits — a dead session's agent leaves `body.c` +
 `mechanism.md` in its packs (R67): `--try` each, bank a 0, record the rest. The session limit cut two agents mid-run and Drew had them RESUMED by SendMessage to their ids (R67 held —
 every deliverable was on disk); an agent id survives a limit cut within a session, and an agent of a DEAD session is relaunched from
 its pack. The next draws: `mkbrief.py f11 <tu>` on the 6-class TUs of `pick.py` (ov_SC06_018, ov_SC07_002, ov_SC03_090, ov_SC06_032; `src/800.c`
@@ -2137,7 +2148,7 @@ git log --oneline -1 && git status --short | grep -v '^??' | wc -l
 - The free sweep is SPENT: every residue class has been judged by every family R2–R46 (S105 `s105_r43_*`, `s105_r44r22`, `s105_r45r46`).
 
 ### 2. NEXT
-1. Cap ONE: after f10 lands, `mkbrief.py f11 <next TU>` from `pick.py`'s order (the 5-class TUs:
+1. Cap ONE: after f11 lands launch f12, then `mkbrief.py f13 <next TU>` from `pick.py`'s order (the 5-class TUs:
    ov_SC03_090, ov_SC06_018, ov_SC06_032, ov_SC07_002, then the 4-class ones), skipping ARG-ONLY (`$4`–`$7`-only pins = the
    missing-parameter shape → structs phase) and the park list (S104 §2.4 + S105's four signature changes func_800385C0, func_80029D3C, func_80180FA4, func_80180A54 and
    the carve change func_80186CE0 — patches in their packs; add them to `pick.py`'s PARK set).