phase-36: T7 burst — five more banks (631 bodies) and two concurrency defects the agents found

Banked: func_80136334 (126, all four levers), func_8016B234 (129), func_8015FBE0 (125), func_80143D28 (131),
func_8014D820 (126 of 128). 27,984 -> 26,714 sites.
  lever_census --check: 26,714 pin/asm sites, 26,714 marked !FAKE, 0 UNMARKED — OK

THE MISSING CALL ARGUMENT CLASS IS NOW CONFIRMED SIX TIMES, independently, by six agents that never saw each other's
work: a7, a8, a11, a12, a13, a25. In every case the source declares a call with fewer arguments than the callee really
takes — m2c drops arguments at unprototyped and indirect call sites — and the register pin was hired to fake the
instruction the missing argument would have produced. Mechanisms differ and were each proven on bytes: combine.c:1458's
added_sets_2 gate; set_preference (global.c:1535/1589) applied ahead of first-fit at :997-1030, the argument copy
degenerating to a self-move deleted at toplev.c:3142 / jump.c:424-443 so it costs zero instructions; and reorg.c:3374's
liveness half, where restoring the argument adds a use to CALL_INSN_FUNCTION_USAGE (reorg.c:428) so a delay-slot steal
is refused. No generator can reach any of it: every family rewrites statements and declarations, none edits a call's
argument list.

Two concurrency defects, both found by agents rather than by me:
- the includers cache wrote through a FIXED temp name, so concurrent processes clobbered each other's os.replace and the
  loser saw FileNotFoundError, which reads like a compiler crash on the candidate. Now a unique tempfile per process.
- the agent brief now mandates PACK/scratch/ for helper scripts and dumps, and says to retry once when a --try failure
  names something that is not your own text. Three agents had scripts overwritten mid-run by another agent.

One valuable negative: func_80178970 does not close, and the agent proved why by construction rather than by exhaustion
— only a call or a return writes $v0 in plain C, and a return's hard write is always emitted after its guarding branch,
so combine deletes the call-result copy (combine.c:914-917, use_crosses_set_p at :10127-10130; the SMALL_REGISTER_CLASSES
arm at :944-957 is not defined for MIPS). Its early-return rewrite still improves the source from 6 to 2 and reads
better than the pinned original.

docs/lever-progress.tsv

@@ -19,3 +19,4 @@ date	milestone	head	sites_AB	pins	asm	bodies_AB	distinct_AB	marked	unmarked	gte_
 2026-09-10	S102 T7 a7 — func_801287B8: a truncated local extern was faking a  pin; the missing call argument restored through a function-pointer cast (127 bodies)	bb0e95c7c	29013	16862	12151	8878	1279	29013	0	462	314	1590	50	7428	445	76
 2026-09-10	S102 T7 a4 — func_8016C49C: one do-while on the function's LAST statement doubles a loop-note reference weight and flips allocno_compare (126 bodies)	9f5b22176	28887	16736	12151	8752	1278	28887	0	462	314	1590	50	7428	445	76
 2026-09-10	S102 T7 burst — a8/a12/a18/a19 banked (132+118+119+134 bodies): the call-arity class twice, a MEM_IN_STRUCT_P alias flip, and a sequence-point split	fb6c857f7	27984	15965	12019	8249	1275	27984	0	462	314	1590	50	7428	445	76
+2026-09-10	S102 T7 burst — a5/a9/a11/a16/a25 banked; the MISSING CALL ARGUMENT class confirmed six times independently (m2c dropped arguments at unprototyped and indirect call sites)	c6b380fcd	26714	15324	11390	7612	1271	26714	0	462	314	1590	50	7428	445	76

docs/levers.md

@@ -65,6 +65,7 @@ counted, not marked). E, F and G belong to the canonical type layer and are the
 | 2026-09-10 | S102 T7 a7 — func_801287B8: a truncated local extern was faking a  pin; the missing call argument restored through a function-pointer cast (127 bodies) | 16862 | 12151 | **29013** | 8878 | 1279 | 462 | 314 | 1590 | 50 | 7428 | 445 | 76 | `bb0e95c7c` |
 | 2026-09-10 | S102 T7 a4 — func_8016C49C: one do-while on the function's LAST statement doubles a loop-note reference weight and flips allocno_compare (126 bodies) | 16736 | 12151 | **28887** | 8752 | 1278 | 462 | 314 | 1590 | 50 | 7428 | 445 | 76 | `9f5b22176` |
 | 2026-09-10 | S102 T7 burst — a8/a12/a18/a19 banked (132+118+119+134 bodies): the call-arity class twice, a MEM_IN_STRUCT_P alias flip, and a sequence-point split | 15965 | 12019 | **27984** | 8249 | 1275 | 462 | 314 | 1590 | 50 | 7428 | 445 | 76 | `fb6c857f7` |
+| 2026-09-10 | S102 T7 burst — a5/a9/a11/a16/a25 banked; the MISSING CALL ARGUMENT class confirmed six times independently (m2c dropped arguments at unprototyped and indirect call sites) | 15324 | 11390 | **26714** | 7612 | 1271 | 462 | 314 | 1590 | 50 | 7428 | 445 | 76 | `c6b380fcd` |
 
 ### The campaign — every batch, from the ledger (derived on every render)
 
@@ -132,7 +133,17 @@ counted, not marked). E, F and G belong to the canonical type layer and are the
 | `a12p` | 2026-09-10 | E | 0 | 0 | 0 | 117 | 117 |
 | `a19p` | 2026-09-10 | E | 0 | 0 | 0 | 399 | 133 |
 | `a18p` | 2026-09-10 | E | 0 | 0 | 0 | 124 | 124 |
-| **total** | | | **17,119** | **20,778** | **283** | **6,269** | **4,472** |
+| `a5` | 2026-09-10 | E | 0 | 0 | 0 | 4 | 1 |
+| `a5p` | 2026-09-10 | E | 0 | 0 | 0 | 500 | 125 |
+| `a9` | 2026-09-10 | E | 0 | 0 | 0 | 2 | 1 |
+| `a9p` | 2026-09-10 | E | 0 | 0 | 0 | 256 | 128 |
+| `a25` | 2026-09-10 | E | 0 | 0 | 0 | 2 | 1 |
+| `a16` | 2026-09-10 | E | 0 | 0 | 0 | 1 | 1 |
+| `a25p` | 2026-09-10 | E | 0 | 0 | 0 | 250 | 125 |
+| `a16p` | 2026-09-10 | E | 0 | 0 | 0 | 130 | 130 |
+| `a11` | 2026-09-10 | E | 0 | 0 | 0 | 1 | 1 |
+| `a11p` | 2026-09-10 | E | 0 | 0 | 0 | 124 | 124 |
+| **total** | | | **17,119** | **20,778** | **283** | **7,539** | **5,109** |
 
 *Generated by `tools/lever_progress.py --render` from `.run/P36/census/lever_census.json` and `.run/P36/delever/ledger.jsonl`; the series lives in `docs/lever-progress.tsv` (R75: published numbers are generated, never typed).*