From 39e3e1851f2e17acb9cb12c5e9100101ab94a70d Mon Sep 17 00:00:00 2001
From: Drew T <50529377+Druthulu@users.noreply.github.com>
Date: Wed, 9 Sep 2026 02:45:58 -0600
Subject: [PATCH] =?UTF-8?q?phase-36:=20T3=20(tools)=20=E2=80=94=20tools/de?=
 =?UTF-8?q?lever.py=20the=20campaign=20tool:=20--plan/--apply=20(the=20fil?=
 =?UTF-8?q?e=20is=20the=20write=20unit,=20its=20final=20compile=20through?=
 =?UTF-8?q?=20every=20recipe=20the=20proof;=20'done'=20=3D=20a=20ledger=20?=
 =?UTF-8?q?fact=20keyed=20by=20the=20body's=20normalized=20text=20before/a?=
 =?UTF-8?q?fter;=20replay=20from=20an=20exemplar=20in=20one=20compile;=20!?=
 =?UTF-8?q?FAKE=20markers=20on=20class=20A/B=20survivors;=20--restore=20fr?=
 =?UTF-8?q?om=20inflight.json;=20--apply-body=20for=20T6/T7;=20a=20selftes?=
 =?UTF-8?q?t=20with=20a=20stub=20oracle),=20the=20launder-ASSIGNMENT=20rew?=
 =?UTF-8?q?rite=20(989=20of=204,793=20direct=20launders=20=E2=80=94=20dele?=
 =?UTF-8?q?ting=20them=20made=20cc1=202.7.2=20abort:=20the=20probe's=20'Do?=
 =?UTF-8?q?ne'=20error,=20reproduced=203/3),=20macro=20shapes=20(SHB=20del?=
 =?UTF-8?q?eted,=20a=20launder=20expression=20valued,=20compound=20macros?=
 =?UTF-8?q?=20refused=20for=20T5),=20the=20oracle's=20COMPILE-CRASH=20verd?=
 =?UTF-8?q?ict=20+=20judge=5Fall=20+=20the=20mtime=20restore,=20the=20cens?=
 =?UTF-8?q?us's=20src=5Fstamp/head,=20tools/delever=5Fcycle.sh=20(apply=20?=
 =?UTF-8?q?=E2=86=92=20R22=20=E2=86=92=20census=20=E2=86=92=20log=20+=20he?=
 =?UTF-8?q?adline=20=E2=86=92=20commit);=20selftest=20OK;=20census=2053,23?=
 =?UTF-8?q?4=20unchanged;=20calibration=20177/177;=20plan=20ov=5FSC04=5F01?=
 =?UTF-8?q?1=20=3D=2018=20files=20/=20176=20bodies=20/=20540=20sites;=20SE?=
 =?UTF-8?q?TUP=20+=20dictionary=20rows;=20kit=20corpus;=20T7=20waves=20nee?=
 =?UTF-8?q?d=20Drew's=20direct=20approval=20(decisions)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore                                    |    1 +
 .run/P36/census/lever_census.json             |    4 +-
 .run/P36/census/lever_census.txt              |    4 +-
 .run/P36/delever/calibration.json             |  352 ++---
 config/tool_dictionary.tsv                    |    3 +-
 decomp-architect/corpus/tools/INDEX.md        |    7 +-
 decomp-architect/corpus/tools/P10/delever.py  | 1251 +++++++++++++++--
 .../corpus/tools/P10/delever_cycle.sh         |   67 +
 .../corpus/tools/P10/delever_oracle.py        |   36 +-
 .../corpus/tools/P10/lever_census.py          |   17 +
 decomp-architect/tools/MANIFEST.md            |    7 +-
 docs/SETUP.md                                 |    3 +-
 docs/tool-index.md                            |    9 +-
 phase-ends/CURRENT_PHASE.md                   |   50 +-
 tools/delever.py                              | 1251 +++++++++++++++--
 tools/delever_cycle.sh                        |   67 +
 tools/delever_oracle.py                       |   36 +-
 tools/lever_census.py                         |   17 +
 18 files changed, 2688 insertions(+), 494 deletions(-)
 create mode 100644 decomp-architect/corpus/tools/P10/delever_cycle.sh
 create mode 100644 tools/delever_cycle.sh

diff --git a/.gitignore b/.gitignore
index 3a4c5d2093..88d8bd746b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -485,6 +485,7 @@ unsloth_compiled_cache/
 !/.run/P36/delever/*.log
 !/.run/P36/delever/*.json
 /.run/P36/delever/recipes.json
+/.run/P36/delever/inflight.json
 !/.run/P36/delever/*.jsonl
 !/.run/P36/delever/*.txt
 !/.run/P36/permuter/
diff --git a/.run/P36/census/lever_census.json b/.run/P36/census/lever_census.json
index 6999949d5b..8aa4707a06 100644
--- a/.run/P36/census/lever_census.json
+++ b/.run/P36/census/lever_census.json
@@ -229,8 +229,9 @@
   }
  },
  "coverage_ok": true,
- "elapsed_s": 40.0,
+ "elapsed_s": 36.0,
  "generated": "2026-09-09",
+ "head": "89676f096",
  "headers": 3181,
  "levers_AB": {
   "asm": 15514,
@@ -434,6 +435,7 @@
   "volatile_qualified": 136,
   "zero": 1337
  },
+ "src_stamp": "8be8c2a58e0ebac7",
  "tus": 4121,
  "unclassified": 0,
  "union_AD": {
diff --git a/.run/P36/census/lever_census.txt b/.run/P36/census/lever_census.txt
index a2b36071f1..ddc0ee44e9 100644
--- a/.run/P36/census/lever_census.txt
+++ b/.run/P36/census/lever_census.txt
@@ -12,7 +12,7 @@ lever_census: 218 binaries · 4,121 TUs + 3,181 headers · coverage OK · unclas
   E asm-label    7428      1005       6423     737       117  2080       0      7428   {'asm-label': 7428}
   F builtin       445       445          0     428        27   302       0       445   {'builtin': 445}
   G attribute      76         1         75       1         1    40       0        76   {'attribute': 76}
-  UNION A–D: 19,156 bodies · 2,537 distinct (addresses normalized) · 488 multi-copy classes holding 17,107 bodies · by kind {'ov': 18330, 'shared': 393, 'md': 213, 'main': 204, 'resident': 16}
+  UNION A–D: 19,156 bodies · 2,537 distinct (addresses normalized) · 488 multi-copy classes holding 17,107 bodies · by kind {'ov': 18330, 'md': 213, 'shared': 393, 'main': 204, 'resident': 16}
   THE PHASE'S NUMBER (pins + asm statements, GTE excluded): 53,234 sites in 15,679 bodies (2,227 distinct) · marked !FAKE 0 · UNMARKED 53,234
   pins: 37,720 · $0 1,337 · $sp 13 · with initializer 5,140 · volatile-qualified 136 · bare-name 76 · spellings {'__asm__': 37510, 'asm': 210}
   whole-body asm routines in C shells, manifest PERMANENT (hand asm, NOT levers): 22 routines · 2,682 sites (2,660 private copies + 22 shared headers); asm-bodies NOT permanent (levers): 13 site(s) ['func_8001E378:DECOMPILE-NOW', 'func_80020F34:DECOMPILE-NOW', 'func_800249F0:DECOMPILE-NOW', 'func_80025CBC:DECOMPILE-NOW', 'func_80026514:UNCERTAIN', 'func_800268D0:UNCERTAIN', 'func_80027058:DECOMPILE-NOW', 'func_80027200:DECOMPILE-NOW', 'func_800CBA44:DECOMPILE-NOW', 'func_8017D810:DECOMPILE-NOW', 'func_8017E26C:UNCERTAIN', 'func_80184440:DECOMPILE-NOW', 'func_801A3BCC:DECOMPILE-NOW']
@@ -25,4 +25,4 @@ lever_census: 218 binaries · 4,121 TUs + 3,181 headers · coverage OK · unclas
     src/shared/ov/func_80178004.h pins                   got 26     expected 26  OK
     ov_SC03_006 func_80184034 bare-name pins             got 3      expected 3  OK
     engine_prelude.h asm sites (a macro definition only) got 0      expected 0  OK
-  elapsed 40.0 s
+  elapsed 36.0 s
diff --git a/.run/P36/delever/calibration.json b/.run/P36/delever/calibration.json
index f9a78a0f3c..c2f7380ac0 100644
--- a/.run/P36/delever/calibration.json
+++ b/.run/P36/delever/calibration.json
@@ -1,7 +1,7 @@
 {
- "head": "a1407bdfc",
+ "head": "89676f096",
  "stamp": "b44c5a8a3423",
- "generated": "2026-09-09 01:50",
+ "generated": "2026-09-09 02:38",
  "aliases": [
   "main",
   "ov_SC03_014",
@@ -21,207 +21,207 @@
   "main": {
    "objects": 85,
    "identical": 85,
-   "seconds": 6.707000000000002,
-   "mean_s": 0.079
+   "seconds": 7.229000000000001,
+   "mean_s": 0.085
   },
   "ov_SC03_014": {
    "objects": 32,
    "identical": 32,
-   "seconds": 4.815,
-   "mean_s": 0.15
+   "seconds": 5.186000000000002,
+   "mean_s": 0.162
   },
   "ov_SC03_015": {
    "objects": 32,
    "identical": 32,
-   "seconds": 4.541,
-   "mean_s": 0.142
+   "seconds": 4.574999999999999,
+   "mean_s": 0.143
   },
   "ov_SC04_011": {
    "objects": 28,
    "identical": 28,
-   "seconds": 3.943,
+   "seconds": 3.9430000000000005,
    "mean_s": 0.141
   }
  },
  "per_object_seconds": {
-  "build/src/800.o": 0.752,
-  "build/src/800_b.o": 0.07,
-  "build/src/800_b_2.o": 0.329,
-  "build/src/800_b_o0a.o": 0.074,
-  "build/src/800_c.o": 0.195,
-  "build/src/800b2.o": 0.078,
-  "build/src/apicard1.o": 0.061,
-  "build/src/apicard2.o": 0.069,
-  "build/src/apicard3.o": 0.076,
-  "build/src/apicard4.o": 0.066,
-  "build/src/apicard5.o": 0.086,
-  "build/src/apicard6.o": 0.072,
-  "build/src/apicard7.o": 0.081,
-  "build/src/boot.o": 0.08,
-  "build/src/gap.o": 0.071,
-  "build/src/libapi1.o": 0.07,
-  "build/src/libapi2.o": 0.063,
-  "build/src/libc2_1.o": 0.064,
-  "build/src/libc2_2.o": 0.059,
-  "build/src/libcd1.o": 0.069,
-  "build/src/libcd2.o": 0.065,
-  "build/src/libetc.o": 0.062,
-  "build/src/libgpu.o": 0.059,
-  "build/src/libgpu2.o": 0.067,
-  "build/src/libgs1.o": 0.057,
-  "build/src/libgs2.o": 0.064,
-  "build/src/libgs3.o": 0.057,
-  "build/src/libgs4.o": 0.064,
-  "build/src/libgs5.o": 0.057,
-  "build/src/libgs6.o": 0.077,
-  "build/src/libgs7.o": 0.061,
-  "build/src/libgs8.o": 0.059,
-  "build/src/libgte1.o": 0.055,
-  "build/src/libgte10.o": 0.065,
-  "build/src/libgte11.o": 0.063,
-  "build/src/libgte12.o": 0.061,
-  "build/src/libgte13.o": 0.056,
-  "build/src/libgte14.o": 0.058,
-  "build/src/libgte15.o": 0.071,
-  "build/src/libgte16.o": 0.063,
-  "build/src/libgte17.o": 0.063,
-  "build/src/libgte18.o": 0.061,
-  "build/src/libgte19.o": 0.063,
-  "build/src/libgte2.o": 0.061,
-  "build/src/libgte20.o": 0.066,
-  "build/src/libgte21.o": 0.058,
-  "build/src/libgte22.o": 0.063,
-  "build/src/libgte23.o": 0.064,
-  "build/src/libgte24.o": 0.057,
-  "build/src/libgte25.o": 0.061,
-  "build/src/libgte26.o": 0.068,
-  "build/src/libgte27.o": 0.062,
-  "build/src/libgte28.o": 0.06,
+  "build/src/800.o": 0.785,
+  "build/src/800_b.o": 0.072,
+  "build/src/800_b_2.o": 0.317,
+  "build/src/800_b_o0a.o": 0.077,
+  "build/src/800_c.o": 0.206,
+  "build/src/800b2.o": 0.075,
+  "build/src/apicard1.o": 0.087,
+  "build/src/apicard2.o": 0.074,
+  "build/src/apicard3.o": 0.092,
+  "build/src/apicard4.o": 0.075,
+  "build/src/apicard5.o": 0.096,
+  "build/src/apicard6.o": 0.071,
+  "build/src/apicard7.o": 0.083,
+  "build/src/boot.o": 0.113,
+  "build/src/gap.o": 0.093,
+  "build/src/libapi1.o": 0.092,
+  "build/src/libapi2.o": 0.064,
+  "build/src/libc2_1.o": 0.071,
+  "build/src/libc2_2.o": 0.063,
+  "build/src/libcd1.o": 0.081,
+  "build/src/libcd2.o": 0.07,
+  "build/src/libetc.o": 0.073,
+  "build/src/libgpu.o": 0.076,
+  "build/src/libgpu2.o": 0.088,
+  "build/src/libgs1.o": 0.066,
+  "build/src/libgs2.o": 0.066,
+  "build/src/libgs3.o": 0.063,
+  "build/src/libgs4.o": 0.066,
+  "build/src/libgs5.o": 0.063,
+  "build/src/libgs6.o": 0.088,
+  "build/src/libgs7.o": 0.072,
+  "build/src/libgs8.o": 0.063,
+  "build/src/libgte1.o": 0.061,
+  "build/src/libgte10.o": 0.06,
+  "build/src/libgte11.o": 0.067,
+  "build/src/libgte12.o": 0.062,
+  "build/src/libgte13.o": 0.066,
+  "build/src/libgte14.o": 0.068,
+  "build/src/libgte15.o": 0.061,
+  "build/src/libgte16.o": 0.064,
+  "build/src/libgte17.o": 0.064,
+  "build/src/libgte18.o": 0.065,
+  "build/src/libgte19.o": 0.065,
+  "build/src/libgte2.o": 0.063,
+  "build/src/libgte20.o": 0.063,
+  "build/src/libgte21.o": 0.071,
+  "build/src/libgte22.o": 0.068,
+  "build/src/libgte23.o": 0.057,
+  "build/src/libgte24.o": 0.069,
+  "build/src/libgte25.o": 0.062,
+  "build/src/libgte26.o": 0.071,
+  "build/src/libgte27.o": 0.068,
+  "build/src/libgte28.o": 0.071,
   "build/src/libgte29.o": 0.068,
-  "build/src/libgte3.o": 0.069,
-  "build/src/libgte30.o": 0.069,
-  "build/src/libgte4.o": 0.065,
-  "build/src/libgte5.o": 0.065,
-  "build/src/libgte6.o": 0.061,
-  "build/src/libgte7.o": 0.058,
-  "build/src/libgte8.o": 0.059,
-  "build/src/libgte9.o": 0.068,
-  "build/src/libmcrd1.o": 0.082,
+  "build/src/libgte3.o": 0.067,
+  "build/src/libgte30.o": 0.081,
+  "build/src/libgte4.o": 0.07,
+  "build/src/libgte5.o": 0.07,
+  "build/src/libgte6.o": 0.07,
+  "build/src/libgte7.o": 0.064,
+  "build/src/libgte8.o": 0.062,
+  "build/src/libgte9.o": 0.074,
+  "build/src/libmcrd1.o": 0.088,
   "build/src/libmcrd2.o": 0.064,
-  "build/src/libpad1.o": 0.068,
-  "build/src/libpad2.o": 0.066,
-  "build/src/sgap.o": 0.066,
+  "build/src/libpad1.o": 0.076,
+  "build/src/libpad2.o": 0.078,
+  "build/src/sgap.o": 0.07,
   "build/src/sgap_2.o": 0.067,
-  "build/src/sgap_3.o": 0.073,
-  "build/src/sgap_4.o": 0.078,
-  "build/src/sgap_5.o": 0.065,
-  "build/src/sgap_6.o": 0.064,
-  "build/src/sgap_8.o": 0.076,
-  "build/src/snd1.o": 0.073,
-  "build/src/snd10.o": 0.07,
-  "build/src/snd11.o": 0.071,
-  "build/src/snd12.o": 0.063,
-  "build/src/snd2.o": 0.072,
-  "build/src/snd3.o": 0.068,
+  "build/src/sgap_3.o": 0.065,
+  "build/src/sgap_4.o": 0.076,
+  "build/src/sgap_5.o": 0.07,
+  "build/src/sgap_6.o": 0.071,
+  "build/src/sgap_8.o": 0.081,
+  "build/src/snd1.o": 0.079,
+  "build/src/snd10.o": 0.076,
+  "build/src/snd11.o": 0.076,
+  "build/src/snd12.o": 0.071,
+  "build/src/snd2.o": 0.074,
+  "build/src/snd3.o": 0.071,
   "build/src/snd4.o": 0.073,
-  "build/src/snd5.o": 0.067,
-  "build/src/snd6.o": 0.069,
-  "build/src/snd7.o": 0.069,
-  "build/src/snd8.o": 0.063,
-  "build/src/snd9.o": 0.065,
-  "build/src/ov_SC03_014/ov_SC03_014.o": 0.141,
-  "build/src/ov_SC03_014/ov_SC03_014_after.o": 0.509,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8012ACE0.o": 0.394,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80135888.o": 0.082,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80135A4C.o": 0.08,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80135D20.o": 0.126,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_801380E0.o": 0.169,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8013C98C.o": 0.129,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8013F350.o": 0.097,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8013FFD8.o": 0.074,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80140608.o": 0.182,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8015444C.o": 0.086,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80154C24.o": 0.174,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_801588CC.o": 0.102,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80159C84.o": 0.079,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8015A3C8.o": 0.075,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8015AE2C.o": 0.093,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8015C32C.o": 0.487,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8016AB6C.o": 0.267,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80171B4C.o": 0.102,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_801734BC.o": 0.205,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_801789AC.o": 0.064,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80178D40.o": 0.099,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8017A4AC.o": 0.066,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8017AE2C.o": 0.168,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_8017EB7C.o": 0.193,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_80184440.o": 0.054,
-  "build/src/ov_SC03_014/ov_SC03_014_jr_801848E4.o": 0.281,
-  "build/src/ov_SC03_014/ov_SC03_014_o0b.o": 0.059,
-  "build/src/ov_SC03_014/ov_SC03_014_o0c.o": 0.06,
-  "build/src/ov_SC03_014/ov_SC03_014_o0d.o": 0.053,
-  "build/src/ov_SC03_014/ov_SC03_014_o0e.o": 0.065,
-  "build/src/ov_SC03_015/ov_SC03_015.o": 0.12,
-  "build/src/ov_SC03_015/ov_SC03_015_after.o": 0.526,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8012ACE0.o": 0.382,
+  "build/src/snd5.o": 0.071,
+  "build/src/snd6.o": 0.083,
+  "build/src/snd7.o": 0.072,
+  "build/src/snd8.o": 0.067,
+  "build/src/snd9.o": 0.077,
+  "build/src/ov_SC03_014/ov_SC03_014.o": 0.157,
+  "build/src/ov_SC03_014/ov_SC03_014_after.o": 0.569,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8012ACE0.o": 0.432,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80135888.o": 0.086,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80135A4C.o": 0.068,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80135D20.o": 0.131,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_801380E0.o": 0.188,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8013C98C.o": 0.133,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8013F350.o": 0.102,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8013FFD8.o": 0.085,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80140608.o": 0.213,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8015444C.o": 0.098,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80154C24.o": 0.197,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_801588CC.o": 0.112,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80159C84.o": 0.105,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8015A3C8.o": 0.079,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8015AE2C.o": 0.121,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8015C32C.o": 0.474,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8016AB6C.o": 0.28,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80171B4C.o": 0.119,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_801734BC.o": 0.208,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_801789AC.o": 0.075,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80178D40.o": 0.107,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8017A4AC.o": 0.082,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8017AE2C.o": 0.179,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_8017EB7C.o": 0.199,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_80184440.o": 0.057,
+  "build/src/ov_SC03_014/ov_SC03_014_jr_801848E4.o": 0.28,
+  "build/src/ov_SC03_014/ov_SC03_014_o0b.o": 0.064,
+  "build/src/ov_SC03_014/ov_SC03_014_o0c.o": 0.061,
+  "build/src/ov_SC03_014/ov_SC03_014_o0d.o": 0.056,
+  "build/src/ov_SC03_014/ov_SC03_014_o0e.o": 0.069,
+  "build/src/ov_SC03_015/ov_SC03_015.o": 0.127,
+  "build/src/ov_SC03_015/ov_SC03_015_after.o": 0.516,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8012ACE0.o": 0.388,
   "build/src/ov_SC03_015/ov_SC03_015_jr_80135888.o": 0.051,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80135A4C.o": 0.051,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80135D20.o": 0.116,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_801380E0.o": 0.148,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8013C98C.o": 0.113,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8013F350.o": 0.064,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8013FFD8.o": 0.06,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80140608.o": 0.18,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8015444C.o": 0.07,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80154C24.o": 0.169,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80135A4C.o": 0.055,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80135D20.o": 0.117,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_801380E0.o": 0.153,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8013C98C.o": 0.118,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8013F350.o": 0.074,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8013FFD8.o": 0.063,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80140608.o": 0.183,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8015444C.o": 0.071,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80154C24.o": 0.158,
   "build/src/ov_SC03_015/ov_SC03_015_jr_801588CC.o": 0.085,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80159C84.o": 0.066,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8015A3C8.o": 0.068,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80159C84.o": 0.061,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8015A3C8.o": 0.071,
   "build/src/ov_SC03_015/ov_SC03_015_jr_8015AE2C.o": 0.092,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8015C32C.o": 0.472,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8016AB6C.o": 0.259,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80171B4C.o": 0.101,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_801734BC.o": 0.201,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_801789AC.o": 0.058,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80178D40.o": 0.1,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8017A4AC.o": 0.064,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8017AE2C.o": 0.164,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_8017EB7C.o": 0.189,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_80184440.o": 0.05,
-  "build/src/ov_SC03_015/ov_SC03_015_jr_801848E4.o": 0.278,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8015C32C.o": 0.446,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8016AB6C.o": 0.269,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80171B4C.o": 0.096,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_801734BC.o": 0.21,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_801789AC.o": 0.056,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80178D40.o": 0.097,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8017A4AC.o": 0.067,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8017AE2C.o": 0.165,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_8017EB7C.o": 0.21,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_80184440.o": 0.052,
+  "build/src/ov_SC03_015/ov_SC03_015_jr_801848E4.o": 0.284,
   "build/src/ov_SC03_015/ov_SC03_015_o0b.o": 0.06,
-  "build/src/ov_SC03_015/ov_SC03_015_o0c.o": 0.061,
-  "build/src/ov_SC03_015/ov_SC03_015_o0d.o": 0.054,
-  "build/src/ov_SC03_015/ov_SC03_015_o0e.o": 0.069,
-  "build/src/ov_SC04_011/ov_SC04_011.o": 0.121,
-  "build/src/ov_SC04_011/ov_SC04_011_after.o": 0.423,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8012ACE0.o": 0.353,
+  "build/src/ov_SC03_015/ov_SC03_015_o0c.o": 0.06,
+  "build/src/ov_SC03_015/ov_SC03_015_o0d.o": 0.05,
+  "build/src/ov_SC03_015/ov_SC03_015_o0e.o": 0.07,
+  "build/src/ov_SC04_011/ov_SC04_011.o": 0.12,
+  "build/src/ov_SC04_011/ov_SC04_011_after.o": 0.428,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8012ACE0.o": 0.348,
   "build/src/ov_SC04_011/ov_SC04_011_jr_80135888.o": 0.054,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_80135A4C.o": 0.053,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_80135D20.o": 0.12,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_801380E0.o": 0.152,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8013C98C.o": 0.109,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8013F350.o": 0.076,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8013FFD8.o": 0.065,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_80140608.o": 0.172,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8015444C.o": 0.072,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_80154C24.o": 0.169,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_801588CC.o": 0.092,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_80135A4C.o": 0.056,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_80135D20.o": 0.115,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_801380E0.o": 0.153,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8013C98C.o": 0.112,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8013F350.o": 0.072,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8013FFD8.o": 0.059,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_80140608.o": 0.18,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8015444C.o": 0.073,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_80154C24.o": 0.162,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_801588CC.o": 0.087,
   "build/src/ov_SC04_011/ov_SC04_011_jr_80159C84.o": 0.066,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8015A3C8.o": 0.073,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8015AE2C.o": 0.093,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8015C32C.o": 0.353,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8016AB6C.o": 0.217,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_80171B4C.o": 0.099,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_801734BC.o": 0.164,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_801789AC.o": 0.054,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_80178D40.o": 0.085,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8017A4AC.o": 0.063,
-  "build/src/ov_SC04_011/ov_SC04_011_jr_8017AE2C.o": 0.093,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8015A3C8.o": 0.075,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8015AE2C.o": 0.096,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8015C32C.o": 0.357,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8016AB6C.o": 0.222,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_80171B4C.o": 0.097,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_801734BC.o": 0.168,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_801789AC.o": 0.057,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_80178D40.o": 0.088,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8017A4AC.o": 0.06,
+  "build/src/ov_SC04_011/ov_SC04_011_jr_8017AE2C.o": 0.095,
   "build/src/ov_SC04_011/ov_SC04_011_jr_8017D494.o": 0.444,
-  "build/src/ov_SC04_011/ov_SC04_011_o0b.o": 0.048,
-  "build/src/ov_SC04_011/ov_SC04_011_o0c.o": 0.06
+  "build/src/ov_SC04_011/ov_SC04_011_o0b.o": 0.046,
+  "build/src/ov_SC04_011/ov_SC04_011_o0c.o": 0.053
  },
  "ok": true,
- "seconds": 2.3
+ "seconds": 2.4
 }
diff --git a/config/tool_dictionary.tsv b/config/tool_dictionary.tsv
index b53599c053..ea1ba88bdf 100644
--- a/config/tool_dictionary.tsv
+++ b/config/tool_dictionary.tsv
@@ -69,7 +69,7 @@ tools/decompme_replica.sh	P4	ADAPT	reproduce an external reference toolchain loc
 tools/dedup_extend.py	P6	ADAPT	extend an existing code-share registry to newly onboarded binaries	Extends the existing share registry to newly onboarded binaries	repo config/src layout	SUPERSEDED	tools/share_body.py
 tools/dedup_integrate.py	P6	ADAPT	validate a code-share registry byte-honestly, failing closed on signature drift	Byte-honesty validator for the code-share registry; fails closed on signature drift	repo config registry path	LIVE	
 tools/dedup_propagate.py	P6	ADAPT	lift one matched body into a shared macro and instantiate it everywhere	Lifts one matched body into a shared macro and instantiates it at every duplicate site	repo shared-header/src layout	SUPERSEDED	tools/share_body.py
-tools/delever.py	P10	ADAPT	take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site	The Phase-36 de-lever engine: positional rewrites per lever class (pin -> plain declaration, barrier/launder/keep-alive deleted, a hand-placed instruction -> its C, the zero-register variable -> 0, volatile/register dropped), rung A strip-all and rung B greedy per body through delever_oracle, headers serialized after the TU phase; --probe runs a stratified sample of distinct bodies and prices the campaign with denominators	the census site records, the oracle	LIVE	
+tools/delever.py	P10	ADAPT	take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site	The Phase-36 de-lever engine and campaign tool: positional rewrites per lever class (pin -> plain declaration, barrier/keep-alive deleted, a launder deleted or turned into the assignment it is, a hand-placed instruction -> its C, the zero-register variable -> 0, a macro-carried site deleted/valued/refused by its macro's shape, volatile/register dropped); per body replay -> rung A strip-all -> rung B greedy through delever_oracle; the file is the write unit and its final compile through every recipe the proof; --plan/--apply batches (TUs parallel, exemplar files first; headers serial, includers parallel), the ledger keyed by tu+fn+addr with the body's nhash before/after, !FAKE markers on class A/B survivors, --restore from inflight.json, --apply-body for T6/T7, --selftest with a stub oracle, --probe (T2)	the census site records, the oracle	LIVE	
 tools/delever_oracle.py	P10	ADAPT	judge one translation-unit edit by the bytes of its object in under a second	The Phase-36 fast byte oracle: every object's exact build command captured once via make -n -W (the Makefile's own recipe, pad stage and -O0 overrides included), a candidate compiled in place with -o/-MF redirected to scratch and compared with the fleet run's object; --calibrate proves 100 % equality untouched, twin == primary and a positive control before any verdict is trusted	the Makefile's object rules, the twin rule	LIVE	
 tools/demacroize.py	P6	ADAPT	escape a shared-header declaration conflict locally by unmacroizing one body	Per-binary local escape from a shared-header declaration conflict by unmacroizing one body	repo shared-header layout	FROZEN	tools/share_body.py
 tools/diff_autopsy.sh	P7	ADAPT	find which words diverge when the whole-binary gate says different but not where	Reproduces exactly what the gate saw, then decodes the diverging words and restores the tree	repo src/build paths	STILL-NEEDED	find WHICH words diverge when the whole-binary gate says DIFF but not where
@@ -281,6 +281,7 @@ tools/seed_ref.py	P8	ADAPT	find an already-banked body that matches an open stub
 tools/serve_local.py	P8	ADAPT	serve a fine-tuned model locally behind a chat-completions endpoint	Serves the fine-tuned model locally behind a chat-completions endpoint	training venv, GPU assumptions	LIVE	
 tools/share_body.py	P10	ADAPT	share one byte-identical function class across its binaries through an include-at-site header, gated per binary	The Phase-35 successor of dedup_propagate + dedup_extend for the include-at-site form: exemplar by majority text, the header written once, every private copy replaced by the include at its position, per-binary byte gate with object comparison, bisect on red, the registry appended or extended by text, the exception ledger on refusal; --plan / --apply --bucket extend|new	repo paths, the registry and signature schemas	LIVE	
 tools/share_body_cycle.sh	P10	ADAPT	run the share-body batch cycle unattended: batch, verify by exit code, log, commit, periodic clean fleet check	The Phase-35 T5 driver for bucket new: per batch share_body --apply --bucket new --batches 1 --label new<k>, the gated N/N line read, the phase log entry appended, the bank committed the moment it is green, the clean fleet run every N batches — stops on the first red	repo paths, the phase-log format, the fleet count from config/check.*.sha	LIVE	
+tools/delever_cycle.sh	P10	ADAPT	run the de-lever batch cycle unattended: batch, verify by exit code, clean fleet gate, census, log, commit	The Phase-36 T3/T4 driver: per batch a clean-tree check, the oracle recalibrated when stale, delever --apply read by exit code and its final X/X line, the clean fleet run as the outer gate (218/218), the census rerun, the phase-log entry and the checkpoint headline, one commit per batch; stops on the first red with the files in place for --restore	the batch size, the aliases, the fleet count	LIVE	
 tools/share_census.py	P10	ADAPT	measure duplicate function bodies across the fleet and assert one source per unique function	The census of byte-identical function classes across every binary with their source forms and verdicts, plus the S1 invariant check with its exception ledger and a fixture self-test	repo paths, the registry and signature schemas	LIVE	
 tools/shared_lock.py	P8	ADAPT	hold one reader/writer lock over the shared source state for concurrent lanes	One reader/writer lock over the shared source state for concurrent lanes	repo lock paths	LIVE	
 tools/sig_image.py	P6	PORTABLE	sign every function of a flat image at a known base, without a disassembler	Disassembler-free per-function signer for a flat image at a known base, field-identical to the dumper	MIPS encodings, repo scratch paths	LIVE	
diff --git a/decomp-architect/corpus/tools/INDEX.md b/decomp-architect/corpus/tools/INDEX.md
index 8efc4989da..52e8deedf7 100644
--- a/decomp-architect/corpus/tools/INDEX.md
+++ b/decomp-architect/corpus/tools/INDEX.md
@@ -8,8 +8,8 @@
 > its platform SDK need the marked adaptation. The last table lists the tools that are project-only in code (their *shape* is a task;
 > their code does not transfer). *TODO(platform): the MIPS and PlayStation SDK hard-codes are the ones another platform replaces first.*
 >
-> **Coverage:** 298 tool files in scope (submodules, vendored and downloaded code excluded), of which 298 live rows
-> below; per phase: P1 2 · P2 26 · P3 17 · P4 9 · P5 26 · P6 51 · P7 20 · P8 86 · P9 27 · P10 18 · PROJECT-ONLY 16. Superseded tools appear only as pointers to their successor (30 pointer rows); one-offs are omitted. Table rows in all: 328 (the installer checks its copy against this figure).
+> **Coverage:** 299 tool files in scope (submodules, vendored and downloaded code excluded), of which 299 live rows
+> below; per phase: P1 2 · P2 26 · P3 17 · P4 9 · P5 26 · P6 51 · P7 20 · P8 86 · P9 27 · P10 19 · PROJECT-ONLY 16. Superseded tools appear only as pointers to their successor (30 pointer rows); one-offs are omitted. Table rows in all: 329 (the installer checks its copy against this figure).
 
 ## P1 — extraction + manifest
 
@@ -338,9 +338,10 @@
 | `ghidra_apply_symbols.sh` | mirror the curated symbol file into the analysis database with a real save | Mirrors the curated symbol file into the analysis program headlessly, with a real save | repo symbol path, project name |
 | `frozen.py` | refuse, from one place, the command line of a tool the project has frozen | The one refusal a FROZEN tool prints from its main(): the tool, the successor and why; imports never exit (libraries stay usable) | nothing |
 | `verbatim_target_s.py` | regenerate a splitter-format target disassembly for a function no longer stubbed | Regenerates a splitter-format target disassembly for a function that is no longer a stub; --gas emits the assemblable gas-syntax form ($-registers, .L labels, noreorder) that a web diff service accepts as a pasted target | repo build/asm layout |
+| `delever_cycle.sh` | run the de-lever batch cycle unattended: batch, verify by exit code, clean fleet gate, census, log, commit | The Phase-36 T3/T4 driver: per batch a clean-tree check, the oracle recalibrated when stale, delever --apply read by exit code and its final X/X line, the clean fleet run as the outer gate (218/218), the census rerun, the phase-log entry and the checkpoint headline, one commit per batch; stops on the first red with the files in place for --restore | the batch size, the aliases, the fleet count |
 | `share_body_cycle.sh` | run the share-body batch cycle unattended: batch, verify by exit code, log, commit, periodic clean fleet check | The Phase-35 T5 driver for bucket new: per batch share_body --apply --bucket new --batches 1 --label new<k>, the gated N/N line read, the phase log entry appended, the bank committed the moment it is green, the clean fleet run every N batches — stops on the first red | repo paths, the phase-log format, the fleet count from config/check.*.sha |
 | `share_body.py` | share one byte-identical function class across its binaries through an include-at-site header, gated per binary | The Phase-35 successor of dedup_propagate + dedup_extend for the include-at-site form: exemplar by majority text, the header written once, every private copy replaced by the include at its position, per-binary byte gate with object comparison, bisect on red, the registry appended or extended by text, the exception ledger on refusal; --plan / --apply --bucket extend|new | repo paths, the registry and signature schemas |
-| `delever.py` | take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site | The Phase-36 de-lever engine: positional rewrites per lever class (pin -> plain declaration, barrier/launder/keep-alive deleted, a hand-placed instruction -> its C, the zero-register variable -> 0, volatile/register dropped), rung A strip-all and rung B greedy per body through delever_oracle, headers serialized after the TU phase; --probe runs a stratified sample of distinct bodies and prices the campaign with denominators | the census site records, the oracle |
+| `delever.py` | take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site | The Phase-36 de-lever engine and campaign tool: positional rewrites per lever class (pin -> plain declaration, barrier/keep-alive deleted, a launder deleted or turned into the assignment it is, a hand-placed instruction -> its C, the zero-register variable -> 0, a macro-carried site deleted/valued/refused by its macro's shape, volatile/register dropped); per body replay -> rung A strip-all -> rung B greedy through delever_oracle; the file is the write unit and its final compile through every recipe the proof; --plan/--apply batches (TUs parallel, exemplar files first; headers serial, includers parallel), the ledger keyed by tu+fn+addr with the body's nhash before/after, !FAKE markers on class A/B survivors, --restore from inflight.json, --apply-body for T6/T7, --selftest with a stub oracle, --probe (T2) | the census site records, the oracle |
 | `verbatim_to_stub.py` | turn an inline-assembly body back into a stub the toolchain can reach | Turns an inline-assembly body back into an include-assembly stub | repo src/asm layout |
 
 ## PROJECT-ONLY — project-only in code (the shape is a task; the code does not transfer)
diff --git a/decomp-architect/corpus/tools/P10/delever.py b/decomp-architect/corpus/tools/P10/delever.py
index 22b8de665b..b763aee5b2 100644
--- a/decomp-architect/corpus/tools/P10/delever.py
+++ b/decomp-architect/corpus/tools/P10/delever.py
@@ -1,32 +1,62 @@
 #!/usr/bin/env python3
 """delever.py — take the compiler-forcing constructs ("levers") out of matched C, byte-gated per translation unit
-(Phase 36; the probe engine at T2, the campaign tool at T3).
+(Phase 36: the probe engine at T2, the campaign tool at T3).
 
-    tools/delever.py --probe --sample 150 [--seed 1] [-j 12]     # T2: rung A + rung B on a stratified sample of DISTINCT bodies
-                                                                 #     -> .run/P36/probe/{probe_results.jsonl,probe_summary.json,probe_table.md}
+    tools/delever.py --plan [--batch 300] [--headers] [--only X ...]        # what the next batch would do (no writes)
+    tools/delever.py --apply --batch 300 --label tu1 [--headers] [--only X ...] [-j 12]
+                                                                           # judge every drawable body of the batch's files, KEEP the winning
+                                                                           # text in place, mark the survivors `// !FAKE:`, ledger every site
+    tools/delever.py --restore                                             # every in-flight file back from inflight.json (never git checkout, R102)
+    tools/delever.py --status                                              # the ledger's totals
+    tools/delever.py --apply-body TU FN FILE --label w1 [--rung E]          # T6/T7: a reshaped function judged on the bytes and kept
+    tools/delever.py --selftest                                            # the fixture: every site kind, the decoys, a stub oracle
+    tools/delever.py --probe --sample 150 [--seed 1] [-j 12]                # T2's measurement (unchanged)
 
 THE LADDER PER BODY (deterministic, zero tokens):
-  rung A  strip-all — every removable site of the body rewritten at once (pin -> plain declaration; barrier/launder/keep-alive ->
-          deleted; a hand-placed instruction -> its C; `$0` pin -> its variable's uses replaced by 0; volatile -> dropped; register ->
-          dropped), one compile, the object compared with the fleet run's (tools/delever_oracle.py). Measured twice: with the `register`
-          keyword dropped from the pin (the target form) and with it kept (A').
+  replay  a body whose normalized text (`nhash`, func_/D_ addresses masked) matches a body the ledger already judged replays that
+          body's accepted edit set: one compile. A disagreement falls through to the full ladder and is recorded.
+  rung A  strip-all — every removable site of the body rewritten at once, one compile, the object compared with the fleet run's
+          (tools/delever_oracle.py).
   rung B  greedy — if A differs: from the untouched text, the sites are re-applied one at a time (asm statements first, then pins,
-          volatile, register); a site whose removal keeps the object identical is REMOVED, one that changes it is NEEDED.
-The verdict of a body = the set of NEEDED sites; a body with none is lever-free. Never touched: GTE ops, the manifest's verbatim
-bodies, an asm-body (a whole routine — the manifest's DECOMPILE rows are another task's work), file-scope declarations.
+          volatile, register); a site whose removal keeps the object identical is REMOVED, one that changes it is NEEDED — with the
+          oracle's word (DIFFERS / COMPILE-ERROR / COMPILE-CRASH) as the reason.
+The verdict of a body = the set of NEEDED sites; a body with none is lever-free.
 
-EVERY EDIT IS POSITIONAL on the raw text (line/col from the census), the file is written in place for the compile and restored
-from the in-memory snapshot right after (never `git checkout`, R102); a site whose raw token does not match the census is REFUSED
-(R43), never guessed.
+THE REWRITE PER SITE (positional on the RAW text at the census's line/col; a token that is not what the census saw is REFUSED, R43):
+  pin `register T x __asm__("$N") [= e];`   -> `T x [= e];`      (the `$0` zero-register variable: the declaration deleted, every use -> 0;
+                                                                  a variable that is ever assigned is REFUSED)
+  barrier `__asm__("" ::: "memory");`, keep-alive `__asm__("" : : "r"(x));`, launder `__asm__("" : "=r"(x) : "0"(x));`  -> deleted
+  launder whose output and input DIFFER `__asm__("" : "=r"(p) : "0"(&D_x));`  -> the assignment it is: `p = &D_x;`
+     (deleting it leaves `p` undefined — cc1 2.7.2 ABORTS on such a candidate; the T2 probe counted those as NEEDED)
+  a hand-placed instruction (`addu %0,%1,$zero` / move / la / lh / lw / addiu / sll / …) -> its C statement, or REFUSED (no spelling)
+  a macro-carried site: `SHB(x);` (a pure launder statement macro) -> deleted; `LAUNDER(p)` (a launder statement-expression) -> its
+     value `((T)(p))`; a COMPOUND macro (XFER, DRAW, RTP_SND, …: real code around the asm) -> REFUSED, the lever is in the #define (T5)
+  volatile (a cast, a body declaration, a parameter, a file-scope declaration) -> the qualifier dropped; bare `register` -> dropped
+  GTE ops, the manifest's verbatim bodies: never touched. An asm-body (a whole routine in a C shell) is DEFERRED to T7 and marked.
+
+THE FILE IS THE WRITE UNIT, ITS FINAL COMPILE THE PROOF: every body's candidates are judged against the file's ORIGINAL text; the
+accepted edits of every body, the file-scope edits and the `// !FAKE:` markers are spliced once at the end, and that final text is
+compiled through EVERY recipe of the file (a twin's object too; every includer of a header, in parallel) — IDENTICAL or the file-scope
+edits are dropped and it is compiled again, or the file is restored and REFUSED (COMBINATION-FAILED, loud). The batch's touched files
+are left in place for the outer gate (the clean fleet run, R22, in tools/delever_cycle.sh); every file's original text is in
+.run/P36/delever/inflight.json before the first write, and --restore reads it.
+
+"DONE" IS A LEDGER FACT KEYED BY TEXT: every ledger row records the body's nhash BEFORE and AFTER. A body whose current nhash is some
+row's after-hash is done (drawn again only with --rejudge); one whose current nhash is some row's before-hash replays it. Markers are
+comments and do not change the hash; a reshaped body (T6/T7) gets a new hash and is drawn again. Class C/D survivors are never marked
+(Drew's decision 3) — the ledger is their record; class A/B survivors carry `// !FAKE: <kind> <detail> — <verdict> (P36 <rung> <label>)`.
 """
 import argparse
 import collections
+import hashlib
 import json
 import os
 import pathlib
 import random
 import re
+import subprocess
 import sys
+import threading
 import time
 from concurrent.futures import ThreadPoolExecutor
 
@@ -36,12 +66,25 @@ import delever_oracle as oracle   # noqa: E402
 import lever_census as lc         # noqa: E402
 import share_census as sc         # noqa: E402
 
-SITES = REPO / ".run" / "P36" / "census" / "lever_sites.jsonl"
+RUN = REPO / ".run" / "P36" / "delever"
+CENSUS_DIR = REPO / ".run" / "P36" / "census"
+SITES = CENSUS_DIR / "lever_sites.jsonl"
+CENSUS_JSON = CENSUS_DIR / "lever_census.json"
+LEDGER = RUN / "ledger.jsonl"
+INFLIGHT = RUN / "inflight.json"
 PROBE = REPO / ".run" / "P36" / "probe"
+PRELUDE = "src/shared/engine_prelude.h"
 REMOVABLE = {("A", "pin"), ("B", "barrier"), ("B", "launder"), ("B", "keepalive"), ("B", "instruction"),
-             ("C", "cast"), ("C", "decl-body"), ("D", "register")}
-ORDER = {"barrier": 0, "launder": 1, "keepalive": 2, "instruction": 3, "pin": 4, "cast": 5, "decl-body": 6, "register": 7}
+             ("C", "cast"), ("C", "decl-body"), ("C", "param"), ("D", "register")}
+FILE_SCOPE_REMOVABLE = {("C", "decl-file")}
+DEFERRED_KINDS = {"asm-body"}                       # a whole routine in a C shell: T7's work, marked now (the census counts it as a lever)
+MARK_KINDS = {"pin", "barrier", "launder", "keepalive", "instruction", "asm-body"}   # class A/B survivors carry the marker; C/D never
+ORDER = {"barrier": 0, "launder": 1, "keepalive": 2, "instruction": 3, "pin": 4, "cast": 5, "decl-body": 6, "param": 6, "register": 7}
+FILE_SCOPE_FN = "<file-scope>"
+DONE_VERDICTS = {"LEVER-FREE", "RESIDUE", "NOTHING-USABLE", "DEFERRED-ONLY", "REFUSED"}   # a body the ledger settles; COMBINATION-FAILED / NO-RECIPE are redrawn
 STRLIT = lc.STRLIT
+FAKE = "// !FAKE:"
+_LOCK = threading.Lock()
 
 
 class Refuse(Exception):
@@ -90,6 +133,10 @@ def ws_after(m, pos):
     return i
 
 
+def norm_expr(e):
+    return re.sub(r"\s+", "", e)
+
+
 # ----------------------------------------------------------------------------------------------------------------------
 # the rewrite of one site -> [(start, end, replacement)] on the raw text
 # ----------------------------------------------------------------------------------------------------------------------
@@ -102,6 +149,11 @@ INSTR_TABLE = {
     "lui": ("OUT = IMM << 16;", None), "li": ("OUT = IMM;", None), "lw": ("OUT = *(s32 *)((s32)IN1 + IMM);", None),
     "lh": ("OUT = *(s16 *)((s32)IN1 + IMM);", None), "la": ("OUT = (s32)&SYM;", None),
 }
+# macro shapes (the replacement text of a #define, whitespace-normalized)
+_ASM = r"(?:__asm__|__asm|asm)\s*(?:__volatile__|volatile)?"
+MACRO_STMT_LAUNDER = re.compile(r"^\s*" + _ASM + r"\s*\(\s*\"\"\s*:\s*\"=r\"\s*\(\s*(\w+)\s*\)\s*:\s*\"0\"\s*\(\s*\1\s*\)\s*\)\s*;?\s*$")
+MACRO_EXPR_LAUNDER = re.compile(r"^\s*\(\s*\{\s*([\w][\w\s\*]*?)\s+(\w+)\s*=\s*\(\s*\1\s*\)\s*\(\s*(\w+)\s*\)\s*;\s*" + _ASM +
+                                r"\s*\(\s*\"\"\s*:\s*\"=r\"\s*\(\s*\2\s*\)\s*:\s*\"0\"\s*\(\s*\2\s*\)\s*\)\s*;\s*\2\s*;\s*\}\s*\)\s*$")
 
 
 def parse_asm_operands(inner):
@@ -186,7 +238,7 @@ def instruction_to_c(inner, indent):
         if not mm:
             return None
         base = resolve(mm.group(2))
-        return None if base is None else templ.replace("OUT", out_expr).replace("IN1", base).replace("IMM", mm.group(1)) and f"{indent}{templ.replace('OUT', out_expr).replace('IN1', base).replace('IMM', mm.group(1))}"
+        return None if base is None else f"{indent}{templ.replace('OUT', out_expr).replace('IN1', base).replace('IMM', mm.group(1))}"
     if mnem in ("addiu", "sll", "srl", "andi"):
         if len(refs) != 3:
             return None
@@ -206,12 +258,55 @@ def instruction_to_c(inner, indent):
     return None
 
 
+def launder_rewrite(inner):
+    """('delete', None) | ('assign', 'out = in;') | raise Refuse — a launder is deletable only when it launders a value into
+    itself (or defines a value from nothing); one that copies another expression into its output IS an assignment."""
+    _, outs, ins = parse_asm_operands(inner)
+    if len(outs) != 1:
+        raise Refuse(f"launder with {len(outs)} outputs")
+    if not ins:
+        return "delete", None
+    if len(ins) != 1:
+        raise Refuse(f"launder with {len(ins)} inputs")
+    o, i = outs[0][1], ins[0][1]
+    if norm_expr(o) == norm_expr(i):
+        return "delete", None
+    return "assign", f"{o} = {i};"
+
+
+_macro_cache = {}
+
+
+def macro_shape(raw, rel, name, use_line):
+    """('stmt-launder' | 'expr-launder' | 'compound' | 'missing', cast_type) for the definition of NAME that governs a use at
+    use_line: the LAST #define before the use in this file, else engine_prelude.h (ENGINE_SHB)."""
+    key = (rel, name, use_line)
+    if key in _macro_cache:
+        return _macro_cache[key]
+    defs = [(l0, l1, body) for (l0, l1, n, body) in lc.define_blocks(raw) if n == name and l1 < use_line]
+    body = defs[-1][2] if defs else None
+    if body is None and name == "ENGINE_SHB":
+        pre = (REPO / PRELUDE).read_text(errors="surrogateescape")
+        d = [(l0, l1, b) for (l0, l1, n, b) in lc.define_blocks(pre) if n == name]
+        body = d[-1][2] if d else None
+    if body is None:
+        res = ("missing", None)
+    else:
+        b = re.sub(r"\s+", " ", sc.mask_text(body) if ("/*" in body or "//" in body) else body).strip()
+        if MACRO_STMT_LAUNDER.match(b):
+            res = ("stmt-launder", None)
+        else:
+            mm = MACRO_EXPR_LAUNDER.match(b)
+            res = ("expr-launder", mm.group(1).strip()) if mm else ("compound", None)
+    _macro_cache[key] = res
+    return res
+
+
 def site_edits(raw, m, ls, site, keep_register=False):
     """[(start, end, replacement)] for one site, or raise Refuse. `m` = same_len_mask(raw)."""
     pos = ls[site["line"] - 1] + site["col"] - 1
     cls, kind = site["cls"], site["kind"]
     indent_start = m.rfind("\n", 0, pos) + 1
-    indent = re.match(r"[ \t]*", raw[indent_start:pos]).group(0)
     if cls == "A":
         if not m.startswith("register", pos):
             raise Refuse(f"token mismatch at {site['tu']}:{site['line']}: expected `register`")
@@ -225,9 +320,15 @@ def site_edits(raw, m, ls, site, keep_register=False):
             if not mm:
                 raise Refuse("zero pin without a name")
             name = mm.group(1)
-            edits = [(indent_start if raw[indent_start:pos].strip() == "" else pos, e + (1 if raw[e:e + 1] == "\n" and raw[indent_start:pos].strip() == "" else 0), "")]
+            if "=" in stmt.split("__asm__")[-1].split("asm")[-1]:
+                raise Refuse("zero pin with an initializer")
+            edits = [(indent_start if raw[indent_start:pos].strip() == "" else pos,
+                      e + (1 if raw[e:e + 1] == "\n" and raw[indent_start:pos].strip() == "" else 0), "")]
             b0, b1 = ls[site["fn_line"] - 1], ls[site["fn_end"]] - 1
-            for um in re.finditer(r"\b%s\b" % re.escape(name), m[b0:b1]):
+            body_m = m[b0:b1]
+            if re.search(r"\b%s\s*(?:=(?!=)|\+\+|--|[-+*/&|^]=)" % re.escape(name), body_m) or re.search(r"(?:\+\+|--)\s*\b%s\b" % re.escape(name), body_m):
+                raise Refuse(f"zero-register variable `{name}` is assigned in the body")
+            for um in re.finditer(r"\b%s\b" % re.escape(name), body_m):
                 s = b0 + um.start()
                 if s < pos or s >= e:
                     edits.append((s, s + len(name), "0"))
@@ -235,10 +336,23 @@ def site_edits(raw, m, ls, site, keep_register=False):
         new = stmt if keep_register else re.sub(r"\bregister\b[ \t]*", "", stmt, count=1)
         new = PIN_CLAUSE.sub("", new)
         return [(pos, e, new)]
+    if cls == "B" and kind in DEFERRED_KINDS:
+        raise Refuse("asm-body: a whole routine in a C shell is T7's work (DEFERRED)")
     if cls == "B" and site.get("via"):
         name = site["via"]
         if not m.startswith(name, pos):
             raise Refuse(f"token mismatch at {site['tu']}:{site['line']}: expected `{name}(`")
+        shape, ctype = macro_shape(raw, site["tu"], name, site["line"])
+        if shape == "missing":
+            raise Refuse(f"macro `{name}` is not defined in this file")
+        if shape == "compound":
+            raise Refuse(f"macro-carried {kind}: the lever is inside `#define {name}` with real code around it (T5)")
+        o = m.find("(", pos)
+        c = lc._paren_span(m, o)
+        if o < 0 or c < 0:
+            raise Refuse("unterminated macro use")
+        if shape == "expr-launder":
+            return [(pos, c + 1, f"(({ctype})({raw[o + 1:c].strip()}))")]
         if kind not in ("barrier", "launder", "keepalive"):
             raise Refuse(f"macro-carried {kind} is residue")
         e = stmt_end(m, pos)
@@ -254,10 +368,14 @@ def site_edits(raw, m, ls, site, keep_register=False):
         e = stmt_end(m, pos)
         if c < 0 or e < 0:
             raise Refuse("unterminated asm statement")
-        if kind in ("barrier", "launder", "keepalive"):
+        inner = m[o + 1:c]
+        if kind in ("barrier", "keepalive"):
             new = ""
+        elif kind == "launder":
+            how, text = launder_rewrite(inner)
+            new = "" if how == "delete" else text
         elif kind == "instruction":
-            new = instruction_to_c(m[o + 1:c] if '"' in m[o + 1:c] else raw[o + 1:c], "")
+            new = instruction_to_c(inner, "")
             if new is None:
                 raise Refuse(f"instruction `{site['detail']}` has no C spelling in the table")
             new = new.strip()
@@ -279,17 +397,44 @@ def site_edits(raw, m, ls, site, keep_register=False):
 
 
 def apply_edits(raw, edits):
-    """Splice non-overlapping edits (bottom-up). Overlap -> Refuse."""
+    """Splice non-overlapping edits (bottom-up). Overlap -> Refuse (an insertion at a deletion's boundary is not an overlap)."""
     es = sorted(edits, key=lambda x: (x[0], x[1]))
     for a, b in zip(es, es[1:]):
         if b[0] < a[1]:
             raise Refuse(f"overlapping edits at {a[0]}..{a[1]} / {b[0]}..{b[1]}")
     out = raw
-    for s, e, r in sorted(es, key=lambda x: -x[0]):
+    for s, e, r in sorted(es, key=lambda x: (-x[0], -x[1])):
         out = out[:s] + r + out[e:]
     return out
 
 
+def marker_edits(raw, ls, survivors, rung, label):
+    """End-of-line `// !FAKE:` insertions for the class A/B survivors (NEEDED / REFUSED / DEFERRED), one marker per line naming
+    every survivor on it; an existing marker on that line is replaced."""
+    by_line = collections.defaultdict(list)
+    for s, verdict, why in survivors:
+        if s["kind"] in MARK_KINDS:
+            by_line[s["line"]].append((s, verdict, why))
+    edits = []
+    for ln, items in by_line.items():
+        start, end = ls[ln - 1], ls[ln] - 1 if ln < len(ls) else len(raw)
+        line = raw[start:end]
+        parts = []
+        for s, verdict, why in items:
+            what = f"{s['kind']}" + (f" {s['detail']}" if s.get("detail") and s.get("detail") != s.get("via") else "") + (f" via {s['via']}" if s.get("via") else "")
+            parts.append(f"{what} — {verdict}" + (f" {why}" if why else ""))
+        text = f"{FAKE} " + "; ".join(parts) + f" (P36 {rung} {label})"
+        k = line.find(FAKE)
+        if k >= 0:
+            j = k
+            while j > 0 and line[j - 1] in " \t":
+                j -= 1
+            edits.append((start + j, end, "  " + text))
+        else:
+            edits.append((end, end, "  " + text))
+    return edits
+
+
 # ----------------------------------------------------------------------------------------------------------------------
 # the population
 # ----------------------------------------------------------------------------------------------------------------------
@@ -297,36 +442,878 @@ def load_sites():
     return [json.loads(l) for l in SITES.read_text().splitlines() if l.strip()]
 
 
-def bodies_from_sites(sites):
-    bodies = {}
-    for s in sites:
-        if not s.get("fn"):
-            continue
-        b = bodies.setdefault((s["tu"], s["fn"]), dict(tu=s["tu"], fn=s["fn"], fn_line=s["fn_line"], fn_end=s["fn_end"], nhash=s.get("nhash"),
-                                                        aliases=s["aliases"], header=s.get("header", False), sites=[], frozen=[]))
-        if (s["cls"], s["kind"]) in REMOVABLE:
-            b["sites"].append(s)
-        else:
-            b["frozen"].append(s)
-    return bodies
-
-
 def kind_of(tu):
     return "shared" if tu.startswith("src/shared/") else "ov" if tu.startswith("src/ov_") else "md" if tu.startswith("src/md_") \
         else "resident" if tu.startswith("src/resident/") else "main"
 
 
+def bodies_from_sites(sites, with_file_scope=False):
+    """(tu, fn) -> body; the removable sites in `sites`, the rest in `frozen`; with_file_scope adds a per-TU pseudo-body for the
+    file-scope `volatile` declarations (fn = FILE_SCOPE_FN, judged after the functions of its TU)."""
+    bodies = {}
+    for s in sites:
+        ck = (s["cls"], s["kind"])
+        if s.get("fn"):
+            b = bodies.setdefault((s["tu"], s["fn"]), dict(tu=s["tu"], fn=s["fn"], fn_line=s["fn_line"], fn_end=s["fn_end"], nhash=s.get("nhash"),
+                                                            aliases=s["aliases"], header=s.get("header", False), includers=s.get("includers", 0),
+                                                            sites=[], frozen=[], deferred=[]))
+            if ck in REMOVABLE:
+                b["sites"].append(s)
+            elif s["kind"] in DEFERRED_KINDS:
+                b["deferred"].append(s)
+            else:
+                b["frozen"].append(s)
+        elif with_file_scope and ck in FILE_SCOPE_REMOVABLE:
+            b = bodies.setdefault((s["tu"], FILE_SCOPE_FN), dict(tu=s["tu"], fn=FILE_SCOPE_FN, fn_line=None, fn_end=None, nhash=None,
+                                                                  aliases=s["aliases"], header=s.get("header", False), includers=s.get("includers", 0),
+                                                                  sites=[], frozen=[], deferred=[]))
+            b["sites"].append(s)
+    for b in bodies.values():
+        for k in ("sites", "frozen", "deferred"):
+            b[k].sort(key=lambda s: (s["line"], s["col"]))
+        if b["fn"] == FILE_SCOPE_FN:
+            b["nhash"] = "fs:" + hashlib.sha1("\n".join(s["text"] for s in b["sites"]).encode()).hexdigest()
+    return bodies
+
+
 def includers():
-    """header rel -> [TU rel] from the #include lines of every TU (the recipe to compile a header's body is an includer's)."""
-    inc = collections.defaultdict(list)
-    for p in sorted((REPO / "src").rglob("*.c")):
+    """header rel -> [TU rel] (transitive: a header included by a header is included by that header's includers)."""
+    direct = collections.defaultdict(set)
+    hdr_inc = collections.defaultdict(set)
+    for p in sorted((REPO / "src").rglob("*")):
+        if p.suffix not in (".c", ".h") or p.name.startswith("."):
+            continue
         rel = p.relative_to(REPO).as_posix()
         text = p.read_text(errors="surrogateescape")
         for mm in sc.INCLUDE_LINE.finditer(sc.mask_text(text)):
-            inc[os.path.normpath(os.path.join(os.path.dirname(rel), mm.group(1)))].append(rel)
-    return inc
+            key = os.path.normpath(os.path.join(os.path.dirname(rel), mm.group(1)))
+            (direct if rel.endswith(".c") else hdr_inc)[key].add(rel)
+    out = {}
+    def resolve(h, seen=()):
+        if h in out:
+            return out[h]
+        r = set(direct.get(h, ()))
+        for h2 in hdr_inc.get(h, ()):
+            if h2 not in seen:
+                r |= resolve(h2, seen + (h,))
+        out[h] = r
+        return r
+    for h in set(direct) | set(hdr_inc):
+        resolve(h)
+    return {h: sorted(v) for h, v in out.items()}
 
 
+def fn_addr(fn, tu):
+    mm = re.fullmatch(r"func_([0-9A-Fa-f]{8})", fn or "")
+    if mm:
+        return int(mm.group(1), 16)
+    if fn and fn != FILE_SCOPE_FN:
+        for ln in (REPO / "config" / "symbols.us.txt").read_text().splitlines():
+            m2 = re.match(r"\s*(\w+)\s*=\s*0x([0-9A-Fa-f]+)\s*;", ln)
+            if m2 and m2.group(1) == fn:
+                return int(m2.group(2), 16)
+    return None
+
+
+def src_clean():
+    r = subprocess.run(["git", "status", "--short", "--", "src"], cwd=REPO, capture_output=True, text=True)
+    return r.stdout.strip() == "", r.stdout
+
+
+def census_current():
+    if not CENSUS_JSON.exists() or not SITES.exists():
+        return False, "no census (run tools/lever_census.py --sites -j 16)"
+    d = json.loads(CENSUS_JSON.read_text())
+    st = d.get("src_stamp")
+    if not st:
+        return False, "the census carries no src_stamp (regenerate it)"
+    if st != lc.src_stamp():
+        return False, f"the census describes another tree (stamp {st}); rerun tools/lever_census.py --sites -j 16"
+    return True, "ok"
+
+
+def ensure_census(jobs):
+    ok, why = census_current()
+    if ok:
+        return
+    print(f"delever: {why} — running the census now", flush=True)
+    lc.run_census(jobs, use_cache=True, want_sites=True)
+    ok, why = census_current()
+    if not ok:
+        sys.exit(f"delever: the census is still not current ({why}) (R43)")
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# the ledger
+# ----------------------------------------------------------------------------------------------------------------------
+def load_ledger():
+    rows = []
+    if LEDGER.exists():
+        for l in LEDGER.read_text().splitlines():
+            if l.strip():
+                rows.append(json.loads(l))
+    return rows
+
+
+def ledger_append(rows):
+    RUN.mkdir(parents=True, exist_ok=True)
+    with _LOCK, open(LEDGER, "a") as f:
+        for r in rows:
+            f.write(json.dumps(r) + "\n")
+
+
+def ledger_index(rows):
+    """(done_after: set of nhash_after, exemplars: nhash_before -> the latest judged row) — the latest row per body wins (R70:
+    the tie-break is part of the instrument: rows are appended in time order, the last one is the current verdict)."""
+    done, ex = set(), {}
+    for r in rows:
+        if r.get("verdict") in DONE_VERDICTS and r.get("nhash_after"):
+            done.add(r["nhash_after"])
+        if r.get("verdict") in ("LEVER-FREE", "RESIDUE") and r.get("nhash_before") and not r.get("replay_disagreed"):
+            ex[r["nhash_before"]] = r
+    return done, ex
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# the ladder on one body — judge(text, removed_ids) -> (verdict, seconds, err); the real judge ignores removed_ids (a stub uses it)
+# ----------------------------------------------------------------------------------------------------------------------
+def site_key(s):
+    return (s["kind"], s.get("detail", ""))
+
+
+def ladder(b, raw, m, ls, judge, replay_from=None, log=None):
+    """Returns dict(verdict, rung, sites=[{ord, kind, cls, detail, line, verdict, why, oracle}], accepted=[edits], compiles, seconds,
+    replay_disagreed). Never writes the file (the judge does, and restores)."""
+    sites = list(b["sites"])
+    res = dict(verdict=None, rung=None, sites=[], accepted=[], compiles=0, seconds=0.0, replay_disagreed=False, refused=0)
+    per = {}
+    usable = []
+    for i, s in enumerate(sites):
+        try:
+            per[i] = site_edits(raw, m, ls, s)
+            usable.append(i)
+        except Refuse as ex:
+            res["sites"].append(dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                                     verdict="REFUSED", why=str(ex)[:160], oracle=""))
+            res["refused"] += 1
+    # two zero pins in one body collide (both rewrite the same uses)
+    zeros = [i for i in usable if sites[i].get("zero")]
+    if len(zeros) > 1:
+        for i in zeros:
+            usable.remove(i)
+            res["sites"].append(dict(ord=i, kind=sites[i]["kind"], cls="A", detail=sites[i]["detail"], via="", line=sites[i]["line"],
+                                     verdict="REFUSED", why="two zero-register pins in one body", oracle=""))
+            res["refused"] += 1
+    if not usable:
+        res["verdict"] = "NOTHING-USABLE"
+        res["sites"].sort(key=lambda x: x["ord"])
+        return res
+
+    def judge_edits(idxs, tag):
+        edits = [e for i in idxs for e in per[i]]
+        try:
+            cand = apply_edits(raw, edits)
+        except Refuse as ex:
+            return "REFUSED", str(ex)
+        if cand == raw:
+            return "REFUSED", "no-op edit (the candidate equals the original — an identical object would prove nothing, R37)"
+        v, dt, err = judge(cand, set(idxs), tag)
+        res["compiles"] += 1
+        res["seconds"] += dt
+        return v, err
+
+    def close(removed, needed, rung):
+        for i in usable:
+            s = sites[i]
+            if i in removed:
+                d = dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                         verdict="REMOVED", why="", oracle="IDENTICAL")
+                if s["kind"] == "launder" and per[i] and per[i][0][2].strip():
+                    d["verdict"], d["why"] = "REWRITTEN", "assignment"
+                elif s["kind"] == "instruction" or (s.get("via") and per[i] and per[i][0][2].strip()):
+                    d["verdict"], d["why"] = "REWRITTEN", (per[i][0][2].strip()[:60])
+                res["sites"].append(d)
+            else:
+                v, err = needed[i]
+                res["sites"].append(dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                                         verdict="NEEDED", why=(err[:160] if v != "DIFFERS" else ""), oracle=v))
+        res["accepted"] = [e for i in removed for e in per[i]]
+        res["verdict"] = "LEVER-FREE" if not needed else "RESIDUE"
+        res["rung"] = rung
+        res["sites"].sort(key=lambda x: x["ord"])
+        return res
+
+    # replay: the exemplar's accepted set by ordinal, when the site sequences agree
+    if replay_from:
+        ex_sites = replay_from["sites"]
+        same = len(ex_sites) == len(sites) and all(site_key(sites[i]) == (x["kind"], x.get("detail", "")) for i, x in enumerate(ex_sites))
+        if same:
+            want = [x["ord"] for x in ex_sites if x["verdict"] in ("REMOVED", "REWRITTEN") and x["ord"] in usable]
+            if want:
+                v, err = judge_edits(want, "R")
+                if v == "IDENTICAL":
+                    needed = {i: ("DIFFERS", "") for i in usable if i not in want}
+                    for x in ex_sites:
+                        if x["ord"] in needed:
+                            needed[x["ord"]] = (x.get("oracle") or "DIFFERS", x.get("why", ""))
+                    return close(set(want), needed, "replay")
+                res["replay_disagreed"] = True
+                if log:
+                    log(f"  {b['tu']}:{b['fn']} replay of {replay_from.get('tu')}:{replay_from.get('fn')} DISAGREED ({v}) — full ladder")
+    # rung A
+    vA, errA = judge_edits(usable, "A")
+    if vA == "IDENTICAL":
+        return close(set(usable), {}, "A")
+    if vA == "REFUSED":
+        res["verdict"] = "REFUSED"
+        for i in usable:                          # every site of the body survives, each with the reason (so each gets its marker)
+            s = sites[i]
+            res["sites"].append(dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                                     verdict="REFUSED", why=("body: " + errA)[:160], oracle=""))
+        res["sites"].sort(key=lambda x: x["ord"])
+        return res
+    # rung B greedy, asm statements first
+    order = sorted(usable, key=lambda i: (ORDER.get(sites[i]["kind"], 9), sites[i]["line"], sites[i]["col"]))
+    accepted, needed = [], {}
+    for i in order:
+        v, err = judge_edits(accepted + [i], "B")
+        if v == "IDENTICAL":
+            accepted.append(i)
+        else:
+            needed[i] = (v, err)
+    if log:
+        log(f"  {b['tu']}:{b['fn']} A={vA} B: removed {len(accepted)} needed {len(needed)} compiles {res['compiles']}")
+    return close(set(accepted), needed, "B")
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# the plan
+# ----------------------------------------------------------------------------------------------------------------------
+def class_sizes(bodies):
+    c = collections.Counter(b["nhash"] for b in bodies.values() if b["nhash"] and b["sites"])
+    return c
+
+
+def make_plan(bodies, ledger_rows, headers, batch, only, rejudge=False):
+    """[(file, [bodies])] in campaign order: headers by includer count desc, TUs by their largest class first (so exemplars precede
+    their copies), then path; a body is drawable iff its sites are non-empty (or it has DEFERRED asm-bodies) and its nhash is not a
+    ledger row's after-hash."""
+    done, ex = ledger_index(ledger_rows)
+    sizes = class_sizes(bodies)
+    files = collections.defaultdict(list)
+    for (tu, fn), b in bodies.items():
+        if tu.endswith(".h") != headers:
+            continue
+        if not b["sites"] and not b["deferred"]:
+            continue
+        if b["nhash"] in done and not rejudge:
+            continue
+        if only and not any(o in b["aliases"] or o == tu or tu.endswith("/" + o) or (b["nhash"] or "").startswith(o) or o == fn for o in only):
+            continue
+        files[tu].append(b)
+    def fkey(tu):
+        bs = files[tu]
+        if headers:
+            return (-max(b["includers"] for b in bs), tu)
+        return (-max(sizes.get(b["nhash"], 1) for b in bs), tu)
+    ordered = sorted(files, key=fkey)
+    plan = [(tu, sorted(files[tu], key=lambda b: (b["fn"] == FILE_SCOPE_FN, b["fn_line"] or 0))) for tu in ordered[:batch]]
+    return plan, len(ordered), ex
+
+
+def describe_plan(plan, total_files, bodies):
+    n_b = sum(len(bs) for _, bs in plan)
+    n_s = sum(len(b["sites"]) for _, bs in plan for b in bs)
+    n_d = sum(len(b["deferred"]) for _, bs in plan for b in bs)
+    sizes = class_sizes(bodies)
+    n_multi = sum(1 for _, bs in plan for b in bs if sizes.get(b["nhash"], 1) > 1)
+    return (f"delever --plan: {len(plan)} of {total_files} drawable files · {n_b} bodies ({n_multi} in multi-copy classes) · "
+            f"{n_s} removable sites · {n_d} deferred asm-bodies")
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# --apply
+# ----------------------------------------------------------------------------------------------------------------------
+def restore_file(path, raw, st):
+    path.write_text(raw, errors="surrogateescape")
+    try:
+        os.utime(path, ns=(st.st_atime_ns, st.st_mtime_ns))
+    except OSError:
+        pass
+
+
+def work_file(tu, bs, recipes_for, pool, exemplars, ledger_ex, label, log, calib_id):
+    """One file: every body through the ladder (replay first) against the ORIGINAL text; the final splice compiled through every
+    recipe; the file left with its final text (or restored). Returns (rows, summary)."""
+    path = REPO / tu
+    st = path.stat()
+    raw = path.read_text(errors="surrogateescape")
+    m = same_len_mask(raw)
+    ls = line_starts(raw)
+    is_hdr = tu.endswith(".h")
+    recs = recipes_for(tu)
+    out = dict(tu=tu, bodies=len(bs), rows=[], compiles=0, seconds=0.0, final="", written=False, sites_removed=0, sites_needed=0,
+               sites_refused=0, sites_deferred=0, lever_free=0, residue=0, refused_bodies=0, replays=0, disagreed=0)
+    if not recs:
+        for b in bs:
+            out["rows"].append(dict(ts=time.strftime("%Y-%m-%d %H:%M:%S"), label=label, rung=None, calib=calib_id, tu=tu, fn=b["fn"],
+                                    addr=fn_addr(b["fn"], tu), aliases=b["aliases"], header=is_hdr, verdict="NO-RECIPE", sites=[]))
+        return out
+    primary = recs[:1] if is_hdr else recs          # a header's greedy runs on ONE includer; the final on all
+
+    def judge_factory(recipe_list, parallel=False):
+        def judge(text, removed, tag):
+            try:
+                if parallel and pool is not None and len(recipe_list) > 1:
+                    path.write_text(text, errors="surrogateescape")
+                    vs = list(pool.map(lambda r: oracle.judge(r, None, tag=tag), recipe_list))
+                    bad = [v for v in vs if v[0] != "IDENTICAL"]
+                    return (bad[0][0], sum(v[1] for v in vs), bad[0][2]) if bad else ("IDENTICAL", sum(v[1] for v in vs), "")
+                return oracle.judge_all(recipe_list, text, tag=tag, write_path=(tu if is_hdr else None))
+            finally:
+                restore_file(path, raw, st)
+        return judge
+    judge_one = judge_factory(primary)
+    judge_every = judge_factory(recs, parallel=True)
+
+    accepted_all, survivors, rows = [], [], []
+    fs_edits = []
+    for b in bs:
+        replay = exemplars.get(b["nhash"]) or ledger_ex.get(b["nhash"]) if b["nhash"] else None
+        if replay and replay.get("tu") == tu and replay.get("fn") == b["fn"]:
+            replay = None
+        res = ladder(b, raw, m, ls, judge_one, replay_from=replay, log=log) if b["sites"] else \
+            dict(verdict="DEFERRED-ONLY", rung=None, sites=[], accepted=[], compiles=0, seconds=0.0, replay_disagreed=False, refused=0)
+        # a header whose greedy ran on one includer: the accepted set must hold on every includer (h_text headers differ per binary)
+        if is_hdr and len(recs) > 1 and res["accepted"] and res["verdict"] in ("LEVER-FREE", "RESIDUE"):
+            v, dt, err = judge_every(apply_edits(raw, res["accepted"]), None, "H")
+            res["compiles"] += len(recs)
+            res["seconds"] += dt
+            if v != "IDENTICAL":
+                log(f"  {tu}:{b['fn']} the one-includer verdict does not hold on every includer ({v}) — greedy on all includers")
+                res = ladder(b, raw, m, ls, judge_every, replay_from=None, log=log)
+                res["rung"] = (res.get("rung") or "") + "-all"
+        for s in b["deferred"]:
+            res["sites"].append(dict(ord=-1, kind=s["kind"], cls=s["cls"], detail=s.get("disposition", ""), via="", line=s["line"],
+                                     verdict="DEFERRED", why="T7", oracle=""))
+        if res.get("rung") == "replay":
+            out["replays"] += 1
+        if res.get("replay_disagreed"):
+            out["disagreed"] += 1
+        out["compiles"] += res["compiles"]
+        out["seconds"] += res["seconds"]
+        if b["fn"] == FILE_SCOPE_FN:
+            fs_edits = res["accepted"]
+        else:
+            accepted_all += res["accepted"]
+        for d in res["sites"]:
+            if d["verdict"] in ("NEEDED", "REFUSED", "DEFERRED"):
+                s = b["sites"][d["ord"]] if d["ord"] >= 0 and d["kind"] != "body" and d["verdict"] != "DEFERRED" else None
+                if d["verdict"] == "DEFERRED":
+                    s = next(x for x in b["deferred"] if x["line"] == d["line"])
+                if s is not None:
+                    survivors.append((s, d["verdict"], (d["oracle"] if d["verdict"] == "NEEDED" else d["why"]) or ""))
+            out["sites_removed"] += d["verdict"] in ("REMOVED", "REWRITTEN")
+            out["sites_needed"] += d["verdict"] == "NEEDED"
+            out["sites_refused"] += d["verdict"] == "REFUSED"
+            out["sites_deferred"] += d["verdict"] == "DEFERRED"
+        out["lever_free"] += res["verdict"] == "LEVER-FREE"
+        out["residue"] += res["verdict"] == "RESIDUE"
+        out["refused_bodies"] += res["verdict"] in ("REFUSED", "NOTHING-USABLE")
+        row = dict(ts=time.strftime("%Y-%m-%d %H:%M:%S"), label=label, rung=res.get("rung"), calib=calib_id, tu=tu, fn=b["fn"],
+                   addr=fn_addr(b["fn"], tu), aliases=b["aliases"], header=is_hdr, includers=b.get("includers", 0),
+                   o0=any("-O0" in r["pipeline"] for r in recs), nhash_before=b["nhash"], nhash_after=None,
+                   exemplar=(dict(tu=replay["tu"], fn=replay["fn"]) if replay and res.get("rung") == "replay" else None),
+                   verdict=res["verdict"], replay_disagreed=res.get("replay_disagreed", False), sites=res["sites"],
+                   compiles=res["compiles"], seconds=round(res["seconds"], 3))
+        rows.append((b, row))
+        if res["verdict"] in ("LEVER-FREE", "RESIDUE") and b["fn"] != FILE_SCOPE_FN:
+            with _LOCK:
+                exemplars.setdefault(b["nhash"], dict(row, tu=tu, fn=b["fn"]))
+    # the final splice: everything accepted + the markers, compiled through every recipe
+    rung_label = "rung B" if any(r.get("rung") == "B" for _, r in rows) else "rung A"
+    markers = marker_edits(raw, ls, survivors, rung_label, label)
+    def final_text(with_fs):
+        return apply_edits(raw, accepted_all + (fs_edits if with_fs else []) + markers)
+    final = None
+    for with_fs in ((True, False) if fs_edits else (True,)):
+        cand = final_text(with_fs)
+        if cand == raw:
+            final, verdict = raw, "UNCHANGED"
+            break
+        v, dt, err = judge_every(cand, None, "F")
+        out["compiles"] += len(recs)
+        out["seconds"] += dt
+        if v == "IDENTICAL":
+            final, verdict = cand, "IDENTICAL"
+            if not with_fs:
+                log(f"  {tu}: the file-scope volatile edits do not combine with the bodies' — dropped (kept as NEEDED)")
+                for b, row in rows:
+                    if b["fn"] == FILE_SCOPE_FN:
+                        row["verdict"] = "RESIDUE"
+                        for d in row["sites"]:
+                            if d["verdict"] in ("REMOVED", "REWRITTEN"):
+                                d["verdict"], d["why"], d["oracle"] = "NEEDED", "does not combine with the bodies' edits", "DIFFERS"
+                                out["sites_removed"] -= 1
+                                out["sites_needed"] += 1
+            break
+        verdict = v
+    if final is None:
+        # the combination failed: restore, refuse the whole file, loudly
+        restore_file(path, raw, st)
+        out["final"] = f"COMBINATION-FAILED ({verdict})"
+        log(f"  {tu}: COMBINATION-FAILED ({verdict}) — every body of this file REFUSED, the file restored")
+        for b, row in rows:
+            row["verdict"] = "COMBINATION-FAILED"
+            row["nhash_after"] = None
+        out["lever_free"] = out["residue"] = 0
+        out["refused_bodies"] = len(rows)
+        out["sites_removed"] = 0
+    else:
+        out["final"] = verdict
+        if final != raw:
+            path.write_text(final, errors="surrogateescape")
+            out["written"] = True
+        else:
+            restore_file(path, raw, st)
+        # the after-hash of every body from the FINAL text (the census's own normalization)
+        try:
+            walk = lc.walk_file(final, tu, is_hdr)
+            nh = {d["name"]: d["nhash"] for d in walk["defs"]}
+            fs_sites = [s for s in walk["sites"] if s["cls"] == "C" and s["kind"] == "decl-file"]
+            fs_hash = "fs:" + hashlib.sha1("\n".join(s["text"] for s in fs_sites).encode()).hexdigest()
+            for b, row in rows:
+                row["nhash_after"] = fs_hash if b["fn"] == FILE_SCOPE_FN else nh.get(b["fn"])
+                if row["nhash_after"] is None and b["fn"] != FILE_SCOPE_FN:
+                    row["nhash_after"] = b["nhash"]
+                    log(f"  {tu}:{b['fn']}: the census did not find the function in the final text — after-hash kept as before-hash")
+        except Exception as ex:   # noqa: BLE001 — the ledger must not lose the batch over a scanner hiccup
+            log(f"  {tu}: after-hash walk failed ({ex}) — after-hash = before-hash")
+            for b, row in rows:
+                row["nhash_after"] = b["nhash"]
+    out["rows"] = [row for _, row in rows]
+    return out
+
+
+def apply_batch(a):
+    RUN.mkdir(parents=True, exist_ok=True)
+    clean, dirty = src_clean()
+    if not clean:
+        sys.exit(f"delever --apply: src/ is dirty — commit, or `tools/delever.py --restore` if a batch is in flight (R42/R102):\n{dirty[:600]}")
+    if INFLIGHT.exists():
+        INFLIGHT.unlink()                            # src is clean: the previous batch was committed (or restored)
+    ok, why = oracle.calibration_current()
+    if not ok:
+        sys.exit(f"delever --apply: the oracle's calibration is not current ({why}) — tools/delever_oracle.py --calibrate … first (R56)")
+    calib = json.loads(oracle.CALIB.read_text())
+    calib_id = dict(head=calib.get("head"), stamp=calib.get("stamp"))
+    ensure_census(a.jobs)
+    recipes = oracle.load_recipes()["recipes"]
+    by_src = oracle.recipes_by_src(recipes)
+    inc = includers()
+    sites = load_sites()
+    bodies = bodies_from_sites(sites, with_file_scope=True)
+    rows = load_ledger()
+    plan, total, ledger_ex = make_plan(bodies, rows, a.headers, a.batch, a.only, a.rejudge)
+    print(describe_plan(plan, total, bodies), flush=True)
+    if not plan:
+        print("delever --apply: nothing to do (no drawable file)")
+        return 0
+    # negative control (R39/R56): the first TU of the batch compiled untouched must equal build/
+    def recipes_for(tu):
+        if tu.endswith(".h"):
+            return [r for t in inc.get(tu, []) for r in by_src.get(t, [])]
+        return by_src.get(tu, [])
+    ctl = next((tu for tu, _ in plan if recipes_for(tu)), None)
+    if ctl is None:
+        sys.exit("delever --apply: no file of the batch has a recipe (R43)")
+    r0 = recipes_for(ctl)[0]
+    v, dt, err = oracle.judge(r0, None, tag="ctl")
+    if v != "IDENTICAL":
+        sys.exit(f"delever --apply: the negative control FAILED — {ctl} untouched compiles {v} vs build/ ({err[:200]}); the baseline is stale (R56)")
+    # the in-flight snapshot BEFORE any write (the only restore, R102)
+    INFLIGHT.write_text(json.dumps({tu: (REPO / tu).read_text(errors="surrogateescape") for tu, _ in plan}))
+    log_p = RUN / f"apply_{a.label}.log"
+    log_f = open(log_p, "a")
+    def log(msg):
+        line = f"{time.strftime('%H:%M:%S')} {msg}"
+        with _LOCK:
+            print(line, flush=True)
+            log_f.write(line + "\n")
+            log_f.flush()
+    log(f"apply {a.label}: {len(plan)} files, control {ctl} IDENTICAL ({dt:.2f} s), calibration {calib_id['head']}, census {json.loads(CENSUS_JSON.read_text()).get('src_stamp')}")
+    exemplars = {}
+    results = []
+    t0 = time.time()
+    pool = ThreadPoolExecutor(max_workers=a.jobs)
+    if a.headers:
+        # headers SERIAL (a header's edit reaches every includer; nothing else may compile meanwhile); the includers in parallel
+        for tu, bs in plan:
+            results.append(work_file(tu, bs, recipes_for, pool, exemplars, ledger_ex, a.label, log, calib_id))
+            ledger_append(results[-1]["rows"])
+    else:
+        # translation units in parallel, one worker per FILE (no two candidates of one file at once; no header is edited)
+        def one(item):
+            tu, bs = item
+            r = work_file(tu, bs, recipes_for, None, exemplars, ledger_ex, a.label, log, calib_id)
+            ledger_append(r["rows"])
+            return r
+        covered, phase1, phase2 = set(), [], []
+        for tu, bs in plan:
+            fresh = [b["nhash"] for b in bs if b["nhash"] and b["nhash"] not in covered and b["nhash"] not in ledger_ex]
+            (phase1 if fresh else phase2).append((tu, bs))
+            covered.update(fresh)
+        log(f"apply {a.label}: phase 1 (exemplar files) {len(phase1)}, phase 2 (copies replay) {len(phase2)}")
+        with ThreadPoolExecutor(max_workers=a.jobs) as ex:
+            results = list(ex.map(one, phase1))
+        with ThreadPoolExecutor(max_workers=a.jobs) as ex:
+            results += list(ex.map(one, phase2))
+    pool.shutdown(wait=True)
+    wall = time.time() - t0
+    agg = collections.Counter()
+    for r in results:
+        for k in ("bodies", "compiles", "sites_removed", "sites_needed", "sites_refused", "sites_deferred", "lever_free", "residue",
+                  "refused_bodies", "replays", "disagreed", "written"):
+            agg[k] += r[k]
+        agg["seconds"] += r["seconds"]
+        agg["final_ok"] += r["final"] in ("IDENTICAL", "UNCHANGED")
+        agg["final_bad"] += r["final"].startswith("COMBINATION-FAILED") or r["final"] == ""
+    summary = dict(label=a.label, generated=time.strftime("%Y-%m-%d %H:%M"), headers=a.headers, batch=a.batch, only=a.only, files=len(plan),
+                   drawable_files=total, wall_s=round(wall, 1), calib=calib_id, **{k: agg[k] for k in agg},
+                   per_file=[dict(tu=r["tu"], bodies=r["bodies"], final=r["final"], written=r["written"], removed=r["sites_removed"],
+                                  needed=r["sites_needed"], refused=r["sites_refused"], compiles=r["compiles"]) for r in results])
+    (RUN / f"batch_{a.label}.json").write_text(json.dumps(summary, indent=1) + "\n")
+    line = (f"delever: batch {a.label} — {len(plan)} files ({'headers' if a.headers else 'TUs'}; {total} drawable) · {agg['bodies']} bodies: "
+            f"{agg['lever_free']} lever-free, {agg['residue']} residue, {agg['refused_bodies']} refused · sites removed {agg['sites_removed']} / "
+            f"needed {agg['sites_needed']} / refused {agg['sites_refused']} / deferred {agg['sites_deferred']} · replays {agg['replays']} "
+            f"({agg['disagreed']} disagreed) · compiles {agg['compiles']} in {wall:.0f} s wall · final {agg['final_ok']}/{len(plan)} identical · "
+            f"written {agg['written']} files")
+    log(line)
+    log_f.close()
+    return 0 if agg["final_bad"] == 0 else 1
+
+
+def restore():
+    if not INFLIGHT.exists():
+        sys.exit("delever --restore: no inflight.json — nothing in flight")
+    d = json.loads(INFLIGHT.read_text())
+    n = 0
+    for tu, text in d.items():
+        p = REPO / tu
+        if p.read_text(errors="surrogateescape") != text:
+            p.write_text(text, errors="surrogateescape")
+            n += 1
+    INFLIGHT.unlink()
+    clean, dirty = src_clean()
+    print(f"delever --restore: {n} of {len(d)} files restored from inflight.json; src {'clean' if clean else 'STILL DIRTY:'}\n{'' if clean else dirty[:400]}")
+    return 0 if clean else 1
+
+
+def status():
+    rows = load_ledger()
+    done, ex = ledger_index(rows)
+    latest = {}
+    for r in rows:
+        latest[(r["tu"], r["fn"])] = r
+    c = collections.Counter(r["verdict"] for r in latest.values())
+    sc_ = collections.Counter(d["verdict"] for r in latest.values() for d in r.get("sites", []))
+    kinds = collections.Counter((d["kind"], d["verdict"]) for r in latest.values() for d in r.get("sites", []))
+    print(f"delever --status: {len(rows)} rows, {len(latest)} bodies (latest row each): {dict(c)}")
+    print(f"  sites: {dict(sc_)}")
+    for (k, v), n in sorted(kinds.items()):
+        print(f"    {k:12s} {v:10s} {n}")
+    print(f"  after-hashes done {len(done)} · exemplars {len(ex)} · labels {sorted({r['label'] for r in rows})}")
+    return 0
+
+
+def apply_body(a):
+    """--apply-body TU FN FILE: the function's definition replaced by FILE's text, judged through every recipe (or every includer),
+    kept and ledgered on IDENTICAL; refused if the new body still carries a class A/B lever (unless --allow-residue)."""
+    tu, fn, src = a.apply_body
+    path = REPO / tu
+    if not path.exists():
+        sys.exit(f"delever --apply-body: no such file {tu}")
+    clean, dirty = src_clean()
+    if not clean and not a.dirty_ok:
+        sys.exit(f"delever --apply-body: src/ is dirty (commit or --restore first):\n{dirty[:400]}")
+    ok, why = oracle.calibration_current()
+    if not ok:
+        sys.exit(f"delever --apply-body: calibration not current ({why})")
+    new = pathlib.Path(src).read_text(errors="surrogateescape").rstrip("\n") + "\n"
+    raw = path.read_text(errors="surrogateescape")
+    st = path.stat()
+    recs = lc.sc.scan_text(raw, tu, shared_defs=None)
+    d = next((r for r in recs if r["form"] == "def" and r["name"] == fn), None)
+    if d is None:
+        sys.exit(f"delever --apply-body: {fn} is not defined in {tu}")
+    ls = line_starts(raw)
+    before = raw[ls[d["line"] - 1]:ls[d["end"]]]
+    cand = raw[:ls[d["line"] - 1]] + new + raw[ls[d["end"]]:]
+    if cand == raw:
+        sys.exit("delever --apply-body: the new body equals the current text (no-op, R37)")
+    walk = lc.walk_file(cand, tu, tu.endswith(".h"))
+    levers = [s for s in walk["sites"] if s.get("fn") == fn and s["cls"] in "AB" and s["kind"] not in lc.NON_LEVER_KINDS]
+    if levers and not a.allow_residue:
+        sys.exit(f"delever --apply-body: the new body still carries {len(levers)} class A/B lever site(s) "
+                 f"({[(s['kind'], s['detail'], s['line']) for s in levers][:6]}) — no lever of any class may remain (--allow-residue to override)")
+    recipes = oracle.load_recipes()["recipes"]
+    by_src = oracle.recipes_by_src(recipes)
+    inc = includers()
+    recs_ = [r for t in inc.get(tu, []) for r in by_src.get(t, [])] if tu.endswith(".h") else by_src.get(tu, [])
+    if not recs_:
+        sys.exit(f"delever --apply-body: no recipe compiles {tu}")
+    try:
+        v, dt, err = oracle.judge_all(recs_, cand, tag="body", write_path=(tu if tu.endswith(".h") else None))
+    finally:
+        restore_file(path, raw, st)
+    nh_before = lc.norm_hash(sc.mask_text(before))
+    nh_after = next((x["nhash"] for x in walk["defs"] if x["name"] == fn), None)
+    row = dict(ts=time.strftime("%Y-%m-%d %H:%M:%S"), label=a.label, rung=a.rung, calib=dict(head=oracle.head(), stamp=oracle.config_stamp()),
+               tu=tu, fn=fn, addr=fn_addr(fn, tu), aliases=None, header=tu.endswith(".h"), includers=len(inc.get(tu, [])),
+               nhash_before=nh_before, nhash_after=nh_after, source=src, verdict=("LEVER-FREE" if v == "IDENTICAL" else f"BODY-{v}"),
+               sites=[dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s["detail"], via=s.get("via", ""), line=s["line"], verdict="NEEDED",
+                           why="left by the author", oracle="") for i, s in enumerate(levers)],
+               compiles=len(recs_), seconds=round(dt, 3), objects=[r["obj"] for r in recs_])
+    if v == "IDENTICAL":
+        path.write_text(cand, errors="surrogateescape")
+        ledger_append([row])
+        print(f"delever --apply-body: {tu}:{fn} IDENTICAL on {len(recs_)} object(s) ({dt:.2f} s) — KEPT, ledgered (rung {a.rung}, {a.label})")
+        return 0
+    ledger_append([row])
+    print(f"delever --apply-body: {tu}:{fn} {v} on {len(recs_)} object(s) — NOT kept ({err[:200]})")
+    return 1
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# selftest: the fixture through the census's own parser, the rewrites, the ladder against a STUB oracle, the markers, a replay
+# ----------------------------------------------------------------------------------------------------------------------
+FIXTURE = r'''#include "common.h"
+extern volatile s32 D_800B0000;
+extern s32 D_800A46D0;
+#define SHB(x) __asm__ __volatile__("" : "=r"(x) : "0"(x))
+#define LAUNDER_X(p) \
+    ({ s32 _m = (s32)(p); __asm__("" : "=r"(_m) : "0"(_m)); _m; })
+#define XFERX(SRCOFF)                                                           \
+    src = *(s32 *)(a0 + SRCOFF);                                                \
+    __asm__("" : "=r"(src) : "0"(src));                                         \
+    func_80012000(src);
+/* a comment carrying a pin: register s32 fake __asm__("$5"); */
+s32 func_80128218(s32 a0)
+{
+    register s32 zr __asm__("$0");
+    register s32 s __asm__("$16") = a0;
+    register s32 t __asm__("$17");
+    register s32 *p __asm__("$4");
+    register int plain;
+    volatile s32 buf[2];
+    s32 v = *(volatile s32 *)(a0 + 0x1C);
+    s32 src;
+    t = 3;
+    __asm__ __volatile__("" ::: "memory");
+    __asm__("" : "=r"(v) : "0"(v));
+    __asm__("" : "=r"(p) : "0"(&D_800A46D0));
+    __asm__ __volatile__("" : : "r"(s));
+    __asm__("addu %0,%1,$zero" : "=r"(v) : "r"(s));
+    SHB(v);
+    v += (s32)LAUNDER_X(&buf);
+    XFERX(0xCC);
+    buf[0] = zr;
+    return v + zr + plain + buf[0] + (s32)p + t + D_800B0000;
+}
+s32 func_80128300(s32 a0)
+{
+    register s32 zr __asm__("$0");
+    zr = a0;
+    return zr;
+}
+void func_80128400(void)
+{
+    __asm__ __volatile__(".set noreorder\n" "addiu $sp, $sp, -24\n" "sw $ra, 16($sp)\n" "jal func_80012000\n" "nop\n"
+                         "lw $ra, 16($sp)\n" "jr $ra\n" "addiu $sp, $sp, 24\n" : : : "memory");
+}
+#if 0
+static void dead(void) { register s32 x __asm__("$8"); }
+#endif
+'''
+FIXTURE_COPY = FIXTURE.replace("func_80128218", "func_80138218").replace("D_800A46D0", "D_800B46D0").replace("D_800B0000", "D_800B1000")
+
+
+def selftest():
+    import tempfile
+    ok = True
+    def fail(msg):
+        nonlocal ok
+        ok = False
+        print("selftest FAIL:", msg)
+    d = pathlib.Path(tempfile.mkdtemp(prefix="delever_selftest_", dir=str(RUN if RUN.exists() else REPO / ".run")))
+    rel = "src/fx/x.c"
+    rel2 = "src/fx/y.c"
+    (d / "x.c").write_text(FIXTURE)
+    walk = lc.walk_file(FIXTURE, rel, False)
+    sites = [dict(s, aliases=["fx"], header=False, includers=0) for s in walk["sites"]]
+    bodies = bodies_from_sites(sites, with_file_scope=True)
+    b = bodies[(rel, "func_80128218")]
+    kinds = collections.Counter(s["kind"] for s in b["sites"])
+    want = {"pin": 4, "register": 1, "decl-body": 1, "cast": 1, "barrier": 1, "launder": 5, "keepalive": 1, "instruction": 1}
+    if dict(kinds) != want:
+        fail(f"fixture sites {dict(kinds)} != {want}")
+    raw = FIXTURE
+    m = same_len_mask(raw)
+    ls = line_starts(raw)
+    # the rewrites, one by one
+    texts = {}
+    refused = {}
+    for s in b["sites"]:
+        try:
+            texts[(s["kind"], s["line"])] = apply_edits(raw, site_edits(raw, m, ls, s))
+        except Refuse as ex:
+            refused[(s["kind"], s["line"], s.get("via", ""))] = str(ex)
+    def line_of(text, needle):
+        return next((ln for ln in text.split("\n") if needle in ln), None)
+    t = texts.get(("pin", 15))
+    if not t or "register" in line_of(t, "s32 s ") or 'asm' in line_of(t, "s32 s ") or "= a0;" not in line_of(t, "s32 s "):
+        fail(f"pin with initializer -> `{line_of(t or '', 's32 s ')}`")
+    t = texts.get(("pin", 14))
+    if not t or "zr" in t.split("func_80128300")[0] or "buf[0] = 0;" not in t or "return v + 0 + plain" not in t:
+        fail("zero pin: declaration deleted, uses -> 0")
+    t = texts.get(("launder", 25))
+    if not t or line_of(t, "p = &D_800A46D0;") is None:
+        fail("launder with a different input is an ASSIGNMENT")
+    t = texts.get(("launder", 24))
+    if not t or '"=r"(v) : "0"(v)' in t.split("SHB(v)")[0].split("#define")[-1]:
+        fail("same-expression launder deleted")
+    t = texts.get(("instruction", 27))
+    if not t or "v = s;" not in t:
+        fail(f"addu-$zero instruction -> assignment: `{line_of(t or '', 'v = s') }`")
+    t = texts.get(("launder", 28))
+    if not t or "SHB(v);" in t.split("#define XFERX")[-1]:
+        fail("SHB(v); (a pure launder statement macro) deleted")
+    t = texts.get(("launder", 29))
+    if not t or "v += (s32)((s32)(&buf));" not in t:
+        fail(f"expression-launder macro -> its value: `{line_of(t or '', 'v +=')}`")
+    if not any(k[0] == "launder" and k[2] == "XFERX" for k in refused):
+        fail(f"compound macro use must be REFUSED (got {refused})")
+    t = texts.get(("cast", 20))
+    if not t or "*(s32 *)(a0 + 0x1C)" not in t:
+        fail("volatile cast dropped")
+    t = texts.get(("decl-body", 19))
+    if not t or "    s32 buf[2];" not in t:
+        fail("volatile declaration dropped")
+    t = texts.get(("register", 18))
+    if not t or "    int plain;" not in t:
+        fail("bare register dropped")
+    t = texts.get(("barrier", 23))
+    if not t or '::: "memory"' in t.split("func_80128218")[1]:
+        fail("barrier deleted")
+    # the assigned zero pin is refused; the asm-body is deferred (no removable site)
+    b2 = bodies[(rel, "func_80128300")]
+    try:
+        site_edits(raw, m, ls, b2["sites"][0])
+        fail("assigned zero-register variable must be REFUSED")
+    except Refuse:
+        pass
+    b3 = bodies[(rel, "func_80128400")]
+    if b3["sites"] or len(b3["deferred"]) != 1:
+        fail(f"asm-body: sites {len(b3['sites'])} deferred {len(b3['deferred'])}")
+    fs = bodies.get((rel, FILE_SCOPE_FN))
+    if not fs or len(fs["sites"]) != 1:
+        fail("file-scope volatile pseudo-body")
+    # the ladder against a stub oracle: NEEDED = the $17 pin and the barrier; the keep-alive's removal CRASHES the compiler
+    idx = {(s["kind"], s["line"]): i for i, s in enumerate(b["sites"])}
+    needed_ids = {idx[("pin", 16)], idx[("barrier", 23)]}
+    crash_ids = {idx[("keepalive", 26)]}
+    calls = []
+    def stub(text, removed, tag):
+        calls.append(tag)
+        if removed & crash_ids:
+            return "COMPILE-CRASH", 0.01, "CRASH: 123 Aborted (core dumped)"
+        return ("DIFFERS" if removed & needed_ids else "IDENTICAL"), 0.01, ""
+    res = ladder(b, raw, m, ls, stub)
+    got = {(x["kind"], x["line"]): x["verdict"] for x in res["sites"]}
+    if res["verdict"] != "RESIDUE" or res["rung"] != "B":
+        fail(f"ladder verdict {res['verdict']} rung {res['rung']}")
+    if got.get(("pin", 16)) != "NEEDED" or got.get(("barrier", 23)) != "NEEDED" or got.get(("keepalive", 26)) != "NEEDED":
+        fail(f"needed set {got}")
+    if [x for x in res["sites"] if x["kind"] == "keepalive"][0]["oracle"] != "COMPILE-CRASH":
+        fail("a crashing candidate must be NEEDED with the CRASH verdict")
+    if got.get(("launder", 25)) != "REWRITTEN" or got.get(("instruction", 27)) != "REWRITTEN" or got.get(("launder", 29)) != "REWRITTEN":
+        fail(f"rewritten verdicts {got}")
+    if got.get(("launder", 30)) != "REFUSED":
+        fail("the compound-macro site is REFUSED in the ladder")
+    if res["compiles"] != 1 + (len(b["sites"]) - res["refused"]):
+        fail(f"rung A + greedy compiles {res['compiles']} for {len(b['sites'])} sites ({res['refused']} refused)")
+    # the markers: class A/B survivors only, one per line, C/D never
+    survivors = [(b["sites"][x["ord"]], x["verdict"], x["oracle"] or x["why"]) for x in res["sites"] if x["verdict"] in ("NEEDED", "REFUSED")]
+    survivors.append((b3["deferred"][0], "DEFERRED", "T7"))
+    final = apply_edits(raw, res["accepted"] + marker_edits(raw, ls, survivors, "rung B", "self1"))
+    fl = final.split("\n")
+    if sum(1 for l in fl if FAKE in l) != 5:
+        fail(f"markers: {sum(1 for l in fl if FAKE in l)} lines carry one (want 5: pin $17, barrier, keepalive, XFERX, asm-body)")
+    if not any("pin $17 — NEEDED DIFFERS (P36 rung B self1)" in l for l in fl):
+        fail("marker text for the needed pin")
+    if not any("keepalive — NEEDED COMPILE-CRASH" in l for l in fl):
+        fail("marker text for the crash")
+    if not any("launder via XFERX — REFUSED" in l for l in fl):
+        fail("marker text for the compound macro")
+    if any(FAKE in l and ("buf[2]" in l or "int plain" in l) for l in fl):
+        fail("class C/D sites must never carry a marker")
+    if lc.walk_file(final, rel, False)["defs"][0]["nhash"] == b["nhash"]:
+        fail("the after-hash must differ from the before-hash once sites were removed")
+    # a marker does not change the hash: the same final text with the markers stripped hashes the same
+    stripped = "\n".join(re.sub(r"\s*// !FAKE:.*$", "", l) for l in fl)
+    if lc.walk_file(stripped, rel, False)["defs"][0]["nhash"] != lc.walk_file(final, rel, False)["defs"][0]["nhash"]:
+        fail("markers changed the normalized hash")
+    # re-marking replaces the old marker instead of stacking a second one
+    ls2 = line_starts(final)
+    ln17 = next(i + 1 for i, l in enumerate(fl) if 'pin $17' in l)
+    again = apply_edits(final, marker_edits(final, ls2, [(dict(b["sites"][idx[("pin", 16)]], line=ln17), "NEEDED", "DIFFERS")], "rung B", "self2"))
+    if again.count("pin $17 — NEEDED") != 1 or "self2" not in again or "self1)  // !FAKE" in again:
+        fail("re-marking must replace the line's marker")
+    # the replay on a copy with a different address environment: one compile, the same verdicts
+    walk2 = lc.walk_file(FIXTURE_COPY, rel2, False)
+    sites2 = [dict(s, aliases=["fy"], header=False, includers=0) for s in walk2["sites"]]
+    bodies2 = bodies_from_sites(sites2, with_file_scope=True)
+    bc = bodies2[(rel2, "func_80138218")]
+    if bc["nhash"] != b["nhash"]:
+        fail("the copy's nhash must equal the exemplar's (addresses masked)")
+    exemplar_row = dict(tu=rel, fn="func_80128218", sites=res["sites"])
+    calls.clear()
+    res2 = ladder(bc, FIXTURE_COPY, same_len_mask(FIXTURE_COPY), line_starts(FIXTURE_COPY), stub, replay_from=exemplar_row)
+    if res2["rung"] != "replay" or res2["compiles"] != 1 or {(x["kind"], x["line"]): x["verdict"] for x in res2["sites"]} != got:
+        fail(f"replay: rung {res2['rung']} compiles {res2['compiles']}")
+    # a disagreeing replay falls through to the full ladder
+    def stub2(text, removed, tag):
+        return ("DIFFERS" if removed & (needed_ids | {idx[('pin', 15)]}) else "IDENTICAL"), 0.01, ""
+    res3 = ladder(bc, FIXTURE_COPY, same_len_mask(FIXTURE_COPY), line_starts(FIXTURE_COPY), stub2, replay_from=exemplar_row)
+    if not res3["replay_disagreed"] or res3["rung"] != "B" or {x["line"] for x in res3["sites"] if x["verdict"] == "NEEDED"} != {15, 16, 23}:
+        fail(f"disagreeing replay: {res3['replay_disagreed']} rung {res3['rung']} needed {[x['line'] for x in res3['sites'] if x['verdict'] == 'NEEDED']}")
+    # a no-op candidate is refused; overlapping edits are refused
+    try:
+        apply_edits(raw, [(0, 5, "x"), (3, 8, "y")])
+        fail("overlapping edits must be refused")
+    except Refuse:
+        pass
+    # the ledger index: after-hash done, before-hash replays, the latest row wins
+    rows = [dict(verdict="RESIDUE", nhash_before="h1", nhash_after="h2", sites=[]), dict(verdict="LEVER-FREE", nhash_before="h1", nhash_after="h3", sites=[{"ord": 0}])]
+    done, ex = ledger_index(rows)
+    if done != {"h2", "h3"} or ex["h1"]["nhash_after"] != "h3":
+        fail("ledger index")
+    # the oracle's crash classification on its real message forms (R103)
+    if not oracle.SIGNAL_LINE.search("bash: line 1: 3845091 Done   mipsel-linux-gnu-cpp ...\n     3845092 Aborted                 (core dumped) | tools/bin/gcc-2.7.2-psx/cc1 -quiet\n"):
+        fail("SIGNAL_LINE must match bash's job-status block")
+    if oracle.SIGNAL_LINE.search("src/x.c:3770: parse error before `}'\n"):
+        fail("SIGNAL_LINE must not match a diagnostic")
+    for f in d.glob("*"):
+        f.unlink()
+    d.rmdir()
+    print(f"delever --selftest: {'OK' if ok else 'FAIL'} — {len(b['sites'])} sites in the exemplar, {len(refused)} refused rewrite(s), "
+          f"ladder {res['verdict']} ({res['compiles']} compiles), replay {res2['rung']} ({res2['compiles']} compile), markers {sum(1 for l in fl if FAKE in l)}")
+    return ok
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# T2's probe (unchanged in substance; the corrected rewrites apply)
+# ----------------------------------------------------------------------------------------------------------------------
 def features(b):
     ks = collections.Counter(s["kind"] for s in b["sites"])
     n = len(b["sites"])
@@ -341,10 +1328,9 @@ def features(b):
 
 def stratified_sample(bodies, n, seed):
     rnd = random.Random(seed)
-    # one exemplar per normalized class
     by_class = {}
     for key, b in bodies.items():
-        if not b["sites"]:
+        if not b["sites"] or b["fn"] == FILE_SCOPE_FN:
             continue
         h = b["nhash"] or key
         cur = by_class.get(h)
@@ -353,14 +1339,12 @@ def stratified_sample(bodies, n, seed):
             by_class[h] = (pref, key)
     pool = [bodies[k] for _, k in by_class.values()]
     rnd.shuffle(pool)
-    # quotas scale with --sample (the shape of the population: main/resident/md are few but distinct, overlays are many)
     base = {"main": 20, "resident": 16, "md": 15, "shared": 20, "ov": 79}
     scale = n / sum(base.values())
     quota = {k: max(3, int(round(v * scale))) for k, v in base.items()}
     picked, seen = [], set()
     for kind, q in quota.items():
         cands = [b for b in pool if kind_of(b["tu"]) == kind]
-        # round-robin over (bucket, mix)
         groups = collections.defaultdict(list)
         for b in cands:
             f = features(b)
@@ -375,7 +1359,6 @@ def stratified_sample(bodies, n, seed):
                 if (b["tu"], b["fn"]) not in seen:
                     picked.append(b)
                     seen.add((b["tu"], b["fn"]))
-    # the special features, topped up from the pool
     for flag, want in (("zero", 10), ("init", 10), ("instr", 12), ("cast", 8), ("register", 5), ("launder", 8), ("keepalive", 6)):
         have = sum(1 for b in picked if features(b)[flag])
         for b in pool:
@@ -388,125 +1371,58 @@ def stratified_sample(bodies, n, seed):
     return picked
 
 
-# ----------------------------------------------------------------------------------------------------------------------
-# the ladder on one body
-# ----------------------------------------------------------------------------------------------------------------------
-def run_body(b, recipe, write_path, raw, m, ls, log):
-    """Returns the per-body result dict; the caller restores the file."""
-    sites = sorted(b["sites"], key=lambda s: (ORDER.get(s["kind"], 9), s["line"], s["col"]))
-    res = dict(tu=b["tu"], fn=b["fn"], nhash=b["nhash"], kind=kind_of(b["tu"]), aliases=b["aliases"], header=b["header"],
-               obj=recipe["obj"], n_sites=len(sites), sites=[dict(kind=s["kind"], cls=s["cls"], detail=s["detail"], line=s["line"]) for s in sites],
-               refused=[], compiles=0, seconds=0.0, features=features(b))
-    per_site, edits_all, edits_keep = {}, [], []
-    usable = []
-    for s in sites:
-        try:
-            ed = site_edits(raw, m, ls, s)
-            edk = site_edits(raw, m, ls, s, keep_register=True) if s["kind"] == "pin" else ed
-            per_site[id(s)] = (ed, edk)
-            usable.append(s)
-            edits_all += ed
-            edits_keep += edk
-        except Refuse as ex:
-            res["refused"].append(dict(kind=s["kind"], line=s["line"], why=str(ex)))
-    res["n_usable"] = len(usable)
-    if not usable:
-        res["verdict"] = "NOTHING-USABLE"
-        return res
-
-    def judge(edits, tag):
-        try:
-            cand = apply_edits(raw, edits)
-        except Refuse as ex:
-            return "REFUSED", str(ex)
-        if cand == raw:
-            return "REFUSED", "no-op edit (the candidate equals the original — an identical object would prove nothing, R37)"
-        v, dt, err = oracle.judge(recipe, cand, tag=tag, write_path=write_path)
-        res["compiles"] += 1
-        res["seconds"] += dt
-        return v, err
-    # rung A (register dropped) and A' (register kept)
-    vA, errA = judge(edits_all, "A")
-    res["rung_A"] = vA
-    res["rung_A_err"] = errA[:200] if vA == "COMPILE-ERROR" else ""
-    if any(s["kind"] == "pin" for s in usable):
-        vK, _ = judge(edits_keep, "Ak")
-        res["rung_A_keep_register"] = vK
-    else:
-        res["rung_A_keep_register"] = vA
-    if vA == "IDENTICAL":
-        res["removed"] = [dict(kind=s["kind"], detail=s["detail"], line=s["line"]) for s in usable]
-        res["needed"] = []
-        res["verdict"] = "LEVER-FREE"
-        return res
-    # rung B greedy
-    accepted, needed, removed = [], [], []
-    for s in usable:
-        ed, _ = per_site[id(s)]
-        v, err = judge(accepted + ed, "B")
-        if v == "IDENTICAL":
-            accepted += ed
-            removed.append(dict(kind=s["kind"], detail=s["detail"], line=s["line"]))
-        else:
-            needed.append(dict(kind=s["kind"], detail=s["detail"], line=s["line"], verdict=v, err=(err[:120] if v == "COMPILE-ERROR" else "")))
-    res["removed"], res["needed"] = removed, needed
-    res["verdict"] = "LEVER-FREE" if not needed else "RESIDUE"
-    log(f"  {b['tu']}:{b['fn']} A={vA} B: removed {len(removed)} needed {len(needed)} compiles {res['compiles']}")
-    return res
-
-
 def probe(sample_n, seed, jobs):
     PROBE.mkdir(parents=True, exist_ok=True)
     ok, why = oracle.calibration_current()
     if not ok:
         sys.exit(f"delever: the oracle's calibration is not current ({why}) — run tools/delever_oracle.py --calibrate first (R56)")
+    ensure_census(jobs)
     recipes = oracle.load_recipes()["recipes"]
+    by_src = oracle.recipes_by_src(recipes)
     sites = load_sites()
     bodies = bodies_from_sites(sites)
     inc = includers()
     sample = stratified_sample(bodies, sample_n, seed)
     log_f = open(PROBE / "probe_log.txt", "a")
-
     def log(msg):
         line = f"{time.strftime('%H:%M:%S')} {msg}"
         print(line, flush=True)
         log_f.write(line + "\n")
         log_f.flush()
     log(f"probe: {len(sample)} bodies sampled from {len(bodies)} lever bodies ({len({b['nhash'] for b in bodies.values() if b['sites']})} distinct classes); seed {seed}")
-    # group by the FILE that gets written (a TU, or a header) — one worker per file
     by_file = collections.defaultdict(list)
     for b in sample:
         by_file[b["tu"]].append(b)
-
     def work(tu):
         out = []
         if tu.endswith(".h"):
-            tus = [t for t in inc.get(tu, []) if ("build/" + t[:-2] + ".o") in recipes]
-            if not tus:
-                return [dict(tu=tu, fn=b["fn"], verdict="NO-INCLUDER-RECIPE") for b in by_file[tu]]
-            recipe = recipes["build/" + tus[0][:-2] + ".o"]
-            write_path = tu
+            recs = [r for t in inc.get(tu, []) for r in by_src.get(t, [])][:1]
         else:
-            obj = "build/" + tu[:-2] + ".o"
-            if obj not in recipes:
-                return [dict(tu=tu, fn=b["fn"], verdict="NO-RECIPE") for b in by_file[tu]]
-            recipe = recipes[obj]
-            write_path = None
+            recs = by_src.get(tu, [])[:1]
+        if not recs:
+            return [dict(tu=tu, fn=b["fn"], verdict="NO-RECIPE") for b in by_file[tu]]
         path = REPO / tu
+        st = path.stat()
         raw = path.read_text(errors="surrogateescape")
         m = same_len_mask(raw)
         ls = line_starts(raw)
-        try:
-            for b in by_file[tu]:
-                out.append(run_body(b, recipe, write_path, raw, m, ls, log))
-        finally:
-            path.write_text(raw, errors="surrogateescape")
+        def judge(text, removed, tag):
+            try:
+                return oracle.judge_all(recs, text, tag=tag, write_path=(tu if tu.endswith(".h") else None))
+            finally:
+                restore_file(path, raw, st)
+        for b in by_file[tu]:
+            res = ladder(b, raw, m, ls, judge, log=log)
+            out.append(dict(tu=tu, fn=b["fn"], nhash=b["nhash"], kind=kind_of(tu), aliases=b["aliases"], header=b["header"], obj=recs[0]["obj"],
+                            n_sites=len(b["sites"]), n_usable=len(b["sites"]) - res["refused"], verdict=res["verdict"], rung=res.get("rung"),
+                            rung_A=("IDENTICAL" if res.get("rung") == "A" else "DIFFERS" if res.get("rung") == "B" else res["verdict"]),
+                            removed=[x for x in res["sites"] if x["verdict"] in ("REMOVED", "REWRITTEN")],
+                            needed=[dict(x, verdict=x["oracle"]) for x in res["sites"] if x["verdict"] == "NEEDED"],
+                            refused=[x for x in res["sites"] if x["verdict"] == "REFUSED"], compiles=res["compiles"], seconds=res["seconds"],
+                            features=features(b)))
         return out
     results = []
     t0 = time.time()
-    # phase 1: translation units, one worker per TU (no two candidates of one file at once, and no header is being edited);
-    # phase 2: shared headers, SERIAL — a header's edit reaches every includer, so nothing else may compile meanwhile
-    # (the dry run's three "compile errors" were two workers' candidates crossing inside one includer)
     tu_files = sorted(f for f in by_file if not f.endswith(".h"))
     hdr_files = sorted(f for f in by_file if f.endswith(".h"))
     with ThreadPoolExecutor(max_workers=jobs) as ex:
@@ -535,13 +1451,13 @@ def summarize(results, bodies, wall, seed):
         if not rs:
             continue
         by_kind[k] = dict(bodies=len(rs), A_identical=sum(1 for r in rs if r["rung_A"] == "IDENTICAL"),
-                          A_keep_register_identical=sum(1 for r in rs if r.get("rung_A_keep_register") == "IDENTICAL"),
                           lever_free=sum(1 for r in rs if r["verdict"] == "LEVER-FREE"),
                           sites=sum(r["n_usable"] for r in rs), removed=sum(len(r["removed"]) for r in rs), needed=sum(len(r["needed"]) for r in rs),
                           compiles=sum(r["compiles"] for r in rs), mean_s_per_compile=round(sum(r["seconds"] for r in rs) / max(sum(r["compiles"] for r in rs), 1), 3))
     needed_kinds = collections.Counter(n["kind"] for r in judged for n in r["needed"])
     needed_detail = collections.Counter(f"{n['kind']}:{n['detail']}" for r in judged for n in r["needed"])
-    removed_kinds = collections.Counter(x["kind"] for r in judged for x in r["removed"])
+    needed_oracle = collections.Counter(n["verdict"] for r in judged for n in r["needed"])
+    removed_kinds = collections.Counter(x["kind"] + ("/rewritten" if x["verdict"] == "REWRITTEN" else "") for r in judged for x in r["removed"])
     refused = collections.Counter(x["why"].split(":")[0][:60] for r in results for x in r.get("refused", []))
     sites_total = sum(r["n_usable"] for r in judged)
     sites_needed = sum(len(r["needed"]) for r in judged)
@@ -556,37 +1472,35 @@ def summarize(results, bodies, wall, seed):
     return dict(generated=time.strftime("%Y-%m-%d %H:%M"), seed=seed, sampled=len(results), judged=len(judged),
                 not_judged=collections.Counter(r.get("verdict") for r in results if r not in judged),
                 rung_A_identical=sum(1 for r in judged if r["rung_A"] == "IDENTICAL"),
-                rung_A_keep_register_identical=sum(1 for r in judged if r.get("rung_A_keep_register") == "IDENTICAL"),
                 lever_free_after_B=sum(1 for r in judged if r["verdict"] == "LEVER-FREE"),
                 sites=dict(total=sites_total, removed=sites_total - sites_needed, needed=sites_needed, pct_removed=pct(sites_total - sites_needed, sites_total)),
-                needed_by_kind=dict(needed_kinds), needed_by_detail=dict(needed_detail.most_common(30)), removed_by_kind=dict(removed_kinds),
-                refused=dict(refused), by_kind=by_kind, flags=flags,
+                needed_by_kind=dict(needed_kinds), needed_by_detail=dict(needed_detail.most_common(30)), needed_by_oracle=dict(needed_oracle),
+                removed_by_kind=dict(removed_kinds), refused=dict(refused), by_kind=by_kind, flags=flags,
                 compiles=sum(r["compiles"] for r in judged), mean_compiles_per_body=round(mean_compiles, 2), mean_s_per_compile=round(mean_s, 3),
-                wall_s=round(wall, 1),
-                population=dict(bodies=pop_bodies, sites=pop_sites),
+                wall_s=round(wall, 1), population=dict(bodies=pop_bodies, sites=pop_sites),
                 pricing=dict(T4_compiles_est=int(pop_bodies * mean_compiles), T4_cpu_hours_est=round(pop_bodies * mean_compiles * mean_s / 3600, 2),
-                             T4_wall_hours_at_16_est=round(pop_bodies * mean_compiles * mean_s / 3600 / 12, 2),
+                             T4_wall_hours_at_12_est=round(pop_bodies * mean_compiles * mean_s / 3600 / 12, 2),
                              residue_bodies_est=int(pop_bodies * (1 - (sum(1 for r in judged if r["verdict"] == "LEVER-FREE") / max(len(judged), 1)))),
                              residue_sites_est=int(pop_sites * (sites_needed / max(sites_total, 1)))))
 
 
 def render(s):
     L = [f"# probe — {s['sampled']} bodies sampled, {s['judged']} judged (seed {s['seed']}, {s['generated']}, wall {s['wall_s']} s)", "",
-         f"- rung A (strip-all) identical: **{s['rung_A_identical']} / {s['judged']}** (register dropped) · {s['rung_A_keep_register_identical']} with `register` kept",
+         f"- rung A (strip-all) identical: **{s['rung_A_identical']} / {s['judged']}**",
          f"- lever-free after rung B: **{s['lever_free_after_B']} / {s['judged']}**",
          f"- sites: {s['sites']['total']} usable · removed {s['sites']['removed']} ({s['sites']['pct_removed']} %) · needed {s['sites']['needed']}",
-         f"- needed by kind: {s['needed_by_kind']}", f"- needed by detail (top): {s['needed_by_detail']}",
+         f"- needed by kind: {s['needed_by_kind']}", f"- needed by the oracle's word: {s['needed_by_oracle']}", f"- needed by detail (top): {s['needed_by_detail']}",
          f"- removed by kind: {s['removed_by_kind']}", f"- refused (rewrite not applicable): {s['refused']}",
          f"- compiles {s['compiles']} · mean {s['mean_compiles_per_body']} per body · {s['mean_s_per_compile']} s per compile", "",
-         "| kind | bodies | A identical | A (register kept) | lever-free after B | sites | removed | needed | compiles | s/compile |", "|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|"]
+         "| kind | bodies | A identical | lever-free after B | sites | removed | needed | compiles | s/compile |", "|---|---:|---:|---:|---:|---:|---:|---:|---:|"]
     for k, v in s["by_kind"].items():
-        L.append(f"| {k} | {v['bodies']} | {v['A_identical']} | {v['A_keep_register_identical']} | {v['lever_free']} | {v['sites']} | {v['removed']} | {v['needed']} | {v['compiles']} | {v['mean_s_per_compile']} |")
+        L.append(f"| {k} | {v['bodies']} | {v['A_identical']} | {v['lever_free']} | {v['sites']} | {v['removed']} | {v['needed']} | {v['compiles']} | {v['mean_s_per_compile']} |")
     L += ["", "| feature | bodies | lever-free |", "|---|---:|---:|"]
     for k, v in s["flags"].items():
         L.append(f"| {k} | {v['bodies']} | {v['lever_free']} |")
     p = s["pricing"]
     L += ["", f"**Pricing (R41; population {s['population']['bodies']:,} lever bodies / {s['population']['sites']:,} removable sites):** "
-          f"T4 ≈ {p['T4_compiles_est']:,} compiles ≈ {p['T4_cpu_hours_est']} CPU-h ≈ {p['T4_wall_hours_at_16_est']} h wall at 12 workers; "
+          f"T4 ≈ {p['T4_compiles_est']:,} compiles ≈ {p['T4_cpu_hours_est']} CPU-h ≈ {p['T4_wall_hours_at_12_est']} h wall at 12 workers; "
           f"residue after the mechanical ladder ≈ {p['residue_bodies_est']:,} bodies / {p['residue_sites_est']:,} sites (the sample's rates applied to the population)."]
     return "\n".join(L)
 
@@ -596,11 +1510,50 @@ def main():
     ap.add_argument("--probe", action="store_true")
     ap.add_argument("--sample", type=int, default=150)
     ap.add_argument("--seed", type=int, default=1)
+    ap.add_argument("--plan", action="store_true", help="list the next batch (no writes)")
+    ap.add_argument("--apply", action="store_true", help="judge the next batch and keep the winning texts in place")
+    ap.add_argument("--batch", type=int, default=300, help="files per batch")
+    ap.add_argument("--headers", action="store_true", help="draw shared headers instead of translation units (serial; includers in parallel)")
+    ap.add_argument("--only", nargs="*", default=None, help="restrict to these aliases / TU paths / function names / nhash prefixes")
+    ap.add_argument("--rejudge", action="store_true", help="draw bodies the ledger already marks done")
+    ap.add_argument("--label", default=None, help="the batch label (ledger rows, apply_<label>.log, batch_<label>.json)")
+    ap.add_argument("--restore", action="store_true", help="restore every in-flight file from inflight.json")
+    ap.add_argument("--status", action="store_true")
+    ap.add_argument("--apply-body", nargs=3, metavar=("TU", "FN", "FILE"))
+    ap.add_argument("--rung", default="E")
+    ap.add_argument("--allow-residue", action="store_true")
+    ap.add_argument("--dirty-ok", action="store_true", help="--apply-body on a dirty tree (a wave banking several bodies before one commit)")
+    ap.add_argument("--selftest", action="store_true")
     ap.add_argument("-j", "--jobs", type=int, default=12)
     a = ap.parse_args()
+    if a.selftest:
+        sys.exit(0 if selftest() else 1)
     if a.probe:
         probe(a.sample, a.seed, a.jobs)
         return
+    if a.restore:
+        sys.exit(restore())
+    if a.status:
+        sys.exit(status())
+    if a.apply_body:
+        if not a.label:
+            sys.exit("delever --apply-body: --label is required")
+        sys.exit(apply_body(a))
+    if a.plan:
+        ensure_census(a.jobs)
+        sites = load_sites()
+        bodies = bodies_from_sites(sites, with_file_scope=True)
+        plan, total, _ = make_plan(bodies, load_ledger(), a.headers, a.batch, a.only, a.rejudge)
+        print(describe_plan(plan, total, bodies))
+        for tu, bs in plan[:40]:
+            print(f"  {tu}: {len(bs)} bodies, {sum(len(b['sites']) for b in bs)} sites" + (f", {sum(len(b['deferred']) for b in bs)} deferred" if any(b['deferred'] for b in bs) else ""))
+        if len(plan) > 40:
+            print(f"  … {len(plan) - 40} more files")
+        return
+    if a.apply:
+        if not a.label:
+            sys.exit("delever --apply: --label is required (R48: the ledger rows, the log and the batch record are keyed by it)")
+        sys.exit(apply_batch(a))
     ap.print_help()
 
 
diff --git a/decomp-architect/corpus/tools/P10/delever_cycle.sh b/decomp-architect/corpus/tools/P10/delever_cycle.sh
new file mode 100644
index 0000000000..887661bbd2
--- /dev/null
+++ b/decomp-architect/corpus/tools/P10/delever_cycle.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# delever_cycle.sh — the Phase-36 batch cycle, mechanised (T3/T4). For each batch k in [START..END]:
+#   1. the tree must be clean (src/ + config/); the oracle's calibration is refreshed (2–3 s: it is keyed to HEAD, every commit stales it);
+#   2. `delever.py --apply --batch N --label <mode>k` judges every drawable body of the next N files and leaves the winning texts in place
+#      (the census is regenerated by the tool when its src stamp is stale); the tool's exit code and its `final X/X identical` are read (R97/R66);
+#   3. the outer gate: the CLEAN fleet run (make clean && extract-all && check-all -> `218 passed, 0 failed of 218`, R22) — it also refreshes
+#      build/, the oracle's baseline objects;
+#   4. the census is rerun on the new tree (the commit line quotes it), the phase log gets the batch's entry, the 🛑 headline is refreshed (R101),
+#      and src/ + the ledger/batch record/log + the census + the phase log are committed (R42).
+# Stops on the first red (a non-zero tool exit, a final N/M with N != M, a fleet run that is not 218/218) — the batch's files are then
+# still in place: inspect, then `tools/delever.py --restore` (never git checkout, R102). Stops cleanly when nothing is drawable.
+# Usage: [LABEL_PREFIX=t3_] [TASK=T4] tools/delever_cycle.sh START END [BATCH=300] [MODE=tus|headers] [ONLY="alias1 alias2 …"]
+#   size a call so one batch stays < 10 min: TUs ≈ 8 s each single-threaded / 12 workers; a header ≈ 4 s (serial, includers in parallel).
+set -o pipefail
+cd "$(dirname "$0")/.." || exit 2
+START=$1; END=$2; BATCH=${3:-300}; MODE=${4:-tus}; ONLY=${5:-}
+[ -n "$START" ] && [ -n "$END" ] || { echo "usage: $0 START END [BATCH] [tus|headers] [ONLY]"; exit 2; }
+case "$MODE" in tus) HFLAG="";; headers) HFLAG="--headers";; *) echo "MODE must be tus or headers"; exit 2;; esac
+ONLYFLAG=""; [ -n "$ONLY" ] && ONLYFLAG="--only $ONLY"
+FLEET=$(ls config/check.*.sha | wc -l)
+PY=.venv/bin/python
+MARKER='## Approved plan (verbatim, gate 1 — 2026-09-09)'
+for k in $(seq "$START" "$END"); do
+  label="${LABEL_PREFIX:-}${MODE}${k}"
+  [ -z "$(git status --short -- src config)" ] || { echo "cycle: src/ or config/ is dirty — commit, or tools/delever.py --restore (R42/R102)"; exit 3; }
+  [ -z "$(git status --short --porcelain src | grep '^??')" ] || { echo "cycle: untracked files under src/ (a dotfile probe?) — sweep them first"; exit 3; }
+  $PY tools/delever_oracle.py --status >/dev/null 2>&1 || $PY tools/delever_oracle.py --calibrate ov_SC04_011 ov_SC03_015 ov_SC03_014 main -j 16 > .run/P36/delever/calibrate_${label}.log 2>&1 \
+    || { echo "cycle: calibration FAILED"; tail -5 .run/P36/delever/calibrate_${label}.log; exit 1; }
+  log=.run/P36/delever/run_${label}.log
+  { /usr/bin/time -f "$label wall=%e s" $PY tools/delever.py --apply --batch "$BATCH" --label "$label" $HFLAG $ONLYFLAG -j 12; echo "exit=$?"; } > "$log" 2>&1
+  grep -q '^exit=0$' "$log" || { echo "cycle: batch $label — delever exited non-zero"; tail -4 "$log"; exit 1; }
+  if grep -q 'nothing to do (no drawable file)' "$log"; then echo "cycle: nothing drawable at $label — done"; exit 0; fi
+  vline=$(grep -oE '^delever: batch .*' "$log" | tail -1)
+  final=$(echo "$vline" | grep -oE 'final [0-9]+/[0-9]+' | grep -oE '[0-9]+/[0-9]+'); [ "${final%/*}" = "${final#*/}" ] || { echo "cycle: batch $label — $vline"; exit 1; }
+  if [ "$(echo "$vline" | grep -oE 'written [0-9]+' | grep -oE '[0-9]+')" = "0" ]; then echo "cycle: batch $label wrote no file — $vline"; fi
+  r22=.run/P36/baseline/r22_${label}.log
+  { /usr/bin/time -f "wall=%e s user=%U s sys=%S s" bash -c 'set -o pipefail; make clean && make extract-all JOBS=16 && make check-all JOBS=16'; echo "exit=$?"; } > "$r22" 2>&1
+  line=$(grep -oE "check-all: [0-9]+ passed, [0-9]+ failed of [0-9]+" "$r22")
+  if ! grep -q '^exit=0$' "$r22" || [ "$line" != "check-all: $FLEET passed, 0 failed of $FLEET" ]; then echo "cycle: R22 RED after batch $label — $line (the batch's files are in place: inspect, then tools/delever.py --restore)"; exit 1; fi
+  $PY tools/lever_census.py --sites -j 16 > .run/P36/census/census_${label}.log 2>&1 || { echo "cycle: the census FAILED after batch $label"; tail -3 .run/P36/census/census_${label}.log; exit 1; }
+  cline=$(grep -oE 'levers A\+B.*' .run/P36/census/lever_census.txt | head -1)
+  [ -n "$cline" ] || cline=$(grep -oE '^lever_census:.*' .run/P36/census/census_${label}.log | head -1)
+  TASK=${TASK:-T4} $PY - "$label" "$vline" "$line" "$cline" "$(grep -oE 'wall=[0-9.]+ s' "$r22" | head -1)" "$MARKER" <<'EOF' || exit 1
+import os, pathlib, re, sys, time, subprocess
+label, vline, r22line, cline, wall, marker = sys.argv[1:7]
+task = os.environ.get("TASK", "T4")
+p = pathlib.Path("phase-ends/CURRENT_PHASE.md"); t = p.read_text()
+head = subprocess.run(["git", "rev-parse", "--short", "HEAD"], capture_output=True, text=True).stdout.strip()
+entry = (f"\n- **{time.strftime('%Y-%m-%d')} — {task} batch `{label}`** (`.run/P36/delever/run_{label}.log`, `batch_{label}.json`): `{vline}` → R22 "
+         f"(`.run/P36/baseline/r22_{label}.log`) **`{r22line}`** (`{wall}`) → census `{cline}`.")
+assert ("\n" + marker) in t, "phase log marker not found"
+t = t.replace("\n" + marker, entry + "\n\n" + marker, 1)
+# the 🛑 headline (R101): every task-advancing commit refreshes it
+lines = t.split("\n")
+for i, l in enumerate(lines):
+    if l.startswith("## 🛑 SESSION CHECKPOINT"):
+        base = re.sub(r"\s*\|\s*last batch.*$", "", l)
+        lines[i] = f"{base} | last batch `{label}` on {head}: {cline}"
+        break
+p.write_text("\n".join(lines))
+print("log:", label, cline)
+EOF
+  git add -A src && git add .run/P36/delever .run/P36/census .run/P36/baseline phase-ends/CURRENT_PHASE.md || exit 1
+  git commit -q -m "src(phase-36): ${TASK:-T4} batch $label — $vline | R22 $line | census: $cline (delever_cycle)" || exit 1
+  echo "cycle: batch $label committed $(git log --oneline -1 | cut -c1-9) — $vline | $line"
+done
+echo "cycle: batches $START..$END done"
diff --git a/decomp-architect/corpus/tools/P10/delever_oracle.py b/decomp-architect/corpus/tools/P10/delever_oracle.py
index f8ce2f640c..6a1b5935b4 100644
--- a/decomp-architect/corpus/tools/P10/delever_oracle.py
+++ b/decomp-architect/corpus/tools/P10/delever_oracle.py
@@ -42,6 +42,8 @@ RECIPES = RUN / "recipes.json"
 CALIB = RUN / "calibration.json"
 SCRATCH = RUN / "obj"
 RECIPE_RE = re.compile(r"^set -o pipefail; (.*) -o (build/\S+\.o)$")
+SIGNAL_LINE = re.compile(r"^\s*\d+\s+(Aborted|Segmentation fault|Illegal instruction|Floating point exception|Bus error|Killed)[^\n]*", re.M)
+JOB_STATUS_LINE = re.compile(r"^(bash: line \d+: )?\s*\d+\s+(Done|Exit \d+)\b")
 
 
 # ----------------------------------------------------------------------------------------------------------------------
@@ -156,11 +158,17 @@ def compile_obj(recipe, text=None, tag="x", write_path=None):
     r = subprocess.run(["bash", "-c", cmd], cwd=REPO, capture_output=True, text=True)
     dt = time.time() - t0
     if r.returncode != 0 or not out.exists():
+        # a pipeline member killed by a signal (cc1 2.7.2 aborts on some candidates — e.g. a variable whose only definition was a
+        # launder that got deleted): bash prints the job-status block ("Done" / "Aborted (core dumped)" / "Segmentation fault")
+        # and the pipeline's rc is >= 128 — that is a CRASH verdict, not a diagnostic (R103: the real message forms)
+        sig = SIGNAL_LINE.search(r.stderr)
+        if sig or r.returncode >= 128:
+            return None, dt, "CRASH: " + (sig.group(0).strip() if sig else f"rc={r.returncode}")
         # gcc 2.7.2 prints errors without the word "error" and the assembler floods stderr with `$at` warnings: keep every
         # non-warning line (R103), then the tail
         errs = [ln for ln in r.stderr.splitlines()
                 if ln.strip() and not re.search(r"\bwarning:", ln, re.I) and not ln.startswith(("In file included", " " * 16))
-                and ": In function" not in ln]
+                and ": In function" not in ln and not JOB_STATUS_LINE.match(ln)]
         return None, dt, ("\n".join(errs[:8]) or r.stderr[-400:])
     data = out.read_bytes()
     try:
@@ -183,10 +191,32 @@ def judge(recipe, text, tag="x", write_path=None):
         return "NO-BASELINE", 0.0, ""
     data, dt, err = compile_obj(recipe, text, tag, write_path)
     if data is None:
-        return "COMPILE-ERROR", dt, err
+        return ("COMPILE-CRASH" if err.startswith("CRASH:") else "COMPILE-ERROR"), dt, err
     return ("IDENTICAL" if data == base else "DIFFERS"), dt, ""
 
 
+def recipes_by_src(recipes):
+    """src rel -> [recipe] (a twin binary compiles the primary's source into its own object: two recipes, one source)."""
+    out = {}
+    for r in recipes.values():
+        out.setdefault(r["src"], []).append(r)
+    for v in out.values():
+        v.sort(key=lambda r: r["obj"])
+    return out
+
+
+def judge_all(recipes, text, tag="x", write_path=None):
+    """Every recipe of one written file judged in turn (the file is written once, by the first compile; the CALLER restores it).
+    Returns (verdict, seconds, err): IDENTICAL only if every object is identical; otherwise the first non-identical verdict."""
+    total, first = 0.0, None
+    for i, r in enumerate(recipes):
+        v, dt, err = judge(r, text if i == 0 else None, tag=tag, write_path=write_path)
+        total += dt
+        if v != "IDENTICAL" and first is None:
+            first = (v, err)
+    return (first[0] if first else "IDENTICAL"), total, (first[1] if first else "")
+
+
 # ----------------------------------------------------------------------------------------------------------------------
 # calibration
 # ----------------------------------------------------------------------------------------------------------------------
@@ -222,6 +252,7 @@ def calibrate(aliases, jobs, recipes):
     import share_census as sc
     ctl = recs[0]
     src = REPO / ctl["src"]
+    st0 = src.stat()
     orig = src.read_text(errors="surrogateescape")
     pos_verdict = "SKIPPED"
     defs = [r for r in sc.scan_text(orig, ctl["src"], shared_defs=None) if r["form"] == "def" and r.get("nlines", 0) >= 3 and not r.get("empty")]
@@ -239,6 +270,7 @@ def calibrate(aliases, jobs, recipes):
                 pos_verdict = pos_verdict if pos_verdict != "COMPILE-ERROR" else f"COMPILE-ERROR ({err[-100:]})"
             finally:
                 src.write_text(orig, errors="surrogateescape")
+                os.utime(src, ns=(st0.st_atime_ns, st0.st_mtime_ns))   # the census's src stamp is stat-based: a restore is not a change
     by_alias = {}
     for x in results:
         d = by_alias.setdefault(x["alias"], dict(objects=0, identical=0, seconds=0.0))
diff --git a/decomp-architect/corpus/tools/P10/lever_census.py b/decomp-architect/corpus/tools/P10/lever_census.py
index 3a2cb9d55c..44a7050c0a 100644
--- a/decomp-architect/corpus/tools/P10/lever_census.py
+++ b/decomp-architect/corpus/tools/P10/lever_census.py
@@ -598,6 +598,22 @@ def _walk_worker(args):
 # ----------------------------------------------------------------------------------------------------------------------
 # the fleet
 # ----------------------------------------------------------------------------------------------------------------------
+def src_stamp():
+    """sha1 over (path, size, mtime_ns) of every .c/.h under src/: the tree the census describes. delever refuses a census whose
+    stamp is not the working tree's (R43) — a restore-write that changes only an mtime just costs a census rerun (35 s)."""
+    h = hashlib.sha1()
+    for p in sorted((REPO / "src").rglob("*")):
+        if p.suffix in (".c", ".h") and not p.name.startswith("."):
+            st = p.stat()
+            h.update(f"{p.relative_to(REPO).as_posix()}|{st.st_size}|{st.st_mtime_ns}\n".encode())
+    return h.hexdigest()[:16]
+
+
+def git_head():
+    import subprocess
+    return subprocess.run(["git", "rev-parse", "--short", "HEAD"], cwd=REPO, capture_output=True, text=True).stdout.strip()
+
+
 def enumerate_files(aliases, dirs):
     """TU -> [aliases] (a twin's TUs are its primary's, listed for both), plus every header under src/ (aliases = its includers')."""
     import compile_only
@@ -756,6 +772,7 @@ def run_census(jobs, use_cache=True, out_dir=OUT_DIR_DEFAULT, want_sites=False,
         macro_texts[m["name"]].add(m["text_hash"])
     summary = dict(
         generated=time.strftime("%Y-%m-%d"), binaries=len(aliases), tus=len(tu_aliases), headers=len(headers),
+        head=git_head(), src_stamp=src_stamp(),
         coverage=coverage, coverage_ok=cov_ok, unclassified=len(unclassified),
         verbatim_excluded=dict(sites=verbatim_sites, functions=len(verbatim_fns), manifest_rows=len(verb)),
         classes=classes,
diff --git a/decomp-architect/tools/MANIFEST.md b/decomp-architect/tools/MANIFEST.md
index 3b4ec1eef2..8c728b103c 100644
--- a/decomp-architect/tools/MANIFEST.md
+++ b/decomp-architect/tools/MANIFEST.md
@@ -8,8 +8,8 @@
 > its platform SDK need the marked adaptation. The last table lists the tools that are project-only in code (their *shape* is a task;
 > their code does not transfer). *TODO(platform): the MIPS and PlayStation SDK hard-codes are the ones another platform replaces first.*
 >
-> **Coverage:** 298 tool files in scope (submodules, vendored and downloaded code excluded), of which 298 live rows
-> below; per phase: P1 2 · P2 26 · P3 17 · P4 9 · P5 26 · P6 51 · P7 20 · P8 86 · P9 27 · P10 18 · PROJECT-ONLY 16. Superseded tools appear only as pointers to their successor (30 pointer rows); one-offs are omitted. Table rows in all: 328 (the installer checks its copy against this figure).
+> **Coverage:** 299 tool files in scope (submodules, vendored and downloaded code excluded), of which 299 live rows
+> below; per phase: P1 2 · P2 26 · P3 17 · P4 9 · P5 26 · P6 51 · P7 20 · P8 86 · P9 27 · P10 19 · PROJECT-ONLY 16. Superseded tools appear only as pointers to their successor (30 pointer rows); one-offs are omitted. Table rows in all: 329 (the installer checks its copy against this figure).
 
 ## P1 — extraction + manifest
 
@@ -338,9 +338,10 @@
 | `ghidra_apply_symbols.sh` | mirror the curated symbol file into the analysis database with a real save | Mirrors the curated symbol file into the analysis program headlessly, with a real save | repo symbol path, project name |
 | `frozen.py` | refuse, from one place, the command line of a tool the project has frozen | The one refusal a FROZEN tool prints from its main(): the tool, the successor and why; imports never exit (libraries stay usable) | nothing |
 | `verbatim_target_s.py` | regenerate a splitter-format target disassembly for a function no longer stubbed | Regenerates a splitter-format target disassembly for a function that is no longer a stub; --gas emits the assemblable gas-syntax form ($-registers, .L labels, noreorder) that a web diff service accepts as a pasted target | repo build/asm layout |
+| `delever_cycle.sh` | run the de-lever batch cycle unattended: batch, verify by exit code, clean fleet gate, census, log, commit | The Phase-36 T3/T4 driver: per batch a clean-tree check, the oracle recalibrated when stale, delever --apply read by exit code and its final X/X line, the clean fleet run as the outer gate (218/218), the census rerun, the phase-log entry and the checkpoint headline, one commit per batch; stops on the first red with the files in place for --restore | the batch size, the aliases, the fleet count |
 | `share_body_cycle.sh` | run the share-body batch cycle unattended: batch, verify by exit code, log, commit, periodic clean fleet check | The Phase-35 T5 driver for bucket new: per batch share_body --apply --bucket new --batches 1 --label new<k>, the gated N/N line read, the phase log entry appended, the bank committed the moment it is green, the clean fleet run every N batches — stops on the first red | repo paths, the phase-log format, the fleet count from config/check.*.sha |
 | `share_body.py` | share one byte-identical function class across its binaries through an include-at-site header, gated per binary | The Phase-35 successor of dedup_propagate + dedup_extend for the include-at-site form: exemplar by majority text, the header written once, every private copy replaced by the include at its position, per-binary byte gate with object comparison, bisect on red, the registry appended or extended by text, the exception ledger on refusal; --plan / --apply --bucket extend|new | repo paths, the registry and signature schemas |
-| `delever.py` | take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site | The Phase-36 de-lever engine: positional rewrites per lever class (pin -> plain declaration, barrier/launder/keep-alive deleted, a hand-placed instruction -> its C, the zero-register variable -> 0, volatile/register dropped), rung A strip-all and rung B greedy per body through delever_oracle, headers serialized after the TU phase; --probe runs a stratified sample of distinct bodies and prices the campaign with denominators | the census site records, the oracle |
+| `delever.py` | take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site | The Phase-36 de-lever engine and campaign tool: positional rewrites per lever class (pin -> plain declaration, barrier/keep-alive deleted, a launder deleted or turned into the assignment it is, a hand-placed instruction -> its C, the zero-register variable -> 0, a macro-carried site deleted/valued/refused by its macro's shape, volatile/register dropped); per body replay -> rung A strip-all -> rung B greedy through delever_oracle; the file is the write unit and its final compile through every recipe the proof; --plan/--apply batches (TUs parallel, exemplar files first; headers serial, includers parallel), the ledger keyed by tu+fn+addr with the body's nhash before/after, !FAKE markers on class A/B survivors, --restore from inflight.json, --apply-body for T6/T7, --selftest with a stub oracle, --probe (T2) | the census site records, the oracle |
 | `verbatim_to_stub.py` | turn an inline-assembly body back into a stub the toolchain can reach | Turns an inline-assembly body back into an include-assembly stub | repo src/asm layout |
 
 ## PROJECT-ONLY — project-only in code (the shape is a task; the code does not transfer)
diff --git a/docs/SETUP.md b/docs/SETUP.md
index 8909663fb0..eaa39d614a 100644
--- a/docs/SETUP.md
+++ b/docs/SETUP.md
@@ -784,7 +784,8 @@ Every script under `tools/` (plus the two report make-targets), grouped by purpo
 | | `tools/share_census.py` | **(P35 T1)** The fleet-wide census of byte-identical function classes and the S1 "one source per unique function" checker (`--check`, `--selftest`, `--scope`, `--strict-macros`, `--strict-text`); its ledger is `config/dedup_exceptions.tsv`; details in the P35 T1 section below. |
 | | `tools/lever_census.py` | **(P36 T1)** The census of every compiler-forcing construct ("lever") in the fleet's C — register pins, asm statements by kind (barrier / launder / keepalive / instruction / GTE / verbatim-body), volatile levers, bare `register`, plus the deferred asm-label aliases, builtins and attributes — derived from `share_census`'s scanner with a per-token coverage assertion against the raw text, four known-true controls, the `// !FAKE:` marker split, `--check` (0 unmarked pins/asm) and `--check --strict` (0 pins, 0 asm outside the GTE header) gates, `--sites` (every site to `.run/P36/census/lever_sites.jsonl`, the delever ledger's input), `--selftest`. Evidence: `.run/P36/census/lever_census.{json,txt}`; `progress.py` publishes the `levers` block and a README sentence from it. |
 | | `tools/delever_oracle.py` | **(P36 T2)** The fast byte oracle for a single-translation-unit edit: `--recipes` captures every object's exact build command through `make -n -W <src> <obj> BINARY=<alias>` (the Makefile's own pipeline — the jump-table pad stage, the per-object `-O0` overrides, the twin rule — into `.run/P36/delever/recipes.json`, regenerable in ~15 s); a candidate is compiled IN PLACE with `-o`/`-MF` redirected to scratch and its bytes compared with `build/`'s object from the fleet run (build/ is never written); `--calibrate <aliases>` proves 100 % equality untouched + twin == primary + a positive control (a nop injected at the end of a real body → DIFFERS) and writes `calibration.json` (HEAD, config stamp, per-object seconds); `--status`. Measured at T2: main 0.08–0.77 s per object, overlays ~0.14 s. |
-| | `tools/delever.py` | **(P36 T2/T3)** The de-lever engine. Rewrites per lever class on the raw text at the census's positions (a token mismatch REFUSES, never guesses): pin → plain declaration (type/qualifiers/initializer kept; the `$0` zero-register variable's uses → 0), barrier / launder / keep-alive → deleted (via-macro `SHB(x)` too), a hand-placed instruction → its C (addu-$zero/move/la/lh/addiu/sll/srl/and/andi/lui/li/lw and the lui+addiu / lui+ori pairs), volatile / register → dropped; rung A strip-all then rung B greedy through `delever_oracle`, the file restored from the in-memory snapshot after every compile; TUs in parallel (one worker per file), shared headers SERIAL after the TU phase (a header edit reaches every includer). `--probe --sample N --seed S` runs the ladder on a stratified sample of DISTINCT bodies → `.run/P36/probe/{probe_results.jsonl,probe_summary.json,probe_table.md}` with the pricing (R41). |
+| | `tools/delever.py` | **(P36 T2/T3)** The de-lever engine AND the campaign tool. Rewrites per lever class on the raw text at the census's positions (a token mismatch REFUSES, never guesses): pin → plain declaration (type/qualifiers/initializer kept; the `$0` zero-register variable's uses → 0, refused if it is ever assigned), barrier / keep-alive → deleted, launder → deleted when it launders a value into itself, **an ASSIGNMENT `out = in;` when its output and input differ** (deleting those made cc1 2.7.2 abort — the T2 probe counted them NEEDED), a hand-placed instruction → its C (addu-$zero/move/la/lh/lw/addiu/sll/srl/and/andi/lui/li and the lui+addiu / lui+ori pairs), a macro-carried site → deleted for a pure launder statement macro (`SHB`), its value `((T)(p))` for a launder statement-expression, REFUSED for a compound macro (XFER/DRAW/RTP_SND: the lever is in the `#define`, T5), volatile / register → dropped. Per body: replay (a ledger exemplar with the same normalized text: 1 compile) → rung A strip-all → rung B greedy, through `delever_oracle` (verdicts IDENTICAL / DIFFERS / COMPILE-ERROR / COMPILE-CRASH). **The file is the write unit and its final compile the proof**: every body's accepted edits + the file-scope volatile edits + the `// !FAKE:` markers spliced once, compiled through every recipe of the file (a twin's object; every includer of a header, in parallel) — IDENTICAL or the file-scope edits are dropped, or the file is restored and REFUSED (COMBINATION-FAILED). `--plan` / `--apply --batch N --label L [--headers] [--only …] [-j 12]` (TUs in parallel, exemplar files before their copies; headers serial; the tree must be clean, the calibration current, the census's src stamp the tree's — it reruns the census itself), `--restore` (from `inflight.json`, the only restore — R102), `--status`, `--apply-body TU FN FILE --label L [--rung E]` (T6/T7: a reshaped body judged on the bytes, refused if a class A/B lever remains), `--selftest` (the fixture through the census's own parser: every rewrite, the ladder against a stub oracle with a crashing site, the markers, a replay and a disagreeing replay, the ledger index, the oracle's crash forms), `--probe` (T2). The ledger `.run/P36/delever/ledger.jsonl`: one row per (tu, fn, addr, aliases) per judgement with every site's verdict REMOVED / REWRITTEN / NEEDED(oracle word) / REFUSED(why) / DEFERRED, the rung, the calibration id, the body's nhash BEFORE and AFTER — "done" = the current nhash is some row's after-hash; a body with a row's before-hash replays it. Class C/D survivors are never marked (decision 3); class A/B survivors carry `// !FAKE: <kind> <detail> — <verdict> (P36 <rung> <label>)` at the end of their line. Evidence: `apply_<label>.log`, `batch_<label>.json`. |
+| | `tools/delever_cycle.sh` | **(P36 T3)** The unattended batch cycle: `[LABEL_PREFIX=…] [TASK=T4] tools/delever_cycle.sh START END [BATCH=300] [tus|headers] [ONLY="alias …"]` — per batch: the tree must be clean (a dotfile under `src/` refuses), the oracle recalibrated when stale (2–3 s; every commit stales it), `delever --apply` (exit code + its `final X/X identical`, R97/R66), the CLEAN fleet run as the outer gate (`218 passed, 0 failed of 218`, R22 — it also refreshes `build/`, the oracle's baselines), the census rerun on the new tree, the phase-log entry + the 🛑 headline (R101), one commit of `src/` + the ledger/batch record/logs + the census + the log (R42). Stops on the first red with the batch's files in place (inspect, then `delever --restore`); stops cleanly when nothing is drawable. Size a call so a batch stays under ~10 min. |
 | | `tools/kit_coverage.py` | **(P33.5 task 14.5)** The kit's DISTILLATION coverage: derives the rule population (every `- **R<n>` of DIGEST §3, asserted contiguous) and the hindsight population (every `## ` heading of `docs/accelerators.md` at numbered-item granularity — 58 at S92) and asserts each is cited by a `provenance:` line of the registry seed / the kernels OR dispositioned in `config/kit_coverage_map.tsv` (`G<id>` / `DK-<n>` / `FOLDED:G<id>` / `ENV` / `PA` / `SEED:<file>` / `KIT:<path>` / `RECORD` / `COOKBOOK` / `NOT-PORTABLE`; unknown ids refused, R43); counts with denominators (R41); rc 1 on any gap. In `tools-health` after `tool_census --check`. Its first run found 26 uncited rules and 21 uncited entries → three new kernels (DK-66–DK-68) and 41 authored dispositions. |
 | | `decomp-architect/` (the day-one decomp kit) | **(P33.5 tasks 9–14)** The package a new matching-decomp project installs as Phase 0.5 on ProjectArchitect 2.0: `README.md` (the three steps), `intake.decomp.md` (ProjectArchitect's twelve items pre-answered + the phase ladder + the six readability inversions), `SETUP.md` (the installer, Step 0 contract … Step 10 verify + hard stop; `answers: <path>` for unattended runs), `decomp-architect.md` (the methodology), `templates/` (the firewall pack — `gitignore.decomp`, `firewall.txt`, `audit_public.template.py`, the planted fixture, `no-rom.template.yml` —, the READMEs, `pa-overlays.md`, `registry-E.decomp.md` G1–G67, the skeletons, `PLACEHOLDERS.md`, `layout-contract.md`), `corpus/decomp-kernels.md` (DK-1 … DK-80), the three dictionaries `corpus/tools/<phase>/` + `corpus/cookbook/` + `corpus/record/` (generated by `make kit-corpus`), `memory-seed/` (18), `tools/MANIFEST.md` (generated). **How it is checked:** `tools/kit_lint.py` (de-specialisation, placeholders, syntax, the gitignore-template diff) + `tools/tool_census.py --check` (the corpora equal their sources) + `tools/gitignore_template_check.py`, all in `tools-health`; the dry-run harness under `.run/P33.5/kit-dryrun/` (`answers.md`, `expected-manifest.txt`, `judge.py`, the install logs and verdicts of runs 1–5 — a kit change is re-verified by a resume on the last throwaway `repo/`, a fresh full run only when SETUP's steps change; the judge compares the real tree's dirty PATH SETS before/after). Wiki page: `docs/wiki/Start-a-new-decomp-project.md`. Split into its own repository after the flip. |
 | **Verification** | `tools/verify_contract.sh` | **(P33 A5/C8) THE recorded contract run**: 00 tree · 01 check-env · 02 family_hseq · 03 `make clean && extract-all && check-all` · 04 sdk-dual (or a recorded SKIP) · 05 tools-health (zero `[warn]`) · 06 audit-frontier · 07 audit-disc · 08 report; one log per step ending `EXIT=<rc>`, abort on the first red (R53), every step asserted by its contract line (R49), `SUMMARY.md` generated → `.run/P33/verify/` (tracked evidence, quoted by `docs/verification.md` §2); step 00 ignores its own output dir. ≈14 min on 32 CPUs. |
diff --git a/docs/tool-index.md b/docs/tool-index.md
index 0822411f94..1951fc93bd 100644
--- a/docs/tool-index.md
+++ b/docs/tool-index.md
@@ -5,7 +5,7 @@ freshness). The derived columns come from the tree on every run; the authored on
 dictionary, whose coverage is asserted both ways. Read it by NEED: find the phrase that matches what you are trying to do, then the tool,
 then what proved it. The same data generates the day-one kit's manifest and its verbatim tool corpus.*
 
-**Coverage:** 298 tool files in scope (submodules, vendored and downloaded code excluded; `find` and `git ls-files` agree) + 38 retired under `tools/sunset/`. Classes: LIVE 238 (a runtime consumer), REFERENCED 30 (a SETUP row only), ORPHAN 30 (neither) — of 298. Portability: PORTABLE 23, ADAPT 258, PROJECT-ONLY 17.
+**Coverage:** 299 tool files in scope (submodules, vendored and downloaded code excluded; `find` and `git ls-files` agree) + 38 retired under `tools/sunset/`. Classes: LIVE 240 (a runtime consumer), REFERENCED 29 (a SETUP row only), ORPHAN 30 (neither) — of 299. Portability: PORTABLE 23, ADAPT 259, PROJECT-ONLY 17.
 
 ## P1 — extraction + manifest
 
@@ -322,21 +322,22 @@ then what proved it. The same data generates the day-one kit's manifest and its
 |---|---|---|---|---|---|
 | add per-site function-pointer casts so a draft can call a differently typed callee | `cast_call_sites.py` | Adds per-site function-pointer casts so a draft can call a differently typed callee | canon_sig_reconcile.py, cast_self_callers.py, family_sweep.py, gate_stage.py (+4) | repo src layout | LIVE |
 | apply curated names and signatures inside the analysis tool and save | `ghidra_scripts/ApplySymbols.java` | The in-tool half of that mirror: apply curated names and signatures, save on exit | ghidra_apply_symbols.sh, ghidra_export_annotations.sh, ghidra_rebuild.sh, ExportAnnotations.java (+1) | none | LIVE |
-| census every compiler-forcing construct in the C and gate the levers-off phase | `lever_census.py` | The Phase-36 census of lever sites (register pins, asm statements by kind, volatile levers, bare register, asm-label aliases, builtins, attributes; the whole-body hand-asm routines and the GTE ops set apart) derived from the shared-body scanner with a per-token coverage assertion against the raw text, four known-true controls, the !FAKE marker split, --check (0 unmarked pins/asm) and --strict (0 pins, 0 asm) gates, --sites for the delever ledger, a fixture self-test | delever.py, progress.py, verbatim_check.py | repo paths, the shared-body scanner | LIVE |
+| census every compiler-forcing construct in the C and gate the levers-off phase | `lever_census.py` | The Phase-36 census of lever sites (register pins, asm statements by kind, volatile levers, bare register, asm-label aliases, builtins, attributes; the whole-body hand-asm routines and the GTE ops set apart) derived from the shared-body scanner with a per-token coverage assertion against the raw text, four known-true controls, the !FAKE marker split, --check (0 unmarked pins/asm) and --strict (0 pins, 0 asm) gates, --sites for the delever ledger, a fixture self-test | delever.py, delever_cycle.sh, progress.py, verbatim_check.py | repo paths, the shared-body scanner | LIVE |
 | convert a shared-body macro header into per-function plain-C headers included at each site | `macro_to_header.py` | The Phase-35 converter: every DEFINE_ macro body becomes a plain-C header under src/shared/<space>/ included at its site, the legacy name-parameterized headers converted, the registry text-edited, the macro header deleted; --plan / --apply / --finalize / --verify | share_body.py, tool_census.py | the macro form is this project's; a kit-born project shares headers from its first bank | LIVE |
 | emit a function's target assembly as an inline-assembly body | `asm_verbatim.py` | Emits the file-scope inline-assembly body form from a disassembly file | docs/wave-playbook.md, draft_prechecks.py, gate_main.py, recover_route.py | repo asm layout | LIVE |
 | extract inline-defined types and typedefs from a source file into a shared header | `build_engine_types.py` | Extracts inline-defined named types and typedefs from a source file into a shared header | inject_capped_externs.py, lift_types.py, uniquify_type.py | repo shared-header path | LIVE |
 | flag address-named references whose address now has a curated name | `lint_symbol_refs.py` | Flags address-named references in committed sources whose address now has a curated name | .github/workflows/no-rom.yml, Makefile | repo symbol/src paths | LIVE |
 | give each conflicting camp of a same-named type its own name | `uniquify_type.py` | Gives each conflicting camp of a same-named type its own name so every camp becomes liftable | — | repo src layout | REFERENCED |
 | guard that every inline-assembly body still reproduces its target bytes | `verbatim_check.py` | Regression guard that every inline-assembly body still reproduces its target bytes | .github/workflows/no-rom.yml, lever_census.py, progress.py, verbatim_target_s.py (+1) | repo src layout | LIVE |
-| judge one translation-unit edit by the bytes of its object in under a second | `delever_oracle.py` | The Phase-36 fast byte oracle: every object's exact build command captured once via make -n -W (the Makefile's own recipe, pad stage and -O0 overrides included), a candidate compiled in place with -o/-MF redirected to scratch and compared with the fleet run's object; --calibrate proves 100 % equality untouched, twin == primary and a positive control before any verdict is trusted | delever.py | the Makefile's object rules, the twin rule | LIVE |
+| judge one translation-unit edit by the bytes of its object in under a second | `delever_oracle.py` | The Phase-36 fast byte oracle: every object's exact build command captured once via make -n -W (the Makefile's own recipe, pad stage and -O0 overrides included), a candidate compiled in place with -o/-MF redirected to scratch and compared with the fleet run's object; --calibrate proves 100 % equality untouched, twin == primary and a positive control before any verdict is trusted | delever.py, delever_cycle.sh | the Makefile's object rules, the twin rule | LIVE |
 | measure duplicate function bodies across the fleet and assert one source per unique function | `share_census.py` | The census of byte-identical function classes across every binary with their source forms and verdicts, plus the S1 invariant check with its exception ledger and a fixture self-test | Makefile, audit_binaries.py, dedup_integrate.py, delever.py (+8) | repo paths, the registry and signature schemas | LIVE |
 | mirror the curated symbol file into the analysis database with a real save | `ghidra_apply_symbols.sh` | Mirrors the curated symbol file into the analysis program headlessly, with a real save | — | repo symbol path, project name | REFERENCED |
 | refuse, from one place, the command line of a tool the project has frozen | `frozen.py` | The one refusal a FROZEN tool prints from its main(): the tool, the successor and why; imports never exit (libraries stay usable) | aprop_autodraft.py, blocker_probe.py, canon_sig_reconcile.py, conform_decls.py (+10) | nothing | LIVE |
 | regenerate a splitter-format target disassembly for a function no longer stubbed | `verbatim_target_s.py` | Regenerates a splitter-format target disassembly for a function that is no longer a stub; --gas emits the assemblable gas-syntax form ($-registers, .L labels, noreorder) that a web diff service accepts as a pasted target | decompme_replica.sh | repo build/asm layout | LIVE |
+| run the de-lever batch cycle unattended: batch, verify by exit code, clean fleet gate, census, log, commit | `delever_cycle.sh` | The Phase-36 T3/T4 driver: per batch a clean-tree check, the oracle recalibrated when stale, delever --apply read by exit code and its final X/X line, the clean fleet run as the outer gate (218/218), the census rerun, the phase-log entry and the checkpoint headline, one commit per batch; stops on the first red with the files in place for --restore | delever.py | the batch size, the aliases, the fleet count | LIVE |
 | run the share-body batch cycle unattended: batch, verify by exit code, log, commit, periodic clean fleet check | `share_body_cycle.sh` | The Phase-35 T5 driver for bucket new: per batch share_body --apply --bucket new --batches 1 --label new<k>, the gated N/N line read, the phase log entry appended, the bank committed the moment it is green, the clean fleet run every N batches — stops on the first red | — | repo paths, the phase-log format, the fleet count from config/check.*.sha | ORPHAN |
 | share one byte-identical function class across its binaries through an include-at-site header, gated per binary | `share_body.py` | The Phase-35 successor of dedup_propagate + dedup_extend for the include-at-site form: exemplar by majority text, the header written once, every private copy replaced by the include at its position, per-binary byte gate with object comparison, bisect on red, the registry appended or extended by text, the exception ledger on refusal; --plan / --apply --bucket extend|new | aprop_autodraft.py, audit_binaries.py, auto_driver.py, blocker_probe.py (+18) | repo paths, the registry and signature schemas | LIVE |
-| take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site | `delever.py` | The Phase-36 de-lever engine: positional rewrites per lever class (pin -> plain declaration, barrier/launder/keep-alive deleted, a hand-placed instruction -> its C, the zero-register variable -> 0, volatile/register dropped), rung A strip-all and rung B greedy per body through delever_oracle, headers serialized after the TU phase; --probe runs a stratified sample of distinct bodies and prices the campaign with denominators | — | the census site records, the oracle | REFERENCED |
+| take register pins, asm statements, volatile and register levers out of matched C, byte-gated per site | `delever.py` | The Phase-36 de-lever engine and campaign tool: positional rewrites per lever class (pin -> plain declaration, barrier/keep-alive deleted, a launder deleted or turned into the assignment it is, a hand-placed instruction -> its C, the zero-register variable -> 0, a macro-carried site deleted/valued/refused by its macro's shape, volatile/register dropped); per body replay -> rung A strip-all -> rung B greedy through delever_oracle; the file is the write unit and its final compile through every recipe the proof; --plan/--apply batches (TUs parallel, exemplar files first; headers serial, includers parallel), the ledger keyed by tu+fn+addr with the body's nhash before/after, !FAKE markers on class A/B survivors, --restore from inflight.json, --apply-body for T6/T7, --selftest with a stub oracle, --probe (T2) | delever_cycle.sh | the census site records, the oracle | LIVE |
 | turn an inline-assembly body back into a stub the toolchain can reach | `verbatim_to_stub.py` | Turns an inline-assembly body back into an include-assembly stub | — | repo src/asm layout | REFERENCED |
 
 ## PROJECT-ONLY — project-only in code (the shape is a task; the code does not transfer)
diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md
index ded35c3a30..31108f25c3 100644
--- a/phase-ends/CURRENT_PHASE.md
+++ b/phase-ends/CURRENT_PHASE.md
@@ -96,6 +96,8 @@
   residue counted as a lever). The 20 per-overlay trampoline families (133 private copies each, bytes varying with the wrapped callee)
   are the names phase's parameterized-form inheritance.
 
+- **S98 (2026-09-09), Drew, mid-T3:** *"dont start ultra code wave for reshaping without my direct approval."* → **T7's reshaping waves (Ultracode) start ONLY on Drew's direct approval in the session that would run them** — the R27 toggle is necessary, not sufficient; the T6 recipe/permuter rungs and the mechanical campaign are not waves and proceed under P3.
+
 ## Rules at gate 1 (P10)
 
 **R100–R106 ratified by the plan approval (2026-09-09; the PhaseEnd_Phase35 candidates (a)–(g), operated through P35):**
@@ -245,7 +247,53 @@ accumulate here as the phase produces them.**
   volatile declarations, `$0` variables, instructions. **Design consequences for T3:** per-body compiles at 0.2 s make group testing
   unnecessary (simplicity wins); run T4 first and publish the fall; rung R (T6) targets the three big classes in that order.
 
-## 🛑 SESSION CHECKPOINT — S97 close (2026-09-09, at 69 % context): T0 ☑ T1 ☑ T1b ☑ T2 ☑ — all committed (T2 `617f29e30`, the checkpoint `772052dff`, this refresh); NEXT = T3 (`tools/delever.py` the campaign tool: the ledger, --plan/--apply batches with the `!FAKE` markers, exemplar/replay, refusals, `delever_cycle.sh`, selftest) in a FRESH session at Max for the design
+- **S98 2026-09-09 — T3 the campaign tool (design at Max; the tools built, the end-to-end batch follows).** Session start at low effort; Drew:
+  `/effort max`, "build task list and resume current phase"; the harness task list rebuilt (R28, 12 tasks; T0–T2 completed). Reconnaissance on
+  T2's engine and probe before any design (R37/R38): three findings that CHANGE the numbers — (1) **989 of the 4,793 direct launders are
+  ASSIGNMENTS** (`__asm__("" : "=r"(p) : "0"(&D_x))` — output ≠ input); the probe deleted them as statements, which left the variable undefined and
+  **cc1 2.7.2 ABORTED** (the probe's one "Done" COMPILE-ERROR, `ov_SC03_124 func_80188C68` launder at 3449, reproduced 3/3: rc 134,
+  `Aborted (core dumped) | tools/bin/gcc-2.7.2-psx/cc1`; the error filter had kept bash's job-status line and dropped the signal line) — the
+  probe's "launder 77 % needed" is partly this; (2) the **macro-carried launders are mostly compound macros** (`XFER`/`DRAW`/`RTP_SND`/`COPY_TO_FAAC`,
+  ~60 uses in 8 definitions: real code around the asm — the probe's rewrite deleted the whole USE statement, which is a correctness hazard; only
+  `SHB`/`ENGINE_SHB` (416 defs / 2 texts, 399 uses) are pure launder statements and `LAUNDER_8018A180` a launder statement-expression);
+  (3) **46 lever bodies live in `-O0` translation units** (boot.c 31 bare `register` + 6 instructions; `md_MAIN_003_o0*` / `md_MAIN_011`) — the
+  plan's "none have pins" was about pins; they are judged by their own recipes, not refused (the ledger records `o0`). Also measured: 5 lever
+  bodies not named `func_` (addresses from `config/symbols.us.txt`), 1 class whose members disagree on the site sequence (the replay checks it),
+  369 header bodies (203 with < 20 includers, 165 with 120–139), 517 file-scope `volatile` declarations in 256 TUs, 2 `volatile` parameters,
+  0 multi-declarator pins, nested includes only `engine_prelude.h` → `include/` (the includer scan is transitive anyway).
+  **Design (X1, the non-obvious choices):** the verdict unit is the body, the write unit the file, the proof unit the file's FINAL compile
+  (every body judged against the original text; all accepted edits + the file-scope volatile edits + the markers spliced once and compiled
+  through every recipe — a twin's object, every includer of a header in parallel; DIFFERS → the file-scope edits dropped and retried → the file
+  restored and COMBINATION-FAILED, loud); **"done" is a ledger fact keyed by normalized text** (every row carries the body's `nhash` BEFORE and
+  AFTER; current nhash ∈ after-hashes → done, ∈ before-hashes → replay in one compile, a disagreement falls through to the full ladder and is
+  recorded; markers are comments and do not move the hash; a reshaped body gets a new hash and is drawn again — so T6/T7 need no new bookkeeping);
+  the launder-assignment and macro-shape rewrites above; the oracle's **COMPILE-CRASH** verdict (a signal line / rc ≥ 128, R103) distinct from
+  COMPILE-ERROR; class C/D survivors judged, ledgered, never marked (decision 3), class A/B survivors marked `// !FAKE: <kind> <detail> — <verdict>
+  (P36 <rung> <label>)` at the end of their line (one marker per line, an old one replaced); an asm-body DEFERRED (T7) and marked; the census
+  gains `head` + a stat-based `src_stamp` and `--apply` refuses a census that does not describe the tree (it reruns it); the outer gate of EVERY
+  batch is the clean fleet run (90 s — cheaper than per-binary checks past ~15 touched binaries, and it refreshes `build/`, the oracle's
+  baselines); the calibration is rerun after every commit (2.4 s; its positive control now restores the source's mtime so the census stamp
+  survives it); exemplar files run before their copies (a class cover, phase 1) so the replay discount is real; `inflight.json` (every batch
+  file's original text, written before the first write) is the only restore (R102). Refusals: a token mismatch, no statement end, a compound
+  macro, an instruction with no C spelling, an assigned zero-register variable, two `$0` pins in one body, a no-op edit, an empty includer set,
+  a dirty `src/`, a stale calibration or census, an untracked dotfile under `src/` (the cycle).
+  **Built:** `tools/delever.py` (1,548 lines: `--plan`, `--apply`, `--restore`, `--status`, `--apply-body`, `--selftest`, `--probe`),
+  `tools/delever_oracle.py` (COMPILE-CRASH, `recipes_by_src`, `judge_all`, the mtime restore), `tools/lever_census.py` (`src_stamp`, `head`),
+  `tools/delever_cycle.sh`, `.gitignore` (`inflight.json` ignored; the ledger/batch records/logs already allowlisted), SETUP + dictionary rows,
+  kit corpus (`tool_census --check: OK`).
+  **Verify so far:** `delever --selftest: OK — 15 sites in the exemplar, 1 refused rewrite(s), ladder RESIDUE (15 compiles), replay replay
+  (1 compile), markers 5` (the fixture through the census's own parser: every rewrite incl. the assignment launder, the `$0` uses → 0, the
+  expression-launder macro → `((s32)(&buf))`, the compound macro REFUSED; the ladder against a stub oracle with two needed sites and one whose
+  removal crashes → NEEDED COMPILE-CRASH; 5 marker lines, none on a class C/D site; the replay on a copy in another address environment = 1
+  compile with the same verdicts; a disagreeing replay → rung B; the ledger index; the oracle's signal-line regex on the real bash form).
+  `lever_census --sites -j 16 --no-cache`: **53,234 / 15,679 / 2,227 unchanged**, `head 89676f096`, `src_stamp` written (32 s).
+  `delever_oracle --calibrate main ov_SC03_014 ov_SC03_015 ov_SC04_011: 177/177 objects byte-identical untouched; twin checks 32 (0 mismatch);
+  positive control DIFFERS on build/src/800.o; 2.4 s — OK`. `delever --plan --only ov_SC04_011: 18 of 18 drawable files · 176 bodies (109 in
+  multi-copy classes) · 540 removable sites`; the campaign order's head: the `*_jr_80140608.c` copies (11 bodies / 30 sites each, classes of
+  134); headers: 371 drawable files. **Next in this task:** the end-to-end batch `LABEL_PREFIX=t3_ TASK=T3 tools/delever_cycle.sh 1 1 300 tus
+  ov_SC04_011` (apply → R22 → census → log → commit), then the checkpoint refresh.
+
+## 🛑 SESSION CHECKPOINT — S98 in progress (2026-09-09): T0 ☑ T1 ☑ T1b ☑ T2 ☑ — T3 tools BUILT + selftest OK + calibration OK (this commit); NEXT = the T3 end-to-end batch on ov_SC04_011 via `tools/delever_cycle.sh` (then the checkpoint refresh, then T4). The §0–§4 below are the S97-close text and stay valid except: `tools/delever.py` now has the campaign commands (see the T3 log entry) and T7 needs Drew's direct approval (decisions).
 
 ### 0. How to use this block
 A fresh session (S98) reads CLAUDE.md's load order, replays this block verbatim, asks Drew for `/effort max` (T3's design is Max; its
diff --git a/tools/delever.py b/tools/delever.py
index 22b8de665b..b763aee5b2 100644
--- a/tools/delever.py
+++ b/tools/delever.py
@@ -1,32 +1,62 @@
 #!/usr/bin/env python3
 """delever.py — take the compiler-forcing constructs ("levers") out of matched C, byte-gated per translation unit
-(Phase 36; the probe engine at T2, the campaign tool at T3).
+(Phase 36: the probe engine at T2, the campaign tool at T3).
 
-    tools/delever.py --probe --sample 150 [--seed 1] [-j 12]     # T2: rung A + rung B on a stratified sample of DISTINCT bodies
-                                                                 #     -> .run/P36/probe/{probe_results.jsonl,probe_summary.json,probe_table.md}
+    tools/delever.py --plan [--batch 300] [--headers] [--only X ...]        # what the next batch would do (no writes)
+    tools/delever.py --apply --batch 300 --label tu1 [--headers] [--only X ...] [-j 12]
+                                                                           # judge every drawable body of the batch's files, KEEP the winning
+                                                                           # text in place, mark the survivors `// !FAKE:`, ledger every site
+    tools/delever.py --restore                                             # every in-flight file back from inflight.json (never git checkout, R102)
+    tools/delever.py --status                                              # the ledger's totals
+    tools/delever.py --apply-body TU FN FILE --label w1 [--rung E]          # T6/T7: a reshaped function judged on the bytes and kept
+    tools/delever.py --selftest                                            # the fixture: every site kind, the decoys, a stub oracle
+    tools/delever.py --probe --sample 150 [--seed 1] [-j 12]                # T2's measurement (unchanged)
 
 THE LADDER PER BODY (deterministic, zero tokens):
-  rung A  strip-all — every removable site of the body rewritten at once (pin -> plain declaration; barrier/launder/keep-alive ->
-          deleted; a hand-placed instruction -> its C; `$0` pin -> its variable's uses replaced by 0; volatile -> dropped; register ->
-          dropped), one compile, the object compared with the fleet run's (tools/delever_oracle.py). Measured twice: with the `register`
-          keyword dropped from the pin (the target form) and with it kept (A').
+  replay  a body whose normalized text (`nhash`, func_/D_ addresses masked) matches a body the ledger already judged replays that
+          body's accepted edit set: one compile. A disagreement falls through to the full ladder and is recorded.
+  rung A  strip-all — every removable site of the body rewritten at once, one compile, the object compared with the fleet run's
+          (tools/delever_oracle.py).
   rung B  greedy — if A differs: from the untouched text, the sites are re-applied one at a time (asm statements first, then pins,
-          volatile, register); a site whose removal keeps the object identical is REMOVED, one that changes it is NEEDED.
-The verdict of a body = the set of NEEDED sites; a body with none is lever-free. Never touched: GTE ops, the manifest's verbatim
-bodies, an asm-body (a whole routine — the manifest's DECOMPILE rows are another task's work), file-scope declarations.
+          volatile, register); a site whose removal keeps the object identical is REMOVED, one that changes it is NEEDED — with the
+          oracle's word (DIFFERS / COMPILE-ERROR / COMPILE-CRASH) as the reason.
+The verdict of a body = the set of NEEDED sites; a body with none is lever-free.
 
-EVERY EDIT IS POSITIONAL on the raw text (line/col from the census), the file is written in place for the compile and restored
-from the in-memory snapshot right after (never `git checkout`, R102); a site whose raw token does not match the census is REFUSED
-(R43), never guessed.
+THE REWRITE PER SITE (positional on the RAW text at the census's line/col; a token that is not what the census saw is REFUSED, R43):
+  pin `register T x __asm__("$N") [= e];`   -> `T x [= e];`      (the `$0` zero-register variable: the declaration deleted, every use -> 0;
+                                                                  a variable that is ever assigned is REFUSED)
+  barrier `__asm__("" ::: "memory");`, keep-alive `__asm__("" : : "r"(x));`, launder `__asm__("" : "=r"(x) : "0"(x));`  -> deleted
+  launder whose output and input DIFFER `__asm__("" : "=r"(p) : "0"(&D_x));`  -> the assignment it is: `p = &D_x;`
+     (deleting it leaves `p` undefined — cc1 2.7.2 ABORTS on such a candidate; the T2 probe counted those as NEEDED)
+  a hand-placed instruction (`addu %0,%1,$zero` / move / la / lh / lw / addiu / sll / …) -> its C statement, or REFUSED (no spelling)
+  a macro-carried site: `SHB(x);` (a pure launder statement macro) -> deleted; `LAUNDER(p)` (a launder statement-expression) -> its
+     value `((T)(p))`; a COMPOUND macro (XFER, DRAW, RTP_SND, …: real code around the asm) -> REFUSED, the lever is in the #define (T5)
+  volatile (a cast, a body declaration, a parameter, a file-scope declaration) -> the qualifier dropped; bare `register` -> dropped
+  GTE ops, the manifest's verbatim bodies: never touched. An asm-body (a whole routine in a C shell) is DEFERRED to T7 and marked.
+
+THE FILE IS THE WRITE UNIT, ITS FINAL COMPILE THE PROOF: every body's candidates are judged against the file's ORIGINAL text; the
+accepted edits of every body, the file-scope edits and the `// !FAKE:` markers are spliced once at the end, and that final text is
+compiled through EVERY recipe of the file (a twin's object too; every includer of a header, in parallel) — IDENTICAL or the file-scope
+edits are dropped and it is compiled again, or the file is restored and REFUSED (COMBINATION-FAILED, loud). The batch's touched files
+are left in place for the outer gate (the clean fleet run, R22, in tools/delever_cycle.sh); every file's original text is in
+.run/P36/delever/inflight.json before the first write, and --restore reads it.
+
+"DONE" IS A LEDGER FACT KEYED BY TEXT: every ledger row records the body's nhash BEFORE and AFTER. A body whose current nhash is some
+row's after-hash is done (drawn again only with --rejudge); one whose current nhash is some row's before-hash replays it. Markers are
+comments and do not change the hash; a reshaped body (T6/T7) gets a new hash and is drawn again. Class C/D survivors are never marked
+(Drew's decision 3) — the ledger is their record; class A/B survivors carry `// !FAKE: <kind> <detail> — <verdict> (P36 <rung> <label>)`.
 """
 import argparse
 import collections
+import hashlib
 import json
 import os
 import pathlib
 import random
 import re
+import subprocess
 import sys
+import threading
 import time
 from concurrent.futures import ThreadPoolExecutor
 
@@ -36,12 +66,25 @@ import delever_oracle as oracle   # noqa: E402
 import lever_census as lc         # noqa: E402
 import share_census as sc         # noqa: E402
 
-SITES = REPO / ".run" / "P36" / "census" / "lever_sites.jsonl"
+RUN = REPO / ".run" / "P36" / "delever"
+CENSUS_DIR = REPO / ".run" / "P36" / "census"
+SITES = CENSUS_DIR / "lever_sites.jsonl"
+CENSUS_JSON = CENSUS_DIR / "lever_census.json"
+LEDGER = RUN / "ledger.jsonl"
+INFLIGHT = RUN / "inflight.json"
 PROBE = REPO / ".run" / "P36" / "probe"
+PRELUDE = "src/shared/engine_prelude.h"
 REMOVABLE = {("A", "pin"), ("B", "barrier"), ("B", "launder"), ("B", "keepalive"), ("B", "instruction"),
-             ("C", "cast"), ("C", "decl-body"), ("D", "register")}
-ORDER = {"barrier": 0, "launder": 1, "keepalive": 2, "instruction": 3, "pin": 4, "cast": 5, "decl-body": 6, "register": 7}
+             ("C", "cast"), ("C", "decl-body"), ("C", "param"), ("D", "register")}
+FILE_SCOPE_REMOVABLE = {("C", "decl-file")}
+DEFERRED_KINDS = {"asm-body"}                       # a whole routine in a C shell: T7's work, marked now (the census counts it as a lever)
+MARK_KINDS = {"pin", "barrier", "launder", "keepalive", "instruction", "asm-body"}   # class A/B survivors carry the marker; C/D never
+ORDER = {"barrier": 0, "launder": 1, "keepalive": 2, "instruction": 3, "pin": 4, "cast": 5, "decl-body": 6, "param": 6, "register": 7}
+FILE_SCOPE_FN = "<file-scope>"
+DONE_VERDICTS = {"LEVER-FREE", "RESIDUE", "NOTHING-USABLE", "DEFERRED-ONLY", "REFUSED"}   # a body the ledger settles; COMBINATION-FAILED / NO-RECIPE are redrawn
 STRLIT = lc.STRLIT
+FAKE = "// !FAKE:"
+_LOCK = threading.Lock()
 
 
 class Refuse(Exception):
@@ -90,6 +133,10 @@ def ws_after(m, pos):
     return i
 
 
+def norm_expr(e):
+    return re.sub(r"\s+", "", e)
+
+
 # ----------------------------------------------------------------------------------------------------------------------
 # the rewrite of one site -> [(start, end, replacement)] on the raw text
 # ----------------------------------------------------------------------------------------------------------------------
@@ -102,6 +149,11 @@ INSTR_TABLE = {
     "lui": ("OUT = IMM << 16;", None), "li": ("OUT = IMM;", None), "lw": ("OUT = *(s32 *)((s32)IN1 + IMM);", None),
     "lh": ("OUT = *(s16 *)((s32)IN1 + IMM);", None), "la": ("OUT = (s32)&SYM;", None),
 }
+# macro shapes (the replacement text of a #define, whitespace-normalized)
+_ASM = r"(?:__asm__|__asm|asm)\s*(?:__volatile__|volatile)?"
+MACRO_STMT_LAUNDER = re.compile(r"^\s*" + _ASM + r"\s*\(\s*\"\"\s*:\s*\"=r\"\s*\(\s*(\w+)\s*\)\s*:\s*\"0\"\s*\(\s*\1\s*\)\s*\)\s*;?\s*$")
+MACRO_EXPR_LAUNDER = re.compile(r"^\s*\(\s*\{\s*([\w][\w\s\*]*?)\s+(\w+)\s*=\s*\(\s*\1\s*\)\s*\(\s*(\w+)\s*\)\s*;\s*" + _ASM +
+                                r"\s*\(\s*\"\"\s*:\s*\"=r\"\s*\(\s*\2\s*\)\s*:\s*\"0\"\s*\(\s*\2\s*\)\s*\)\s*;\s*\2\s*;\s*\}\s*\)\s*$")
 
 
 def parse_asm_operands(inner):
@@ -186,7 +238,7 @@ def instruction_to_c(inner, indent):
         if not mm:
             return None
         base = resolve(mm.group(2))
-        return None if base is None else templ.replace("OUT", out_expr).replace("IN1", base).replace("IMM", mm.group(1)) and f"{indent}{templ.replace('OUT', out_expr).replace('IN1', base).replace('IMM', mm.group(1))}"
+        return None if base is None else f"{indent}{templ.replace('OUT', out_expr).replace('IN1', base).replace('IMM', mm.group(1))}"
     if mnem in ("addiu", "sll", "srl", "andi"):
         if len(refs) != 3:
             return None
@@ -206,12 +258,55 @@ def instruction_to_c(inner, indent):
     return None
 
 
+def launder_rewrite(inner):
+    """('delete', None) | ('assign', 'out = in;') | raise Refuse — a launder is deletable only when it launders a value into
+    itself (or defines a value from nothing); one that copies another expression into its output IS an assignment."""
+    _, outs, ins = parse_asm_operands(inner)
+    if len(outs) != 1:
+        raise Refuse(f"launder with {len(outs)} outputs")
+    if not ins:
+        return "delete", None
+    if len(ins) != 1:
+        raise Refuse(f"launder with {len(ins)} inputs")
+    o, i = outs[0][1], ins[0][1]
+    if norm_expr(o) == norm_expr(i):
+        return "delete", None
+    return "assign", f"{o} = {i};"
+
+
+_macro_cache = {}
+
+
+def macro_shape(raw, rel, name, use_line):
+    """('stmt-launder' | 'expr-launder' | 'compound' | 'missing', cast_type) for the definition of NAME that governs a use at
+    use_line: the LAST #define before the use in this file, else engine_prelude.h (ENGINE_SHB)."""
+    key = (rel, name, use_line)
+    if key in _macro_cache:
+        return _macro_cache[key]
+    defs = [(l0, l1, body) for (l0, l1, n, body) in lc.define_blocks(raw) if n == name and l1 < use_line]
+    body = defs[-1][2] if defs else None
+    if body is None and name == "ENGINE_SHB":
+        pre = (REPO / PRELUDE).read_text(errors="surrogateescape")
+        d = [(l0, l1, b) for (l0, l1, n, b) in lc.define_blocks(pre) if n == name]
+        body = d[-1][2] if d else None
+    if body is None:
+        res = ("missing", None)
+    else:
+        b = re.sub(r"\s+", " ", sc.mask_text(body) if ("/*" in body or "//" in body) else body).strip()
+        if MACRO_STMT_LAUNDER.match(b):
+            res = ("stmt-launder", None)
+        else:
+            mm = MACRO_EXPR_LAUNDER.match(b)
+            res = ("expr-launder", mm.group(1).strip()) if mm else ("compound", None)
+    _macro_cache[key] = res
+    return res
+
+
 def site_edits(raw, m, ls, site, keep_register=False):
     """[(start, end, replacement)] for one site, or raise Refuse. `m` = same_len_mask(raw)."""
     pos = ls[site["line"] - 1] + site["col"] - 1
     cls, kind = site["cls"], site["kind"]
     indent_start = m.rfind("\n", 0, pos) + 1
-    indent = re.match(r"[ \t]*", raw[indent_start:pos]).group(0)
     if cls == "A":
         if not m.startswith("register", pos):
             raise Refuse(f"token mismatch at {site['tu']}:{site['line']}: expected `register`")
@@ -225,9 +320,15 @@ def site_edits(raw, m, ls, site, keep_register=False):
             if not mm:
                 raise Refuse("zero pin without a name")
             name = mm.group(1)
-            edits = [(indent_start if raw[indent_start:pos].strip() == "" else pos, e + (1 if raw[e:e + 1] == "\n" and raw[indent_start:pos].strip() == "" else 0), "")]
+            if "=" in stmt.split("__asm__")[-1].split("asm")[-1]:
+                raise Refuse("zero pin with an initializer")
+            edits = [(indent_start if raw[indent_start:pos].strip() == "" else pos,
+                      e + (1 if raw[e:e + 1] == "\n" and raw[indent_start:pos].strip() == "" else 0), "")]
             b0, b1 = ls[site["fn_line"] - 1], ls[site["fn_end"]] - 1
-            for um in re.finditer(r"\b%s\b" % re.escape(name), m[b0:b1]):
+            body_m = m[b0:b1]
+            if re.search(r"\b%s\s*(?:=(?!=)|\+\+|--|[-+*/&|^]=)" % re.escape(name), body_m) or re.search(r"(?:\+\+|--)\s*\b%s\b" % re.escape(name), body_m):
+                raise Refuse(f"zero-register variable `{name}` is assigned in the body")
+            for um in re.finditer(r"\b%s\b" % re.escape(name), body_m):
                 s = b0 + um.start()
                 if s < pos or s >= e:
                     edits.append((s, s + len(name), "0"))
@@ -235,10 +336,23 @@ def site_edits(raw, m, ls, site, keep_register=False):
         new = stmt if keep_register else re.sub(r"\bregister\b[ \t]*", "", stmt, count=1)
         new = PIN_CLAUSE.sub("", new)
         return [(pos, e, new)]
+    if cls == "B" and kind in DEFERRED_KINDS:
+        raise Refuse("asm-body: a whole routine in a C shell is T7's work (DEFERRED)")
     if cls == "B" and site.get("via"):
         name = site["via"]
         if not m.startswith(name, pos):
             raise Refuse(f"token mismatch at {site['tu']}:{site['line']}: expected `{name}(`")
+        shape, ctype = macro_shape(raw, site["tu"], name, site["line"])
+        if shape == "missing":
+            raise Refuse(f"macro `{name}` is not defined in this file")
+        if shape == "compound":
+            raise Refuse(f"macro-carried {kind}: the lever is inside `#define {name}` with real code around it (T5)")
+        o = m.find("(", pos)
+        c = lc._paren_span(m, o)
+        if o < 0 or c < 0:
+            raise Refuse("unterminated macro use")
+        if shape == "expr-launder":
+            return [(pos, c + 1, f"(({ctype})({raw[o + 1:c].strip()}))")]
         if kind not in ("barrier", "launder", "keepalive"):
             raise Refuse(f"macro-carried {kind} is residue")
         e = stmt_end(m, pos)
@@ -254,10 +368,14 @@ def site_edits(raw, m, ls, site, keep_register=False):
         e = stmt_end(m, pos)
         if c < 0 or e < 0:
             raise Refuse("unterminated asm statement")
-        if kind in ("barrier", "launder", "keepalive"):
+        inner = m[o + 1:c]
+        if kind in ("barrier", "keepalive"):
             new = ""
+        elif kind == "launder":
+            how, text = launder_rewrite(inner)
+            new = "" if how == "delete" else text
         elif kind == "instruction":
-            new = instruction_to_c(m[o + 1:c] if '"' in m[o + 1:c] else raw[o + 1:c], "")
+            new = instruction_to_c(inner, "")
             if new is None:
                 raise Refuse(f"instruction `{site['detail']}` has no C spelling in the table")
             new = new.strip()
@@ -279,17 +397,44 @@ def site_edits(raw, m, ls, site, keep_register=False):
 
 
 def apply_edits(raw, edits):
-    """Splice non-overlapping edits (bottom-up). Overlap -> Refuse."""
+    """Splice non-overlapping edits (bottom-up). Overlap -> Refuse (an insertion at a deletion's boundary is not an overlap)."""
     es = sorted(edits, key=lambda x: (x[0], x[1]))
     for a, b in zip(es, es[1:]):
         if b[0] < a[1]:
             raise Refuse(f"overlapping edits at {a[0]}..{a[1]} / {b[0]}..{b[1]}")
     out = raw
-    for s, e, r in sorted(es, key=lambda x: -x[0]):
+    for s, e, r in sorted(es, key=lambda x: (-x[0], -x[1])):
         out = out[:s] + r + out[e:]
     return out
 
 
+def marker_edits(raw, ls, survivors, rung, label):
+    """End-of-line `// !FAKE:` insertions for the class A/B survivors (NEEDED / REFUSED / DEFERRED), one marker per line naming
+    every survivor on it; an existing marker on that line is replaced."""
+    by_line = collections.defaultdict(list)
+    for s, verdict, why in survivors:
+        if s["kind"] in MARK_KINDS:
+            by_line[s["line"]].append((s, verdict, why))
+    edits = []
+    for ln, items in by_line.items():
+        start, end = ls[ln - 1], ls[ln] - 1 if ln < len(ls) else len(raw)
+        line = raw[start:end]
+        parts = []
+        for s, verdict, why in items:
+            what = f"{s['kind']}" + (f" {s['detail']}" if s.get("detail") and s.get("detail") != s.get("via") else "") + (f" via {s['via']}" if s.get("via") else "")
+            parts.append(f"{what} — {verdict}" + (f" {why}" if why else ""))
+        text = f"{FAKE} " + "; ".join(parts) + f" (P36 {rung} {label})"
+        k = line.find(FAKE)
+        if k >= 0:
+            j = k
+            while j > 0 and line[j - 1] in " \t":
+                j -= 1
+            edits.append((start + j, end, "  " + text))
+        else:
+            edits.append((end, end, "  " + text))
+    return edits
+
+
 # ----------------------------------------------------------------------------------------------------------------------
 # the population
 # ----------------------------------------------------------------------------------------------------------------------
@@ -297,36 +442,878 @@ def load_sites():
     return [json.loads(l) for l in SITES.read_text().splitlines() if l.strip()]
 
 
-def bodies_from_sites(sites):
-    bodies = {}
-    for s in sites:
-        if not s.get("fn"):
-            continue
-        b = bodies.setdefault((s["tu"], s["fn"]), dict(tu=s["tu"], fn=s["fn"], fn_line=s["fn_line"], fn_end=s["fn_end"], nhash=s.get("nhash"),
-                                                        aliases=s["aliases"], header=s.get("header", False), sites=[], frozen=[]))
-        if (s["cls"], s["kind"]) in REMOVABLE:
-            b["sites"].append(s)
-        else:
-            b["frozen"].append(s)
-    return bodies
-
-
 def kind_of(tu):
     return "shared" if tu.startswith("src/shared/") else "ov" if tu.startswith("src/ov_") else "md" if tu.startswith("src/md_") \
         else "resident" if tu.startswith("src/resident/") else "main"
 
 
+def bodies_from_sites(sites, with_file_scope=False):
+    """(tu, fn) -> body; the removable sites in `sites`, the rest in `frozen`; with_file_scope adds a per-TU pseudo-body for the
+    file-scope `volatile` declarations (fn = FILE_SCOPE_FN, judged after the functions of its TU)."""
+    bodies = {}
+    for s in sites:
+        ck = (s["cls"], s["kind"])
+        if s.get("fn"):
+            b = bodies.setdefault((s["tu"], s["fn"]), dict(tu=s["tu"], fn=s["fn"], fn_line=s["fn_line"], fn_end=s["fn_end"], nhash=s.get("nhash"),
+                                                            aliases=s["aliases"], header=s.get("header", False), includers=s.get("includers", 0),
+                                                            sites=[], frozen=[], deferred=[]))
+            if ck in REMOVABLE:
+                b["sites"].append(s)
+            elif s["kind"] in DEFERRED_KINDS:
+                b["deferred"].append(s)
+            else:
+                b["frozen"].append(s)
+        elif with_file_scope and ck in FILE_SCOPE_REMOVABLE:
+            b = bodies.setdefault((s["tu"], FILE_SCOPE_FN), dict(tu=s["tu"], fn=FILE_SCOPE_FN, fn_line=None, fn_end=None, nhash=None,
+                                                                  aliases=s["aliases"], header=s.get("header", False), includers=s.get("includers", 0),
+                                                                  sites=[], frozen=[], deferred=[]))
+            b["sites"].append(s)
+    for b in bodies.values():
+        for k in ("sites", "frozen", "deferred"):
+            b[k].sort(key=lambda s: (s["line"], s["col"]))
+        if b["fn"] == FILE_SCOPE_FN:
+            b["nhash"] = "fs:" + hashlib.sha1("\n".join(s["text"] for s in b["sites"]).encode()).hexdigest()
+    return bodies
+
+
 def includers():
-    """header rel -> [TU rel] from the #include lines of every TU (the recipe to compile a header's body is an includer's)."""
-    inc = collections.defaultdict(list)
-    for p in sorted((REPO / "src").rglob("*.c")):
+    """header rel -> [TU rel] (transitive: a header included by a header is included by that header's includers)."""
+    direct = collections.defaultdict(set)
+    hdr_inc = collections.defaultdict(set)
+    for p in sorted((REPO / "src").rglob("*")):
+        if p.suffix not in (".c", ".h") or p.name.startswith("."):
+            continue
         rel = p.relative_to(REPO).as_posix()
         text = p.read_text(errors="surrogateescape")
         for mm in sc.INCLUDE_LINE.finditer(sc.mask_text(text)):
-            inc[os.path.normpath(os.path.join(os.path.dirname(rel), mm.group(1)))].append(rel)
-    return inc
+            key = os.path.normpath(os.path.join(os.path.dirname(rel), mm.group(1)))
+            (direct if rel.endswith(".c") else hdr_inc)[key].add(rel)
+    out = {}
+    def resolve(h, seen=()):
+        if h in out:
+            return out[h]
+        r = set(direct.get(h, ()))
+        for h2 in hdr_inc.get(h, ()):
+            if h2 not in seen:
+                r |= resolve(h2, seen + (h,))
+        out[h] = r
+        return r
+    for h in set(direct) | set(hdr_inc):
+        resolve(h)
+    return {h: sorted(v) for h, v in out.items()}
 
 
+def fn_addr(fn, tu):
+    mm = re.fullmatch(r"func_([0-9A-Fa-f]{8})", fn or "")
+    if mm:
+        return int(mm.group(1), 16)
+    if fn and fn != FILE_SCOPE_FN:
+        for ln in (REPO / "config" / "symbols.us.txt").read_text().splitlines():
+            m2 = re.match(r"\s*(\w+)\s*=\s*0x([0-9A-Fa-f]+)\s*;", ln)
+            if m2 and m2.group(1) == fn:
+                return int(m2.group(2), 16)
+    return None
+
+
+def src_clean():
+    r = subprocess.run(["git", "status", "--short", "--", "src"], cwd=REPO, capture_output=True, text=True)
+    return r.stdout.strip() == "", r.stdout
+
+
+def census_current():
+    if not CENSUS_JSON.exists() or not SITES.exists():
+        return False, "no census (run tools/lever_census.py --sites -j 16)"
+    d = json.loads(CENSUS_JSON.read_text())
+    st = d.get("src_stamp")
+    if not st:
+        return False, "the census carries no src_stamp (regenerate it)"
+    if st != lc.src_stamp():
+        return False, f"the census describes another tree (stamp {st}); rerun tools/lever_census.py --sites -j 16"
+    return True, "ok"
+
+
+def ensure_census(jobs):
+    ok, why = census_current()
+    if ok:
+        return
+    print(f"delever: {why} — running the census now", flush=True)
+    lc.run_census(jobs, use_cache=True, want_sites=True)
+    ok, why = census_current()
+    if not ok:
+        sys.exit(f"delever: the census is still not current ({why}) (R43)")
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# the ledger
+# ----------------------------------------------------------------------------------------------------------------------
+def load_ledger():
+    rows = []
+    if LEDGER.exists():
+        for l in LEDGER.read_text().splitlines():
+            if l.strip():
+                rows.append(json.loads(l))
+    return rows
+
+
+def ledger_append(rows):
+    RUN.mkdir(parents=True, exist_ok=True)
+    with _LOCK, open(LEDGER, "a") as f:
+        for r in rows:
+            f.write(json.dumps(r) + "\n")
+
+
+def ledger_index(rows):
+    """(done_after: set of nhash_after, exemplars: nhash_before -> the latest judged row) — the latest row per body wins (R70:
+    the tie-break is part of the instrument: rows are appended in time order, the last one is the current verdict)."""
+    done, ex = set(), {}
+    for r in rows:
+        if r.get("verdict") in DONE_VERDICTS and r.get("nhash_after"):
+            done.add(r["nhash_after"])
+        if r.get("verdict") in ("LEVER-FREE", "RESIDUE") and r.get("nhash_before") and not r.get("replay_disagreed"):
+            ex[r["nhash_before"]] = r
+    return done, ex
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# the ladder on one body — judge(text, removed_ids) -> (verdict, seconds, err); the real judge ignores removed_ids (a stub uses it)
+# ----------------------------------------------------------------------------------------------------------------------
+def site_key(s):
+    return (s["kind"], s.get("detail", ""))
+
+
+def ladder(b, raw, m, ls, judge, replay_from=None, log=None):
+    """Returns dict(verdict, rung, sites=[{ord, kind, cls, detail, line, verdict, why, oracle}], accepted=[edits], compiles, seconds,
+    replay_disagreed). Never writes the file (the judge does, and restores)."""
+    sites = list(b["sites"])
+    res = dict(verdict=None, rung=None, sites=[], accepted=[], compiles=0, seconds=0.0, replay_disagreed=False, refused=0)
+    per = {}
+    usable = []
+    for i, s in enumerate(sites):
+        try:
+            per[i] = site_edits(raw, m, ls, s)
+            usable.append(i)
+        except Refuse as ex:
+            res["sites"].append(dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                                     verdict="REFUSED", why=str(ex)[:160], oracle=""))
+            res["refused"] += 1
+    # two zero pins in one body collide (both rewrite the same uses)
+    zeros = [i for i in usable if sites[i].get("zero")]
+    if len(zeros) > 1:
+        for i in zeros:
+            usable.remove(i)
+            res["sites"].append(dict(ord=i, kind=sites[i]["kind"], cls="A", detail=sites[i]["detail"], via="", line=sites[i]["line"],
+                                     verdict="REFUSED", why="two zero-register pins in one body", oracle=""))
+            res["refused"] += 1
+    if not usable:
+        res["verdict"] = "NOTHING-USABLE"
+        res["sites"].sort(key=lambda x: x["ord"])
+        return res
+
+    def judge_edits(idxs, tag):
+        edits = [e for i in idxs for e in per[i]]
+        try:
+            cand = apply_edits(raw, edits)
+        except Refuse as ex:
+            return "REFUSED", str(ex)
+        if cand == raw:
+            return "REFUSED", "no-op edit (the candidate equals the original — an identical object would prove nothing, R37)"
+        v, dt, err = judge(cand, set(idxs), tag)
+        res["compiles"] += 1
+        res["seconds"] += dt
+        return v, err
+
+    def close(removed, needed, rung):
+        for i in usable:
+            s = sites[i]
+            if i in removed:
+                d = dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                         verdict="REMOVED", why="", oracle="IDENTICAL")
+                if s["kind"] == "launder" and per[i] and per[i][0][2].strip():
+                    d["verdict"], d["why"] = "REWRITTEN", "assignment"
+                elif s["kind"] == "instruction" or (s.get("via") and per[i] and per[i][0][2].strip()):
+                    d["verdict"], d["why"] = "REWRITTEN", (per[i][0][2].strip()[:60])
+                res["sites"].append(d)
+            else:
+                v, err = needed[i]
+                res["sites"].append(dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                                         verdict="NEEDED", why=(err[:160] if v != "DIFFERS" else ""), oracle=v))
+        res["accepted"] = [e for i in removed for e in per[i]]
+        res["verdict"] = "LEVER-FREE" if not needed else "RESIDUE"
+        res["rung"] = rung
+        res["sites"].sort(key=lambda x: x["ord"])
+        return res
+
+    # replay: the exemplar's accepted set by ordinal, when the site sequences agree
+    if replay_from:
+        ex_sites = replay_from["sites"]
+        same = len(ex_sites) == len(sites) and all(site_key(sites[i]) == (x["kind"], x.get("detail", "")) for i, x in enumerate(ex_sites))
+        if same:
+            want = [x["ord"] for x in ex_sites if x["verdict"] in ("REMOVED", "REWRITTEN") and x["ord"] in usable]
+            if want:
+                v, err = judge_edits(want, "R")
+                if v == "IDENTICAL":
+                    needed = {i: ("DIFFERS", "") for i in usable if i not in want}
+                    for x in ex_sites:
+                        if x["ord"] in needed:
+                            needed[x["ord"]] = (x.get("oracle") or "DIFFERS", x.get("why", ""))
+                    return close(set(want), needed, "replay")
+                res["replay_disagreed"] = True
+                if log:
+                    log(f"  {b['tu']}:{b['fn']} replay of {replay_from.get('tu')}:{replay_from.get('fn')} DISAGREED ({v}) — full ladder")
+    # rung A
+    vA, errA = judge_edits(usable, "A")
+    if vA == "IDENTICAL":
+        return close(set(usable), {}, "A")
+    if vA == "REFUSED":
+        res["verdict"] = "REFUSED"
+        for i in usable:                          # every site of the body survives, each with the reason (so each gets its marker)
+            s = sites[i]
+            res["sites"].append(dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s.get("detail", ""), via=s.get("via", ""), line=s["line"],
+                                     verdict="REFUSED", why=("body: " + errA)[:160], oracle=""))
+        res["sites"].sort(key=lambda x: x["ord"])
+        return res
+    # rung B greedy, asm statements first
+    order = sorted(usable, key=lambda i: (ORDER.get(sites[i]["kind"], 9), sites[i]["line"], sites[i]["col"]))
+    accepted, needed = [], {}
+    for i in order:
+        v, err = judge_edits(accepted + [i], "B")
+        if v == "IDENTICAL":
+            accepted.append(i)
+        else:
+            needed[i] = (v, err)
+    if log:
+        log(f"  {b['tu']}:{b['fn']} A={vA} B: removed {len(accepted)} needed {len(needed)} compiles {res['compiles']}")
+    return close(set(accepted), needed, "B")
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# the plan
+# ----------------------------------------------------------------------------------------------------------------------
+def class_sizes(bodies):
+    c = collections.Counter(b["nhash"] for b in bodies.values() if b["nhash"] and b["sites"])
+    return c
+
+
+def make_plan(bodies, ledger_rows, headers, batch, only, rejudge=False):
+    """[(file, [bodies])] in campaign order: headers by includer count desc, TUs by their largest class first (so exemplars precede
+    their copies), then path; a body is drawable iff its sites are non-empty (or it has DEFERRED asm-bodies) and its nhash is not a
+    ledger row's after-hash."""
+    done, ex = ledger_index(ledger_rows)
+    sizes = class_sizes(bodies)
+    files = collections.defaultdict(list)
+    for (tu, fn), b in bodies.items():
+        if tu.endswith(".h") != headers:
+            continue
+        if not b["sites"] and not b["deferred"]:
+            continue
+        if b["nhash"] in done and not rejudge:
+            continue
+        if only and not any(o in b["aliases"] or o == tu or tu.endswith("/" + o) or (b["nhash"] or "").startswith(o) or o == fn for o in only):
+            continue
+        files[tu].append(b)
+    def fkey(tu):
+        bs = files[tu]
+        if headers:
+            return (-max(b["includers"] for b in bs), tu)
+        return (-max(sizes.get(b["nhash"], 1) for b in bs), tu)
+    ordered = sorted(files, key=fkey)
+    plan = [(tu, sorted(files[tu], key=lambda b: (b["fn"] == FILE_SCOPE_FN, b["fn_line"] or 0))) for tu in ordered[:batch]]
+    return plan, len(ordered), ex
+
+
+def describe_plan(plan, total_files, bodies):
+    n_b = sum(len(bs) for _, bs in plan)
+    n_s = sum(len(b["sites"]) for _, bs in plan for b in bs)
+    n_d = sum(len(b["deferred"]) for _, bs in plan for b in bs)
+    sizes = class_sizes(bodies)
+    n_multi = sum(1 for _, bs in plan for b in bs if sizes.get(b["nhash"], 1) > 1)
+    return (f"delever --plan: {len(plan)} of {total_files} drawable files · {n_b} bodies ({n_multi} in multi-copy classes) · "
+            f"{n_s} removable sites · {n_d} deferred asm-bodies")
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# --apply
+# ----------------------------------------------------------------------------------------------------------------------
+def restore_file(path, raw, st):
+    path.write_text(raw, errors="surrogateescape")
+    try:
+        os.utime(path, ns=(st.st_atime_ns, st.st_mtime_ns))
+    except OSError:
+        pass
+
+
+def work_file(tu, bs, recipes_for, pool, exemplars, ledger_ex, label, log, calib_id):
+    """One file: every body through the ladder (replay first) against the ORIGINAL text; the final splice compiled through every
+    recipe; the file left with its final text (or restored). Returns (rows, summary)."""
+    path = REPO / tu
+    st = path.stat()
+    raw = path.read_text(errors="surrogateescape")
+    m = same_len_mask(raw)
+    ls = line_starts(raw)
+    is_hdr = tu.endswith(".h")
+    recs = recipes_for(tu)
+    out = dict(tu=tu, bodies=len(bs), rows=[], compiles=0, seconds=0.0, final="", written=False, sites_removed=0, sites_needed=0,
+               sites_refused=0, sites_deferred=0, lever_free=0, residue=0, refused_bodies=0, replays=0, disagreed=0)
+    if not recs:
+        for b in bs:
+            out["rows"].append(dict(ts=time.strftime("%Y-%m-%d %H:%M:%S"), label=label, rung=None, calib=calib_id, tu=tu, fn=b["fn"],
+                                    addr=fn_addr(b["fn"], tu), aliases=b["aliases"], header=is_hdr, verdict="NO-RECIPE", sites=[]))
+        return out
+    primary = recs[:1] if is_hdr else recs          # a header's greedy runs on ONE includer; the final on all
+
+    def judge_factory(recipe_list, parallel=False):
+        def judge(text, removed, tag):
+            try:
+                if parallel and pool is not None and len(recipe_list) > 1:
+                    path.write_text(text, errors="surrogateescape")
+                    vs = list(pool.map(lambda r: oracle.judge(r, None, tag=tag), recipe_list))
+                    bad = [v for v in vs if v[0] != "IDENTICAL"]
+                    return (bad[0][0], sum(v[1] for v in vs), bad[0][2]) if bad else ("IDENTICAL", sum(v[1] for v in vs), "")
+                return oracle.judge_all(recipe_list, text, tag=tag, write_path=(tu if is_hdr else None))
+            finally:
+                restore_file(path, raw, st)
+        return judge
+    judge_one = judge_factory(primary)
+    judge_every = judge_factory(recs, parallel=True)
+
+    accepted_all, survivors, rows = [], [], []
+    fs_edits = []
+    for b in bs:
+        replay = exemplars.get(b["nhash"]) or ledger_ex.get(b["nhash"]) if b["nhash"] else None
+        if replay and replay.get("tu") == tu and replay.get("fn") == b["fn"]:
+            replay = None
+        res = ladder(b, raw, m, ls, judge_one, replay_from=replay, log=log) if b["sites"] else \
+            dict(verdict="DEFERRED-ONLY", rung=None, sites=[], accepted=[], compiles=0, seconds=0.0, replay_disagreed=False, refused=0)
+        # a header whose greedy ran on one includer: the accepted set must hold on every includer (h_text headers differ per binary)
+        if is_hdr and len(recs) > 1 and res["accepted"] and res["verdict"] in ("LEVER-FREE", "RESIDUE"):
+            v, dt, err = judge_every(apply_edits(raw, res["accepted"]), None, "H")
+            res["compiles"] += len(recs)
+            res["seconds"] += dt
+            if v != "IDENTICAL":
+                log(f"  {tu}:{b['fn']} the one-includer verdict does not hold on every includer ({v}) — greedy on all includers")
+                res = ladder(b, raw, m, ls, judge_every, replay_from=None, log=log)
+                res["rung"] = (res.get("rung") or "") + "-all"
+        for s in b["deferred"]:
+            res["sites"].append(dict(ord=-1, kind=s["kind"], cls=s["cls"], detail=s.get("disposition", ""), via="", line=s["line"],
+                                     verdict="DEFERRED", why="T7", oracle=""))
+        if res.get("rung") == "replay":
+            out["replays"] += 1
+        if res.get("replay_disagreed"):
+            out["disagreed"] += 1
+        out["compiles"] += res["compiles"]
+        out["seconds"] += res["seconds"]
+        if b["fn"] == FILE_SCOPE_FN:
+            fs_edits = res["accepted"]
+        else:
+            accepted_all += res["accepted"]
+        for d in res["sites"]:
+            if d["verdict"] in ("NEEDED", "REFUSED", "DEFERRED"):
+                s = b["sites"][d["ord"]] if d["ord"] >= 0 and d["kind"] != "body" and d["verdict"] != "DEFERRED" else None
+                if d["verdict"] == "DEFERRED":
+                    s = next(x for x in b["deferred"] if x["line"] == d["line"])
+                if s is not None:
+                    survivors.append((s, d["verdict"], (d["oracle"] if d["verdict"] == "NEEDED" else d["why"]) or ""))
+            out["sites_removed"] += d["verdict"] in ("REMOVED", "REWRITTEN")
+            out["sites_needed"] += d["verdict"] == "NEEDED"
+            out["sites_refused"] += d["verdict"] == "REFUSED"
+            out["sites_deferred"] += d["verdict"] == "DEFERRED"
+        out["lever_free"] += res["verdict"] == "LEVER-FREE"
+        out["residue"] += res["verdict"] == "RESIDUE"
+        out["refused_bodies"] += res["verdict"] in ("REFUSED", "NOTHING-USABLE")
+        row = dict(ts=time.strftime("%Y-%m-%d %H:%M:%S"), label=label, rung=res.get("rung"), calib=calib_id, tu=tu, fn=b["fn"],
+                   addr=fn_addr(b["fn"], tu), aliases=b["aliases"], header=is_hdr, includers=b.get("includers", 0),
+                   o0=any("-O0" in r["pipeline"] for r in recs), nhash_before=b["nhash"], nhash_after=None,
+                   exemplar=(dict(tu=replay["tu"], fn=replay["fn"]) if replay and res.get("rung") == "replay" else None),
+                   verdict=res["verdict"], replay_disagreed=res.get("replay_disagreed", False), sites=res["sites"],
+                   compiles=res["compiles"], seconds=round(res["seconds"], 3))
+        rows.append((b, row))
+        if res["verdict"] in ("LEVER-FREE", "RESIDUE") and b["fn"] != FILE_SCOPE_FN:
+            with _LOCK:
+                exemplars.setdefault(b["nhash"], dict(row, tu=tu, fn=b["fn"]))
+    # the final splice: everything accepted + the markers, compiled through every recipe
+    rung_label = "rung B" if any(r.get("rung") == "B" for _, r in rows) else "rung A"
+    markers = marker_edits(raw, ls, survivors, rung_label, label)
+    def final_text(with_fs):
+        return apply_edits(raw, accepted_all + (fs_edits if with_fs else []) + markers)
+    final = None
+    for with_fs in ((True, False) if fs_edits else (True,)):
+        cand = final_text(with_fs)
+        if cand == raw:
+            final, verdict = raw, "UNCHANGED"
+            break
+        v, dt, err = judge_every(cand, None, "F")
+        out["compiles"] += len(recs)
+        out["seconds"] += dt
+        if v == "IDENTICAL":
+            final, verdict = cand, "IDENTICAL"
+            if not with_fs:
+                log(f"  {tu}: the file-scope volatile edits do not combine with the bodies' — dropped (kept as NEEDED)")
+                for b, row in rows:
+                    if b["fn"] == FILE_SCOPE_FN:
+                        row["verdict"] = "RESIDUE"
+                        for d in row["sites"]:
+                            if d["verdict"] in ("REMOVED", "REWRITTEN"):
+                                d["verdict"], d["why"], d["oracle"] = "NEEDED", "does not combine with the bodies' edits", "DIFFERS"
+                                out["sites_removed"] -= 1
+                                out["sites_needed"] += 1
+            break
+        verdict = v
+    if final is None:
+        # the combination failed: restore, refuse the whole file, loudly
+        restore_file(path, raw, st)
+        out["final"] = f"COMBINATION-FAILED ({verdict})"
+        log(f"  {tu}: COMBINATION-FAILED ({verdict}) — every body of this file REFUSED, the file restored")
+        for b, row in rows:
+            row["verdict"] = "COMBINATION-FAILED"
+            row["nhash_after"] = None
+        out["lever_free"] = out["residue"] = 0
+        out["refused_bodies"] = len(rows)
+        out["sites_removed"] = 0
+    else:
+        out["final"] = verdict
+        if final != raw:
+            path.write_text(final, errors="surrogateescape")
+            out["written"] = True
+        else:
+            restore_file(path, raw, st)
+        # the after-hash of every body from the FINAL text (the census's own normalization)
+        try:
+            walk = lc.walk_file(final, tu, is_hdr)
+            nh = {d["name"]: d["nhash"] for d in walk["defs"]}
+            fs_sites = [s for s in walk["sites"] if s["cls"] == "C" and s["kind"] == "decl-file"]
+            fs_hash = "fs:" + hashlib.sha1("\n".join(s["text"] for s in fs_sites).encode()).hexdigest()
+            for b, row in rows:
+                row["nhash_after"] = fs_hash if b["fn"] == FILE_SCOPE_FN else nh.get(b["fn"])
+                if row["nhash_after"] is None and b["fn"] != FILE_SCOPE_FN:
+                    row["nhash_after"] = b["nhash"]
+                    log(f"  {tu}:{b['fn']}: the census did not find the function in the final text — after-hash kept as before-hash")
+        except Exception as ex:   # noqa: BLE001 — the ledger must not lose the batch over a scanner hiccup
+            log(f"  {tu}: after-hash walk failed ({ex}) — after-hash = before-hash")
+            for b, row in rows:
+                row["nhash_after"] = b["nhash"]
+    out["rows"] = [row for _, row in rows]
+    return out
+
+
+def apply_batch(a):
+    RUN.mkdir(parents=True, exist_ok=True)
+    clean, dirty = src_clean()
+    if not clean:
+        sys.exit(f"delever --apply: src/ is dirty — commit, or `tools/delever.py --restore` if a batch is in flight (R42/R102):\n{dirty[:600]}")
+    if INFLIGHT.exists():
+        INFLIGHT.unlink()                            # src is clean: the previous batch was committed (or restored)
+    ok, why = oracle.calibration_current()
+    if not ok:
+        sys.exit(f"delever --apply: the oracle's calibration is not current ({why}) — tools/delever_oracle.py --calibrate … first (R56)")
+    calib = json.loads(oracle.CALIB.read_text())
+    calib_id = dict(head=calib.get("head"), stamp=calib.get("stamp"))
+    ensure_census(a.jobs)
+    recipes = oracle.load_recipes()["recipes"]
+    by_src = oracle.recipes_by_src(recipes)
+    inc = includers()
+    sites = load_sites()
+    bodies = bodies_from_sites(sites, with_file_scope=True)
+    rows = load_ledger()
+    plan, total, ledger_ex = make_plan(bodies, rows, a.headers, a.batch, a.only, a.rejudge)
+    print(describe_plan(plan, total, bodies), flush=True)
+    if not plan:
+        print("delever --apply: nothing to do (no drawable file)")
+        return 0
+    # negative control (R39/R56): the first TU of the batch compiled untouched must equal build/
+    def recipes_for(tu):
+        if tu.endswith(".h"):
+            return [r for t in inc.get(tu, []) for r in by_src.get(t, [])]
+        return by_src.get(tu, [])
+    ctl = next((tu for tu, _ in plan if recipes_for(tu)), None)
+    if ctl is None:
+        sys.exit("delever --apply: no file of the batch has a recipe (R43)")
+    r0 = recipes_for(ctl)[0]
+    v, dt, err = oracle.judge(r0, None, tag="ctl")
+    if v != "IDENTICAL":
+        sys.exit(f"delever --apply: the negative control FAILED — {ctl} untouched compiles {v} vs build/ ({err[:200]}); the baseline is stale (R56)")
+    # the in-flight snapshot BEFORE any write (the only restore, R102)
+    INFLIGHT.write_text(json.dumps({tu: (REPO / tu).read_text(errors="surrogateescape") for tu, _ in plan}))
+    log_p = RUN / f"apply_{a.label}.log"
+    log_f = open(log_p, "a")
+    def log(msg):
+        line = f"{time.strftime('%H:%M:%S')} {msg}"
+        with _LOCK:
+            print(line, flush=True)
+            log_f.write(line + "\n")
+            log_f.flush()
+    log(f"apply {a.label}: {len(plan)} files, control {ctl} IDENTICAL ({dt:.2f} s), calibration {calib_id['head']}, census {json.loads(CENSUS_JSON.read_text()).get('src_stamp')}")
+    exemplars = {}
+    results = []
+    t0 = time.time()
+    pool = ThreadPoolExecutor(max_workers=a.jobs)
+    if a.headers:
+        # headers SERIAL (a header's edit reaches every includer; nothing else may compile meanwhile); the includers in parallel
+        for tu, bs in plan:
+            results.append(work_file(tu, bs, recipes_for, pool, exemplars, ledger_ex, a.label, log, calib_id))
+            ledger_append(results[-1]["rows"])
+    else:
+        # translation units in parallel, one worker per FILE (no two candidates of one file at once; no header is edited)
+        def one(item):
+            tu, bs = item
+            r = work_file(tu, bs, recipes_for, None, exemplars, ledger_ex, a.label, log, calib_id)
+            ledger_append(r["rows"])
+            return r
+        covered, phase1, phase2 = set(), [], []
+        for tu, bs in plan:
+            fresh = [b["nhash"] for b in bs if b["nhash"] and b["nhash"] not in covered and b["nhash"] not in ledger_ex]
+            (phase1 if fresh else phase2).append((tu, bs))
+            covered.update(fresh)
+        log(f"apply {a.label}: phase 1 (exemplar files) {len(phase1)}, phase 2 (copies replay) {len(phase2)}")
+        with ThreadPoolExecutor(max_workers=a.jobs) as ex:
+            results = list(ex.map(one, phase1))
+        with ThreadPoolExecutor(max_workers=a.jobs) as ex:
+            results += list(ex.map(one, phase2))
+    pool.shutdown(wait=True)
+    wall = time.time() - t0
+    agg = collections.Counter()
+    for r in results:
+        for k in ("bodies", "compiles", "sites_removed", "sites_needed", "sites_refused", "sites_deferred", "lever_free", "residue",
+                  "refused_bodies", "replays", "disagreed", "written"):
+            agg[k] += r[k]
+        agg["seconds"] += r["seconds"]
+        agg["final_ok"] += r["final"] in ("IDENTICAL", "UNCHANGED")
+        agg["final_bad"] += r["final"].startswith("COMBINATION-FAILED") or r["final"] == ""
+    summary = dict(label=a.label, generated=time.strftime("%Y-%m-%d %H:%M"), headers=a.headers, batch=a.batch, only=a.only, files=len(plan),
+                   drawable_files=total, wall_s=round(wall, 1), calib=calib_id, **{k: agg[k] for k in agg},
+                   per_file=[dict(tu=r["tu"], bodies=r["bodies"], final=r["final"], written=r["written"], removed=r["sites_removed"],
+                                  needed=r["sites_needed"], refused=r["sites_refused"], compiles=r["compiles"]) for r in results])
+    (RUN / f"batch_{a.label}.json").write_text(json.dumps(summary, indent=1) + "\n")
+    line = (f"delever: batch {a.label} — {len(plan)} files ({'headers' if a.headers else 'TUs'}; {total} drawable) · {agg['bodies']} bodies: "
+            f"{agg['lever_free']} lever-free, {agg['residue']} residue, {agg['refused_bodies']} refused · sites removed {agg['sites_removed']} / "
+            f"needed {agg['sites_needed']} / refused {agg['sites_refused']} / deferred {agg['sites_deferred']} · replays {agg['replays']} "
+            f"({agg['disagreed']} disagreed) · compiles {agg['compiles']} in {wall:.0f} s wall · final {agg['final_ok']}/{len(plan)} identical · "
+            f"written {agg['written']} files")
+    log(line)
+    log_f.close()
+    return 0 if agg["final_bad"] == 0 else 1
+
+
+def restore():
+    if not INFLIGHT.exists():
+        sys.exit("delever --restore: no inflight.json — nothing in flight")
+    d = json.loads(INFLIGHT.read_text())
+    n = 0
+    for tu, text in d.items():
+        p = REPO / tu
+        if p.read_text(errors="surrogateescape") != text:
+            p.write_text(text, errors="surrogateescape")
+            n += 1
+    INFLIGHT.unlink()
+    clean, dirty = src_clean()
+    print(f"delever --restore: {n} of {len(d)} files restored from inflight.json; src {'clean' if clean else 'STILL DIRTY:'}\n{'' if clean else dirty[:400]}")
+    return 0 if clean else 1
+
+
+def status():
+    rows = load_ledger()
+    done, ex = ledger_index(rows)
+    latest = {}
+    for r in rows:
+        latest[(r["tu"], r["fn"])] = r
+    c = collections.Counter(r["verdict"] for r in latest.values())
+    sc_ = collections.Counter(d["verdict"] for r in latest.values() for d in r.get("sites", []))
+    kinds = collections.Counter((d["kind"], d["verdict"]) for r in latest.values() for d in r.get("sites", []))
+    print(f"delever --status: {len(rows)} rows, {len(latest)} bodies (latest row each): {dict(c)}")
+    print(f"  sites: {dict(sc_)}")
+    for (k, v), n in sorted(kinds.items()):
+        print(f"    {k:12s} {v:10s} {n}")
+    print(f"  after-hashes done {len(done)} · exemplars {len(ex)} · labels {sorted({r['label'] for r in rows})}")
+    return 0
+
+
+def apply_body(a):
+    """--apply-body TU FN FILE: the function's definition replaced by FILE's text, judged through every recipe (or every includer),
+    kept and ledgered on IDENTICAL; refused if the new body still carries a class A/B lever (unless --allow-residue)."""
+    tu, fn, src = a.apply_body
+    path = REPO / tu
+    if not path.exists():
+        sys.exit(f"delever --apply-body: no such file {tu}")
+    clean, dirty = src_clean()
+    if not clean and not a.dirty_ok:
+        sys.exit(f"delever --apply-body: src/ is dirty (commit or --restore first):\n{dirty[:400]}")
+    ok, why = oracle.calibration_current()
+    if not ok:
+        sys.exit(f"delever --apply-body: calibration not current ({why})")
+    new = pathlib.Path(src).read_text(errors="surrogateescape").rstrip("\n") + "\n"
+    raw = path.read_text(errors="surrogateescape")
+    st = path.stat()
+    recs = lc.sc.scan_text(raw, tu, shared_defs=None)
+    d = next((r for r in recs if r["form"] == "def" and r["name"] == fn), None)
+    if d is None:
+        sys.exit(f"delever --apply-body: {fn} is not defined in {tu}")
+    ls = line_starts(raw)
+    before = raw[ls[d["line"] - 1]:ls[d["end"]]]
+    cand = raw[:ls[d["line"] - 1]] + new + raw[ls[d["end"]]:]
+    if cand == raw:
+        sys.exit("delever --apply-body: the new body equals the current text (no-op, R37)")
+    walk = lc.walk_file(cand, tu, tu.endswith(".h"))
+    levers = [s for s in walk["sites"] if s.get("fn") == fn and s["cls"] in "AB" and s["kind"] not in lc.NON_LEVER_KINDS]
+    if levers and not a.allow_residue:
+        sys.exit(f"delever --apply-body: the new body still carries {len(levers)} class A/B lever site(s) "
+                 f"({[(s['kind'], s['detail'], s['line']) for s in levers][:6]}) — no lever of any class may remain (--allow-residue to override)")
+    recipes = oracle.load_recipes()["recipes"]
+    by_src = oracle.recipes_by_src(recipes)
+    inc = includers()
+    recs_ = [r for t in inc.get(tu, []) for r in by_src.get(t, [])] if tu.endswith(".h") else by_src.get(tu, [])
+    if not recs_:
+        sys.exit(f"delever --apply-body: no recipe compiles {tu}")
+    try:
+        v, dt, err = oracle.judge_all(recs_, cand, tag="body", write_path=(tu if tu.endswith(".h") else None))
+    finally:
+        restore_file(path, raw, st)
+    nh_before = lc.norm_hash(sc.mask_text(before))
+    nh_after = next((x["nhash"] for x in walk["defs"] if x["name"] == fn), None)
+    row = dict(ts=time.strftime("%Y-%m-%d %H:%M:%S"), label=a.label, rung=a.rung, calib=dict(head=oracle.head(), stamp=oracle.config_stamp()),
+               tu=tu, fn=fn, addr=fn_addr(fn, tu), aliases=None, header=tu.endswith(".h"), includers=len(inc.get(tu, [])),
+               nhash_before=nh_before, nhash_after=nh_after, source=src, verdict=("LEVER-FREE" if v == "IDENTICAL" else f"BODY-{v}"),
+               sites=[dict(ord=i, kind=s["kind"], cls=s["cls"], detail=s["detail"], via=s.get("via", ""), line=s["line"], verdict="NEEDED",
+                           why="left by the author", oracle="") for i, s in enumerate(levers)],
+               compiles=len(recs_), seconds=round(dt, 3), objects=[r["obj"] for r in recs_])
+    if v == "IDENTICAL":
+        path.write_text(cand, errors="surrogateescape")
+        ledger_append([row])
+        print(f"delever --apply-body: {tu}:{fn} IDENTICAL on {len(recs_)} object(s) ({dt:.2f} s) — KEPT, ledgered (rung {a.rung}, {a.label})")
+        return 0
+    ledger_append([row])
+    print(f"delever --apply-body: {tu}:{fn} {v} on {len(recs_)} object(s) — NOT kept ({err[:200]})")
+    return 1
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# selftest: the fixture through the census's own parser, the rewrites, the ladder against a STUB oracle, the markers, a replay
+# ----------------------------------------------------------------------------------------------------------------------
+FIXTURE = r'''#include "common.h"
+extern volatile s32 D_800B0000;
+extern s32 D_800A46D0;
+#define SHB(x) __asm__ __volatile__("" : "=r"(x) : "0"(x))
+#define LAUNDER_X(p) \
+    ({ s32 _m = (s32)(p); __asm__("" : "=r"(_m) : "0"(_m)); _m; })
+#define XFERX(SRCOFF)                                                           \
+    src = *(s32 *)(a0 + SRCOFF);                                                \
+    __asm__("" : "=r"(src) : "0"(src));                                         \
+    func_80012000(src);
+/* a comment carrying a pin: register s32 fake __asm__("$5"); */
+s32 func_80128218(s32 a0)
+{
+    register s32 zr __asm__("$0");
+    register s32 s __asm__("$16") = a0;
+    register s32 t __asm__("$17");
+    register s32 *p __asm__("$4");
+    register int plain;
+    volatile s32 buf[2];
+    s32 v = *(volatile s32 *)(a0 + 0x1C);
+    s32 src;
+    t = 3;
+    __asm__ __volatile__("" ::: "memory");
+    __asm__("" : "=r"(v) : "0"(v));
+    __asm__("" : "=r"(p) : "0"(&D_800A46D0));
+    __asm__ __volatile__("" : : "r"(s));
+    __asm__("addu %0,%1,$zero" : "=r"(v) : "r"(s));
+    SHB(v);
+    v += (s32)LAUNDER_X(&buf);
+    XFERX(0xCC);
+    buf[0] = zr;
+    return v + zr + plain + buf[0] + (s32)p + t + D_800B0000;
+}
+s32 func_80128300(s32 a0)
+{
+    register s32 zr __asm__("$0");
+    zr = a0;
+    return zr;
+}
+void func_80128400(void)
+{
+    __asm__ __volatile__(".set noreorder\n" "addiu $sp, $sp, -24\n" "sw $ra, 16($sp)\n" "jal func_80012000\n" "nop\n"
+                         "lw $ra, 16($sp)\n" "jr $ra\n" "addiu $sp, $sp, 24\n" : : : "memory");
+}
+#if 0
+static void dead(void) { register s32 x __asm__("$8"); }
+#endif
+'''
+FIXTURE_COPY = FIXTURE.replace("func_80128218", "func_80138218").replace("D_800A46D0", "D_800B46D0").replace("D_800B0000", "D_800B1000")
+
+
+def selftest():
+    import tempfile
+    ok = True
+    def fail(msg):
+        nonlocal ok
+        ok = False
+        print("selftest FAIL:", msg)
+    d = pathlib.Path(tempfile.mkdtemp(prefix="delever_selftest_", dir=str(RUN if RUN.exists() else REPO / ".run")))
+    rel = "src/fx/x.c"
+    rel2 = "src/fx/y.c"
+    (d / "x.c").write_text(FIXTURE)
+    walk = lc.walk_file(FIXTURE, rel, False)
+    sites = [dict(s, aliases=["fx"], header=False, includers=0) for s in walk["sites"]]
+    bodies = bodies_from_sites(sites, with_file_scope=True)
+    b = bodies[(rel, "func_80128218")]
+    kinds = collections.Counter(s["kind"] for s in b["sites"])
+    want = {"pin": 4, "register": 1, "decl-body": 1, "cast": 1, "barrier": 1, "launder": 5, "keepalive": 1, "instruction": 1}
+    if dict(kinds) != want:
+        fail(f"fixture sites {dict(kinds)} != {want}")
+    raw = FIXTURE
+    m = same_len_mask(raw)
+    ls = line_starts(raw)
+    # the rewrites, one by one
+    texts = {}
+    refused = {}
+    for s in b["sites"]:
+        try:
+            texts[(s["kind"], s["line"])] = apply_edits(raw, site_edits(raw, m, ls, s))
+        except Refuse as ex:
+            refused[(s["kind"], s["line"], s.get("via", ""))] = str(ex)
+    def line_of(text, needle):
+        return next((ln for ln in text.split("\n") if needle in ln), None)
+    t = texts.get(("pin", 15))
+    if not t or "register" in line_of(t, "s32 s ") or 'asm' in line_of(t, "s32 s ") or "= a0;" not in line_of(t, "s32 s "):
+        fail(f"pin with initializer -> `{line_of(t or '', 's32 s ')}`")
+    t = texts.get(("pin", 14))
+    if not t or "zr" in t.split("func_80128300")[0] or "buf[0] = 0;" not in t or "return v + 0 + plain" not in t:
+        fail("zero pin: declaration deleted, uses -> 0")
+    t = texts.get(("launder", 25))
+    if not t or line_of(t, "p = &D_800A46D0;") is None:
+        fail("launder with a different input is an ASSIGNMENT")
+    t = texts.get(("launder", 24))
+    if not t or '"=r"(v) : "0"(v)' in t.split("SHB(v)")[0].split("#define")[-1]:
+        fail("same-expression launder deleted")
+    t = texts.get(("instruction", 27))
+    if not t or "v = s;" not in t:
+        fail(f"addu-$zero instruction -> assignment: `{line_of(t or '', 'v = s') }`")
+    t = texts.get(("launder", 28))
+    if not t or "SHB(v);" in t.split("#define XFERX")[-1]:
+        fail("SHB(v); (a pure launder statement macro) deleted")
+    t = texts.get(("launder", 29))
+    if not t or "v += (s32)((s32)(&buf));" not in t:
+        fail(f"expression-launder macro -> its value: `{line_of(t or '', 'v +=')}`")
+    if not any(k[0] == "launder" and k[2] == "XFERX" for k in refused):
+        fail(f"compound macro use must be REFUSED (got {refused})")
+    t = texts.get(("cast", 20))
+    if not t or "*(s32 *)(a0 + 0x1C)" not in t:
+        fail("volatile cast dropped")
+    t = texts.get(("decl-body", 19))
+    if not t or "    s32 buf[2];" not in t:
+        fail("volatile declaration dropped")
+    t = texts.get(("register", 18))
+    if not t or "    int plain;" not in t:
+        fail("bare register dropped")
+    t = texts.get(("barrier", 23))
+    if not t or '::: "memory"' in t.split("func_80128218")[1]:
+        fail("barrier deleted")
+    # the assigned zero pin is refused; the asm-body is deferred (no removable site)
+    b2 = bodies[(rel, "func_80128300")]
+    try:
+        site_edits(raw, m, ls, b2["sites"][0])
+        fail("assigned zero-register variable must be REFUSED")
+    except Refuse:
+        pass
+    b3 = bodies[(rel, "func_80128400")]
+    if b3["sites"] or len(b3["deferred"]) != 1:
+        fail(f"asm-body: sites {len(b3['sites'])} deferred {len(b3['deferred'])}")
+    fs = bodies.get((rel, FILE_SCOPE_FN))
+    if not fs or len(fs["sites"]) != 1:
+        fail("file-scope volatile pseudo-body")
+    # the ladder against a stub oracle: NEEDED = the $17 pin and the barrier; the keep-alive's removal CRASHES the compiler
+    idx = {(s["kind"], s["line"]): i for i, s in enumerate(b["sites"])}
+    needed_ids = {idx[("pin", 16)], idx[("barrier", 23)]}
+    crash_ids = {idx[("keepalive", 26)]}
+    calls = []
+    def stub(text, removed, tag):
+        calls.append(tag)
+        if removed & crash_ids:
+            return "COMPILE-CRASH", 0.01, "CRASH: 123 Aborted (core dumped)"
+        return ("DIFFERS" if removed & needed_ids else "IDENTICAL"), 0.01, ""
+    res = ladder(b, raw, m, ls, stub)
+    got = {(x["kind"], x["line"]): x["verdict"] for x in res["sites"]}
+    if res["verdict"] != "RESIDUE" or res["rung"] != "B":
+        fail(f"ladder verdict {res['verdict']} rung {res['rung']}")
+    if got.get(("pin", 16)) != "NEEDED" or got.get(("barrier", 23)) != "NEEDED" or got.get(("keepalive", 26)) != "NEEDED":
+        fail(f"needed set {got}")
+    if [x for x in res["sites"] if x["kind"] == "keepalive"][0]["oracle"] != "COMPILE-CRASH":
+        fail("a crashing candidate must be NEEDED with the CRASH verdict")
+    if got.get(("launder", 25)) != "REWRITTEN" or got.get(("instruction", 27)) != "REWRITTEN" or got.get(("launder", 29)) != "REWRITTEN":
+        fail(f"rewritten verdicts {got}")
+    if got.get(("launder", 30)) != "REFUSED":
+        fail("the compound-macro site is REFUSED in the ladder")
+    if res["compiles"] != 1 + (len(b["sites"]) - res["refused"]):
+        fail(f"rung A + greedy compiles {res['compiles']} for {len(b['sites'])} sites ({res['refused']} refused)")
+    # the markers: class A/B survivors only, one per line, C/D never
+    survivors = [(b["sites"][x["ord"]], x["verdict"], x["oracle"] or x["why"]) for x in res["sites"] if x["verdict"] in ("NEEDED", "REFUSED")]
+    survivors.append((b3["deferred"][0], "DEFERRED", "T7"))
+    final = apply_edits(raw, res["accepted"] + marker_edits(raw, ls, survivors, "rung B", "self1"))
+    fl = final.split("\n")
+    if sum(1 for l in fl if FAKE in l) != 5:
+        fail(f"markers: {sum(1 for l in fl if FAKE in l)} lines carry one (want 5: pin $17, barrier, keepalive, XFERX, asm-body)")
+    if not any("pin $17 — NEEDED DIFFERS (P36 rung B self1)" in l for l in fl):
+        fail("marker text for the needed pin")
+    if not any("keepalive — NEEDED COMPILE-CRASH" in l for l in fl):
+        fail("marker text for the crash")
+    if not any("launder via XFERX — REFUSED" in l for l in fl):
+        fail("marker text for the compound macro")
+    if any(FAKE in l and ("buf[2]" in l or "int plain" in l) for l in fl):
+        fail("class C/D sites must never carry a marker")
+    if lc.walk_file(final, rel, False)["defs"][0]["nhash"] == b["nhash"]:
+        fail("the after-hash must differ from the before-hash once sites were removed")
+    # a marker does not change the hash: the same final text with the markers stripped hashes the same
+    stripped = "\n".join(re.sub(r"\s*// !FAKE:.*$", "", l) for l in fl)
+    if lc.walk_file(stripped, rel, False)["defs"][0]["nhash"] != lc.walk_file(final, rel, False)["defs"][0]["nhash"]:
+        fail("markers changed the normalized hash")
+    # re-marking replaces the old marker instead of stacking a second one
+    ls2 = line_starts(final)
+    ln17 = next(i + 1 for i, l in enumerate(fl) if 'pin $17' in l)
+    again = apply_edits(final, marker_edits(final, ls2, [(dict(b["sites"][idx[("pin", 16)]], line=ln17), "NEEDED", "DIFFERS")], "rung B", "self2"))
+    if again.count("pin $17 — NEEDED") != 1 or "self2" not in again or "self1)  // !FAKE" in again:
+        fail("re-marking must replace the line's marker")
+    # the replay on a copy with a different address environment: one compile, the same verdicts
+    walk2 = lc.walk_file(FIXTURE_COPY, rel2, False)
+    sites2 = [dict(s, aliases=["fy"], header=False, includers=0) for s in walk2["sites"]]
+    bodies2 = bodies_from_sites(sites2, with_file_scope=True)
+    bc = bodies2[(rel2, "func_80138218")]
+    if bc["nhash"] != b["nhash"]:
+        fail("the copy's nhash must equal the exemplar's (addresses masked)")
+    exemplar_row = dict(tu=rel, fn="func_80128218", sites=res["sites"])
+    calls.clear()
+    res2 = ladder(bc, FIXTURE_COPY, same_len_mask(FIXTURE_COPY), line_starts(FIXTURE_COPY), stub, replay_from=exemplar_row)
+    if res2["rung"] != "replay" or res2["compiles"] != 1 or {(x["kind"], x["line"]): x["verdict"] for x in res2["sites"]} != got:
+        fail(f"replay: rung {res2['rung']} compiles {res2['compiles']}")
+    # a disagreeing replay falls through to the full ladder
+    def stub2(text, removed, tag):
+        return ("DIFFERS" if removed & (needed_ids | {idx[('pin', 15)]}) else "IDENTICAL"), 0.01, ""
+    res3 = ladder(bc, FIXTURE_COPY, same_len_mask(FIXTURE_COPY), line_starts(FIXTURE_COPY), stub2, replay_from=exemplar_row)
+    if not res3["replay_disagreed"] or res3["rung"] != "B" or {x["line"] for x in res3["sites"] if x["verdict"] == "NEEDED"} != {15, 16, 23}:
+        fail(f"disagreeing replay: {res3['replay_disagreed']} rung {res3['rung']} needed {[x['line'] for x in res3['sites'] if x['verdict'] == 'NEEDED']}")
+    # a no-op candidate is refused; overlapping edits are refused
+    try:
+        apply_edits(raw, [(0, 5, "x"), (3, 8, "y")])
+        fail("overlapping edits must be refused")
+    except Refuse:
+        pass
+    # the ledger index: after-hash done, before-hash replays, the latest row wins
+    rows = [dict(verdict="RESIDUE", nhash_before="h1", nhash_after="h2", sites=[]), dict(verdict="LEVER-FREE", nhash_before="h1", nhash_after="h3", sites=[{"ord": 0}])]
+    done, ex = ledger_index(rows)
+    if done != {"h2", "h3"} or ex["h1"]["nhash_after"] != "h3":
+        fail("ledger index")
+    # the oracle's crash classification on its real message forms (R103)
+    if not oracle.SIGNAL_LINE.search("bash: line 1: 3845091 Done   mipsel-linux-gnu-cpp ...\n     3845092 Aborted                 (core dumped) | tools/bin/gcc-2.7.2-psx/cc1 -quiet\n"):
+        fail("SIGNAL_LINE must match bash's job-status block")
+    if oracle.SIGNAL_LINE.search("src/x.c:3770: parse error before `}'\n"):
+        fail("SIGNAL_LINE must not match a diagnostic")
+    for f in d.glob("*"):
+        f.unlink()
+    d.rmdir()
+    print(f"delever --selftest: {'OK' if ok else 'FAIL'} — {len(b['sites'])} sites in the exemplar, {len(refused)} refused rewrite(s), "
+          f"ladder {res['verdict']} ({res['compiles']} compiles), replay {res2['rung']} ({res2['compiles']} compile), markers {sum(1 for l in fl if FAKE in l)}")
+    return ok
+
+
+# ----------------------------------------------------------------------------------------------------------------------
+# T2's probe (unchanged in substance; the corrected rewrites apply)
+# ----------------------------------------------------------------------------------------------------------------------
 def features(b):
     ks = collections.Counter(s["kind"] for s in b["sites"])
     n = len(b["sites"])
@@ -341,10 +1328,9 @@ def features(b):
 
 def stratified_sample(bodies, n, seed):
     rnd = random.Random(seed)
-    # one exemplar per normalized class
     by_class = {}
     for key, b in bodies.items():
-        if not b["sites"]:
+        if not b["sites"] or b["fn"] == FILE_SCOPE_FN:
             continue
         h = b["nhash"] or key
         cur = by_class.get(h)
@@ -353,14 +1339,12 @@ def stratified_sample(bodies, n, seed):
             by_class[h] = (pref, key)
     pool = [bodies[k] for _, k in by_class.values()]
     rnd.shuffle(pool)
-    # quotas scale with --sample (the shape of the population: main/resident/md are few but distinct, overlays are many)
     base = {"main": 20, "resident": 16, "md": 15, "shared": 20, "ov": 79}
     scale = n / sum(base.values())
     quota = {k: max(3, int(round(v * scale))) for k, v in base.items()}
     picked, seen = [], set()
     for kind, q in quota.items():
         cands = [b for b in pool if kind_of(b["tu"]) == kind]
-        # round-robin over (bucket, mix)
         groups = collections.defaultdict(list)
         for b in cands:
             f = features(b)
@@ -375,7 +1359,6 @@ def stratified_sample(bodies, n, seed):
                 if (b["tu"], b["fn"]) not in seen:
                     picked.append(b)
                     seen.add((b["tu"], b["fn"]))
-    # the special features, topped up from the pool
     for flag, want in (("zero", 10), ("init", 10), ("instr", 12), ("cast", 8), ("register", 5), ("launder", 8), ("keepalive", 6)):
         have = sum(1 for b in picked if features(b)[flag])
         for b in pool:
@@ -388,125 +1371,58 @@ def stratified_sample(bodies, n, seed):
     return picked
 
 
-# ----------------------------------------------------------------------------------------------------------------------
-# the ladder on one body
-# ----------------------------------------------------------------------------------------------------------------------
-def run_body(b, recipe, write_path, raw, m, ls, log):
-    """Returns the per-body result dict; the caller restores the file."""
-    sites = sorted(b["sites"], key=lambda s: (ORDER.get(s["kind"], 9), s["line"], s["col"]))
-    res = dict(tu=b["tu"], fn=b["fn"], nhash=b["nhash"], kind=kind_of(b["tu"]), aliases=b["aliases"], header=b["header"],
-               obj=recipe["obj"], n_sites=len(sites), sites=[dict(kind=s["kind"], cls=s["cls"], detail=s["detail"], line=s["line"]) for s in sites],
-               refused=[], compiles=0, seconds=0.0, features=features(b))
-    per_site, edits_all, edits_keep = {}, [], []
-    usable = []
-    for s in sites:
-        try:
-            ed = site_edits(raw, m, ls, s)
-            edk = site_edits(raw, m, ls, s, keep_register=True) if s["kind"] == "pin" else ed
-            per_site[id(s)] = (ed, edk)
-            usable.append(s)
-            edits_all += ed
-            edits_keep += edk
-        except Refuse as ex:
-            res["refused"].append(dict(kind=s["kind"], line=s["line"], why=str(ex)))
-    res["n_usable"] = len(usable)
-    if not usable:
-        res["verdict"] = "NOTHING-USABLE"
-        return res
-
-    def judge(edits, tag):
-        try:
-            cand = apply_edits(raw, edits)
-        except Refuse as ex:
-            return "REFUSED", str(ex)
-        if cand == raw:
-            return "REFUSED", "no-op edit (the candidate equals the original — an identical object would prove nothing, R37)"
-        v, dt, err = oracle.judge(recipe, cand, tag=tag, write_path=write_path)
-        res["compiles"] += 1
-        res["seconds"] += dt
-        return v, err
-    # rung A (register dropped) and A' (register kept)
-    vA, errA = judge(edits_all, "A")
-    res["rung_A"] = vA
-    res["rung_A_err"] = errA[:200] if vA == "COMPILE-ERROR" else ""
-    if any(s["kind"] == "pin" for s in usable):
-        vK, _ = judge(edits_keep, "Ak")
-        res["rung_A_keep_register"] = vK
-    else:
-        res["rung_A_keep_register"] = vA
-    if vA == "IDENTICAL":
-        res["removed"] = [dict(kind=s["kind"], detail=s["detail"], line=s["line"]) for s in usable]
-        res["needed"] = []
-        res["verdict"] = "LEVER-FREE"
-        return res
-    # rung B greedy
-    accepted, needed, removed = [], [], []
-    for s in usable:
-        ed, _ = per_site[id(s)]
-        v, err = judge(accepted + ed, "B")
-        if v == "IDENTICAL":
-            accepted += ed
-            removed.append(dict(kind=s["kind"], detail=s["detail"], line=s["line"]))
-        else:
-            needed.append(dict(kind=s["kind"], detail=s["detail"], line=s["line"], verdict=v, err=(err[:120] if v == "COMPILE-ERROR" else "")))
-    res["removed"], res["needed"] = removed, needed
-    res["verdict"] = "LEVER-FREE" if not needed else "RESIDUE"
-    log(f"  {b['tu']}:{b['fn']} A={vA} B: removed {len(removed)} needed {len(needed)} compiles {res['compiles']}")
-    return res
-
-
 def probe(sample_n, seed, jobs):
     PROBE.mkdir(parents=True, exist_ok=True)
     ok, why = oracle.calibration_current()
     if not ok:
         sys.exit(f"delever: the oracle's calibration is not current ({why}) — run tools/delever_oracle.py --calibrate first (R56)")
+    ensure_census(jobs)
     recipes = oracle.load_recipes()["recipes"]
+    by_src = oracle.recipes_by_src(recipes)
     sites = load_sites()
     bodies = bodies_from_sites(sites)
     inc = includers()
     sample = stratified_sample(bodies, sample_n, seed)
     log_f = open(PROBE / "probe_log.txt", "a")
-
     def log(msg):
         line = f"{time.strftime('%H:%M:%S')} {msg}"
         print(line, flush=True)
         log_f.write(line + "\n")
         log_f.flush()
     log(f"probe: {len(sample)} bodies sampled from {len(bodies)} lever bodies ({len({b['nhash'] for b in bodies.values() if b['sites']})} distinct classes); seed {seed}")
-    # group by the FILE that gets written (a TU, or a header) — one worker per file
     by_file = collections.defaultdict(list)
     for b in sample:
         by_file[b["tu"]].append(b)
-
     def work(tu):
         out = []
         if tu.endswith(".h"):
-            tus = [t for t in inc.get(tu, []) if ("build/" + t[:-2] + ".o") in recipes]
-            if not tus:
-                return [dict(tu=tu, fn=b["fn"], verdict="NO-INCLUDER-RECIPE") for b in by_file[tu]]
-            recipe = recipes["build/" + tus[0][:-2] + ".o"]
-            write_path = tu
+            recs = [r for t in inc.get(tu, []) for r in by_src.get(t, [])][:1]
         else:
-            obj = "build/" + tu[:-2] + ".o"
-            if obj not in recipes:
-                return [dict(tu=tu, fn=b["fn"], verdict="NO-RECIPE") for b in by_file[tu]]
-            recipe = recipes[obj]
-            write_path = None
+            recs = by_src.get(tu, [])[:1]
+        if not recs:
+            return [dict(tu=tu, fn=b["fn"], verdict="NO-RECIPE") for b in by_file[tu]]
         path = REPO / tu
+        st = path.stat()
         raw = path.read_text(errors="surrogateescape")
         m = same_len_mask(raw)
         ls = line_starts(raw)
-        try:
-            for b in by_file[tu]:
-                out.append(run_body(b, recipe, write_path, raw, m, ls, log))
-        finally:
-            path.write_text(raw, errors="surrogateescape")
+        def judge(text, removed, tag):
+            try:
+                return oracle.judge_all(recs, text, tag=tag, write_path=(tu if tu.endswith(".h") else None))
+            finally:
+                restore_file(path, raw, st)
+        for b in by_file[tu]:
+            res = ladder(b, raw, m, ls, judge, log=log)
+            out.append(dict(tu=tu, fn=b["fn"], nhash=b["nhash"], kind=kind_of(tu), aliases=b["aliases"], header=b["header"], obj=recs[0]["obj"],
+                            n_sites=len(b["sites"]), n_usable=len(b["sites"]) - res["refused"], verdict=res["verdict"], rung=res.get("rung"),
+                            rung_A=("IDENTICAL" if res.get("rung") == "A" else "DIFFERS" if res.get("rung") == "B" else res["verdict"]),
+                            removed=[x for x in res["sites"] if x["verdict"] in ("REMOVED", "REWRITTEN")],
+                            needed=[dict(x, verdict=x["oracle"]) for x in res["sites"] if x["verdict"] == "NEEDED"],
+                            refused=[x for x in res["sites"] if x["verdict"] == "REFUSED"], compiles=res["compiles"], seconds=res["seconds"],
+                            features=features(b)))
         return out
     results = []
     t0 = time.time()
-    # phase 1: translation units, one worker per TU (no two candidates of one file at once, and no header is being edited);
-    # phase 2: shared headers, SERIAL — a header's edit reaches every includer, so nothing else may compile meanwhile
-    # (the dry run's three "compile errors" were two workers' candidates crossing inside one includer)
     tu_files = sorted(f for f in by_file if not f.endswith(".h"))
     hdr_files = sorted(f for f in by_file if f.endswith(".h"))
     with ThreadPoolExecutor(max_workers=jobs) as ex:
@@ -535,13 +1451,13 @@ def summarize(results, bodies, wall, seed):
         if not rs:
             continue
         by_kind[k] = dict(bodies=len(rs), A_identical=sum(1 for r in rs if r["rung_A"] == "IDENTICAL"),
-                          A_keep_register_identical=sum(1 for r in rs if r.get("rung_A_keep_register") == "IDENTICAL"),
                           lever_free=sum(1 for r in rs if r["verdict"] == "LEVER-FREE"),
                           sites=sum(r["n_usable"] for r in rs), removed=sum(len(r["removed"]) for r in rs), needed=sum(len(r["needed"]) for r in rs),
                           compiles=sum(r["compiles"] for r in rs), mean_s_per_compile=round(sum(r["seconds"] for r in rs) / max(sum(r["compiles"] for r in rs), 1), 3))
     needed_kinds = collections.Counter(n["kind"] for r in judged for n in r["needed"])
     needed_detail = collections.Counter(f"{n['kind']}:{n['detail']}" for r in judged for n in r["needed"])
-    removed_kinds = collections.Counter(x["kind"] for r in judged for x in r["removed"])
+    needed_oracle = collections.Counter(n["verdict"] for r in judged for n in r["needed"])
+    removed_kinds = collections.Counter(x["kind"] + ("/rewritten" if x["verdict"] == "REWRITTEN" else "") for r in judged for x in r["removed"])
     refused = collections.Counter(x["why"].split(":")[0][:60] for r in results for x in r.get("refused", []))
     sites_total = sum(r["n_usable"] for r in judged)
     sites_needed = sum(len(r["needed"]) for r in judged)
@@ -556,37 +1472,35 @@ def summarize(results, bodies, wall, seed):
     return dict(generated=time.strftime("%Y-%m-%d %H:%M"), seed=seed, sampled=len(results), judged=len(judged),
                 not_judged=collections.Counter(r.get("verdict") for r in results if r not in judged),
                 rung_A_identical=sum(1 for r in judged if r["rung_A"] == "IDENTICAL"),
-                rung_A_keep_register_identical=sum(1 for r in judged if r.get("rung_A_keep_register") == "IDENTICAL"),
                 lever_free_after_B=sum(1 for r in judged if r["verdict"] == "LEVER-FREE"),
                 sites=dict(total=sites_total, removed=sites_total - sites_needed, needed=sites_needed, pct_removed=pct(sites_total - sites_needed, sites_total)),
-                needed_by_kind=dict(needed_kinds), needed_by_detail=dict(needed_detail.most_common(30)), removed_by_kind=dict(removed_kinds),
-                refused=dict(refused), by_kind=by_kind, flags=flags,
+                needed_by_kind=dict(needed_kinds), needed_by_detail=dict(needed_detail.most_common(30)), needed_by_oracle=dict(needed_oracle),
+                removed_by_kind=dict(removed_kinds), refused=dict(refused), by_kind=by_kind, flags=flags,
                 compiles=sum(r["compiles"] for r in judged), mean_compiles_per_body=round(mean_compiles, 2), mean_s_per_compile=round(mean_s, 3),
-                wall_s=round(wall, 1),
-                population=dict(bodies=pop_bodies, sites=pop_sites),
+                wall_s=round(wall, 1), population=dict(bodies=pop_bodies, sites=pop_sites),
                 pricing=dict(T4_compiles_est=int(pop_bodies * mean_compiles), T4_cpu_hours_est=round(pop_bodies * mean_compiles * mean_s / 3600, 2),
-                             T4_wall_hours_at_16_est=round(pop_bodies * mean_compiles * mean_s / 3600 / 12, 2),
+                             T4_wall_hours_at_12_est=round(pop_bodies * mean_compiles * mean_s / 3600 / 12, 2),
                              residue_bodies_est=int(pop_bodies * (1 - (sum(1 for r in judged if r["verdict"] == "LEVER-FREE") / max(len(judged), 1)))),
                              residue_sites_est=int(pop_sites * (sites_needed / max(sites_total, 1)))))
 
 
 def render(s):
     L = [f"# probe — {s['sampled']} bodies sampled, {s['judged']} judged (seed {s['seed']}, {s['generated']}, wall {s['wall_s']} s)", "",
-         f"- rung A (strip-all) identical: **{s['rung_A_identical']} / {s['judged']}** (register dropped) · {s['rung_A_keep_register_identical']} with `register` kept",
+         f"- rung A (strip-all) identical: **{s['rung_A_identical']} / {s['judged']}**",
          f"- lever-free after rung B: **{s['lever_free_after_B']} / {s['judged']}**",
          f"- sites: {s['sites']['total']} usable · removed {s['sites']['removed']} ({s['sites']['pct_removed']} %) · needed {s['sites']['needed']}",
-         f"- needed by kind: {s['needed_by_kind']}", f"- needed by detail (top): {s['needed_by_detail']}",
+         f"- needed by kind: {s['needed_by_kind']}", f"- needed by the oracle's word: {s['needed_by_oracle']}", f"- needed by detail (top): {s['needed_by_detail']}",
          f"- removed by kind: {s['removed_by_kind']}", f"- refused (rewrite not applicable): {s['refused']}",
          f"- compiles {s['compiles']} · mean {s['mean_compiles_per_body']} per body · {s['mean_s_per_compile']} s per compile", "",
-         "| kind | bodies | A identical | A (register kept) | lever-free after B | sites | removed | needed | compiles | s/compile |", "|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|"]
+         "| kind | bodies | A identical | lever-free after B | sites | removed | needed | compiles | s/compile |", "|---|---:|---:|---:|---:|---:|---:|---:|---:|"]
     for k, v in s["by_kind"].items():
-        L.append(f"| {k} | {v['bodies']} | {v['A_identical']} | {v['A_keep_register_identical']} | {v['lever_free']} | {v['sites']} | {v['removed']} | {v['needed']} | {v['compiles']} | {v['mean_s_per_compile']} |")
+        L.append(f"| {k} | {v['bodies']} | {v['A_identical']} | {v['lever_free']} | {v['sites']} | {v['removed']} | {v['needed']} | {v['compiles']} | {v['mean_s_per_compile']} |")
     L += ["", "| feature | bodies | lever-free |", "|---|---:|---:|"]
     for k, v in s["flags"].items():
         L.append(f"| {k} | {v['bodies']} | {v['lever_free']} |")
     p = s["pricing"]
     L += ["", f"**Pricing (R41; population {s['population']['bodies']:,} lever bodies / {s['population']['sites']:,} removable sites):** "
-          f"T4 ≈ {p['T4_compiles_est']:,} compiles ≈ {p['T4_cpu_hours_est']} CPU-h ≈ {p['T4_wall_hours_at_16_est']} h wall at 12 workers; "
+          f"T4 ≈ {p['T4_compiles_est']:,} compiles ≈ {p['T4_cpu_hours_est']} CPU-h ≈ {p['T4_wall_hours_at_12_est']} h wall at 12 workers; "
           f"residue after the mechanical ladder ≈ {p['residue_bodies_est']:,} bodies / {p['residue_sites_est']:,} sites (the sample's rates applied to the population)."]
     return "\n".join(L)
 
@@ -596,11 +1510,50 @@ def main():
     ap.add_argument("--probe", action="store_true")
     ap.add_argument("--sample", type=int, default=150)
     ap.add_argument("--seed", type=int, default=1)
+    ap.add_argument("--plan", action="store_true", help="list the next batch (no writes)")
+    ap.add_argument("--apply", action="store_true", help="judge the next batch and keep the winning texts in place")
+    ap.add_argument("--batch", type=int, default=300, help="files per batch")
+    ap.add_argument("--headers", action="store_true", help="draw shared headers instead of translation units (serial; includers in parallel)")
+    ap.add_argument("--only", nargs="*", default=None, help="restrict to these aliases / TU paths / function names / nhash prefixes")
+    ap.add_argument("--rejudge", action="store_true", help="draw bodies the ledger already marks done")
+    ap.add_argument("--label", default=None, help="the batch label (ledger rows, apply_<label>.log, batch_<label>.json)")
+    ap.add_argument("--restore", action="store_true", help="restore every in-flight file from inflight.json")
+    ap.add_argument("--status", action="store_true")
+    ap.add_argument("--apply-body", nargs=3, metavar=("TU", "FN", "FILE"))
+    ap.add_argument("--rung", default="E")
+    ap.add_argument("--allow-residue", action="store_true")
+    ap.add_argument("--dirty-ok", action="store_true", help="--apply-body on a dirty tree (a wave banking several bodies before one commit)")
+    ap.add_argument("--selftest", action="store_true")
     ap.add_argument("-j", "--jobs", type=int, default=12)
     a = ap.parse_args()
+    if a.selftest:
+        sys.exit(0 if selftest() else 1)
     if a.probe:
         probe(a.sample, a.seed, a.jobs)
         return
+    if a.restore:
+        sys.exit(restore())
+    if a.status:
+        sys.exit(status())
+    if a.apply_body:
+        if not a.label:
+            sys.exit("delever --apply-body: --label is required")
+        sys.exit(apply_body(a))
+    if a.plan:
+        ensure_census(a.jobs)
+        sites = load_sites()
+        bodies = bodies_from_sites(sites, with_file_scope=True)
+        plan, total, _ = make_plan(bodies, load_ledger(), a.headers, a.batch, a.only, a.rejudge)
+        print(describe_plan(plan, total, bodies))
+        for tu, bs in plan[:40]:
+            print(f"  {tu}: {len(bs)} bodies, {sum(len(b['sites']) for b in bs)} sites" + (f", {sum(len(b['deferred']) for b in bs)} deferred" if any(b['deferred'] for b in bs) else ""))
+        if len(plan) > 40:
+            print(f"  … {len(plan) - 40} more files")
+        return
+    if a.apply:
+        if not a.label:
+            sys.exit("delever --apply: --label is required (R48: the ledger rows, the log and the batch record are keyed by it)")
+        sys.exit(apply_batch(a))
     ap.print_help()
 
 
diff --git a/tools/delever_cycle.sh b/tools/delever_cycle.sh
new file mode 100644
index 0000000000..887661bbd2
--- /dev/null
+++ b/tools/delever_cycle.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# delever_cycle.sh — the Phase-36 batch cycle, mechanised (T3/T4). For each batch k in [START..END]:
+#   1. the tree must be clean (src/ + config/); the oracle's calibration is refreshed (2–3 s: it is keyed to HEAD, every commit stales it);
+#   2. `delever.py --apply --batch N --label <mode>k` judges every drawable body of the next N files and leaves the winning texts in place
+#      (the census is regenerated by the tool when its src stamp is stale); the tool's exit code and its `final X/X identical` are read (R97/R66);
+#   3. the outer gate: the CLEAN fleet run (make clean && extract-all && check-all -> `218 passed, 0 failed of 218`, R22) — it also refreshes
+#      build/, the oracle's baseline objects;
+#   4. the census is rerun on the new tree (the commit line quotes it), the phase log gets the batch's entry, the 🛑 headline is refreshed (R101),
+#      and src/ + the ledger/batch record/log + the census + the phase log are committed (R42).
+# Stops on the first red (a non-zero tool exit, a final N/M with N != M, a fleet run that is not 218/218) — the batch's files are then
+# still in place: inspect, then `tools/delever.py --restore` (never git checkout, R102). Stops cleanly when nothing is drawable.
+# Usage: [LABEL_PREFIX=t3_] [TASK=T4] tools/delever_cycle.sh START END [BATCH=300] [MODE=tus|headers] [ONLY="alias1 alias2 …"]
+#   size a call so one batch stays < 10 min: TUs ≈ 8 s each single-threaded / 12 workers; a header ≈ 4 s (serial, includers in parallel).
+set -o pipefail
+cd "$(dirname "$0")/.." || exit 2
+START=$1; END=$2; BATCH=${3:-300}; MODE=${4:-tus}; ONLY=${5:-}
+[ -n "$START" ] && [ -n "$END" ] || { echo "usage: $0 START END [BATCH] [tus|headers] [ONLY]"; exit 2; }
+case "$MODE" in tus) HFLAG="";; headers) HFLAG="--headers";; *) echo "MODE must be tus or headers"; exit 2;; esac
+ONLYFLAG=""; [ -n "$ONLY" ] && ONLYFLAG="--only $ONLY"
+FLEET=$(ls config/check.*.sha | wc -l)
+PY=.venv/bin/python
+MARKER='## Approved plan (verbatim, gate 1 — 2026-09-09)'
+for k in $(seq "$START" "$END"); do
+  label="${LABEL_PREFIX:-}${MODE}${k}"
+  [ -z "$(git status --short -- src config)" ] || { echo "cycle: src/ or config/ is dirty — commit, or tools/delever.py --restore (R42/R102)"; exit 3; }
+  [ -z "$(git status --short --porcelain src | grep '^??')" ] || { echo "cycle: untracked files under src/ (a dotfile probe?) — sweep them first"; exit 3; }
+  $PY tools/delever_oracle.py --status >/dev/null 2>&1 || $PY tools/delever_oracle.py --calibrate ov_SC04_011 ov_SC03_015 ov_SC03_014 main -j 16 > .run/P36/delever/calibrate_${label}.log 2>&1 \
+    || { echo "cycle: calibration FAILED"; tail -5 .run/P36/delever/calibrate_${label}.log; exit 1; }
+  log=.run/P36/delever/run_${label}.log
+  { /usr/bin/time -f "$label wall=%e s" $PY tools/delever.py --apply --batch "$BATCH" --label "$label" $HFLAG $ONLYFLAG -j 12; echo "exit=$?"; } > "$log" 2>&1
+  grep -q '^exit=0$' "$log" || { echo "cycle: batch $label — delever exited non-zero"; tail -4 "$log"; exit 1; }
+  if grep -q 'nothing to do (no drawable file)' "$log"; then echo "cycle: nothing drawable at $label — done"; exit 0; fi
+  vline=$(grep -oE '^delever: batch .*' "$log" | tail -1)
+  final=$(echo "$vline" | grep -oE 'final [0-9]+/[0-9]+' | grep -oE '[0-9]+/[0-9]+'); [ "${final%/*}" = "${final#*/}" ] || { echo "cycle: batch $label — $vline"; exit 1; }
+  if [ "$(echo "$vline" | grep -oE 'written [0-9]+' | grep -oE '[0-9]+')" = "0" ]; then echo "cycle: batch $label wrote no file — $vline"; fi
+  r22=.run/P36/baseline/r22_${label}.log
+  { /usr/bin/time -f "wall=%e s user=%U s sys=%S s" bash -c 'set -o pipefail; make clean && make extract-all JOBS=16 && make check-all JOBS=16'; echo "exit=$?"; } > "$r22" 2>&1
+  line=$(grep -oE "check-all: [0-9]+ passed, [0-9]+ failed of [0-9]+" "$r22")
+  if ! grep -q '^exit=0$' "$r22" || [ "$line" != "check-all: $FLEET passed, 0 failed of $FLEET" ]; then echo "cycle: R22 RED after batch $label — $line (the batch's files are in place: inspect, then tools/delever.py --restore)"; exit 1; fi
+  $PY tools/lever_census.py --sites -j 16 > .run/P36/census/census_${label}.log 2>&1 || { echo "cycle: the census FAILED after batch $label"; tail -3 .run/P36/census/census_${label}.log; exit 1; }
+  cline=$(grep -oE 'levers A\+B.*' .run/P36/census/lever_census.txt | head -1)
+  [ -n "$cline" ] || cline=$(grep -oE '^lever_census:.*' .run/P36/census/census_${label}.log | head -1)
+  TASK=${TASK:-T4} $PY - "$label" "$vline" "$line" "$cline" "$(grep -oE 'wall=[0-9.]+ s' "$r22" | head -1)" "$MARKER" <<'EOF' || exit 1
+import os, pathlib, re, sys, time, subprocess
+label, vline, r22line, cline, wall, marker = sys.argv[1:7]
+task = os.environ.get("TASK", "T4")
+p = pathlib.Path("phase-ends/CURRENT_PHASE.md"); t = p.read_text()
+head = subprocess.run(["git", "rev-parse", "--short", "HEAD"], capture_output=True, text=True).stdout.strip()
+entry = (f"\n- **{time.strftime('%Y-%m-%d')} — {task} batch `{label}`** (`.run/P36/delever/run_{label}.log`, `batch_{label}.json`): `{vline}` → R22 "
+         f"(`.run/P36/baseline/r22_{label}.log`) **`{r22line}`** (`{wall}`) → census `{cline}`.")
+assert ("\n" + marker) in t, "phase log marker not found"
+t = t.replace("\n" + marker, entry + "\n\n" + marker, 1)
+# the 🛑 headline (R101): every task-advancing commit refreshes it
+lines = t.split("\n")
+for i, l in enumerate(lines):
+    if l.startswith("## 🛑 SESSION CHECKPOINT"):
+        base = re.sub(r"\s*\|\s*last batch.*$", "", l)
+        lines[i] = f"{base} | last batch `{label}` on {head}: {cline}"
+        break
+p.write_text("\n".join(lines))
+print("log:", label, cline)
+EOF
+  git add -A src && git add .run/P36/delever .run/P36/census .run/P36/baseline phase-ends/CURRENT_PHASE.md || exit 1
+  git commit -q -m "src(phase-36): ${TASK:-T4} batch $label — $vline | R22 $line | census: $cline (delever_cycle)" || exit 1
+  echo "cycle: batch $label committed $(git log --oneline -1 | cut -c1-9) — $vline | $line"
+done
+echo "cycle: batches $START..$END done"
diff --git a/tools/delever_oracle.py b/tools/delever_oracle.py
index f8ce2f640c..6a1b5935b4 100644
--- a/tools/delever_oracle.py
+++ b/tools/delever_oracle.py
@@ -42,6 +42,8 @@ RECIPES = RUN / "recipes.json"
 CALIB = RUN / "calibration.json"
 SCRATCH = RUN / "obj"
 RECIPE_RE = re.compile(r"^set -o pipefail; (.*) -o (build/\S+\.o)$")
+SIGNAL_LINE = re.compile(r"^\s*\d+\s+(Aborted|Segmentation fault|Illegal instruction|Floating point exception|Bus error|Killed)[^\n]*", re.M)
+JOB_STATUS_LINE = re.compile(r"^(bash: line \d+: )?\s*\d+\s+(Done|Exit \d+)\b")
 
 
 # ----------------------------------------------------------------------------------------------------------------------
@@ -156,11 +158,17 @@ def compile_obj(recipe, text=None, tag="x", write_path=None):
     r = subprocess.run(["bash", "-c", cmd], cwd=REPO, capture_output=True, text=True)
     dt = time.time() - t0
     if r.returncode != 0 or not out.exists():
+        # a pipeline member killed by a signal (cc1 2.7.2 aborts on some candidates — e.g. a variable whose only definition was a
+        # launder that got deleted): bash prints the job-status block ("Done" / "Aborted (core dumped)" / "Segmentation fault")
+        # and the pipeline's rc is >= 128 — that is a CRASH verdict, not a diagnostic (R103: the real message forms)
+        sig = SIGNAL_LINE.search(r.stderr)
+        if sig or r.returncode >= 128:
+            return None, dt, "CRASH: " + (sig.group(0).strip() if sig else f"rc={r.returncode}")
         # gcc 2.7.2 prints errors without the word "error" and the assembler floods stderr with `$at` warnings: keep every
         # non-warning line (R103), then the tail
         errs = [ln for ln in r.stderr.splitlines()
                 if ln.strip() and not re.search(r"\bwarning:", ln, re.I) and not ln.startswith(("In file included", " " * 16))
-                and ": In function" not in ln]
+                and ": In function" not in ln and not JOB_STATUS_LINE.match(ln)]
         return None, dt, ("\n".join(errs[:8]) or r.stderr[-400:])
     data = out.read_bytes()
     try:
@@ -183,10 +191,32 @@ def judge(recipe, text, tag="x", write_path=None):
         return "NO-BASELINE", 0.0, ""
     data, dt, err = compile_obj(recipe, text, tag, write_path)
     if data is None:
-        return "COMPILE-ERROR", dt, err
+        return ("COMPILE-CRASH" if err.startswith("CRASH:") else "COMPILE-ERROR"), dt, err
     return ("IDENTICAL" if data == base else "DIFFERS"), dt, ""
 
 
+def recipes_by_src(recipes):
+    """src rel -> [recipe] (a twin binary compiles the primary's source into its own object: two recipes, one source)."""
+    out = {}
+    for r in recipes.values():
+        out.setdefault(r["src"], []).append(r)
+    for v in out.values():
+        v.sort(key=lambda r: r["obj"])
+    return out
+
+
+def judge_all(recipes, text, tag="x", write_path=None):
+    """Every recipe of one written file judged in turn (the file is written once, by the first compile; the CALLER restores it).
+    Returns (verdict, seconds, err): IDENTICAL only if every object is identical; otherwise the first non-identical verdict."""
+    total, first = 0.0, None
+    for i, r in enumerate(recipes):
+        v, dt, err = judge(r, text if i == 0 else None, tag=tag, write_path=write_path)
+        total += dt
+        if v != "IDENTICAL" and first is None:
+            first = (v, err)
+    return (first[0] if first else "IDENTICAL"), total, (first[1] if first else "")
+
+
 # ----------------------------------------------------------------------------------------------------------------------
 # calibration
 # ----------------------------------------------------------------------------------------------------------------------
@@ -222,6 +252,7 @@ def calibrate(aliases, jobs, recipes):
     import share_census as sc
     ctl = recs[0]
     src = REPO / ctl["src"]
+    st0 = src.stat()
     orig = src.read_text(errors="surrogateescape")
     pos_verdict = "SKIPPED"
     defs = [r for r in sc.scan_text(orig, ctl["src"], shared_defs=None) if r["form"] == "def" and r.get("nlines", 0) >= 3 and not r.get("empty")]
@@ -239,6 +270,7 @@ def calibrate(aliases, jobs, recipes):
                 pos_verdict = pos_verdict if pos_verdict != "COMPILE-ERROR" else f"COMPILE-ERROR ({err[-100:]})"
             finally:
                 src.write_text(orig, errors="surrogateescape")
+                os.utime(src, ns=(st0.st_atime_ns, st0.st_mtime_ns))   # the census's src stamp is stat-based: a restore is not a change
     by_alias = {}
     for x in results:
         d = by_alias.setdefault(x["alias"], dict(objects=0, identical=0, seconds=0.0))
diff --git a/tools/lever_census.py b/tools/lever_census.py
index 3a2cb9d55c..44a7050c0a 100644
--- a/tools/lever_census.py
+++ b/tools/lever_census.py
@@ -598,6 +598,22 @@ def _walk_worker(args):
 # ----------------------------------------------------------------------------------------------------------------------
 # the fleet
 # ----------------------------------------------------------------------------------------------------------------------
+def src_stamp():
+    """sha1 over (path, size, mtime_ns) of every .c/.h under src/: the tree the census describes. delever refuses a census whose
+    stamp is not the working tree's (R43) — a restore-write that changes only an mtime just costs a census rerun (35 s)."""
+    h = hashlib.sha1()
+    for p in sorted((REPO / "src").rglob("*")):
+        if p.suffix in (".c", ".h") and not p.name.startswith("."):
+            st = p.stat()
+            h.update(f"{p.relative_to(REPO).as_posix()}|{st.st_size}|{st.st_mtime_ns}\n".encode())
+    return h.hexdigest()[:16]
+
+
+def git_head():
+    import subprocess
+    return subprocess.run(["git", "rev-parse", "--short", "HEAD"], cwd=REPO, capture_output=True, text=True).stdout.strip()
+
+
 def enumerate_files(aliases, dirs):
     """TU -> [aliases] (a twin's TUs are its primary's, listed for both), plus every header under src/ (aliases = its includers')."""
     import compile_only
@@ -756,6 +772,7 @@ def run_census(jobs, use_cache=True, out_dir=OUT_DIR_DEFAULT, want_sites=False,
         macro_texts[m["name"]].add(m["text_hash"])
     summary = dict(
         generated=time.strftime("%Y-%m-%d"), binaries=len(aliases), tus=len(tu_aliases), headers=len(headers),
+        head=git_head(), src_stamp=src_stamp(),
         coverage=coverage, coverage_ok=cov_ok, unclassified=len(unclassified),
         verbatim_excluded=dict(sites=verbatim_sites, functions=len(verbatim_fns), manifest_rows=len(verb)),
         classes=classes,