feat(phase-29 Task-13B): directed permuter wins first try; 3 latent gate defects fixed at root

First run of the Task-13A-targeted grinder (--once --batch 8 --permute-secs 90):
  targeting: ON — 1665 classified; only bucket=permuter is admitted
  targeting skipped 1601 non-permuter candidates
    {redraft 707, structural 583, integration 305, unclassified 4, unknown 2}
  permuter WON func_80181F78 @ ov_SC03_014 (close was 1)   [~6 min]

BANKED 2 (both whole-binary byte-gated, R22 clean-fleet 140/140):
- func_80181F78 (8 ins)  — classified DELAY-SLOT / schedule
- func_80141B90 (29 ins) — classified IMM-VALUE / cse
Both were classified bucket=permuter by residual_class BEFORE the run: the classifier
predicted a search-closer could reach them, and one did. First end-to-end validation of
the targeting thesis.

THREE latent defects, all pre-existing, all unreachable while the grinder banked nothing
since Phase 21 — the fix made it win and every one fired at once (cookbook §60a):

1. gate_stage commit path crashed on src=None. `src` is DELIBERATELY never defaulted
   (Phase 26-A: a default silently PINS the gate to the main .c), but the commit did
   `git add src …` unconditionally -> every caller that omits it (grinder, orchestrator,
   idiom_hunt) crashes THE MOMENT IT BANKS. Now `git add -u src/`, which also retires the
   `src/ov_*/*.c` filename glob that once omitted 4 R22-verified banks from a commit.
2. _xform ladder dirs (-cn/-cast/-rc/-uni) ACCUMULATE across runs: they held 34 stale
   drafts, so the gate processed 34 when the grinder submitted 1, and banked one function
   it was never asked to try — which would have been committed under a message naming a
   different one. Nothing wrong entered the tree (G3/P9 held; the gate banks only
   byte-identical output) but report and work had diverged. Now cleared per run.
3. grinder called gate_stage with the default propagate=True = `dedup_propagate
   --auto-from`, the §55b fleet-wide path that timed out at 3600s and left 90/140 overlays
   broken — and being INSIDE the gate it takes the banks down with it. Now propagate=False;
   banks commit cheap, propagation is its own targeted --addr batch (§55b law).

R22: make clean && extract-all && check-all -> 140 passed, 0 failed of 140.
tools-health OK (dedup 1847/0, C1 234343/234343); 0 NON_MATCHING (G4).

docs/matching-cookbook.md

@@ -4447,3 +4447,35 @@ process died with a traceback instead of a verdict: **14 of 1,752 drafts lost in
 — and every parallel wave has paid it invisibly, because a drafter that crashes on its self-check merely
 looks like a drafter that failed. Now per-PID. Same defect class, one level down, as the Phase-28
 `match_one --work` shared scratch whose docstring promised the isolation its default contradicted.
+
+### §60a — What the first DIRECTED grinder run exposed (Phase 29 Task-13B, 2026-07-21)
+
+Turning the targeting on and running the grinder bounded (`--once --batch 8 --permute-secs 90`) produced a win
+on the FIRST candidate — `func_80181F78`, close=1, classified `DELAY-SLOT`/schedule, banked in ~6 min — and
+then immediately surfaced three latent defects that had been unreachable **because the daemon had not banked
+anything since Phase 21**. All three are the same shape: a step whose REPORT and whose WORK had quietly
+diverged.
+
+1. **`gate_stage`'s commit path crashed on `src=None`.** `src` is deliberately never defaulted (the Phase 26-A
+   audit: a default would silently PIN the gate to the main `.c`), but the commit did `git add src …`
+   unconditionally. So every caller that omits `src` — grinder, orchestrator, idiom_hunt — crashes
+   **the moment it banks**. Fix: `git add -u src/` (every modified tracked file under src/), which also
+   retires the `src/ov_*/*.c` filename glob that once omitted 4 R22-verified banks from a commit because a
+   family's members do not all live in the same-named split.
+2. **The `_xform` ladder dirs accumulate.** `<drafts>-cn/-cast/-rc/-uni` are reused across runs and the
+   transform tools only write the drafts they are handed, so every stale draft from every previous run
+   survives and is re-submitted to the byte-gate. Measured: the grinder submitted **1** draft, the gate
+   processed **34** and banked **2**. Nothing wrong entered the tree (G3/P9: the gate banks only
+   byte-identical output) — but a run banked a function it was never asked to try, and would have committed
+   it under a message naming a different one. Fix: clear the out dir per run. Note the symmetry with R32: a
+   scanner that silently NARROWS its input hides work; a stage that silently WIDENS it fabricates provenance.
+3. **The grinder fired the fleet-wide propagate from inside the gate.** `gate_stage(propagate=True)` runs
+   `dedup_propagate --auto-from` — the §55b path that timed out at 3600 s and left 90/140 overlays broken,
+   and which, being *inside* the gate, takes the banks down with it when it fails. The unattended caller must
+   never fire it: bank with `propagate=False`, commit the cheap verified banks, then run ONE targeted
+   `dedup_propagate --addr` as its own batch.
+
+**The transferable point:** a tool that has been failing for a long time accretes latent bugs on its success
+path, because nothing exercises it. Before trusting an unattended fix-and-run, budget for the first success
+to fail — and check the tree state, not the exit code (here the durable Task-12 winner save in
+`.run/permuter-winners/` is what made the crash a non-event).

docs/progress.fleet.md

@@ -4,15 +4,15 @@
 # cross-binary collapsible-byte leverage: docs/duplicates.cross.md.
 
 # THREE progress metrics (all matter — see the labels):
-FLEET fn-count byte-ident: 310917 / 353722 = 87.90%   (REAL+LINKED+empties; FUNCTION-count, ×134-inflated — one crack counts per overlay)
-FLEET instr-weighted     : 10203439 / 13081451 = 78.0%   (shipped .text across resident+138 overlays; the decomp.dev-DISPLAY number)
-FLEET distinct-code(uniq): 3708744 / 5574674 = 66.5%   (64085/87459 unique fns; the DISTINCT-RE number)
+FLEET fn-count byte-ident: 310919 / 353722 = 87.90%   (REAL+LINKED+empties; FUNCTION-count, ×134-inflated — one crack counts per overlay)
+FLEET instr-weighted     : 10203476 / 13081451 = 78.0%   (shipped .text across resident+138 overlays; the decomp.dev-DISPLAY number)
+FLEET distinct-code(uniq): 3708773 / 5574674 = 66.5%   (64086/87459 unique fns; the DISTINCT-RE number)
 MAIN game-code weighted  :     436 / 60201 = 0.7%   (Phase-27 T10; SEPARATE — LINKED-excluding Ghidra sig dated 2026-06-14, PROVISIONAL until a fresh/complete main sig; NOT folded into the fleet number)
 
-FLEET REAL substantive   : 309062   (of which dedup-shared 234299 via 1847 groups / 234343 instances)
+FLEET REAL substantive   : 309064   (of which dedup-shared 234299 via 1847 groups / 234343 instances)
 FLEET LINKED PsyQ objs   :    959
 FLEET NON_MATCHING       :      7   (0 in any default build — G4)
-FLEET INCLUDE_ASM stubs  :  42798
+FLEET INCLUDE_ASM stubs  :  42796
 FLEET matchable          : 353722
 
 | binary | REAL | shared | LINKED | byte-ident | matchable | byte-ident % |
@@ -55,7 +55,7 @@ FLEET matchable          : 353722
 | ov_SC03_011 | 2236 | 1700 | 0 | 2242 | 2527 | 88.7% |
 | ov_SC03_012 | 2214 | 1700 | 0 | 2215 | 2406 | 92.1% |
 | ov_SC03_013 | 2233 | 1700 | 0 | 2233 | 2492 | 89.6% |
-| ov_SC03_014 | 2291 | 1725 | 0 | 2291 | 2685 | 85.3% |
+| ov_SC03_014 | 2293 | 1725 | 0 | 2293 | 2685 | 85.4% |
 | ov_SC03_015 | 2292 | 1725 | 0 | 2292 | 2685 | 85.4% |
 | ov_SC03_023 | 2220 | 1700 | 0 | 2221 | 2435 | 91.2% |
 | ov_SC03_024 | 2278 | 1705 | 0 | 2285 | 2641 | 86.5% |