diff --git a/docs/cookbook-index.md b/docs/cookbook-index.md
index e0b3605d3..c5019585a 100644
--- a/docs/cookbook-index.md
+++ b/docs/cookbook-index.md
@@ -2,7 +2,7 @@
 
 > **Generated by `tools/cookbook_index.py` — do not hand-edit** (R33). Regenerate after adding a cookbook section.
 >
-> `docs/matching-cookbook.md` is ~716 KB / 749 sections. Grepping it blind is how three P30 wave-1 agents each "discovered" an idiom that was already written down. **Start here, then read the section.** A section appears under every symptom it addresses.
+> `docs/matching-cookbook.md` is ~716 KB / 750 sections. Grepping it blind is how three P30 wave-1 agents each "discovered" an idiom that was already written down. **Start here, then read the section.** A section appears under every symptom it addresses.
 
 **How to use:** name what you SEE in the diff (a stolen delay slot, an extra `la`, a swapped register pair, a `conflicting types` error), find that symptom below, read those sections first. If nothing fits, THEN grind — and add a section when you win.
 
@@ -42,31 +42,31 @@
 - **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10068</sub>
 - **§162** — CROSS-JUMP DIRECTION: the surviving copy is always the LATER one, so a BACKWARD `j` into a sibling arm is a source `goto` (P30 S48)  <sub>L11266</sub>
 - **§162** — The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_80189540`)  <sub>L11302</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17159</sub>
-- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17616</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18063</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19282</sub>
-- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19541</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19852</sub>
-- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19920</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19978</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20030</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20190</sub>
-- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20382</sub>
-- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20582</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20942</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L20996</sub>
-- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21233</sub>
-- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21529</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22337</sub>
-- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22724</sub>
-- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22782</sub>
-- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22844</sub>
-- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23126</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23626</sub>
-- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23778</sub>
-- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24465</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24832</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17169</sub>
+- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17626</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18073</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19292</sub>
+- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19551</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19862</sub>
+- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19930</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19988</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20040</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20200</sub>
+- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20392</sub>
+- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20592</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20952</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21006</sub>
+- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21243</sub>
+- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21539</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22347</sub>
+- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22734</sub>
+- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22792</sub>
+- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22854</sub>
+- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23136</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23636</sub>
+- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23788</sub>
+- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24475</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24842</sub>
 
 ### instruction scheduling  (46)
 
@@ -89,33 +89,33 @@
 - **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10145</sub>
 - **§3-A.** — `move_movables` hoists iff `threshold × savings × lifetime ≥ insn_count` — and you can read it  <sub>L10151</sub>
 - **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14340</sub>
-- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16712</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17159</sub>
-- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17244</sub>
-- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17616</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17680</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18063</sub>
-- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18518</sub>
-- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18552</sub>
-- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18653</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18921</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19088</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19282</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19415</sub>
-- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19596</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19852</sub>
-- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20681</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20942</sub>
-- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22020</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22337</sub>
-- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22663</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23162</sub>
-- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23194</sub>
-- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23506</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23626</sub>
-- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23691</sub>
-- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24221</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24832</sub>
+- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16722</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17169</sub>
+- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17254</sub>
+- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17626</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17690</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18073</sub>
+- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18528</sub>
+- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18562</sub>
+- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18663</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18931</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19098</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19292</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19425</sub>
+- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19606</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19862</sub>
+- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20691</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20952</sub>
+- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22030</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22347</sub>
+- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22673</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23172</sub>
+- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23204</sub>
+- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23516</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23636</sub>
+- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23701</sub>
+- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24231</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24842</sub>
 
 ### register allocation & pins  (82)
 
@@ -161,69 +161,69 @@
 - **§158** — The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S46 tier-3, `func_8017CE58`, 733 ins)  <sub>L10712</sub>
 - **Bonus** — facts worth keeping  <sub>L10757</sub>
 - **§156** — THE PREFERENCE-DONOR MERGE: cross-region variable reuse is what fills a0-a3, and a call-arg use in ONE region steers the fill in ALL of them (P30 S46 tier-3, `func_80186E24`, 611 ins: 236-off "S11 regalloc-order" → MATCH, zero new pins)  <sub>L10772</sub>
-- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16712</sub>
-- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17096</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17159</sub>
-- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17313</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17509</sub>
-- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17532</sub>
-- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17610</sub>
-- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17640</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17680</sub>
-- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17933</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18063</sub>
-- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18092</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18480</sub>
-- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18552</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18987</sub>
-- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19025</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19088</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19239</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19282</sub>
-- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19596</sub>
-- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19762</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19978</sub>
-- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20610</sub>
-- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20681</sub>
-- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20730</sub>
-- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20883</sub>
-- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22020</sub>
-- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22165</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22337</sub>
-- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22512</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22690</sub>
-- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22724</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23162</sub>
-- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23656</sub>
-- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23812</sub>
-- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23958</sub>
-- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23972</sub>
-- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24329</sub>
-- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24441</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24832</sub>
+- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16722</sub>
+- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17106</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17169</sub>
+- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17323</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17519</sub>
+- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17542</sub>
+- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17620</sub>
+- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17650</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17690</sub>
+- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17943</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18073</sub>
+- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18102</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18490</sub>
+- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18562</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18997</sub>
+- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19035</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19098</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19249</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19292</sub>
+- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19606</sub>
+- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19772</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19988</sub>
+- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20620</sub>
+- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20691</sub>
+- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20740</sub>
+- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20893</sub>
+- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22030</sub>
+- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22175</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22347</sub>
+- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22522</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22700</sub>
+- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22734</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23172</sub>
+- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23666</sub>
+- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23822</sub>
+- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23968</sub>
+- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23982</sub>
+- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24339</sub>
+- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24451</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24842</sub>
 
 ### CSE / redundancy / rematerialization  (20)
 
 - **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3313</sub>
 - **§83d** — CSE's quantity budget is WHOLE-FUNCTION, so a local rewrite cannot fix a local symptom  <sub>L6452</sub>
 - **§153** — THE ADDRESS-REMATERIALISATION LAUNDER: a third zero-emission asm lever (P30 S43, `func_8018D98C`, 710 ins)  <sub>L10466</sub>
-- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17706</sub>
-- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18623</sub>
-- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18653</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18778</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18921</sub>
-- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19363</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19415</sub>
-- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20078</sub>
-- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20125</sub>
-- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20286</sub>
-- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20544</sub>
-- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20582</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21331</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21726</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23626</sub>
-- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23656</sub>
+- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17716</sub>
+- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18633</sub>
+- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18663</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18788</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18931</sub>
+- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19373</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19425</sub>
+- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20088</sub>
+- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20135</sub>
+- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20296</sub>
+- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20554</sub>
+- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20592</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21341</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21736</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23636</sub>
+- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23666</sub>
 
 ### loops & induction variables  (18)
 
@@ -237,14 +237,14 @@
 - **§145** — Three loop/combine levers from the S40 wave-2 drafters (16/16 match_one)  <sub>L9927</sub>
 - **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10145</sub>
 - **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16420</sub>
-- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17313</sub>
-- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17483</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17509</sub>
-- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19025</sub>
-- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21604</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21726</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22337</sub>
-- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23738</sub>
+- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17323</sub>
+- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17493</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17519</sub>
+- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19035</sub>
+- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21614</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21736</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22347</sub>
+- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23748</sub>
 
 ### structs, block moves & memcpy  (57)
 
@@ -283,28 +283,28 @@
 - **§3-The** — `/s` drop clause is in ALL THREE dependence predicates, so the FIXED-ADDRESS STORE is what floats (P30 S48, `func_8017CA18`, ov_MAIN_012)  <sub>L12302</sub>
 - **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14340</sub>
 - **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014)  <sub>L14342</sub>
-- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16930</sub>
-- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17281</sub>
-- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17483</sub>
-- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17640</sub>
-- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18197</sub>
-- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18413</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18480</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18818</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19129</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19282</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19852</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19978</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20030</sub>
-- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20234</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20942</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21726</sub>
-- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22880</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23162</sub>
-- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23836</sub>
-- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24104</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24832</sub>
+- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16940</sub>
+- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17291</sub>
+- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17493</sub>
+- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17650</sub>
+- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18207</sub>
+- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18423</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18490</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18828</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19139</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19292</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19862</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19988</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20040</sub>
+- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20244</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20952</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21736</sub>
+- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22890</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23172</sub>
+- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23846</sub>
+- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24114</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24842</sub>
 
 ### types, signedness & load/store width  (59)
 
@@ -342,31 +342,31 @@
 - **§154** — Reading a disc payload: the module-id word, static base derivation, and "type 1 = uncompressed overlay" (P30 S44)  <sub>L10522</sub>
 - **§3-C.** — PAC type 1 = the same payload class as type 4, just NOT compressed  <sub>L10548</sub>
 - **§155b** — check the TYPE your oracle returns before comparing against it (S45 p5)  <sub>L10587</sub>
-- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L16994</sub>
-- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17265</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18031</sub>
-- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18084</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18480</sub>
-- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18717</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18778</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18987</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19088</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19239</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19282</sub>
-- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19320</sub>
-- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20544</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21284</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21449</sub>
-- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21801</sub>
-- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22634</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22690</sub>
-- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L22964</sub>
-- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23262</sub>
-- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23411</sub>
-- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23598</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23626</sub>
-- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23915</sub>
+- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L17004</sub>
+- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17275</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18041</sub>
+- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18094</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18490</sub>
+- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18727</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18788</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18997</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19098</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19249</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19292</sub>
+- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19330</sub>
+- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20554</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21294</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21459</sub>
+- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21811</sub>
+- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22644</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22700</sub>
+- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L22974</sub>
+- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23272</sub>
+- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23421</sub>
+- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23608</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23636</sub>
+- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23925</sub>
 
 ### declarations, prototypes & K&R  (89)
 
@@ -427,38 +427,38 @@
 - **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10068</sub>
 - **§159** — THE DECLARATION AXIS: conform to byte-truth, and make every guard state its COVERAGE (P30 S47; ~10,930 sites across 8 axes, fleet byte-identical)  <sub>L10828</sub>
 - **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16211</sub>
-- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16899</sub>
-- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17932</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18778</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18818</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18987</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19088</sub>
-- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19691</sub>
-- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19804</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19852</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19978</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20030</sub>
-- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20078</sub>
-- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20475</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L20996</sub>
-- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21062</sub>
-- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21121</sub>
-- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21284</sub>
-- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21412</sub>
-- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21668</sub>
-- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21801</sub>
-- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22165</sub>
-- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22466</sub>
-- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22568</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22690</sub>
-- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22844</sub>
-- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23332</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23626</sub>
-- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23878</sub>
-- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24293</sub>
-- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24522</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24832</sub>
+- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16909</sub>
+- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17942</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18788</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18828</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18997</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19098</sub>
+- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19701</sub>
+- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19814</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19862</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19988</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20040</sub>
+- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20088</sub>
+- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20485</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21006</sub>
+- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21072</sub>
+- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21131</sub>
+- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21294</sub>
+- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21422</sub>
+- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21678</sub>
+- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21811</sub>
+- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22175</sub>
+- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22476</sub>
+- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22578</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22700</sub>
+- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22854</sub>
+- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23342</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23636</sub>
+- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23888</sub>
+- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24303</sub>
+- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24532</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24842</sub>
 
 ### jump tables & switches  (37)
 
@@ -489,16 +489,16 @@
 - **§132b** — When the span's already-matched owner is ITSELF multi-switch: `--span-rel` (P30 S1, `func_8014032C`)  <sub>L8660</sub>
 - **§139** — A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not survive a carve (P30 S38, wave 6: 10 of 16 drafts vanished)  <sub>L9594</sub>
 - **§161** — THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47)  <sub>L10969</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17509</sub>
-- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18147</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L20996</sub>
-- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22075</sub>
-- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22740</sub>
-- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23126</sub>
-- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24019</sub>
-- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24423</sub>
-- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24718</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17519</sub>
+- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18157</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21006</sub>
+- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22085</sub>
+- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22750</sub>
+- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23136</sub>
+- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24029</sub>
+- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24433</sub>
+- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24728</sub>
 
 ### optimisation level (-O0/-O2)  (15)
 
@@ -514,9 +514,9 @@
 - **§3-The** — rest of the `-O0` regime (write PLAIN C, and mean it)  <sub>L8367</sub>
 - **§127a** — §71 (sibling-first) is the strongest `-O0` lever, and it beats the index  <sub>L8377</sub>
 - **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8570</sub>
-- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20234</sub>
-- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24754</sub>
-- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24780</sub>
+- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20244</sub>
+- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24764</sub>
+- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24790</sub>
 
 ### family propagation & sweeps  (94)
 
@@ -606,14 +606,14 @@
 - **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16211</sub>
 - **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16420</sub>
 - **§171b** — THREE CARRIES THE MECHANICAL DRAFT NEEDS (P30 S50, banking the top-reach families)  <sub>L16470</sub>
-- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17287</sub>
-- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18623</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19129</sub>
-- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19920</sub>
-- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20730</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21449</sub>
-- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22880</sub>
-- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24104</sub>
+- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17297</sub>
+- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18633</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19139</sub>
+- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19930</sub>
+- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20740</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21459</sub>
+- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22890</sub>
+- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24114</sub>
 
 ### integration / TU plumbing  (50)
 
@@ -656,17 +656,17 @@
 - **§3-A.** — Payload word0 is a global MODULE ID; code starts after the header  <sub>L10527</sub>
 - **§162** — THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the body order (P30 S47, `ov_MAIN_012`)  <sub>L11143</sub>
 - **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14902</sub>
-- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16606</sub>
-- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16803</sub>
-- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17813</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18031</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19129</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20190</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21062</sub>
-- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21121</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21449</sub>
-- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22291</sub>
+- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16616</sub>
+- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16813</sub>
+- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17823</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18041</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19139</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20200</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21072</sub>
+- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21131</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21459</sub>
+- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22301</sub>
 
 ### build graph, splat & the harness  (154)
 
@@ -779,51 +779,51 @@
 - **§165** — S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed  <sub>L13689</sub>
 - **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14902</sub>
 - **§167** — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point  <sub>L14958</sub>
-- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16842</sub>
-- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L16976</sub>
-- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17023</sub>
-- **§3-D.** — The measured cost shape, and what to build next  <sub>L17046</sub>
-- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17064</sub>
-- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17303</sub>
-- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17532</sub>
-- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17599</sub>
-- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17784</sub>
-- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17813</sub>
-- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17850</sub>
-- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18003</sub>
-- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18109</sub>
-- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18272</sub>
-- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18309</sub>
-- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18331</sub>
-- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18396</sub>
-- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18413</sub>
-- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18717</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18818</sub>
-- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18877</sub>
-- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18904</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19129</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19239</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19415</sub>
-- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19656</sub>
-- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19677</sub>
-- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20125</sub>
-- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20333</sub>
-- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20429</sub>
-- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20530</sub>
-- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20670</sub>
-- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20775</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L20996</sub>
-- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21111</sub>
-- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21510</sub>
-- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22144</sub>
-- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23218</sub>
-- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23332</sub>
-- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23778</sub>
-- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23972</sub>
-- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24629</sub>
-- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24718</sub>
-- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24754</sub>
+- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16852</sub>
+- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L16986</sub>
+- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17033</sub>
+- **§3-D.** — The measured cost shape, and what to build next  <sub>L17056</sub>
+- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17074</sub>
+- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17313</sub>
+- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17542</sub>
+- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17609</sub>
+- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17794</sub>
+- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17823</sub>
+- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17860</sub>
+- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18013</sub>
+- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18119</sub>
+- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18282</sub>
+- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18319</sub>
+- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18341</sub>
+- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18406</sub>
+- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18423</sub>
+- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18727</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18828</sub>
+- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18887</sub>
+- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18914</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19139</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19249</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19425</sub>
+- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19666</sub>
+- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19687</sub>
+- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20135</sub>
+- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20343</sub>
+- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20439</sub>
+- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20540</sub>
+- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20680</sub>
+- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20785</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21006</sub>
+- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21121</sub>
+- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21520</sub>
+- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22154</sub>
+- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23228</sub>
+- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23342</sub>
+- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23788</sub>
+- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23982</sub>
+- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24639</sub>
+- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24728</sub>
+- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24764</sub>
 
 ### process, measurement & doctrine  (92)
 
@@ -900,27 +900,27 @@
 - **§165z** — REFUTED THIS WAVE: do NOT re-derive  <sub>L14858</sub>
 - **§167z** — REFUTED IN WAVES 5/6: do NOT re-derive  <sub>L16154</sub>
 - **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16211</sub>
-- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16930</sub>
-- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L16968</sub>
-- **§3-D.** — The measured cost shape, and what to build next  <sub>L17046</sub>
-- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17122</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17680</sub>
-- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17732</sub>
-- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17784</sub>
-- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17850</sub>
-- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17906</sub>
-- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17932</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18031</sub>
-- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18272</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18921</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19088</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20190</sub>
-- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21331</sub>
-- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23070</sub>
-- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24056</sub>
-- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24125</sub>
+- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16940</sub>
+- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L16978</sub>
+- **§3-D.** — The measured cost shape, and what to build next  <sub>L17056</sub>
+- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17132</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17690</sub>
+- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17742</sub>
+- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17794</sub>
+- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17860</sub>
+- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17916</sub>
+- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17942</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18041</sub>
+- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18282</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18931</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19098</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20200</sub>
+- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21341</sub>
+- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23080</sub>
+- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24066</sub>
+- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24135</sub>
 
-### (unbucketed — title matched no symptom vocabulary)  (233)
+### (unbucketed — title matched no symptom vocabulary)  (234)
 
 - **§3-How** — to use this  <sub>L30</sub>
 - **§1** — Idiom catalog (asm pattern → C that produces it)  <sub>L39</sub>
@@ -1094,67 +1094,68 @@
 - **§172** — THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 MIPS  <sub>L16503</sub>
 - **§172a** — TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max)  <sub>L16557</sub>
 - **§172b** — THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask)  <sub>L16573</sub>
-- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16642</sub>
-- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16737</sub>
-- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16777</sub>
-- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17016</sub>
-- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17142</sub>
-- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17216</sub>
-- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17228</sub>
-- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17257</sub>
-- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17272</sub>
-- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17362</sub>
-- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17412</sub>
-- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17463</sub>
-- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17559</sub>
-- **Considered** — and NOT banked  <sub>L17582</sub>
-- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17754</sub>
-- **What** — is NOT banked here  <sub>L17771</sub>
-- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17832</sub>
-- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17851</sub>
-- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17920</sub>
-- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18332</sub>
-- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19166</sub>
-- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19493</sub>
-- **§197-REJECTED** — §197-REJECTED  <sub>L20655</sub>
-- **§199-REJECTED** — §199-REJECTED  <sub>L21051</sub>
-- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21153</sub>
-- **§201-REJECTED** — eight, the session's highest  <sub>L21387</sub>
-- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21853</sub>
-- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21947</sub>
-- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22214</sub>
-- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22385</sub>
-- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22430</sub>
-- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22608</sub>
-- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22923</sub>
-- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L22984</sub>
-- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23021</sub>
-- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23085</sub>
-- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23182</sub>
-- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23188</sub>
-- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23203</sub>
-- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23212</sub>
-- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23303</sub>
-- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23466</sub>
-- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23540</sub>
-- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23569</sub>
-- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L23937</sub>
-- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L23984</sub>
-- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24099</sub>
-- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24148</sub>
-- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24159</sub>
-- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24176</sub>
-- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24205</sub>
-- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24264</sub>
-- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24381</sub>
-- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24398</sub>
-- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24495</sub>
-- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24567</sub>
-- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24578</sub>
-- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24587</sub>
-- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24618</sub>
-- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24668</sub>
-- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24802</sub>
+- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16652</sub>
+- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16747</sub>
+- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16787</sub>
+- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17026</sub>
+- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17152</sub>
+- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17226</sub>
+- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17238</sub>
+- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17267</sub>
+- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17282</sub>
+- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17372</sub>
+- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17422</sub>
+- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17473</sub>
+- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17569</sub>
+- **Considered** — and NOT banked  <sub>L17592</sub>
+- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17764</sub>
+- **What** — is NOT banked here  <sub>L17781</sub>
+- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17842</sub>
+- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17861</sub>
+- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17930</sub>
+- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18342</sub>
+- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19176</sub>
+- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19503</sub>
+- **§197-REJECTED** — §197-REJECTED  <sub>L20665</sub>
+- **§199-REJECTED** — §199-REJECTED  <sub>L21061</sub>
+- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21163</sub>
+- **§201-REJECTED** — eight, the session's highest  <sub>L21397</sub>
+- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21863</sub>
+- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21957</sub>
+- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22224</sub>
+- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22395</sub>
+- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22440</sub>
+- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22618</sub>
+- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22933</sub>
+- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L22994</sub>
+- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23031</sub>
+- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23095</sub>
+- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23192</sub>
+- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23198</sub>
+- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23213</sub>
+- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23222</sub>
+- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23313</sub>
+- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23476</sub>
+- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23550</sub>
+- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23579</sub>
+- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L23947</sub>
+- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L23994</sub>
+- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24109</sub>
+- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24158</sub>
+- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24169</sub>
+- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24186</sub>
+- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24215</sub>
+- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24274</sub>
+- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24391</sub>
+- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24408</sub>
+- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24505</sub>
+- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24577</sub>
+- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24588</sub>
+- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24597</sub>
+- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24628</sub>
+- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24678</sub>
+- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24812</sub>
+- **§264** — FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59)  <sub>L24883</sub>
 
 
 ## All sections, in order
@@ -1676,235 +1677,236 @@
 - **§172** — THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 MIPS  <sub>L16503</sub>
 - **§172a** — TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max)  <sub>L16557</sub>
 - **§172b** — THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask)  <sub>L16573</sub>
-- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16606</sub>
-- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16642</sub>
-- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16712</sub>
-- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16737</sub>
-- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16777</sub>
-- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16803</sub>
-- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16842</sub>
-- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16899</sub>
-- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16930</sub>
-- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L16968</sub>
-- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L16976</sub>
-- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L16994</sub>
-- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17016</sub>
-- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17023</sub>
-- **§3-D.** — The measured cost shape, and what to build next  <sub>L17046</sub>
-- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17064</sub>
-- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17096</sub>
-- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17122</sub>
-- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17142</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17159</sub>
-- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17216</sub>
-- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17228</sub>
-- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17244</sub>
-- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17257</sub>
-- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17265</sub>
-- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17272</sub>
-- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17281</sub>
-- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17287</sub>
-- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17303</sub>
-- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17313</sub>
-- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17362</sub>
-- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17412</sub>
-- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17463</sub>
-- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17483</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17509</sub>
-- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17532</sub>
-- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17559</sub>
-- **Considered** — and NOT banked  <sub>L17582</sub>
-- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17599</sub>
-- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17610</sub>
-- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17616</sub>
-- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17640</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17680</sub>
-- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17706</sub>
-- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17732</sub>
-- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17754</sub>
-- **What** — is NOT banked here  <sub>L17771</sub>
-- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17784</sub>
-- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17813</sub>
-- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17832</sub>
-- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17850</sub>
-- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17851</sub>
-- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17906</sub>
-- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17920</sub>
-- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17932</sub>
-- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17933</sub>
-- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18003</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18031</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18063</sub>
-- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18084</sub>
-- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18092</sub>
-- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18109</sub>
-- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18147</sub>
-- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18197</sub>
-- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18272</sub>
-- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18309</sub>
-- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18331</sub>
-- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18332</sub>
-- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18396</sub>
-- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18413</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18480</sub>
-- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18518</sub>
-- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18552</sub>
-- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18623</sub>
-- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18653</sub>
-- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18717</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18778</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18818</sub>
-- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18877</sub>
-- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18904</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18921</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18987</sub>
-- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19025</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19088</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19129</sub>
-- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19166</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19239</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19282</sub>
-- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19320</sub>
-- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19363</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19415</sub>
-- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19493</sub>
-- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19541</sub>
-- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19596</sub>
-- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19656</sub>
-- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19677</sub>
-- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19691</sub>
-- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19762</sub>
-- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19804</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19852</sub>
-- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19920</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19978</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20030</sub>
-- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20078</sub>
-- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20125</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20190</sub>
-- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20234</sub>
-- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20286</sub>
-- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20333</sub>
-- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20382</sub>
-- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20429</sub>
-- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20475</sub>
-- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20530</sub>
-- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20544</sub>
-- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20582</sub>
-- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20610</sub>
-- **§197-REJECTED** — §197-REJECTED  <sub>L20655</sub>
-- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20670</sub>
-- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20681</sub>
-- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20730</sub>
-- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20775</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20823</sub>
-- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20883</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20942</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L20996</sub>
-- **§199-REJECTED** — §199-REJECTED  <sub>L21051</sub>
-- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21062</sub>
-- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21111</sub>
-- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21121</sub>
-- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21153</sub>
-- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21233</sub>
-- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21284</sub>
-- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21331</sub>
-- **§201-REJECTED** — eight, the session's highest  <sub>L21387</sub>
-- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21412</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21449</sub>
-- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21510</sub>
-- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21529</sub>
-- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21604</sub>
-- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21668</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21726</sub>
-- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21801</sub>
-- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21853</sub>
-- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21947</sub>
-- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22020</sub>
-- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22075</sub>
-- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22144</sub>
-- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22165</sub>
-- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22214</sub>
-- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22291</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22337</sub>
-- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22385</sub>
-- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22430</sub>
-- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22466</sub>
-- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22512</sub>
-- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22568</sub>
-- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22608</sub>
-- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22634</sub>
-- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22663</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22690</sub>
-- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22724</sub>
-- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22740</sub>
-- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22782</sub>
-- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22844</sub>
-- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22880</sub>
-- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22923</sub>
-- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L22964</sub>
-- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L22984</sub>
-- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23021</sub>
-- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23070</sub>
-- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23085</sub>
-- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23126</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23162</sub>
-- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23182</sub>
-- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23188</sub>
-- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23194</sub>
-- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23203</sub>
-- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23212</sub>
-- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23218</sub>
-- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23262</sub>
-- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23303</sub>
-- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23332</sub>
-- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23411</sub>
-- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23466</sub>
-- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23506</sub>
-- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23540</sub>
-- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23569</sub>
-- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23598</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23626</sub>
-- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23656</sub>
-- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23691</sub>
-- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23738</sub>
-- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23778</sub>
-- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23812</sub>
-- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23836</sub>
-- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23878</sub>
-- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23915</sub>
-- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L23937</sub>
-- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23958</sub>
-- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23972</sub>
-- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L23984</sub>
-- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24019</sub>
-- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24056</sub>
-- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24099</sub>
-- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24104</sub>
-- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24125</sub>
-- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24148</sub>
-- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24159</sub>
-- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24176</sub>
-- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24205</sub>
-- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24221</sub>
-- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24264</sub>
-- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24293</sub>
-- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24329</sub>
-- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24381</sub>
-- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24398</sub>
-- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24423</sub>
-- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24441</sub>
-- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24465</sub>
-- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24495</sub>
-- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24522</sub>
-- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24567</sub>
-- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24578</sub>
-- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24587</sub>
-- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24618</sub>
-- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24629</sub>
-- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24668</sub>
-- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24718</sub>
-- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24754</sub>
-- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24780</sub>
-- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24802</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24832</sub>
+- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16616</sub>
+- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16652</sub>
+- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16722</sub>
+- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16747</sub>
+- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16787</sub>
+- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16813</sub>
+- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16852</sub>
+- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16909</sub>
+- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16940</sub>
+- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L16978</sub>
+- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L16986</sub>
+- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L17004</sub>
+- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17026</sub>
+- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17033</sub>
+- **§3-D.** — The measured cost shape, and what to build next  <sub>L17056</sub>
+- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17074</sub>
+- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17106</sub>
+- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17132</sub>
+- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17152</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17169</sub>
+- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17226</sub>
+- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17238</sub>
+- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17254</sub>
+- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17267</sub>
+- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17275</sub>
+- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17282</sub>
+- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17291</sub>
+- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17297</sub>
+- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17313</sub>
+- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17323</sub>
+- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17372</sub>
+- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17422</sub>
+- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17473</sub>
+- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17493</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17519</sub>
+- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17542</sub>
+- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17569</sub>
+- **Considered** — and NOT banked  <sub>L17592</sub>
+- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17609</sub>
+- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17620</sub>
+- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17626</sub>
+- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17650</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17690</sub>
+- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17716</sub>
+- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17742</sub>
+- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17764</sub>
+- **What** — is NOT banked here  <sub>L17781</sub>
+- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17794</sub>
+- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17823</sub>
+- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17842</sub>
+- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17860</sub>
+- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17861</sub>
+- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17916</sub>
+- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17930</sub>
+- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17942</sub>
+- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17943</sub>
+- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18013</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18041</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18073</sub>
+- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18094</sub>
+- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18102</sub>
+- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18119</sub>
+- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18157</sub>
+- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18207</sub>
+- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18282</sub>
+- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18319</sub>
+- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18341</sub>
+- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18342</sub>
+- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18406</sub>
+- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18423</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18490</sub>
+- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18528</sub>
+- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18562</sub>
+- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18633</sub>
+- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18663</sub>
+- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18727</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18788</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18828</sub>
+- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18887</sub>
+- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18914</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18931</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L18997</sub>
+- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19035</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19098</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19139</sub>
+- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19176</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19249</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19292</sub>
+- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19330</sub>
+- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19373</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19425</sub>
+- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19503</sub>
+- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19551</sub>
+- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19606</sub>
+- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19666</sub>
+- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19687</sub>
+- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19701</sub>
+- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19772</sub>
+- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19814</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19862</sub>
+- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19930</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L19988</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20040</sub>
+- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20088</sub>
+- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20135</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20200</sub>
+- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20244</sub>
+- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20296</sub>
+- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20343</sub>
+- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20392</sub>
+- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20439</sub>
+- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20485</sub>
+- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20540</sub>
+- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20554</sub>
+- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20592</sub>
+- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20620</sub>
+- **§197-REJECTED** — §197-REJECTED  <sub>L20665</sub>
+- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20680</sub>
+- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20691</sub>
+- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20740</sub>
+- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20785</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20833</sub>
+- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20893</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20952</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21006</sub>
+- **§199-REJECTED** — §199-REJECTED  <sub>L21061</sub>
+- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21072</sub>
+- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21121</sub>
+- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21131</sub>
+- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21163</sub>
+- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21243</sub>
+- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21294</sub>
+- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21341</sub>
+- **§201-REJECTED** — eight, the session's highest  <sub>L21397</sub>
+- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21422</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21459</sub>
+- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21520</sub>
+- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21539</sub>
+- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21614</sub>
+- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21678</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21736</sub>
+- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21811</sub>
+- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21863</sub>
+- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21957</sub>
+- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22030</sub>
+- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22085</sub>
+- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22154</sub>
+- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22175</sub>
+- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22224</sub>
+- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22301</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22347</sub>
+- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22395</sub>
+- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22440</sub>
+- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22476</sub>
+- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22522</sub>
+- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22578</sub>
+- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22618</sub>
+- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22644</sub>
+- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22673</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22700</sub>
+- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22734</sub>
+- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22750</sub>
+- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22792</sub>
+- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22854</sub>
+- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22890</sub>
+- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22933</sub>
+- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L22974</sub>
+- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L22994</sub>
+- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23031</sub>
+- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23080</sub>
+- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23095</sub>
+- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23136</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23172</sub>
+- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23192</sub>
+- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23198</sub>
+- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23204</sub>
+- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23213</sub>
+- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23222</sub>
+- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23228</sub>
+- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23272</sub>
+- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23313</sub>
+- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23342</sub>
+- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23421</sub>
+- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23476</sub>
+- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23516</sub>
+- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23550</sub>
+- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23579</sub>
+- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23608</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23636</sub>
+- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23666</sub>
+- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23701</sub>
+- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23748</sub>
+- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23788</sub>
+- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23822</sub>
+- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23846</sub>
+- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23888</sub>
+- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23925</sub>
+- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L23947</sub>
+- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23968</sub>
+- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L23982</sub>
+- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L23994</sub>
+- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24029</sub>
+- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24066</sub>
+- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24109</sub>
+- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24114</sub>
+- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24135</sub>
+- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24158</sub>
+- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24169</sub>
+- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24186</sub>
+- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24215</sub>
+- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24231</sub>
+- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24274</sub>
+- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24303</sub>
+- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24339</sub>
+- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24391</sub>
+- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24408</sub>
+- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24433</sub>
+- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24451</sub>
+- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24475</sub>
+- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24505</sub>
+- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24532</sub>
+- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24577</sub>
+- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24588</sub>
+- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24597</sub>
+- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24628</sub>
+- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24639</sub>
+- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24678</sub>
+- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24728</sub>
+- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24764</sub>
+- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24790</sub>
+- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24812</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24842</sub>
+- **§264** — FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59)  <sub>L24883</sub>
diff --git a/docs/matching-cookbook.md b/docs/matching-cookbook.md
index f98d682d4..23e7fd4f6 100644
--- a/docs/matching-cookbook.md
+++ b/docs/matching-cookbook.md
@@ -16572,6 +16572,16 @@ repeated operand expressions — that redundancy is load-bearing for byte-matchi
 
 ## §172b — THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask)
 
+**LANE ALIASES (grep bait — added P31 S59).** The atlas lever labels a drafting card carries
+(`tools/atlas.py`) do not appear anywhere else in this cookbook, so an agent that greps the label it
+was handed finds NOTHING: measured over the tells waves, **108 failure transcripts grepped
+`extend-tell` and 28 grepped `swaprepeat` against zero hits** while the knowledge sat here under
+different words. The map:
+`extend-tell` → **§172b-1** (+ the C recipes in §264) · `swaprepeat-tell` → **§172a** (macro-vs-inline
+repeats) + **§172b-2** · `s16-div-tell` → **§172b-4**. If you arrived by grepping a card label, this
+is your section.
+
+
 **1. The sll/sra-16 pair tell (extendhisi2 is MEM-only).** The single-insn sign-extending load
 (`extendhisi2_internal`) exists ONLY for memory operands. A visible `sll X,Y,16; sra X,X,16` pair
 in the target is therefore a promotion of a REGISTER-held short — a multi-def s16 variable (a
@@ -24869,3 +24879,50 @@ levers and twenty CPU-minutes went to a defect one deleted argument closed.
 function takes the struct pointer, or because a seed's sibling had it. `decl_prior` (the fleet
 declaration consensus on the card) answers this when the symbol is known fleet-wide — read it before
 inventing a signature.
+
+## §264 — FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59)
+
+The `extend-tell` / `swaprepeat-tell` / `s16-div-tell` population banks well below the default lane,
+and the measured cause is not the models: **the card names a lever that appears nowhere in this
+cookbook** (see the LANE ALIASES block at §172b) and the drafts stack 3-5 idioms. These four were
+proven this session by taking real failed wave drafts to `MATCH`; full derivations, transcripts and
+probe files in `docs/tool-designs/tells-lane-s59.md` and `.run/s59_tells/`.
+
+**1. The `(s16)` promotion belongs INLINE in the call argument** (`func_8017D8E8`, 33/33). Spelled
+inline, its `sra` lands in the `jal` delay slot; hoisting it into a temp kills that fill. Three
+companions in the same function: hold the table base in a *source pointer local* so it owns its
+`$sN` across calls (gcc-2.7.2 has no cross-bb CSE, L2425); index with `p[i]` so `(field<<3)+base`
+stays ONE association unit (writing `base + f8 + i2` lets fold re-associate the constant out); read
+an s16 field directly in the expression for a plain `lh`. The failing draft had pinned EIGHT
+registers to transcribe the asm 1:1 and plateaued at near-2 over 23 oracle calls — **pins are the
+last resort (§17), not the opening move; they block the parm-copy and arg-copy shapes.**
+
+**2. NEW LAW — a save-order-only residual is a bb0 anti-dependence** (`func_801808AC`, 67/67).
+Symptom: your prologue emits `sw $s1` before `sw $ra` where the target has `$ra` first, and nothing
+else differs. Saves are emitted descending-regno and woven at sched2, so an anti-dependence from a
+**basic-block-zero write of that `$sN`** promotes its store. Cure: move the first write of that
+variable out of bb0 and into a branch arm — `i = 0; if (…) goto found; i = 1;` becomes
+`if (…) i = 0; else if (…) i = 1; … else return;`. reorg then re-creates the target's
+`addu $s1,$zero` in the `beq` delay slot by thread fill.
+
+**3. NEW LAW — an opaque bound must live in a LOCAL, assigned LATE** (`func_80180E58`, 34/34).
+`if (v < 0x10000)` and `if (v <= 0xFFFF)` both canonicalize to `li 0xFFFF; slt(0xFFFF,v); bnez`.
+The target's `lui 0x10000; slt(v,K); beqz` — plus the arm's store REUSING that register — is only
+reachable with the bound in a local, and assigned **late**, so its live range starts after the block
+temps die (assigned at the top it takes `$a1`, not `$v1`). Two companions: use the PARAMETER as the
+multi-use variable (its expand-time parm copy survives exactly when `$aN` is re-used; a
+`self = arg0` local emits double moves), and name the inner term of a nested `a - (b - K)` as a temp
+or fold distributes it away.
+
+**4. §172b-1 made concrete — a naked `sll/sra` pair on a REGISTER is a branch-merged multi-def
+variable** (`func_8018A6A0`). Not a cast of a fresh load: mirror the memory slot with a variable
+written on BOTH paths (`vec0[1] = w = *s1;` at entry, `w = vec0[1] + …; vec0[1] = w;` in the loop)
+and compare `(s16)w` after the join. `(s16)vec0[1]` instead emits a fresh `lh` — store-forwarding
+cannot cross a two-predecessor label. This flipped the residual from structural to a 3-instruction
+commutative register tie, i.e. from an idiom problem to permuter fuel.
+
+**Two honest walls recorded so nobody re-spends them:** `func_801AE3A4`'s missing same-value copy is
+reachable by an `"0"(b)` re-tie but sits behind §172's +8-frame canonicalization wall; and the
+`swaprepeat` siblings `func_80187E08`/`func_80182FD0` already carry the right doubled-compare
+structure — their 2-10-instruction scratch permutation is the S11 knife-edge, permuter fuel, and one
+fix banks both by remap.
diff --git a/docs/tool-designs/tells-lane-s59.md b/docs/tool-designs/tells-lane-s59.md
new file mode 100644
index 000000000..f9cca060a
--- /dev/null
+++ b/docs/tool-designs/tells-lane-s59.md
@@ -0,0 +1,305 @@
+# Tells lane S59 — measured taxonomy, byte-proven idioms, and the path to 75%
+
+**Investigation date:** 2026-08-24 (P31 S59). All artifacts under `.run/s59_tells/` (inventory,
+re-run results, streams, gap scans, and every probe `.c`). Nothing in `tools/` or `src/` was
+edited; every change below is a proposal.
+
+**The one-line answer:** the tells lane is not failing on the tells. It is failing on (1) a
+**discovery gap** — the card vocabulary (`extend-tell`) has zero hits in the cookbook, so 650
+transcripts grepped and missed; (2) **stacked micro-idioms** — a tells function carries 3–5
+independent gcc-2.7.2 spelling laws, and missing any one reads as LENGTH-DRIFT; (3) **pipeline
+losses** — 26% of in-band failures are drafts that already shape-match and reloc-agree, lost at
+gate/integration, and another 12% are permuter-bucket residuals no permuter ever visits; and
+(4) **budget caps** — 36% of final attempts ended at the turn/cost cap, not at surrender.
+5–50 ins is cumulatively at 75% already; 50–80 needs only the pipeline fixes; 80+ is where the
+real wall is, and 75% there is NOT supported by current evidence.
+
+---
+
+## 1. Denominators (assert before believing any rate below)
+
+Completed tells-lane waves at analysis time: **ao, as, at, au, aw, az, bb, bd, bg, bi** (wave bk
+was in flight and is excluded; `at` was a mixed draw that also carried non-tell levers).
+Cards → `.run/wave_??_cards.json`; drafts → `.run/wave_??/shard*/`.
+
+| population | count |
+|---|---|
+| unique (binary,fn) carded across those 10 waves | 1,120 |
+| … of which carry a tell lever (extend 406 / swaprepeat 46 / s16-div 3) | 455 |
+| banked by now (INCLUDE_ASM gone from the card's TU, any wave/retry) | 730 |
+| still open | 390 |
+| still open **with a draft on disk** (newest per fn) | 270 (29,784 ins, median 91) |
+| still open with **no draft ever** (worker exhaustion; 43 UNKNOWN / 38 head-crack / 28 extend-tell) | 120 (10,437 ins) |
+| of the 270 re-run through `match_one --json`: | **near 216 · shape-MATCH 45 · toolfail 9** |
+
+Re-run harness: `.run/s59_tells/rerun.py` (12-way, `--work` private per binary). "Banked" was
+derived from the live tree (a campaign is banking concurrently, so a function open NOW definitely
+failed its waves; one banked later by another lane counts as banked — the right population for
+"what does the lane still need").
+
+## 2. The residual taxonomy, measured
+
+`tools/residual_class.py` verdicts over the 216 nears (count / instructions at stake):
+
+| klass | extend-tell | swaprepeat | s16-div | non-tell riders | share of nears |
+|---|---|---|---|---|---|
+| LENGTH-DRIFT | 105 / 12,901 | 11 / 1,577 | 1 / 110 | 23 / 3,465 | **65%** |
+| OPCODE-MIXED | 20 / 2,014 | 1 / 102 | — | 7 / 766 | 13% |
+| SIZE-MISMATCH (redraft: wrong body) | 5 / 511 | 2 / 292 | — | 4 / 505 | 5% |
+| SCHEDULE-REORDER | 6 / 496 | 1 / 76 | — | 3 / 225 | 5% |
+| WIDTH | 2 / 178 | 1 / 51 | — | 5 / 388 | 4% |
+| REGALLOC-PERM | 4 / 371 | 2 / 204 | — | — | 3% |
+| ADDRESSING | 5 / 559 | — | — | 1 / 45 | 3% |
+| other (REGALLOC-LOCAL, IMM-VALUE, BRANCH-POLARITY, DELAY-SLOT, STRENGTH) | 4 | 1 | — | 3 | 4% |
+
+Buckets: **permuter 21** (16 of them at closeness ≤ 8), **structural 184**, **redraft 11**.
+
+**LENGTH-DRIFT decomposed** (`.run/s59_tells/ld_scan.py`, greedy resync alignment over the
+`--emit-streams` word pairs, 140/140 scanned): gap mass ≤ 3 words: **31** · 4–8 words: **55** ·
+> 8 words: **54**. So under half of the dominant class is "one construct spelled wrong"; the rest
+are wrong *regions* — misread bodies, which no cookbook section fixes.
+
+**Construct-delta measurement** (170 tell-lever nears, draft-minus-target counts,
+`.run/s59_tells/analyze3.py`): drafts run SHORT (Σdlen −417; 78 short vs 46 long), with fewer
+`lh` (−79), fewer `sll` (−64), smaller frames (Σ −288 bytes, 39 drafts smaller vs 15 larger), and
+MORE nops (+60). **`d_extpair = 0` for 74% of failing extend-tell drafts** — the sll/sra pair
+count is usually already right. The standing mental model "tells drafts miss the extend pairs" is
+refuted; what they miss is *placement* (which side of a branch/jal, fold-vs-materialize) and the
+surrounding fold/alloc laws. The bodies are systematically too *clean*: the original source's
+redundancy (textual repeats, mirror variables, opaque bound locals) is load-bearing and the
+drafts don't write it.
+
+## 3. The discovery gap (why the cookbook isn't reaching the drafts)
+
+From the 796 transcripts behind still-open fns (`.run/s59_tells/mine_transcripts.py`):
+650 grepped the cookbook, 524 read sections — the harness works. But:
+
+- **`grep 'extend-tell'` — 108 times. `grep 'swaprepeat'` — 28 times. Both have ZERO hits** in
+  `docs/matching-cookbook.md` (verified). `s16-div-tell`: zero. `grep '172'`: **zero** attempts.
+- The knowledge exists at §172a (L16557) / §172b (L16573) under *different words*
+  ("sll/sra-16 pair tell", "swapped-arm select tell", "extendhisi2 is MEM-only") — invisible to a
+  model searching the only vocabulary it was given.
+- The card's entire statement of the lever is `tools/api_agent.py:384-385`:
+  `"The atlas labels this card's lever: extend-tell."` — no meaning, no §, no recipe.
+
+The agents' own submit notes (1,101 collected, 420 deduped, 274 non-MATCH,
+`.run/s59_tells/submit_notes.json` / `near_notes.json`) repeatedly *re-derive* §172b from the
+bytes ("target splits the counter's sign-extend as lhu; sll [delay slot]; sra; slt — every
+spelling I reached folds to lh", ov_SC02_005 func_8018A6A0) and then plateau without the recipe.
+
+## 4. Byte-proven idioms (each verified with `match_one` this session; probes in `.run/s59_tells/`)
+
+The whole-binary gate remains the arbiter — these are relocation-masked standalone MATCHes with
+the symbol walk done by hand against each target's own reloc lines (law 1c).
+
+### 4.1 `func_8017D8E8` (ov_SC03_108, 33 ins) — near-2 pin-transcription → **MATCH**
+Draft `.run/wave_bg/shard114/func_8017D8E8.c` pinned EIGHT registers (incl. caller-saved
+$2/$3/$4-$6) to transcribe the asm 1:1 and plateaued at near-2 over 23 oracle calls. Natural C
+matched (`.run/s59_tells/fix_8017D8E8.c`):
+```c
+void func_8017D8E8(s32 arg0) {
+    s32 i;  u16 *tbl;
+    for (i = 0, tbl = D_8018476C; i < 4; i++)
+        func_8012C658(0x199,
+            (s16)((i << 10) + *((u16 *)((*(s16 *)(arg0 + 0x70) << 3) + (s32)tbl) + i)),
+            arg0);
+}
+```
+Levers, in order of necessity: **(a)** the `(s16)` promotion spelled INLINE in the call argument —
+its `sra` lands in the jal delay slot (a temp kills this); **(b)** the table base as a *source
+pointer local* so it owns `$s2` across calls (cookbook L2425 rule 1 — gcc-2.7.2 has no cross-bb
+CSE); **(c)** `p[i]` indexing so `(field<<3)+base` stays one association unit (writing
+`base + f8 + i2` lets fold re-associate the constant out); **(d)** comma-init order `i` then
+`tbl`; **(e)** `lh` = read the s16 field directly in the expression (§172a).
+
+### 4.2 `func_801808AC` (ov_SC05_018, 67 ins) — prologue save-order swap → **MATCH**
+Draft `.run/wave_bg/shard117/…` plateaued at near-2: `sw $s1` emitted before `sw $ra` (target:
+$ra first). 43 match_one calls; its cookbook greps were "frame size", "delay slot|reorg" — wrong
+vocabulary. Root cause (sched.md S7 + `sched.c`): saves are emitted descending-regno and woven at
+sched2; an anti-dependence from a **bb0 write of $s1** promotes `sw $s1`. The draft's
+`i = 0; if (tbl == &A) goto found; i = 1; …` places `i = 0` in bb0. The else-if spelling moves
+every `i = K` into its own arm, bb0 stays clean, the fixed order survives:
+```c
+if (tbl == &D_801B3DC4) i = 0;
+else if (tbl == &D_801BBAB8) i = 1;
+else if (tbl == &D_801C29C4) i = 2;
+else if (tbl == &D_801CB724) i = 3;
+else return;
+```
+(`.run/s59_tells/fix_801808AC.c`, MATCH 67/67.) **General law, new to the cookbook:** a
+save-order-only residual ⇒ find which callee-saved reg is written in bb0 and move that first
+write into a branch arm (set-in-arm vs set-then-test). reorg then re-creates the target's
+`addu $s1,$zero` in the beq delay slot by thread fill.
+
+### 4.3 `func_80180E58` (ov_SC06_000, 34 ins) — LENGTH-DRIFT/−1 stack → **MATCH**
+Draft (near-20, pinned $5/$6/$7) vs natural C (`.run/s59_tells/fix_80180E58.c`):
+```c
+void func_80180E58(u8 *self) {                 /* (a) param IS the variable */
+    s32 amt = 0xFFFE4000;  u16 *p = (u16 *)&D_801274EA;
+    s32 lim; s32 t; s32 d; s32 v;
+    d = *(u16 *)(self + 0xA) - 0x300;          /* (b) fold-blocker temp     */
+    t = *p - d;
+    v = *(s32 *)(self + 0x204) + amt;
+    *(s32 *)(self + 0x204) = v;
+    lim = 0x10000;                             /* (c) opaque bound, late    */
+    if (v < lim) *(s32 *)(self + 0x204) = lim;
+    *p = *p - *(u16 *)(self + 0x206);
+    if ((s16)t < 0) { *(s32 *)(self + 0x200) = 0x1E; func_80171990(self); }
+}
+```
+**(a)** Use the *parameter* as the multi-use variable — its expand-time parm copy
+(`addu $a2,$a0`) survives exactly when `$a0` is re-used (here by `t` and the call's own arg
+copy); a separate `self = arg0` local emits double moves, and a `$6` pin blocks `t` from taking
+`$a0` and lets cse pass the raw param to the call (killing the target's `addu $a0,$a2` slot
+fill). **(b)** `a - (b - K)` gets distributed by fold; a named temp for the inner term keeps the
+target's `addiu −0x300; subu` shape. **(c)** `if (v < 0x10000)` and `if (v <= 0xFFFF)` BOTH
+canonicalize to `li 0xFFFF; slt(0xFFFF,v); bnez` — the target's `lui 0x10000; slt(v,K); beqz`
+plus the store *reusing the same register* is only reachable with the bound in a local; assign it
+LATE so its live range starts after the block temps die (assigned at the top it allocates $a1,
+not $v1). **(d)** `(s16)t < 0` emits `sll 16; bgez` (sra elided) for free.
+
+### 4.4 `func_8018A6A0` (ov_SC02_005, 76 ins) — §172b-1's C recipe made concrete
+Draft's compare `(vec0[1] << 15 << 1)` → structural STRENGTH/lhu!=sll. `(s16)vec0[1]` → a fresh
+`lh` (the compare sits after a two-predecessor label; store-forwarding cannot cross it). The
+target's naked `sll/sra` pair on a REGISTER is a **branch-merged multi-def variable** — §172b-1's
+"like `mw`", spelled:
+```c
+vec0[1] = w = *s1;              /* entry def */
+…
+w = vec0[1] + *(u16 *)(s1 + 2); /* loop def: lhu (real mem re-read) + addu */
+vec0[1] = w;
+check:
+if ((s16)w < *(s16 *)(s1 + 1)) goto body;   /* sll/sra of w after the join */
+```
+This flipped the residual from structural to REGALLOC-PERM/3 (a pure $v0/$v1 commutative-tie,
+`[permuter]` bucket) — the promotion bytes now exact. Six tie spellings probed
+(`.run/s59_tells/v_*.c`), all stable at 3: that last mile is permuter fuel, not an idiom.
+
+### 4.5 The honest walls met
+- `func_801AE3A4` (25 ins, LD/−1): the missing `addu $v1,$v0` is a same-value copy that plain
+  `b = a` cannot produce (cse deletes it; a `"0"(b)` re-tie materializes it — mechanism confirmed
+  — but the target's +8 frame slot is §172's documented three-layer canonicalization wall).
+  Left unsolved; routed to §172's instrument, not to more spelling probes.
+- `func_80187E08` / `func_80182FD0` (swaprepeat siblings, 102 ins): the doubled compare structure
+  (§172b-2) is already RIGHT in the drafts; the residual is a 2–10-ins scratch permutation that
+  flips between spellings (S11 knife-edge). Permuter fuel; one fix banks both via remap.
+
+## 5. Pipeline losses (free wins, no model change)
+
+1. **45 shape-MATCH drafts sit unbanked** (3,105 ins) — 34 of them also reloc-**AGREE**
+   (`.run/s59_tells/shape_matches.json`). 9 are on `main`/md_MAIN, where wave gating cannot bank
+   (gate_main is a separate, slate-level path). The remaining ~25 overlay fns died at the
+   whole-binary gate on TU plumbing. §173's measured recovery rate on exactly this class is 64%
+   (`aprop_symfix --fix` → `recover_integration --stages macro-externs,demacroize,tu-scope`).
+2. **21 permuter-bucket nears** (16 at closeness ≤ 8, 1,710 ins) — the lane never runs the
+   permuter. `residual_class` already routes them (`match_one --json` carries the verdict); a
+   zero-token post-wave permuter pass over `bucket=="permuter" && closeness<=8` drafts is the
+   designed use of `tools/permuter/`.
+3. **Budget caps bind**: of the 270 newest attempts, 98 ended at the turn cap and 12 at
+   cost/API stops (`submit`ted: 160). `tools/ox_campaign.py:264` pins every lane to
+   `--max-turns 24 --max-cost-per-fn 0.15`; tells cards are 2.4× default size (median 89–95 vs
+   37–39) and my three hand-cracks each took 5–10 oracle iterations WITH the right hypothesis
+   already in hand. Wave ao alone logged 562 truncated turns for 185 targets.
+4. **120 drawn cards never got a draft at all** (10,437 ins) — worker exhaustion in the 2,000-way
+   fan-out; they re-enter only via `--retry-unbanked`.
+
+## 6. Concrete changes (proposed; nothing landed)
+
+### 6.1 Cookbook — make the card vocabulary greppable (3 lines, highest ROI in this doc)
+At the §172b header (`docs/matching-cookbook.md:16573`) append an alias line, and mirror it in
+`docs/cookbook-index.md:1088`:
+
+> **Lane aliases (grep bait):** `extend-tell` = §172b-1 (+§4.1–4.4 recipes below), `swaprepeat-tell`
+> = §172a macro-vs-inline + §172b-2, `s16-div-tell` = §172b-4. Atlas lever labels from
+> `tools/atlas.py:441-445` — a drafter grepping the label must land here.
+
+Then add the four byte-proven laws of §4 above as proper cookbook sections (the save-order/bb0
+anti-dep law of 4.2 and the opaque-bound-local law of 4.3 are NEW; 4.1 and 4.4 sharpen §172b-1
+into C recipes). Per R30/bank-idioms-before-checkpoint, this belongs in the same session that
+lands the doc.
+
+### 6.2 `tools/api_agent.py` — put the crib ON the card (replace lines 384-385)
+```python
+LEVER_CRIB = {
+  'extend-tell': (
+    "extend-tell = §172b-1 (grep 'sll/sra-16 pair tell'). The target promotes REGISTER-held\n"
+    "s16 values. The four placements and their C spellings:\n"
+    "  * naked sll/sra pair = a MULTI-DEF s16/u16 variable merged across branches — write\n"
+    "    `w` assigned on BOTH paths (mirror the mem slot: `x[i] = w = …`), compare (s16)w;\n"
+    "  * plain lh = single promoted use — read the s16 mem DIRECTLY in the expression, no temp;\n"
+    "  * sll before a jal + sra IN its delay slot = the (s16) cast INLINE in the call argument;\n"
+    "  * lhu + separate sll/sra = the value is also used as u16 — keep the u16 variable.\n"
+    "Also: sign test (s16)t<0 emits sll+bgez only. NO register pins first (§17 is last resort):\n"
+    "pins block the parm-copy/arg-copy shapes. Param-as-variable: if a param is copied to $aN,\n"
+    "type the PARAMETER and use it everywhere; do not invent `self = arg0`.\n"),
+  'swaprepeat-tell': (
+    "swaprepeat-tell = §172a/§172b-2 (grep 'swapped-arm select tell'). Textual REPEATS are\n"
+    "load-bearing: a repeated compare/select re-emits its own slt+branch; write the repeat\n"
+    "TEXTUALLY (nested macros repeat operands; inline fns collapse — §172a). Range checks are\n"
+    "plain `if (-lim < x && x < lim)` — the 2nd slt rides the 1st beqz's delay slot free.\n"),
+  's16-div-tell': (
+    "s16-div-tell = §172b-4 (grep 'Division-by-constant sign-correction'). s16/K magic-multiply:\n"
+    "keep the promotion as an EXPRESSION (not a temp) so the sign-sra can reuse the <<16\n"
+    "intermediate; K's magic pairs are in §167-25 and the odd-part table.\n"),
+}
+if card.get('lever'):
+    out.append(f"\nThe atlas labels this card's lever: {card['lever']}.")
+    crib = LEVER_CRIB.get(card['lever'])
+    if crib:
+        out.append(crib)
+        out.append("Universal fold-blockers when a shape refuses: name the inner term of a\n"
+                   "nested +/- as a temp (keeps association); hold a non-slti constant bound in\n"
+                   "a LOCAL assigned right before its `if` (defeats the 0xFFFF canonicalization\n"
+                   "and lets the arm's store reuse its register); hold a global base in a\n"
+                   "pointer local when it must live in an $sN across calls (L2425).")
+```
+And one SYS line (after "THE LAWS THAT MATTER MOST", `api_agent.py:290-314`):
+`3. If your card names a lever, grep the cookbook for the § its crib cites BEFORE drafting; a
+plateaued diff whose class says [permuter] is DONE — submit NEAR with the class, do not spend
+ten more compiles on a 2-ins register swap.`
+
+### 6.3 `tools/build_wave_atlas.py:360` — attach the tell counts
+Join each card's member row to `.run/feat.<binary>.jsonl` (keyed by addr; already produced by
+`tools/atlas_features.py`) and attach
+`'tells': {'extpair': N, 'dupselect': N, 'magic_div': N, 'sign_lh': B, 'sign_lb': B}`;
+`_fuel` renders "expect N sll/sra pair sites / N repeated selects". Cost: one dict load per
+binary at build time.
+
+### 6.4 `tools/ox_campaign.py:264` — per-lane budgets
+The tells lane needs `--max-turns 40 --max-cost-per-fn 0.40` (cards are 2.4× bigger and stack
+3–5 idioms; 36% of failures ended at the caps). Make both per-lane fields in the lane spec
+(`tools/lanes/campaign.sh:33` syntax) rather than constants.
+
+### 6.5 Post-wave recovery (wave-closing step 2, per the standing 7-step sequence)
+- `bucket==permuter && closeness<=8` → `tools/permuter/` pass (zero tokens; 16 candidates now).
+- shape-MATCH + reloc-AGREE strays → §173 ladder; the 9 `main` ones go to the next gate_main
+  slate instead of dying in the wave path.
+- `.run/s59_tells/open_drafts.json` + `open_nodraft.json` are the current worklists.
+
+### 6.6 80+ band — stop drafting it wide
+Route extend-tell ≥ 80 ins through `tools/idiom_serial.py --lever extend-tell` (built for wall
+classes, never yet run on tells — its ledger holds only jtbl rows). Its distill step is the
+compounding channel the 2,000-way fan-out lacks, and `.run/idioms_learned.md` (currently absent)
+is where 4.1–4.4 should also land so the serial lane reads them.
+
+## 7. The 75% verdict, per band (cumulative bank of carded tell-lever fns, live tree)
+
+| band | banked now | verdict |
+|---|---|---|
+| 5–50 | 75/100 = **75%** | already there; retries converge without any change |
+| 50–80 | 83/144 = **58%** | **75% reachable** with §6 alone. 75% of 144 = 108 ⇒ 25 more banks needed from the 61 open (41% of failures). The measured ≤80 failure mix (26% shape-MATCH strays × 64% §173 recovery ≈ 17pp, 12% permuter-bucket × ~70% ≈ 8pp, ~22% one-construct LD × crib+budget ≈ 9–13pp, plus mid-gap partials) recovers ~35–45% of failures — 41% sits inside that band, tight but evidenced. No model upgrade required. |
+| 80–120 | 34/118 = 29% | 45–55% plausible (crib + budgets + permuter + recovery); **75% not evidenced** — the LD gap-mass shifts to multi-region misreads (54/140 > 8 words) |
+| 120+ | 26/93 = 28% | wide drafting is the wrong tool; serial lane + remap or park. 75% out of reach at current drafter tier |
+
+Instruction-weighted honesty: the lane's 86,602 ins sit mostly ABOVE 80 ins (atlas means: extend
+76,972/1,010 ≈ 76, but the open residue skews large — the 390 still-open average 103). So "the
+lane at 75%" is true only as a ≤80-ins statement; the *instruction* frontier of this population
+is a serial-learning problem, not a wave-tuning problem. The three cracked exemplars each carried
+3–5 stacked laws; that stacking is the honest reason tells collapse above 80: p(all-k-idioms)
+falls geometrically, and only a compounding lane (or the §6.1 cribs raising per-idiom hit rate)
+bends it.
+
+**Refuted along the way** (do not re-spend): §235 symbol-identity as the tells failure mode
+(body-wrong confirmed: only 6/66–5/47 shape-matches among MISMATCH?); "drafts miss the extend
+pairs" (74% have exact pair counts); "the models don't use the cookbook" (650/796 grepped — with
+the wrong words).
diff --git a/tools/api_agent.py b/tools/api_agent.py
index 40ae865e7..53ad9d2ad 100644
--- a/tools/api_agent.py
+++ b/tools/api_agent.py
@@ -310,11 +310,50 @@ THE LAWS THAT MATTER MOST:
    A draft that calls the WRONG function reports a clean MATCH. After MATCH, walk the .s once more
    and check every symbol you wrote against its own relocation lines.
 2. A seed or twin gives you the SHAPE, never the symbols, and never the literals. Re-read both.
+3. IF YOUR CARD NAMES A LEVER, grep the cookbook for the § its crib cites BEFORE you draft. And a
+   plateaued diff whose class says [permuter] is DONE: submit NEAR with the class rather than
+   spending ten more compiles on a 2-instruction register swap the search cannot reach from C.
+4. AN ARGUMENT YOU INVENTED CHANGES SCHEDULING (§263). If your only residual is one stolen delay
+   slot holding a `move $aN,$sN`, you gave a no-argument callee a parameter — check its arity
+   against decl_prior before touching a fence or the permuter, which cannot change call arity.
 
 Work until match_one says MATCH, or until you have genuinely exhausted your levers -- then submit
 with an honest status and say what the cookbook did NOT already tell you."""
 
 
+# THE LEVER CRIB (P31 S59). The card used to state its lever as a bare label and nothing else, and
+# the label is a word this project's 750-section cookbook DOES NOT CONTAIN: measured over the tells
+# waves, 108 failure transcripts grepped `extend-tell` and 28 grepped `swaprepeat` for zero hits
+# while the knowledge sat at §172a/§172b/§264 under different words. A label the drafter cannot look
+# up is not fuel; it is a dead end that costs a grep and buys nothing. Each entry below states what
+# the tell MEANS, names the § to grep, and gives the C spellings — all byte-proven (§264).
+LEVER_CRIB = {
+    'extend-tell': (
+        "extend-tell = §172b-1 + §264 (grep 'sll/sra-16 pair tell'). The target promotes\n"
+        "REGISTER-held s16 values. Four placements, four C spellings:\n"
+        "  * naked sll/sra pair  = a MULTI-DEF s16/u16 variable merged across branches — write it\n"
+        "    on BOTH paths mirroring the mem slot (`x[i] = w = ...`), then compare (s16)w;\n"
+        "  * plain lh            = one promoted use — read the s16 memory DIRECTLY, no temp;\n"
+        "  * sll before a jal, sra IN its delay slot = the (s16) cast written INLINE in the call\n"
+        "    argument (a temp kills the delay-slot fill);\n"
+        "  * lhu + separate sll/sra = the value is ALSO used as u16 — keep the u16 variable.\n"
+        "Sign test (s16)t < 0 emits sll+bgez only (the sra is elided).\n"
+        "NO register pins first — §17 is the last resort; pins block the parm-copy and arg-copy\n"
+        "shapes. If a parameter is copied to $aN, type the PARAMETER and use it everywhere rather\n"
+        "than inventing `self = arg0`.\n"),
+    'swaprepeat-tell': (
+        "swaprepeat-tell = §172a + §172b-2 (grep 'swapped-arm select tell'). Textual REPEATS are\n"
+        "load-bearing: a repeated compare/select re-emits its own slt+branch, so write the repeat\n"
+        "TEXTUALLY — nested macros repeat their operands, inline functions collapse them.\n"
+        "A range check is plain `if (-lim < x && x < lim)`; the second slt rides the first beqz's\n"
+        "delay slot for free.\n"),
+    's16-div-tell': (
+        "s16-div-tell = §172b-4 (grep 'Division-by-constant sign-correction'). For s16/K magic\n"
+        "multiplies keep the promotion as an EXPRESSION, never a temp, so the sign-sra can reuse\n"
+        "the <<16 intermediate; the magic pairs for K are in §167-25 and the odd-part table.\n"),
+}
+
+
 def _fuel(t, card):
     """THE CARD FUEL, in the wave's own proven wording (P31 S56).
 
@@ -383,6 +422,14 @@ def _fuel(t, card):
         out.append( "WORTH, not where an answer is.")
     if card.get('lever'):
         out.append(f"\nThe atlas labels this card's lever: {card['lever']}.")
+        crib = LEVER_CRIB.get(card['lever'])
+        if crib:
+            out.append(crib)
+            out.append("Universal fold-blockers when a shape refuses: name the inner term of a "
+                       "nested +/- as a temp (keeps association); hold a non-slti constant bound "
+                       "in a LOCAL assigned right before its `if` (defeats the 0xFFFF "
+                       "canonicalization and lets the arm's store reuse its register); hold a "
+                       "global base in a pointer local when it must live in an $sN across calls.")
     return '\n'.join(out)
 
 
diff --git a/tools/ox_campaign.py b/tools/ox_campaign.py
index d713ffb76..8f868d841 100644
--- a/tools/ox_campaign.py
+++ b/tools/ox_campaign.py
@@ -187,7 +187,17 @@ def shard_targets(tag, cards_path, workers):
     return targets
 
 
-def draft(tag, lanes, maxtok, max_turns, ramp_seconds=float(os.environ.get('RAMP_SECONDS', '240'))):
+# PER-LANE AGENT BUDGETS (P31 S59, measured). The turn/cost caps were one global pair, and the
+# tells lane's cards are 2.4x the default lane's size (median 89-95 instructions vs 37-39) and stack
+# 3-5 idioms each: 98 of 270 final tells attempts ended AT the turn cap and 36% of failures ended at
+# a cap of some kind — i.e. they ran out of budget mid-work rather than failing. A budget that fits
+# a 38-instruction card starves a 95-instruction one. {lane: (max_turns, max_cost_per_fn)}.
+LANE_BUDGET = {'tells': (40, 0.40)}
+LANE_BUDGET_DEFAULT = (None, 0.15)          # None = the campaign's --max-turns
+
+
+def draft(tag, lanes, maxtok, max_turns, ramp_seconds=float(os.environ.get('RAMP_SECONDS', '240')),
+          wave_lane=None):
     """Draft one wave across SEVERAL MODEL LANES at once.
 
     Concurrency on ONE model is spent (P31 S58, measured): every 429 we have ever recorded is
@@ -200,6 +210,11 @@ def draft(tag, lanes, maxtok, max_turns, ramp_seconds=float(os.environ.get('RAMP
     owns a known slice, and every request already carries its model in the telemetry — so the
     per-lane 429 rate is measurable after the fact instead of assumed.
     """
+    _t, _cost = LANE_BUDGET.get(wave_lane or '', LANE_BUDGET_DEFAULT)
+    _turns = _t if _t is not None else max_turns
+    if _t is not None:
+        log(f"  lane {wave_lane}: budget {_turns} turns / ${_cost:.2f} per function "
+            f"(default {max_turns}/$0.15)")
     outdir = f".run/wave_{tag}"
     shutil.rmtree(outdir, ignore_errors=True)
     os.makedirs(outdir, exist_ok=True)
@@ -261,7 +276,7 @@ def draft(tag, lanes, maxtok, max_turns, ramp_seconds=float(os.environ.get('RAMP
         procs.append(subprocess.Popen(
             [PY, "-u", "tools/api_agent.py", "--targets", tf, "--cards",
              f".run/wave_{tag}_cards.json", "--out", f"{outdir}/shard{idx}",
-             "--max-turns", str(max_turns), "--max-cost", "1.0", "--max-cost-per-fn", "0.15"],
+             "--max-turns", str(_turns), "--max-cost", "1.0", "--max-cost-per-fn", str(_cost)],
             stdout=fh, stderr=subprocess.STDOUT, env=env))
         started[model] += 1
         # STAGGER THE LAUNCH. Every shard issues its first request immediately, so starting N at
@@ -615,7 +630,8 @@ def run_drafter(a):
             log(f"  {tag}: draw failed — retrying next cycle"); time.sleep(30); continue
         targets = shard_targets(tag, cards, a.workers)
         t0 = time.time()
-        procs = draft(tag, parse_lanes(a.models, a.model, a.workers), a.maxtok, a.max_turns)
+        procs = draft(tag, parse_lanes(a.models, a.model, a.workers), a.maxtok, a.max_turns,
+                      wave_lane=lane['name'])
 
         # PRE-DRAW THE NEXT WAVE **AFTER** THE SHARDS ARE RUNNING, never before. Drawing takes
         # minutes of CPU (build_wave_atlas over the whole atlas), and doing it between the draw and
@@ -806,7 +822,8 @@ def main():
                 log("  draw failed — skipping wave"); continue
             targets = shard_targets(tag, cards, workers)
             log(f"  {len(targets)} targets sharded")
-            procs = draft(tag, parse_lanes(a.models, a.model, workers), a.maxtok, a.max_turns)
+            procs = draft(tag, parse_lanes(a.models, a.model, workers), a.maxtok, a.max_turns,
+                          wave_lane=lane['name'])
             inflight = (tag, cards, targets, procs, time.time())
 
         tag, cards, targets, procs, t0 = inflight
@@ -824,7 +841,8 @@ def main():
             ncards = draw_wave(ntag, a.cards_per_wave, nband, nlane.get("levers"))
             if ncards:
                 ntargets = shard_targets(ntag, ncards, workers)
-                nprocs = draft(ntag, parse_lanes(a.models, a.model, workers), a.maxtok, a.max_turns)
+                nprocs = draft(ntag, parse_lanes(a.models, a.model, workers), a.maxtok, a.max_turns,
+                               wave_lane=nlane['name'])
                 inflight = (ntag, ncards, ntargets, nprocs, time.time())
             else:
                 log(f"  wave {ntag}: draw failed — next cycle will redraw")