feat(phase-29): func_8014CD80 x138 — the fresh-138 def-side blocker is RECOVERABLE (R35 reversal)

Bounded probe (SESSION-13, token-free) that REVERSED the same-session "fresh
reach-138 well is spent" verdict. Target func_8014CD80: 138 live, 0 matched, NO
DEFINE macro, a universal body (only universal callees + param offsets, zero
overlay-local D_* refs), clean MATCH draft from batch-1.

- Blocker was a def-side header decl: engine_core.h DEFINE_func_8014CD0C()
  forward-declares it `void func_8014CD80(s32,void*,void*)` while the byte-true
  def is `int func_8014CD80(s32,u16*,u16*)`. gate_stage's arity pre-pass is
  param-COUNT-only (misses return/ptr-type); §54 reconcile_def_sig fixes the
  wrong direction.
- One byte-neutral header edit (void->int, void*->u16*; call site passes u16[3]
  arrays + ignores the return -> codegen unchanged) -> harvest_verify banked x1
  BYTE-IDENTICAL -> dedup_propagate --addr propagated 138/138 overlays
  byte-identical (live 138->0) -> R22 clean-fleet 140/140.
- Fleet 78.7->78.8% instr, 88.22->88.26% fn-count from this one family;
  tools-health green (dedup 1851/0).

Quantified market (decision-log 2026-07-23): of the 75 fresh (>=100-live)
families, 46 carry an engine_core.h caller forward-decl, 38 SIMPLIFIED = the
func_8014CD80 pattern -> each a candidate x138 (~+1.5-2.8pp instr). NEXT: build
tools/fix_header_decl.py + a fresh-family wave. func_80165CA0's 0/135 was a
non-universal BODY (different failure mode), not this blocker.

src/shared/engine_core.h

@@ -8963,7 +8963,7 @@
 
 #define DEFINE_func_8014CD0C() \
     extern void func_8014CF04(s32 a0, void *a1, void *a2); \
-    extern void func_8014CD80(s32 a0, void *a1, void *a2); \
+    extern int func_8014CD80(s32 a0, u16 *a1, u16 *a2); \
     void func_8014CD0C(u8 *a0) { \
         u16 sp10[3]; \
         u16 sp18[3]; \
@@ -28082,4 +28082,58 @@
         } while (i < 0x1e); \
     }
 
+#define DEFINE_func_8014CD80() \
+    extern int func_80135A4C(); \
+    extern int func_80135888(); \
+    extern int func_8014C918(); \
+    int func_8014CD80(int param_1, unsigned short *param_2, unsigned short *param_3) \
+    { \
+        short *psVar4; \
+        register int iVar3 __asm__("$3"); \
+        unsigned short uVar1; \
+        unsigned short uVar2; \
+        psVar4 = *(short **)(param_1 + 0x174); \
+        if (*(unsigned short *)psVar4 == 0) goto LAB_ce00; \
+        if (((*(unsigned short *)((int)psVar4 + 0x5c) & 0x400) == 0) || \
+            (*(int *)((int)psVar4 + 0x58) == 0) || \
+            (*(short *)((int)psVar4 + 0xa) < *(short *)(param_1 + 0xa))) { \
+            if (*(unsigned short *)psVar4 != 0) { \
+                *(char *)((int)psVar4 + 0x74) = 0; \
+            } \
+    LAB_ce00: \
+            *(int *)(param_1 + 0x174) = 0; \
+            return 0; \
+        } \
+        *param_2 = *(unsigned short *)(param_1 + 0x98); \
+        param_2[1] = *(unsigned short *)(param_1 + 0x9a) - 3; \
+        param_2[2] = *(unsigned short *)(param_1 + 0x9c); \
+        if ((*(unsigned short *)((int)psVar4 + 0x5c) & 8) != 0) { \
+            param_3[1] = param_2[1] + 0xc; \
+            iVar3 = func_80135A4C(*(int *)((int)psVar4 + 0x20), \
+                                  *(int *)((int)psVar4 + 0x58), param_2, param_3); \
+            if (iVar3 == 0) goto LAB_cec4; \
+            uVar1 = param_3[0]; \
+            *(unsigned short *)(param_1 + 0x78) = uVar1; \
+            *(unsigned short *)(param_1 + 6) = uVar1; \
+            uVar1 = param_3[1]; \
+            *(unsigned short *)(param_1 + 0x7a) = uVar1; \
+            *(unsigned short *)(param_1 + 0xa) = uVar1; \
+            uVar1 = param_3[2]; \
+            *(unsigned short *)(param_1 + 0x7c) = uVar1; \
+            *(unsigned short *)(param_1 + 0xe) = uVar1; \
+        } else { \
+            iVar3 = func_80135888(*(int *)((int)psVar4 + 0x20), \
+                                  *(int *)((int)psVar4 + 0x58), param_2, param_3); \
+        } \
+        if (iVar3 != 0) goto LAB_ced0; \
+    LAB_cec4: \
+        *(char *)((int)psVar4 + 0x74) = 0; \
+        *(int *)(param_1 + 0x174) = 0; \
+        return 0; \
+    LAB_ced0: \
+        uVar2 = func_8014C918(param_1, *(unsigned char *)((int)psVar4 + 0x75)) & 0xff; \
+        *(unsigned short *)(param_1 + 0x16e) = uVar2; \
+        return 1; \
+    }
+
 #endif