diff --git a/docs/cookbook-index.md b/docs/cookbook-index.md
index 2b4eb32ed..3244c83e8 100644
--- a/docs/cookbook-index.md
+++ b/docs/cookbook-index.md
@@ -2,7 +2,7 @@
 
 > **Generated by `tools/cookbook_index.py` — do not hand-edit** (R33). Regenerate after adding a cookbook section.
 >
-> `docs/matching-cookbook.md` is ~716 KB / 919 sections. Grepping it blind is how three P30 wave-1 agents each "discovered" an idiom that was already written down. **Start here, then read the section.** A section appears under every symptom it addresses.
+> `docs/matching-cookbook.md` is ~716 KB / 920 sections. Grepping it blind is how three P30 wave-1 agents each "discovered" an idiom that was already written down. **Start here, then read the section.** A section appears under every symptom it addresses.
 
 **How to use:** name what you SEE in the diff (a stolen delay slot, an extra `la`, a swapped register pair, a `conflicting types` error), find that symptom below, read those sections first. If nothing fits, THEN grind — and add a section when you win.
 
@@ -38,56 +38,56 @@
 
 - **§3-T4** — Branch polarity: invert the source condition to flip gcc's chosen branch  <sub>L90</sub>
 - **§5a** — Cross-jump tail-merge — gcc collapses two byte-identical blocks the original kept separate (FIX FOUND)  <sub>L211</sub>
-- **§3-D.** — THE CROSS-JUMP RATCHET (the sharpest new trap — `func_80131340` L-C)  <sub>L3508</sub>
-- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10068</sub>
-- **§162** — CROSS-JUMP DIRECTION: the surviving copy is always the LATER one, so a BACKWARD `j` into a sibling arm is a source `goto` (P30 S48)  <sub>L11266</sub>
-- **§162** — The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_80189540`)  <sub>L11302</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17182</sub>
-- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17639</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18092</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19311</sub>
-- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19570</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19884</sub>
-- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19952</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20010</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20062</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20222</sub>
-- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20419</sub>
-- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20619</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20979</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21033</sub>
-- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21270</sub>
-- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21566</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22374</sub>
-- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22778</sub>
-- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22836</sub>
-- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22898</sub>
-- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23180</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23680</sub>
-- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23832</sub>
-- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24519</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24886</sub>
-- **ADD-4** — → §225-3/-4 addendum — THE MIRROR ROW: VALUE-RETURN IN THE *TAKEN* ARM + TRAILING BARE `return 0`  <sub>L25118</sub>
-- **ADD-5** — → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TRAILING `else`  <sub>L25132</sub>
-- **ADD-5** — → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON THE SHIFTED COPY, RAW STAYS LIVE — AND THE HALFWORD-ABS SHAPE NEEDS NO RITUAL  <sub>L25370</sub>
-- **ADDENDUM** — to §224 — CROSS-JUMP: THE DUPLICATE CAN BE A PLAIN STORE, NOT ONLY A CALL  <sub>L25963</sub>
-- **ADDENDUM** — to §172a — RE-READING MEMORY (NOT NAMING A TEMP) IS WHAT KEEPS AN INCREMENT'S DELAY-SLOT FILL ALIVE  <sub>L26263</sub>
-- **ADDENDUM** — to §225 / §256 — A GOTO TO A SHARED SET-POINT PREVENTS IF-CONVERSION FROM COLLAPSING A LATER BRANCH TEST  <sub>L26294</sub>
-- **§277** — RETURN-TAIL C SPELLING PICKS THE DELAY-SLOT-FILL vs TRAILING-MOVE TOPOLOGY, AND A NARROWER SECOND VARIABLE KEEPS TWO PSEUDOS INSTEAD OF ONE (P31 S60; `func_801846F0` ov_SC03_104, `func_801A44C4` md_SC07_004, both byte-proven)  <sub>L26520</sub>
-- **ADDENDUM** — to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, same-address double RMW, a plain memory clobber beats `volatile`, and `volatile` actively breaks a delay-slot fill  <sub>L27185</sub>
-- **ADDENDUM** — to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SAVED SPILL LAND IN THE FIRST CALL'S OWN DELAY SLOT  <sub>L27439</sub>
-- **ADDENDUM** — to §252 — a `>=0`/`<0` split on an unconditionally-decremented value needs the POSTFIX operator INSIDE the branch condition, not a prior statement  <sub>L27497</sub>
-- **ADDENDUM** — to §20's cross-jump EXPLOIT bullet (func_8017E360, ov_SC05_007 — wave dg)  <sub>L27791</sub>
-- **ADDENDUM** — §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE A SWITCH DISPATCH CAN BE PLAIN NESTED `if`s WHOSE SHARED BODY WAS TRIPLICATED BY THE SOURCE AND THEN CROSS-JUMP-MERGED BACK DOWN  <sub>L28182</sub>
-- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29037</sub>
-- **§286** — FOLD A STATEMENT'S SIDE EFFECT INTO A COMMA-EXPRESSION IN AN ARGUMENT POSITION TO PLACE ITS RTL RELATIVE TO A CALL'S OWN DELAY SLOT (P31 S60/dj; `func_80180A88`, ov_SC06_010, byte-proven 411/411) (P31 S60; waves #, byte-proven)  <sub>L29041</sub>
-- **§291** — THE DELAY-SLOT FALSE-VALUE: A CONDITIONAL BRANCH'S ZERO ARM MUST BE A FALL-THROUGH-ADJACENT BLOCK ENDING IN AN EXPLICIT JUMP, OR REORG CANNOT MATERIALIZE IT INSIDE THE BRANCH'S OWN DELAY SLOT (P31 S60; waves #, byte-proven)  <sub>L29061</sub>
-- **ADDENDUM** — to §253 — SECOND byte-proven card (upgrade from single-observation), and the placement face: postfix-in-condition parks the RMW store in the branch delay slot  <sub>L29295</sub>
-- **§306** — A HAZARD `nop` IN FRONT OF A DIV-RESULT STORE IS A STATEMENT-ORDER DEFECT: THE INDEPENDENT TRAILING STATEMENT MUST BE WRITTEN *BEFORE* THE DIVISION-CONSUMING ONE (P31 S62 T4; byte-proven func_8017E7D0)  <sub>L29833</sub>
-- **§308** — A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if` SO cse FOLDS IT TO AN UNCONDITIONAL JUMP *AFTER* jump1's WINDOW HAS CLOSED (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29942</sub>
-- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29971</sub>
-- **§309** — A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD ONTO `$sp` UNLESS THE `if` SURVIVES jump1 AS A BARRIER-PRECEDED DIAMOND (P31 S63 t5e-t5i; byte-proven func_801812AC)  <sub>L30005</sub>
-- **§311** — A JOIN-BLOCK STORE CAN SWALLOW AN ARM'S LOAD-DELAY `nop`: WHEN ONE ARM'S VALUE COMES FROM A LOAD, DUPLICATE THE STORE INTO BOTH ARMS (P31 S64 t5j-t5m; byte-proven func_8017D7E0)  <sub>L30076</sub>
+- **§3-D.** — THE CROSS-JUMP RATCHET (the sharpest new trap — `func_80131340` L-C)  <sub>L3523</sub>
+- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10083</sub>
+- **§162** — CROSS-JUMP DIRECTION: the surviving copy is always the LATER one, so a BACKWARD `j` into a sibling arm is a source `goto` (P30 S48)  <sub>L11281</sub>
+- **§162** — The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_80189540`)  <sub>L11317</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17197</sub>
+- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17654</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18107</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19326</sub>
+- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19585</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19899</sub>
+- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19967</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20025</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20077</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20237</sub>
+- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20434</sub>
+- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20634</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20994</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21048</sub>
+- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21285</sub>
+- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21581</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22389</sub>
+- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22793</sub>
+- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22851</sub>
+- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22913</sub>
+- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23195</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23695</sub>
+- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23847</sub>
+- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24534</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24901</sub>
+- **ADD-4** — → §225-3/-4 addendum — THE MIRROR ROW: VALUE-RETURN IN THE *TAKEN* ARM + TRAILING BARE `return 0`  <sub>L25133</sub>
+- **ADD-5** — → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TRAILING `else`  <sub>L25147</sub>
+- **ADD-5** — → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON THE SHIFTED COPY, RAW STAYS LIVE — AND THE HALFWORD-ABS SHAPE NEEDS NO RITUAL  <sub>L25385</sub>
+- **ADDENDUM** — to §224 — CROSS-JUMP: THE DUPLICATE CAN BE A PLAIN STORE, NOT ONLY A CALL  <sub>L25978</sub>
+- **ADDENDUM** — to §172a — RE-READING MEMORY (NOT NAMING A TEMP) IS WHAT KEEPS AN INCREMENT'S DELAY-SLOT FILL ALIVE  <sub>L26278</sub>
+- **ADDENDUM** — to §225 / §256 — A GOTO TO A SHARED SET-POINT PREVENTS IF-CONVERSION FROM COLLAPSING A LATER BRANCH TEST  <sub>L26309</sub>
+- **§277** — RETURN-TAIL C SPELLING PICKS THE DELAY-SLOT-FILL vs TRAILING-MOVE TOPOLOGY, AND A NARROWER SECOND VARIABLE KEEPS TWO PSEUDOS INSTEAD OF ONE (P31 S60; `func_801846F0` ov_SC03_104, `func_801A44C4` md_SC07_004, both byte-proven)  <sub>L26535</sub>
+- **ADDENDUM** — to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, same-address double RMW, a plain memory clobber beats `volatile`, and `volatile` actively breaks a delay-slot fill  <sub>L27200</sub>
+- **ADDENDUM** — to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SAVED SPILL LAND IN THE FIRST CALL'S OWN DELAY SLOT  <sub>L27454</sub>
+- **ADDENDUM** — to §252 — a `>=0`/`<0` split on an unconditionally-decremented value needs the POSTFIX operator INSIDE the branch condition, not a prior statement  <sub>L27512</sub>
+- **ADDENDUM** — to §20's cross-jump EXPLOIT bullet (func_8017E360, ov_SC05_007 — wave dg)  <sub>L27806</sub>
+- **ADDENDUM** — §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE A SWITCH DISPATCH CAN BE PLAIN NESTED `if`s WHOSE SHARED BODY WAS TRIPLICATED BY THE SOURCE AND THEN CROSS-JUMP-MERGED BACK DOWN  <sub>L28197</sub>
+- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29052</sub>
+- **§286** — FOLD A STATEMENT'S SIDE EFFECT INTO A COMMA-EXPRESSION IN AN ARGUMENT POSITION TO PLACE ITS RTL RELATIVE TO A CALL'S OWN DELAY SLOT (P31 S60/dj; `func_80180A88`, ov_SC06_010, byte-proven 411/411) (P31 S60; waves #, byte-proven)  <sub>L29056</sub>
+- **§291** — THE DELAY-SLOT FALSE-VALUE: A CONDITIONAL BRANCH'S ZERO ARM MUST BE A FALL-THROUGH-ADJACENT BLOCK ENDING IN AN EXPLICIT JUMP, OR REORG CANNOT MATERIALIZE IT INSIDE THE BRANCH'S OWN DELAY SLOT (P31 S60; waves #, byte-proven)  <sub>L29076</sub>
+- **ADDENDUM** — to §253 — SECOND byte-proven card (upgrade from single-observation), and the placement face: postfix-in-condition parks the RMW store in the branch delay slot  <sub>L29310</sub>
+- **§306** — A HAZARD `nop` IN FRONT OF A DIV-RESULT STORE IS A STATEMENT-ORDER DEFECT: THE INDEPENDENT TRAILING STATEMENT MUST BE WRITTEN *BEFORE* THE DIVISION-CONSUMING ONE (P31 S62 T4; byte-proven func_8017E7D0)  <sub>L29848</sub>
+- **§308** — A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if` SO cse FOLDS IT TO AN UNCONDITIONAL JUMP *AFTER* jump1's WINDOW HAS CLOSED (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29957</sub>
+- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29986</sub>
+- **§309** — A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD ONTO `$sp` UNLESS THE `if` SURVIVES jump1 AS A BARRIER-PRECEDED DIAMOND (P31 S63 t5e-t5i; byte-proven func_801812AC)  <sub>L30020</sub>
+- **§311** — A JOIN-BLOCK STORE CAN SWALLOW AN ARM'S LOAD-DELAY `nop`: WHEN ONE ARM'S VALUE COMES FROM A LOAD, DUPLICATE THE STORE INTO BOTH ARMS (P31 S64 t5j-t5m; byte-proven func_8017D7E0)  <sub>L30091</sub>
 
 ### instruction scheduling  (59)
 
@@ -101,57 +101,57 @@
 - **§32** — The region-a CAMERA-GIANT idiom set: struct-base hoisting + 4 sibling levers (Phase 24 T7, Fable5-cracked on `func_80129CF8` 191 ins, match_one MATCH; transferable to the 6 sibling giants)  <sub>L2422</sub>
 - **§34** — The `func_80138ED0` giant crack: gcc-2.7.2's **3-qty sort bug** + the **zero-byte asm allocation toolkit** + the **giv-init fence** (Phase 24 T5; Opus→close=21, Fable5→MATCH ×134)  <sub>L2454</sub>
 - **§35** — The region-a sibling-giant harvest: difficulty ≠ $s-reg count (it's global-array hoisting) + the banking recipe + new loop idioms (Phase 24 T7, 5 parallel Opus-Max agents)  <sub>L2471</sub>
-- **§3-A4** — SINK THE CONSUMER CALL INTO THE ARMS (the inverse of A1; `func_8016AB6C`, byte-proven)  <sub>L3444</sub>
-- **§49** — The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` (536 ins ×134), Phase 26 session 8  <sub>L3527</sub>
-- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5491</sub>
-- **§3-The** — attribution primitive (use this before calling anything a scheduling residual)  <sub>L6057</sub>
-- **§3-The** — scheduling rules (refining §135-2 and §135-4)  <sub>L8912</sub>
-- **Consequence** — for the family (a real scheduling decision)  <sub>L10095</sub>
-- **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10145</sub>
-- **§3-A.** — `move_movables` hoists iff `threshold × savings × lifetime ≥ insn_count` — and you can read it  <sub>L10151</sub>
-- **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14353</sub>
-- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16735</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17182</sub>
-- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17267</sub>
-- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17639</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17709</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18092</sub>
-- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18547</sub>
-- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18581</sub>
-- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18682</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18950</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19117</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19311</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19444</sub>
-- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19628</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19884</sub>
-- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20718</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20979</sub>
-- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22057</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22374</sub>
-- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22711</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23216</sub>
-- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23248</sub>
-- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23560</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23680</sub>
-- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23745</sub>
-- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24275</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24886</sub>
-- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25162</sub>
-- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26028</sub>
-- **§281** — GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, the source must not (P31 S60; wave cf, func_80180FB4, ov_SC03_111, byte-proven)  <sub>L26949</sub>
-- **§NNN** — A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AND SCHED1 DOES THE INTERLEAVING (P31 S60; `func_80180FB4`, ov_SC03_111, byte-proven)  <sub>L26950</sub>
-- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L26995</sub>
-- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L26996</sub>
-- **ADDENDUM** — to §195-N — a GNU statement-expression slider must sit INSIDE the conditional arm's value position, not as a post-hoc barrier, to block the store-flag transform on a ternary chain  <sub>L27266</sub>
-- **ADDENDUM** — §NNN — sharpens §167-13's boundary: CHAINING TWO IDENTICAL SIDE-BY-SIDE STORES INTO ONE C ASSIGNMENT STATEMENT IS A MID-BLOCK SCHEDULING-PRIORITY DIAL, NOT ONLY A STORE-ORDER SPELLING  <sub>L28219</sub>
-- **§284** — COMBINE CAN REASSOCIATE TWO SEQUENTIAL BITWISE-AND MASKS INTO ONE AGAINST THE PRE-MASK VALUE; AN ASM IN/OUT FENCE RIGHT AFTER THE FIRST MASK BLOCKS IT (P31, wave dd, `func_8018087C`, ov_SC04_020, byte-proven) (P31 S60; waves #, byte-proven)  <sub>L29033</sub>
-- **§298** — THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUPLICATED STATEMENTS, NOT A HOISTED POST-SWITCH STATEMENT (P31 S61; waves g0e/g0f, `func_80181B68`, ov_SC06_016, byte-proven 68/68)  <sub>L29501</sub>
-- **§299** — TWO INDEPENDENT EXTRACTION CHAINS EMIT CONTIGUOUSLY INSIDE ONE EXPRESSION; ONLY A STATEMENT BOUNDARY MAKES THE SCHEDULER INTERLEAVE THEM (P31 S61; wave m0a, `func_8003A404`, main, byte-proven 8/8)  <sub>L29526</sub>
-- **§307** — THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHEDULER-INTERNAL, AND NO SOURCE ORDER REACHES IT (P31 S63; byte-evidenced NEGATIVE result, main wave)  <sub>L29898</sub>
-- **§309** — A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD ONTO `$sp` UNLESS THE `if` SURVIVES jump1 AS A BARRIER-PRECEDED DIAMOND (P31 S63 t5e-t5i; byte-proven func_801812AC)  <sub>L30005</sub>
+- **§3-A4** — SINK THE CONSUMER CALL INTO THE ARMS (the inverse of A1; `func_8016AB6C`, byte-proven)  <sub>L3459</sub>
+- **§49** — The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` (536 ins ×134), Phase 26 session 8  <sub>L3542</sub>
+- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5506</sub>
+- **§3-The** — attribution primitive (use this before calling anything a scheduling residual)  <sub>L6072</sub>
+- **§3-The** — scheduling rules (refining §135-2 and §135-4)  <sub>L8927</sub>
+- **Consequence** — for the family (a real scheduling decision)  <sub>L10110</sub>
+- **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10160</sub>
+- **§3-A.** — `move_movables` hoists iff `threshold × savings × lifetime ≥ insn_count` — and you can read it  <sub>L10166</sub>
+- **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14368</sub>
+- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16750</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17197</sub>
+- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17282</sub>
+- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17654</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17724</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18107</sub>
+- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18562</sub>
+- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18596</sub>
+- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18697</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18965</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19132</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19326</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19459</sub>
+- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19643</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19899</sub>
+- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20733</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20994</sub>
+- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22072</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22389</sub>
+- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22726</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23231</sub>
+- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23263</sub>
+- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23575</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23695</sub>
+- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23760</sub>
+- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24290</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24901</sub>
+- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25177</sub>
+- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26043</sub>
+- **§281** — GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, the source must not (P31 S60; wave cf, func_80180FB4, ov_SC03_111, byte-proven)  <sub>L26964</sub>
+- **§NNN** — A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AND SCHED1 DOES THE INTERLEAVING (P31 S60; `func_80180FB4`, ov_SC03_111, byte-proven)  <sub>L26965</sub>
+- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L27010</sub>
+- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L27011</sub>
+- **ADDENDUM** — to §195-N — a GNU statement-expression slider must sit INSIDE the conditional arm's value position, not as a post-hoc barrier, to block the store-flag transform on a ternary chain  <sub>L27281</sub>
+- **ADDENDUM** — §NNN — sharpens §167-13's boundary: CHAINING TWO IDENTICAL SIDE-BY-SIDE STORES INTO ONE C ASSIGNMENT STATEMENT IS A MID-BLOCK SCHEDULING-PRIORITY DIAL, NOT ONLY A STORE-ORDER SPELLING  <sub>L28234</sub>
+- **§284** — COMBINE CAN REASSOCIATE TWO SEQUENTIAL BITWISE-AND MASKS INTO ONE AGAINST THE PRE-MASK VALUE; AN ASM IN/OUT FENCE RIGHT AFTER THE FIRST MASK BLOCKS IT (P31, wave dd, `func_8018087C`, ov_SC04_020, byte-proven) (P31 S60; waves #, byte-proven)  <sub>L29048</sub>
+- **§298** — THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUPLICATED STATEMENTS, NOT A HOISTED POST-SWITCH STATEMENT (P31 S61; waves g0e/g0f, `func_80181B68`, ov_SC06_016, byte-proven 68/68)  <sub>L29516</sub>
+- **§299** — TWO INDEPENDENT EXTRACTION CHAINS EMIT CONTIGUOUSLY INSIDE ONE EXPRESSION; ONLY A STATEMENT BOUNDARY MAKES THE SCHEDULER INTERLEAVE THEM (P31 S61; wave m0a, `func_8003A404`, main, byte-proven 8/8)  <sub>L29541</sub>
+- **§307** — THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHEDULER-INTERNAL, AND NO SOURCE ORDER REACHES IT (P31 S63; byte-evidenced NEGATIVE result, main wave)  <sub>L29913</sub>
+- **§309** — A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD ONTO `$sp` UNLESS THE `if` SURVIVES jump1 AS A BARRIER-PRECEDED DIAMOND (P31 S63 t5e-t5i; byte-proven func_801812AC)  <sub>L30020</sub>
 
-### register allocation & pins  (103)
+### register allocation & pins  (104)
 
 - **§10** — Closing the regalloc/scheduling hard tail by hand (LZSS, Phase 7 session F — the full close)  <sub>L835</sub>
 - **Residual** — A — commutative `|`/`&`/`+` result lands in the wrong source-operand register  <sub>L856</sub>
@@ -161,168 +161,170 @@
 - **§22** — DEF-side loose-typing recovery + grinder blacklist (Phase 21)  <sub>L2005</sub>
 - **§24** — The `ov_SC01_077_a.c` split-file vein: split-aware propagation, but loose-typing-gated (Phase 21)  <sub>L2085</sub>
 - **§25** — The "schedule" class is mostly COALESCING (pin-crackable), not scheduling; + the gate two-stage + h_exact over-counts ×134 (Phase 21, cont.6)  <sub>L2132</sub>
-- **§42** — The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 25 T7 F-band, 2026-07-10; Ultracode 9-worker wave, 4/9 banked byte-identical, 266 swept ×134)  <sub>L2900</sub>
-- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3195</sub>
-- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3298</sub>
-- **§47** — The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm (Phase 26 session 8, Fable5 Max, byte-proven on `func_8017BEBC` 952 ins ×113)  <sub>L3365</sub>
-- **§48** — The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, Ultracode, 9/12 MATCH first pass)  <sub>L3405</sub>
-- **§3-A.** — ALLOCNO-PRICING DIALS — move a value into the register you want, byte-neutrally  <sub>L3413</sub>
-- **§52** — The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wall (`func_80178004`, 165 ins ×134; Phase 26, Fable5, 2026-07-15)  <sub>L3913</sub>
-- **§52a** — The regalloc sibling wave: new levers + two new wall classes (cheap-Opus applying §52, 2026-07-15)  <sub>L3959</sub>
-- **§52b** — Sibling wave 2: more de-pin levers, a third wall class, and the match_one→whole-binary gap at scale (2026-07-15)  <sub>L3997</sub>
-- **§66d-1** — What transfers between giants is the LOOP, not the PIN  <sub>L5280</sub>
-- **§70** — The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `func_801777BC`)  <sub>L5619</sub>
-- **§71** — Before mapping a giant, look for an already-matched SIBLING beside it (Phase 29 SESSION-18, `func_8017D960`, 3,338 ins)  <sub>L5660</sub>
-- **§72** — A `register __asm__` pin is a PREFERENCE, not a reservation (Phase 29 SESSION-18, `func_8017F510`)  <sub>L5726</sub>
-- **§74** — Auditing a pinned draft: the §72 hazard is CALLER-SAVED pins spanning a call, and only the disassembly can tell you (Phase 29 SESSION-19, `func_8017D960` b2, 5 pins)  <sub>L5822</sub>
-- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6028</sub>
-- **§78** — A LENGTH drift can be a register grant in disguise; and `fold` never leaves a literal first in an `|` chain (Phase 29 SESSION-19, behemoth #2 `func_8017D960` 3,338 ins, 1806 → 0, pin-free)  <sub>L6174</sub>
-- **§76** — confirmed at scale, and a pin nuance  <sub>L6251</sub>
-- **§80** — A do-not-re-buy entry is scoped to its BASE, not to the function; and the pin's hidden cost is an unconditional `qty_phys_sugg` (Phase 29 SESSION-19, `func_8017BF14` 45 → 0)  <sub>L6270</sub>
-- **§3-The** — pin's hidden cost, with the citation  <sub>L6291</sub>
-- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6412</sub>
-- **§83c** — TRAP: a "dead local" in a prior draft may be gcc's OWN spill area  <sub>L6445</sub>
-- **§86** — Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §42e pin guard is now over-conservative (Phase 29 SESSION-20)  <sub>L6589</sub>
-- **§3-Two** — further notes worth keeping  <sub>L8248</sub>
-- **§137** — REGALLOC-PERM is a TWO-COMPILE ARITHMETIC PROBLEM, not a permuter job  <sub>L9344</sub>
-- **§3-The** — same swallow, twice more, in the integration spine  <sub>L9709</sub>
-- **§3-B.** — A `?:` on MEMORY operands costs ~16 bytes of invisible frame; on REGISTER operands, zero  <sub>L10057</sub>
-- **§3-D.** — A lone `$t8`/`$t9` in the target is RELOAD SCRATCH — reproduce the spill, don't pin the register  <sub>L10073</sub>
-- **§3-C.** — A zero-byte ALLOCNO-PRIORITY slider  <sub>L10184</sub>
-- **§150** — A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocator tie (P30 S43, `func_8017C6F4`, 947 ins ×4)  <sub>L10312</sub>
-- **§152** — BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC family: 1 crack → 12 overlays → 11,364 ins)  <sub>L10418</sub>
-- **§155** — hi/lo literal scanning MUST track base registers (S45)  <sub>L10558</sub>
-- **§158** — The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S46 tier-3, `func_8017CE58`, 733 ins)  <sub>L10712</sub>
-- **Bonus** — facts worth keeping  <sub>L10757</sub>
-- **§156** — THE PREFERENCE-DONOR MERGE: cross-region variable reuse is what fills a0-a3, and a call-arg use in ONE region steers the fill in ALL of them (P30 S46 tier-3, `func_80186E24`, 611 ins: 236-off "S11 regalloc-order" → MATCH, zero new pins)  <sub>L10772</sub>
-- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16735</sub>
-- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17119</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17182</sub>
-- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17336</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17532</sub>
-- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17555</sub>
-- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17633</sub>
-- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17663</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17709</sub>
-- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17962</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18092</sub>
-- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18121</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18509</sub>
-- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18581</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19016</sub>
-- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19054</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19117</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19268</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19311</sub>
-- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19628</sub>
-- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19794</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20010</sub>
-- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20647</sub>
-- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20718</sub>
-- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20767</sub>
-- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20920</sub>
-- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22057</sub>
-- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22202</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22374</sub>
-- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22560</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22738</sub>
-- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22778</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23216</sub>
-- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23710</sub>
-- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23866</sub>
-- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24012</sub>
-- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24026</sub>
-- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24383</sub>
-- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24495</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24886</sub>
-- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25162</sub>
-- **§268** — A `register __asm__` PIN ON A CALL-CLOBBERED REGISTER IS HONORED EXACTLY WHEN THE PINNED RANGE CROSSES NO CALL (P31 S59c; three A/B'd cards, unifying §257-2's two)  <sub>L25244</sub>
-- **ADD-6** — → §220-addendum — THE FOURTH FACE: WHEN THE NAMED COPY ITSELF BUYS THE EXTRA CALLEE-SAVED, PIN THE COPY TO `$16`  <sub>L25386</sub>
-- **ADD-7** — → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE POSITION; NAME IT TO PIN THE PROLOGUE INIT ORDER  <sub>L25402</sub>
-- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25702</sub>
-- **ADDENDUM** — to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads the wrong register"  <sub>L25740</sub>
-- **ADDENDUM** — to §164-64 — AN EMPTY CLOBBER ON AN ARGUMENT REGISTER CAN BE THE DELIBERATE FIX, NOT JUST THE ACCIDENTAL BUG  <sub>L25997</sub>
-- **§275** — THE LEFTOVER-REGISTER READ  <sub>L26371</sub>
-- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26882</sub>
-- **ADDENDUM** — to §176-B2 — in a micro-function with no long/short lifetime asymmetry, BOTH contending pseudos need their own hard-register pin  <sub>L27323</sub>
-- **ADDENDUM** — to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SAVED SPILL LAND IN THE FIRST CALL'S OWN DELAY SLOT  <sub>L27439</sub>
-- **ADDENDUM** — to §215 — FIFTH SHAPE: reused mask constants across two call-free merge sites each get their own whole-function hard-register pin, and a shared sub-expression at the second site must be its own statement  <sub>L27524</sub>
-- **ADDENDUM** — to §194-B (func_8017EB34, ov_SC03_117 — wave dk; distinct from the §74 co-pinning finding on the SAME function below)  <sub>L27932</sub>
-- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28252</sub>
-- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29037</sub>
-- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29045</sub>
-- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29049</sub>
-- **§290** — A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EACH KEEPING ITS OWN `%hi`/`%lo` ANCHOR (P31 S60; waves #, byte-proven)  <sub>L29057</sub>
-- **ADDENDUM** — to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator  <sub>L29227</sub>
-- **ADDENDUM** — to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction births the induction register at loop.c's own insertion point  <sub>L29272</sub>
-- **§310** — A TWO-OPERAND `subu`'s DESTINATION TIES ONLY TO THE OPERAND THAT IS BLOCK-LOCAL: SHARE *ONE* SIDE ACROSS BLOCKS TO CHOOSE WHICH OPERAND'S REGISTER IT LANDS IN (P31 S64 t5j-t5m; byte-proven func_8017F578)  <sub>L30045</sub>
+- **§42** — The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 25 T7 F-band, 2026-07-10; Ultracode 9-worker wave, 4/9 banked byte-identical, 266 swept ×134)  <sub>L2915</sub>
+- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3210</sub>
+- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3313</sub>
+- **§47** — The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm (Phase 26 session 8, Fable5 Max, byte-proven on `func_8017BEBC` 952 ins ×113)  <sub>L3380</sub>
+- **§48** — The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, Ultracode, 9/12 MATCH first pass)  <sub>L3420</sub>
+- **§3-A.** — ALLOCNO-PRICING DIALS — move a value into the register you want, byte-neutrally  <sub>L3428</sub>
+- **§52** — The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wall (`func_80178004`, 165 ins ×134; Phase 26, Fable5, 2026-07-15)  <sub>L3928</sub>
+- **§52a** — The regalloc sibling wave: new levers + two new wall classes (cheap-Opus applying §52, 2026-07-15)  <sub>L3974</sub>
+- **§52b** — Sibling wave 2: more de-pin levers, a third wall class, and the match_one→whole-binary gap at scale (2026-07-15)  <sub>L4012</sub>
+- **§66d-1** — What transfers between giants is the LOOP, not the PIN  <sub>L5295</sub>
+- **§70** — The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `func_801777BC`)  <sub>L5634</sub>
+- **§71** — Before mapping a giant, look for an already-matched SIBLING beside it (Phase 29 SESSION-18, `func_8017D960`, 3,338 ins)  <sub>L5675</sub>
+- **§72** — A `register __asm__` pin is a PREFERENCE, not a reservation (Phase 29 SESSION-18, `func_8017F510`)  <sub>L5741</sub>
+- **§74** — Auditing a pinned draft: the §72 hazard is CALLER-SAVED pins spanning a call, and only the disassembly can tell you (Phase 29 SESSION-19, `func_8017D960` b2, 5 pins)  <sub>L5837</sub>
+- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6043</sub>
+- **§78** — A LENGTH drift can be a register grant in disguise; and `fold` never leaves a literal first in an `|` chain (Phase 29 SESSION-19, behemoth #2 `func_8017D960` 3,338 ins, 1806 → 0, pin-free)  <sub>L6189</sub>
+- **§76** — confirmed at scale, and a pin nuance  <sub>L6266</sub>
+- **§80** — A do-not-re-buy entry is scoped to its BASE, not to the function; and the pin's hidden cost is an unconditional `qty_phys_sugg` (Phase 29 SESSION-19, `func_8017BF14` 45 → 0)  <sub>L6285</sub>
+- **§3-The** — pin's hidden cost, with the citation  <sub>L6306</sub>
+- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6427</sub>
+- **§83c** — TRAP: a "dead local" in a prior draft may be gcc's OWN spill area  <sub>L6460</sub>
+- **§86** — Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §42e pin guard is now over-conservative (Phase 29 SESSION-20)  <sub>L6604</sub>
+- **§3-Two** — further notes worth keeping  <sub>L8263</sub>
+- **§137** — REGALLOC-PERM is a TWO-COMPILE ARITHMETIC PROBLEM, not a permuter job  <sub>L9359</sub>
+- **§3-The** — same swallow, twice more, in the integration spine  <sub>L9724</sub>
+- **§3-B.** — A `?:` on MEMORY operands costs ~16 bytes of invisible frame; on REGISTER operands, zero  <sub>L10072</sub>
+- **§3-D.** — A lone `$t8`/`$t9` in the target is RELOAD SCRATCH — reproduce the spill, don't pin the register  <sub>L10088</sub>
+- **§3-C.** — A zero-byte ALLOCNO-PRIORITY slider  <sub>L10199</sub>
+- **§150** — A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocator tie (P30 S43, `func_8017C6F4`, 947 ins ×4)  <sub>L10327</sub>
+- **§152** — BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC family: 1 crack → 12 overlays → 11,364 ins)  <sub>L10433</sub>
+- **§155** — hi/lo literal scanning MUST track base registers (S45)  <sub>L10573</sub>
+- **§158** — The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S46 tier-3, `func_8017CE58`, 733 ins)  <sub>L10727</sub>
+- **Bonus** — facts worth keeping  <sub>L10772</sub>
+- **§156** — THE PREFERENCE-DONOR MERGE: cross-region variable reuse is what fills a0-a3, and a call-arg use in ONE region steers the fill in ALL of them (P30 S46 tier-3, `func_80186E24`, 611 ins: 236-off "S11 regalloc-order" → MATCH, zero new pins)  <sub>L10787</sub>
+- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16750</sub>
+- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17134</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17197</sub>
+- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17351</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17547</sub>
+- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17570</sub>
+- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17648</sub>
+- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17678</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17724</sub>
+- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17977</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18107</sub>
+- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18136</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18524</sub>
+- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18596</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19031</sub>
+- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19069</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19132</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19283</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19326</sub>
+- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19643</sub>
+- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19809</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20025</sub>
+- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20662</sub>
+- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20733</sub>
+- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20782</sub>
+- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20935</sub>
+- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22072</sub>
+- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22217</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22389</sub>
+- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22575</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22753</sub>
+- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22793</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23231</sub>
+- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23725</sub>
+- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23881</sub>
+- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24027</sub>
+- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24041</sub>
+- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24398</sub>
+- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24510</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24901</sub>
+- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25177</sub>
+- **§268** — A `register __asm__` PIN ON A CALL-CLOBBERED REGISTER IS HONORED EXACTLY WHEN THE PINNED RANGE CROSSES NO CALL (P31 S59c; three A/B'd cards, unifying §257-2's two)  <sub>L25259</sub>
+- **ADD-6** — → §220-addendum — THE FOURTH FACE: WHEN THE NAMED COPY ITSELF BUYS THE EXTRA CALLEE-SAVED, PIN THE COPY TO `$16`  <sub>L25401</sub>
+- **ADD-7** — → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE POSITION; NAME IT TO PIN THE PROLOGUE INIT ORDER  <sub>L25417</sub>
+- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25717</sub>
+- **ADDENDUM** — to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads the wrong register"  <sub>L25755</sub>
+- **ADDENDUM** — to §164-64 — AN EMPTY CLOBBER ON AN ARGUMENT REGISTER CAN BE THE DELIBERATE FIX, NOT JUST THE ACCIDENTAL BUG  <sub>L26012</sub>
+- **§275** — THE LEFTOVER-REGISTER READ  <sub>L26386</sub>
+- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26897</sub>
+- **ADDENDUM** — to §176-B2 — in a micro-function with no long/short lifetime asymmetry, BOTH contending pseudos need their own hard-register pin  <sub>L27338</sub>
+- **ADDENDUM** — to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SAVED SPILL LAND IN THE FIRST CALL'S OWN DELAY SLOT  <sub>L27454</sub>
+- **ADDENDUM** — to §215 — FIFTH SHAPE: reused mask constants across two call-free merge sites each get their own whole-function hard-register pin, and a shared sub-expression at the second site must be its own statement  <sub>L27539</sub>
+- **ADDENDUM** — to §194-B (func_8017EB34, ov_SC03_117 — wave dk; distinct from the §74 co-pinning finding on the SAME function below)  <sub>L27947</sub>
+- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28267</sub>
+- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29052</sub>
+- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29060</sub>
+- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29064</sub>
+- **§290** — A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EACH KEEPING ITS OWN `%hi`/`%lo` ANCHOR (P31 S60; waves #, byte-proven)  <sub>L29072</sub>
+- **ADDENDUM** — to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator  <sub>L29242</sub>
+- **ADDENDUM** — to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction births the induction register at loop.c's own insertion point  <sub>L29287</sub>
+- **§310** — A TWO-OPERAND `subu`'s DESTINATION TIES ONLY TO THE OPERAND THAT IS BLOCK-LOCAL: SHARE *ONE* SIDE ACROSS BLOCKS TO CHOOSE WHICH OPERAND'S REGISTER IT LANDS IN (P31 S64 t5j-t5m; byte-proven func_8017F578)  <sub>L30060</sub>
+- **§312** — A BARE RELATIONAL IN AN `if` GIVES THE `slt` NO TARGET: ASSIGN THE COMPARISON INTO THE ALREADY-ALLOCATED VARIABLE TO CHOOSE ITS DESTINATION REGISTER, AT ZERO INSTRUCTION COST (P31 S64 t5o-t5r; byte-proven func_80180DCC)  <sub>L30133</sub>
 
 ### CSE / redundancy / rematerialization  (28)
 
-- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3313</sub>
-- **§83d** — CSE's quantity budget is WHOLE-FUNCTION, so a local rewrite cannot fix a local symptom  <sub>L6452</sub>
-- **§153** — THE ADDRESS-REMATERIALISATION LAUNDER: a third zero-emission asm lever (P30 S43, `func_8018D98C`, 710 ins)  <sub>L10466</sub>
-- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17735</sub>
-- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18652</sub>
-- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18682</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18807</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18950</sub>
-- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19392</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19444</sub>
-- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20110</sub>
-- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20157</sub>
-- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20318</sub>
-- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20581</sub>
-- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20619</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21368</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21763</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23680</sub>
-- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23710</sub>
-- **ADD-1** — → §257-8 addendum — THE INTERPOSED ASM'S `__volatile__` IS A PER-SHAPE DIAL, AND THE "NO-OUTPUT ASM IS IMPLICITLY VOLATILE" LORE IS BYTE-FALSE IN gcc-2.7.2  <sub>L25313</sub>
-- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26028</sub>
-- **ADDENDUM** — to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIALISES ITS CONSTANT AFTER EVERY CALL  <sub>L26336</sub>
-- **§276** — MIXED ADDRESS-EXPRESSION SPELLING FOR ADJACENT RELOCATABLE SYMBOLS IS A CSE-UNIFICATION DIAL, NOT JUST A BYTE-ENCODING CHOICE (P31 S60; `func_80180FE8`, ov_SC06_006, byte-proven)  <sub>L26411</sub>
-- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26882</sub>
-- **ADDENDUM** — to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, same-address double RMW, a plain memory clobber beats `volatile`, and `volatile` actively breaks a delay-slot fill  <sub>L27185</sub>
-- **§302** — A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO DERIVE EACH FROM THE BYTES (P31 S62 T2; five reds healed in one session, 5/5, +39 held banks)  <sub>L29678</sub>
-- **§308** — A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if` SO cse FOLDS IT TO AN UNCONDITIONAL JUMP *AFTER* jump1's WINDOW HAS CLOSED (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29942</sub>
+- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3328</sub>
+- **§83d** — CSE's quantity budget is WHOLE-FUNCTION, so a local rewrite cannot fix a local symptom  <sub>L6467</sub>
+- **§153** — THE ADDRESS-REMATERIALISATION LAUNDER: a third zero-emission asm lever (P30 S43, `func_8018D98C`, 710 ins)  <sub>L10481</sub>
+- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17750</sub>
+- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18667</sub>
+- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18697</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18822</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18965</sub>
+- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19407</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19459</sub>
+- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20125</sub>
+- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20172</sub>
+- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20333</sub>
+- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20596</sub>
+- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20634</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21383</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21778</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23695</sub>
+- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23725</sub>
+- **ADD-1** — → §257-8 addendum — THE INTERPOSED ASM'S `__volatile__` IS A PER-SHAPE DIAL, AND THE "NO-OUTPUT ASM IS IMPLICITLY VOLATILE" LORE IS BYTE-FALSE IN gcc-2.7.2  <sub>L25328</sub>
+- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26043</sub>
+- **ADDENDUM** — to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIALISES ITS CONSTANT AFTER EVERY CALL  <sub>L26351</sub>
+- **§276** — MIXED ADDRESS-EXPRESSION SPELLING FOR ADJACENT RELOCATABLE SYMBOLS IS A CSE-UNIFICATION DIAL, NOT JUST A BYTE-ENCODING CHOICE (P31 S60; `func_80180FE8`, ov_SC06_006, byte-proven)  <sub>L26426</sub>
+- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26897</sub>
+- **ADDENDUM** — to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, same-address double RMW, a plain memory clobber beats `volatile`, and `volatile` actively breaks a delay-slot fill  <sub>L27200</sub>
+- **§302** — A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO DERIVE EACH FROM THE BYTES (P31 S62 T2; five reds healed in one session, 5/5, +39 held banks)  <sub>L29693</sub>
+- **§308** — A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if` SO cse FOLDS IT TO AN UNCONDITIONAL JUMP *AFTER* jump1's WINDOW HAS CLOSED (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29957</sub>
 
-### loops & induction variables  (31)
+### loops & induction variables  (32)
 
 - **§3-T1** — Loop pointer: top-of-body for `addu` induction, not constant-folded `addiu`  <sub>L71</sub>
 - **§34** — The `func_80138ED0` giant crack: gcc-2.7.2's **3-qty sort bug** + the **zero-byte asm allocation toolkit** + the **giv-init fence** (Phase 24 T5; Opus→close=21, Fable5→MATCH ×134)  <sub>L2454</sub>
 - **§35** — The region-a sibling-giant harvest: difficulty ≠ $s-reg count (it's global-array hoisting) + the banking recipe + new loop idioms (Phase 24 T7, 5 parallel Opus-Max agents)  <sub>L2471</sub>
-- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3313</sub>
-- **§66d** — The permuter⇄reader loop: alternate a random search with a byte-verified idiom, and let `residual_class` decide whose turn it is (Phase 29 SESSION-17)  <sub>L5245</sub>
-- **§66d-1** — What transfers between giants is the LOOP, not the PIN  <sub>L5280</sub>
-- **§70** — The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `func_801777BC`)  <sub>L5619</sub>
-- **§145** — Three loop/combine levers from the S40 wave-2 drafters (16/16 match_one)  <sub>L9927</sub>
-- **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10145</sub>
-- **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16433</sub>
-- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17336</sub>
-- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17506</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17532</sub>
-- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19054</sub>
-- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21641</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21763</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22374</sub>
-- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23792</sub>
-- **ADD-7** — → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE POSITION; NAME IT TO PIN THE PROLOGUE INIT ORDER  <sub>L25402</sub>
-- **ADD-8** — → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST-PLUS GIVES SERIALIZATION *AND* DISPLACEMENT FOLDING  <sub>L25415</sub>
-- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26059</sub>
-- **ADDENDUM** — to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIALISES ITS CONSTANT AFTER EVERY CALL  <sub>L26336</sub>
-- **§279** — A `do/while (p < end)` LOOP UNDER AN ENTRY GUARD: the guard decides the compare, not the loop (P31 S60; wave cf, func_8017F2A4, ov_SC03_096, byte-proven)  <sub>L26881</sub>
-- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26882</sub>
-- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26916</sub>
-- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L26995</sub>
-- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L26996</sub>
-- **§290** — A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EACH KEEPING ITS OWN `%hi`/`%lo` ANCHOR (P31 S60; waves #, byte-proven)  <sub>L29057</sub>
-- **ADDENDUM** — to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction births the induction register at loop.c's own insertion point  <sub>L29272</sub>
-- **ADDENDUM** — to the L1800 anchor-steer bullet — a DERIVED-POINTER local silently flips the merged giv's anchor END  <sub>L29316</sub>
-- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29458</sub>
+- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3328</sub>
+- **§66d** — The permuter⇄reader loop: alternate a random search with a byte-verified idiom, and let `residual_class` decide whose turn it is (Phase 29 SESSION-17)  <sub>L5260</sub>
+- **§66d-1** — What transfers between giants is the LOOP, not the PIN  <sub>L5295</sub>
+- **§70** — The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `func_801777BC`)  <sub>L5634</sub>
+- **§145** — Three loop/combine levers from the S40 wave-2 drafters (16/16 match_one)  <sub>L9942</sub>
+- **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10160</sub>
+- **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16448</sub>
+- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17351</sub>
+- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17521</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17547</sub>
+- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19069</sub>
+- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21656</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21778</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22389</sub>
+- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23807</sub>
+- **ADD-7** — → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE POSITION; NAME IT TO PIN THE PROLOGUE INIT ORDER  <sub>L25417</sub>
+- **ADD-8** — → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST-PLUS GIVES SERIALIZATION *AND* DISPLACEMENT FOLDING  <sub>L25430</sub>
+- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26074</sub>
+- **ADDENDUM** — to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIALISES ITS CONSTANT AFTER EVERY CALL  <sub>L26351</sub>
+- **§279** — A `do/while (p < end)` LOOP UNDER AN ENTRY GUARD: the guard decides the compare, not the loop (P31 S60; wave cf, func_8017F2A4, ov_SC03_096, byte-proven)  <sub>L26896</sub>
+- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26897</sub>
+- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26931</sub>
+- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L27010</sub>
+- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L27011</sub>
+- **§290** — A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EACH KEEPING ITS OWN `%hi`/`%lo` ANCHOR (P31 S60; waves #, byte-proven)  <sub>L29072</sub>
+- **ADDENDUM** — to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction births the induction register at loop.c's own insertion point  <sub>L29287</sub>
+- **ADDENDUM** — to the L1800 anchor-steer bullet — a DERIVED-POINTER local silently flips the merged giv's anchor END  <sub>L29331</sub>
+- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29473</sub>
+- **§312** — A BARE RELATIONAL IN AN `if` GIVES THE `slt` NO TARGET: ASSIGN THE COMPARISON INTO THE ALREADY-ALLOCATED VARIABLE TO CHOOSE ITS DESTINATION REGISTER, AT ZERO INSTRUCTION COST (P31 S64 t5o-t5r; byte-proven func_80180DCC)  <sub>L30133</sub>
 
-### structs, block moves & memcpy  (70)
+### structs, block moves & memcpy  (71)
 
 - **§3-T2** — Source statement order drives instruction scheduling  <sub>L78</sub>
 - **§5** — Known hard-residual classes (instruction-identical, one byte-exact blocker)  <sub>L199</sub>
@@ -337,63 +339,64 @@
 - **§38** — The WHALE `func_80144B9C` (770 ins): the -O0 struct-assign memcpy idiom + the -O0 reach-134 ×134 rollout (Phase 24 T7 §G, cheap Opus — no Fable5, no calls.c)  <sub>L2527</sub>
 - **§40** — Structural families: the MECHANICAL symbol-remap (crack one exemplar → remap the rest, ~0 tokens) (Phase 25 T3/T7, 2026-07-08)  <sub>L2553</sub>
 - **§41** — The DEF-SIDE canonical-sig wall: mechanically banking a drafted giant past `conflicting types` (Phase 25 T5b batch-2, 2026-07-09; `tools/canon_sig_reconcile.py`, byte-proven on `func_8013B274`)  <sub>L2710</sub>
-- **§42a** — addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-assign fix, +5 levers (2026-07-10b)  <sub>L2953</sub>
-- **§44** — The Phase-25 cheap-Opus giant batch: 5 structural levers + the §43 extension (2026-07-11, 6 crackers over the frontier giants)  <sub>L3242</sub>
-- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3313</sub>
-- **§3-Why** — 0/8 was structural, and predictable from two words  <sub>L4045</sub>
-- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4163</sub>
-- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4232</sub>
-- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5030</sub>
-- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5491</sub>
-- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6412</sub>
-- **§84** — The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between two per-overlay symbols, and why `match_one` is structurally blind to it (Phase 29 SESSION-20, `func_8013D53C`)  <sub>L6472</sub>
-- **§3-The** — construct  <sub>L6477</sub>
-- **§91** — A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap (Phase 29 SESSION-21, `func_8012AAAC` ×137)  <sub>L6842</sub>
-- **§3-The** — three-hypothesis trail, because two of them were wrong and the wrongness is instructive  <sub>L6871</sub>
-- **§129** — Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must never be committed without its owner (P30 S28, `func_8013BD74`)  <sub>L8437</sub>
-- **§129a** — the target instruction count is INFLATED after a carve  <sub>L8441</sub>
-- **§3-The** — DEFINITION-side alias is the only escape when the fleet canon disagrees on a promoting param  <sub>L9473</sub>
-- **§3-Two** — errors of mine, both instructive  <sub>L10009</sub>
-- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10893</sub>
-- **§16Xy** — SHARPENS  *(sharpens §136d-3, §37 /s-DEP LATTICE, §135-2, §136-13, §162q)*  <sub>L12300</sub>
-- **§3-The** — `/s` drop clause is in ALL THREE dependence predicates, so the FIXED-ADDRESS STORE is what floats (P30 S48, `func_8017CA18`, ov_MAIN_012)  <sub>L12302</sub>
-- **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14353</sub>
-- **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014)  <sub>L14355</sub>
-- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16953</sub>
-- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17304</sub>
-- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17506</sub>
-- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17663</sub>
-- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18226</sub>
-- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18442</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18509</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18847</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19158</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19311</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19884</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20010</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20062</sub>
-- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20266</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20979</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21763</sub>
-- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22934</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23216</sub>
-- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23890</sub>
-- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24158</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24886</sub>
-- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25162</sub>
-- **ADD-11** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25193</sub>
-- **ADD-4** — → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAME IT **AND** STORE **INSIDE** THE ARM  <sub>L25353</sub>
-- **ADD-10** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25444</sub>
-- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25702</sub>
-- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26028</sub>
-- **§281** — GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, the source must not (P31 S60; wave cf, func_80180FB4, ov_SC03_111, byte-proven)  <sub>L26949</sub>
-- **§NNN** — A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AND SCHED1 DOES THE INTERLEAVING (P31 S60; `func_80180FB4`, ov_SC03_111, byte-proven)  <sub>L26950</sub>
-- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L26996</sub>
-- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29037</sub>
-- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29045</sub>
-- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29458</sub>
-- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29971</sub>
+- **§42a** — addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-assign fix, +5 levers (2026-07-10b)  <sub>L2968</sub>
+- **§44** — The Phase-25 cheap-Opus giant batch: 5 structural levers + the §43 extension (2026-07-11, 6 crackers over the frontier giants)  <sub>L3257</sub>
+- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3328</sub>
+- **§3-Why** — 0/8 was structural, and predictable from two words  <sub>L4060</sub>
+- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4178</sub>
+- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4247</sub>
+- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5045</sub>
+- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5506</sub>
+- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6427</sub>
+- **§84** — The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between two per-overlay symbols, and why `match_one` is structurally blind to it (Phase 29 SESSION-20, `func_8013D53C`)  <sub>L6487</sub>
+- **§3-The** — construct  <sub>L6492</sub>
+- **§91** — A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap (Phase 29 SESSION-21, `func_8012AAAC` ×137)  <sub>L6857</sub>
+- **§3-The** — three-hypothesis trail, because two of them were wrong and the wrongness is instructive  <sub>L6886</sub>
+- **§129** — Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must never be committed without its owner (P30 S28, `func_8013BD74`)  <sub>L8452</sub>
+- **§129a** — the target instruction count is INFLATED after a carve  <sub>L8456</sub>
+- **§3-The** — DEFINITION-side alias is the only escape when the fleet canon disagrees on a promoting param  <sub>L9488</sub>
+- **§3-Two** — errors of mine, both instructive  <sub>L10024</sub>
+- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10908</sub>
+- **§16Xy** — SHARPENS  *(sharpens §136d-3, §37 /s-DEP LATTICE, §135-2, §136-13, §162q)*  <sub>L12315</sub>
+- **§3-The** — `/s` drop clause is in ALL THREE dependence predicates, so the FIXED-ADDRESS STORE is what floats (P30 S48, `func_8017CA18`, ov_MAIN_012)  <sub>L12317</sub>
+- **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14368</sub>
+- **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014)  <sub>L14370</sub>
+- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16968</sub>
+- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17319</sub>
+- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17521</sub>
+- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17678</sub>
+- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18241</sub>
+- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18457</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18524</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18862</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19173</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19326</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19899</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20025</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20077</sub>
+- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20281</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20994</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21778</sub>
+- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22949</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23231</sub>
+- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23905</sub>
+- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24173</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24901</sub>
+- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25177</sub>
+- **ADD-11** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25208</sub>
+- **ADD-4** — → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAME IT **AND** STORE **INSIDE** THE ARM  <sub>L25368</sub>
+- **ADD-10** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25459</sub>
+- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25717</sub>
+- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26043</sub>
+- **§281** — GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, the source must not (P31 S60; wave cf, func_80180FB4, ov_SC03_111, byte-proven)  <sub>L26964</sub>
+- **§NNN** — A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AND SCHED1 DOES THE INTERLEAVING (P31 S60; `func_80180FB4`, ov_SC03_111, byte-proven)  <sub>L26965</sub>
+- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L27011</sub>
+- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29052</sub>
+- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29060</sub>
+- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29473</sub>
+- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29986</sub>
+- **§312** — A BARE RELATIONAL IN AN `if` GIVES THE `slt` NO TARGET: ASSIGN THE COMPARISON INTO THE ALREADY-ALLOCATED VARIABLE TO CHOOSE ITS DESTINATION REGISTER, AT ZERO INSTRUCTION COST (P31 S64 t5o-t5r; byte-proven func_80180DCC)  <sub>L30133</sub>
 
 ### types, signedness & load/store width  (77)
 
@@ -408,72 +411,72 @@
 - **§33** — Automating the giant decl-reconcile: `tools/reconcile_decls.py` (the DATA analog of §20's `cast_call_sites`) + a fleet-majority type oracle (Phase 24 T7b, byte-proven on `func_80129CF8`)  <sub>L2434</sub>
 - **§40a** — The DECL-RECONCILE pass (type-lift so remapped drafts compile in the sibling TU) (Phase 25 T7.2, 2026-07-08)  <sub>L2601</sub>
 - **§41** — The DEF-SIDE canonical-sig wall: mechanically banking a drafted giant past `conflicting types` (Phase 25 T5b batch-2, 2026-07-09; `tools/canon_sig_reconcile.py`, byte-proven on `func_8013B274`)  <sub>L2710</sub>
-- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2878</sub>
-- **§42b** — addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cast drift + fix  <sub>L2994</sub>
-- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3195</sub>
-- **§3-C.** — TYPE- AND SHAPE-DRIVEN CODEGEN (the C type literally selects the addressing mode)  <sub>L3484</sub>
-- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4232</sub>
-- **§64** — The §20 type-lift's three laws: fold the tagged typedef, check VISIBILITY, and strip only what is TEXTUALLY IDENTICAL (`lift_types.py`, Phase 29 SESSION-14, 2026-07-23)  <sub>L4908</sub>
-- **§64a** — VARIANT types: UNIQUIFY the camps, do not reconcile them (`uniquify_type.py`, Phase 29 SESSION-14)  <sub>L4957</sub>
-- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5139</sub>
-- **§68** — A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase 29 SESSION-18)  <sub>L5524</sub>
-- **§73** — A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at each use, T0). Diagnose which before paying for the expensive one (Phase 29 SESSION-19, `func_8014F3E8` + `func_8014D4C0`)  <sub>L5783</sub>
-- **§75c** — Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix moves the error and looks like a new wall (Phase 29 SESSION-19, `func_8012F14C`)  <sub>L5997</sub>
-- **§3-The** — defect this exposed: a shared type that is present but invisible  <sub>L6354</sub>
-- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6891</sub>
-- **§94** — A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's local types, ALL of them, transitively (Phase 29 SESSION-21, `func_8016B6BC` 0/137 → 137/137)  <sub>L6947</sub>
-- **§100** — Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a shared header (Phase 29 SESSION-22, `func_80175DA8` 0/137 → 137/137)  <sub>L7216</sub>
-- **§120** — Uniquify draft-defined TYPE names; and check which of N staging sites you actually patched (Phase 29 T93)  <sub>L8026</sub>
-- **§3-Do** — NOT "strip the duplicate typedef" — it breaks the extern that uses it  <sub>L8037</sub>
-- **§3-The** — type-form rules  <sub>L8879</sub>
-- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9834</sub>
-- **Then** — propagation returned 0/137 TWICE — both times a missing TYPE  <sub>L10000</sub>
-- **§154** — Reading a disc payload: the module-id word, static base derivation, and "type 1 = uncompressed overlay" (P30 S44)  <sub>L10522</sub>
-- **§3-C.** — PAC type 1 = the same payload class as type 4, just NOT compressed  <sub>L10548</sub>
-- **§155b** — check the TYPE your oracle returns before comparing against it (S45 p5)  <sub>L10587</sub>
-- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L17017</sub>
-- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17288</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18060</sub>
-- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18113</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18509</sub>
-- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18746</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18807</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19016</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19117</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19268</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19311</sub>
-- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19349</sub>
-- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20581</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21321</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21486</sub>
-- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21838</sub>
-- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22682</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22738</sub>
-- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L23018</sub>
-- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23316</sub>
-- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23465</sub>
-- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23652</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23680</sub>
-- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23969</sub>
-- **ADD-5** — → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TRAILING `else`  <sub>L25132</sub>
-- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25326</sub>
-- **ADD-5** — → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON THE SHIFTED COPY, RAW STAYS LIVE — AND THE HALFWORD-ABS SHAPE NEEDS NO RITUAL  <sub>L25370</sub>
-- **ADD-8** — → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST-PLUS GIVES SERIALIZATION *AND* DISPLACEMENT FOLDING  <sub>L25415</sub>
-- **ADDENDUM** — to §179-C — the `.type NAME, @function` requirement  <sub>L25599</sub>
-- **ADDENDUM** — to §134 — a typedef defined BELOW the splice point is stripped anyway  <sub>L25646</sub>
-- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26059</sub>
-- **ADDENDUM** — to §172b-4 — THE PLAIN CAST-DIVISION ALREADY PRODUCES THE PATTERN; DON'T HAND-ROLL THE BIAS, AND KEEP THE OPERAND WIDE  <sub>L26151</sub>
-- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26915</sub>
-- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26916</sub>
-- **ADDENDUM** — to §21 — the `bltz`+`slti` (or N-separate-compares) signed-range-split bullet is now CONFIRMED on three independent functions, and generalizes beyond `lbu`/u8  <sub>L27116</sub>
-- **ADDENDUM** — to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not only a function-vs-function prototype clash  <sub>L27162</sub>
-- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28252</sub>
-- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29049</sub>
-- **§292** — DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPLICIT (K&R) DECLARATION CAN SILENTLY REPROTOTYPE THE SIBLING'S OWN CALL SITE (P31 S60; waves #, byte-proven)  <sub>L29065</sub>
-- **ADDENDUM** — to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator  <sub>L29227</sub>
-- **ADDENDUM** — to §31's asm→layout inference — TWO WIDTH-PAIR DISCRIMINATORS (same offset, different widths)  <sub>L29339</sub>
-- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29458</sub>
+- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2893</sub>
+- **§42b** — addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cast drift + fix  <sub>L3009</sub>
+- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3210</sub>
+- **§3-C.** — TYPE- AND SHAPE-DRIVEN CODEGEN (the C type literally selects the addressing mode)  <sub>L3499</sub>
+- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4247</sub>
+- **§64** — The §20 type-lift's three laws: fold the tagged typedef, check VISIBILITY, and strip only what is TEXTUALLY IDENTICAL (`lift_types.py`, Phase 29 SESSION-14, 2026-07-23)  <sub>L4923</sub>
+- **§64a** — VARIANT types: UNIQUIFY the camps, do not reconcile them (`uniquify_type.py`, Phase 29 SESSION-14)  <sub>L4972</sub>
+- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5154</sub>
+- **§68** — A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase 29 SESSION-18)  <sub>L5539</sub>
+- **§73** — A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at each use, T0). Diagnose which before paying for the expensive one (Phase 29 SESSION-19, `func_8014F3E8` + `func_8014D4C0`)  <sub>L5798</sub>
+- **§75c** — Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix moves the error and looks like a new wall (Phase 29 SESSION-19, `func_8012F14C`)  <sub>L6012</sub>
+- **§3-The** — defect this exposed: a shared type that is present but invisible  <sub>L6369</sub>
+- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6906</sub>
+- **§94** — A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's local types, ALL of them, transitively (Phase 29 SESSION-21, `func_8016B6BC` 0/137 → 137/137)  <sub>L6962</sub>
+- **§100** — Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a shared header (Phase 29 SESSION-22, `func_80175DA8` 0/137 → 137/137)  <sub>L7231</sub>
+- **§120** — Uniquify draft-defined TYPE names; and check which of N staging sites you actually patched (Phase 29 T93)  <sub>L8041</sub>
+- **§3-Do** — NOT "strip the duplicate typedef" — it breaks the extern that uses it  <sub>L8052</sub>
+- **§3-The** — type-form rules  <sub>L8894</sub>
+- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9849</sub>
+- **Then** — propagation returned 0/137 TWICE — both times a missing TYPE  <sub>L10015</sub>
+- **§154** — Reading a disc payload: the module-id word, static base derivation, and "type 1 = uncompressed overlay" (P30 S44)  <sub>L10537</sub>
+- **§3-C.** — PAC type 1 = the same payload class as type 4, just NOT compressed  <sub>L10563</sub>
+- **§155b** — check the TYPE your oracle returns before comparing against it (S45 p5)  <sub>L10602</sub>
+- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L17032</sub>
+- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17303</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18075</sub>
+- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18128</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18524</sub>
+- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18761</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18822</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19031</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19132</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19283</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19326</sub>
+- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19364</sub>
+- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20596</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21336</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21501</sub>
+- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21853</sub>
+- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22697</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22753</sub>
+- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L23033</sub>
+- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23331</sub>
+- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23480</sub>
+- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23667</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23695</sub>
+- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23984</sub>
+- **ADD-5** — → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TRAILING `else`  <sub>L25147</sub>
+- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25341</sub>
+- **ADD-5** — → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON THE SHIFTED COPY, RAW STAYS LIVE — AND THE HALFWORD-ABS SHAPE NEEDS NO RITUAL  <sub>L25385</sub>
+- **ADD-8** — → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST-PLUS GIVES SERIALIZATION *AND* DISPLACEMENT FOLDING  <sub>L25430</sub>
+- **ADDENDUM** — to §179-C — the `.type NAME, @function` requirement  <sub>L25614</sub>
+- **ADDENDUM** — to §134 — a typedef defined BELOW the splice point is stripped anyway  <sub>L25661</sub>
+- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26074</sub>
+- **ADDENDUM** — to §172b-4 — THE PLAIN CAST-DIVISION ALREADY PRODUCES THE PATTERN; DON'T HAND-ROLL THE BIAS, AND KEEP THE OPERAND WIDE  <sub>L26166</sub>
+- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26930</sub>
+- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26931</sub>
+- **ADDENDUM** — to §21 — the `bltz`+`slti` (or N-separate-compares) signed-range-split bullet is now CONFIRMED on three independent functions, and generalizes beyond `lbu`/u8  <sub>L27131</sub>
+- **ADDENDUM** — to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not only a function-vs-function prototype clash  <sub>L27177</sub>
+- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28267</sub>
+- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29064</sub>
+- **§292** — DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPLICIT (K&R) DECLARATION CAN SILENTLY REPROTOTYPE THE SIBLING'S OWN CALL SITE (P31 S60; waves #, byte-proven)  <sub>L29080</sub>
+- **ADDENDUM** — to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator  <sub>L29242</sub>
+- **ADDENDUM** — to §31's asm→layout inference — TWO WIDTH-PAIR DISCRIMINATORS (same offset, different widths)  <sub>L29354</sub>
+- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29473</sub>
 
 ### declarations, prototypes & K&R  (99)
 
@@ -489,93 +492,93 @@
 - **§33** — Automating the giant decl-reconcile: `tools/reconcile_decls.py` (the DATA analog of §20's `cast_call_sites`) + a fleet-majority type oracle (Phase 24 T7b, byte-proven on `func_80129CF8`)  <sub>L2434</sub>
 - **§40a** — The DECL-RECONCILE pass (type-lift so remapped drafts compile in the sibling TU) (Phase 25 T7.2, 2026-07-08)  <sub>L2601</sub>
 - **§41** — The DEF-SIDE canonical-sig wall: mechanically banking a drafted giant past `conflicting types` (Phase 25 T5b batch-2, 2026-07-09; `tools/canon_sig_reconcile.py`, byte-proven on `func_8013B274`)  <sub>L2710</sub>
-- **§41b** — addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25 T7-M4, 2026-07-10)  <sub>L2858</sub>
-- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2878</sub>
-- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3195</sub>
-- **§51g** — When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`)  <sub>L3769</sub>
-- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4163</sub>
-- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4187</sub>
-- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4232</sub>
-- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4256</sub>
-- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4545</sub>
-- **§63** — The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`, Phase 29 SESSION-13, 2026-07-23)  <sub>L4877</sub>
-- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5000</sub>
-- **§65c** — `rtu_match` MATCH → bank held 13/13 on self-decl, but broke on the FIRST callee-decl case  <sub>L5081</sub>
-- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5139</sub>
-- **§66a** — The widest write in a pipeline is the one most likely to be UNDECLARED  <sub>L5181</sub>
-- **§68** — A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase 29 SESSION-18)  <sub>L5524</sub>
-- **§73** — A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at each use, T0). Diagnose which before paying for the expensive one (Phase 29 SESSION-19, `func_8014F3E8` + `func_8014D4C0`)  <sub>L5783</sub>
-- **§75** — A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the carried extern before believing the exclusion message (Phase 29 SESSION-19, `func_8014F3E8` ×4 → ×138)  <sub>L5866</sub>
-- **§75b** — A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the externs (Phase 29 SESSION-19, `func_80165CA0` ×3 → fleet)  <sub>L5948</sub>
-- **§75c** — Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix moves the error and looks like a new wall (Phase 29 SESSION-19, `func_8012F14C`)  <sub>L5997</sub>
-- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6028</sub>
-- **§79** — For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT ORDER is a declaration-order oracle (Phase 29 SESSION-19, `func_8017BF14` 4,763 ins, cold start → 45/4763)  <sub>L6220</sub>
-- **§3-NEW** — LEVER — the frame layout reads back the original declaration order  <sub>L6240</sub>
-- **§3-1.** — The inlined-helper signature  <sub>L6375</sub>
-- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6891</sub>
-- **§95** — `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 SESSION-21, `func_80176218`)  <sub>L6983</sub>
-- **§96** — The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so every COMMENTED declaration was silently skipped (Phase 29 SESSION-22, `func_80176218` banked)  <sub>L7018</sub>
-- **§98** — `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION-22, `func_8014CF04`)  <sub>L7113</sub>
-- **§99** — The narrow-param wall is a DEF-side problem with a ZERO-blast-radius fix: convert the definition to K&R (Phase 29 SESSION-22, `func_80175AB8` + `func_80175DA8`)  <sub>L7167</sub>
-- **§102** — A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSION-22, `func_8016EC0C`)  <sub>L7272</sub>
-- **§103** — A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER function; move the DECL, not the draft (Phase 29 T48/T51, `func_80135260` — the fleet-wide half)  <sub>L7307</sub>
-- **§104** — Two silent-skip defects in one scan: match on MASKED text, emit from the ORIGINAL (Phase 29 T53, `gather_externs`)  <sub>L7395</sub>
-- **§112** — A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69, `audit_header_sigs.py`)  <sub>L7730</sub>
-- **§113** — An ARITY blocker only exists if the macro CALLS the function; an address-taken use has no call site (Phase 29 T72)  <sub>L7776</sub>
-- **§114** — The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29 T76/T77)  <sub>L7808</sub>
-- **§3-Do** — NOT "strip the duplicate typedef" — it breaks the extern that uses it  <sub>L8037</sub>
-- **§121** — Synthesise externs for macro-DEFINED callees from the macro's own definition head (Phase 29 T95)  <sub>L8061</sub>
-- **§3-The** — declaration surface (integration, not codegen)  <sub>L8941</sub>
-- **§136f** — Two declaration sub-cases the reconcile lane surfaced (lane now 15/15 lifetime)  <sub>L9186</sub>
-- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9415</sub>
-- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9565</sub>
-- **§141** — The §134 class is CLOSED: every line-shape decision now routes through `cdecl._mask` (P30 S39)  <sub>L9740</sub>
-- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9834</sub>
-- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10068</sub>
-- **§159** — THE DECLARATION AXIS: conform to byte-truth, and make every guard state its COVERAGE (P30 S47; ~10,930 sites across 8 axes, fleet byte-identical)  <sub>L10828</sub>
-- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16224</sub>
-- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16922</sub>
-- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17961</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18807</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18847</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19016</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19117</sub>
-- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19723</sub>
-- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19836</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19884</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20010</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20062</sub>
-- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20110</sub>
-- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20512</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21033</sub>
-- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21099</sub>
-- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21158</sub>
-- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21321</sub>
-- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21449</sub>
-- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21705</sub>
-- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21838</sub>
-- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22202</sub>
-- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22514</sub>
-- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22616</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22738</sub>
-- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22898</sub>
-- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23386</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23680</sub>
-- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23932</sub>
-- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24347</sub>
-- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24576</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24886</sub>
-- **ADD-10** — → §237 addendum (arity-evidence paragraph) — AN `la` PAIR ABOVE THE PROLOGUE `sw $ra` IS AN OUTGOING-ARGUMENT MATERIALISATION  <sub>L25184</sub>
-- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25326</sub>
-- **§272** — The `(void)`-decl + empty-call wall: K&R the DEFINITION, not just the decls (P31 S59)  <sub>L25558</sub>
-- **ADDENDUM** — to §20 — a global declared as `T *` may itself BE the array base, not a pointer to dereference  <sub>L25779</sub>
-- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26059</sub>
-- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26915</sub>
-- **ADDENDUM** — to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not only a function-vs-function prototype clash  <sub>L27162</sub>
-- **ADDENDUM** — §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWER BOUND FROM ITS OWN `.s` STACK-ARGUMENT READS, NOT FROM ANY SINGLE CALL SITE  <sub>L28285</sub>
-- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29049</sub>
-- **§292** — DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPLICIT (K&R) DECLARATION CAN SILENTLY REPROTOTYPE THE SIBLING'S OWN CALL SITE (P31 S60; waves #, byte-proven)  <sub>L29065</sub>
+- **§41b** — addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25 T7-M4, 2026-07-10)  <sub>L2873</sub>
+- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2893</sub>
+- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3210</sub>
+- **§51g** — When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`)  <sub>L3784</sub>
+- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4178</sub>
+- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4202</sub>
+- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4247</sub>
+- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4271</sub>
+- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4560</sub>
+- **§63** — The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`, Phase 29 SESSION-13, 2026-07-23)  <sub>L4892</sub>
+- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5015</sub>
+- **§65c** — `rtu_match` MATCH → bank held 13/13 on self-decl, but broke on the FIRST callee-decl case  <sub>L5096</sub>
+- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5154</sub>
+- **§66a** — The widest write in a pipeline is the one most likely to be UNDECLARED  <sub>L5196</sub>
+- **§68** — A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase 29 SESSION-18)  <sub>L5539</sub>
+- **§73** — A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at each use, T0). Diagnose which before paying for the expensive one (Phase 29 SESSION-19, `func_8014F3E8` + `func_8014D4C0`)  <sub>L5798</sub>
+- **§75** — A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the carried extern before believing the exclusion message (Phase 29 SESSION-19, `func_8014F3E8` ×4 → ×138)  <sub>L5881</sub>
+- **§75b** — A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the externs (Phase 29 SESSION-19, `func_80165CA0` ×3 → fleet)  <sub>L5963</sub>
+- **§75c** — Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix moves the error and looks like a new wall (Phase 29 SESSION-19, `func_8012F14C`)  <sub>L6012</sub>
+- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6043</sub>
+- **§79** — For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT ORDER is a declaration-order oracle (Phase 29 SESSION-19, `func_8017BF14` 4,763 ins, cold start → 45/4763)  <sub>L6235</sub>
+- **§3-NEW** — LEVER — the frame layout reads back the original declaration order  <sub>L6255</sub>
+- **§3-1.** — The inlined-helper signature  <sub>L6390</sub>
+- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6906</sub>
+- **§95** — `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 SESSION-21, `func_80176218`)  <sub>L6998</sub>
+- **§96** — The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so every COMMENTED declaration was silently skipped (Phase 29 SESSION-22, `func_80176218` banked)  <sub>L7033</sub>
+- **§98** — `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION-22, `func_8014CF04`)  <sub>L7128</sub>
+- **§99** — The narrow-param wall is a DEF-side problem with a ZERO-blast-radius fix: convert the definition to K&R (Phase 29 SESSION-22, `func_80175AB8` + `func_80175DA8`)  <sub>L7182</sub>
+- **§102** — A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSION-22, `func_8016EC0C`)  <sub>L7287</sub>
+- **§103** — A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER function; move the DECL, not the draft (Phase 29 T48/T51, `func_80135260` — the fleet-wide half)  <sub>L7322</sub>
+- **§104** — Two silent-skip defects in one scan: match on MASKED text, emit from the ORIGINAL (Phase 29 T53, `gather_externs`)  <sub>L7410</sub>
+- **§112** — A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69, `audit_header_sigs.py`)  <sub>L7745</sub>
+- **§113** — An ARITY blocker only exists if the macro CALLS the function; an address-taken use has no call site (Phase 29 T72)  <sub>L7791</sub>
+- **§114** — The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29 T76/T77)  <sub>L7823</sub>
+- **§3-Do** — NOT "strip the duplicate typedef" — it breaks the extern that uses it  <sub>L8052</sub>
+- **§121** — Synthesise externs for macro-DEFINED callees from the macro's own definition head (Phase 29 T95)  <sub>L8076</sub>
+- **§3-The** — declaration surface (integration, not codegen)  <sub>L8956</sub>
+- **§136f** — Two declaration sub-cases the reconcile lane surfaced (lane now 15/15 lifetime)  <sub>L9201</sub>
+- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9430</sub>
+- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9580</sub>
+- **§141** — The §134 class is CLOSED: every line-shape decision now routes through `cdecl._mask` (P30 S39)  <sub>L9755</sub>
+- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9849</sub>
+- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10083</sub>
+- **§159** — THE DECLARATION AXIS: conform to byte-truth, and make every guard state its COVERAGE (P30 S47; ~10,930 sites across 8 axes, fleet byte-identical)  <sub>L10843</sub>
+- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16239</sub>
+- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16937</sub>
+- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17976</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18822</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18862</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19031</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19132</sub>
+- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19738</sub>
+- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19851</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19899</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20025</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20077</sub>
+- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20125</sub>
+- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20527</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21048</sub>
+- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21114</sub>
+- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21173</sub>
+- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21336</sub>
+- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21464</sub>
+- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21720</sub>
+- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21853</sub>
+- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22217</sub>
+- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22529</sub>
+- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22631</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22753</sub>
+- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22913</sub>
+- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23401</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23695</sub>
+- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23947</sub>
+- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24362</sub>
+- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24591</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24901</sub>
+- **ADD-10** — → §237 addendum (arity-evidence paragraph) — AN `la` PAIR ABOVE THE PROLOGUE `sw $ra` IS AN OUTGOING-ARGUMENT MATERIALISATION  <sub>L25199</sub>
+- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25341</sub>
+- **§272** — The `(void)`-decl + empty-call wall: K&R the DEFINITION, not just the decls (P31 S59)  <sub>L25573</sub>
+- **ADDENDUM** — to §20 — a global declared as `T *` may itself BE the array base, not a pointer to dereference  <sub>L25794</sub>
+- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26074</sub>
+- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26930</sub>
+- **ADDENDUM** — to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not only a function-vs-function prototype clash  <sub>L27177</sub>
+- **ADDENDUM** — §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWER BOUND FROM ITS OWN `.s` STACK-ARGUMENT READS, NOT FROM ANY SINGLE CALL SITE  <sub>L28300</sub>
+- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29064</sub>
+- **§292** — DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPLICIT (K&R) DECLARATION CAN SILENTLY REPROTOTYPE THE SIBLING'S OWN CALL SITE (P31 S60; waves #, byte-proven)  <sub>L29080</sub>
 
 ### jump tables & switches  (46)
 
@@ -585,46 +588,46 @@
 - **§8b** — MULTI-jtbl per overlay — the `ld_interleave --order` sandwich + the same-subseg cases (Phase 26 session 4)  <sub>L404</sub>
 - **§8e** — The jtbl ALIGNMENT LAW + the pad-spec filter — multi-table .rodata spans (Phase 29, byte-proven; `.run/probe_jtbl/verdict.md`)  <sub>L530</sub>
 - **§3-The** — clean object-level metric (use this, not the permuter score, for jtbl/rodata functions)  <sub>L844</sub>
-- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2809</sub>
-- **§48** — The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, Ultracode, 9/12 MATCH first pass)  <sub>L3405</sub>
-- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4028</sub>
-- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4658</sub>
-- **§61c** — The jtbl bank is INCREMENTALLY valid and CLEAN-INVALID (Phase 29, 2026-07-21) — the blocking finding  <sub>L4713</sub>
-- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4833</sub>
-- **§81** — Banking a jr (jump-table) function: the 3-step carve chain, and why `match_one` cannot see the problem (Phase 29 SESSION-19, `func_8017C954`)  <sub>L6323</sub>
-- **§88d** — BANKING ORDER: run the §81 carve chain BEFORE banking, never after  <sub>L6701</sub>
-- **§97** — The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that captured a dirty tree (Phase 29 SESSION-22)  <sub>L7066</sub>
-- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7431</sub>
-- **§125** — Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA from a CLEAN tree (P30 SESSION-28; **this section's first draft was WRONG and the method caught it**)  <sub>L8206</sub>
-- **§126** — The carve-within-a-carve: an ADDRESS RANGE is not an OPTIMIZATION REGION (P30 T2, byte-proven end-to-end)  <sub>L8264</sub>
-- **§129** — Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must never be committed without its owner (P30 S28, `func_8013BD74`)  <sub>L8437</sub>
-- **§129a** — the target instruction count is INFLATED after a carve  <sub>L8441</sub>
-- **§129b** — never commit a carve whose owner is still a stub (it strands the carve)  <sub>L8462</sub>
-- **§130** — An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LINK (P30 S28, the jr pair)  <sub>L8486</sub>
-- **§131** — The jtbl OVER-SPAN: `sltiu N` is ground truth in BOTH directions, and the zero-word rule only guards one (P30 S28, `func_80191C50`)  <sub>L8533</sub>
-- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8570</sub>
-- **§132b** — When the span's already-matched owner is ITSELF multi-switch: `--span-rel` (P30 S1, `func_8014032C`)  <sub>L8660</sub>
-- **§139** — A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not survive a carve (P30 S38, wave 6: 10 of 16 drafts vanished)  <sub>L9594</sub>
-- **§161** — THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47)  <sub>L10969</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17532</sub>
-- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18176</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21033</sub>
-- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22112</sub>
-- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22794</sub>
-- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23180</sub>
-- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24073</sub>
-- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24477</sub>
-- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24772</sub>
-- **ADDENDUM** — to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT AS A FILE-SCOPE `__asm__` BLOB  <sub>L26181</sub>
-- **ADDENDUM** — §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE A SWITCH DISPATCH CAN BE PLAIN NESTED `if`s WHOSE SHARED BODY WAS TRIPLICATED BY THE SOURCE AND THEN CROSS-JUMP-MERGED BACK DOWN  <sub>L28182</sub>
-- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28252</sub>
-- **§295** — THE KERNEL-TRAP STUB: §81's jr-DETECTOR WITHOUT A TABLE IS A PsyQ SYSCALL TRAMPOLINE — ROUTE TO §265, NEVER INTO THE CARVE CHAIN (P31 S61; wave m0a, 9 cards byte-proven; resolves §182's held cluster)  <sub>L29360</sub>
-- **§298** — THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUPLICATED STATEMENTS, NOT A HOISTED POST-SWITCH STATEMENT (P31 S61; waves g0e/g0f, `func_80181B68`, ov_SC06_016, byte-proven 68/68)  <sub>L29501</sub>
-- **§302** — A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO DERIVE EACH FROM THE BYTES (P31 S62 T2; five reds healed in one session, 5/5, +39 held banks)  <sub>L29678</sub>
-- **§304** — SELF-DEFINING RODATA: WHEN A FUNCTION'S `.s` IS THE ONLY OWNER OF THE DATA IT REFERENCES, THE C BODY MUST DEFINE IT (P31 S62 T3; byte-proven md_MAIN_011/func_800D04F4)  <sub>L29758</sub>
-- **§305** — "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE (P31 S62 T3; 28 resolver drafts autopsied 28/28)  <sub>L29781</sub>
-- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29971</sub>
+- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2824</sub>
+- **§48** — The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, Ultracode, 9/12 MATCH first pass)  <sub>L3420</sub>
+- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4043</sub>
+- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4673</sub>
+- **§61c** — The jtbl bank is INCREMENTALLY valid and CLEAN-INVALID (Phase 29, 2026-07-21) — the blocking finding  <sub>L4728</sub>
+- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4848</sub>
+- **§81** — Banking a jr (jump-table) function: the 3-step carve chain, and why `match_one` cannot see the problem (Phase 29 SESSION-19, `func_8017C954`)  <sub>L6338</sub>
+- **§88d** — BANKING ORDER: run the §81 carve chain BEFORE banking, never after  <sub>L6716</sub>
+- **§97** — The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that captured a dirty tree (Phase 29 SESSION-22)  <sub>L7081</sub>
+- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7446</sub>
+- **§125** — Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA from a CLEAN tree (P30 SESSION-28; **this section's first draft was WRONG and the method caught it**)  <sub>L8221</sub>
+- **§126** — The carve-within-a-carve: an ADDRESS RANGE is not an OPTIMIZATION REGION (P30 T2, byte-proven end-to-end)  <sub>L8279</sub>
+- **§129** — Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must never be committed without its owner (P30 S28, `func_8013BD74`)  <sub>L8452</sub>
+- **§129a** — the target instruction count is INFLATED after a carve  <sub>L8456</sub>
+- **§129b** — never commit a carve whose owner is still a stub (it strands the carve)  <sub>L8477</sub>
+- **§130** — An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LINK (P30 S28, the jr pair)  <sub>L8501</sub>
+- **§131** — The jtbl OVER-SPAN: `sltiu N` is ground truth in BOTH directions, and the zero-word rule only guards one (P30 S28, `func_80191C50`)  <sub>L8548</sub>
+- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8585</sub>
+- **§132b** — When the span's already-matched owner is ITSELF multi-switch: `--span-rel` (P30 S1, `func_8014032C`)  <sub>L8675</sub>
+- **§139** — A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not survive a carve (P30 S38, wave 6: 10 of 16 drafts vanished)  <sub>L9609</sub>
+- **§161** — THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47)  <sub>L10984</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17547</sub>
+- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18191</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21048</sub>
+- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22127</sub>
+- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22809</sub>
+- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23195</sub>
+- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24088</sub>
+- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24492</sub>
+- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24787</sub>
+- **ADDENDUM** — to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT AS A FILE-SCOPE `__asm__` BLOB  <sub>L26196</sub>
+- **ADDENDUM** — §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE A SWITCH DISPATCH CAN BE PLAIN NESTED `if`s WHOSE SHARED BODY WAS TRIPLICATED BY THE SOURCE AND THEN CROSS-JUMP-MERGED BACK DOWN  <sub>L28197</sub>
+- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28267</sub>
+- **§295** — THE KERNEL-TRAP STUB: §81's jr-DETECTOR WITHOUT A TABLE IS A PsyQ SYSCALL TRAMPOLINE — ROUTE TO §265, NEVER INTO THE CARVE CHAIN (P31 S61; wave m0a, 9 cards byte-proven; resolves §182's held cluster)  <sub>L29375</sub>
+- **§298** — THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUPLICATED STATEMENTS, NOT A HOISTED POST-SWITCH STATEMENT (P31 S61; waves g0e/g0f, `func_80181B68`, ov_SC06_016, byte-proven 68/68)  <sub>L29516</sub>
+- **§302** — A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO DERIVE EACH FROM THE BYTES (P31 S62 T2; five reds healed in one session, 5/5, +39 held banks)  <sub>L29693</sub>
+- **§304** — SELF-DEFINING RODATA: WHEN A FUNCTION'S `.s` IS THE ONLY OWNER OF THE DATA IT REFERENCES, THE C BODY MUST DEFINE IT (P31 S62 T3; byte-proven md_MAIN_011/func_800D04F4)  <sub>L29773</sub>
+- **§305** — "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE (P31 S62 T3; 28 resolver drafts autopsied 28/28)  <sub>L29796</sub>
+- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29986</sub>
 
 ### optimisation level (-O0/-O2)  (18)
 
@@ -634,18 +637,18 @@
 - **§18** — Per-file `-O0` split inside an overlay/blob (Phase 19 T1)  <sub>L1519</sub>
 - **§38** — The WHALE `func_80144B9C` (770 ins): the -O0 struct-assign memcpy idiom + the -O0 reach-134 ×134 rollout (Phase 24 T7 §G, cheap Opus — no Fable5, no calls.c)  <sub>L2527</sub>
 - **§39** — The ×1→×134 giant-endgame: propagate a matched **-O2** giant via the NATIVE DEFINE-macro path (Phase 24 T7 §G close, 2026-07-08)  <sub>L2537</sub>
-- **§116** — Optimization level is a property of the FILE, not the function: read a family 0/N against the member's stub HOME (Phase 29 T79)  <sub>L7877</sub>
-- **§3-The** — finding: opt level is per FILE, so the file's contents must be opt-HOMOGENEOUS  <sub>L8279</sub>
-- **§127** — The `-O0` regime: the CONSTANT-OFFSET FOLD, and why `-O0` needs its own idiom set (P30 T3 wave, 15 targets)  <sub>L8349</sub>
-- **§3-The** — rest of the `-O0` regime (write PLAIN C, and mean it)  <sub>L8367</sub>
-- **§127a** — §71 (sibling-first) is the strongest `-O0` lever, and it beats the index  <sub>L8377</sub>
-- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8570</sub>
-- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20266</sub>
-- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24808</sub>
-- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24834</sub>
-- **§265** — THE VERBATIM-ASM BANK LANE: A FUNCTION NO -O2 C CAN EVER MATCH BANKS AS A RAW `__asm__` BODY (P31 S59b; two banked cards, two in-tree precedents)  <sub>L24977</sub>
-- **ADDENDUM** — to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the index being constant  <sub>L29129</sub>
-- **ADDENDUM** — to §261a — FOUR MORE -O0 DIALS BEYOND THE RELOAD COUNT (boot.c + md_MAIN_011/003, wave m0a/g0a/g0f, byte-proven)  <sub>L29157</sub>
+- **§116** — Optimization level is a property of the FILE, not the function: read a family 0/N against the member's stub HOME (Phase 29 T79)  <sub>L7892</sub>
+- **§3-The** — finding: opt level is per FILE, so the file's contents must be opt-HOMOGENEOUS  <sub>L8294</sub>
+- **§127** — The `-O0` regime: the CONSTANT-OFFSET FOLD, and why `-O0` needs its own idiom set (P30 T3 wave, 15 targets)  <sub>L8364</sub>
+- **§3-The** — rest of the `-O0` regime (write PLAIN C, and mean it)  <sub>L8382</sub>
+- **§127a** — §71 (sibling-first) is the strongest `-O0` lever, and it beats the index  <sub>L8392</sub>
+- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8585</sub>
+- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20281</sub>
+- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24823</sub>
+- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24849</sub>
+- **§265** — THE VERBATIM-ASM BANK LANE: A FUNCTION NO -O2 C CAN EVER MATCH BANKS AS A RAW `__asm__` BODY (P31 S59b; two banked cards, two in-tree precedents)  <sub>L24992</sub>
+- **ADDENDUM** — to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the index being constant  <sub>L29144</sub>
+- **ADDENDUM** — to §261a — FOUR MORE -O0 DIALS BEYOND THE RELOAD COUNT (boot.c + md_MAIN_011/003, wave m0a/g0a/g0f, byte-proven)  <sub>L29172</sub>
 
 ### family propagation & sweeps  (109)
 
@@ -672,92 +675,92 @@
 - **§40a** — The DECL-RECONCILE pass (type-lift so remapped drafts compile in the sibling TU) (Phase 25 T7.2, 2026-07-08)  <sub>L2601</sub>
 - **§40b** — The reloc-tracker blind spot: the indexed-global idiom that hid the "reach-1 tail" (Phase 26 Task 1, 2026-07-11, byte-verified V0/V1)  <sub>L2634</sub>
 - **§40c** — The h_seq per-sibling reconcile: templating a reconcile-class crack ×134 (Phase 26 Task 8, 2026-07-12, byte-proven)  <sub>L2676</sub>
-- **§41c** — T7-M2: the ×134 def-side-wall sweep via per-sibling RE-reconcile (Phase 25, 2026-07-10; 4,389 banks, ~0 agent tokens)  <sub>L2839</sub>
-- **§42** — The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 25 T7 F-band, 2026-07-10; Ultracode 9-worker wave, 4/9 banked byte-identical, 266 swept ×134)  <sub>L2900</sub>
-- **§42e** — propagating a CRACK ×134: the def-finder bug + the byte-drift residual (the "remap-fail" misdiagnosis)  <sub>L3121</sub>
-- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3195</sub>
-- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3298</sub>
-- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3313</sub>
-- **§47** — The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm (Phase 26 session 8, Fable5 Max, byte-proven on `func_8017BEBC` 952 ins ×113)  <sub>L3365</sub>
-- **§49** — The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` (536 ins ×134), Phase 26 session 8  <sub>L3527</sub>
-- **§52** — The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wall (`func_80178004`, 165 ins ×134; Phase 26, Fable5, 2026-07-15)  <sub>L3913</sub>
-- **§3-The** — 6 levers (the "walker-family skeleton" — apply to the 12 siblings; levers 1-5 retire ~half the residual)  <sub>L3924</sub>
-- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4028</sub>
-- **§55c** — Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TREE ARTIFACT  <sub>L4141</sub>
-- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4163</sub>
-- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4187</sub>
-- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4232</sub>
-- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4256</sub>
-- **§57a** — Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026-07-18)  <sub>L4303</sub>
-- **§59** — Three h_seq sweep-residual classes match_one/the-exemplar-bank don't reveal (Phase 29 crack-wave close, 2026-07-18)  <sub>L4377</sub>
-- **§3-Two** — corollaries worth remembering  <sub>L4450</sub>
-- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5030</sub>
-- **§3-Giv** — record order (the §70 family)  <sub>L5760</sub>
-- **§75** — A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the carried extern before believing the exclusion message (Phase 29 SESSION-19, `func_8014F3E8` ×4 → ×138)  <sub>L5866</sub>
-- **§75a** — The exclusion classes, enumerated with named causes (Phase 29 SESSION-19, the 134-binary `dedup_extend` sweep)  <sub>L5925</sub>
-- **§75b** — A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the externs (Phase 29 SESSION-19, `func_80165CA0` ×3 → fleet)  <sub>L5948</sub>
-- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6028</sub>
-- **§77** — Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silently caps the body's reach. Diff the preamble before you gate. (Phase 29 SESSION-19 — three variants in one session, two different tools)  <sub>L6084</sub>
-- **§84** — The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between two per-overlay symbols, and why `match_one` is structurally blind to it (Phase 29 SESSION-20, `func_8013D53C`)  <sub>L6472</sub>
-- **§86** — Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §42e pin guard is now over-conservative (Phase 29 SESSION-20)  <sub>L6589</sub>
-- **§3-THE** — LAW: all-or-nothing PER FAMILY  <sub>L6600</sub>
-- **§3-Why** — the two live families differ from the three dead ones — the open question  <sub>L6627</sub>
-- **§3-The** — cheap discriminator, before spending a sweep  <sub>L6666</sub>
-- **§89b** — the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel.py`)  <sub>L6745</sub>
-- **§91** — A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap (Phase 29 SESSION-21, `func_8012AAAC` ×137)  <sub>L6842</sub>
-- **§94** — A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's local types, ALL of them, transitively (Phase 29 SESSION-21, `func_8016B6BC` 0/137 → 137/137)  <sub>L6947</sub>
-- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7431</sub>
-- **§107** — A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `func_80144090` 0/136 → 136/136)  <sub>L7513</sub>
-- **§108** — Diagnosing a family `0/N`: the four causes, and the third opt-in lever (Phase 29 T59)  <sub>L7551</sub>
-- **§111** — The distinct-code metric is not noisy: a family pays it only if its members are byte-VARIANT (Phase 29 T66)  <sub>L7681</sub>
-- **§116** — Optimization level is a property of the FILE, not the function: read a family 0/N against the member's stub HOME (Phase 29 T79)  <sub>L7877</sub>
-- **§123** — PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its refusals are statements about the TOOL (P30 wave 1, 2026-07-30)  <sub>L8116</sub>
-- **§124** — A "not matched" verdict can mean the definition is there under a DIFFERENT C NAME: the asm-label alias blind spot (P30 SESSION-28, `func_8016191C` ×137)  <sub>L8153</sub>
-- **§124a** — a family sweep's `0 matched-exemplar families` may be a FILTER, not a wall  <sub>L8198</sub>
-- **§134** — MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P30 S6, 190 zero-crack families)  <sub>L8711</sub>
-- **§136c** — SIBLING-FIRST is a DERIVATION shortcut, not just a conflict fix (the fastest route in a family wave)  <sub>L9069</sub>
-- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9415</sub>
-- **§142** — An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do not gate a draft. (P30 S39, +7,710 ins in two commands)  <sub>L9778</sub>
-- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9834</sub>
-- **Then** — propagation returned 0/137 TWICE — both times a missing TYPE  <sub>L10000</sub>
-- **§3-A.** — The frame has THREE strata, and stratum 3 is unreachable from C  <sub>L10041</sub>
-- **§3-E.** — A `qty_compare` TIE is not spelling-reachable — recognise it and stop  <sub>L10083</sub>
-- **Consequence** — for the family (a real scheduling decision)  <sub>L10095</sub>
-- **§150** — A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocator tie (P30 S43, `func_8017C6F4`, 947 ins ×4)  <sub>L10312</sub>
-- **§151** — THE GHOST WEDGE: when a load-before-store transposition is unreachable by ANY statement order (P30 S43, `func_8017EF68`, 969 ins)  <sub>L10367</sub>
-- **When** — to reach for it  <sub>L10407</sub>
-- **§152** — BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC family: 1 crack → 12 overlays → 11,364 ins)  <sub>L10418</sub>
-- **§156** — an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7)  <sub>L10640</sub>
-- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10893</sub>
-- **§162** — S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 targets  <sub>L11014</sub>
-- **§163z** — THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass)  <sub>L11828</sub>
-- **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014)  <sub>L14355</sub>
-- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16224</sub>
-- **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16433</sub>
-- **§171b** — THREE CARRIES THE MECHANICAL DRAFT NEEDS (P30 S50, banking the top-reach families)  <sub>L16483</sub>
-- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17310</sub>
-- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18652</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19158</sub>
-- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19952</sub>
-- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20767</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21486</sub>
-- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22934</sub>
-- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24158</sub>
-- **§3-1a.** — The §266 sweep — every solo-lever A/B run for this batch  <sub>L25485</sub>
-- **ADDENDUM** — to §179-D (GTE macro reference family) — `gte_SetRotMatrix`/`gte_SetTransMatrix` bodies  <sub>L25676</sub>
-- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25702</sub>
-- **ADDENDUM** — to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads the wrong register"  <sub>L25740</sub>
-- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L26995</sub>
-- **ADDENDUM** — to the zero-byte-asm-slider family (§47 / §148-C / §153) (func_800CB874, md_MAIN_040 — wave dj; open tension with a more cautious dm-wave card — see closing)  <sub>L27914</sub>
-- **ADDENDUM** — the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_800CB900, md_MAIN_026)  <sub>L28124</sub>
-- **ADDENDUM** — §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWER BOUND FROM ITS OWN `.s` STACK-ARGUMENT READS, NOT FROM ANY SINGLE CALL SITE  <sub>L28285</sub>
-- **ADDENDUM** — to §199-F family (func_8017EFB0, ov_SC02_021, wave cu)  <sub>L28437</sub>
-- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29045</sub>
-- **ADDENDUM** — to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the index being constant  <sub>L29129</sub>
-- **§296** — THE FRAME CHECK OUTRANKS THE ATLAS LEVER: READ PROLOGUE/EPILOGUE BEFORE DRAFTING ANY C — A REAL TELL CAN LIVE INSIDE AN UNREACHABLE FRAGMENT (P31 S61; wave m0a, 16 cards byte-proven; extends §179-C)  <sub>L29415</sub>
-- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29458</sub>
-- **§307** — THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHEDULER-INTERNAL, AND NO SOURCE ORDER REACHES IT (P31 S63; byte-evidenced NEGATIVE result, main wave)  <sub>L29898</sub>
-- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29971</sub>
+- **§41c** — T7-M2: the ×134 def-side-wall sweep via per-sibling RE-reconcile (Phase 25, 2026-07-10; 4,389 banks, ~0 agent tokens)  <sub>L2854</sub>
+- **§42** — The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 25 T7 F-band, 2026-07-10; Ultracode 9-worker wave, 4/9 banked byte-identical, 266 swept ×134)  <sub>L2915</sub>
+- **§42e** — propagating a CRACK ×134: the def-finder bug + the byte-drift residual (the "remap-fail" misdiagnosis)  <sub>L3136</sub>
+- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3210</sub>
+- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3313</sub>
+- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3328</sub>
+- **§47** — The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm (Phase 26 session 8, Fable5 Max, byte-proven on `func_8017BEBC` 952 ins ×113)  <sub>L3380</sub>
+- **§49** — The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` (536 ins ×134), Phase 26 session 8  <sub>L3542</sub>
+- **§52** — The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wall (`func_80178004`, 165 ins ×134; Phase 26, Fable5, 2026-07-15)  <sub>L3928</sub>
+- **§3-The** — 6 levers (the "walker-family skeleton" — apply to the 12 siblings; levers 1-5 retire ~half the residual)  <sub>L3939</sub>
+- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4043</sub>
+- **§55c** — Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TREE ARTIFACT  <sub>L4156</sub>
+- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4178</sub>
+- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4202</sub>
+- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4247</sub>
+- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4271</sub>
+- **§57a** — Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026-07-18)  <sub>L4318</sub>
+- **§59** — Three h_seq sweep-residual classes match_one/the-exemplar-bank don't reveal (Phase 29 crack-wave close, 2026-07-18)  <sub>L4392</sub>
+- **§3-Two** — corollaries worth remembering  <sub>L4465</sub>
+- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5045</sub>
+- **§3-Giv** — record order (the §70 family)  <sub>L5775</sub>
+- **§75** — A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the carried extern before believing the exclusion message (Phase 29 SESSION-19, `func_8014F3E8` ×4 → ×138)  <sub>L5881</sub>
+- **§75a** — The exclusion classes, enumerated with named causes (Phase 29 SESSION-19, the 134-binary `dedup_extend` sweep)  <sub>L5940</sub>
+- **§75b** — A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the externs (Phase 29 SESSION-19, `func_80165CA0` ×3 → fleet)  <sub>L5963</sub>
+- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6043</sub>
+- **§77** — Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silently caps the body's reach. Diff the preamble before you gate. (Phase 29 SESSION-19 — three variants in one session, two different tools)  <sub>L6099</sub>
+- **§84** — The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between two per-overlay symbols, and why `match_one` is structurally blind to it (Phase 29 SESSION-20, `func_8013D53C`)  <sub>L6487</sub>
+- **§86** — Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §42e pin guard is now over-conservative (Phase 29 SESSION-20)  <sub>L6604</sub>
+- **§3-THE** — LAW: all-or-nothing PER FAMILY  <sub>L6615</sub>
+- **§3-Why** — the two live families differ from the three dead ones — the open question  <sub>L6642</sub>
+- **§3-The** — cheap discriminator, before spending a sweep  <sub>L6681</sub>
+- **§89b** — the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel.py`)  <sub>L6760</sub>
+- **§91** — A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap (Phase 29 SESSION-21, `func_8012AAAC` ×137)  <sub>L6857</sub>
+- **§94** — A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's local types, ALL of them, transitively (Phase 29 SESSION-21, `func_8016B6BC` 0/137 → 137/137)  <sub>L6962</sub>
+- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7446</sub>
+- **§107** — A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `func_80144090` 0/136 → 136/136)  <sub>L7528</sub>
+- **§108** — Diagnosing a family `0/N`: the four causes, and the third opt-in lever (Phase 29 T59)  <sub>L7566</sub>
+- **§111** — The distinct-code metric is not noisy: a family pays it only if its members are byte-VARIANT (Phase 29 T66)  <sub>L7696</sub>
+- **§116** — Optimization level is a property of the FILE, not the function: read a family 0/N against the member's stub HOME (Phase 29 T79)  <sub>L7892</sub>
+- **§123** — PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its refusals are statements about the TOOL (P30 wave 1, 2026-07-30)  <sub>L8131</sub>
+- **§124** — A "not matched" verdict can mean the definition is there under a DIFFERENT C NAME: the asm-label alias blind spot (P30 SESSION-28, `func_8016191C` ×137)  <sub>L8168</sub>
+- **§124a** — a family sweep's `0 matched-exemplar families` may be a FILTER, not a wall  <sub>L8213</sub>
+- **§134** — MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P30 S6, 190 zero-crack families)  <sub>L8726</sub>
+- **§136c** — SIBLING-FIRST is a DERIVATION shortcut, not just a conflict fix (the fastest route in a family wave)  <sub>L9084</sub>
+- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9430</sub>
+- **§142** — An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do not gate a draft. (P30 S39, +7,710 ins in two commands)  <sub>L9793</sub>
+- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9849</sub>
+- **Then** — propagation returned 0/137 TWICE — both times a missing TYPE  <sub>L10015</sub>
+- **§3-A.** — The frame has THREE strata, and stratum 3 is unreachable from C  <sub>L10056</sub>
+- **§3-E.** — A `qty_compare` TIE is not spelling-reachable — recognise it and stop  <sub>L10098</sub>
+- **Consequence** — for the family (a real scheduling decision)  <sub>L10110</sub>
+- **§150** — A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocator tie (P30 S43, `func_8017C6F4`, 947 ins ×4)  <sub>L10327</sub>
+- **§151** — THE GHOST WEDGE: when a load-before-store transposition is unreachable by ANY statement order (P30 S43, `func_8017EF68`, 969 ins)  <sub>L10382</sub>
+- **When** — to reach for it  <sub>L10422</sub>
+- **§152** — BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC family: 1 crack → 12 overlays → 11,364 ins)  <sub>L10433</sub>
+- **§156** — an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7)  <sub>L10655</sub>
+- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10908</sub>
+- **§162** — S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 targets  <sub>L11029</sub>
+- **§163z** — THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass)  <sub>L11843</sub>
+- **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014)  <sub>L14370</sub>
+- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16239</sub>
+- **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16448</sub>
+- **§171b** — THREE CARRIES THE MECHANICAL DRAFT NEEDS (P30 S50, banking the top-reach families)  <sub>L16498</sub>
+- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17325</sub>
+- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18667</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19173</sub>
+- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19967</sub>
+- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20782</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21501</sub>
+- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22949</sub>
+- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24173</sub>
+- **§3-1a.** — The §266 sweep — every solo-lever A/B run for this batch  <sub>L25500</sub>
+- **ADDENDUM** — to §179-D (GTE macro reference family) — `gte_SetRotMatrix`/`gte_SetTransMatrix` bodies  <sub>L25691</sub>
+- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25717</sub>
+- **ADDENDUM** — to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads the wrong register"  <sub>L25755</sub>
+- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L27010</sub>
+- **ADDENDUM** — to the zero-byte-asm-slider family (§47 / §148-C / §153) (func_800CB874, md_MAIN_040 — wave dj; open tension with a more cautious dm-wave card — see closing)  <sub>L27929</sub>
+- **ADDENDUM** — the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_800CB900, md_MAIN_026)  <sub>L28139</sub>
+- **ADDENDUM** — §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWER BOUND FROM ITS OWN `.s` STACK-ARGUMENT READS, NOT FROM ANY SINGLE CALL SITE  <sub>L28300</sub>
+- **ADDENDUM** — to §199-F family (func_8017EFB0, ov_SC02_021, wave cu)  <sub>L28452</sub>
+- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29060</sub>
+- **ADDENDUM** — to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the index being constant  <sub>L29144</sub>
+- **§296** — THE FRAME CHECK OUTRANKS THE ATLAS LEVER: READ PROLOGUE/EPILOGUE BEFORE DRAFTING ANY C — A REAL TELL CAN LIVE INSIDE AN UNREACHABLE FRAGMENT (P31 S61; wave m0a, 16 cards byte-proven; extends §179-C)  <sub>L29430</sub>
+- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29473</sub>
+- **§307** — THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHEDULER-INTERNAL, AND NO SOURCE ORDER REACHES IT (P31 S63; byte-evidenced NEGATIVE result, main wave)  <sub>L29913</sub>
+- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29986</sub>
 
 ### integration / TU plumbing  (60)
 
@@ -772,55 +775,55 @@
 - **§28d** — The "macro-extern-injection" lever: freeing reach-134 inline matches dedup_propagate skips as "not self-contained" (Phase 23, `tools/inject_capped_externs.py`)  <sub>L2366</sub>
 - **§30a** — §30 generalizes to the FULL near-miss backlog (via STANDARD Opus agents, not just Fable5) + 2 more steer levers + the mechanical-integration throughput unlock (Phase 23 (a))  <sub>L2394</sub>
 - **§40a** — The DECL-RECONCILE pass (type-lift so remapped drafts compile in the sibling TU) (Phase 25 T7.2, 2026-07-08)  <sub>L2601</sub>
-- **§42a** — addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-assign fix, +5 levers (2026-07-10b)  <sub>L2953</sub>
-- **§42c** — addendum — wave 3 (Max orchestrator + CORRECTED Ultracode fan-out, 2026-07-10c): the real-TU-faithful parallel harness (rtu_match) + 7/9 crack, ZERO iso-drift  <sub>L3033</sub>
-- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4187</sub>
-- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4545</sub>
-- **§61a** — The Task-5 wave: 11/12 MATCH, 0 banked — three DISTINCT integration walls, each now named (Phase 29, 2026-07-21)  <sub>L4606</sub>
-- **§63** — The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`, Phase 29 SESSION-13, 2026-07-23)  <sub>L4877</sub>
-- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5000</sub>
-- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5015</sub>
-- **§65b** — The escape: de-macroize the instantiation, don't touch the shared header  <sub>L5045</sub>
-- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5118</sub>
-- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5139</sub>
-- **§85** — The RETURN-axis fleet widen is ALL-OR-NOTHING: widening the shared header alone guarantees a conflict in the source overlay (Phase 29 SESSION-20, `func_8012CC88` / `func_8014D12C`)  <sub>L6539</sub>
-- **§95** — `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 SESSION-21, `func_80176218`)  <sub>L6983</sub>
-- **§96** — The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so every COMMENTED declaration was silently skipped (Phase 29 SESSION-22, `func_80176218` banked)  <sub>L7018</sub>
-- **§3-Two** — `reconcile_tu` bugs found underneath, one introduced while fixing the other  <sub>L7190</sub>
-- **§100** — Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a shared header (Phase 29 SESSION-22, `func_80175DA8` 0/137 → 137/137)  <sub>L7216</sub>
-- **§102** — A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSION-22, `func_8016EC0C`)  <sub>L7272</sub>
-- **§103** — A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER function; move the DECL, not the draft (Phase 29 T48/T51, `func_80135260` — the fleet-wide half)  <sub>L7307</sub>
-- **§109** — Conforming a definition to a shared header: fix the NAMES, then check the RETURN precondition (Phase 29 T60)  <sub>L7600</sub>
-- **§112** — A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69, `audit_header_sigs.py`)  <sub>L7730</sub>
-- **§114** — The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29 T76/T77)  <sub>L7808</sub>
-- **§3-The** — integration idioms (these decide whether a byte-correct draft BANKS)  <sub>L8804</sub>
-- **§3-The** — declaration surface (integration, not codegen)  <sub>L8941</sub>
-- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9565</sub>
-- **§3-The** — same swallow, twice more, in the integration spine  <sub>L9709</sub>
-- **§3-A.** — Payload word0 is a global MODULE ID; code starts after the header  <sub>L10527</sub>
-- **§162** — THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the body order (P30 S47, `ov_MAIN_012`)  <sub>L11143</sub>
-- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14915</sub>
-- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16629</sub>
-- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16826</sub>
-- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17842</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18060</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19158</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20222</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21099</sub>
-- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21158</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21486</sub>
-- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22328</sub>
-- **ADD-2** — → §42a addendum — A SHARED CONSTANT *NAMED IN A LOCAL* ACROSS A `jal` IS AN ISO→TU DRIFT HAZARD; WRITE BARE LITERALS  <sub>L25096</sub>
-- **ADD-3** — → §236, item 10 — THE UN-DELETED `INCLUDE_ASM` STUB IS A DUPLICATE DEFINITION  <sub>L25108</sub>
-- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25326</sub>
-- **§273** — A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59)  <sub>L25578</sub>
-- **ADDENDUM** — to §134 — a typedef defined BELOW the splice point is stripped anyway  <sub>L25646</sub>
-- **ADDENDUM** — to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT AS A FILE-SCOPE `__asm__` BLOB  <sub>L26181</sub>
-- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26915</sub>
-- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26916</sub>
-- **ADDENDUM** — to §199-G — A `default:` LABEL GROUPED ONTO THE LAST CASE REMOVES THE `j default` TAIL, EVEN THOUGH THE 2-NODE HEADER STAYS ALL-POSITIVE  <sub>L27370</sub>
-- **§301** — AN INTERNAL `j` CARRIES `R_MIPS_26 .text`: rtu/match_one "MATCH" COULD NOT SEE WHICH LABEL A `j` TAKES — FIXED (`jrel`), AND THE TWO DRAFT SHAPES IT HID (P31 S62 T1; byte-proven 2/2, negative-controlled over 3,297 stubs)  <sub>L29630</sub>
+- **§42a** — addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-assign fix, +5 levers (2026-07-10b)  <sub>L2968</sub>
+- **§42c** — addendum — wave 3 (Max orchestrator + CORRECTED Ultracode fan-out, 2026-07-10c): the real-TU-faithful parallel harness (rtu_match) + 7/9 crack, ZERO iso-drift  <sub>L3048</sub>
+- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4202</sub>
+- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4560</sub>
+- **§61a** — The Task-5 wave: 11/12 MATCH, 0 banked — three DISTINCT integration walls, each now named (Phase 29, 2026-07-21)  <sub>L4621</sub>
+- **§63** — The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`, Phase 29 SESSION-13, 2026-07-23)  <sub>L4892</sub>
+- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5015</sub>
+- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5030</sub>
+- **§65b** — The escape: de-macroize the instantiation, don't touch the shared header  <sub>L5060</sub>
+- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5133</sub>
+- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5154</sub>
+- **§85** — The RETURN-axis fleet widen is ALL-OR-NOTHING: widening the shared header alone guarantees a conflict in the source overlay (Phase 29 SESSION-20, `func_8012CC88` / `func_8014D12C`)  <sub>L6554</sub>
+- **§95** — `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 SESSION-21, `func_80176218`)  <sub>L6998</sub>
+- **§96** — The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so every COMMENTED declaration was silently skipped (Phase 29 SESSION-22, `func_80176218` banked)  <sub>L7033</sub>
+- **§3-Two** — `reconcile_tu` bugs found underneath, one introduced while fixing the other  <sub>L7205</sub>
+- **§100** — Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a shared header (Phase 29 SESSION-22, `func_80175DA8` 0/137 → 137/137)  <sub>L7231</sub>
+- **§102** — A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSION-22, `func_8016EC0C`)  <sub>L7287</sub>
+- **§103** — A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER function; move the DECL, not the draft (Phase 29 T48/T51, `func_80135260` — the fleet-wide half)  <sub>L7322</sub>
+- **§109** — Conforming a definition to a shared header: fix the NAMES, then check the RETURN precondition (Phase 29 T60)  <sub>L7615</sub>
+- **§112** — A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69, `audit_header_sigs.py`)  <sub>L7745</sub>
+- **§114** — The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29 T76/T77)  <sub>L7823</sub>
+- **§3-The** — integration idioms (these decide whether a byte-correct draft BANKS)  <sub>L8819</sub>
+- **§3-The** — declaration surface (integration, not codegen)  <sub>L8956</sub>
+- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9580</sub>
+- **§3-The** — same swallow, twice more, in the integration spine  <sub>L9724</sub>
+- **§3-A.** — Payload word0 is a global MODULE ID; code starts after the header  <sub>L10542</sub>
+- **§162** — THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the body order (P30 S47, `ov_MAIN_012`)  <sub>L11158</sub>
+- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14930</sub>
+- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16644</sub>
+- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16841</sub>
+- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17857</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18075</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19173</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20237</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21114</sub>
+- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21173</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21501</sub>
+- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22343</sub>
+- **ADD-2** — → §42a addendum — A SHARED CONSTANT *NAMED IN A LOCAL* ACROSS A `jal` IS AN ISO→TU DRIFT HAZARD; WRITE BARE LITERALS  <sub>L25111</sub>
+- **ADD-3** — → §236, item 10 — THE UN-DELETED `INCLUDE_ASM` STUB IS A DUPLICATE DEFINITION  <sub>L25123</sub>
+- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25341</sub>
+- **§273** — A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59)  <sub>L25593</sub>
+- **ADDENDUM** — to §134 — a typedef defined BELOW the splice point is stripped anyway  <sub>L25661</sub>
+- **ADDENDUM** — to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT AS A FILE-SCOPE `__asm__` BLOB  <sub>L26196</sub>
+- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26930</sub>
+- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26931</sub>
+- **ADDENDUM** — to §199-G — A `default:` LABEL GROUPED ONTO THE LAST CASE REMOVES THE `j default` TAIL, EVEN THOUGH THE 2-NODE HEADER STAYS ALL-POSITIVE  <sub>L27385</sub>
+- **§301** — AN INTERNAL `j` CARRIES `R_MIPS_26 .text`: rtu/match_one "MATCH" COULD NOT SEE WHICH LABEL A `j` TAKES — FIXED (`jrel`), AND THE TWO DRAFT SHAPES IT HID (P31 S62 T1; byte-proven 2/2, negative-controlled over 3,297 stubs)  <sub>L29645</sub>
 
 ### build graph, splat & the harness  (167)
 
@@ -864,133 +867,133 @@
 - **§37** — The T7 §G giant endgame: 6/8 cracked, meta-laws + transferable levers (Phase 24, 2026-07-07; FULL byte-verified detail + gcc-2.7.2 line cites in `docs/gcc-2.7.2-map/t7g-giant-harvest.md`)  <sub>L2506</sub>
 - **§39** — The ×1→×134 giant-endgame: propagate a matched **-O2** giant via the NATIVE DEFINE-macro path (Phase 24 T7 §G close, 2026-07-08)  <sub>L2537</sub>
 - **§41** — The DEF-SIDE canonical-sig wall: mechanically banking a drafted giant past `conflicting types` (Phase 25 T5b batch-2, 2026-07-09; `tools/canon_sig_reconcile.py`, byte-proven on `func_8013B274`)  <sub>L2710</sub>
-- **§41a** — v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that dissolve them (Phase 25 T6, Fable5, 2026-07-09)  <sub>L2754</sub>
-- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2809</sub>
-- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2878</sub>
-- **§42b** — addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cast drift + fix  <sub>L2994</sub>
-- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3298</sub>
-- **§51** — TOOLING INTEGRITY: the silent skip, and how to hunt it  <sub>L3630</sub>
-- **§51b** — Why the byte-gate cannot save you  <sub>L3652</sub>
-- **§51f** — Checklist for any new corpus-scanning tool  <sub>L3755</sub>
-- **§51g** — When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`)  <sub>L3769</sub>
-- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4028</sub>
-- **§55** — Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, 2026-07-17)  <sub>L4093</sub>
-- **§55b** — THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost)  <sub>L4122</sub>
-- **§55c** — Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TREE ARTIFACT  <sub>L4141</sub>
-- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4163</sub>
-- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4256</sub>
-- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4545</sub>
-- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4658</sub>
-- **§61d** — The undo was eating the tree: two tools, one defect, invisible to the byte-gate (Phase 29, 2026-07-22)  <sub>L4779</sub>
-- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4833</sub>
-- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5015</sub>
-- **§65d** — Existing-ladder baseline, measured (do this before building a recovery stage)  <sub>L5091</sub>
-- **§65e** — Two oracles, and the disagreement is the finding (R34 in practice)  <sub>L5101</sub>
-- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5118</sub>
-- **§66b** — A metric parsed out of another tool's prose goes NULL silently when the label changes  <sub>L5200</sub>
-- **§67a** — Run the symbol-set guard BEFORE you pay for a gate (`tools/symcheck.py`, Phase 29 SESSION-18)  <sub>L5405</sub>
-- **§77** — Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silently caps the body's reach. Diff the preamble before you gate. (Phase 29 SESSION-19 — three variants in one session, two different tools)  <sub>L6084</sub>
-- **§3-The** — CANDIDATE gate and the REAL gate need DIFFERENT preambles — keep the difference out of the bank  <sub>L6124</sub>
-- **§79** — For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT ORDER is a declaration-order oracle (Phase 29 SESSION-19, `func_8017BF14` 4,763 ins, cold start → 45/4763)  <sub>L6220</sub>
-- **§82** — Two source-shape oracles from behemoth #6: a duplicated `addiu $aN,$sp,K` across a `jal` means the block was INLINED, and scalar-vs-aggregate decides WHEN a stack slot is allocated (Phase 29 SESSION-19, `func_8017C730` 1,061 ins)  <sub>L6370</sub>
-- **§3-2.** — Scalar vs aggregate decides *when* the slot is allocated  <sub>L6389</sub>
-- **§3-Why** — it survived every candidate gate  <sub>L6495</sub>
-- **§3-THE** — FIX IS MECHANICAL — the tool already holds the answer  <sub>L6510</sub>
-- **§87** — `match_one` COMPILES but never LINKS, so an unresolvable data symbol reads as MATCH; and stored drafts go STALE against the tree (Phase 29 SESSION-20)  <sub>L6633</sub>
-- **§88f** — the missing rung: a RELOCATION gate between `match_one` and the binary  <sub>L6718</sub>
-- **§89a** — MEASURE the write set; do not assert its tier (`tools/blast_radius.py`)  <sub>L6732</sub>
-- **§89b** — the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel.py`)  <sub>L6745</sub>
-- **§90** — Five tool-integrity laws from one session, each of which changed an answer (Phase 29 SESSION-21, 2026-07-27)  <sub>L6766</sub>
-- **§90a** — A comparison tool MUST share its reference oracle's index space, exactly  <sub>L6772</sub>
-- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6891</sub>
-- **§97** — The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that captured a dirty tree (Phase 29 SESSION-22)  <sub>L7066</sub>
-- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7431</sub>
-- **§107** — A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `func_80144090` 0/136 → 136/136)  <sub>L7513</sub>
-- **§3-Why** — it survived so long: a MASKED oracle will MATCH a wrong symbol  <sub>L7953</sub>
-- **§122** — GATE RAW BEFORE TRANSFORMING; the undo belongs to the WRITER, as a per-edit journal (P30 T0a, 2026-07-30)  <sub>L8084</sub>
-- **§123** — PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its refusals are statements about the TOOL (P30 wave 1, 2026-07-30)  <sub>L8116</sub>
-- **§126a** — a bare `except: continue` around a coverage-asserting oracle re-creates the silent skip (P30 S28)  <sub>L8317</sub>
-- **§130** — An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LINK (P30 S28, the jr pair)  <sub>L8486</sub>
-- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8570</sub>
-- **§133** — The DEFAULT-FILTER class: three times in one session, a tool silently answered a narrower question than the one asked (P30 S1–S3)  <sub>L8685</sub>
-- **§134** — MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P30 S6, 190 zero-crack families)  <sub>L8711</sub>
-- **§3-The** — splitting/merging rules (each closed a residual, byte-gated)  <sub>L8853</sub>
-- **§137a** — A gate verdict has a TIMESTAMP; re-check it against the draft's mtime  <sub>L9386</sub>
-- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9415</sub>
-- **§134** — again, in a second tool — and the waiter rule corrected  <sub>L9526</sub>
-- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9565</sub>
-- **§139** — A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not survive a carve (P30 S38, wave 6: 10 of 16 drafts vanished)  <sub>L9594</sub>
-- **§140** — A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a phantom regression that gated the session's best lever)  <sub>L9660</sub>
-- **§142** — An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do not gate a draft. (P30 S39, +7,710 ins in two commands)  <sub>L9778</sub>
-- **§3-The** — measurement (do this before any wave; it is ~20 lines and needs no builds)  <sub>L9790</sub>
-- **§155b** — check the TYPE your oracle returns before comparing against it (S45 p5)  <sub>L10587</sub>
-- **§156** — an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7)  <sub>L10640</sub>
-- **§158** — The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S46 tier-3, `func_8017CE58`, 733 ins)  <sub>L10712</sub>
-- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10893</sub>
-- **§161** — THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47)  <sub>L10969</sub>
-- **§162** — S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 targets  <sub>L11014</sub>
-- **§163** — S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actionable  <sub>L11760</sub>
-- **§165** — S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed  <sub>L13702</sub>
-- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14915</sub>
-- **§167** — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point  <sub>L14971</sub>
-- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16865</sub>
-- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L16999</sub>
-- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17046</sub>
-- **§3-D.** — The measured cost shape, and what to build next  <sub>L17069</sub>
-- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17087</sub>
-- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17326</sub>
-- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17555</sub>
-- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17622</sub>
-- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17813</sub>
-- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17842</sub>
-- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17879</sub>
-- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18032</sub>
-- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18138</sub>
-- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18301</sub>
-- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18338</sub>
-- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18360</sub>
-- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18425</sub>
-- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18442</sub>
-- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18746</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18847</sub>
-- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18906</sub>
-- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18933</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19158</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19268</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19444</sub>
-- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19688</sub>
-- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19709</sub>
-- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20157</sub>
-- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20370</sub>
-- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20466</sub>
-- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20567</sub>
-- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20707</sub>
-- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20812</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21033</sub>
-- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21148</sub>
-- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21547</sub>
-- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22181</sub>
-- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23272</sub>
-- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23386</sub>
-- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23832</sub>
-- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24026</sub>
-- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24683</sub>
-- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24772</sub>
-- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24808</sub>
-- **§267** — ADDENDA HARVESTED FROM WAVES at/bh/bk/bl (P31 S59b)  <sub>L25079</sub>
-- **ADD-9** — → §213-3 / §217 addendum — ADJACENT PRE-CALL FRAME STORES ARE ONE AGGREGATE; THE UNESCAPED SCALAR NEIGHBOR IS DEAD-STORED  <sub>L25174</sub>
-- **§269** — ADDENDA HARVESTED FROM WAVES ax/bm (P31 S59c)  <sub>L25298</sub>
-- **§271** — Ordinal IMM pairing: text order is NOT emission order; emit CANDIDATES, let the oracle pick (P31 S59)  <sub>L25536</sub>
-- **§273** — A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59)  <sub>L25578</sub>
-- **§274** — ADDENDA HARVESTED FROM 18 WAVES (P31 S60): 315 candidates, 255 already covered, 21 sharpenings, 3 new laws  <sub>L25593</sub>
-- **§278** — ADDENDA HARVESTED FROM WAVE cf (P31 S60): 34 candidates, 13 already covered, 8 sharpenings, 4 new laws  <sub>L26584</sub>
-- **§283** — ADDENDA HARVESTED FROM THE 36-WAVE BATCH (P31 S60): 1,216 candidates, 859 already covered, 46 sharpenings, 9 new laws  <sub>L27080</sub>
-- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29045</sub>
-- **§293** — THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND THE LOAD-BEARING ONE IS "THE BASELINE, NOT THE SIBLINGS" (P31 S61; byte-proven on 15 binaries in one night)  <sub>L29068</sub>
-- **§294** — ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2): 99 candidates, 52 covered, 15 notes → 10 addenda, 29 notes → 5 new laws (§295–§299), 3 refuted  <sub>L29118</sub>
-- **§303** — MODULE ISLAND TABLES: DERIVE THE PADS AT BUILD TIME, PEEL NOTHING — THE §154-A/§260 "island-pads"/"island-blocked" WALLS DISSOLVE (P31 S62 T3a; byte-proven md_SC03_076 func_801F0A9C + func_801F0F28, sha 9a165e36…)  <sub>L29722</sub>
-- **§305** — "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE (P31 S62 T3; 28 resolver drafts autopsied 28/28)  <sub>L29781</sub>
+- **§41a** — v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that dissolve them (Phase 25 T6, Fable5, 2026-07-09)  <sub>L2769</sub>
+- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2824</sub>
+- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2893</sub>
+- **§42b** — addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cast drift + fix  <sub>L3009</sub>
+- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3313</sub>
+- **§51** — TOOLING INTEGRITY: the silent skip, and how to hunt it  <sub>L3645</sub>
+- **§51b** — Why the byte-gate cannot save you  <sub>L3667</sub>
+- **§51f** — Checklist for any new corpus-scanning tool  <sub>L3770</sub>
+- **§51g** — When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`)  <sub>L3784</sub>
+- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4043</sub>
+- **§55** — Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, 2026-07-17)  <sub>L4108</sub>
+- **§55b** — THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost)  <sub>L4137</sub>
+- **§55c** — Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TREE ARTIFACT  <sub>L4156</sub>
+- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4178</sub>
+- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4271</sub>
+- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4560</sub>
+- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4673</sub>
+- **§61d** — The undo was eating the tree: two tools, one defect, invisible to the byte-gate (Phase 29, 2026-07-22)  <sub>L4794</sub>
+- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4848</sub>
+- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5030</sub>
+- **§65d** — Existing-ladder baseline, measured (do this before building a recovery stage)  <sub>L5106</sub>
+- **§65e** — Two oracles, and the disagreement is the finding (R34 in practice)  <sub>L5116</sub>
+- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5133</sub>
+- **§66b** — A metric parsed out of another tool's prose goes NULL silently when the label changes  <sub>L5215</sub>
+- **§67a** — Run the symbol-set guard BEFORE you pay for a gate (`tools/symcheck.py`, Phase 29 SESSION-18)  <sub>L5420</sub>
+- **§77** — Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silently caps the body's reach. Diff the preamble before you gate. (Phase 29 SESSION-19 — three variants in one session, two different tools)  <sub>L6099</sub>
+- **§3-The** — CANDIDATE gate and the REAL gate need DIFFERENT preambles — keep the difference out of the bank  <sub>L6139</sub>
+- **§79** — For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT ORDER is a declaration-order oracle (Phase 29 SESSION-19, `func_8017BF14` 4,763 ins, cold start → 45/4763)  <sub>L6235</sub>
+- **§82** — Two source-shape oracles from behemoth #6: a duplicated `addiu $aN,$sp,K` across a `jal` means the block was INLINED, and scalar-vs-aggregate decides WHEN a stack slot is allocated (Phase 29 SESSION-19, `func_8017C730` 1,061 ins)  <sub>L6385</sub>
+- **§3-2.** — Scalar vs aggregate decides *when* the slot is allocated  <sub>L6404</sub>
+- **§3-Why** — it survived every candidate gate  <sub>L6510</sub>
+- **§3-THE** — FIX IS MECHANICAL — the tool already holds the answer  <sub>L6525</sub>
+- **§87** — `match_one` COMPILES but never LINKS, so an unresolvable data symbol reads as MATCH; and stored drafts go STALE against the tree (Phase 29 SESSION-20)  <sub>L6648</sub>
+- **§88f** — the missing rung: a RELOCATION gate between `match_one` and the binary  <sub>L6733</sub>
+- **§89a** — MEASURE the write set; do not assert its tier (`tools/blast_radius.py`)  <sub>L6747</sub>
+- **§89b** — the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel.py`)  <sub>L6760</sub>
+- **§90** — Five tool-integrity laws from one session, each of which changed an answer (Phase 29 SESSION-21, 2026-07-27)  <sub>L6781</sub>
+- **§90a** — A comparison tool MUST share its reference oracle's index space, exactly  <sub>L6787</sub>
+- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6906</sub>
+- **§97** — The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that captured a dirty tree (Phase 29 SESSION-22)  <sub>L7081</sub>
+- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7446</sub>
+- **§107** — A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `func_80144090` 0/136 → 136/136)  <sub>L7528</sub>
+- **§3-Why** — it survived so long: a MASKED oracle will MATCH a wrong symbol  <sub>L7968</sub>
+- **§122** — GATE RAW BEFORE TRANSFORMING; the undo belongs to the WRITER, as a per-edit journal (P30 T0a, 2026-07-30)  <sub>L8099</sub>
+- **§123** — PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its refusals are statements about the TOOL (P30 wave 1, 2026-07-30)  <sub>L8131</sub>
+- **§126a** — a bare `except: continue` around a coverage-asserting oracle re-creates the silent skip (P30 S28)  <sub>L8332</sub>
+- **§130** — An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LINK (P30 S28, the jr pair)  <sub>L8501</sub>
+- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8585</sub>
+- **§133** — The DEFAULT-FILTER class: three times in one session, a tool silently answered a narrower question than the one asked (P30 S1–S3)  <sub>L8700</sub>
+- **§134** — MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P30 S6, 190 zero-crack families)  <sub>L8726</sub>
+- **§3-The** — splitting/merging rules (each closed a residual, byte-gated)  <sub>L8868</sub>
+- **§137a** — A gate verdict has a TIMESTAMP; re-check it against the draft's mtime  <sub>L9401</sub>
+- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9430</sub>
+- **§134** — again, in a second tool — and the waiter rule corrected  <sub>L9541</sub>
+- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9580</sub>
+- **§139** — A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not survive a carve (P30 S38, wave 6: 10 of 16 drafts vanished)  <sub>L9609</sub>
+- **§140** — A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a phantom regression that gated the session's best lever)  <sub>L9675</sub>
+- **§142** — An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do not gate a draft. (P30 S39, +7,710 ins in two commands)  <sub>L9793</sub>
+- **§3-The** — measurement (do this before any wave; it is ~20 lines and needs no builds)  <sub>L9805</sub>
+- **§155b** — check the TYPE your oracle returns before comparing against it (S45 p5)  <sub>L10602</sub>
+- **§156** — an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7)  <sub>L10655</sub>
+- **§158** — The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S46 tier-3, `func_8017CE58`, 733 ins)  <sub>L10727</sub>
+- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10908</sub>
+- **§161** — THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47)  <sub>L10984</sub>
+- **§162** — S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 targets  <sub>L11029</sub>
+- **§163** — S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actionable  <sub>L11775</sub>
+- **§165** — S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed  <sub>L13717</sub>
+- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14930</sub>
+- **§167** — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point  <sub>L14986</sub>
+- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16880</sub>
+- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L17014</sub>
+- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17061</sub>
+- **§3-D.** — The measured cost shape, and what to build next  <sub>L17084</sub>
+- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17102</sub>
+- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17341</sub>
+- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17570</sub>
+- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17637</sub>
+- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17828</sub>
+- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17857</sub>
+- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17894</sub>
+- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18047</sub>
+- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18153</sub>
+- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18316</sub>
+- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18353</sub>
+- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18375</sub>
+- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18440</sub>
+- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18457</sub>
+- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18761</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18862</sub>
+- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18921</sub>
+- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18948</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19173</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19283</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19459</sub>
+- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19703</sub>
+- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19724</sub>
+- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20172</sub>
+- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20385</sub>
+- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20481</sub>
+- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20582</sub>
+- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20722</sub>
+- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20827</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21048</sub>
+- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21163</sub>
+- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21562</sub>
+- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22196</sub>
+- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23287</sub>
+- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23401</sub>
+- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23847</sub>
+- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24041</sub>
+- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24698</sub>
+- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24787</sub>
+- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24823</sub>
+- **§267** — ADDENDA HARVESTED FROM WAVES at/bh/bk/bl (P31 S59b)  <sub>L25094</sub>
+- **ADD-9** — → §213-3 / §217 addendum — ADJACENT PRE-CALL FRAME STORES ARE ONE AGGREGATE; THE UNESCAPED SCALAR NEIGHBOR IS DEAD-STORED  <sub>L25189</sub>
+- **§269** — ADDENDA HARVESTED FROM WAVES ax/bm (P31 S59c)  <sub>L25313</sub>
+- **§271** — Ordinal IMM pairing: text order is NOT emission order; emit CANDIDATES, let the oracle pick (P31 S59)  <sub>L25551</sub>
+- **§273** — A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59)  <sub>L25593</sub>
+- **§274** — ADDENDA HARVESTED FROM 18 WAVES (P31 S60): 315 candidates, 255 already covered, 21 sharpenings, 3 new laws  <sub>L25608</sub>
+- **§278** — ADDENDA HARVESTED FROM WAVE cf (P31 S60): 34 candidates, 13 already covered, 8 sharpenings, 4 new laws  <sub>L26599</sub>
+- **§283** — ADDENDA HARVESTED FROM THE 36-WAVE BATCH (P31 S60): 1,216 candidates, 859 already covered, 46 sharpenings, 9 new laws  <sub>L27095</sub>
+- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29060</sub>
+- **§293** — THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND THE LOAD-BEARING ONE IS "THE BASELINE, NOT THE SIBLINGS" (P31 S61; byte-proven on 15 binaries in one night)  <sub>L29083</sub>
+- **§294** — ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2): 99 candidates, 52 covered, 15 notes → 10 addenda, 29 notes → 5 new laws (§295–§299), 3 refuted  <sub>L29133</sub>
+- **§303** — MODULE ISLAND TABLES: DERIVE THE PADS AT BUILD TIME, PEEL NOTHING — THE §154-A/§260 "island-pads"/"island-blocked" WALLS DISSOLVE (P31 S62 T3a; byte-proven md_SC03_076 func_801F0A9C + func_801F0F28, sha 9a165e36…)  <sub>L29737</sub>
+- **§305** — "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE (P31 S62 T3; 28 resolver drafts autopsied 28/28)  <sub>L29796</sub>
 
 ### process, measurement & doctrine  (107)
 
@@ -1004,103 +1007,103 @@
 - **§3-h** — _exact OVER-COUNTS ×134 — verify shareability before crediting a class's "reach-134" (R14)  <sub>L2177</sub>
 - **§28c** — The close=0 recovery is NOT fully exhausted (§26 corrected, R14); + the dedup_propagate registry-skip recovery (Phase 22 T2)  <sub>L2352</sub>
 - **§31-triage** — R17 applies to CODEGEN residuals, never to a compile ERROR (Phase 26 session 7, Drew asked)  <sub>L2693</sub>
-- **§41a** — v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that dissolve them (Phase 25 T6, Fable5, 2026-07-09)  <sub>L2754</sub>
-- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2809</sub>
-- **§41b** — addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25 T7-M4, 2026-07-10)  <sub>L2858</sub>
-- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4028</sub>
-- **§3-The** — meta-lesson (R35, and why this one is expensive)  <sub>L4078</sub>
-- **§55** — Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, 2026-07-17)  <sub>L4093</sub>
-- **§55b** — THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost)  <sub>L4122</sub>
-- **§57a** — Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026-07-18)  <sub>L4303</sub>
-- **§58** — match_one MATCH ≠ BANK: the four blind spots + the crack-wave reconcile-before-bank law (Phase 29 crack-wave, 2026-07-18)  <sub>L4343</sub>
-- **§60** — Classify the residual, don't rank it: the deterministic residual→class classifier and what it measured about the backlog (Phase 29 Task-13A, 2026-07-21)  <sub>L4407</sub>
-- **What** — it measured — the whole open backlog, byte-grounded  <sub>L4431</sub>
-- **§3-The** — parallel-probe race this surfaced  <sub>L4463</sub>
-- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4658</sub>
-- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4833</sub>
-- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5000</sub>
-- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5015</sub>
-- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5030</sub>
-- **§65d** — Existing-ladder baseline, measured (do this before building a recovery stage)  <sub>L5091</sub>
-- **§65e** — Two oracles, and the disagreement is the finding (R34 in practice)  <sub>L5101</sub>
-- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5118</sub>
-- **§66c** — Before a wave, verify the FUEL exists; an "already attempted" set built from the wrong directory lies in BOTH directions  <sub>L5217</sub>
-- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5491</sub>
-- **§3-The** — honest fix was source-level and cheap  <sub>L5750</sub>
-- **§3-The** — residual, and the honest read  <sub>L6260</sub>
-- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6412</sub>
-- **Scope** — , measured (do not over-generalise — §80)  <sub>L6518</sub>
-- **§3-Two** — ladder lessons banked with it  <sub>L6528</sub>
-- **§3-Do** — the WHOLE axis in one edit, then R22 once  <sub>L6567</sub>
-- **§3-THE** — LAW: all-or-nothing PER FAMILY  <sub>L6600</sub>
-- **§88b** — the `slti` literal-position law (extends §78 to comparisons)  <sub>L6686</sub>
-- **§88e** — a wrong diagnosis, refuted properly (the model for how to treat an inherited lever)  <sub>L6708</sub>
-- **§89a** — MEASURE the write set; do not assert its tier (`tools/blast_radius.py`)  <sub>L6732</sub>
-- **§90d** — Do not measure a live wave's drafts (§87 in real time)  <sub>L6810</sub>
-- **§98** — `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION-22, `func_8014CF04`)  <sub>L7113</sub>
-- **§106** — Persist the MEASUREMENT, derive the POLICY: a stored route let a stale file out-vote the live table (Phase 29 T54, `residual_class._ROUTE`)  <sub>L7470</sub>
-- **§125** — Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA from a CLEAN tree (P30 SESSION-28; **this section's first draft was WRONG and the method caught it**)  <sub>L8206</sub>
-- **§3-The** — meta-lesson  <sub>L8257</sub>
-- **Wave** — economics (measured, for the next batch's sizing)  <sub>L8953</sub>
-- **§136b** — A prior wave's "genuine byte-DIFF" verdict is NOT reliable evidence (4 of 4 refuted)  <sub>L9033</sub>
-- **§136g** — When the index points at the WRONG lever: two byte-refuted routings (func_801863B4)  <sub>L9211</sub>
-- **§136h** — CORRECTION: the zero-crack pool does NOT "refill with cheap work" (my error, byte-measured)  <sub>L9240</sub>
-- **§136j** — The failure MIX flips with function size (measured across four bands, one session)  <sub>L9302</sub>
-- **Rank** — the lane by measured concentration, not by class count  <sub>L9481</sub>
-- **§140** — A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a phantom regression that gated the session's best lever)  <sub>L9660</sub>
-- **§3-The** — measurement (do this before any wave; it is ~20 lines and needs no builds)  <sub>L9790</sub>
-- **§3-And** — the report-vs-bytes lesson attached to it  <sub>L9822</sub>
-- **§146** — RE-MEASURE A WALL BEFORE YOU RESPECT IT. Both "permanent" giants fell to drafts already on disk. (P30 S6, +50,094 ins)  <sub>L9977</sub>
-- **§147** — The three-stratum FRAME LAW, and four "stop searching" verdicts (P30 S42, `func_8017C294`, serial run)  <sub>L10036</sub>
-- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10068</sub>
-- **§3-D.** — "Cheap fuel" that was never probed: 0 of 31 templatable  <sub>L10293</sub>
-- **§3-Two** — corrections to the record  <sub>L10345</sub>
-- **§3-The** — two fallouts, and how to close them (both measured, in order)  <sub>L10395</sub>
-- **What** — does NOT work (14 byte-measured probes)  <sub>L10486</sub>
-- **§157** — the cheap-tier size cliff, measured (S45 p6)  <sub>L10687</sub>
-- **§162** — The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_80189540`)  <sub>L11302</sub>
-- **§3-The** — law  <sub>L11549</sub>
-- **DIAGNOSTIC** — TELL — two faces, one law  <sub>L11591</sub>
-- **§163** — S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actionable  <sub>L11760</sub>
-- **§163z** — THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass)  <sub>L11828</sub>
-- **§164z** — REFUTED CLAIMS: do NOT re-derive these  <sub>L13636</sub>
-- **§165z** — REFUTED THIS WAVE: do NOT re-derive  <sub>L14871</sub>
-- **§167z** — REFUTED IN WAVES 5/6: do NOT re-derive  <sub>L16167</sub>
-- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16224</sub>
-- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16953</sub>
-- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L16991</sub>
-- **§3-D.** — The measured cost shape, and what to build next  <sub>L17069</sub>
-- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17145</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17709</sub>
-- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17761</sub>
-- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17813</sub>
-- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17879</sub>
-- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17935</sub>
-- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17961</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18060</sub>
-- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18301</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18950</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19117</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20222</sub>
-- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21368</sub>
-- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23124</sub>
-- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24110</sub>
-- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24179</sub>
-- **§266** — THE INERT-RIDER LAW: A LEVER IS ONLY CITABLE WHEN ITS SOLO REMOVAL BREAKS THE MATCH (P31 S59b; measured 4-of-8 on this batch)  <sub>L25039</sub>
-- **ADD-4** — → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAME IT **AND** STORE **INSIDE** THE ARM  <sub>L25353</sub>
-- **ADD-9** — → §255 "AND CASE-BODY PLACEMENT" bound / §222-addendum-3 — ON A LARGE SPARSE TREE, BODIES FOLLOW **SOURCE** ORDER (measured by a one-word probe)  <sub>L25430</sub>
-- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26059</sub>
-- **What** — I could not verify  <sub>L27033</sub>
-- **ADDENDUM** — to §164-75 — the fold-reassociation law also fires at a variable's INITIALIZER, not only a later expression  <sub>L27090</sub>
-- **What** — I could not verify  <sub>L27607</sub>
-- **ADDENDUM** — to §153 / §236-5 (func_801A419C, md_SC07_003 — waves di and dl, corroborating; refutes a contradicted dj-wave card)  <sub>L27824</sub>
-- **What** — I could not verify  <sub>L28064</sub>
-- **ADDENDUM** — to §174 Law 4 (func_8017E9A8, ov_SC06_015)  <sub>L28084</sub>
-- **ADDENDUM** — the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_800CB900, md_MAIN_026)  <sub>L28124</sub>
-- **What** — I could not verify  <sub>L28622</sub>
-- **What** — I could not verify  <sub>L28928</sub>
-- **§293** — THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND THE LOAD-BEARING ONE IS "THE BASELINE, NOT THE SIBLINGS" (P31 S61; byte-proven on 15 binaries in one night)  <sub>L29068</sub>
-- **§294** — ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2): 99 candidates, 52 covered, 15 notes → 10 addenda, 29 notes → 5 new laws (§295–§299), 3 refuted  <sub>L29118</sub>
+- **§41a** — v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that dissolve them (Phase 25 T6, Fable5, 2026-07-09)  <sub>L2769</sub>
+- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2824</sub>
+- **§41b** — addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25 T7-M4, 2026-07-10)  <sub>L2873</sub>
+- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4043</sub>
+- **§3-The** — meta-lesson (R35, and why this one is expensive)  <sub>L4093</sub>
+- **§55** — Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, 2026-07-17)  <sub>L4108</sub>
+- **§55b** — THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost)  <sub>L4137</sub>
+- **§57a** — Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026-07-18)  <sub>L4318</sub>
+- **§58** — match_one MATCH ≠ BANK: the four blind spots + the crack-wave reconcile-before-bank law (Phase 29 crack-wave, 2026-07-18)  <sub>L4358</sub>
+- **§60** — Classify the residual, don't rank it: the deterministic residual→class classifier and what it measured about the backlog (Phase 29 Task-13A, 2026-07-21)  <sub>L4422</sub>
+- **What** — it measured — the whole open backlog, byte-grounded  <sub>L4446</sub>
+- **§3-The** — parallel-probe race this surfaced  <sub>L4478</sub>
+- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4673</sub>
+- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4848</sub>
+- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5015</sub>
+- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5030</sub>
+- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5045</sub>
+- **§65d** — Existing-ladder baseline, measured (do this before building a recovery stage)  <sub>L5106</sub>
+- **§65e** — Two oracles, and the disagreement is the finding (R34 in practice)  <sub>L5116</sub>
+- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5133</sub>
+- **§66c** — Before a wave, verify the FUEL exists; an "already attempted" set built from the wrong directory lies in BOTH directions  <sub>L5232</sub>
+- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5506</sub>
+- **§3-The** — honest fix was source-level and cheap  <sub>L5765</sub>
+- **§3-The** — residual, and the honest read  <sub>L6275</sub>
+- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6427</sub>
+- **Scope** — , measured (do not over-generalise — §80)  <sub>L6533</sub>
+- **§3-Two** — ladder lessons banked with it  <sub>L6543</sub>
+- **§3-Do** — the WHOLE axis in one edit, then R22 once  <sub>L6582</sub>
+- **§3-THE** — LAW: all-or-nothing PER FAMILY  <sub>L6615</sub>
+- **§88b** — the `slti` literal-position law (extends §78 to comparisons)  <sub>L6701</sub>
+- **§88e** — a wrong diagnosis, refuted properly (the model for how to treat an inherited lever)  <sub>L6723</sub>
+- **§89a** — MEASURE the write set; do not assert its tier (`tools/blast_radius.py`)  <sub>L6747</sub>
+- **§90d** — Do not measure a live wave's drafts (§87 in real time)  <sub>L6825</sub>
+- **§98** — `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION-22, `func_8014CF04`)  <sub>L7128</sub>
+- **§106** — Persist the MEASUREMENT, derive the POLICY: a stored route let a stale file out-vote the live table (Phase 29 T54, `residual_class._ROUTE`)  <sub>L7485</sub>
+- **§125** — Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA from a CLEAN tree (P30 SESSION-28; **this section's first draft was WRONG and the method caught it**)  <sub>L8221</sub>
+- **§3-The** — meta-lesson  <sub>L8272</sub>
+- **Wave** — economics (measured, for the next batch's sizing)  <sub>L8968</sub>
+- **§136b** — A prior wave's "genuine byte-DIFF" verdict is NOT reliable evidence (4 of 4 refuted)  <sub>L9048</sub>
+- **§136g** — When the index points at the WRONG lever: two byte-refuted routings (func_801863B4)  <sub>L9226</sub>
+- **§136h** — CORRECTION: the zero-crack pool does NOT "refill with cheap work" (my error, byte-measured)  <sub>L9255</sub>
+- **§136j** — The failure MIX flips with function size (measured across four bands, one session)  <sub>L9317</sub>
+- **Rank** — the lane by measured concentration, not by class count  <sub>L9496</sub>
+- **§140** — A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a phantom regression that gated the session's best lever)  <sub>L9675</sub>
+- **§3-The** — measurement (do this before any wave; it is ~20 lines and needs no builds)  <sub>L9805</sub>
+- **§3-And** — the report-vs-bytes lesson attached to it  <sub>L9837</sub>
+- **§146** — RE-MEASURE A WALL BEFORE YOU RESPECT IT. Both "permanent" giants fell to drafts already on disk. (P30 S6, +50,094 ins)  <sub>L9992</sub>
+- **§147** — The three-stratum FRAME LAW, and four "stop searching" verdicts (P30 S42, `func_8017C294`, serial run)  <sub>L10051</sub>
+- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10083</sub>
+- **§3-D.** — "Cheap fuel" that was never probed: 0 of 31 templatable  <sub>L10308</sub>
+- **§3-Two** — corrections to the record  <sub>L10360</sub>
+- **§3-The** — two fallouts, and how to close them (both measured, in order)  <sub>L10410</sub>
+- **What** — does NOT work (14 byte-measured probes)  <sub>L10501</sub>
+- **§157** — the cheap-tier size cliff, measured (S45 p6)  <sub>L10702</sub>
+- **§162** — The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_80189540`)  <sub>L11317</sub>
+- **§3-The** — law  <sub>L11564</sub>
+- **DIAGNOSTIC** — TELL — two faces, one law  <sub>L11606</sub>
+- **§163** — S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actionable  <sub>L11775</sub>
+- **§163z** — THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass)  <sub>L11843</sub>
+- **§164z** — REFUTED CLAIMS: do NOT re-derive these  <sub>L13651</sub>
+- **§165z** — REFUTED THIS WAVE: do NOT re-derive  <sub>L14886</sub>
+- **§167z** — REFUTED IN WAVES 5/6: do NOT re-derive  <sub>L16182</sub>
+- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16239</sub>
+- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16968</sub>
+- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L17006</sub>
+- **§3-D.** — The measured cost shape, and what to build next  <sub>L17084</sub>
+- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17160</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17724</sub>
+- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17776</sub>
+- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17828</sub>
+- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17894</sub>
+- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17950</sub>
+- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17976</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18075</sub>
+- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18316</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18965</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19132</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20237</sub>
+- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21383</sub>
+- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23139</sub>
+- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24125</sub>
+- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24194</sub>
+- **§266** — THE INERT-RIDER LAW: A LEVER IS ONLY CITABLE WHEN ITS SOLO REMOVAL BREAKS THE MATCH (P31 S59b; measured 4-of-8 on this batch)  <sub>L25054</sub>
+- **ADD-4** — → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAME IT **AND** STORE **INSIDE** THE ARM  <sub>L25368</sub>
+- **ADD-9** — → §255 "AND CASE-BODY PLACEMENT" bound / §222-addendum-3 — ON A LARGE SPARSE TREE, BODIES FOLLOW **SOURCE** ORDER (measured by a one-word probe)  <sub>L25445</sub>
+- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26074</sub>
+- **What** — I could not verify  <sub>L27048</sub>
+- **ADDENDUM** — to §164-75 — the fold-reassociation law also fires at a variable's INITIALIZER, not only a later expression  <sub>L27105</sub>
+- **What** — I could not verify  <sub>L27622</sub>
+- **ADDENDUM** — to §153 / §236-5 (func_801A419C, md_SC07_003 — waves di and dl, corroborating; refutes a contradicted dj-wave card)  <sub>L27839</sub>
+- **What** — I could not verify  <sub>L28079</sub>
+- **ADDENDUM** — to §174 Law 4 (func_8017E9A8, ov_SC06_015)  <sub>L28099</sub>
+- **ADDENDUM** — the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_800CB900, md_MAIN_026)  <sub>L28139</sub>
+- **What** — I could not verify  <sub>L28637</sub>
+- **What** — I could not verify  <sub>L28943</sub>
+- **§293** — THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND THE LOAD-BEARING ONE IS "THE BASELINE, NOT THE SIBLINGS" (P31 S61; byte-proven on 15 binaries in one night)  <sub>L29083</sub>
+- **§294** — ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2): 99 candidates, 52 covered, 15 notes → 10 addenda, 29 notes → 5 new laws (§295–§299), 3 refuted  <sub>L29133</sub>
 
 ### (unbucketed — title matched no symptom vocabulary)  (288)
 
@@ -1129,269 +1132,269 @@
 - **§28a** — decomp.wiki GCC patterns worth trying on BFM giants (decomp.wiki/compilers/GCC, raw at decompals/decompedia; PS1-applicable subset)  <sub>L2345</sub>
 - **§31** — THE gcc-2.7.2 CODEGEN MAP: pass → residual → C-lever catalog (Phase 23; 4 Fable5 agents read the compiler source)  <sub>L2402</sub>
 - **§36** — Fable5 giant-crack levers (Phase 24 T7 Fable5 batch; accumulates as each lands — full RTL dumps in `.run/t7/fable/`)  <sub>L2487</sub>
-- **§42d** — addendum — wave 4 (rtu_match fan-out over the mapped frontier, 2026-07-10c): 24/26 MATCH, +5 durable levers  <sub>L3082</sub>
-- **§3-B.** — THE EBB RULE — the general form of §46-L2  <sub>L3468</sub>
-- **§3-E.** — Meta  <sub>L3518</sub>
-- **§50** — Refinements that BOUND §47/§48 (from the `func_80135EB0` wall, 21→6; Phase 26 session 8)  <sub>L3576</sub>
-- **§51a** — The bug class  <sub>L3636</sub>
-- **§51c** — THE METHOD (do not audit by reading the regex)  <sub>L3662</sub>
-- **§51d** — THE LAWS  <sub>L3677</sub>
-- **§51e** — The false-wall pipeline (why this is not just hygiene)  <sub>L3739</sub>
-- **§3-Why** — the wall is (probably) intrinsic  <sub>L3945</sub>
-- **§3-The** — case  <sub>L4033</sub>
-- **§3-The** — rule  <sub>L4062</sub>
-- **§55a** — New byte-proven levers (each from a banked or near draft)  <sub>L4098</sub>
-- **§60a** — What the first DIRECTED grinder run exposed (Phase 29 Task-13B, 2026-07-21)  <sub>L4472</sub>
-- **§60b** — The plateau autopsy's verdict: a `partial` drift is a WRONG DRAFT, not a missing transform (Phase 29 Task-13B close, 2026-07-21)  <sub>L4510</sub>
-- **§66** — Exercise a banking driver's SUCCESS path before pointing it at a wave: the free re-bank test (Phase 29 SESSION-17, 2026-07-24)  <sub>L5159</sub>
-- **§66d-2** — Two operational sharp edges  <sub>L5289</sub>
-- **§66d-3** — Read the ILS per-cycle SERIES, not its final best: a repeated score and a still-falling one look identical in a summary line and mean opposite things  <sub>L5300</sub>
-- **§67** — The arg-copy PLACEMENT lever: launder a parameter into a fresh pseudo AT the statement where the target's copy lands (Phase 29 SESSION-18, `func_8014D820` 25 → 16)  <sub>L5315</sub>
-- **§66d-4** — "ILS converged" means converged FOR THAT WEIGHT PROFILE, not a floor (amends §66d-3; Phase 29 SESSION-18)  <sub>L5438</sub>
-- **§69** — How to attack a behemoth: map it, don't draft it (Phase 29 SESSION-18, `func_80183814`, 5,122 ins)  <sub>L5569</sub>
-- **What** — is left, and what is byte-recorded as SPENT  <sub>L5766</sub>
-- **§3-The** — mechanism, with citations  <sub>L6037</sub>
-- **§3-Two** — diagnosis traps this function proved  <sub>L6064</sub>
-- **Practice** — Practice  <sub>L6074</sub>
-- **§3-The** — drift was an allocation decision, not missing code  <sub>L6180</sub>
-- **§3-The** — economics  <sub>L6211</sub>
-- **§71** — has a blind spot, and this is it  <sub>L6226</sub>
-- **§3-The** — flagged "#1 move" LOST — and why the failure is informative  <sub>L6302</sub>
-- **§78** — 's attribution primitive, run and reproduced  <sub>L6312</sub>
-- **Cold-start** — economics, now complete  <sub>L6318</sub>
-- **Also** — reproduced on this function  <sub>L6401</sub>
-- **§3-And** — the banking footnote (§75a class A, one line)  <sub>L6405</sub>
-- **§83a** — READ THE HEADLINE NUMBER CORRECTLY: a LENGTH drift makes `match_one`'s count meaningless  <sub>L6419</sub>
-- **§83b** — THE LEVER: find the parameterised REPEAT before decoding case-by-case  <sub>L6427</sub>
-- **§83e** — §80 vindicated again, on the same day it was written  <sub>L6466</sub>
-- **§3-The** — conflict  <sub>L6544</sub>
-- **§3-THE** — FAILURE MODE — widening only `engine_core.h` is worse than not starting  <sub>L6552</sub>
-- **§3-The** — precondition, and how to check it in one grep  <sub>L6559</sub>
-- **Reading** — , for the next person  <sub>L6576</sub>
-- **§3-The** — guard refuses a class that largely works  <sub>L6591</sub>
-- **§3-The** — blindness ladder, now complete — FOUR classes `match_one` cannot see  <sub>L6649</sub>
-- **Consequence** — for the backlog ledger  <sub>L6659</sub>
-- **§88** — `cross_jump` will not merge a common suffix containing a CALL; and §78 is scoped to ORDERED comparisons only (Phase 29 SESSION-20, the behemoth close-out)  <sub>L6674</sub>
-- **§88a** — repeated CALL-shaped blocks are left UNMERGED; call-free tails are merged for you  <sub>L6679</sub>
-- **§89** — Two throughput rules the project already had written down and was not following (Phase 29 SESSION-20)  <sub>L6726</sub>
-- **§3-The** — standing sequence  <sub>L6758</sub>
-- **§90b** — "Byte-neutral" is not "wanted": undo on the SUCCESS path too  <sub>L6789</sub>
-- **§90c** — A library-callable function must FAIL CLOSED on an unconfigured module  <sub>L6799</sub>
-- **§90e** — An agent's CONCLUSION and its EVIDENCE fail independently — re-derive the premise, not the fix  <sub>L6818</sub>
-- **§93** — `set -o pipefail` attributes a pipeline failure to the LAST stage, not the failing one (Phase 29 SESSION-21, `func_8014D820`)  <sub>L6922</sub>
-- **§101** — The STALE DEFAULT class: a guard whose cause was removed is a silent skip wearing a safety label (Phase 29 SESSION-22, three instances in one session)  <sub>L7245</sub>
-- **§110** — A unit must define exactly ONE function, and "ends in `;`" does not tell you which line defines it (Phase 29 T65)  <sub>L7640</sub>
-- **§115** — A `func_XXXXXXXX` predicate rots by design: the same name-form assumption in THREE places (Phase 29 T78)  <sub>L7850</sub>
-- **§3-The** — fix moves the DEFINITION, not the stub — and here is why the obvious shortcut fails  <sub>L7895</sub>
-- **§117** — Spell the sibling's symbol from the SIBLING's address, not the exemplar's kind (Phase 29 T82)  <sub>L7926</sub>
-- **§118** — Ordinal (positional) immediate resolution: compare C tokens to the DIFFERING asm uses (Phase 29 T87)  <sub>L7963</sub>
-- **§119** — Two levers on the SAME axis, opposite directions: test the off-diagonal (Phase 29 T89)  <sub>L7997</sub>
-- **§3-The** — wiring trap that cost two attempts  <sub>L8043</sub>
-- **§3-The** — method (keep this)  <sub>L8213</sub>
-- **§3-The** — instrument rules that make its answer trustworthy (this is where I failed)  <sub>L8223</sub>
-- **§3-The** — corrected results (each SHA-verified, from a clean tree, restore re-verified)  <sub>L8238</sub>
-- **§3-The** — instrument trap that hid it (and it is §124's shape again)  <sub>L8290</sub>
-- **§3-The** — mechanics  <sub>L8299</sub>
-- **§3-The** — idiom they kept re-deriving: the constant-offset fold  <sub>L8356</sub>
-- **§127b** — the knowledge was in a SOURCE COMMENT, not the cookbook  <sub>L8386</sub>
-- **§128** — A raw NUL in C source makes grep SILENTLY SKIP the file (P30 S28, 137 files)  <sub>L8393</sub>
-- **§128a** — a negative control must corrupt a SCRATCH COPY, never the tracked file  <sub>L8425</sub>
-- **§3-The** — real blocker underneath, for the record  <sub>L8477</sub>
-- **§3-The** — diagnostic ladder that finally located it (reusable)  <sub>L8523</sub>
-- **Defect** — 1 — a pre-§8e MERGED DOUBLE is not a single-table predecessor  <sub>L8579</sub>
-- **Defect** — 2 — `as` writes a corpse and nothing deletes it  <sub>L8597</sub>
-- **§3-The** — fingerprint, and the 30-second ladder that found it  <sub>L8607</sub>
-- **§3-The** — transferable rule  <sub>L8628</sub>
-- **§132a** — `--like` is for a sibling with NO record; against one that HAS a record it over-derives (P30 S29, `ov_SC07_010`)  <sub>L8635</sub>
-- **§135** — Six byte-verified gcc-2.7.2 idioms from the P30 S6f-h waves (and the two-lane wave shape that found them)  <sub>L8765</sub>
-- **§3-The** — codegen idioms  <sub>L8770</sub>
-- **§3-The** — wave shape that produced these  <sub>L8819</sub>
-- **§136** — The LOCAL-VARIABLE lever: how many C locals, at what scope (P30 wave 4a, 25 byte-verified banks)  <sub>L8837</sub>
-- **§136a** — Blocker capture: classify on the OUTPUT, never on the exit status  <sub>L8976</sub>
-- **§136d** — Four gcc-2.7.2 levers the redraft lane found (each closed a residual no other lever moved)  <sub>L9094</sub>
-- **§136e** — §136c's PRECONDITION, and two more symptom keys (wave 4b batch 3)  <sub>L9138</sub>
-- **§136i** — The drafter model LADDER: Haiku → **Sonnet** → Opus → Fable5 (Drew, 2026-08-03)  <sub>L9270</sub>
-- **§3-The** — triage, cheapest first  <sub>L9421</sub>
-- **THREE** — carry variants hide in one "CARRY-FIXABLE" bucket — and they need different fixes  <sub>L9490</sub>
-- **STEP** — 0 of sibling-first: grep `src/` for a distinctive LITERAL from the `.s`  <sub>L9546</sub>
-- **§3-The** — generalisation — three corollaries worth more than the bug  <sub>L9626</sub>
-- **§3-And** — the inverse-lookup trap, same session  <sub>L9643</sub>
-- **§3-The** — three-line proof (do this before diagnosing any metric movement)  <sub>L9680</sub>
-- **§3-The** — two instrument defects it exposed  <sub>L9689</sub>
-- **§3-Two** — wrong mechanisms I chased first, and why they were wrong  <sub>L9720</sub>
-- **§3-The** — trap that hid it — SAME FUNCTION, TWO ROUTES, ONLY ONE IS FREE  <sub>L9805</sub>
-- **Route** — selection (why `--addr` sometimes says "nothing changed")  <sub>L9814</sub>
-- **§144** — THE LITERAL'S SPELLING PICKS THE IMMEDIATE ENCODING (P30 S40 wave 1, `func_801822E0`)  <sub>L9888</sub>
-- **§3-Why** — a correct draft can read as an intrinsic wall  <sub>L9988</sub>
-- **§3-The** — rule  <sub>L10023</sub>
-- **§3-B.** — `(v < 0x40) ? v : 0x3F` is folded to `MIN_EXPR` and expands to the WRONG SHAPE  <sub>L10170</sub>
-- **§3-D.** — Reproduce the original's BUGS verbatim  <sub>L10194</sub>
-- **§149** — Four instrument defects in one session, and the two questions they were hiding (P30 S43)  <sub>L10243</sub>
-- **§3-A.** — A prep step that returns its input on failure is indistinguishable from a search that found nothing  <sub>L10249</sub>
-- **§3-B.** — Same address + same name ≠ same body — and the ledger keys on address  <sub>L10267</sub>
-- **§3-C.** — `make: *** [...] Error N` is a summary, never a diagnosis  <sub>L10283</sub>
-- **§3-The** — fix  <sub>L10319</sub>
-- **§3-The** — method that found it (this is the transferable part)  <sub>L10329</sub>
-- **Diagnostic** — order (adopt this)  <sub>L10356</sub>
-- **§3-The** — mechanism (read from cc1's own `-dR` trace, not inferred)  <sub>L10372</sub>
-- **§3-The** — lever — a zero-emission insn that absorbs the blocked tick  <sub>L10387</sub>
-- **§3-The** — finding  <sub>L10423</sub>
-- **§3-The** — key  <sub>L10432</sub>
-- **§3-Two** — cautions that must travel with this technique  <sub>L10443</sub>
-- **§3-The** — companion defect (open)  <sub>L10454</sub>
-- **Symptom** — Symptom  <sub>L10474</sub>
-- **Mechanism** — (gcc source + RTL dumps, not inferred)  <sub>L10479</sub>
-- **§3-The** — cure — a fresh launder per site, each in its own block  <sub>L10492</sub>
-- **Companion** — levers from the same function  <sub>L10502</sub>
-- **§3-B.** — Two static base-derivation methods that must AGREE (use both)  <sub>L10536</sub>
-- **§155a** — the same failure class, one level up: SHAPE-blind table scanning (S45 p5)  <sub>L10567</sub>
-- **§155c** — the ZERO-REFERENCE trap: gcc splits a global-array address across the `lui` and the LOAD (S46)  <sub>L10610</sub>
-- **Symptom** — Symptom  <sub>L10721</sub>
-- **§3-Why** — the fork is chained (gcc source, validated insn-by-insn against -dS/-dR dumps)  <sub>L10727</sub>
-- **§3-The** — method (dump-arithmetic first, then place — no probing)  <sub>L10740</sub>
-- **§162a** — SHARPENS  *(sharpens §161a, §131, §8a-pad, §129a)*  <sub>L11041</sub>
-- **§162b** — SHARPENS  *(sharpens §48-A3, §156, §150, §76)*  <sub>L11070</sub>
-- **§162d** — SHARPENS  *(sharpens §31, §21, §30, §55a)*  <sub>L11099</sub>
-- **§162e** — NEW  <sub>L11141</sub>
-- **§162f** — SHARPENS  *(sharpens §42d, §41d, §73, §10)*  <sub>L11209</sub>
-- **§162g** — NEW  <sub>L11264</sub>
-- **§162h** — SHARPENS  *(sharpens §88, §88a, §50-B, §8)*  <sub>L11300</sub>
-- **§162i** — SHARPENS  *(sharpens §135, §21, §42, §32)*  <sub>L11368</sub>
-- **§162j** — SHARPENS  *(sharpens §25, §136d-1, §48-B, §46-L2)*  <sub>L11393</sub>
-- **§162k** — SHARPENS  *(sharpens §1-I2, §12, §160d, §21)*  <sub>L11422</sub>
-- **§162l** — SHARPENS  *(sharpens §48-B, §48-C1, §20, §21)*  <sub>L11485</sub>
-- **§162m** — SHARPENS  *(sharpens §36, §158, §148, §153)*  <sub>L11540</sub>
-- **§158a** — THE FIFTH LEVER IS NOT AN ASM: `do { } while (0)` is a REGION ref-multiplier you MINT (P30 S48, `func_8017CBC8`, ov_MAIN_012 / jr_801789AC, 188 ins → MATCH)  <sub>L11542</sub>
-- **Size** — it before you write it (§158 step 1-2, applied)  <sub>L11560</sub>
-- **§3-The** — wrap BOUNDARY is the dial — and it is indiscriminate  <sub>L11581</sub>
-- **§3-Not** — a pure dial  <sub>L11587</sub>
-- **§162n** — NEW  <sub>L11613</sub>
-- **§162o** — SHARPENS  *(sharpens §158, §136-1, §136-6, §79)*  <sub>L11646</sub>
-- **§162p** — SHARPENS  *(sharpens §48-B, §46-L2, §156, §136d-1)*  <sub>L11705</sub>
-- **§162q** — SHARPENS  *(sharpens §30, §30a, §135-2, §136-13)*  <sub>L11722</sub>
-- **§164** — S48 §163z SKEPTIC PASS (P30, 2026-08-12): 190 claims vetted, 82 banked  <sub>L11848</sub>
-- **§169** — THE MICRO-ADAPT LANE (P30 S49): edit a proven body, don't crack a new one  <sub>L16276</sub>
-- **§170** — THE A-PROP WORD-DIFF CARD (P30 S49): the lane that had no owner  <sub>L16323</sub>
-- **§171** — THE STALE SEED SYMBOL (P30 S50, 2026-08-13): why §170's 91%→57% was never codegen  <sub>L16367</sub>
-- **§172** — THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 MIPS  <sub>L16516</sub>
-- **§172a** — TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max)  <sub>L16570</sub>
-- **§172b** — THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask)  <sub>L16586</sub>
-- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16665</sub>
-- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16760</sub>
-- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16800</sub>
-- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17039</sub>
-- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17165</sub>
-- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17239</sub>
-- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17251</sub>
-- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17280</sub>
-- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17295</sub>
-- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17385</sub>
-- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17435</sub>
-- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17486</sub>
-- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17582</sub>
-- **Considered** — and NOT banked  <sub>L17605</sub>
-- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17783</sub>
-- **What** — is NOT banked here  <sub>L17800</sub>
-- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17861</sub>
-- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17880</sub>
-- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17949</sub>
-- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18361</sub>
-- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19195</sub>
-- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19522</sub>
-- **§197-REJECTED** — §197-REJECTED  <sub>L20692</sub>
-- **§199-REJECTED** — §199-REJECTED  <sub>L21088</sub>
-- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21190</sub>
-- **§201-REJECTED** — eight, the session's highest  <sub>L21424</sub>
-- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21890</sub>
-- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21984</sub>
-- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22251</sub>
-- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22433</sub>
-- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22478</sub>
-- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22656</sub>
-- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22977</sub>
-- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L23038</sub>
-- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23075</sub>
-- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23139</sub>
-- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23236</sub>
-- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23242</sub>
-- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23257</sub>
-- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23266</sub>
-- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23357</sub>
-- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23520</sub>
-- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23594</sub>
-- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23623</sub>
-- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L23991</sub>
-- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L24038</sub>
-- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24153</sub>
-- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24202</sub>
-- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24213</sub>
-- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24230</sub>
-- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24259</sub>
-- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24318</sub>
-- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24435</sub>
-- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24452</sub>
-- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24549</sub>
-- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24621</sub>
-- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24632</sub>
-- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24641</sub>
-- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24672</sub>
-- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24722</sub>
-- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24856</sub>
-- **§264** — FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59)  <sub>L24927</sub>
-- **ADD-1** — → §231 addendum (also cross-ref from §195-D) — THE MASKED-`jal` "MISSING CALL" ILLUSION  <sub>L25087</sub>
-- **ADD-6** — → §172b-1 / §264 addendum — SHIFT-AS-TEST: `(x << 16) != 0` TESTS THE LOW HALF WITHOUT TRUNCATING THE PSEUDO  <sub>L25141</sub>
-- **ADD-7** — → §256 addendum — THE SINGLE-GUARD GOTO: THEN-BLOCK OUT OF LINE AT THE TAIL  <sub>L25150</sub>
-- **ADD-3** — → §238 addendum — TWO BINARIES CAN EACH DEFINE THE SAME `func_` NAME WITH DIFFERENT BYTES, AND NO GENERATED REPORT SHOWS IT  <sub>L25340</sub>
-- **§270** — The A-prop 0-bank anatomy: a byte-correct body still needs FOUR layers to agree (P31 S59)  <sub>L25518</sub>
-- **ADDENDUM** — to §1-I5  <sub>L25808</sub>
-- **ADDENDUM** — to §164-51  <sub>L25873</sub>
-- **ADDENDUM** — to §176-F5  <sub>L25889</sub>
-- **ADDENDUM** — to §225  <sub>L25918</sub>
-- **ADDENDUM** — to §229 — A POINTER'S NUMBER OF USES DECIDES WHETHER ITS ADDRESS FOLDS OR SURVIVES A CALL  <sub>L26106</sub>
-- **ADDENDUM** — to §226 — A DEAD LOCAL SCOPED TO A NESTED BLOCK BUYS A MID-FUNCTION `addiu sp` PAIR, NOT A FRAME-SIZE CHANGE  <sub>L26224</sub>
-- **ADDENDUM** — to §74 (func_800D0E30, resident)  <sub>L26592</sub>
-- **ADDENDUM** — to §172b-4 (func_80185054, ov_SC03_097)  <sub>L26628</sub>
-- **ADDENDUM** — to §265 (func_8017DC80, ov_SC07_002)  <sub>L26666</sub>
-- **ADDENDUM** — to §17 (func_800CB794, md_MAIN_036)  <sub>L26705</sub>
-- **ADDENDUM** — to §162p (func_8017C120, ov_MAIN_012)  <sub>L26753</sub>
-- **ADDENDUM** — to §20 (~L1947) (func_80186AD0, ov_SC06_032)  <sub>L26787</sub>
-- **ADDENDUM** — to §164-56 (func_8017F644, ov_SC04_005)  <sub>L26817</sub>
-- **ADDENDUM** — to §237 (func_8017F7FC, ov_SC03_092)  <sub>L26852</sub>
-- **ADDENDUM** — to §195-E — a goto-ladder's STORES must sit AT the labels, after the gotos, not inline before them  <sub>L27204</sub>
-- **Harness-defect** — flags  <sub>L27678</sub>
-- **ADDENDUM** — to §167-40 (func_8017E2CC, ov_SC04_015 — wave dg)  <sub>L27771</sub>
-- **ADDENDUM** — to §87 (func_801815F4 ov_SC06_032; corroborating func_801840DC ov_SC05_017, func_80189C68 ov_SC03_006 — wave dg)  <sub>L27805</sub>
-- **ADDENDUM** — to §263 (func_801E83AC, md_SC04_029 — wave dj)  <sub>L27844</sub>
-- **ADDENDUM** — to §265 (func_8017D878, ov_SC03_107 — wave dj; corroborated by a REJECTED, contradicted card in wave dm — see closing)  <sub>L27858</sub>
-- **ADDENDUM** — to §6 (func_801811F0, ov_SC03_102 — waves dj and dl, corroborated by a self-reported "nothing new" dm-wave card)  <sub>L27872</sub>
-- **ADDENDUM** — to §195-G (func_80183BB0, ov_SC05_001 — wave dj)  <sub>L27886</sub>
-- **ADDENDUM** — to §74 (func_8017EB34, ov_SC03_117 — counter/clamp variant; wave dj, corroborated by dk/dl/dm cards on the same function)  <sub>L27964</sub>
-- **ADDENDUM** — §37 — merged into the §153/§236-5 entry above (func_801A419C, wave dl)  <sub>L27984</sub>
-- **ADDENDUM** — §6 — merged into the §6 entry above (func_801811F0, wave dl)  <sub>L27992</sub>
-- **ADDENDUM** — to §238 (func_80182CB4, ov_SC02_000 — wave dl)  <sub>L28000</sub>
-- **ADDENDUM** — to §137a (func_801684B4, ov_MAIN_012; corroborated independently by func_80189E68, func_8017FF9C, func_801822B4, func_8018DA8C — wave dl)  <sub>L28018</sub>
-- **ADDENDUM** — to §8c / §88d (func_8016AB6C, ov_MAIN_012 — wave dm)  <sub>L28034</sub>
-- **ADDENDUM** — to §73 / §30#2 (func_800D1984, resident — wave dm)  <sub>L28048</sub>
-- **From** — ck + cl + cm  <sub>L28176</sub>
-- **ADDENDUM** — to §5a (func_80181F74, ov_SC03_112, wave cn)  <sub>L28318</sub>
-- **ADDENDUM** — to §265 (func_8017E26C, ov_SC04_016, wave cn)  <sub>L28368</sub>
-- **ADDENDUM** — to §42b (func_8018247C, ov_SC07_002, waves cu + cw)  <sub>L28406</sub>
-- **ADDENDUM** — to §195-E (func_800CFC1C, md_MAIN_003, wave cv)  <sub>L28492</sub>
-- **ADDENDUM** — to §215 addendum (func_800CB2C8, md_MAIN_033, waves cv + cw)  <sub>L28537</sub>
-- **ADDENDUM** — to §236 item 4 (func_8017D268, ov_SC04_006, wave cw)  <sub>L28593</sub>
-- **Harness-defect** — flags (not idioms — flagged for the operator)  <sub>L28654</sub>
-- **ADDENDUM** — to §250 (func_8017D7CC, ov_SC03_115 — cx/cy/cz/dr)  <sub>L28695</sub>
-- **ADDENDUM** — to §225 (func_8017E190, ov_SC03_115 — cx/cy/cz)  <sub>L28740</sub>
-- **ADDENDUM** — to §45-A (func_8017F6A4, ov_SC02_016 — cy/cz)  <sub>L28793</sub>
-- **ADDENDUM** — to §249 (func_80182ED4, ov_SC04_004 — dp/dr/dt)  <sub>L28837</sub>
-- **ADDENDUM** — to §199-A (func_801816FC, ov_SC02_005 — dp/dr/dt)  <sub>L28882</sub>
-- **Harness-defect** — flags  <sub>L28971</sub>
-- **§289** — an array local's address-taken base keeps every element's store alive, even though only one pointer escapes (`func_80189EFC`, ov_SC04_011) (P31 S60; waves #, byte-proven)  <sub>L29053</sub>
-- **ADDENDUM** — to §264-3 — the explicit entry copy's BOUND: required exactly when the RAW value must outlive the call that consumes only the PROMOTED value  <sub>L29207</sub>
-- **ADDENDUM** — to §276 — the SHARE direction: spell the second adjacent symbol RELATIVE to force ONE anchor  <sub>L29239</sub>
-- **ADDENDUM** — to §31's density-dummy dial (L2460/L2497) — the dose is TWO refs, and the dummy must sit where the loser is live-through  <sub>L29255</sub>
-- **§300** — S61 DISTILL BATCH NOTES (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2 · m0b)  <sub>L29561</sub>
-- **§306a** — T4 DISTILL ADDENDA (P31 S62; four byte-proven refinements to existing laws, verified against the book by an independent verifier; each names its parent §)  <sub>L29860</sub>
+- **§42d** — addendum — wave 4 (rtu_match fan-out over the mapped frontier, 2026-07-10c): 24/26 MATCH, +5 durable levers  <sub>L3097</sub>
+- **§3-B.** — THE EBB RULE — the general form of §46-L2  <sub>L3483</sub>
+- **§3-E.** — Meta  <sub>L3533</sub>
+- **§50** — Refinements that BOUND §47/§48 (from the `func_80135EB0` wall, 21→6; Phase 26 session 8)  <sub>L3591</sub>
+- **§51a** — The bug class  <sub>L3651</sub>
+- **§51c** — THE METHOD (do not audit by reading the regex)  <sub>L3677</sub>
+- **§51d** — THE LAWS  <sub>L3692</sub>
+- **§51e** — The false-wall pipeline (why this is not just hygiene)  <sub>L3754</sub>
+- **§3-Why** — the wall is (probably) intrinsic  <sub>L3960</sub>
+- **§3-The** — case  <sub>L4048</sub>
+- **§3-The** — rule  <sub>L4077</sub>
+- **§55a** — New byte-proven levers (each from a banked or near draft)  <sub>L4113</sub>
+- **§60a** — What the first DIRECTED grinder run exposed (Phase 29 Task-13B, 2026-07-21)  <sub>L4487</sub>
+- **§60b** — The plateau autopsy's verdict: a `partial` drift is a WRONG DRAFT, not a missing transform (Phase 29 Task-13B close, 2026-07-21)  <sub>L4525</sub>
+- **§66** — Exercise a banking driver's SUCCESS path before pointing it at a wave: the free re-bank test (Phase 29 SESSION-17, 2026-07-24)  <sub>L5174</sub>
+- **§66d-2** — Two operational sharp edges  <sub>L5304</sub>
+- **§66d-3** — Read the ILS per-cycle SERIES, not its final best: a repeated score and a still-falling one look identical in a summary line and mean opposite things  <sub>L5315</sub>
+- **§67** — The arg-copy PLACEMENT lever: launder a parameter into a fresh pseudo AT the statement where the target's copy lands (Phase 29 SESSION-18, `func_8014D820` 25 → 16)  <sub>L5330</sub>
+- **§66d-4** — "ILS converged" means converged FOR THAT WEIGHT PROFILE, not a floor (amends §66d-3; Phase 29 SESSION-18)  <sub>L5453</sub>
+- **§69** — How to attack a behemoth: map it, don't draft it (Phase 29 SESSION-18, `func_80183814`, 5,122 ins)  <sub>L5584</sub>
+- **What** — is left, and what is byte-recorded as SPENT  <sub>L5781</sub>
+- **§3-The** — mechanism, with citations  <sub>L6052</sub>
+- **§3-Two** — diagnosis traps this function proved  <sub>L6079</sub>
+- **Practice** — Practice  <sub>L6089</sub>
+- **§3-The** — drift was an allocation decision, not missing code  <sub>L6195</sub>
+- **§3-The** — economics  <sub>L6226</sub>
+- **§71** — has a blind spot, and this is it  <sub>L6241</sub>
+- **§3-The** — flagged "#1 move" LOST — and why the failure is informative  <sub>L6317</sub>
+- **§78** — 's attribution primitive, run and reproduced  <sub>L6327</sub>
+- **Cold-start** — economics, now complete  <sub>L6333</sub>
+- **Also** — reproduced on this function  <sub>L6416</sub>
+- **§3-And** — the banking footnote (§75a class A, one line)  <sub>L6420</sub>
+- **§83a** — READ THE HEADLINE NUMBER CORRECTLY: a LENGTH drift makes `match_one`'s count meaningless  <sub>L6434</sub>
+- **§83b** — THE LEVER: find the parameterised REPEAT before decoding case-by-case  <sub>L6442</sub>
+- **§83e** — §80 vindicated again, on the same day it was written  <sub>L6481</sub>
+- **§3-The** — conflict  <sub>L6559</sub>
+- **§3-THE** — FAILURE MODE — widening only `engine_core.h` is worse than not starting  <sub>L6567</sub>
+- **§3-The** — precondition, and how to check it in one grep  <sub>L6574</sub>
+- **Reading** — , for the next person  <sub>L6591</sub>
+- **§3-The** — guard refuses a class that largely works  <sub>L6606</sub>
+- **§3-The** — blindness ladder, now complete — FOUR classes `match_one` cannot see  <sub>L6664</sub>
+- **Consequence** — for the backlog ledger  <sub>L6674</sub>
+- **§88** — `cross_jump` will not merge a common suffix containing a CALL; and §78 is scoped to ORDERED comparisons only (Phase 29 SESSION-20, the behemoth close-out)  <sub>L6689</sub>
+- **§88a** — repeated CALL-shaped blocks are left UNMERGED; call-free tails are merged for you  <sub>L6694</sub>
+- **§89** — Two throughput rules the project already had written down and was not following (Phase 29 SESSION-20)  <sub>L6741</sub>
+- **§3-The** — standing sequence  <sub>L6773</sub>
+- **§90b** — "Byte-neutral" is not "wanted": undo on the SUCCESS path too  <sub>L6804</sub>
+- **§90c** — A library-callable function must FAIL CLOSED on an unconfigured module  <sub>L6814</sub>
+- **§90e** — An agent's CONCLUSION and its EVIDENCE fail independently — re-derive the premise, not the fix  <sub>L6833</sub>
+- **§93** — `set -o pipefail` attributes a pipeline failure to the LAST stage, not the failing one (Phase 29 SESSION-21, `func_8014D820`)  <sub>L6937</sub>
+- **§101** — The STALE DEFAULT class: a guard whose cause was removed is a silent skip wearing a safety label (Phase 29 SESSION-22, three instances in one session)  <sub>L7260</sub>
+- **§110** — A unit must define exactly ONE function, and "ends in `;`" does not tell you which line defines it (Phase 29 T65)  <sub>L7655</sub>
+- **§115** — A `func_XXXXXXXX` predicate rots by design: the same name-form assumption in THREE places (Phase 29 T78)  <sub>L7865</sub>
+- **§3-The** — fix moves the DEFINITION, not the stub — and here is why the obvious shortcut fails  <sub>L7910</sub>
+- **§117** — Spell the sibling's symbol from the SIBLING's address, not the exemplar's kind (Phase 29 T82)  <sub>L7941</sub>
+- **§118** — Ordinal (positional) immediate resolution: compare C tokens to the DIFFERING asm uses (Phase 29 T87)  <sub>L7978</sub>
+- **§119** — Two levers on the SAME axis, opposite directions: test the off-diagonal (Phase 29 T89)  <sub>L8012</sub>
+- **§3-The** — wiring trap that cost two attempts  <sub>L8058</sub>
+- **§3-The** — method (keep this)  <sub>L8228</sub>
+- **§3-The** — instrument rules that make its answer trustworthy (this is where I failed)  <sub>L8238</sub>
+- **§3-The** — corrected results (each SHA-verified, from a clean tree, restore re-verified)  <sub>L8253</sub>
+- **§3-The** — instrument trap that hid it (and it is §124's shape again)  <sub>L8305</sub>
+- **§3-The** — mechanics  <sub>L8314</sub>
+- **§3-The** — idiom they kept re-deriving: the constant-offset fold  <sub>L8371</sub>
+- **§127b** — the knowledge was in a SOURCE COMMENT, not the cookbook  <sub>L8401</sub>
+- **§128** — A raw NUL in C source makes grep SILENTLY SKIP the file (P30 S28, 137 files)  <sub>L8408</sub>
+- **§128a** — a negative control must corrupt a SCRATCH COPY, never the tracked file  <sub>L8440</sub>
+- **§3-The** — real blocker underneath, for the record  <sub>L8492</sub>
+- **§3-The** — diagnostic ladder that finally located it (reusable)  <sub>L8538</sub>
+- **Defect** — 1 — a pre-§8e MERGED DOUBLE is not a single-table predecessor  <sub>L8594</sub>
+- **Defect** — 2 — `as` writes a corpse and nothing deletes it  <sub>L8612</sub>
+- **§3-The** — fingerprint, and the 30-second ladder that found it  <sub>L8622</sub>
+- **§3-The** — transferable rule  <sub>L8643</sub>
+- **§132a** — `--like` is for a sibling with NO record; against one that HAS a record it over-derives (P30 S29, `ov_SC07_010`)  <sub>L8650</sub>
+- **§135** — Six byte-verified gcc-2.7.2 idioms from the P30 S6f-h waves (and the two-lane wave shape that found them)  <sub>L8780</sub>
+- **§3-The** — codegen idioms  <sub>L8785</sub>
+- **§3-The** — wave shape that produced these  <sub>L8834</sub>
+- **§136** — The LOCAL-VARIABLE lever: how many C locals, at what scope (P30 wave 4a, 25 byte-verified banks)  <sub>L8852</sub>
+- **§136a** — Blocker capture: classify on the OUTPUT, never on the exit status  <sub>L8991</sub>
+- **§136d** — Four gcc-2.7.2 levers the redraft lane found (each closed a residual no other lever moved)  <sub>L9109</sub>
+- **§136e** — §136c's PRECONDITION, and two more symptom keys (wave 4b batch 3)  <sub>L9153</sub>
+- **§136i** — The drafter model LADDER: Haiku → **Sonnet** → Opus → Fable5 (Drew, 2026-08-03)  <sub>L9285</sub>
+- **§3-The** — triage, cheapest first  <sub>L9436</sub>
+- **THREE** — carry variants hide in one "CARRY-FIXABLE" bucket — and they need different fixes  <sub>L9505</sub>
+- **STEP** — 0 of sibling-first: grep `src/` for a distinctive LITERAL from the `.s`  <sub>L9561</sub>
+- **§3-The** — generalisation — three corollaries worth more than the bug  <sub>L9641</sub>
+- **§3-And** — the inverse-lookup trap, same session  <sub>L9658</sub>
+- **§3-The** — three-line proof (do this before diagnosing any metric movement)  <sub>L9695</sub>
+- **§3-The** — two instrument defects it exposed  <sub>L9704</sub>
+- **§3-Two** — wrong mechanisms I chased first, and why they were wrong  <sub>L9735</sub>
+- **§3-The** — trap that hid it — SAME FUNCTION, TWO ROUTES, ONLY ONE IS FREE  <sub>L9820</sub>
+- **Route** — selection (why `--addr` sometimes says "nothing changed")  <sub>L9829</sub>
+- **§144** — THE LITERAL'S SPELLING PICKS THE IMMEDIATE ENCODING (P30 S40 wave 1, `func_801822E0`)  <sub>L9903</sub>
+- **§3-Why** — a correct draft can read as an intrinsic wall  <sub>L10003</sub>
+- **§3-The** — rule  <sub>L10038</sub>
+- **§3-B.** — `(v < 0x40) ? v : 0x3F` is folded to `MIN_EXPR` and expands to the WRONG SHAPE  <sub>L10185</sub>
+- **§3-D.** — Reproduce the original's BUGS verbatim  <sub>L10209</sub>
+- **§149** — Four instrument defects in one session, and the two questions they were hiding (P30 S43)  <sub>L10258</sub>
+- **§3-A.** — A prep step that returns its input on failure is indistinguishable from a search that found nothing  <sub>L10264</sub>
+- **§3-B.** — Same address + same name ≠ same body — and the ledger keys on address  <sub>L10282</sub>
+- **§3-C.** — `make: *** [...] Error N` is a summary, never a diagnosis  <sub>L10298</sub>
+- **§3-The** — fix  <sub>L10334</sub>
+- **§3-The** — method that found it (this is the transferable part)  <sub>L10344</sub>
+- **Diagnostic** — order (adopt this)  <sub>L10371</sub>
+- **§3-The** — mechanism (read from cc1's own `-dR` trace, not inferred)  <sub>L10387</sub>
+- **§3-The** — lever — a zero-emission insn that absorbs the blocked tick  <sub>L10402</sub>
+- **§3-The** — finding  <sub>L10438</sub>
+- **§3-The** — key  <sub>L10447</sub>
+- **§3-Two** — cautions that must travel with this technique  <sub>L10458</sub>
+- **§3-The** — companion defect (open)  <sub>L10469</sub>
+- **Symptom** — Symptom  <sub>L10489</sub>
+- **Mechanism** — (gcc source + RTL dumps, not inferred)  <sub>L10494</sub>
+- **§3-The** — cure — a fresh launder per site, each in its own block  <sub>L10507</sub>
+- **Companion** — levers from the same function  <sub>L10517</sub>
+- **§3-B.** — Two static base-derivation methods that must AGREE (use both)  <sub>L10551</sub>
+- **§155a** — the same failure class, one level up: SHAPE-blind table scanning (S45 p5)  <sub>L10582</sub>
+- **§155c** — the ZERO-REFERENCE trap: gcc splits a global-array address across the `lui` and the LOAD (S46)  <sub>L10625</sub>
+- **Symptom** — Symptom  <sub>L10736</sub>
+- **§3-Why** — the fork is chained (gcc source, validated insn-by-insn against -dS/-dR dumps)  <sub>L10742</sub>
+- **§3-The** — method (dump-arithmetic first, then place — no probing)  <sub>L10755</sub>
+- **§162a** — SHARPENS  *(sharpens §161a, §131, §8a-pad, §129a)*  <sub>L11056</sub>
+- **§162b** — SHARPENS  *(sharpens §48-A3, §156, §150, §76)*  <sub>L11085</sub>
+- **§162d** — SHARPENS  *(sharpens §31, §21, §30, §55a)*  <sub>L11114</sub>
+- **§162e** — NEW  <sub>L11156</sub>
+- **§162f** — SHARPENS  *(sharpens §42d, §41d, §73, §10)*  <sub>L11224</sub>
+- **§162g** — NEW  <sub>L11279</sub>
+- **§162h** — SHARPENS  *(sharpens §88, §88a, §50-B, §8)*  <sub>L11315</sub>
+- **§162i** — SHARPENS  *(sharpens §135, §21, §42, §32)*  <sub>L11383</sub>
+- **§162j** — SHARPENS  *(sharpens §25, §136d-1, §48-B, §46-L2)*  <sub>L11408</sub>
+- **§162k** — SHARPENS  *(sharpens §1-I2, §12, §160d, §21)*  <sub>L11437</sub>
+- **§162l** — SHARPENS  *(sharpens §48-B, §48-C1, §20, §21)*  <sub>L11500</sub>
+- **§162m** — SHARPENS  *(sharpens §36, §158, §148, §153)*  <sub>L11555</sub>
+- **§158a** — THE FIFTH LEVER IS NOT AN ASM: `do { } while (0)` is a REGION ref-multiplier you MINT (P30 S48, `func_8017CBC8`, ov_MAIN_012 / jr_801789AC, 188 ins → MATCH)  <sub>L11557</sub>
+- **Size** — it before you write it (§158 step 1-2, applied)  <sub>L11575</sub>
+- **§3-The** — wrap BOUNDARY is the dial — and it is indiscriminate  <sub>L11596</sub>
+- **§3-Not** — a pure dial  <sub>L11602</sub>
+- **§162n** — NEW  <sub>L11628</sub>
+- **§162o** — SHARPENS  *(sharpens §158, §136-1, §136-6, §79)*  <sub>L11661</sub>
+- **§162p** — SHARPENS  *(sharpens §48-B, §46-L2, §156, §136d-1)*  <sub>L11720</sub>
+- **§162q** — SHARPENS  *(sharpens §30, §30a, §135-2, §136-13)*  <sub>L11737</sub>
+- **§164** — S48 §163z SKEPTIC PASS (P30, 2026-08-12): 190 claims vetted, 82 banked  <sub>L11863</sub>
+- **§169** — THE MICRO-ADAPT LANE (P30 S49): edit a proven body, don't crack a new one  <sub>L16291</sub>
+- **§170** — THE A-PROP WORD-DIFF CARD (P30 S49): the lane that had no owner  <sub>L16338</sub>
+- **§171** — THE STALE SEED SYMBOL (P30 S50, 2026-08-13): why §170's 91%→57% was never codegen  <sub>L16382</sub>
+- **§172** — THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 MIPS  <sub>L16531</sub>
+- **§172a** — TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max)  <sub>L16585</sub>
+- **§172b** — THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask)  <sub>L16601</sub>
+- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16680</sub>
+- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16775</sub>
+- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16815</sub>
+- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17054</sub>
+- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17180</sub>
+- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17254</sub>
+- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17266</sub>
+- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17295</sub>
+- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17310</sub>
+- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17400</sub>
+- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17450</sub>
+- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17501</sub>
+- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17597</sub>
+- **Considered** — and NOT banked  <sub>L17620</sub>
+- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17798</sub>
+- **What** — is NOT banked here  <sub>L17815</sub>
+- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17876</sub>
+- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17895</sub>
+- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17964</sub>
+- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18376</sub>
+- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19210</sub>
+- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19537</sub>
+- **§197-REJECTED** — §197-REJECTED  <sub>L20707</sub>
+- **§199-REJECTED** — §199-REJECTED  <sub>L21103</sub>
+- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21205</sub>
+- **§201-REJECTED** — eight, the session's highest  <sub>L21439</sub>
+- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21905</sub>
+- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21999</sub>
+- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22266</sub>
+- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22448</sub>
+- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22493</sub>
+- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22671</sub>
+- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22992</sub>
+- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L23053</sub>
+- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23090</sub>
+- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23154</sub>
+- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23251</sub>
+- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23257</sub>
+- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23272</sub>
+- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23281</sub>
+- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23372</sub>
+- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23535</sub>
+- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23609</sub>
+- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23638</sub>
+- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L24006</sub>
+- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L24053</sub>
+- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24168</sub>
+- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24217</sub>
+- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24228</sub>
+- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24245</sub>
+- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24274</sub>
+- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24333</sub>
+- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24450</sub>
+- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24467</sub>
+- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24564</sub>
+- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24636</sub>
+- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24647</sub>
+- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24656</sub>
+- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24687</sub>
+- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24737</sub>
+- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24871</sub>
+- **§264** — FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59)  <sub>L24942</sub>
+- **ADD-1** — → §231 addendum (also cross-ref from §195-D) — THE MASKED-`jal` "MISSING CALL" ILLUSION  <sub>L25102</sub>
+- **ADD-6** — → §172b-1 / §264 addendum — SHIFT-AS-TEST: `(x << 16) != 0` TESTS THE LOW HALF WITHOUT TRUNCATING THE PSEUDO  <sub>L25156</sub>
+- **ADD-7** — → §256 addendum — THE SINGLE-GUARD GOTO: THEN-BLOCK OUT OF LINE AT THE TAIL  <sub>L25165</sub>
+- **ADD-3** — → §238 addendum — TWO BINARIES CAN EACH DEFINE THE SAME `func_` NAME WITH DIFFERENT BYTES, AND NO GENERATED REPORT SHOWS IT  <sub>L25355</sub>
+- **§270** — The A-prop 0-bank anatomy: a byte-correct body still needs FOUR layers to agree (P31 S59)  <sub>L25533</sub>
+- **ADDENDUM** — to §1-I5  <sub>L25823</sub>
+- **ADDENDUM** — to §164-51  <sub>L25888</sub>
+- **ADDENDUM** — to §176-F5  <sub>L25904</sub>
+- **ADDENDUM** — to §225  <sub>L25933</sub>
+- **ADDENDUM** — to §229 — A POINTER'S NUMBER OF USES DECIDES WHETHER ITS ADDRESS FOLDS OR SURVIVES A CALL  <sub>L26121</sub>
+- **ADDENDUM** — to §226 — A DEAD LOCAL SCOPED TO A NESTED BLOCK BUYS A MID-FUNCTION `addiu sp` PAIR, NOT A FRAME-SIZE CHANGE  <sub>L26239</sub>
+- **ADDENDUM** — to §74 (func_800D0E30, resident)  <sub>L26607</sub>
+- **ADDENDUM** — to §172b-4 (func_80185054, ov_SC03_097)  <sub>L26643</sub>
+- **ADDENDUM** — to §265 (func_8017DC80, ov_SC07_002)  <sub>L26681</sub>
+- **ADDENDUM** — to §17 (func_800CB794, md_MAIN_036)  <sub>L26720</sub>
+- **ADDENDUM** — to §162p (func_8017C120, ov_MAIN_012)  <sub>L26768</sub>
+- **ADDENDUM** — to §20 (~L1947) (func_80186AD0, ov_SC06_032)  <sub>L26802</sub>
+- **ADDENDUM** — to §164-56 (func_8017F644, ov_SC04_005)  <sub>L26832</sub>
+- **ADDENDUM** — to §237 (func_8017F7FC, ov_SC03_092)  <sub>L26867</sub>
+- **ADDENDUM** — to §195-E — a goto-ladder's STORES must sit AT the labels, after the gotos, not inline before them  <sub>L27219</sub>
+- **Harness-defect** — flags  <sub>L27693</sub>
+- **ADDENDUM** — to §167-40 (func_8017E2CC, ov_SC04_015 — wave dg)  <sub>L27786</sub>
+- **ADDENDUM** — to §87 (func_801815F4 ov_SC06_032; corroborating func_801840DC ov_SC05_017, func_80189C68 ov_SC03_006 — wave dg)  <sub>L27820</sub>
+- **ADDENDUM** — to §263 (func_801E83AC, md_SC04_029 — wave dj)  <sub>L27859</sub>
+- **ADDENDUM** — to §265 (func_8017D878, ov_SC03_107 — wave dj; corroborated by a REJECTED, contradicted card in wave dm — see closing)  <sub>L27873</sub>
+- **ADDENDUM** — to §6 (func_801811F0, ov_SC03_102 — waves dj and dl, corroborated by a self-reported "nothing new" dm-wave card)  <sub>L27887</sub>
+- **ADDENDUM** — to §195-G (func_80183BB0, ov_SC05_001 — wave dj)  <sub>L27901</sub>
+- **ADDENDUM** — to §74 (func_8017EB34, ov_SC03_117 — counter/clamp variant; wave dj, corroborated by dk/dl/dm cards on the same function)  <sub>L27979</sub>
+- **ADDENDUM** — §37 — merged into the §153/§236-5 entry above (func_801A419C, wave dl)  <sub>L27999</sub>
+- **ADDENDUM** — §6 — merged into the §6 entry above (func_801811F0, wave dl)  <sub>L28007</sub>
+- **ADDENDUM** — to §238 (func_80182CB4, ov_SC02_000 — wave dl)  <sub>L28015</sub>
+- **ADDENDUM** — to §137a (func_801684B4, ov_MAIN_012; corroborated independently by func_80189E68, func_8017FF9C, func_801822B4, func_8018DA8C — wave dl)  <sub>L28033</sub>
+- **ADDENDUM** — to §8c / §88d (func_8016AB6C, ov_MAIN_012 — wave dm)  <sub>L28049</sub>
+- **ADDENDUM** — to §73 / §30#2 (func_800D1984, resident — wave dm)  <sub>L28063</sub>
+- **From** — ck + cl + cm  <sub>L28191</sub>
+- **ADDENDUM** — to §5a (func_80181F74, ov_SC03_112, wave cn)  <sub>L28333</sub>
+- **ADDENDUM** — to §265 (func_8017E26C, ov_SC04_016, wave cn)  <sub>L28383</sub>
+- **ADDENDUM** — to §42b (func_8018247C, ov_SC07_002, waves cu + cw)  <sub>L28421</sub>
+- **ADDENDUM** — to §195-E (func_800CFC1C, md_MAIN_003, wave cv)  <sub>L28507</sub>
+- **ADDENDUM** — to §215 addendum (func_800CB2C8, md_MAIN_033, waves cv + cw)  <sub>L28552</sub>
+- **ADDENDUM** — to §236 item 4 (func_8017D268, ov_SC04_006, wave cw)  <sub>L28608</sub>
+- **Harness-defect** — flags (not idioms — flagged for the operator)  <sub>L28669</sub>
+- **ADDENDUM** — to §250 (func_8017D7CC, ov_SC03_115 — cx/cy/cz/dr)  <sub>L28710</sub>
+- **ADDENDUM** — to §225 (func_8017E190, ov_SC03_115 — cx/cy/cz)  <sub>L28755</sub>
+- **ADDENDUM** — to §45-A (func_8017F6A4, ov_SC02_016 — cy/cz)  <sub>L28808</sub>
+- **ADDENDUM** — to §249 (func_80182ED4, ov_SC04_004 — dp/dr/dt)  <sub>L28852</sub>
+- **ADDENDUM** — to §199-A (func_801816FC, ov_SC02_005 — dp/dr/dt)  <sub>L28897</sub>
+- **Harness-defect** — flags  <sub>L28986</sub>
+- **§289** — an array local's address-taken base keeps every element's store alive, even though only one pointer escapes (`func_80189EFC`, ov_SC04_011) (P31 S60; waves #, byte-proven)  <sub>L29068</sub>
+- **ADDENDUM** — to §264-3 — the explicit entry copy's BOUND: required exactly when the RAW value must outlive the call that consumes only the PROMOTED value  <sub>L29222</sub>
+- **ADDENDUM** — to §276 — the SHARE direction: spell the second adjacent symbol RELATIVE to force ONE anchor  <sub>L29254</sub>
+- **ADDENDUM** — to §31's density-dummy dial (L2460/L2497) — the dose is TWO refs, and the dummy must sit where the loser is live-through  <sub>L29270</sub>
+- **§300** — S61 DISTILL BATCH NOTES (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2 · m0b)  <sub>L29576</sub>
+- **§306a** — T4 DISTILL ADDENDA (P31 S62; four byte-proven refinements to existing laws, verified against the book by an independent verifier; each names its parent §)  <sub>L29875</sub>
 
 
 ## All sections, in order
@@ -1508,813 +1511,814 @@
 - **§40c** — The h_seq per-sibling reconcile: templating a reconcile-class crack ×134 (Phase 26 Task 8, 2026-07-12, byte-proven)  <sub>L2676</sub>
 - **§31-triage** — R17 applies to CODEGEN residuals, never to a compile ERROR (Phase 26 session 7, Drew asked)  <sub>L2693</sub>
 - **§41** — The DEF-SIDE canonical-sig wall: mechanically banking a drafted giant past `conflicting types` (Phase 25 T5b batch-2, 2026-07-09; `tools/canon_sig_reconcile.py`, byte-proven on `func_8013B274`)  <sub>L2710</sub>
-- **§41a** — v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that dissolve them (Phase 25 T6, Fable5, 2026-07-09)  <sub>L2754</sub>
-- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2809</sub>
-- **§41c** — T7-M2: the ×134 def-side-wall sweep via per-sibling RE-reconcile (Phase 25, 2026-07-10; 4,389 banks, ~0 agent tokens)  <sub>L2839</sub>
-- **§41b** — addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25 T7-M4, 2026-07-10)  <sub>L2858</sub>
-- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2878</sub>
-- **§42** — The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 25 T7 F-band, 2026-07-10; Ultracode 9-worker wave, 4/9 banked byte-identical, 266 swept ×134)  <sub>L2900</sub>
-- **§42a** — addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-assign fix, +5 levers (2026-07-10b)  <sub>L2953</sub>
-- **§42b** — addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cast drift + fix  <sub>L2994</sub>
-- **§42c** — addendum — wave 3 (Max orchestrator + CORRECTED Ultracode fan-out, 2026-07-10c): the real-TU-faithful parallel harness (rtu_match) + 7/9 crack, ZERO iso-drift  <sub>L3033</sub>
-- **§42d** — addendum — wave 4 (rtu_match fan-out over the mapped frontier, 2026-07-10c): 24/26 MATCH, +5 durable levers  <sub>L3082</sub>
-- **§42e** — propagating a CRACK ×134: the def-finder bug + the byte-drift residual (the "remap-fail" misdiagnosis)  <sub>L3121</sub>
-- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3195</sub>
-- **§44** — The Phase-25 cheap-Opus giant batch: 5 structural levers + the §43 extension (2026-07-11, 6 crackers over the frontier giants)  <sub>L3242</sub>
-- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3298</sub>
-- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3313</sub>
-- **§47** — The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm (Phase 26 session 8, Fable5 Max, byte-proven on `func_8017BEBC` 952 ins ×113)  <sub>L3365</sub>
-- **§48** — The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, Ultracode, 9/12 MATCH first pass)  <sub>L3405</sub>
-- **§3-A.** — ALLOCNO-PRICING DIALS — move a value into the register you want, byte-neutrally  <sub>L3413</sub>
-- **§3-A4** — SINK THE CONSUMER CALL INTO THE ARMS (the inverse of A1; `func_8016AB6C`, byte-proven)  <sub>L3444</sub>
-- **§3-B.** — THE EBB RULE — the general form of §46-L2  <sub>L3468</sub>
-- **§3-C.** — TYPE- AND SHAPE-DRIVEN CODEGEN (the C type literally selects the addressing mode)  <sub>L3484</sub>
-- **§3-D.** — THE CROSS-JUMP RATCHET (the sharpest new trap — `func_80131340` L-C)  <sub>L3508</sub>
-- **§3-E.** — Meta  <sub>L3518</sub>
-- **§49** — The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` (536 ins ×134), Phase 26 session 8  <sub>L3527</sub>
-- **§50** — Refinements that BOUND §47/§48 (from the `func_80135EB0` wall, 21→6; Phase 26 session 8)  <sub>L3576</sub>
-- **§51** — TOOLING INTEGRITY: the silent skip, and how to hunt it  <sub>L3630</sub>
-- **§51a** — The bug class  <sub>L3636</sub>
-- **§51b** — Why the byte-gate cannot save you  <sub>L3652</sub>
-- **§51c** — THE METHOD (do not audit by reading the regex)  <sub>L3662</sub>
-- **§51d** — THE LAWS  <sub>L3677</sub>
-- **§51e** — The false-wall pipeline (why this is not just hygiene)  <sub>L3739</sub>
-- **§51f** — Checklist for any new corpus-scanning tool  <sub>L3755</sub>
-- **§51g** — When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`)  <sub>L3769</sub>
-- **§52** — The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wall (`func_80178004`, 165 ins ×134; Phase 26, Fable5, 2026-07-15)  <sub>L3913</sub>
-- **§3-The** — 6 levers (the "walker-family skeleton" — apply to the 12 siblings; levers 1-5 retire ~half the residual)  <sub>L3924</sub>
-- **§3-Why** — the wall is (probably) intrinsic  <sub>L3945</sub>
-- **§52a** — The regalloc sibling wave: new levers + two new wall classes (cheap-Opus applying §52, 2026-07-15)  <sub>L3959</sub>
-- **§52b** — Sibling wave 2: more de-pin levers, a third wall class, and the match_one→whole-binary gap at scale (2026-07-15)  <sub>L3997</sub>
-- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4028</sub>
-- **§3-The** — case  <sub>L4033</sub>
-- **§3-Why** — 0/8 was structural, and predictable from two words  <sub>L4045</sub>
-- **§3-The** — rule  <sub>L4062</sub>
-- **§3-The** — meta-lesson (R35, and why this one is expensive)  <sub>L4078</sub>
-- **§55** — Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, 2026-07-17)  <sub>L4093</sub>
-- **§55a** — New byte-proven levers (each from a banked or near draft)  <sub>L4098</sub>
-- **§55b** — THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost)  <sub>L4122</sub>
-- **§55c** — Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TREE ARTIFACT  <sub>L4141</sub>
-- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4163</sub>
-- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4187</sub>
-- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4232</sub>
-- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4256</sub>
-- **§57a** — Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026-07-18)  <sub>L4303</sub>
-- **§58** — match_one MATCH ≠ BANK: the four blind spots + the crack-wave reconcile-before-bank law (Phase 29 crack-wave, 2026-07-18)  <sub>L4343</sub>
-- **§59** — Three h_seq sweep-residual classes match_one/the-exemplar-bank don't reveal (Phase 29 crack-wave close, 2026-07-18)  <sub>L4377</sub>
-- **§60** — Classify the residual, don't rank it: the deterministic residual→class classifier and what it measured about the backlog (Phase 29 Task-13A, 2026-07-21)  <sub>L4407</sub>
-- **What** — it measured — the whole open backlog, byte-grounded  <sub>L4431</sub>
-- **§3-Two** — corollaries worth remembering  <sub>L4450</sub>
-- **§3-The** — parallel-probe race this surfaced  <sub>L4463</sub>
-- **§60a** — What the first DIRECTED grinder run exposed (Phase 29 Task-13B, 2026-07-21)  <sub>L4472</sub>
-- **§60b** — The plateau autopsy's verdict: a `partial` drift is a WRONG DRAFT, not a missing transform (Phase 29 Task-13B close, 2026-07-21)  <sub>L4510</sub>
-- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4545</sub>
-- **§61a** — The Task-5 wave: 11/12 MATCH, 0 banked — three DISTINCT integration walls, each now named (Phase 29, 2026-07-21)  <sub>L4606</sub>
-- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4658</sub>
-- **§61c** — The jtbl bank is INCREMENTALLY valid and CLEAN-INVALID (Phase 29, 2026-07-21) — the blocking finding  <sub>L4713</sub>
-- **§61d** — The undo was eating the tree: two tools, one defect, invisible to the byte-gate (Phase 29, 2026-07-22)  <sub>L4779</sub>
-- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4833</sub>
-- **§63** — The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`, Phase 29 SESSION-13, 2026-07-23)  <sub>L4877</sub>
-- **§64** — The §20 type-lift's three laws: fold the tagged typedef, check VISIBILITY, and strip only what is TEXTUALLY IDENTICAL (`lift_types.py`, Phase 29 SESSION-14, 2026-07-23)  <sub>L4908</sub>
-- **§64a** — VARIANT types: UNIQUIFY the camps, do not reconcile them (`uniquify_type.py`, Phase 29 SESSION-14)  <sub>L4957</sub>
-- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5000</sub>
-- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5015</sub>
-- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5030</sub>
-- **§65b** — The escape: de-macroize the instantiation, don't touch the shared header  <sub>L5045</sub>
-- **§65c** — `rtu_match` MATCH → bank held 13/13 on self-decl, but broke on the FIRST callee-decl case  <sub>L5081</sub>
-- **§65d** — Existing-ladder baseline, measured (do this before building a recovery stage)  <sub>L5091</sub>
-- **§65e** — Two oracles, and the disagreement is the finding (R34 in practice)  <sub>L5101</sub>
-- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5118</sub>
-- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5139</sub>
-- **§66** — Exercise a banking driver's SUCCESS path before pointing it at a wave: the free re-bank test (Phase 29 SESSION-17, 2026-07-24)  <sub>L5159</sub>
-- **§66a** — The widest write in a pipeline is the one most likely to be UNDECLARED  <sub>L5181</sub>
-- **§66b** — A metric parsed out of another tool's prose goes NULL silently when the label changes  <sub>L5200</sub>
-- **§66c** — Before a wave, verify the FUEL exists; an "already attempted" set built from the wrong directory lies in BOTH directions  <sub>L5217</sub>
-- **§66d** — The permuter⇄reader loop: alternate a random search with a byte-verified idiom, and let `residual_class` decide whose turn it is (Phase 29 SESSION-17)  <sub>L5245</sub>
-- **§66d-1** — What transfers between giants is the LOOP, not the PIN  <sub>L5280</sub>
-- **§66d-2** — Two operational sharp edges  <sub>L5289</sub>
-- **§66d-3** — Read the ILS per-cycle SERIES, not its final best: a repeated score and a still-falling one look identical in a summary line and mean opposite things  <sub>L5300</sub>
-- **§67** — The arg-copy PLACEMENT lever: launder a parameter into a fresh pseudo AT the statement where the target's copy lands (Phase 29 SESSION-18, `func_8014D820` 25 → 16)  <sub>L5315</sub>
-- **§67a** — Run the symbol-set guard BEFORE you pay for a gate (`tools/symcheck.py`, Phase 29 SESSION-18)  <sub>L5405</sub>
-- **§66d-4** — "ILS converged" means converged FOR THAT WEIGHT PROFILE, not a floor (amends §66d-3; Phase 29 SESSION-18)  <sub>L5438</sub>
-- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5491</sub>
-- **§68** — A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase 29 SESSION-18)  <sub>L5524</sub>
-- **§69** — How to attack a behemoth: map it, don't draft it (Phase 29 SESSION-18, `func_80183814`, 5,122 ins)  <sub>L5569</sub>
-- **§70** — The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `func_801777BC`)  <sub>L5619</sub>
-- **§71** — Before mapping a giant, look for an already-matched SIBLING beside it (Phase 29 SESSION-18, `func_8017D960`, 3,338 ins)  <sub>L5660</sub>
-- **§72** — A `register __asm__` pin is a PREFERENCE, not a reservation (Phase 29 SESSION-18, `func_8017F510`)  <sub>L5726</sub>
-- **§3-The** — honest fix was source-level and cheap  <sub>L5750</sub>
-- **§3-Giv** — record order (the §70 family)  <sub>L5760</sub>
-- **What** — is left, and what is byte-recorded as SPENT  <sub>L5766</sub>
-- **§73** — A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at each use, T0). Diagnose which before paying for the expensive one (Phase 29 SESSION-19, `func_8014F3E8` + `func_8014D4C0`)  <sub>L5783</sub>
-- **§74** — Auditing a pinned draft: the §72 hazard is CALLER-SAVED pins spanning a call, and only the disassembly can tell you (Phase 29 SESSION-19, `func_8017D960` b2, 5 pins)  <sub>L5822</sub>
-- **§75** — A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the carried extern before believing the exclusion message (Phase 29 SESSION-19, `func_8014F3E8` ×4 → ×138)  <sub>L5866</sub>
-- **§75a** — The exclusion classes, enumerated with named causes (Phase 29 SESSION-19, the 134-binary `dedup_extend` sweep)  <sub>L5925</sub>
-- **§75b** — A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the externs (Phase 29 SESSION-19, `func_80165CA0` ×3 → fleet)  <sub>L5948</sub>
-- **§75c** — Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix moves the error and looks like a new wall (Phase 29 SESSION-19, `func_8012F14C`)  <sub>L5997</sub>
-- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6028</sub>
-- **§3-The** — mechanism, with citations  <sub>L6037</sub>
-- **§3-The** — attribution primitive (use this before calling anything a scheduling residual)  <sub>L6057</sub>
-- **§3-Two** — diagnosis traps this function proved  <sub>L6064</sub>
-- **Practice** — Practice  <sub>L6074</sub>
-- **§77** — Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silently caps the body's reach. Diff the preamble before you gate. (Phase 29 SESSION-19 — three variants in one session, two different tools)  <sub>L6084</sub>
-- **§3-The** — CANDIDATE gate and the REAL gate need DIFFERENT preambles — keep the difference out of the bank  <sub>L6124</sub>
-- **§78** — A LENGTH drift can be a register grant in disguise; and `fold` never leaves a literal first in an `|` chain (Phase 29 SESSION-19, behemoth #2 `func_8017D960` 3,338 ins, 1806 → 0, pin-free)  <sub>L6174</sub>
-- **§3-The** — drift was an allocation decision, not missing code  <sub>L6180</sub>
-- **§3-The** — economics  <sub>L6211</sub>
-- **§79** — For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT ORDER is a declaration-order oracle (Phase 29 SESSION-19, `func_8017BF14` 4,763 ins, cold start → 45/4763)  <sub>L6220</sub>
-- **§71** — has a blind spot, and this is it  <sub>L6226</sub>
-- **§3-NEW** — LEVER — the frame layout reads back the original declaration order  <sub>L6240</sub>
-- **§76** — confirmed at scale, and a pin nuance  <sub>L6251</sub>
-- **§3-The** — residual, and the honest read  <sub>L6260</sub>
-- **§80** — A do-not-re-buy entry is scoped to its BASE, not to the function; and the pin's hidden cost is an unconditional `qty_phys_sugg` (Phase 29 SESSION-19, `func_8017BF14` 45 → 0)  <sub>L6270</sub>
-- **§3-The** — pin's hidden cost, with the citation  <sub>L6291</sub>
-- **§3-The** — flagged "#1 move" LOST — and why the failure is informative  <sub>L6302</sub>
-- **§78** — 's attribution primitive, run and reproduced  <sub>L6312</sub>
-- **Cold-start** — economics, now complete  <sub>L6318</sub>
-- **§81** — Banking a jr (jump-table) function: the 3-step carve chain, and why `match_one` cannot see the problem (Phase 29 SESSION-19, `func_8017C954`)  <sub>L6323</sub>
-- **§3-The** — defect this exposed: a shared type that is present but invisible  <sub>L6354</sub>
-- **§82** — Two source-shape oracles from behemoth #6: a duplicated `addiu $aN,$sp,K` across a `jal` means the block was INLINED, and scalar-vs-aggregate decides WHEN a stack slot is allocated (Phase 29 SESSION-19, `func_8017C730` 1,061 ins)  <sub>L6370</sub>
-- **§3-1.** — The inlined-helper signature  <sub>L6375</sub>
-- **§3-2.** — Scalar vs aggregate decides *when* the slot is allocated  <sub>L6389</sub>
-- **Also** — reproduced on this function  <sub>L6401</sub>
-- **§3-And** — the banking footnote (§75a class A, one line)  <sub>L6405</sub>
-- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6412</sub>
-- **§83a** — READ THE HEADLINE NUMBER CORRECTLY: a LENGTH drift makes `match_one`'s count meaningless  <sub>L6419</sub>
-- **§83b** — THE LEVER: find the parameterised REPEAT before decoding case-by-case  <sub>L6427</sub>
-- **§83c** — TRAP: a "dead local" in a prior draft may be gcc's OWN spill area  <sub>L6445</sub>
-- **§83d** — CSE's quantity budget is WHOLE-FUNCTION, so a local rewrite cannot fix a local symptom  <sub>L6452</sub>
-- **§83e** — §80 vindicated again, on the same day it was written  <sub>L6466</sub>
-- **§84** — The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between two per-overlay symbols, and why `match_one` is structurally blind to it (Phase 29 SESSION-20, `func_8013D53C`)  <sub>L6472</sub>
-- **§3-The** — construct  <sub>L6477</sub>
-- **§3-Why** — it survived every candidate gate  <sub>L6495</sub>
-- **§3-THE** — FIX IS MECHANICAL — the tool already holds the answer  <sub>L6510</sub>
-- **Scope** — , measured (do not over-generalise — §80)  <sub>L6518</sub>
-- **§3-Two** — ladder lessons banked with it  <sub>L6528</sub>
-- **§85** — The RETURN-axis fleet widen is ALL-OR-NOTHING: widening the shared header alone guarantees a conflict in the source overlay (Phase 29 SESSION-20, `func_8012CC88` / `func_8014D12C`)  <sub>L6539</sub>
-- **§3-The** — conflict  <sub>L6544</sub>
-- **§3-THE** — FAILURE MODE — widening only `engine_core.h` is worse than not starting  <sub>L6552</sub>
-- **§3-The** — precondition, and how to check it in one grep  <sub>L6559</sub>
-- **§3-Do** — the WHOLE axis in one edit, then R22 once  <sub>L6567</sub>
-- **Reading** — , for the next person  <sub>L6576</sub>
-- **§86** — Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §42e pin guard is now over-conservative (Phase 29 SESSION-20)  <sub>L6589</sub>
-- **§3-The** — guard refuses a class that largely works  <sub>L6591</sub>
-- **§3-THE** — LAW: all-or-nothing PER FAMILY  <sub>L6600</sub>
-- **§3-Why** — the two live families differ from the three dead ones — the open question  <sub>L6627</sub>
-- **§87** — `match_one` COMPILES but never LINKS, so an unresolvable data symbol reads as MATCH; and stored drafts go STALE against the tree (Phase 29 SESSION-20)  <sub>L6633</sub>
-- **§3-The** — blindness ladder, now complete — FOUR classes `match_one` cannot see  <sub>L6649</sub>
-- **Consequence** — for the backlog ledger  <sub>L6659</sub>
-- **§3-The** — cheap discriminator, before spending a sweep  <sub>L6666</sub>
-- **§88** — `cross_jump` will not merge a common suffix containing a CALL; and §78 is scoped to ORDERED comparisons only (Phase 29 SESSION-20, the behemoth close-out)  <sub>L6674</sub>
-- **§88a** — repeated CALL-shaped blocks are left UNMERGED; call-free tails are merged for you  <sub>L6679</sub>
-- **§88b** — the `slti` literal-position law (extends §78 to comparisons)  <sub>L6686</sub>
-- **§88d** — BANKING ORDER: run the §81 carve chain BEFORE banking, never after  <sub>L6701</sub>
-- **§88e** — a wrong diagnosis, refuted properly (the model for how to treat an inherited lever)  <sub>L6708</sub>
-- **§88f** — the missing rung: a RELOCATION gate between `match_one` and the binary  <sub>L6718</sub>
-- **§89** — Two throughput rules the project already had written down and was not following (Phase 29 SESSION-20)  <sub>L6726</sub>
-- **§89a** — MEASURE the write set; do not assert its tier (`tools/blast_radius.py`)  <sub>L6732</sub>
-- **§89b** — the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel.py`)  <sub>L6745</sub>
-- **§3-The** — standing sequence  <sub>L6758</sub>
-- **§90** — Five tool-integrity laws from one session, each of which changed an answer (Phase 29 SESSION-21, 2026-07-27)  <sub>L6766</sub>
-- **§90a** — A comparison tool MUST share its reference oracle's index space, exactly  <sub>L6772</sub>
-- **§90b** — "Byte-neutral" is not "wanted": undo on the SUCCESS path too  <sub>L6789</sub>
-- **§90c** — A library-callable function must FAIL CLOSED on an unconfigured module  <sub>L6799</sub>
-- **§90d** — Do not measure a live wave's drafts (§87 in real time)  <sub>L6810</sub>
-- **§90e** — An agent's CONCLUSION and its EVIDENCE fail independently — re-derive the premise, not the fix  <sub>L6818</sub>
-- **§91** — A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap (Phase 29 SESSION-21, `func_8012AAAC` ×137)  <sub>L6842</sub>
-- **§3-The** — three-hypothesis trail, because two of them were wrong and the wrongness is instructive  <sub>L6871</sub>
-- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6891</sub>
-- **§93** — `set -o pipefail` attributes a pipeline failure to the LAST stage, not the failing one (Phase 29 SESSION-21, `func_8014D820`)  <sub>L6922</sub>
-- **§94** — A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's local types, ALL of them, transitively (Phase 29 SESSION-21, `func_8016B6BC` 0/137 → 137/137)  <sub>L6947</sub>
-- **§95** — `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 SESSION-21, `func_80176218`)  <sub>L6983</sub>
-- **§96** — The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so every COMMENTED declaration was silently skipped (Phase 29 SESSION-22, `func_80176218` banked)  <sub>L7018</sub>
-- **§97** — The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that captured a dirty tree (Phase 29 SESSION-22)  <sub>L7066</sub>
-- **§98** — `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION-22, `func_8014CF04`)  <sub>L7113</sub>
-- **§99** — The narrow-param wall is a DEF-side problem with a ZERO-blast-radius fix: convert the definition to K&R (Phase 29 SESSION-22, `func_80175AB8` + `func_80175DA8`)  <sub>L7167</sub>
-- **§3-Two** — `reconcile_tu` bugs found underneath, one introduced while fixing the other  <sub>L7190</sub>
-- **§100** — Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a shared header (Phase 29 SESSION-22, `func_80175DA8` 0/137 → 137/137)  <sub>L7216</sub>
-- **§101** — The STALE DEFAULT class: a guard whose cause was removed is a silent skip wearing a safety label (Phase 29 SESSION-22, three instances in one session)  <sub>L7245</sub>
-- **§102** — A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSION-22, `func_8016EC0C`)  <sub>L7272</sub>
-- **§103** — A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER function; move the DECL, not the draft (Phase 29 T48/T51, `func_80135260` — the fleet-wide half)  <sub>L7307</sub>
-- **§104** — Two silent-skip defects in one scan: match on MASKED text, emit from the ORIGINAL (Phase 29 T53, `gather_externs`)  <sub>L7395</sub>
-- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7431</sub>
-- **§106** — Persist the MEASUREMENT, derive the POLICY: a stored route let a stale file out-vote the live table (Phase 29 T54, `residual_class._ROUTE`)  <sub>L7470</sub>
-- **§107** — A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `func_80144090` 0/136 → 136/136)  <sub>L7513</sub>
-- **§108** — Diagnosing a family `0/N`: the four causes, and the third opt-in lever (Phase 29 T59)  <sub>L7551</sub>
-- **§109** — Conforming a definition to a shared header: fix the NAMES, then check the RETURN precondition (Phase 29 T60)  <sub>L7600</sub>
-- **§110** — A unit must define exactly ONE function, and "ends in `;`" does not tell you which line defines it (Phase 29 T65)  <sub>L7640</sub>
-- **§111** — The distinct-code metric is not noisy: a family pays it only if its members are byte-VARIANT (Phase 29 T66)  <sub>L7681</sub>
-- **§112** — A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69, `audit_header_sigs.py`)  <sub>L7730</sub>
-- **§113** — An ARITY blocker only exists if the macro CALLS the function; an address-taken use has no call site (Phase 29 T72)  <sub>L7776</sub>
-- **§114** — The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29 T76/T77)  <sub>L7808</sub>
-- **§115** — A `func_XXXXXXXX` predicate rots by design: the same name-form assumption in THREE places (Phase 29 T78)  <sub>L7850</sub>
-- **§116** — Optimization level is a property of the FILE, not the function: read a family 0/N against the member's stub HOME (Phase 29 T79)  <sub>L7877</sub>
-- **§3-The** — fix moves the DEFINITION, not the stub — and here is why the obvious shortcut fails  <sub>L7895</sub>
-- **§117** — Spell the sibling's symbol from the SIBLING's address, not the exemplar's kind (Phase 29 T82)  <sub>L7926</sub>
-- **§3-Why** — it survived so long: a MASKED oracle will MATCH a wrong symbol  <sub>L7953</sub>
-- **§118** — Ordinal (positional) immediate resolution: compare C tokens to the DIFFERING asm uses (Phase 29 T87)  <sub>L7963</sub>
-- **§119** — Two levers on the SAME axis, opposite directions: test the off-diagonal (Phase 29 T89)  <sub>L7997</sub>
-- **§120** — Uniquify draft-defined TYPE names; and check which of N staging sites you actually patched (Phase 29 T93)  <sub>L8026</sub>
-- **§3-Do** — NOT "strip the duplicate typedef" — it breaks the extern that uses it  <sub>L8037</sub>
-- **§3-The** — wiring trap that cost two attempts  <sub>L8043</sub>
-- **§121** — Synthesise externs for macro-DEFINED callees from the macro's own definition head (Phase 29 T95)  <sub>L8061</sub>
-- **§122** — GATE RAW BEFORE TRANSFORMING; the undo belongs to the WRITER, as a per-edit journal (P30 T0a, 2026-07-30)  <sub>L8084</sub>
-- **§123** — PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its refusals are statements about the TOOL (P30 wave 1, 2026-07-30)  <sub>L8116</sub>
-- **§124** — A "not matched" verdict can mean the definition is there under a DIFFERENT C NAME: the asm-label alias blind spot (P30 SESSION-28, `func_8016191C` ×137)  <sub>L8153</sub>
-- **§124a** — a family sweep's `0 matched-exemplar families` may be a FILTER, not a wall  <sub>L8198</sub>
-- **§125** — Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA from a CLEAN tree (P30 SESSION-28; **this section's first draft was WRONG and the method caught it**)  <sub>L8206</sub>
-- **§3-The** — method (keep this)  <sub>L8213</sub>
-- **§3-The** — instrument rules that make its answer trustworthy (this is where I failed)  <sub>L8223</sub>
-- **§3-The** — corrected results (each SHA-verified, from a clean tree, restore re-verified)  <sub>L8238</sub>
-- **§3-Two** — further notes worth keeping  <sub>L8248</sub>
-- **§3-The** — meta-lesson  <sub>L8257</sub>
-- **§126** — The carve-within-a-carve: an ADDRESS RANGE is not an OPTIMIZATION REGION (P30 T2, byte-proven end-to-end)  <sub>L8264</sub>
-- **§3-The** — finding: opt level is per FILE, so the file's contents must be opt-HOMOGENEOUS  <sub>L8279</sub>
-- **§3-The** — instrument trap that hid it (and it is §124's shape again)  <sub>L8290</sub>
-- **§3-The** — mechanics  <sub>L8299</sub>
-- **§126a** — a bare `except: continue` around a coverage-asserting oracle re-creates the silent skip (P30 S28)  <sub>L8317</sub>
-- **§127** — The `-O0` regime: the CONSTANT-OFFSET FOLD, and why `-O0` needs its own idiom set (P30 T3 wave, 15 targets)  <sub>L8349</sub>
-- **§3-The** — idiom they kept re-deriving: the constant-offset fold  <sub>L8356</sub>
-- **§3-The** — rest of the `-O0` regime (write PLAIN C, and mean it)  <sub>L8367</sub>
-- **§127a** — §71 (sibling-first) is the strongest `-O0` lever, and it beats the index  <sub>L8377</sub>
-- **§127b** — the knowledge was in a SOURCE COMMENT, not the cookbook  <sub>L8386</sub>
-- **§128** — A raw NUL in C source makes grep SILENTLY SKIP the file (P30 S28, 137 files)  <sub>L8393</sub>
-- **§128a** — a negative control must corrupt a SCRATCH COPY, never the tracked file  <sub>L8425</sub>
-- **§129** — Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must never be committed without its owner (P30 S28, `func_8013BD74`)  <sub>L8437</sub>
-- **§129a** — the target instruction count is INFLATED after a carve  <sub>L8441</sub>
-- **§129b** — never commit a carve whose owner is still a stub (it strands the carve)  <sub>L8462</sub>
-- **§3-The** — real blocker underneath, for the record  <sub>L8477</sub>
-- **§130** — An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LINK (P30 S28, the jr pair)  <sub>L8486</sub>
-- **§3-The** — diagnostic ladder that finally located it (reusable)  <sub>L8523</sub>
-- **§131** — The jtbl OVER-SPAN: `sltiu N` is ground truth in BOTH directions, and the zero-word rule only guards one (P30 S28, `func_80191C50`)  <sub>L8533</sub>
-- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8570</sub>
-- **Defect** — 1 — a pre-§8e MERGED DOUBLE is not a single-table predecessor  <sub>L8579</sub>
-- **Defect** — 2 — `as` writes a corpse and nothing deletes it  <sub>L8597</sub>
-- **§3-The** — fingerprint, and the 30-second ladder that found it  <sub>L8607</sub>
-- **§3-The** — transferable rule  <sub>L8628</sub>
-- **§132a** — `--like` is for a sibling with NO record; against one that HAS a record it over-derives (P30 S29, `ov_SC07_010`)  <sub>L8635</sub>
-- **§132b** — When the span's already-matched owner is ITSELF multi-switch: `--span-rel` (P30 S1, `func_8014032C`)  <sub>L8660</sub>
-- **§133** — The DEFAULT-FILTER class: three times in one session, a tool silently answered a narrower question than the one asked (P30 S1–S3)  <sub>L8685</sub>
-- **§134** — MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P30 S6, 190 zero-crack families)  <sub>L8711</sub>
-- **§135** — Six byte-verified gcc-2.7.2 idioms from the P30 S6f-h waves (and the two-lane wave shape that found them)  <sub>L8765</sub>
-- **§3-The** — codegen idioms  <sub>L8770</sub>
-- **§3-The** — integration idioms (these decide whether a byte-correct draft BANKS)  <sub>L8804</sub>
-- **§3-The** — wave shape that produced these  <sub>L8819</sub>
-- **§136** — The LOCAL-VARIABLE lever: how many C locals, at what scope (P30 wave 4a, 25 byte-verified banks)  <sub>L8837</sub>
-- **§3-The** — splitting/merging rules (each closed a residual, byte-gated)  <sub>L8853</sub>
-- **§3-The** — type-form rules  <sub>L8879</sub>
-- **§3-The** — scheduling rules (refining §135-2 and §135-4)  <sub>L8912</sub>
-- **§3-The** — declaration surface (integration, not codegen)  <sub>L8941</sub>
-- **Wave** — economics (measured, for the next batch's sizing)  <sub>L8953</sub>
-- **§136a** — Blocker capture: classify on the OUTPUT, never on the exit status  <sub>L8976</sub>
-- **§136b** — A prior wave's "genuine byte-DIFF" verdict is NOT reliable evidence (4 of 4 refuted)  <sub>L9033</sub>
-- **§136c** — SIBLING-FIRST is a DERIVATION shortcut, not just a conflict fix (the fastest route in a family wave)  <sub>L9069</sub>
-- **§136d** — Four gcc-2.7.2 levers the redraft lane found (each closed a residual no other lever moved)  <sub>L9094</sub>
-- **§136e** — §136c's PRECONDITION, and two more symptom keys (wave 4b batch 3)  <sub>L9138</sub>
-- **§136f** — Two declaration sub-cases the reconcile lane surfaced (lane now 15/15 lifetime)  <sub>L9186</sub>
-- **§136g** — When the index points at the WRONG lever: two byte-refuted routings (func_801863B4)  <sub>L9211</sub>
-- **§136h** — CORRECTION: the zero-crack pool does NOT "refill with cheap work" (my error, byte-measured)  <sub>L9240</sub>
-- **§136i** — The drafter model LADDER: Haiku → **Sonnet** → Opus → Fable5 (Drew, 2026-08-03)  <sub>L9270</sub>
-- **§136j** — The failure MIX flips with function size (measured across four bands, one session)  <sub>L9302</sub>
-- **§137** — REGALLOC-PERM is a TWO-COMPILE ARITHMETIC PROBLEM, not a permuter job  <sub>L9344</sub>
-- **§137a** — A gate verdict has a TIMESTAMP; re-check it against the draft's mtime  <sub>L9386</sub>
-- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9415</sub>
-- **§3-The** — triage, cheapest first  <sub>L9421</sub>
-- **§3-The** — DEFINITION-side alias is the only escape when the fleet canon disagrees on a promoting param  <sub>L9473</sub>
-- **Rank** — the lane by measured concentration, not by class count  <sub>L9481</sub>
-- **THREE** — carry variants hide in one "CARRY-FIXABLE" bucket — and they need different fixes  <sub>L9490</sub>
-- **§134** — again, in a second tool — and the waiter rule corrected  <sub>L9526</sub>
-- **STEP** — 0 of sibling-first: grep `src/` for a distinctive LITERAL from the `.s`  <sub>L9546</sub>
-- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9565</sub>
-- **§139** — A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not survive a carve (P30 S38, wave 6: 10 of 16 drafts vanished)  <sub>L9594</sub>
-- **§3-The** — generalisation — three corollaries worth more than the bug  <sub>L9626</sub>
-- **§3-And** — the inverse-lookup trap, same session  <sub>L9643</sub>
-- **§140** — A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a phantom regression that gated the session's best lever)  <sub>L9660</sub>
-- **§3-The** — three-line proof (do this before diagnosing any metric movement)  <sub>L9680</sub>
-- **§3-The** — two instrument defects it exposed  <sub>L9689</sub>
-- **§3-The** — same swallow, twice more, in the integration spine  <sub>L9709</sub>
-- **§3-Two** — wrong mechanisms I chased first, and why they were wrong  <sub>L9720</sub>
-- **§141** — The §134 class is CLOSED: every line-shape decision now routes through `cdecl._mask` (P30 S39)  <sub>L9740</sub>
-- **§142** — An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do not gate a draft. (P30 S39, +7,710 ins in two commands)  <sub>L9778</sub>
-- **§3-The** — measurement (do this before any wave; it is ~20 lines and needs no builds)  <sub>L9790</sub>
-- **§3-The** — trap that hid it — SAME FUNCTION, TWO ROUTES, ONLY ONE IS FREE  <sub>L9805</sub>
-- **Route** — selection (why `--addr` sometimes says "nothing changed")  <sub>L9814</sub>
-- **§3-And** — the report-vs-bytes lesson attached to it  <sub>L9822</sub>
-- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9834</sub>
-- **§144** — THE LITERAL'S SPELLING PICKS THE IMMEDIATE ENCODING (P30 S40 wave 1, `func_801822E0`)  <sub>L9888</sub>
-- **§145** — Three loop/combine levers from the S40 wave-2 drafters (16/16 match_one)  <sub>L9927</sub>
-- **§146** — RE-MEASURE A WALL BEFORE YOU RESPECT IT. Both "permanent" giants fell to drafts already on disk. (P30 S6, +50,094 ins)  <sub>L9977</sub>
-- **§3-Why** — a correct draft can read as an intrinsic wall  <sub>L9988</sub>
-- **Then** — propagation returned 0/137 TWICE — both times a missing TYPE  <sub>L10000</sub>
-- **§3-Two** — errors of mine, both instructive  <sub>L10009</sub>
-- **§3-The** — rule  <sub>L10023</sub>
-- **§147** — The three-stratum FRAME LAW, and four "stop searching" verdicts (P30 S42, `func_8017C294`, serial run)  <sub>L10036</sub>
-- **§3-A.** — The frame has THREE strata, and stratum 3 is unreachable from C  <sub>L10041</sub>
-- **§3-B.** — A `?:` on MEMORY operands costs ~16 bytes of invisible frame; on REGISTER operands, zero  <sub>L10057</sub>
-- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10068</sub>
-- **§3-D.** — A lone `$t8`/`$t9` in the target is RELOAD SCRATCH — reproduce the spill, don't pin the register  <sub>L10073</sub>
-- **§3-E.** — A `qty_compare` TIE is not spelling-reachable — recognise it and stop  <sub>L10083</sub>
-- **Consequence** — for the family (a real scheduling decision)  <sub>L10095</sub>
-- **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10145</sub>
-- **§3-A.** — `move_movables` hoists iff `threshold × savings × lifetime ≥ insn_count` — and you can read it  <sub>L10151</sub>
-- **§3-B.** — `(v < 0x40) ? v : 0x3F` is folded to `MIN_EXPR` and expands to the WRONG SHAPE  <sub>L10170</sub>
-- **§3-C.** — A zero-byte ALLOCNO-PRIORITY slider  <sub>L10184</sub>
-- **§3-D.** — Reproduce the original's BUGS verbatim  <sub>L10194</sub>
-- **§149** — Four instrument defects in one session, and the two questions they were hiding (P30 S43)  <sub>L10243</sub>
-- **§3-A.** — A prep step that returns its input on failure is indistinguishable from a search that found nothing  <sub>L10249</sub>
-- **§3-B.** — Same address + same name ≠ same body — and the ledger keys on address  <sub>L10267</sub>
-- **§3-C.** — `make: *** [...] Error N` is a summary, never a diagnosis  <sub>L10283</sub>
-- **§3-D.** — "Cheap fuel" that was never probed: 0 of 31 templatable  <sub>L10293</sub>
-- **§150** — A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocator tie (P30 S43, `func_8017C6F4`, 947 ins ×4)  <sub>L10312</sub>
-- **§3-The** — fix  <sub>L10319</sub>
-- **§3-The** — method that found it (this is the transferable part)  <sub>L10329</sub>
-- **§3-Two** — corrections to the record  <sub>L10345</sub>
-- **Diagnostic** — order (adopt this)  <sub>L10356</sub>
-- **§151** — THE GHOST WEDGE: when a load-before-store transposition is unreachable by ANY statement order (P30 S43, `func_8017EF68`, 969 ins)  <sub>L10367</sub>
-- **§3-The** — mechanism (read from cc1's own `-dR` trace, not inferred)  <sub>L10372</sub>
-- **§3-The** — lever — a zero-emission insn that absorbs the blocked tick  <sub>L10387</sub>
-- **§3-The** — two fallouts, and how to close them (both measured, in order)  <sub>L10395</sub>
-- **When** — to reach for it  <sub>L10407</sub>
-- **§152** — BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC family: 1 crack → 12 overlays → 11,364 ins)  <sub>L10418</sub>
-- **§3-The** — finding  <sub>L10423</sub>
-- **§3-The** — key  <sub>L10432</sub>
-- **§3-Two** — cautions that must travel with this technique  <sub>L10443</sub>
-- **§3-The** — companion defect (open)  <sub>L10454</sub>
-- **§153** — THE ADDRESS-REMATERIALISATION LAUNDER: a third zero-emission asm lever (P30 S43, `func_8018D98C`, 710 ins)  <sub>L10466</sub>
-- **Symptom** — Symptom  <sub>L10474</sub>
-- **Mechanism** — (gcc source + RTL dumps, not inferred)  <sub>L10479</sub>
-- **What** — does NOT work (14 byte-measured probes)  <sub>L10486</sub>
-- **§3-The** — cure — a fresh launder per site, each in its own block  <sub>L10492</sub>
-- **Companion** — levers from the same function  <sub>L10502</sub>
-- **§154** — Reading a disc payload: the module-id word, static base derivation, and "type 1 = uncompressed overlay" (P30 S44)  <sub>L10522</sub>
-- **§3-A.** — Payload word0 is a global MODULE ID; code starts after the header  <sub>L10527</sub>
-- **§3-B.** — Two static base-derivation methods that must AGREE (use both)  <sub>L10536</sub>
-- **§3-C.** — PAC type 1 = the same payload class as type 4, just NOT compressed  <sub>L10548</sub>
-- **§155** — hi/lo literal scanning MUST track base registers (S45)  <sub>L10558</sub>
-- **§155a** — the same failure class, one level up: SHAPE-blind table scanning (S45 p5)  <sub>L10567</sub>
-- **§155b** — check the TYPE your oracle returns before comparing against it (S45 p5)  <sub>L10587</sub>
-- **§155c** — the ZERO-REFERENCE trap: gcc splits a global-array address across the `lui` and the LOAD (S46)  <sub>L10610</sub>
-- **§156** — an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7)  <sub>L10640</sub>
-- **§157** — the cheap-tier size cliff, measured (S45 p6)  <sub>L10687</sub>
-- **§158** — The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S46 tier-3, `func_8017CE58`, 733 ins)  <sub>L10712</sub>
-- **Symptom** — Symptom  <sub>L10721</sub>
-- **§3-Why** — the fork is chained (gcc source, validated insn-by-insn against -dS/-dR dumps)  <sub>L10727</sub>
-- **§3-The** — method (dump-arithmetic first, then place — no probing)  <sub>L10740</sub>
-- **Bonus** — facts worth keeping  <sub>L10757</sub>
-- **§156** — THE PREFERENCE-DONOR MERGE: cross-region variable reuse is what fills a0-a3, and a call-arg use in ONE region steers the fill in ALL of them (P30 S46 tier-3, `func_80186E24`, 611 ins: 236-off "S11 regalloc-order" → MATCH, zero new pins)  <sub>L10772</sub>
-- **§159** — THE DECLARATION AXIS: conform to byte-truth, and make every guard state its COVERAGE (P30 S47; ~10,930 sites across 8 axes, fleet byte-identical)  <sub>L10828</sub>
-- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10893</sub>
-- **§161** — THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47)  <sub>L10969</sub>
-- **§162** — S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 targets  <sub>L11014</sub>
-- **§162a** — SHARPENS  *(sharpens §161a, §131, §8a-pad, §129a)*  <sub>L11041</sub>
-- **§162b** — SHARPENS  *(sharpens §48-A3, §156, §150, §76)*  <sub>L11070</sub>
-- **§162d** — SHARPENS  *(sharpens §31, §21, §30, §55a)*  <sub>L11099</sub>
-- **§162e** — NEW  <sub>L11141</sub>
-- **§162** — THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the body order (P30 S47, `ov_MAIN_012`)  <sub>L11143</sub>
-- **§162f** — SHARPENS  *(sharpens §42d, §41d, §73, §10)*  <sub>L11209</sub>
-- **§162g** — NEW  <sub>L11264</sub>
-- **§162** — CROSS-JUMP DIRECTION: the surviving copy is always the LATER one, so a BACKWARD `j` into a sibling arm is a source `goto` (P30 S48)  <sub>L11266</sub>
-- **§162h** — SHARPENS  *(sharpens §88, §88a, §50-B, §8)*  <sub>L11300</sub>
-- **§162** — The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_80189540`)  <sub>L11302</sub>
-- **§162i** — SHARPENS  *(sharpens §135, §21, §42, §32)*  <sub>L11368</sub>
-- **§162j** — SHARPENS  *(sharpens §25, §136d-1, §48-B, §46-L2)*  <sub>L11393</sub>
-- **§162k** — SHARPENS  *(sharpens §1-I2, §12, §160d, §21)*  <sub>L11422</sub>
-- **§162l** — SHARPENS  *(sharpens §48-B, §48-C1, §20, §21)*  <sub>L11485</sub>
-- **§162m** — SHARPENS  *(sharpens §36, §158, §148, §153)*  <sub>L11540</sub>
-- **§158a** — THE FIFTH LEVER IS NOT AN ASM: `do { } while (0)` is a REGION ref-multiplier you MINT (P30 S48, `func_8017CBC8`, ov_MAIN_012 / jr_801789AC, 188 ins → MATCH)  <sub>L11542</sub>
-- **§3-The** — law  <sub>L11549</sub>
-- **Size** — it before you write it (§158 step 1-2, applied)  <sub>L11560</sub>
-- **§3-The** — wrap BOUNDARY is the dial — and it is indiscriminate  <sub>L11581</sub>
-- **§3-Not** — a pure dial  <sub>L11587</sub>
-- **DIAGNOSTIC** — TELL — two faces, one law  <sub>L11591</sub>
-- **§162n** — NEW  <sub>L11613</sub>
-- **§162o** — SHARPENS  *(sharpens §158, §136-1, §136-6, §79)*  <sub>L11646</sub>
-- **§162p** — SHARPENS  *(sharpens §48-B, §46-L2, §156, §136d-1)*  <sub>L11705</sub>
-- **§162q** — SHARPENS  *(sharpens §30, §30a, §135-2, §136-13)*  <sub>L11722</sub>
-- **§163** — S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actionable  <sub>L11760</sub>
-- **§163z** — THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass)  <sub>L11828</sub>
-- **§164** — S48 §163z SKEPTIC PASS (P30, 2026-08-12): 190 claims vetted, 82 banked  <sub>L11848</sub>
-- **§16Xy** — SHARPENS  *(sharpens §136d-3, §37 /s-DEP LATTICE, §135-2, §136-13, §162q)*  <sub>L12300</sub>
-- **§3-The** — `/s` drop clause is in ALL THREE dependence predicates, so the FIXED-ADDRESS STORE is what floats (P30 S48, `func_8017CA18`, ov_MAIN_012)  <sub>L12302</sub>
-- **§164z** — REFUTED CLAIMS: do NOT re-derive these  <sub>L13636</sub>
-- **§165** — S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed  <sub>L13702</sub>
-- **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14353</sub>
-- **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014)  <sub>L14355</sub>
-- **§165z** — REFUTED THIS WAVE: do NOT re-derive  <sub>L14871</sub>
-- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14915</sub>
-- **§167** — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point  <sub>L14971</sub>
-- **§167z** — REFUTED IN WAVES 5/6: do NOT re-derive  <sub>L16167</sub>
-- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16224</sub>
-- **§169** — THE MICRO-ADAPT LANE (P30 S49): edit a proven body, don't crack a new one  <sub>L16276</sub>
-- **§170** — THE A-PROP WORD-DIFF CARD (P30 S49): the lane that had no owner  <sub>L16323</sub>
-- **§171** — THE STALE SEED SYMBOL (P30 S50, 2026-08-13): why §170's 91%→57% was never codegen  <sub>L16367</sub>
-- **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16433</sub>
-- **§171b** — THREE CARRIES THE MECHANICAL DRAFT NEEDS (P30 S50, banking the top-reach families)  <sub>L16483</sub>
-- **§172** — THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 MIPS  <sub>L16516</sub>
-- **§172a** — TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max)  <sub>L16570</sub>
-- **§172b** — THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask)  <sub>L16586</sub>
-- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16629</sub>
-- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16665</sub>
-- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16735</sub>
-- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16760</sub>
-- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16800</sub>
-- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16826</sub>
-- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16865</sub>
-- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16922</sub>
-- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16953</sub>
-- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L16991</sub>
-- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L16999</sub>
-- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L17017</sub>
-- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17039</sub>
-- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17046</sub>
-- **§3-D.** — The measured cost shape, and what to build next  <sub>L17069</sub>
-- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17087</sub>
-- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17119</sub>
-- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17145</sub>
-- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17165</sub>
-- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17182</sub>
-- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17239</sub>
-- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17251</sub>
-- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17267</sub>
-- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17280</sub>
-- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17288</sub>
-- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17295</sub>
-- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17304</sub>
-- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17310</sub>
-- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17326</sub>
-- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17336</sub>
-- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17385</sub>
-- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17435</sub>
-- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17486</sub>
-- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17506</sub>
-- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17532</sub>
-- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17555</sub>
-- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17582</sub>
-- **Considered** — and NOT banked  <sub>L17605</sub>
-- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17622</sub>
-- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17633</sub>
-- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17639</sub>
-- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17663</sub>
-- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17709</sub>
-- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17735</sub>
-- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17761</sub>
-- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17783</sub>
-- **What** — is NOT banked here  <sub>L17800</sub>
-- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17813</sub>
-- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17842</sub>
-- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17861</sub>
-- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17879</sub>
-- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17880</sub>
-- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17935</sub>
-- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17949</sub>
-- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17961</sub>
-- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17962</sub>
-- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18032</sub>
-- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18060</sub>
-- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18092</sub>
-- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18113</sub>
-- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18121</sub>
-- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18138</sub>
-- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18176</sub>
-- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18226</sub>
-- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18301</sub>
-- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18338</sub>
-- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18360</sub>
-- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18361</sub>
-- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18425</sub>
-- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18442</sub>
-- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18509</sub>
-- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18547</sub>
-- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18581</sub>
-- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18652</sub>
-- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18682</sub>
-- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18746</sub>
-- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18807</sub>
-- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18847</sub>
-- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18906</sub>
-- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18933</sub>
-- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18950</sub>
-- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19016</sub>
-- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19054</sub>
-- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19117</sub>
-- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19158</sub>
-- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19195</sub>
-- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19268</sub>
-- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19311</sub>
-- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19349</sub>
-- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19392</sub>
-- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19444</sub>
-- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19522</sub>
-- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19570</sub>
-- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19628</sub>
-- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19688</sub>
-- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19709</sub>
-- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19723</sub>
-- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19794</sub>
-- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19836</sub>
-- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19884</sub>
-- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19952</sub>
-- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20010</sub>
-- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20062</sub>
-- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20110</sub>
-- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20157</sub>
-- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20222</sub>
-- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20266</sub>
-- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20318</sub>
-- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20370</sub>
-- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20419</sub>
-- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20466</sub>
-- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20512</sub>
-- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20567</sub>
-- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20581</sub>
-- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20619</sub>
-- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20647</sub>
-- **§197-REJECTED** — §197-REJECTED  <sub>L20692</sub>
-- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20707</sub>
-- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20718</sub>
-- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20767</sub>
-- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20812</sub>
-- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20860</sub>
-- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20920</sub>
-- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20979</sub>
-- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21033</sub>
-- **§199-REJECTED** — §199-REJECTED  <sub>L21088</sub>
-- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21099</sub>
-- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21148</sub>
-- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21158</sub>
-- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21190</sub>
-- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21270</sub>
-- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21321</sub>
-- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21368</sub>
-- **§201-REJECTED** — eight, the session's highest  <sub>L21424</sub>
-- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21449</sub>
-- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21486</sub>
-- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21547</sub>
-- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21566</sub>
-- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21641</sub>
-- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21705</sub>
-- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21763</sub>
-- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21838</sub>
-- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21890</sub>
-- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21984</sub>
-- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22057</sub>
-- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22112</sub>
-- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22181</sub>
-- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22202</sub>
-- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22251</sub>
-- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22328</sub>
-- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22374</sub>
-- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22433</sub>
-- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22478</sub>
-- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22514</sub>
-- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22560</sub>
-- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22616</sub>
-- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22656</sub>
-- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22682</sub>
-- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22711</sub>
-- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22738</sub>
-- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22778</sub>
-- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22794</sub>
-- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22836</sub>
-- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22898</sub>
-- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22934</sub>
-- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22977</sub>
-- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L23018</sub>
-- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L23038</sub>
-- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23075</sub>
-- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23124</sub>
-- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23139</sub>
-- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23180</sub>
-- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23216</sub>
-- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23236</sub>
-- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23242</sub>
-- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23248</sub>
-- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23257</sub>
-- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23266</sub>
-- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23272</sub>
-- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23316</sub>
-- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23357</sub>
-- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23386</sub>
-- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23465</sub>
-- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23520</sub>
-- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23560</sub>
-- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23594</sub>
-- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23623</sub>
-- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23652</sub>
-- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23680</sub>
-- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23710</sub>
-- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23745</sub>
-- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23792</sub>
-- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23832</sub>
-- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23866</sub>
-- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23890</sub>
-- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23932</sub>
-- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23969</sub>
-- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L23991</sub>
-- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24012</sub>
-- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24026</sub>
-- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L24038</sub>
-- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24073</sub>
-- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24110</sub>
-- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24153</sub>
-- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24158</sub>
-- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24179</sub>
-- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24202</sub>
-- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24213</sub>
-- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24230</sub>
-- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24259</sub>
-- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24275</sub>
-- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24318</sub>
-- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24347</sub>
-- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24383</sub>
-- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24435</sub>
-- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24452</sub>
-- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24477</sub>
-- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24495</sub>
-- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24519</sub>
-- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24549</sub>
-- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24576</sub>
-- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24621</sub>
-- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24632</sub>
-- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24641</sub>
-- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24672</sub>
-- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24683</sub>
-- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24722</sub>
-- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24772</sub>
-- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24808</sub>
-- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24834</sub>
-- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24856</sub>
-- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24886</sub>
-- **§264** — FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59)  <sub>L24927</sub>
-- **§265** — THE VERBATIM-ASM BANK LANE: A FUNCTION NO -O2 C CAN EVER MATCH BANKS AS A RAW `__asm__` BODY (P31 S59b; two banked cards, two in-tree precedents)  <sub>L24977</sub>
-- **§266** — THE INERT-RIDER LAW: A LEVER IS ONLY CITABLE WHEN ITS SOLO REMOVAL BREAKS THE MATCH (P31 S59b; measured 4-of-8 on this batch)  <sub>L25039</sub>
-- **§267** — ADDENDA HARVESTED FROM WAVES at/bh/bk/bl (P31 S59b)  <sub>L25079</sub>
-- **ADD-1** — → §231 addendum (also cross-ref from §195-D) — THE MASKED-`jal` "MISSING CALL" ILLUSION  <sub>L25087</sub>
-- **ADD-2** — → §42a addendum — A SHARED CONSTANT *NAMED IN A LOCAL* ACROSS A `jal` IS AN ISO→TU DRIFT HAZARD; WRITE BARE LITERALS  <sub>L25096</sub>
-- **ADD-3** — → §236, item 10 — THE UN-DELETED `INCLUDE_ASM` STUB IS A DUPLICATE DEFINITION  <sub>L25108</sub>
-- **ADD-4** — → §225-3/-4 addendum — THE MIRROR ROW: VALUE-RETURN IN THE *TAKEN* ARM + TRAILING BARE `return 0`  <sub>L25118</sub>
-- **ADD-5** — → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TRAILING `else`  <sub>L25132</sub>
-- **ADD-6** — → §172b-1 / §264 addendum — SHIFT-AS-TEST: `(x << 16) != 0` TESTS THE LOW HALF WITHOUT TRUNCATING THE PSEUDO  <sub>L25141</sub>
-- **ADD-7** — → §256 addendum — THE SINGLE-GUARD GOTO: THEN-BLOCK OUT OF LINE AT THE TAIL  <sub>L25150</sub>
-- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25162</sub>
-- **ADD-9** — → §213-3 / §217 addendum — ADJACENT PRE-CALL FRAME STORES ARE ONE AGGREGATE; THE UNESCAPED SCALAR NEIGHBOR IS DEAD-STORED  <sub>L25174</sub>
-- **ADD-10** — → §237 addendum (arity-evidence paragraph) — AN `la` PAIR ABOVE THE PROLOGUE `sw $ra` IS AN OUTGOING-ARGUMENT MATERIALISATION  <sub>L25184</sub>
-- **ADD-11** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25193</sub>
-- **§268** — A `register __asm__` PIN ON A CALL-CLOBBERED REGISTER IS HONORED EXACTLY WHEN THE PINNED RANGE CROSSES NO CALL (P31 S59c; three A/B'd cards, unifying §257-2's two)  <sub>L25244</sub>
-- **§269** — ADDENDA HARVESTED FROM WAVES ax/bm (P31 S59c)  <sub>L25298</sub>
-- **ADD-1** — → §257-8 addendum — THE INTERPOSED ASM'S `__volatile__` IS A PER-SHAPE DIAL, AND THE "NO-OUTPUT ASM IS IMPLICITLY VOLATILE" LORE IS BYTE-FALSE IN gcc-2.7.2  <sub>L25313</sub>
-- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25326</sub>
-- **ADD-3** — → §238 addendum — TWO BINARIES CAN EACH DEFINE THE SAME `func_` NAME WITH DIFFERENT BYTES, AND NO GENERATED REPORT SHOWS IT  <sub>L25340</sub>
-- **ADD-4** — → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAME IT **AND** STORE **INSIDE** THE ARM  <sub>L25353</sub>
-- **ADD-5** — → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON THE SHIFTED COPY, RAW STAYS LIVE — AND THE HALFWORD-ABS SHAPE NEEDS NO RITUAL  <sub>L25370</sub>
-- **ADD-6** — → §220-addendum — THE FOURTH FACE: WHEN THE NAMED COPY ITSELF BUYS THE EXTRA CALLEE-SAVED, PIN THE COPY TO `$16`  <sub>L25386</sub>
-- **ADD-7** — → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE POSITION; NAME IT TO PIN THE PROLOGUE INIT ORDER  <sub>L25402</sub>
-- **ADD-8** — → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST-PLUS GIVES SERIALIZATION *AND* DISPLACEMENT FOLDING  <sub>L25415</sub>
-- **ADD-9** — → §255 "AND CASE-BODY PLACEMENT" bound / §222-addendum-3 — ON A LARGE SPARSE TREE, BODIES FOLLOW **SOURCE** ORDER (measured by a one-word probe)  <sub>L25430</sub>
-- **ADD-10** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25444</sub>
-- **§3-1a.** — The §266 sweep — every solo-lever A/B run for this batch  <sub>L25485</sub>
-- **§270** — The A-prop 0-bank anatomy: a byte-correct body still needs FOUR layers to agree (P31 S59)  <sub>L25518</sub>
-- **§271** — Ordinal IMM pairing: text order is NOT emission order; emit CANDIDATES, let the oracle pick (P31 S59)  <sub>L25536</sub>
-- **§272** — The `(void)`-decl + empty-call wall: K&R the DEFINITION, not just the decls (P31 S59)  <sub>L25558</sub>
-- **§273** — A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59)  <sub>L25578</sub>
-- **§274** — ADDENDA HARVESTED FROM 18 WAVES (P31 S60): 315 candidates, 255 already covered, 21 sharpenings, 3 new laws  <sub>L25593</sub>
-- **ADDENDUM** — to §179-C — the `.type NAME, @function` requirement  <sub>L25599</sub>
-- **ADDENDUM** — to §134 — a typedef defined BELOW the splice point is stripped anyway  <sub>L25646</sub>
-- **ADDENDUM** — to §179-D (GTE macro reference family) — `gte_SetRotMatrix`/`gte_SetTransMatrix` bodies  <sub>L25676</sub>
-- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25702</sub>
-- **ADDENDUM** — to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads the wrong register"  <sub>L25740</sub>
-- **ADDENDUM** — to §20 — a global declared as `T *` may itself BE the array base, not a pointer to dereference  <sub>L25779</sub>
-- **ADDENDUM** — to §1-I5  <sub>L25808</sub>
-- **ADDENDUM** — to §164-51  <sub>L25873</sub>
-- **ADDENDUM** — to §176-F5  <sub>L25889</sub>
-- **ADDENDUM** — to §225  <sub>L25918</sub>
-- **ADDENDUM** — to §224 — CROSS-JUMP: THE DUPLICATE CAN BE A PLAIN STORE, NOT ONLY A CALL  <sub>L25963</sub>
-- **ADDENDUM** — to §164-64 — AN EMPTY CLOBBER ON AN ARGUMENT REGISTER CAN BE THE DELIBERATE FIX, NOT JUST THE ACCIDENTAL BUG  <sub>L25997</sub>
-- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26028</sub>
-- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26059</sub>
-- **ADDENDUM** — to §229 — A POINTER'S NUMBER OF USES DECIDES WHETHER ITS ADDRESS FOLDS OR SURVIVES A CALL  <sub>L26106</sub>
-- **ADDENDUM** — to §172b-4 — THE PLAIN CAST-DIVISION ALREADY PRODUCES THE PATTERN; DON'T HAND-ROLL THE BIAS, AND KEEP THE OPERAND WIDE  <sub>L26151</sub>
-- **ADDENDUM** — to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT AS A FILE-SCOPE `__asm__` BLOB  <sub>L26181</sub>
-- **ADDENDUM** — to §226 — A DEAD LOCAL SCOPED TO A NESTED BLOCK BUYS A MID-FUNCTION `addiu sp` PAIR, NOT A FRAME-SIZE CHANGE  <sub>L26224</sub>
-- **ADDENDUM** — to §172a — RE-READING MEMORY (NOT NAMING A TEMP) IS WHAT KEEPS AN INCREMENT'S DELAY-SLOT FILL ALIVE  <sub>L26263</sub>
-- **ADDENDUM** — to §225 / §256 — A GOTO TO A SHARED SET-POINT PREVENTS IF-CONVERSION FROM COLLAPSING A LATER BRANCH TEST  <sub>L26294</sub>
-- **ADDENDUM** — to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIALISES ITS CONSTANT AFTER EVERY CALL  <sub>L26336</sub>
-- **§275** — THE LEFTOVER-REGISTER READ  <sub>L26371</sub>
-- **§276** — MIXED ADDRESS-EXPRESSION SPELLING FOR ADJACENT RELOCATABLE SYMBOLS IS A CSE-UNIFICATION DIAL, NOT JUST A BYTE-ENCODING CHOICE (P31 S60; `func_80180FE8`, ov_SC06_006, byte-proven)  <sub>L26411</sub>
-- **§277** — RETURN-TAIL C SPELLING PICKS THE DELAY-SLOT-FILL vs TRAILING-MOVE TOPOLOGY, AND A NARROWER SECOND VARIABLE KEEPS TWO PSEUDOS INSTEAD OF ONE (P31 S60; `func_801846F0` ov_SC03_104, `func_801A44C4` md_SC07_004, both byte-proven)  <sub>L26520</sub>
-- **§278** — ADDENDA HARVESTED FROM WAVE cf (P31 S60): 34 candidates, 13 already covered, 8 sharpenings, 4 new laws  <sub>L26584</sub>
-- **ADDENDUM** — to §74 (func_800D0E30, resident)  <sub>L26592</sub>
-- **ADDENDUM** — to §172b-4 (func_80185054, ov_SC03_097)  <sub>L26628</sub>
-- **ADDENDUM** — to §265 (func_8017DC80, ov_SC07_002)  <sub>L26666</sub>
-- **ADDENDUM** — to §17 (func_800CB794, md_MAIN_036)  <sub>L26705</sub>
-- **ADDENDUM** — to §162p (func_8017C120, ov_MAIN_012)  <sub>L26753</sub>
-- **ADDENDUM** — to §20 (~L1947) (func_80186AD0, ov_SC06_032)  <sub>L26787</sub>
-- **ADDENDUM** — to §164-56 (func_8017F644, ov_SC04_005)  <sub>L26817</sub>
-- **ADDENDUM** — to §237 (func_8017F7FC, ov_SC03_092)  <sub>L26852</sub>
-- **§279** — A `do/while (p < end)` LOOP UNDER AN ENTRY GUARD: the guard decides the compare, not the loop (P31 S60; wave cf, func_8017F2A4, ov_SC03_096, byte-proven)  <sub>L26881</sub>
-- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26882</sub>
-- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26915</sub>
-- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26916</sub>
-- **§281** — GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, the source must not (P31 S60; wave cf, func_80180FB4, ov_SC03_111, byte-proven)  <sub>L26949</sub>
-- **§NNN** — A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AND SCHED1 DOES THE INTERLEAVING (P31 S60; `func_80180FB4`, ov_SC03_111, byte-proven)  <sub>L26950</sub>
-- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L26995</sub>
-- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L26996</sub>
-- **What** — I could not verify  <sub>L27033</sub>
-- **§283** — ADDENDA HARVESTED FROM THE 36-WAVE BATCH (P31 S60): 1,216 candidates, 859 already covered, 46 sharpenings, 9 new laws  <sub>L27080</sub>
-- **ADDENDUM** — to §164-75 — the fold-reassociation law also fires at a variable's INITIALIZER, not only a later expression  <sub>L27090</sub>
-- **ADDENDUM** — to §21 — the `bltz`+`slti` (or N-separate-compares) signed-range-split bullet is now CONFIRMED on three independent functions, and generalizes beyond `lbu`/u8  <sub>L27116</sub>
-- **ADDENDUM** — to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not only a function-vs-function prototype clash  <sub>L27162</sub>
-- **ADDENDUM** — to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, same-address double RMW, a plain memory clobber beats `volatile`, and `volatile` actively breaks a delay-slot fill  <sub>L27185</sub>
-- **ADDENDUM** — to §195-E — a goto-ladder's STORES must sit AT the labels, after the gotos, not inline before them  <sub>L27204</sub>
-- **ADDENDUM** — to §195-N — a GNU statement-expression slider must sit INSIDE the conditional arm's value position, not as a post-hoc barrier, to block the store-flag transform on a ternary chain  <sub>L27266</sub>
-- **ADDENDUM** — to §176-B2 — in a micro-function with no long/short lifetime asymmetry, BOTH contending pseudos need their own hard-register pin  <sub>L27323</sub>
-- **ADDENDUM** — to §199-G — A `default:` LABEL GROUPED ONTO THE LAST CASE REMOVES THE `j default` TAIL, EVEN THOUGH THE 2-NODE HEADER STAYS ALL-POSITIVE  <sub>L27370</sub>
-- **ADDENDUM** — to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SAVED SPILL LAND IN THE FIRST CALL'S OWN DELAY SLOT  <sub>L27439</sub>
-- **ADDENDUM** — to §252 — a `>=0`/`<0` split on an unconditionally-decremented value needs the POSTFIX operator INSIDE the branch condition, not a prior statement  <sub>L27497</sub>
-- **ADDENDUM** — to §215 — FIFTH SHAPE: reused mask constants across two call-free merge sites each get their own whole-function hard-register pin, and a shared sub-expression at the second site must be its own statement  <sub>L27524</sub>
-- **What** — I could not verify  <sub>L27607</sub>
-- **Harness-defect** — flags  <sub>L27678</sub>
-- **ADDENDUM** — to §167-40 (func_8017E2CC, ov_SC04_015 — wave dg)  <sub>L27771</sub>
-- **ADDENDUM** — to §20's cross-jump EXPLOIT bullet (func_8017E360, ov_SC05_007 — wave dg)  <sub>L27791</sub>
-- **ADDENDUM** — to §87 (func_801815F4 ov_SC06_032; corroborating func_801840DC ov_SC05_017, func_80189C68 ov_SC03_006 — wave dg)  <sub>L27805</sub>
-- **ADDENDUM** — to §153 / §236-5 (func_801A419C, md_SC07_003 — waves di and dl, corroborating; refutes a contradicted dj-wave card)  <sub>L27824</sub>
-- **ADDENDUM** — to §263 (func_801E83AC, md_SC04_029 — wave dj)  <sub>L27844</sub>
-- **ADDENDUM** — to §265 (func_8017D878, ov_SC03_107 — wave dj; corroborated by a REJECTED, contradicted card in wave dm — see closing)  <sub>L27858</sub>
-- **ADDENDUM** — to §6 (func_801811F0, ov_SC03_102 — waves dj and dl, corroborated by a self-reported "nothing new" dm-wave card)  <sub>L27872</sub>
-- **ADDENDUM** — to §195-G (func_80183BB0, ov_SC05_001 — wave dj)  <sub>L27886</sub>
-- **ADDENDUM** — to the zero-byte-asm-slider family (§47 / §148-C / §153) (func_800CB874, md_MAIN_040 — wave dj; open tension with a more cautious dm-wave card — see closing)  <sub>L27914</sub>
-- **ADDENDUM** — to §194-B (func_8017EB34, ov_SC03_117 — wave dk; distinct from the §74 co-pinning finding on the SAME function below)  <sub>L27932</sub>
-- **ADDENDUM** — to §74 (func_8017EB34, ov_SC03_117 — counter/clamp variant; wave dj, corroborated by dk/dl/dm cards on the same function)  <sub>L27964</sub>
-- **ADDENDUM** — §37 — merged into the §153/§236-5 entry above (func_801A419C, wave dl)  <sub>L27984</sub>
-- **ADDENDUM** — §6 — merged into the §6 entry above (func_801811F0, wave dl)  <sub>L27992</sub>
-- **ADDENDUM** — to §238 (func_80182CB4, ov_SC02_000 — wave dl)  <sub>L28000</sub>
-- **ADDENDUM** — to §137a (func_801684B4, ov_MAIN_012; corroborated independently by func_80189E68, func_8017FF9C, func_801822B4, func_8018DA8C — wave dl)  <sub>L28018</sub>
-- **ADDENDUM** — to §8c / §88d (func_8016AB6C, ov_MAIN_012 — wave dm)  <sub>L28034</sub>
-- **ADDENDUM** — to §73 / §30#2 (func_800D1984, resident — wave dm)  <sub>L28048</sub>
-- **What** — I could not verify  <sub>L28064</sub>
-- **ADDENDUM** — to §174 Law 4 (func_8017E9A8, ov_SC06_015)  <sub>L28084</sub>
-- **ADDENDUM** — the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_800CB900, md_MAIN_026)  <sub>L28124</sub>
-- **From** — ck + cl + cm  <sub>L28176</sub>
-- **ADDENDUM** — §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE A SWITCH DISPATCH CAN BE PLAIN NESTED `if`s WHOSE SHARED BODY WAS TRIPLICATED BY THE SOURCE AND THEN CROSS-JUMP-MERGED BACK DOWN  <sub>L28182</sub>
-- **ADDENDUM** — §NNN — sharpens §167-13's boundary: CHAINING TWO IDENTICAL SIDE-BY-SIDE STORES INTO ONE C ASSIGNMENT STATEMENT IS A MID-BLOCK SCHEDULING-PRIORITY DIAL, NOT ONLY A STORE-ORDER SPELLING  <sub>L28219</sub>
-- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28252</sub>
-- **ADDENDUM** — §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWER BOUND FROM ITS OWN `.s` STACK-ARGUMENT READS, NOT FROM ANY SINGLE CALL SITE  <sub>L28285</sub>
-- **ADDENDUM** — to §5a (func_80181F74, ov_SC03_112, wave cn)  <sub>L28318</sub>
-- **ADDENDUM** — to §265 (func_8017E26C, ov_SC04_016, wave cn)  <sub>L28368</sub>
-- **ADDENDUM** — to §42b (func_8018247C, ov_SC07_002, waves cu + cw)  <sub>L28406</sub>
-- **ADDENDUM** — to §199-F family (func_8017EFB0, ov_SC02_021, wave cu)  <sub>L28437</sub>
-- **ADDENDUM** — to §195-E (func_800CFC1C, md_MAIN_003, wave cv)  <sub>L28492</sub>
-- **ADDENDUM** — to §215 addendum (func_800CB2C8, md_MAIN_033, waves cv + cw)  <sub>L28537</sub>
-- **ADDENDUM** — to §236 item 4 (func_8017D268, ov_SC04_006, wave cw)  <sub>L28593</sub>
-- **What** — I could not verify  <sub>L28622</sub>
-- **Harness-defect** — flags (not idioms — flagged for the operator)  <sub>L28654</sub>
-- **ADDENDUM** — to §250 (func_8017D7CC, ov_SC03_115 — cx/cy/cz/dr)  <sub>L28695</sub>
-- **ADDENDUM** — to §225 (func_8017E190, ov_SC03_115 — cx/cy/cz)  <sub>L28740</sub>
-- **ADDENDUM** — to §45-A (func_8017F6A4, ov_SC02_016 — cy/cz)  <sub>L28793</sub>
-- **ADDENDUM** — to §249 (func_80182ED4, ov_SC04_004 — dp/dr/dt)  <sub>L28837</sub>
-- **ADDENDUM** — to §199-A (func_801816FC, ov_SC02_005 — dp/dr/dt)  <sub>L28882</sub>
-- **What** — I could not verify  <sub>L28928</sub>
-- **Harness-defect** — flags  <sub>L28971</sub>
-- **§284** — COMBINE CAN REASSOCIATE TWO SEQUENTIAL BITWISE-AND MASKS INTO ONE AGAINST THE PRE-MASK VALUE; AN ASM IN/OUT FENCE RIGHT AFTER THE FIRST MASK BLOCKS IT (P31, wave dd, `func_8018087C`, ov_SC04_020, byte-proven) (P31 S60; waves #, byte-proven)  <sub>L29033</sub>
-- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29037</sub>
-- **§286** — FOLD A STATEMENT'S SIDE EFFECT INTO A COMMA-EXPRESSION IN AN ARGUMENT POSITION TO PLACE ITS RTL RELATIVE TO A CALL'S OWN DELAY SLOT (P31 S60/dj; `func_80180A88`, ov_SC06_010, byte-proven 411/411) (P31 S60; waves #, byte-proven)  <sub>L29041</sub>
-- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29045</sub>
-- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29049</sub>
-- **§289** — an array local's address-taken base keeps every element's store alive, even though only one pointer escapes (`func_80189EFC`, ov_SC04_011) (P31 S60; waves #, byte-proven)  <sub>L29053</sub>
-- **§290** — A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EACH KEEPING ITS OWN `%hi`/`%lo` ANCHOR (P31 S60; waves #, byte-proven)  <sub>L29057</sub>
-- **§291** — THE DELAY-SLOT FALSE-VALUE: A CONDITIONAL BRANCH'S ZERO ARM MUST BE A FALL-THROUGH-ADJACENT BLOCK ENDING IN AN EXPLICIT JUMP, OR REORG CANNOT MATERIALIZE IT INSIDE THE BRANCH'S OWN DELAY SLOT (P31 S60; waves #, byte-proven)  <sub>L29061</sub>
-- **§292** — DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPLICIT (K&R) DECLARATION CAN SILENTLY REPROTOTYPE THE SIBLING'S OWN CALL SITE (P31 S60; waves #, byte-proven)  <sub>L29065</sub>
-- **§293** — THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND THE LOAD-BEARING ONE IS "THE BASELINE, NOT THE SIBLINGS" (P31 S61; byte-proven on 15 binaries in one night)  <sub>L29068</sub>
-- **§294** — ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2): 99 candidates, 52 covered, 15 notes → 10 addenda, 29 notes → 5 new laws (§295–§299), 3 refuted  <sub>L29118</sub>
-- **ADDENDUM** — to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the index being constant  <sub>L29129</sub>
-- **ADDENDUM** — to §261a — FOUR MORE -O0 DIALS BEYOND THE RELOAD COUNT (boot.c + md_MAIN_011/003, wave m0a/g0a/g0f, byte-proven)  <sub>L29157</sub>
-- **ADDENDUM** — to §264-3 — the explicit entry copy's BOUND: required exactly when the RAW value must outlive the call that consumes only the PROMOTED value  <sub>L29207</sub>
-- **ADDENDUM** — to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator  <sub>L29227</sub>
-- **ADDENDUM** — to §276 — the SHARE direction: spell the second adjacent symbol RELATIVE to force ONE anchor  <sub>L29239</sub>
-- **ADDENDUM** — to §31's density-dummy dial (L2460/L2497) — the dose is TWO refs, and the dummy must sit where the loser is live-through  <sub>L29255</sub>
-- **ADDENDUM** — to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction births the induction register at loop.c's own insertion point  <sub>L29272</sub>
-- **ADDENDUM** — to §253 — SECOND byte-proven card (upgrade from single-observation), and the placement face: postfix-in-condition parks the RMW store in the branch delay slot  <sub>L29295</sub>
-- **ADDENDUM** — to the L1800 anchor-steer bullet — a DERIVED-POINTER local silently flips the merged giv's anchor END  <sub>L29316</sub>
-- **ADDENDUM** — to §31's asm→layout inference — TWO WIDTH-PAIR DISCRIMINATORS (same offset, different widths)  <sub>L29339</sub>
-- **§295** — THE KERNEL-TRAP STUB: §81's jr-DETECTOR WITHOUT A TABLE IS A PsyQ SYSCALL TRAMPOLINE — ROUTE TO §265, NEVER INTO THE CARVE CHAIN (P31 S61; wave m0a, 9 cards byte-proven; resolves §182's held cluster)  <sub>L29360</sub>
-- **§296** — THE FRAME CHECK OUTRANKS THE ATLAS LEVER: READ PROLOGUE/EPILOGUE BEFORE DRAFTING ANY C — A REAL TELL CAN LIVE INSIDE AN UNREACHABLE FRAGMENT (P31 S61; wave m0a, 16 cards byte-proven; extends §179-C)  <sub>L29415</sub>
-- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29458</sub>
-- **§298** — THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUPLICATED STATEMENTS, NOT A HOISTED POST-SWITCH STATEMENT (P31 S61; waves g0e/g0f, `func_80181B68`, ov_SC06_016, byte-proven 68/68)  <sub>L29501</sub>
-- **§299** — TWO INDEPENDENT EXTRACTION CHAINS EMIT CONTIGUOUSLY INSIDE ONE EXPRESSION; ONLY A STATEMENT BOUNDARY MAKES THE SCHEDULER INTERLEAVE THEM (P31 S61; wave m0a, `func_8003A404`, main, byte-proven 8/8)  <sub>L29526</sub>
-- **§300** — S61 DISTILL BATCH NOTES (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2 · m0b)  <sub>L29561</sub>
-- **§301** — AN INTERNAL `j` CARRIES `R_MIPS_26 .text`: rtu/match_one "MATCH" COULD NOT SEE WHICH LABEL A `j` TAKES — FIXED (`jrel`), AND THE TWO DRAFT SHAPES IT HID (P31 S62 T1; byte-proven 2/2, negative-controlled over 3,297 stubs)  <sub>L29630</sub>
-- **§302** — A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO DERIVE EACH FROM THE BYTES (P31 S62 T2; five reds healed in one session, 5/5, +39 held banks)  <sub>L29678</sub>
-- **§303** — MODULE ISLAND TABLES: DERIVE THE PADS AT BUILD TIME, PEEL NOTHING — THE §154-A/§260 "island-pads"/"island-blocked" WALLS DISSOLVE (P31 S62 T3a; byte-proven md_SC03_076 func_801F0A9C + func_801F0F28, sha 9a165e36…)  <sub>L29722</sub>
-- **§304** — SELF-DEFINING RODATA: WHEN A FUNCTION'S `.s` IS THE ONLY OWNER OF THE DATA IT REFERENCES, THE C BODY MUST DEFINE IT (P31 S62 T3; byte-proven md_MAIN_011/func_800D04F4)  <sub>L29758</sub>
-- **§305** — "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE (P31 S62 T3; 28 resolver drafts autopsied 28/28)  <sub>L29781</sub>
-- **§306** — A HAZARD `nop` IN FRONT OF A DIV-RESULT STORE IS A STATEMENT-ORDER DEFECT: THE INDEPENDENT TRAILING STATEMENT MUST BE WRITTEN *BEFORE* THE DIVISION-CONSUMING ONE (P31 S62 T4; byte-proven func_8017E7D0)  <sub>L29833</sub>
-- **§306a** — T4 DISTILL ADDENDA (P31 S62; four byte-proven refinements to existing laws, verified against the book by an independent verifier; each names its parent §)  <sub>L29860</sub>
-- **§307** — THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHEDULER-INTERNAL, AND NO SOURCE ORDER REACHES IT (P31 S63; byte-evidenced NEGATIVE result, main wave)  <sub>L29898</sub>
-- **§308** — A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if` SO cse FOLDS IT TO AN UNCONDITIONAL JUMP *AFTER* jump1's WINDOW HAS CLOSED (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29942</sub>
-- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29971</sub>
-- **§309** — A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD ONTO `$sp` UNLESS THE `if` SURVIVES jump1 AS A BARRIER-PRECEDED DIAMOND (P31 S63 t5e-t5i; byte-proven func_801812AC)  <sub>L30005</sub>
-- **§310** — A TWO-OPERAND `subu`'s DESTINATION TIES ONLY TO THE OPERAND THAT IS BLOCK-LOCAL: SHARE *ONE* SIDE ACROSS BLOCKS TO CHOOSE WHICH OPERAND'S REGISTER IT LANDS IN (P31 S64 t5j-t5m; byte-proven func_8017F578)  <sub>L30045</sub>
-- **§311** — A JOIN-BLOCK STORE CAN SWALLOW AN ARM'S LOAD-DELAY `nop`: WHEN ONE ARM'S VALUE COMES FROM A LOAD, DUPLICATE THE STORE INTO BOTH ARMS (P31 S64 t5j-t5m; byte-proven func_8017D7E0)  <sub>L30076</sub>
+- **§41a** — v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that dissolve them (Phase 25 T6, Fable5, 2026-07-09)  <sub>L2769</sub>
+- **§41b** — T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase 25 T7-M1, 2026-07-10)  <sub>L2824</sub>
+- **§41c** — T7-M2: the ×134 def-side-wall sweep via per-sibling RE-reconcile (Phase 25, 2026-07-10; 4,389 banks, ~0 agent tokens)  <sub>L2854</sub>
+- **§41b** — addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25 T7-M4, 2026-07-10)  <sub>L2873</sub>
+- **§41d** — `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byte-proven)  <sub>L2893</sub>
+- **§42** — The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 25 T7 F-band, 2026-07-10; Ultracode 9-worker wave, 4/9 banked byte-identical, 266 swept ×134)  <sub>L2915</sub>
+- **§42a** — addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-assign fix, +5 levers (2026-07-10b)  <sub>L2968</sub>
+- **§42b** — addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cast drift + fix  <sub>L3009</sub>
+- **§42c** — addendum — wave 3 (Max orchestrator + CORRECTED Ultracode fan-out, 2026-07-10c): the real-TU-faithful parallel harness (rtu_match) + 7/9 crack, ZERO iso-drift  <sub>L3048</sub>
+- **§42d** — addendum — wave 4 (rtu_match fan-out over the mapped frontier, 2026-07-10c): 24/26 MATCH, +5 durable levers  <sub>L3097</sub>
+- **§42e** — propagating a CRACK ×134: the def-finder bug + the byte-drift residual (the "remap-fail" misdiagnosis)  <sub>L3136</sub>
+- **§43** — The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args (Phase 25 task A, Fable5 crack of the 369-ins giant `func_80166994` ×134, 2026-07-11)  <sub>L3210</sub>
+- **§44** — The Phase-25 cheap-Opus giant batch: 5 structural levers + the §43 extension (2026-07-11, 6 crackers over the frontier giants)  <sub>L3257</sub>
+- **§45** — The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker + the 1-death local-alloc gate (Phase 25 task A giant escalation, Fable5 gdb-on-cc1, 2026-07-11)  <sub>L3313</sub>
+- **§46** — The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTURE levers cheap-Opus found by reading loop.c/jump.c/cse.c (Phase 26 session 8, 2026-07-13)  <sub>L3328</sub>
+- **§47** — The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm (Phase 26 session 8, Fable5 Max, byte-proven on `func_8017BEBC` 952 ins ×113)  <sub>L3380</sub>
+- **§48** — The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, Ultracode, 9/12 MATCH first pass)  <sub>L3420</sub>
+- **§3-A.** — ALLOCNO-PRICING DIALS — move a value into the register you want, byte-neutrally  <sub>L3428</sub>
+- **§3-A4** — SINK THE CONSUMER CALL INTO THE ARMS (the inverse of A1; `func_8016AB6C`, byte-proven)  <sub>L3459</sub>
+- **§3-B.** — THE EBB RULE — the general form of §46-L2  <sub>L3483</sub>
+- **§3-C.** — TYPE- AND SHAPE-DRIVEN CODEGEN (the C type literally selects the addressing mode)  <sub>L3499</sub>
+- **§3-D.** — THE CROSS-JUMP RATCHET (the sharpest new trap — `func_80131340` L-C)  <sub>L3523</sub>
+- **§3-E.** — Meta  <sub>L3533</sub>
+- **§49** — The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` (536 ins ×134), Phase 26 session 8  <sub>L3542</sub>
+- **§50** — Refinements that BOUND §47/§48 (from the `func_80135EB0` wall, 21→6; Phase 26 session 8)  <sub>L3591</sub>
+- **§51** — TOOLING INTEGRITY: the silent skip, and how to hunt it  <sub>L3645</sub>
+- **§51a** — The bug class  <sub>L3651</sub>
+- **§51b** — Why the byte-gate cannot save you  <sub>L3667</sub>
+- **§51c** — THE METHOD (do not audit by reading the regex)  <sub>L3677</sub>
+- **§51d** — THE LAWS  <sub>L3692</sub>
+- **§51e** — The false-wall pipeline (why this is not just hygiene)  <sub>L3754</sub>
+- **§51f** — Checklist for any new corpus-scanning tool  <sub>L3770</sub>
+- **§51g** — When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`)  <sub>L3784</sub>
+- **§52** — The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wall (`func_80178004`, 165 ins ×134; Phase 26, Fable5, 2026-07-15)  <sub>L3928</sub>
+- **§3-The** — 6 levers (the "walker-family skeleton" — apply to the 12 siblings; levers 1-5 retire ~half the residual)  <sub>L3939</sub>
+- **§3-Why** — the wall is (probably) intrinsic  <sub>L3960</sub>
+- **§52a** — The regalloc sibling wave: new levers + two new wall classes (cheap-Opus applying §52, 2026-07-15)  <sub>L3974</sub>
+- **§52b** — Sibling wave 2: more de-pin levers, a third wall class, and the match_one→whole-binary gap at scale (2026-07-15)  <sub>L4012</sub>
+- **§53** — SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it manufactured the "families don't template" doctrine (Phase 28 T1, 2026-07-15)  <sub>L4043</sub>
+- **§3-The** — case  <sub>L4048</sub>
+- **§3-Why** — 0/8 was structural, and predictable from two words  <sub>L4060</sub>
+- **§3-The** — rule  <sub>L4077</sub>
+- **§3-The** — meta-lesson (R35, and why this one is expensive)  <sub>L4093</sub>
+- **§55** — Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, 2026-07-17)  <sub>L4108</sub>
+- **§55a** — New byte-proven levers (each from a banked or near draft)  <sub>L4113</sub>
+- **§55b** — THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost)  <sub>L4137</sub>
+- **§55c** — Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TREE ARTIFACT  <sub>L4156</sub>
+- **§54** — `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-pools, +4,801, Phase 29 T6, 2026-07-16)  <sub>L4178</sub>
+- **§56** — Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls, 4 reconciliation tactics (`func_8013FAF8`, 312 ins ×138, Phase 29 T4, 2026-07-17)  <sub>L4202</sub>
+- **§56b** — PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft's types  <sub>L4247</sub>
+- **§57** — The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (the third §17a-1 direction; `tools/normalize_self_decls.py`, func_801670E4 ×137, Phase 29, 2026-07-18)  <sub>L4271</sub>
+- **§57a** — Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026-07-18)  <sub>L4318</sub>
+- **§58** — match_one MATCH ≠ BANK: the four blind spots + the crack-wave reconcile-before-bank law (Phase 29 crack-wave, 2026-07-18)  <sub>L4358</sub>
+- **§59** — Three h_seq sweep-residual classes match_one/the-exemplar-bank don't reveal (Phase 29 crack-wave close, 2026-07-18)  <sub>L4392</sub>
+- **§60** — Classify the residual, don't rank it: the deterministic residual→class classifier and what it measured about the backlog (Phase 29 Task-13A, 2026-07-21)  <sub>L4422</sub>
+- **What** — it measured — the whole open backlog, byte-grounded  <sub>L4446</sub>
+- **§3-Two** — corollaries worth remembering  <sub>L4465</sub>
+- **§3-The** — parallel-probe race this surfaced  <sub>L4478</sub>
+- **§60a** — What the first DIRECTED grinder run exposed (Phase 29 Task-13B, 2026-07-21)  <sub>L4487</sub>
+- **§60b** — The plateau autopsy's verdict: a `partial` drift is a WRONG DRAFT, not a missing transform (Phase 29 Task-13B close, 2026-07-21)  <sub>L4525</sub>
+- **§61** — Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draft-side (Phase 29, 2026-07-21)  <sub>L4560</sub>
+- **§61a** — The Task-5 wave: 11/12 MATCH, 0 banked — three DISTINCT integration walls, each now named (Phase 29, 2026-07-21)  <sub>L4621</sub>
+- **§61b** — The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 2026-07-21)  <sub>L4673</sub>
+- **§61c** — The jtbl bank is INCREMENTALLY valid and CLEAN-INVALID (Phase 29, 2026-07-21) — the blocking finding  <sub>L4728</sub>
+- **§61d** — The undo was eating the tree: two tools, one defect, invisible to the byte-gate (Phase 29, 2026-07-22)  <sub>L4794</sub>
+- **§62** — The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_verify._jtbl_reconcile`, Phase 29 SESSION-11, 2026-07-22)  <sub>L4848</sub>
+- **§63** — The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`, Phase 29 SESSION-13, 2026-07-23)  <sub>L4892</sub>
+- **§64** — The §20 type-lift's three laws: fold the tagged typedef, check VISIBILITY, and strip only what is TEXTUALLY IDENTICAL (`lift_types.py`, Phase 29 SESSION-14, 2026-07-23)  <sub>L4923</sub>
+- **§64a** — VARIANT types: UNIQUIFY the camps, do not reconcile them (`uniquify_type.py`, Phase 29 SESSION-14)  <sub>L4972</sub>
+- **§63** — UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST be R22-validated  <sub>L5015</sub>
+- **§65** — The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refutes §20's DEF-conflict wall (`tools/demacroize.py` + `tools/blocker_probe.py`, Phase 29 SESSION-16, 2026-07-24)  <sub>L5030</sub>
+- **§65a** — The blast-radius taxonomy (makes §61's law structural instead of remembered)  <sub>L5045</sub>
+- **§65b** — The escape: de-macroize the instantiation, don't touch the shared header  <sub>L5060</sub>
+- **§65c** — `rtu_match` MATCH → bank held 13/13 on self-decl, but broke on the FIRST callee-decl case  <sub>L5096</sub>
+- **§65d** — Existing-ladder baseline, measured (do this before building a recovery stage)  <sub>L5106</sub>
+- **§65e** — Two oracles, and the disagreement is the finding (R34 in practice)  <sub>L5116</sub>
+- **§65f** — The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is why the gate exists  <sub>L5133</sub>
+- **§65g** — Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield  <sub>L5154</sub>
+- **§66** — Exercise a banking driver's SUCCESS path before pointing it at a wave: the free re-bank test (Phase 29 SESSION-17, 2026-07-24)  <sub>L5174</sub>
+- **§66a** — The widest write in a pipeline is the one most likely to be UNDECLARED  <sub>L5196</sub>
+- **§66b** — A metric parsed out of another tool's prose goes NULL silently when the label changes  <sub>L5215</sub>
+- **§66c** — Before a wave, verify the FUEL exists; an "already attempted" set built from the wrong directory lies in BOTH directions  <sub>L5232</sub>
+- **§66d** — The permuter⇄reader loop: alternate a random search with a byte-verified idiom, and let `residual_class` decide whose turn it is (Phase 29 SESSION-17)  <sub>L5260</sub>
+- **§66d-1** — What transfers between giants is the LOOP, not the PIN  <sub>L5295</sub>
+- **§66d-2** — Two operational sharp edges  <sub>L5304</sub>
+- **§66d-3** — Read the ILS per-cycle SERIES, not its final best: a repeated score and a still-falling one look identical in a summary line and mean opposite things  <sub>L5315</sub>
+- **§67** — The arg-copy PLACEMENT lever: launder a parameter into a fresh pseudo AT the statement where the target's copy lands (Phase 29 SESSION-18, `func_8014D820` 25 → 16)  <sub>L5330</sub>
+- **§67a** — Run the symbol-set guard BEFORE you pay for a gate (`tools/symcheck.py`, Phase 29 SESSION-18)  <sub>L5420</sub>
+- **§66d-4** — "ILS converged" means converged FOR THAT WEIGHT PROFILE, not a floor (amends §66d-3; Phase 29 SESSION-18)  <sub>L5453</sub>
+- **§66d-5** — `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations (measured, Phase 29 SESSION-18)  <sub>L5506</sub>
+- **§68** — A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase 29 SESSION-18)  <sub>L5539</sub>
+- **§69** — How to attack a behemoth: map it, don't draft it (Phase 29 SESSION-18, `func_80183814`, 5,122 ins)  <sub>L5584</sub>
+- **§70** — The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `func_801777BC`)  <sub>L5634</sub>
+- **§71** — Before mapping a giant, look for an already-matched SIBLING beside it (Phase 29 SESSION-18, `func_8017D960`, 3,338 ins)  <sub>L5675</sub>
+- **§72** — A `register __asm__` pin is a PREFERENCE, not a reservation (Phase 29 SESSION-18, `func_8017F510`)  <sub>L5741</sub>
+- **§3-The** — honest fix was source-level and cheap  <sub>L5765</sub>
+- **§3-Giv** — record order (the §70 family)  <sub>L5775</sub>
+- **What** — is left, and what is byte-recorded as SPENT  <sub>L5781</sub>
+- **§73** — A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at each use, T0). Diagnose which before paying for the expensive one (Phase 29 SESSION-19, `func_8014F3E8` + `func_8014D4C0`)  <sub>L5798</sub>
+- **§74** — Auditing a pinned draft: the §72 hazard is CALLER-SAVED pins spanning a call, and only the disassembly can tell you (Phase 29 SESSION-19, `func_8017D960` b2, 5 pins)  <sub>L5837</sub>
+- **§75** — A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the carried extern before believing the exclusion message (Phase 29 SESSION-19, `func_8014F3E8` ×4 → ×138)  <sub>L5881</sub>
+- **§75a** — The exclusion classes, enumerated with named causes (Phase 29 SESSION-19, the 134-binary `dedup_extend` sweep)  <sub>L5940</sub>
+- **§75b** — A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the externs (Phase 29 SESSION-19, `func_80165CA0` ×3 → fleet)  <sub>L5963</sub>
+- **§75c** — Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix moves the error and looks like a new wall (Phase 29 SESSION-19, `func_8012F14C`)  <sub>L6012</sub>
+- **§76** — The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY through declaration scope and variable reuse (Phase 29 SESSION-19, behemoth #3 `func_8017F510` 1,511 ins, 97 → MATCH, pin-free)  <sub>L6043</sub>
+- **§3-The** — mechanism, with citations  <sub>L6052</sub>
+- **§3-The** — attribution primitive (use this before calling anything a scheduling residual)  <sub>L6072</sub>
+- **§3-Two** — diagnosis traps this function proved  <sub>L6079</sub>
+- **Practice** — Practice  <sub>L6089</sub>
+- **§77** — Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silently caps the body's reach. Diff the preamble before you gate. (Phase 29 SESSION-19 — three variants in one session, two different tools)  <sub>L6099</sub>
+- **§3-The** — CANDIDATE gate and the REAL gate need DIFFERENT preambles — keep the difference out of the bank  <sub>L6139</sub>
+- **§78** — A LENGTH drift can be a register grant in disguise; and `fold` never leaves a literal first in an `|` chain (Phase 29 SESSION-19, behemoth #2 `func_8017D960` 3,338 ins, 1806 → 0, pin-free)  <sub>L6189</sub>
+- **§3-The** — drift was an allocation decision, not missing code  <sub>L6195</sub>
+- **§3-The** — economics  <sub>L6226</sub>
+- **§79** — For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT ORDER is a declaration-order oracle (Phase 29 SESSION-19, `func_8017BF14` 4,763 ins, cold start → 45/4763)  <sub>L6235</sub>
+- **§71** — has a blind spot, and this is it  <sub>L6241</sub>
+- **§3-NEW** — LEVER — the frame layout reads back the original declaration order  <sub>L6255</sub>
+- **§76** — confirmed at scale, and a pin nuance  <sub>L6266</sub>
+- **§3-The** — residual, and the honest read  <sub>L6275</sub>
+- **§80** — A do-not-re-buy entry is scoped to its BASE, not to the function; and the pin's hidden cost is an unconditional `qty_phys_sugg` (Phase 29 SESSION-19, `func_8017BF14` 45 → 0)  <sub>L6285</sub>
+- **§3-The** — pin's hidden cost, with the citation  <sub>L6306</sub>
+- **§3-The** — flagged "#1 move" LOST — and why the failure is informative  <sub>L6317</sub>
+- **§78** — 's attribution primitive, run and reproduced  <sub>L6327</sub>
+- **Cold-start** — economics, now complete  <sub>L6333</sub>
+- **§81** — Banking a jr (jump-table) function: the 3-step carve chain, and why `match_one` cannot see the problem (Phase 29 SESSION-19, `func_8017C954`)  <sub>L6338</sub>
+- **§3-The** — defect this exposed: a shared type that is present but invisible  <sub>L6369</sub>
+- **§82** — Two source-shape oracles from behemoth #6: a duplicated `addiu $aN,$sp,K` across a `jal` means the block was INLINED, and scalar-vs-aggregate decides WHEN a stack slot is allocated (Phase 29 SESSION-19, `func_8017C730` 1,061 ins)  <sub>L6385</sub>
+- **§3-1.** — The inlined-helper signature  <sub>L6390</sub>
+- **§3-2.** — Scalar vs aggregate decides *when* the slot is allocated  <sub>L6404</sub>
+- **Also** — reproduced on this function  <sub>L6416</sub>
+- **§3-And** — the banking footnote (§75a class A, one line)  <sub>L6420</sub>
+- **§83** — The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a per-case symptom (Phase 29 SESSION-20, `func_80183814` 5,122 ins, cold-ish start → 36 structural / 99.3%)  <sub>L6427</sub>
+- **§83a** — READ THE HEADLINE NUMBER CORRECTLY: a LENGTH drift makes `match_one`'s count meaningless  <sub>L6434</sub>
+- **§83b** — THE LEVER: find the parameterised REPEAT before decoding case-by-case  <sub>L6442</sub>
+- **§83c** — TRAP: a "dead local" in a prior draft may be gcc's OWN spill area  <sub>L6460</sub>
+- **§83d** — CSE's quantity budget is WHOLE-FUNCTION, so a local rewrite cannot fix a local symptom  <sub>L6467</sub>
+- **§83e** — §80 vindicated again, on the same day it was written  <sub>L6481</sub>
+- **§84** — The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between two per-overlay symbols, and why `match_one` is structurally blind to it (Phase 29 SESSION-20, `func_8013D53C`)  <sub>L6487</sub>
+- **§3-The** — construct  <sub>L6492</sub>
+- **§3-Why** — it survived every candidate gate  <sub>L6510</sub>
+- **§3-THE** — FIX IS MECHANICAL — the tool already holds the answer  <sub>L6525</sub>
+- **Scope** — , measured (do not over-generalise — §80)  <sub>L6533</sub>
+- **§3-Two** — ladder lessons banked with it  <sub>L6543</sub>
+- **§85** — The RETURN-axis fleet widen is ALL-OR-NOTHING: widening the shared header alone guarantees a conflict in the source overlay (Phase 29 SESSION-20, `func_8012CC88` / `func_8014D12C`)  <sub>L6554</sub>
+- **§3-The** — conflict  <sub>L6559</sub>
+- **§3-THE** — FAILURE MODE — widening only `engine_core.h` is worse than not starting  <sub>L6567</sub>
+- **§3-The** — precondition, and how to check it in one grep  <sub>L6574</sub>
+- **§3-Do** — the WHOLE axis in one edit, then R22 once  <sub>L6582</sub>
+- **Reading** — , for the next person  <sub>L6591</sub>
+- **§86** — Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §42e pin guard is now over-conservative (Phase 29 SESSION-20)  <sub>L6604</sub>
+- **§3-The** — guard refuses a class that largely works  <sub>L6606</sub>
+- **§3-THE** — LAW: all-or-nothing PER FAMILY  <sub>L6615</sub>
+- **§3-Why** — the two live families differ from the three dead ones — the open question  <sub>L6642</sub>
+- **§87** — `match_one` COMPILES but never LINKS, so an unresolvable data symbol reads as MATCH; and stored drafts go STALE against the tree (Phase 29 SESSION-20)  <sub>L6648</sub>
+- **§3-The** — blindness ladder, now complete — FOUR classes `match_one` cannot see  <sub>L6664</sub>
+- **Consequence** — for the backlog ledger  <sub>L6674</sub>
+- **§3-The** — cheap discriminator, before spending a sweep  <sub>L6681</sub>
+- **§88** — `cross_jump` will not merge a common suffix containing a CALL; and §78 is scoped to ORDERED comparisons only (Phase 29 SESSION-20, the behemoth close-out)  <sub>L6689</sub>
+- **§88a** — repeated CALL-shaped blocks are left UNMERGED; call-free tails are merged for you  <sub>L6694</sub>
+- **§88b** — the `slti` literal-position law (extends §78 to comparisons)  <sub>L6701</sub>
+- **§88d** — BANKING ORDER: run the §81 carve chain BEFORE banking, never after  <sub>L6716</sub>
+- **§88e** — a wrong diagnosis, refuted properly (the model for how to treat an inherited lever)  <sub>L6723</sub>
+- **§88f** — the missing rung: a RELOCATION gate between `match_one` and the binary  <sub>L6733</sub>
+- **§89** — Two throughput rules the project already had written down and was not following (Phase 29 SESSION-20)  <sub>L6741</sub>
+- **§89a** — MEASURE the write set; do not assert its tier (`tools/blast_radius.py`)  <sub>L6747</sub>
+- **§89b** — the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel.py`)  <sub>L6760</sub>
+- **§3-The** — standing sequence  <sub>L6773</sub>
+- **§90** — Five tool-integrity laws from one session, each of which changed an answer (Phase 29 SESSION-21, 2026-07-27)  <sub>L6781</sub>
+- **§90a** — A comparison tool MUST share its reference oracle's index space, exactly  <sub>L6787</sub>
+- **§90b** — "Byte-neutral" is not "wanted": undo on the SUCCESS path too  <sub>L6804</sub>
+- **§90c** — A library-callable function must FAIL CLOSED on an unconfigured module  <sub>L6814</sub>
+- **§90d** — Do not measure a live wave's drafts (§87 in real time)  <sub>L6825</sub>
+- **§90e** — An agent's CONCLUSION and its EVIDENCE fail independently — re-derive the premise, not the fix  <sub>L6833</sub>
+- **§91** — A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap (Phase 29 SESSION-21, `func_8012AAAC` ×137)  <sub>L6857</sub>
+- **§3-The** — three-hypothesis trail, because two of them were wrong and the wrongness is instructive  <sub>L6886</sub>
+- **§92** — Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not (Phase 29 SESSION-21, `tools/conform_decls.py`)  <sub>L6906</sub>
+- **§93** — `set -o pipefail` attributes a pipeline failure to the LAST stage, not the failing one (Phase 29 SESSION-21, `func_8014D820`)  <sub>L6937</sub>
+- **§94** — A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's local types, ALL of them, transitively (Phase 29 SESSION-21, `func_8016B6BC` 0/137 → 137/137)  <sub>L6962</sub>
+- **§95** — `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 SESSION-21, `func_80176218`)  <sub>L6998</sub>
+- **§96** — The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so every COMMENTED declaration was silently skipped (Phase 29 SESSION-22, `func_80176218` banked)  <sub>L7033</sub>
+- **§97** — The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that captured a dirty tree (Phase 29 SESSION-22)  <sub>L7081</sub>
+- **§98** — `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION-22, `func_8014CF04`)  <sub>L7128</sub>
+- **§99** — The narrow-param wall is a DEF-side problem with a ZERO-blast-radius fix: convert the definition to K&R (Phase 29 SESSION-22, `func_80175AB8` + `func_80175DA8`)  <sub>L7182</sub>
+- **§3-Two** — `reconcile_tu` bugs found underneath, one introduced while fixing the other  <sub>L7205</sub>
+- **§100** — Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a shared header (Phase 29 SESSION-22, `func_80175DA8` 0/137 → 137/137)  <sub>L7231</sub>
+- **§101** — The STALE DEFAULT class: a guard whose cause was removed is a silent skip wearing a safety label (Phase 29 SESSION-22, three instances in one session)  <sub>L7260</sub>
+- **§102** — A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSION-22, `func_8016EC0C`)  <sub>L7287</sub>
+- **§103** — A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER function; move the DECL, not the draft (Phase 29 T48/T51, `func_80135260` — the fleet-wide half)  <sub>L7322</sub>
+- **§104** — Two silent-skip defects in one scan: match on MASKED text, emit from the ORIGINAL (Phase 29 T53, `gather_externs`)  <sub>L7410</sub>
+- **§105** — A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_bank`)  <sub>L7446</sub>
+- **§106** — Persist the MEASUREMENT, derive the POLICY: a stored route let a stale file out-vote the live table (Phase 29 T54, `residual_class._ROUTE`)  <sub>L7485</sub>
+- **§107** — A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `func_80144090` 0/136 → 136/136)  <sub>L7528</sub>
+- **§108** — Diagnosing a family `0/N`: the four causes, and the third opt-in lever (Phase 29 T59)  <sub>L7566</sub>
+- **§109** — Conforming a definition to a shared header: fix the NAMES, then check the RETURN precondition (Phase 29 T60)  <sub>L7615</sub>
+- **§110** — A unit must define exactly ONE function, and "ends in `;`" does not tell you which line defines it (Phase 29 T65)  <sub>L7655</sub>
+- **§111** — The distinct-code metric is not noisy: a family pays it only if its members are byte-VARIANT (Phase 29 T66)  <sub>L7696</sub>
+- **§112** — A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69, `audit_header_sigs.py`)  <sub>L7745</sub>
+- **§113** — An ARITY blocker only exists if the macro CALLS the function; an address-taken use has no call site (Phase 29 T72)  <sub>L7791</sub>
+- **§114** — The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29 T76/T77)  <sub>L7823</sub>
+- **§115** — A `func_XXXXXXXX` predicate rots by design: the same name-form assumption in THREE places (Phase 29 T78)  <sub>L7865</sub>
+- **§116** — Optimization level is a property of the FILE, not the function: read a family 0/N against the member's stub HOME (Phase 29 T79)  <sub>L7892</sub>
+- **§3-The** — fix moves the DEFINITION, not the stub — and here is why the obvious shortcut fails  <sub>L7910</sub>
+- **§117** — Spell the sibling's symbol from the SIBLING's address, not the exemplar's kind (Phase 29 T82)  <sub>L7941</sub>
+- **§3-Why** — it survived so long: a MASKED oracle will MATCH a wrong symbol  <sub>L7968</sub>
+- **§118** — Ordinal (positional) immediate resolution: compare C tokens to the DIFFERING asm uses (Phase 29 T87)  <sub>L7978</sub>
+- **§119** — Two levers on the SAME axis, opposite directions: test the off-diagonal (Phase 29 T89)  <sub>L8012</sub>
+- **§120** — Uniquify draft-defined TYPE names; and check which of N staging sites you actually patched (Phase 29 T93)  <sub>L8041</sub>
+- **§3-Do** — NOT "strip the duplicate typedef" — it breaks the extern that uses it  <sub>L8052</sub>
+- **§3-The** — wiring trap that cost two attempts  <sub>L8058</sub>
+- **§121** — Synthesise externs for macro-DEFINED callees from the macro's own definition head (Phase 29 T95)  <sub>L8076</sub>
+- **§122** — GATE RAW BEFORE TRANSFORMING; the undo belongs to the WRITER, as a per-edit journal (P30 T0a, 2026-07-30)  <sub>L8099</sub>
+- **§123** — PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its refusals are statements about the TOOL (P30 wave 1, 2026-07-30)  <sub>L8131</sub>
+- **§124** — A "not matched" verdict can mean the definition is there under a DIFFERENT C NAME: the asm-label alias blind spot (P30 SESSION-28, `func_8016191C` ×137)  <sub>L8168</sub>
+- **§124a** — a family sweep's `0 matched-exemplar families` may be a FILTER, not a wall  <sub>L8213</sub>
+- **§125** — Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA from a CLEAN tree (P30 SESSION-28; **this section's first draft was WRONG and the method caught it**)  <sub>L8221</sub>
+- **§3-The** — method (keep this)  <sub>L8228</sub>
+- **§3-The** — instrument rules that make its answer trustworthy (this is where I failed)  <sub>L8238</sub>
+- **§3-The** — corrected results (each SHA-verified, from a clean tree, restore re-verified)  <sub>L8253</sub>
+- **§3-Two** — further notes worth keeping  <sub>L8263</sub>
+- **§3-The** — meta-lesson  <sub>L8272</sub>
+- **§126** — The carve-within-a-carve: an ADDRESS RANGE is not an OPTIMIZATION REGION (P30 T2, byte-proven end-to-end)  <sub>L8279</sub>
+- **§3-The** — finding: opt level is per FILE, so the file's contents must be opt-HOMOGENEOUS  <sub>L8294</sub>
+- **§3-The** — instrument trap that hid it (and it is §124's shape again)  <sub>L8305</sub>
+- **§3-The** — mechanics  <sub>L8314</sub>
+- **§126a** — a bare `except: continue` around a coverage-asserting oracle re-creates the silent skip (P30 S28)  <sub>L8332</sub>
+- **§127** — The `-O0` regime: the CONSTANT-OFFSET FOLD, and why `-O0` needs its own idiom set (P30 T3 wave, 15 targets)  <sub>L8364</sub>
+- **§3-The** — idiom they kept re-deriving: the constant-offset fold  <sub>L8371</sub>
+- **§3-The** — rest of the `-O0` regime (write PLAIN C, and mean it)  <sub>L8382</sub>
+- **§127a** — §71 (sibling-first) is the strongest `-O0` lever, and it beats the index  <sub>L8392</sub>
+- **§127b** — the knowledge was in a SOURCE COMMENT, not the cookbook  <sub>L8401</sub>
+- **§128** — A raw NUL in C source makes grep SILENTLY SKIP the file (P30 S28, 137 files)  <sub>L8408</sub>
+- **§128a** — a negative control must corrupt a SCRATCH COPY, never the tracked file  <sub>L8440</sub>
+- **§129** — Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must never be committed without its owner (P30 S28, `func_8013BD74`)  <sub>L8452</sub>
+- **§129a** — the target instruction count is INFLATED after a carve  <sub>L8456</sub>
+- **§129b** — never commit a carve whose owner is still a stub (it strands the carve)  <sub>L8477</sub>
+- **§3-The** — real blocker underneath, for the record  <sub>L8492</sub>
+- **§130** — An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LINK (P30 S28, the jr pair)  <sub>L8501</sub>
+- **§3-The** — diagnostic ladder that finally located it (reusable)  <sub>L8538</sub>
+- **§131** — The jtbl OVER-SPAN: `sltiu N` is ground truth in BOTH directions, and the zero-word rule only guards one (P30 S28, `func_80191C50`)  <sub>L8548</sub>
+- **§132** — The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the carve could not see, and a truncated object no rule deleted (P30 S29, `func_8013B83C` + `func_8013BD74`)  <sub>L8585</sub>
+- **Defect** — 1 — a pre-§8e MERGED DOUBLE is not a single-table predecessor  <sub>L8594</sub>
+- **Defect** — 2 — `as` writes a corpse and nothing deletes it  <sub>L8612</sub>
+- **§3-The** — fingerprint, and the 30-second ladder that found it  <sub>L8622</sub>
+- **§3-The** — transferable rule  <sub>L8643</sub>
+- **§132a** — `--like` is for a sibling with NO record; against one that HAS a record it over-derives (P30 S29, `ov_SC07_010`)  <sub>L8650</sub>
+- **§132b** — When the span's already-matched owner is ITSELF multi-switch: `--span-rel` (P30 S1, `func_8014032C`)  <sub>L8675</sub>
+- **§133** — The DEFAULT-FILTER class: three times in one session, a tool silently answered a narrower question than the one asked (P30 S1–S3)  <sub>L8700</sub>
+- **§134** — MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P30 S6, 190 zero-crack families)  <sub>L8726</sub>
+- **§135** — Six byte-verified gcc-2.7.2 idioms from the P30 S6f-h waves (and the two-lane wave shape that found them)  <sub>L8780</sub>
+- **§3-The** — codegen idioms  <sub>L8785</sub>
+- **§3-The** — integration idioms (these decide whether a byte-correct draft BANKS)  <sub>L8819</sub>
+- **§3-The** — wave shape that produced these  <sub>L8834</sub>
+- **§136** — The LOCAL-VARIABLE lever: how many C locals, at what scope (P30 wave 4a, 25 byte-verified banks)  <sub>L8852</sub>
+- **§3-The** — splitting/merging rules (each closed a residual, byte-gated)  <sub>L8868</sub>
+- **§3-The** — type-form rules  <sub>L8894</sub>
+- **§3-The** — scheduling rules (refining §135-2 and §135-4)  <sub>L8927</sub>
+- **§3-The** — declaration surface (integration, not codegen)  <sub>L8956</sub>
+- **Wave** — economics (measured, for the next batch's sizing)  <sub>L8968</sub>
+- **§136a** — Blocker capture: classify on the OUTPUT, never on the exit status  <sub>L8991</sub>
+- **§136b** — A prior wave's "genuine byte-DIFF" verdict is NOT reliable evidence (4 of 4 refuted)  <sub>L9048</sub>
+- **§136c** — SIBLING-FIRST is a DERIVATION shortcut, not just a conflict fix (the fastest route in a family wave)  <sub>L9084</sub>
+- **§136d** — Four gcc-2.7.2 levers the redraft lane found (each closed a residual no other lever moved)  <sub>L9109</sub>
+- **§136e** — §136c's PRECONDITION, and two more symptom keys (wave 4b batch 3)  <sub>L9153</sub>
+- **§136f** — Two declaration sub-cases the reconcile lane surfaced (lane now 15/15 lifetime)  <sub>L9201</sub>
+- **§136g** — When the index points at the WRONG lever: two byte-refuted routings (func_801863B4)  <sub>L9226</sub>
+- **§136h** — CORRECTION: the zero-crack pool does NOT "refill with cheap work" (my error, byte-measured)  <sub>L9255</sub>
+- **§136i** — The drafter model LADDER: Haiku → **Sonnet** → Opus → Fable5 (Drew, 2026-08-03)  <sub>L9285</sub>
+- **§136j** — The failure MIX flips with function size (measured across four bands, one session)  <sub>L9317</sub>
+- **§137** — REGALLOC-PERM is a TWO-COMPILE ARITHMETIC PROBLEM, not a permuter job  <sub>L9359</sub>
+- **§137a** — A gate verdict has a TIMESTAMP; re-check it against the draft's mtime  <sub>L9401</sub>
+- **§138** — The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on blast radius  <sub>L9430</sub>
+- **§3-The** — triage, cheapest first  <sub>L9436</sub>
+- **§3-The** — DEFINITION-side alias is the only escape when the fleet canon disagrees on a promoting param  <sub>L9488</sub>
+- **Rank** — the lane by measured concentration, not by class count  <sub>L9496</sub>
+- **THREE** — carry variants hide in one "CARRY-FIXABLE" bucket — and they need different fixes  <sub>L9505</sub>
+- **§134** — again, in a second tool — and the waiter rule corrected  <sub>L9541</sub>
+- **STEP** — 0 of sibling-first: grep `src/` for a distinctive LITERAL from the `.s`  <sub>L9561</sub>
+- **Reconciling** — a gate-refused draft: which way you edit depends on WHERE the TU's decl is  <sub>L9580</sub>
+- **§139** — A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not survive a carve (P30 S38, wave 6: 10 of 16 drafts vanished)  <sub>L9609</sub>
+- **§3-The** — generalisation — three corollaries worth more than the bug  <sub>L9641</sub>
+- **§3-And** — the inverse-lookup trap, same session  <sub>L9658</sub>
+- **§140** — A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a phantom regression that gated the session's best lever)  <sub>L9675</sub>
+- **§3-The** — three-line proof (do this before diagnosing any metric movement)  <sub>L9695</sub>
+- **§3-The** — two instrument defects it exposed  <sub>L9704</sub>
+- **§3-The** — same swallow, twice more, in the integration spine  <sub>L9724</sub>
+- **§3-Two** — wrong mechanisms I chased first, and why they were wrong  <sub>L9735</sub>
+- **§141** — The §134 class is CLOSED: every line-shape decision now routes through `cdecl._mask` (P30 S39)  <sub>L9755</sub>
+- **§142** — An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do not gate a draft. (P30 S39, +7,710 ins in two commands)  <sub>L9793</sub>
+- **§3-The** — measurement (do this before any wave; it is ~20 lines and needs no builds)  <sub>L9805</sub>
+- **§3-The** — trap that hid it — SAME FUNCTION, TWO ROUTES, ONLY ONE IS FREE  <sub>L9820</sub>
+- **Route** — selection (why `--addr` sometimes says "nothing changed")  <sub>L9829</sub>
+- **§3-And** — the report-vs-bytes lesson attached to it  <sub>L9837</sub>
+- **§143** — `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep became 18/39. (P30 S40)  <sub>L9849</sub>
+- **§144** — THE LITERAL'S SPELLING PICKS THE IMMEDIATE ENCODING (P30 S40 wave 1, `func_801822E0`)  <sub>L9903</sub>
+- **§145** — Three loop/combine levers from the S40 wave-2 drafters (16/16 match_one)  <sub>L9942</sub>
+- **§146** — RE-MEASURE A WALL BEFORE YOU RESPECT IT. Both "permanent" giants fell to drafts already on disk. (P30 S6, +50,094 ins)  <sub>L9992</sub>
+- **§3-Why** — a correct draft can read as an intrinsic wall  <sub>L10003</sub>
+- **Then** — propagation returned 0/137 TWICE — both times a missing TYPE  <sub>L10015</sub>
+- **§3-Two** — errors of mine, both instructive  <sub>L10024</sub>
+- **§3-The** — rule  <sub>L10038</sub>
+- **§147** — The three-stratum FRAME LAW, and four "stop searching" verdicts (P30 S42, `func_8017C294`, serial run)  <sub>L10051</sub>
+- **§3-A.** — The frame has THREE strata, and stratum 3 is unreachable from C  <sub>L10056</sub>
+- **§3-B.** — A `?:` on MEMORY operands costs ~16 bytes of invisible frame; on REGISTER operands, zero  <sub>L10072</sub>
+- **§3-C.** — Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED  <sub>L10083</sub>
+- **§3-D.** — A lone `$t8`/`$t9` in the target is RELOAD SCRATCH — reproduce the spill, don't pin the register  <sub>L10088</sub>
+- **§3-E.** — A `qty_compare` TIE is not spelling-reachable — recognise it and stop  <sub>L10098</sub>
+- **Consequence** — for the family (a real scheduling decision)  <sub>L10110</sub>
+- **§148** — The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds to MIN_EXPR (P30 S42, `func_8017C6F4`, 947 ins)  <sub>L10160</sub>
+- **§3-A.** — `move_movables` hoists iff `threshold × savings × lifetime ≥ insn_count` — and you can read it  <sub>L10166</sub>
+- **§3-B.** — `(v < 0x40) ? v : 0x3F` is folded to `MIN_EXPR` and expands to the WRONG SHAPE  <sub>L10185</sub>
+- **§3-C.** — A zero-byte ALLOCNO-PRIORITY slider  <sub>L10199</sub>
+- **§3-D.** — Reproduce the original's BUGS verbatim  <sub>L10209</sub>
+- **§149** — Four instrument defects in one session, and the two questions they were hiding (P30 S43)  <sub>L10258</sub>
+- **§3-A.** — A prep step that returns its input on failure is indistinguishable from a search that found nothing  <sub>L10264</sub>
+- **§3-B.** — Same address + same name ≠ same body — and the ledger keys on address  <sub>L10282</sub>
+- **§3-C.** — `make: *** [...] Error N` is a summary, never a diagnosis  <sub>L10298</sub>
+- **§3-D.** — "Cheap fuel" that was never probed: 0 of 31 templatable  <sub>L10308</sub>
+- **§150** — A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocator tie (P30 S43, `func_8017C6F4`, 947 ins ×4)  <sub>L10327</sub>
+- **§3-The** — fix  <sub>L10334</sub>
+- **§3-The** — method that found it (this is the transferable part)  <sub>L10344</sub>
+- **§3-Two** — corrections to the record  <sub>L10360</sub>
+- **Diagnostic** — order (adopt this)  <sub>L10371</sub>
+- **§151** — THE GHOST WEDGE: when a load-before-store transposition is unreachable by ANY statement order (P30 S43, `func_8017EF68`, 969 ins)  <sub>L10382</sub>
+- **§3-The** — mechanism (read from cc1's own `-dR` trace, not inferred)  <sub>L10387</sub>
+- **§3-The** — lever — a zero-emission insn that absorbs the blocked tick  <sub>L10402</sub>
+- **§3-The** — two fallouts, and how to close them (both measured, in order)  <sub>L10410</sub>
+- **When** — to reach for it  <sub>L10422</sub>
+- **§152** — BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC family: 1 crack → 12 overlays → 11,364 ins)  <sub>L10433</sub>
+- **§3-The** — finding  <sub>L10438</sub>
+- **§3-The** — key  <sub>L10447</sub>
+- **§3-Two** — cautions that must travel with this technique  <sub>L10458</sub>
+- **§3-The** — companion defect (open)  <sub>L10469</sub>
+- **§153** — THE ADDRESS-REMATERIALISATION LAUNDER: a third zero-emission asm lever (P30 S43, `func_8018D98C`, 710 ins)  <sub>L10481</sub>
+- **Symptom** — Symptom  <sub>L10489</sub>
+- **Mechanism** — (gcc source + RTL dumps, not inferred)  <sub>L10494</sub>
+- **What** — does NOT work (14 byte-measured probes)  <sub>L10501</sub>
+- **§3-The** — cure — a fresh launder per site, each in its own block  <sub>L10507</sub>
+- **Companion** — levers from the same function  <sub>L10517</sub>
+- **§154** — Reading a disc payload: the module-id word, static base derivation, and "type 1 = uncompressed overlay" (P30 S44)  <sub>L10537</sub>
+- **§3-A.** — Payload word0 is a global MODULE ID; code starts after the header  <sub>L10542</sub>
+- **§3-B.** — Two static base-derivation methods that must AGREE (use both)  <sub>L10551</sub>
+- **§3-C.** — PAC type 1 = the same payload class as type 4, just NOT compressed  <sub>L10563</sub>
+- **§155** — hi/lo literal scanning MUST track base registers (S45)  <sub>L10573</sub>
+- **§155a** — the same failure class, one level up: SHAPE-blind table scanning (S45 p5)  <sub>L10582</sub>
+- **§155b** — check the TYPE your oracle returns before comparing against it (S45 p5)  <sub>L10602</sub>
+- **§155c** — the ZERO-REFERENCE trap: gcc splits a global-array address across the `lui` and the LOAD (S46)  <sub>L10625</sub>
+- **§156** — an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7)  <sub>L10655</sub>
+- **§157** — the cheap-tier size cliff, measured (S45 p6)  <sub>L10702</sub>
+- **§158** — The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S46 tier-3, `func_8017CE58`, 733 ins)  <sub>L10727</sub>
+- **Symptom** — Symptom  <sub>L10736</sub>
+- **§3-Why** — the fork is chained (gcc source, validated insn-by-insn against -dS/-dR dumps)  <sub>L10742</sub>
+- **§3-The** — method (dump-arithmetic first, then place — no probing)  <sub>L10755</sub>
+- **Bonus** — facts worth keeping  <sub>L10772</sub>
+- **§156** — THE PREFERENCE-DONOR MERGE: cross-region variable reuse is what fills a0-a3, and a call-arg use in ONE region steers the fill in ALL of them (P30 S46 tier-3, `func_80186E24`, 611 ins: 236-off "S11 regalloc-order" → MATCH, zero new pins)  <sub>L10787</sub>
+- **§159** — THE DECLARATION AXIS: conform to byte-truth, and make every guard state its COVERAGE (P30 S47; ~10,930 sites across 8 axes, fleet byte-identical)  <sub>L10843</sub>
+- **§160** — THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall (P30 S47)  <sub>L10908</sub>
+- **§161** — THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47)  <sub>L10984</sub>
+- **§162** — S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 targets  <sub>L11029</sub>
+- **§162a** — SHARPENS  *(sharpens §161a, §131, §8a-pad, §129a)*  <sub>L11056</sub>
+- **§162b** — SHARPENS  *(sharpens §48-A3, §156, §150, §76)*  <sub>L11085</sub>
+- **§162d** — SHARPENS  *(sharpens §31, §21, §30, §55a)*  <sub>L11114</sub>
+- **§162e** — NEW  <sub>L11156</sub>
+- **§162** — THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the body order (P30 S47, `ov_MAIN_012`)  <sub>L11158</sub>
+- **§162f** — SHARPENS  *(sharpens §42d, §41d, §73, §10)*  <sub>L11224</sub>
+- **§162g** — NEW  <sub>L11279</sub>
+- **§162** — CROSS-JUMP DIRECTION: the surviving copy is always the LATER one, so a BACKWARD `j` into a sibling arm is a source `goto` (P30 S48)  <sub>L11281</sub>
+- **§162h** — SHARPENS  *(sharpens §88, §88a, §50-B, §8)*  <sub>L11315</sub>
+- **§162** — The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_80189540`)  <sub>L11317</sub>
+- **§162i** — SHARPENS  *(sharpens §135, §21, §42, §32)*  <sub>L11383</sub>
+- **§162j** — SHARPENS  *(sharpens §25, §136d-1, §48-B, §46-L2)*  <sub>L11408</sub>
+- **§162k** — SHARPENS  *(sharpens §1-I2, §12, §160d, §21)*  <sub>L11437</sub>
+- **§162l** — SHARPENS  *(sharpens §48-B, §48-C1, §20, §21)*  <sub>L11500</sub>
+- **§162m** — SHARPENS  *(sharpens §36, §158, §148, §153)*  <sub>L11555</sub>
+- **§158a** — THE FIFTH LEVER IS NOT AN ASM: `do { } while (0)` is a REGION ref-multiplier you MINT (P30 S48, `func_8017CBC8`, ov_MAIN_012 / jr_801789AC, 188 ins → MATCH)  <sub>L11557</sub>
+- **§3-The** — law  <sub>L11564</sub>
+- **Size** — it before you write it (§158 step 1-2, applied)  <sub>L11575</sub>
+- **§3-The** — wrap BOUNDARY is the dial — and it is indiscriminate  <sub>L11596</sub>
+- **§3-Not** — a pure dial  <sub>L11602</sub>
+- **DIAGNOSTIC** — TELL — two faces, one law  <sub>L11606</sub>
+- **§162n** — NEW  <sub>L11628</sub>
+- **§162o** — SHARPENS  *(sharpens §158, §136-1, §136-6, §79)*  <sub>L11661</sub>
+- **§162p** — SHARPENS  *(sharpens §48-B, §46-L2, §156, §136d-1)*  <sub>L11720</sub>
+- **§162q** — SHARPENS  *(sharpens §30, §30a, §135-2, §136-13)*  <sub>L11737</sub>
+- **§163** — S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actionable  <sub>L11775</sub>
+- **§163z** — THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass)  <sub>L11843</sub>
+- **§164** — S48 §163z SKEPTIC PASS (P30, 2026-08-12): 190 claims vetted, 82 banked  <sub>L11863</sub>
+- **§16Xy** — SHARPENS  *(sharpens §136d-3, §37 /s-DEP LATTICE, §135-2, §136-13, §162q)*  <sub>L12315</sub>
+- **§3-The** — `/s` drop clause is in ALL THREE dependence predicates, so the FIXED-ADDRESS STORE is what floats (P30 S48, `func_8017CA18`, ov_MAIN_012)  <sub>L12317</sub>
+- **§164z** — REFUTED CLAIMS: do NOT re-derive these  <sub>L13651</sub>
+- **§165** — S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed  <sub>L13717</sub>
+- **§16Z** — SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2-map/sched.md` §64)*  <sub>L14368</sub>
+- **§3-The** — ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `func_80185B44`, ov_SC03_014)  <sub>L14370</sub>
+- **§165z** — REFUTED THIS WAVE: do NOT re-derive  <sub>L14886</sub>
+- **§166** — THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen  <sub>L14930</sub>
+- **§167** — S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point  <sub>L14986</sub>
+- **§167z** — REFUTED IN WAVES 5/6: do NOT re-derive  <sub>L16182</sub>
+- **§168** — THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the similarity map above it  <sub>L16239</sub>
+- **§169** — THE MICRO-ADAPT LANE (P30 S49): edit a proven body, don't crack a new one  <sub>L16291</sub>
+- **§170** — THE A-PROP WORD-DIFF CARD (P30 S49): the lane that had no owner  <sub>L16338</sub>
+- **§171** — THE STALE SEED SYMBOL (P30 S50, 2026-08-13): why §170's 91%→57% was never codegen  <sub>L16382</sub>
+- **§171a** — THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop  <sub>L16448</sub>
+- **§171b** — THREE CARRIES THE MECHANICAL DRAFT NEEDS (P30 S50, banking the top-reach families)  <sub>L16498</sub>
+- **§172** — THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 MIPS  <sub>L16531</sub>
+- **§172a** — TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max)  <sub>L16585</sub>
+- **§172b** — THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask)  <sub>L16601</sub>
+- **§173** — THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where the verdicts have no drafts  <sub>L16644</sub>
+- **§174** — THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery  <sub>L16680</sub>
+- **§175** — A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wave H, 2026-08-15)  <sub>L16750</sub>
+- **§176a** — THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot prove.  <sub>L16775</sub>
+- **§176b** — BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c  <sub>L16815</sub>
+- **§176d** — THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15)  <sub>L16841</sub>
+- **§176e** — SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py`  <sub>L16880</sub>
+- **§176f** — THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P31 S52)  <sub>L16937</sub>
+- **§176g** — SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine)  <sub>L16968</sub>
+- **§176h** — THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law  <sub>L17006</sub>
+- **§3-A.** — The seven under-reporting holes (all in `gate_main`, all the same shape)  <sub>L17014</sub>
+- **§3-B.** — Typedef handling — the only strategy that survives contact  <sub>L17032</sub>
+- **§3-C.** — The limit that remains (recorded, not solved)  <sub>L17054</sub>
+- **§3-C2.** — RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier  <sub>L17061</sub>
+- **§3-D.** — The measured cost shape, and what to build next  <sub>L17084</sub>
+- **§176i** — WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q)  <sub>L17102</sub>
+- **§176j** — STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable)  <sub>L17134</sub>
+- **§176j-2** — THE REPAIR PASS, MEASURED (do this instead of resuming)  <sub>L17160</sub>
+- **§176k** — TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE  <sub>L17180</sub>
+- **§177** — 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING  <sub>L17197</sub>
+- **§178** — SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited  <sub>L17254</sub>
+- **§3-A.** — THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins)  <sub>L17266</sub>
+- **§3-B.** — A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, 92 ins)  <sub>L17282</sub>
+- **§3-C.** — SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins)  <sub>L17295</sub>
+- **§3-D.** — A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom)  <sub>L17303</sub>
+- **§3-E.** — THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins)  <sub>L17310</sub>
+- **§3-F.** — `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins)  <sub>L17319</sub>
+- **§3-G.** — TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES  <sub>L17325</sub>
+- **§179** — IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass)  <sub>L17341</sub>
+- **§179-A** — 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proofs)  <sub>L17351</sub>
+- **§179-B** — 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs)  <sub>L17400</sub>
+- **§179-C** — 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__asm__`  <sub>L17450</sub>
+- **§179-D** — `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE  <sub>L17501</sub>
+- **§179-E** — A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP  <sub>L17521</sub>
+- **§179-F** — PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION  <sub>L17547</sub>
+- **§179-G** — 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1)  <sub>L17570</sub>
+- **§179-H** — A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE  <sub>L17597</sub>
+- **Considered** — and NOT banked  <sub>L17620</sub>
+- **§176c** — MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY  <sub>L17637</sub>
+- **§176** — SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, and the pin that fights back  <sub>L17648</sub>
+- **§176-A** — "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first  <sub>L17654</sub>
+- **§176-B** — "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation  <sub>L17678</sub>
+- **§176-C** — 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine gcc-2.7.2 bug  <sub>L17724</sub>
+- **§176-D** — CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2)  <sub>L17750</sub>
+- **§176-E** — Two cheap source spellings, both cc1-probed  <sub>L17776</sub>
+- **§176-F** — Misdiagnosis triage: four residual verdicts that were lying  <sub>L17798</sub>
+- **What** — is NOT banked here  <sub>L17815</sub>
+- **§180** — THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW  <sub>L17828</sub>
+- **§180b** — WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt)  <sub>L17857</sub>
+- **§180c** — WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER  <sub>L17876</sub>
+- **§181** — WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile)  <sub>L17894</sub>
+- **Only** — ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable.  <sub>L17895</sub>
+- **§182** — §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held  <sub>L17950</sub>
+- **§180d** — THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE  <sub>L17964</sub>
+- **§183** — THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts)  <sub>L17976</sub>
+- **§3-18** — of 20 reconciled while keeping the match. The two that did not are mechanism, not effort.  <sub>L17977</sub>
+- **§184** — COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one session)  <sub>L18047</sub>
+- **§185** — EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES  <sub>L18075</sub>
+- **§186** — CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT  <sub>L18107</sub>
+- **§186b** — A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL  <sub>L18128</sub>
+- **§186c** — WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER  <sub>L18136</sub>
+- **§187** — 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOPS  <sub>L18153</sub>
+- **§188** — 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE  <sub>L18191</sub>
+- **§189** — FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-derived by a second agent  <sub>L18241</sub>
+- **§190** — THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled)  <sub>L18316</sub>
+- **§191** — WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-derived  <sub>L18353</sub>
+- **§192** — THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54)  <sub>L18375</sub>
+- **Three** — defects in one call path; the overlay slates that carry most of the wave work were being waved through  <sub>L18376</sub>
+- **§193** — THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-covered  <sub>L18440</sub>
+- **§193-A** — The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar`/`sibs` are stubs 100% by construction (tools/atlas.py:96/657), while `seed.ref` (matched pool, atlas.py:505-536) is dropped at build_wave_atlas.py:143  <sub>L18457</sub>
+- **§193-B** — A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTER AN INTERVENING `jal` — AND THE DECIDER IS `combine.c:929`'s CROSS-CALL GUARD, NOT REGISTER ALLOCATION  <sub>L18524</sub>
+- **§193-C** — gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head merge, so §8/§48-A1's "duplicate into both arms and cross_jump refunds it" is a TAIL-only lever  <sub>L18562</sub>
+- **§193-D** — A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's LAST use in a block precedes a call that takes the pointer *as a register*, sched1 hoists the implicit `move $aN,$sN` to the block top and local-alloc re-bases the WHOLE block's memory operands onto `$aN`. The only C dial is a label (the §165-24 goto-join) between the block and the call.  <sub>L18596</sub>
+- **§193-E** — A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it in a C local is the only C-level lever over that count — no store SPELLING has any reach  <sub>L18667</sub>
+- **§193-F** — §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, not a boolean — two identical merged constants split hoisted/not-hoisted by LIST ORDER, and `insn_count` picks the rank cutoff  <sub>L18697</sub>
+- **§193-G** — §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live at THREE case nodes (`balance_case_nodes` splits at `i > 2`), but only for a signed-after-promotion index  <sub>L18761</sub>
+- **§193-H** — A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call (cse's third kill disjunct) — so the target emits one `lw` per store-separated RUN of spellings, and a run of stores sharing one `lw` is a C local you must declare  <sub>L18822</sub>
+- **§193-I** — A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS THEREFORE COST 8·k MORE THAN ONE HAND-LAID STRUCT (k = how many of them have size mod 8 ≠ 0), AND THE TELL IS IDENTICAL INSTRUCTION COUNT WITH EVERY $sp DISPLACEMENT SHIFTED BY THE SAME CONSTANT.  <sub>L18862</sub>
+- **§193-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L18921</sub>
+- **§194** — THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-covered  <sub>L18948</sub>
+- **§194-A** — A zero-byte scheduling fence goes AFTER the defining statement to make that computation emit FIRST in its block — and the barrier predicate is `volatile`-or-colon-less, not the `"memory"` clobber (COMPLEMENTS §165-40; does not refute it)  <sub>L18965</sub>
+- **§194-B** — A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — the width, not the clamp or the join liveness, is what keeps the copy (and func_80183094's pin + `"memory"` clobber are both provably inert)  <sub>L19031</sub>
+- **§194-C** — A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share a pseudo with any value LIVE ACROSS a call (but it may freely share one with values that merely sit between calls)  <sub>L19069</sub>
+- **§194-D** — Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication + attribution correction of §165-17, NOT a new argument-register law  <sub>L19132</sub>
+- **§194-E** — The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a construction consequence of `atlas.py:657` (exemplar = max-nins OPEN member) meeting `build_wave_atlas.py:166` (one card per gid); and the shipped §193-A `seed_ref` is same-binary on 0/51, so no card field can ever name a destination-TU sibling  <sub>L19173</sub>
+- **§194-F** — `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value && MEM` path), not a fold — it partitions one value between local_alloc and global_alloc. BOUNDS §21's L1872 bullet, whose stated direction is byte-wrong on 3 of 4 instances, and CLOSES the control §167-37 asked for.  <sub>L19210</sub>
+- **§194-G** — Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling, decides `sra` vs `lhu` — and the break is count-neutral  <sub>L19283</sub>
+- **§194-H** — §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a branch fences the store that reads v, and when TWO independent stores compete for the one delay slot the fence picks the winner at ZERO length drift (a WIDTH/sh!=sw swap, not a nop). Corrects §167-42's reconstruction (pseudo arm → hard-reg arm) and supplies its first re-runnable A/B.  <sub>L19326</sub>
+- **§194-I** — §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmetically instead: d = round(2^(32 + post_shift) / magic_read_as_unsigned)  <sub>L19364</sub>
+- **§194-J** — Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volatile` saves it  <sub>L19407</sub>
+- **§194-K** — Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, non-volatile, dependence-CREATING lever (corrects §167-05's "volatile is the only door"; fourth consumer of reg_n_sets)  <sub>L19459</sub>
+- **§194-L** — §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-constant shape is a 2-D lookup (cmp_info ROW × constant-in-window), and naming matters on OPPOSITE sides of the window for the GE/LT rows vs the GT/LE rows  <sub>L19537</sub>
+- **§194-M** — A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — reorg can never pull a store out of either thread (gcc-2.7.2, -mips1)  <sub>L19585</sub>
+- **§194-N** — §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real incoming edge), not "a label between the block and the call" — a bare label, or a `goto L; L:` pair whose target is the next active insn, is deleted by jump1 (jump.c:663-669 → delete_insn → jump.c:3458-3461, and jump.c:243 for the bare case) long before sched1/local-alloc, and costs exactly zero bytes  <sub>L19643</sub>
+- **§194-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L19703</sub>
+- **§195** — THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-covered  <sub>L19724</sub>
+- **§195-A** — §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class: an argument that DIES at the call is allocated straight into $aN, so its only def is a plain load far above the jal and every intervening use reads $aN — there is no positive tell in either direction, only the two-arity A/B  <sub>L19738</sub>
+- **§195-B** — A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a LOCAL-alloc quantity (the missing precondition under §48-A2 / §52 / regalloc.md K8)  <sub>L19809</sub>
+- **§195-C** — A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-delay-gap filler chosen by SOURCE STATEMENT ORDER — swap the two independent statements nearest the call; a single-use `void *p = &SYM;` call-arg temp is OUTPUT-inert against it (but NOT expand-stream-inert)  <sub>L19851</sub>
+- **§195-D** — §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` destination is invisible to match_one, the permuter scorer AND every similarity tier: a control-flow semantic error (which calls execute) surfaces as a 1-instruction residual mislabelled `DELAY-SLOT / profile=schedule`, or as an outright false MATCH  <sub>L19899</sub>
+- **§195-E** — A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the source NAMED the condition — a truth expression in an `if`'s controlling position reaches `do_jump`, which has no value path  <sub>L19967</sub>
+- **§195-F** — fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-constant ELSE) by inverting the condition and swapping the arms — so a ternary's written arm order is byte-inert there, and `c ? 0 : X` is unspellable: it always compiles as `!c ? X : 0`  <sub>L20025</sub>
+- **§195-G** — §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CONSUMES THE RESULT: the C dial that keeps two call sites apart is WHERE the consumer test lives, and the branch SENSE you spell it with is byte-inert (jump.c:1737 canonicalises it)  <sub>L20077</sub>
+- **§195-H** — §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT ZERO ADDRESSING COST, AND THE ELEMENT COUNT IS INERT (§165-27's `T v[2]` CAVEAT IS A LOCAL-FRAME FACT AND DOES NOT TRANSFER)  <sub>L20125</sub>
+- **§195-I** — §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of a pseudo in the address's equivalence chain (in-place `p += K`, §145(b)'s `p = r;` copy, or an asm re-tie) kills the fold; the pass is cse and the gate is `invalidate`'s `reg_tick++`  <sub>L20172</sub>
+- **§195-J** — GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexist in one TU (measured in 2 TUs), and the tell is the target's own opcodes (`lwc2`/`sqr`/`swc2` vs `jal`), not the sibling. Costs -8 ins on func_8018505C. Corollary: the game's inline `sqr` macro emits TWO hazard nops, the SDK's `Square0` body emits ONE — so the inline form is provably not `Square0` inlined (a second instance of §187's SDK-vs-game GTE nop divergence).  <sub>L20237</sub>
+- **§195-K** — At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when the N reads carry DISTINCT index expressions; with a SHARED index §18's +2-instruction residual is still alive at -O2 (the submitted "memory-loaded narrow index" precondition and unconditional length-neutrality are both falsified)  <sub>L20281</sub>
+- **§195-L** — The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the reload that one join store deletes (bounds §193-E BOUND 1/BOUND 3 with §48-B's EBB boundary)  <sub>L20333</sub>
+- **§195-M** — Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) term and §165-03/§167-06's 8×orphan term are the SAME frame_offset walk at two different compiler stages, and each stage re-CEILs frame_offset to 8 before it allocates  <sub>L20385</sub>
+- **§195-N** — In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LAST test must stay in STATEMENT form — the value form (`return f() != 0;` / `? 1 : 0` / `!!f()`) costs +1 `j` and empties the other N−1 delay slots. The cause is REORG block placement, not jump.c's `delete_jump`.  <sub>L20434</sub>
+- **§195-REJECTED** — what this harvest did NOT bank (recorded so it is not re-derived)  <sub>L20481</sub>
+- **§196** — PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54)  <sub>L20527</sub>
+- **§197** — THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-covered  <sub>L20582</sub>
+- **§197-A** — A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM RE-TIE (attribution CONTESTED: cse vs combine)  <sub>L20596</sub>
+- **§197-B** — A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_code` CHANNEL (the non-EQ complement of §165-03) — and a front-end-opaque mask on EITHER compare is a pure-C dial that keeps the target's second branch  <sub>L20634</sub>
+- **§197-C** — Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set already contains BOTH operand hard registers — split the accumulate so the destination IS the load's pseudo  <sub>L20662</sub>
+- **§197-REJECTED** — §197-REJECTED  <sub>L20707</sub>
+- **§199** — THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-covered  <sub>L20722</sub>
+- **§199-A** — §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui`/`ori` is a SCHEDULE fact, not a source fact — and the separator is the BIRTHING BOOST, not a "priority floor" (§189-A's split-timing half survives; its "no statement order / no pin" absolute and the candidate's own forward-scheduler narrative both fall)  <sub>L20733</sub>
+- **§199-B** — A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent pins as "obviously load-bearing" is the one carrying the signal, and the partial sweep returns a FLAT residual that reads as proof of order-invariance  <sub>L20782</sub>
+- **§199-C** — A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever SEE the neg is decided by COMBINE, and for an EVEN |K| it never disappears  <sub>L20827</sub>
+- **§199-D** — A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is the WIDTH of a real object, and a widening `(s32)` cast is inert — AMENDS §35 (whose stated "only CSE-reuse canonicalizes" mechanism is byte-wrong) and does NOT apply inside a `switch`  <sub>L20875</sub>
+- **§199-E** — §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper a constant": an insn between a `lui`/`ori` pair proves NOTHING about the source spelling unless it TIES the `ori` on priority, and on the pinned `-mcpu=3000` triple a dependent load never does  <sub>L20935</sub>
+- **§199-F** — §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN `mostly_true_jump > 0` (amendment to §164-36; its "−1 instruction" tell is falsified)  <sub>L20994</sub>
+- **§199-G** — At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positive + a trailing `j default`, NOT the first test's polarity  <sub>L21048</sub>
+- **§199-REJECTED** — §199-REJECTED  <sub>L21103</sub>
+- **§200** — THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P31 S55)  <sub>L21114</sub>
+- **§201** — THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered  <sub>L21163</sub>
+- **§201-A** — §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definition" is usually another overlay's function, and the card ranks it ABOVE the destination TU  <sub>L21173</sub>
+- **§201-B** — In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sign of the materialized constant is decided by an OR over the UNWIDENED operands (convert.c trunc1), which bounds §1841 to direct constant stores  <sub>L21205</sub>
+- **§201-C** — §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE INSN (the call's argument copy), AND ONE STATEMENT'S POSITION RELATIVE TO THE CALL DECIDES BOTH — the residual is visible at the BRANCH, not at the call  <sub>L21285</sub>
+- **§201-D** — THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER `get_narrower` STRIPS WIDENING CONVERSIONS — NEVER BY A PROVABLE RANGE. AN `& 0xFF` IS NOT A CONVERSION, SO IT NEVER FLIPS THE MAGIC; A DECLARED-UNSIGNED LOCAL *OR* A NARROWING CAST WRITTEN AT THE DIVIDE BOTH DO.  <sub>L21336</sub>
+- **§201-E** — §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in the printed stream; a foreign store moved between the pair in C source is a real lever, and `volatile` is not always the better one  <sub>L21383</sub>
+- **§201-REJECTED** — eight, the session's highest  <sub>L21439</sub>
+- **§202** — THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56)  <sub>L21464</sub>
+- **§203** — A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56)  <sub>L21501</sub>
+- **§204** — THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered  <sub>L21562</sub>
+- **§204-A** — A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JOIN WITH TWO INCOMING EDGES: THE TWO GUARDS ARE SEQUENTIAL `if`s, NEVER `if/else if`  <sub>L21581</sub>
+- **§204-B** — A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can cost a real `move` AND permute the whole callee-saved file  <sub>L21656</sub>
+- **§204-C** — WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S BODY, NOT ABOUT THE CALL SITE: grep the callee's proven definition and count the stores through the pointer parameter before you declare the local  <sub>L21720</sub>
+- **§204-D** — A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.field` PASSES, THE SAME READ THROUGH A POINTER LOCAL IS REFUSED  <sub>L21778</sub>
+- **§204-E** — `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of 1,210  <sub>L21853</sub>
+- **§204-CONFIRMED** — 30 reports that the index already answered  <sub>L21905</sub>
+- **§204-REJECTED** — sixteen, twice the previous record  <sub>L21999</sub>
+- **§205** — THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy that no local, no pin and no statement reorder will move (P31 S56)  <sub>L22072</sub>
+- **§206** — THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns a slot (P31 S56)  <sub>L22127</sub>
+- **§207** — THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-gap  <sub>L22196</sub>
+- **§208** — TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity owns the REGISTER SPLIT, not just the load count (P31 S58)  <sub>L22217</sub>
+- **§209** — THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND IS BYTE-WRONG (P31 S58)  <sub>L22266</sub>
+- **§210** — THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a STATEMENT-SHAPE dial, not an operator choice (P31 S58)  <sub>L22343</sub>
+- **§211** — HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips the counter/pointer register pair (P31 S58)  <sub>L22389</sub>
+- **§212** — THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one (P31 S58)  <sub>L22448</sub>
+- **§213** — INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE PERMUTATION IS NOT ALWAYS THE IDENTITY (P31 S58)  <sub>L22493</sub>
+- **§214** — THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 similarity lies (P31 S58)  <sub>L22529</sub>
+- **§215** — PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing value" is over-broad (P31 S58)  <sub>L22575</sub>
+- **§216** — DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array decl is UNUSABLE (P31 S58)  <sub>L22631</sub>
+- **§217** — DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22671</sub>
+- **§218** — A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well as on the PARAMETER (P31 S58)  <sub>L22697</sub>
+- **§219** — COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE READ-MODIFY-WRITE (P31 S58)  <sub>L22726</sub>
+- **§220** — THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and place the save-copy AFTER the first call (P31 S58)  <sub>L22753</sub>
+- **§221** — A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L22793</sub>
+- **§222** — SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys the median split, and a 2-way dispatch with a shared post-block is a `switch` (P31 S58)  <sub>L22809</sub>
+- **§223** — READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER that call's return (P31 S58)  <sub>L22851</sub>
+- **§224** — CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31 S58)  <sub>L22913</sub>
+- **§225** — THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58)  <sub>L22949</sub>
+- **§226** — FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58)  <sub>L22992</sub>
+- **§227** — TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58)  <sub>L23033</sub>
+- **§228** — READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discriminators (P31 S58)  <sub>L23053</sub>
+- **§229** — THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPOSITE FOR A REASON (P31 S58)  <sub>L23090</sub>
+- **§230** — THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which assignment was written first **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23139</sub>
+- **§231** — TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58)  <sub>L23154</sub>
+- **§232** — WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(single observation — not yet cross-confirmed)** (P31 S58)  <sub>L23195</sub>
+- **§30** — addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual with one edit  <sub>L23231</sub>
+- **§194-B** — addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A  <sub>L23251</sub>
+- **§176-B** — addendum (P31 S58) — the misdiagnosis direction  <sub>L23257</sub>
+- **§165-40** — addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects  <sub>L23263</sub>
+- **§164-63** — addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignment  <sub>L23272</sub>
+- **§193-A** — / §194-E addendum (P31 S58) — where the twin's body actually lives  <sub>L23281</sub>
+- **§233** — THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 already-covered  <sub>L23287</sub>
+- **§234** — CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S58b)  <sub>L23331</sub>
+- **§235** — THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b)  <sub>L23372</sub>
+- **§236** — THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS THE GATE (P31 S58b)  <sub>L23401</sub>
+- **§237** — THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCAPES (P31 S58b)  <sub>L23480</sub>
+- **§238** — SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b)  <sub>L23535</sub>
+- **§239** — TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPERAND ORDER (P31 S58b)  <sub>L23575</sub>
+- **§240** — `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b)  <sub>L23609</sub>
+- **§241** — THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b)  <sub>L23638</sub>
+- **§242** — `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDING CHAIN (P31 S58b)  <sub>L23667</sub>
+- **§243** — SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P31 S58b)  <sub>L23695</sub>
+- **§244** — `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC (P31 S58b)  <sub>L23725</sub>
+- **§245** — THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b)  <sub>L23760</sub>
+- **§246** — THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P31 S58b)  <sub>L23807</sub>
+- **§247** — TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b)  <sub>L23847</sub>
+- **§248** — SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS DIRECT HOME (P31 S58b)  <sub>L23881</sub>
+- **§249** — THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INSTRUCTION REAL (P31 S58b)  <sub>L23905</sub>
+- **§250** — `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 S58b)  <sub>L23947</sub>
+- **§251** — IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b)  <sub>L23984</sub>
+- **§252** — THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b)  <sub>L24006</sub>
+- **§253** — POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24027</sub>
+- **§254** — THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-confirmed)** (P31 S58b)  <sub>L24041</sub>
+- **§255** — THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b)  <sub>L24053</sub>
+- **§256** — GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS (P31 S58b)  <sub>L24088</sub>
+- **§257** — THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED  <sub>L24125</sub>
+- **§258** — ADDENDA TO EXISTING SECTIONS (P31 S58b)  <sub>L24168</sub>
+- **§30** — addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-ONE  <sub>L24173</sub>
+- **§194-B** — / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS  <sub>L24194</sub>
+- **§202** — addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT  <sub>L24217</sub>
+- **§205** — addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMISSION  <sub>L24228</sub>
+- **§208** — addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE  <sub>L24245</sub>
+- **§210** — addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL  <sub>L24274</sub>
+- **§211** — addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST  <sub>L24290</sub>
+- **§213** — addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES  <sub>L24333</sub>
+- **§214** — addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES  <sub>L24362</sub>
+- **§215** — addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS  <sub>L24398</sub>
+- **§217** — CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR  <sub>L24450</sub>
+- **§220** — addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS)  <sub>L24467</sub>
+- **§222** — addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS  <sub>L24492</sub>
+- **§223** — addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE  <sub>L24510</sub>
+- **§224** — addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR  <sub>L24534</sub>
+- **§225** — addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES  <sub>L24564</sub>
+- **§226** — addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATION ORDER  <sub>L24591</sub>
+- **§229** — addendum (P31 S58b) — NAME IT **INSIDE** THE ARM  <sub>L24636</sub>
+- **§230** — CROSS-CONFIRMED (P31 S58b)  <sub>L24647</sub>
+- **§231** — addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS  <sub>L24656</sub>
+- **§232** — CROSS-CONFIRMED (P31 S58b)  <sub>L24687</sub>
+- **§259** — THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY  <sub>L24698</sub>
+- **§260** — THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S59, byte-proven)  <sub>L24737</sub>
+- **§260-A** — STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day)  <sub>L24787</sub>
+- **§261** — THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59)  <sub>L24823</sub>
+- **§261a** — THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-proven)  <sub>L24849</sub>
+- **§262** — A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59)  <sub>L24871</sub>
+- **§263** — A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCHEDULE (P31 S59, byte-proven)  <sub>L24901</sub>
+- **§264** — FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59)  <sub>L24942</sub>
+- **§265** — THE VERBATIM-ASM BANK LANE: A FUNCTION NO -O2 C CAN EVER MATCH BANKS AS A RAW `__asm__` BODY (P31 S59b; two banked cards, two in-tree precedents)  <sub>L24992</sub>
+- **§266** — THE INERT-RIDER LAW: A LEVER IS ONLY CITABLE WHEN ITS SOLO REMOVAL BREAKS THE MATCH (P31 S59b; measured 4-of-8 on this batch)  <sub>L25054</sub>
+- **§267** — ADDENDA HARVESTED FROM WAVES at/bh/bk/bl (P31 S59b)  <sub>L25094</sub>
+- **ADD-1** — → §231 addendum (also cross-ref from §195-D) — THE MASKED-`jal` "MISSING CALL" ILLUSION  <sub>L25102</sub>
+- **ADD-2** — → §42a addendum — A SHARED CONSTANT *NAMED IN A LOCAL* ACROSS A `jal` IS AN ISO→TU DRIFT HAZARD; WRITE BARE LITERALS  <sub>L25111</sub>
+- **ADD-3** — → §236, item 10 — THE UN-DELETED `INCLUDE_ASM` STUB IS A DUPLICATE DEFINITION  <sub>L25123</sub>
+- **ADD-4** — → §225-3/-4 addendum — THE MIRROR ROW: VALUE-RETURN IN THE *TAKEN* ARM + TRAILING BARE `return 0`  <sub>L25133</sub>
+- **ADD-5** — → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TRAILING `else`  <sub>L25147</sub>
+- **ADD-6** — → §172b-1 / §264 addendum — SHIFT-AS-TEST: `(x << 16) != 0` TESTS THE LOW HALF WITHOUT TRUNCATING THE PSEUDO  <sub>L25156</sub>
+- **ADD-7** — → §256 addendum — THE SINGLE-GUARD GOTO: THEN-BLOCK OUT OF LINE AT THE TAIL  <sub>L25165</sub>
+- **ADD-8** — → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6)  <sub>L25177</sub>
+- **ADD-9** — → §213-3 / §217 addendum — ADJACENT PRE-CALL FRAME STORES ARE ONE AGGREGATE; THE UNESCAPED SCALAR NEIGHBOR IS DEAD-STORED  <sub>L25189</sub>
+- **ADD-10** — → §237 addendum (arity-evidence paragraph) — AN `la` PAIR ABOVE THE PROLOGUE `sw $ra` IS AN OUTGOING-ARGUMENT MATERIALISATION  <sub>L25199</sub>
+- **ADD-11** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25208</sub>
+- **§268** — A `register __asm__` PIN ON A CALL-CLOBBERED REGISTER IS HONORED EXACTLY WHEN THE PINNED RANGE CROSSES NO CALL (P31 S59c; three A/B'd cards, unifying §257-2's two)  <sub>L25259</sub>
+- **§269** — ADDENDA HARVESTED FROM WAVES ax/bm (P31 S59c)  <sub>L25313</sub>
+- **ADD-1** — → §257-8 addendum — THE INTERPOSED ASM'S `__volatile__` IS A PER-SHAPE DIAL, AND THE "NO-OUTPUT ASM IS IMPLICITLY VOLATILE" LORE IS BYTE-FALSE IN gcc-2.7.2  <sub>L25328</sub>
+- **ADD-2** — → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HAS NO SPELLING, UNPROTOTYPED `()` BEATS THE FLEET VOTE  <sub>L25341</sub>
+- **ADD-3** — → §238 addendum — TWO BINARIES CAN EACH DEFINE THE SAME `func_` NAME WITH DIFFERENT BYTES, AND NO GENERATED REPORT SHOWS IT  <sub>L25355</sub>
+- **ADD-4** — → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAME IT **AND** STORE **INSIDE** THE ARM  <sub>L25368</sub>
+- **ADD-5** — → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON THE SHIFTED COPY, RAW STAYS LIVE — AND THE HALFWORD-ABS SHAPE NEEDS NO RITUAL  <sub>L25385</sub>
+- **ADD-6** — → §220-addendum — THE FOURTH FACE: WHEN THE NAMED COPY ITSELF BUYS THE EXTRA CALLEE-SAVED, PIN THE COPY TO `$16`  <sub>L25401</sub>
+- **ADD-7** — → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE POSITION; NAME IT TO PIN THE PROLOGUE INIT ORDER  <sub>L25417</sub>
+- **ADD-8** — → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST-PLUS GIVES SERIALIZATION *AND* DISPLACEMENT FOLDING  <sub>L25430</sub>
+- **ADD-9** — → §255 "AND CASE-BODY PLACEMENT" bound / §222-addendum-3 — ON A LARGE SPARSE TREE, BODIES FOLLOW **SOURCE** ORDER (measured by a one-word probe)  <sub>L25445</sub>
+- **ADD-10** — → Cross-confirmation card block (per §259's standing instruction: confirmation, not news)  <sub>L25459</sub>
+- **§3-1a.** — The §266 sweep — every solo-lever A/B run for this batch  <sub>L25500</sub>
+- **§270** — The A-prop 0-bank anatomy: a byte-correct body still needs FOUR layers to agree (P31 S59)  <sub>L25533</sub>
+- **§271** — Ordinal IMM pairing: text order is NOT emission order; emit CANDIDATES, let the oracle pick (P31 S59)  <sub>L25551</sub>
+- **§272** — The `(void)`-decl + empty-call wall: K&R the DEFINITION, not just the decls (P31 S59)  <sub>L25573</sub>
+- **§273** — A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59)  <sub>L25593</sub>
+- **§274** — ADDENDA HARVESTED FROM 18 WAVES (P31 S60): 315 candidates, 255 already covered, 21 sharpenings, 3 new laws  <sub>L25608</sub>
+- **ADDENDUM** — to §179-C — the `.type NAME, @function` requirement  <sub>L25614</sub>
+- **ADDENDUM** — to §134 — a typedef defined BELOW the splice point is stripped anyway  <sub>L25661</sub>
+- **ADDENDUM** — to §179-D (GTE macro reference family) — `gte_SetRotMatrix`/`gte_SetTransMatrix` bodies  <sub>L25691</sub>
+- **ADDENDUM** — to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save  <sub>L25717</sub>
+- **ADDENDUM** — to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads the wrong register"  <sub>L25755</sub>
+- **ADDENDUM** — to §20 — a global declared as `T *` may itself BE the array base, not a pointer to dereference  <sub>L25794</sub>
+- **ADDENDUM** — to §1-I5  <sub>L25823</sub>
+- **ADDENDUM** — to §164-51  <sub>L25888</sub>
+- **ADDENDUM** — to §176-F5  <sub>L25904</sub>
+- **ADDENDUM** — to §225  <sub>L25933</sub>
+- **ADDENDUM** — to §224 — CROSS-JUMP: THE DUPLICATE CAN BE A PLAIN STORE, NOT ONLY A CALL  <sub>L25978</sub>
+- **ADDENDUM** — to §164-64 — AN EMPTY CLOBBER ON AN ARGUMENT REGISTER CAN BE THE DELIBERATE FIX, NOT JUST THE ACCIDENTAL BUG  <sub>L26012</sub>
+- **ADDENDUM** — to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTER-OFFSET FIELD  <sub>L26043</sub>
+- **ADDENDUM** — to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECLARED TYPE, AND MOVE THE CAST INTO THE LOOP BODY  <sub>L26074</sub>
+- **ADDENDUM** — to §229 — A POINTER'S NUMBER OF USES DECIDES WHETHER ITS ADDRESS FOLDS OR SURVIVES A CALL  <sub>L26121</sub>
+- **ADDENDUM** — to §172b-4 — THE PLAIN CAST-DIVISION ALREADY PRODUCES THE PATTERN; DON'T HAND-ROLL THE BIAS, AND KEEP THE OPERAND WIDE  <sub>L26166</sub>
+- **ADDENDUM** — to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT AS A FILE-SCOPE `__asm__` BLOB  <sub>L26196</sub>
+- **ADDENDUM** — to §226 — A DEAD LOCAL SCOPED TO A NESTED BLOCK BUYS A MID-FUNCTION `addiu sp` PAIR, NOT A FRAME-SIZE CHANGE  <sub>L26239</sub>
+- **ADDENDUM** — to §172a — RE-READING MEMORY (NOT NAMING A TEMP) IS WHAT KEEPS AN INCREMENT'S DELAY-SLOT FILL ALIVE  <sub>L26278</sub>
+- **ADDENDUM** — to §225 / §256 — A GOTO TO A SHARED SET-POINT PREVENTS IF-CONVERSION FROM COLLAPSING A LATER BRANCH TEST  <sub>L26309</sub>
+- **ADDENDUM** — to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIALISES ITS CONSTANT AFTER EVERY CALL  <sub>L26351</sub>
+- **§275** — THE LEFTOVER-REGISTER READ  <sub>L26386</sub>
+- **§276** — MIXED ADDRESS-EXPRESSION SPELLING FOR ADJACENT RELOCATABLE SYMBOLS IS A CSE-UNIFICATION DIAL, NOT JUST A BYTE-ENCODING CHOICE (P31 S60; `func_80180FE8`, ov_SC06_006, byte-proven)  <sub>L26426</sub>
+- **§277** — RETURN-TAIL C SPELLING PICKS THE DELAY-SLOT-FILL vs TRAILING-MOVE TOPOLOGY, AND A NARROWER SECOND VARIABLE KEEPS TWO PSEUDOS INSTEAD OF ONE (P31 S60; `func_801846F0` ov_SC03_104, `func_801A44C4` md_SC07_004, both byte-proven)  <sub>L26535</sub>
+- **§278** — ADDENDA HARVESTED FROM WAVE cf (P31 S60): 34 candidates, 13 already covered, 8 sharpenings, 4 new laws  <sub>L26599</sub>
+- **ADDENDUM** — to §74 (func_800D0E30, resident)  <sub>L26607</sub>
+- **ADDENDUM** — to §172b-4 (func_80185054, ov_SC03_097)  <sub>L26643</sub>
+- **ADDENDUM** — to §265 (func_8017DC80, ov_SC07_002)  <sub>L26681</sub>
+- **ADDENDUM** — to §17 (func_800CB794, md_MAIN_036)  <sub>L26720</sub>
+- **ADDENDUM** — to §162p (func_8017C120, ov_MAIN_012)  <sub>L26768</sub>
+- **ADDENDUM** — to §20 (~L1947) (func_80186AD0, ov_SC06_032)  <sub>L26802</sub>
+- **ADDENDUM** — to §164-56 (func_8017F644, ov_SC04_005)  <sub>L26832</sub>
+- **ADDENDUM** — to §237 (func_8017F7FC, ov_SC03_092)  <sub>L26867</sub>
+- **§279** — A `do/while (p < end)` LOOP UNDER AN ENTRY GUARD: the guard decides the compare, not the loop (P31 S60; wave cf, func_8017F2A4, ov_SC03_096, byte-proven)  <sub>L26896</sub>
+- **§NNN** — A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: THE REPETITION IS WHAT BUYS THE CSE'D COPY INTO A SECOND REGISTER (P31 S60; `func_8017F2A4`, ov_SC03_096, byte-proven 25/25)  <sub>L26897</sub>
+- **§280** — THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, an integer cursor is signed (P31 S60; wave cf, func_800CAE74, md_MAIN_031, byte-proven)  <sub>L26930</sub>
+- **§NNN** — A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TEST, INDEPENDENT OF THE VALUES INVOLVED (P31 S60; `func_800CAE74`, md_MAIN_031, byte-proven; cross-confirmed same wave by `func_8017F2A4`, ov_SC03_096)  <sub>L26931</sub>
+- **§281** — GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, the source must not (P31 S60; wave cf, func_80180FB4, ov_SC03_111, byte-proven)  <sub>L26964</sub>
+- **§NNN** — A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AND SCHED1 DOES THE INTERLEAVING (P31 S60; `func_80180FB4`, ov_SC03_111, byte-proven)  <sub>L26965</sub>
+- **§282** — gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no hand-written down-count can reach (P31 S60; wave cf, func_80180DD8, ov_SC04_005, byte-proven)  <sub>L27010</sub>
+- **§NNN** — WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS AFTER HOISTED MOVABLES, WHICH A HAND-WRITTEN DOWN-COUNT LOOP CANNOT REPRODUCE (P31 S60; `func_80180DD8`, ov_SC04_005, byte-proven)  <sub>L27011</sub>
+- **What** — I could not verify  <sub>L27048</sub>
+- **§283** — ADDENDA HARVESTED FROM THE 36-WAVE BATCH (P31 S60): 1,216 candidates, 859 already covered, 46 sharpenings, 9 new laws  <sub>L27095</sub>
+- **ADDENDUM** — to §164-75 — the fold-reassociation law also fires at a variable's INITIALIZER, not only a later expression  <sub>L27105</sub>
+- **ADDENDUM** — to §21 — the `bltz`+`slti` (or N-separate-compares) signed-range-split bullet is now CONFIRMED on three independent functions, and generalizes beyond `lbu`/u8  <sub>L27131</sub>
+- **ADDENDUM** — to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not only a function-vs-function prototype clash  <sub>L27177</sub>
+- **ADDENDUM** — to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, same-address double RMW, a plain memory clobber beats `volatile`, and `volatile` actively breaks a delay-slot fill  <sub>L27200</sub>
+- **ADDENDUM** — to §195-E — a goto-ladder's STORES must sit AT the labels, after the gotos, not inline before them  <sub>L27219</sub>
+- **ADDENDUM** — to §195-N — a GNU statement-expression slider must sit INSIDE the conditional arm's value position, not as a post-hoc barrier, to block the store-flag transform on a ternary chain  <sub>L27281</sub>
+- **ADDENDUM** — to §176-B2 — in a micro-function with no long/short lifetime asymmetry, BOTH contending pseudos need their own hard-register pin  <sub>L27338</sub>
+- **ADDENDUM** — to §199-G — A `default:` LABEL GROUPED ONTO THE LAST CASE REMOVES THE `j default` TAIL, EVEN THOUGH THE 2-NODE HEADER STAYS ALL-POSITIVE  <sub>L27385</sub>
+- **ADDENDUM** — to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SAVED SPILL LAND IN THE FIRST CALL'S OWN DELAY SLOT  <sub>L27454</sub>
+- **ADDENDUM** — to §252 — a `>=0`/`<0` split on an unconditionally-decremented value needs the POSTFIX operator INSIDE the branch condition, not a prior statement  <sub>L27512</sub>
+- **ADDENDUM** — to §215 — FIFTH SHAPE: reused mask constants across two call-free merge sites each get their own whole-function hard-register pin, and a shared sub-expression at the second site must be its own statement  <sub>L27539</sub>
+- **What** — I could not verify  <sub>L27622</sub>
+- **Harness-defect** — flags  <sub>L27693</sub>
+- **ADDENDUM** — to §167-40 (func_8017E2CC, ov_SC04_015 — wave dg)  <sub>L27786</sub>
+- **ADDENDUM** — to §20's cross-jump EXPLOIT bullet (func_8017E360, ov_SC05_007 — wave dg)  <sub>L27806</sub>
+- **ADDENDUM** — to §87 (func_801815F4 ov_SC06_032; corroborating func_801840DC ov_SC05_017, func_80189C68 ov_SC03_006 — wave dg)  <sub>L27820</sub>
+- **ADDENDUM** — to §153 / §236-5 (func_801A419C, md_SC07_003 — waves di and dl, corroborating; refutes a contradicted dj-wave card)  <sub>L27839</sub>
+- **ADDENDUM** — to §263 (func_801E83AC, md_SC04_029 — wave dj)  <sub>L27859</sub>
+- **ADDENDUM** — to §265 (func_8017D878, ov_SC03_107 — wave dj; corroborated by a REJECTED, contradicted card in wave dm — see closing)  <sub>L27873</sub>
+- **ADDENDUM** — to §6 (func_801811F0, ov_SC03_102 — waves dj and dl, corroborated by a self-reported "nothing new" dm-wave card)  <sub>L27887</sub>
+- **ADDENDUM** — to §195-G (func_80183BB0, ov_SC05_001 — wave dj)  <sub>L27901</sub>
+- **ADDENDUM** — to the zero-byte-asm-slider family (§47 / §148-C / §153) (func_800CB874, md_MAIN_040 — wave dj; open tension with a more cautious dm-wave card — see closing)  <sub>L27929</sub>
+- **ADDENDUM** — to §194-B (func_8017EB34, ov_SC03_117 — wave dk; distinct from the §74 co-pinning finding on the SAME function below)  <sub>L27947</sub>
+- **ADDENDUM** — to §74 (func_8017EB34, ov_SC03_117 — counter/clamp variant; wave dj, corroborated by dk/dl/dm cards on the same function)  <sub>L27979</sub>
+- **ADDENDUM** — §37 — merged into the §153/§236-5 entry above (func_801A419C, wave dl)  <sub>L27999</sub>
+- **ADDENDUM** — §6 — merged into the §6 entry above (func_801811F0, wave dl)  <sub>L28007</sub>
+- **ADDENDUM** — to §238 (func_80182CB4, ov_SC02_000 — wave dl)  <sub>L28015</sub>
+- **ADDENDUM** — to §137a (func_801684B4, ov_MAIN_012; corroborated independently by func_80189E68, func_8017FF9C, func_801822B4, func_8018DA8C — wave dl)  <sub>L28033</sub>
+- **ADDENDUM** — to §8c / §88d (func_8016AB6C, ov_MAIN_012 — wave dm)  <sub>L28049</sub>
+- **ADDENDUM** — to §73 / §30#2 (func_800D1984, resident — wave dm)  <sub>L28063</sub>
+- **What** — I could not verify  <sub>L28079</sub>
+- **ADDENDUM** — to §174 Law 4 (func_8017E9A8, ov_SC06_015)  <sub>L28099</sub>
+- **ADDENDUM** — the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_800CB900, md_MAIN_026)  <sub>L28139</sub>
+- **From** — ck + cl + cm  <sub>L28191</sub>
+- **ADDENDUM** — §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE A SWITCH DISPATCH CAN BE PLAIN NESTED `if`s WHOSE SHARED BODY WAS TRIPLICATED BY THE SOURCE AND THEN CROSS-JUMP-MERGED BACK DOWN  <sub>L28197</sub>
+- **ADDENDUM** — §NNN — sharpens §167-13's boundary: CHAINING TWO IDENTICAL SIDE-BY-SIDE STORES INTO ONE C ASSIGNMENT STATEMENT IS A MID-BLOCK SCHEDULING-PRIORITY DIAL, NOT ONLY A STORE-ORDER SPELLING  <sub>L28234</sub>
+- **ADDENDUM** — §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED HALFWORD IS A SIGNED-TEMP WIDTH TELL OUTSIDE ANY SWITCH/RANGE-TEST CONTEXT  <sub>L28267</sub>
+- **ADDENDUM** — §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWER BOUND FROM ITS OWN `.s` STACK-ARGUMENT READS, NOT FROM ANY SINGLE CALL SITE  <sub>L28300</sub>
+- **ADDENDUM** — to §5a (func_80181F74, ov_SC03_112, wave cn)  <sub>L28333</sub>
+- **ADDENDUM** — to §265 (func_8017E26C, ov_SC04_016, wave cn)  <sub>L28383</sub>
+- **ADDENDUM** — to §42b (func_8018247C, ov_SC07_002, waves cu + cw)  <sub>L28421</sub>
+- **ADDENDUM** — to §199-F family (func_8017EFB0, ov_SC02_021, wave cu)  <sub>L28452</sub>
+- **ADDENDUM** — to §195-E (func_800CFC1C, md_MAIN_003, wave cv)  <sub>L28507</sub>
+- **ADDENDUM** — to §215 addendum (func_800CB2C8, md_MAIN_033, waves cv + cw)  <sub>L28552</sub>
+- **ADDENDUM** — to §236 item 4 (func_8017D268, ov_SC04_006, wave cw)  <sub>L28608</sub>
+- **What** — I could not verify  <sub>L28637</sub>
+- **Harness-defect** — flags (not idioms — flagged for the operator)  <sub>L28669</sub>
+- **ADDENDUM** — to §250 (func_8017D7CC, ov_SC03_115 — cx/cy/cz/dr)  <sub>L28710</sub>
+- **ADDENDUM** — to §225 (func_8017E190, ov_SC03_115 — cx/cy/cz)  <sub>L28755</sub>
+- **ADDENDUM** — to §45-A (func_8017F6A4, ov_SC02_016 — cy/cz)  <sub>L28808</sub>
+- **ADDENDUM** — to §249 (func_80182ED4, ov_SC04_004 — dp/dr/dt)  <sub>L28852</sub>
+- **ADDENDUM** — to §199-A (func_801816FC, ov_SC02_005 — dp/dr/dt)  <sub>L28897</sub>
+- **What** — I could not verify  <sub>L28943</sub>
+- **Harness-defect** — flags  <sub>L28986</sub>
+- **§284** — COMBINE CAN REASSOCIATE TWO SEQUENTIAL BITWISE-AND MASKS INTO ONE AGAINST THE PRE-MASK VALUE; AN ASM IN/OUT FENCE RIGHT AFTER THE FIRST MASK BLOCKS IT (P31, wave dd, `func_8018087C`, ov_SC04_020, byte-proven) (P31 S60; waves #, byte-proven)  <sub>L29048</sub>
+- **§285** — PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE FOLLOWING if/else DESTRUCTIVELY REUSE THE SAME DESTINATION REGISTER FOR THEIR BITWISE RESULT (byte-proven; `func_801811F0`, ov_SC03_102, independently rediscovered across waves di/dj) (P31 S60; waves #, byte-proven)  <sub>L29052</sub>
+- **§286** — FOLD A STATEMENT'S SIDE EFFECT INTO A COMMA-EXPRESSION IN AN ARGUMENT POSITION TO PLACE ITS RTL RELATIVE TO A CALL'S OWN DELAY SLOT (P31 S60/dj; `func_80180A88`, ov_SC06_010, byte-proven 411/411) (P31 S60; waves #, byte-proven)  <sub>L29056</sub>
+- **§287** — A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE COMBINED STRUCT, NOT SEPARATE LOCALS OR A REGISTER PIN (P31 S60/dj; `func_8017D104`, ov_SC06_027, byte-proven 47/47) (P31 S60; waves #, byte-proven)  <sub>L29060</sub>
+- **§288** — A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES THE FIXED REGISTER'S SAVE/RESTORE, AND THE ASSIGNMENT'S SOURCE POSITION CONTROLS WHERE THE VALUE MATERIALIZES (P31; `func_80186530`, ov_SC02_017, byte-proven, match_one MATCH re-verified) (P31 S60; waves #, byte-proven)  <sub>L29064</sub>
+- **§289** — an array local's address-taken base keeps every element's store alive, even though only one pointer escapes (`func_80189EFC`, ov_SC04_011) (P31 S60; waves #, byte-proven)  <sub>L29068</sub>
+- **§290** — A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EACH KEEPING ITS OWN `%hi`/`%lo` ANCHOR (P31 S60; waves #, byte-proven)  <sub>L29072</sub>
+- **§291** — THE DELAY-SLOT FALSE-VALUE: A CONDITIONAL BRANCH'S ZERO ARM MUST BE A FALL-THROUGH-ADJACENT BLOCK ENDING IN AN EXPLICIT JUMP, OR REORG CANNOT MATERIALIZE IT INSIDE THE BRANCH'S OWN DELAY SLOT (P31 S60; waves #, byte-proven)  <sub>L29076</sub>
+- **§292** — DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPLICIT (K&R) DECLARATION CAN SILENTLY REPROTOTYPE THE SIBLING'S OWN CALL SITE (P31 S60; waves #, byte-proven)  <sub>L29080</sub>
+- **§293** — THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND THE LOAD-BEARING ONE IS "THE BASELINE, NOT THE SIBLINGS" (P31 S61; byte-proven on 15 binaries in one night)  <sub>L29083</sub>
+- **§294** — ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2): 99 candidates, 52 covered, 15 notes → 10 addenda, 29 notes → 5 new laws (§295–§299), 3 refuted  <sub>L29133</sub>
+- **ADDENDUM** — to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the index being constant  <sub>L29144</sub>
+- **ADDENDUM** — to §261a — FOUR MORE -O0 DIALS BEYOND THE RELOAD COUNT (boot.c + md_MAIN_011/003, wave m0a/g0a/g0f, byte-proven)  <sub>L29172</sub>
+- **ADDENDUM** — to §264-3 — the explicit entry copy's BOUND: required exactly when the RAW value must outlive the call that consumes only the PROMOTED value  <sub>L29222</sub>
+- **ADDENDUM** — to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator  <sub>L29242</sub>
+- **ADDENDUM** — to §276 — the SHARE direction: spell the second adjacent symbol RELATIVE to force ONE anchor  <sub>L29254</sub>
+- **ADDENDUM** — to §31's density-dummy dial (L2460/L2497) — the dose is TWO refs, and the dummy must sit where the loser is live-through  <sub>L29270</sub>
+- **ADDENDUM** — to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction births the induction register at loop.c's own insertion point  <sub>L29287</sub>
+- **ADDENDUM** — to §253 — SECOND byte-proven card (upgrade from single-observation), and the placement face: postfix-in-condition parks the RMW store in the branch delay slot  <sub>L29310</sub>
+- **ADDENDUM** — to the L1800 anchor-steer bullet — a DERIVED-POINTER local silently flips the merged giv's anchor END  <sub>L29331</sub>
+- **ADDENDUM** — to §31's asm→layout inference — TWO WIDTH-PAIR DISCRIMINATORS (same offset, different widths)  <sub>L29354</sub>
+- **§295** — THE KERNEL-TRAP STUB: §81's jr-DETECTOR WITHOUT A TABLE IS A PsyQ SYSCALL TRAMPOLINE — ROUTE TO §265, NEVER INTO THE CARVE CHAIN (P31 S61; wave m0a, 9 cards byte-proven; resolves §182's held cluster)  <sub>L29375</sub>
+- **§296** — THE FRAME CHECK OUTRANKS THE ATLAS LEVER: READ PROLOGUE/EPILOGUE BEFORE DRAFTING ANY C — A REAL TELL CAN LIVE INSIDE AN UNREACHABLE FRAGMENT (P31 S61; wave m0a, 16 cards byte-proven; extends §179-C)  <sub>L29430</sub>
+- **§297** — ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX SPELLINGS RE-SPLIT THE PSEUDO (P31 S61; wave m0a, `func_800347C8`, main, byte-proven 31/31)  <sub>L29473</sub>
+- **§298** — THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUPLICATED STATEMENTS, NOT A HOISTED POST-SWITCH STATEMENT (P31 S61; waves g0e/g0f, `func_80181B68`, ov_SC06_016, byte-proven 68/68)  <sub>L29516</sub>
+- **§299** — TWO INDEPENDENT EXTRACTION CHAINS EMIT CONTIGUOUSLY INSIDE ONE EXPRESSION; ONLY A STATEMENT BOUNDARY MAKES THE SCHEDULER INTERLEAVE THEM (P31 S61; wave m0a, `func_8003A404`, main, byte-proven 8/8)  <sub>L29541</sub>
+- **§300** — S61 DISTILL BATCH NOTES (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2 · m0b)  <sub>L29576</sub>
+- **§301** — AN INTERNAL `j` CARRIES `R_MIPS_26 .text`: rtu/match_one "MATCH" COULD NOT SEE WHICH LABEL A `j` TAKES — FIXED (`jrel`), AND THE TWO DRAFT SHAPES IT HID (P31 S62 T1; byte-proven 2/2, negative-controlled over 3,297 stubs)  <sub>L29645</sub>
+- **§302** — A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO DERIVE EACH FROM THE BYTES (P31 S62 T2; five reds healed in one session, 5/5, +39 held banks)  <sub>L29693</sub>
+- **§303** — MODULE ISLAND TABLES: DERIVE THE PADS AT BUILD TIME, PEEL NOTHING — THE §154-A/§260 "island-pads"/"island-blocked" WALLS DISSOLVE (P31 S62 T3a; byte-proven md_SC03_076 func_801F0A9C + func_801F0F28, sha 9a165e36…)  <sub>L29737</sub>
+- **§304** — SELF-DEFINING RODATA: WHEN A FUNCTION'S `.s` IS THE ONLY OWNER OF THE DATA IT REFERENCES, THE C BODY MUST DEFINE IT (P31 S62 T3; byte-proven md_MAIN_011/func_800D04F4)  <sub>L29773</sub>
+- **§305** — "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE (P31 S62 T3; 28 resolver drafts autopsied 28/28)  <sub>L29796</sub>
+- **§306** — A HAZARD `nop` IN FRONT OF A DIV-RESULT STORE IS A STATEMENT-ORDER DEFECT: THE INDEPENDENT TRAILING STATEMENT MUST BE WRITTEN *BEFORE* THE DIVISION-CONSUMING ONE (P31 S62 T4; byte-proven func_8017E7D0)  <sub>L29848</sub>
+- **§306a** — T4 DISTILL ADDENDA (P31 S62; four byte-proven refinements to existing laws, verified against the book by an independent verifier; each names its parent §)  <sub>L29875</sub>
+- **§307** — THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHEDULER-INTERNAL, AND NO SOURCE ORDER REACHES IT (P31 S63; byte-evidenced NEGATIVE result, main wave)  <sub>L29913</sub>
+- **§308** — A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if` SO cse FOLDS IT TO AN UNCONDITIONAL JUMP *AFTER* jump1's WINDOW HAS CLOSED (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29957</sub>
+- **§308a** — A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j` SURVIVES ONLY BEHIND A SHORT-CIRCUIT `&&` GUARD PLUS A SEPARATE RE-TEST; EVERY PLAIN if/else-if, GOTO-LADDER, NESTED-INVERTED-if AND 1-/2-NODE switch LETS jump1 INLINE IT (−2 ins) (P31 S63 t5e-t5i; byte-proven func_80180808)  <sub>L29986</sub>
+- **§309** — A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD ONTO `$sp` UNLESS THE `if` SURVIVES jump1 AS A BARRIER-PRECEDED DIAMOND (P31 S63 t5e-t5i; byte-proven func_801812AC)  <sub>L30020</sub>
+- **§310** — A TWO-OPERAND `subu`'s DESTINATION TIES ONLY TO THE OPERAND THAT IS BLOCK-LOCAL: SHARE *ONE* SIDE ACROSS BLOCKS TO CHOOSE WHICH OPERAND'S REGISTER IT LANDS IN (P31 S64 t5j-t5m; byte-proven func_8017F578)  <sub>L30060</sub>
+- **§311** — A JOIN-BLOCK STORE CAN SWALLOW AN ARM'S LOAD-DELAY `nop`: WHEN ONE ARM'S VALUE COMES FROM A LOAD, DUPLICATE THE STORE INTO BOTH ARMS (P31 S64 t5j-t5m; byte-proven func_8017D7E0)  <sub>L30091</sub>
+- **§312** — A BARE RELATIONAL IN AN `if` GIVES THE `slt` NO TARGET: ASSIGN THE COMPARISON INTO THE ALREADY-ALLOCATED VARIABLE TO CHOOSE ITS DESTINATION REGISTER, AT ZERO INSTRUCTION COST (P31 S64 t5o-t5r; byte-proven func_80180DCC)  <sub>L30133</sub>
 
 
 ---
@@ -2439,810 +2443,811 @@ Notes routinely quote that as a section id. This table resolves it. Grep bait: `
 | L2676 | §40c | The h_seq per-sibling reconcile: templating a reconcile-class crack ×134 (Phase 26 Task 8, |
 | L2693 | §31-triage | R17 applies to CODEGEN residuals, never to a compile ERROR (Phase 26 session 7, Drew asked |
 | L2710 | §41 | The DEF-SIDE canonical-sig wall: mechanically banking a drafted giant past `conflicting ty |
-| L2754 | §41a | v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that d |
-| L2809 | §41b | T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase |
-| L2839 | §41c | T7-M2: the ×134 def-side-wall sweep via per-sibling RE-reconcile (Phase 25, 2026-07-10; 4, |
-| L2858 | §41b | addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25  |
-| L2878 | §41d | `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byt |
-| L2900 | §42 | The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 2 |
-| L2953 | §42a | addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-a |
-| L2994 | §42b | addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cas |
-| L3033 | §42c | addendum — wave 3 (Max orchestrator + CORRECTED Ultracode fan-out, 2026-07-10c): the real- |
-| L3082 | §42d | addendum — wave 4 (rtu_match fan-out over the mapped frontier, 2026-07-10c): 24/26 MATCH,  |
-| L3121 | §42e | propagating a CRACK ×134: the def-finder bug + the byte-drift residual (the "remap-fail" m |
-| L3195 | §43 | The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args  |
-| L3242 | §44 | The Phase-25 cheap-Opus giant batch: 5 structural levers + the §43 extension (2026-07-11,  |
-| L3298 | §45 | The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker |
-| L3313 | §46 | The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTU |
-| L3365 | §47 | The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm ( |
-| L3405 | §48 | The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, |
-| L3413 | §3-A. | ALLOCNO-PRICING DIALS — move a value into the register you want, byte-neutrally |
-| L3444 | §3-A4 | SINK THE CONSUMER CALL INTO THE ARMS (the inverse of A1; `func_8016AB6C`, byte-proven) |
-| L3468 | §3-B. | THE EBB RULE — the general form of §46-L2 |
-| L3484 | §3-C. | TYPE- AND SHAPE-DRIVEN CODEGEN (the C type literally selects the addressing mode) |
-| L3508 | §3-D. | THE CROSS-JUMP RATCHET (the sharpest new trap — `func_80131340` L-C) |
-| L3518 | §3-E. | Meta |
-| L3527 | §49 | The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` |
-| L3576 | §50 | Refinements that BOUND §47/§48 (from the `func_80135EB0` wall, 21→6; Phase 26 session 8) |
-| L3630 | §51 | TOOLING INTEGRITY: the silent skip, and how to hunt it |
-| L3636 | §51a | The bug class |
-| L3652 | §51b | Why the byte-gate cannot save you |
-| L3662 | §51c | THE METHOD (do not audit by reading the regex) |
-| L3677 | §51d | THE LAWS |
-| L3739 | §51e | The false-wall pipeline (why this is not just hygiene) |
-| L3755 | §51f | Checklist for any new corpus-scanning tool |
-| L3769 | §51g | When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`) |
-| L3913 | §52 | The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wal |
-| L3924 | §3-The | 6 levers (the "walker-family skeleton" — apply to the 12 siblings; levers 1-5 retire ~half |
-| L3945 | §3-Why | the wall is (probably) intrinsic |
-| L3959 | §52a | The regalloc sibling wave: new levers + two new wall classes (cheap-Opus applying §52, 202 |
-| L3997 | §52b | Sibling wave 2: more de-pin levers, a third wall class, and the match_one→whole-binary gap |
-| L4028 | §53 | SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it |
-| L4033 | §3-The | case |
-| L4045 | §3-Why | 0/8 was structural, and predictable from two words |
-| L4062 | §3-The | rule |
-| L4078 | §3-The | meta-lesson (R35, and why this one is expensive) |
-| L4093 | §55 | Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, |
-| L4098 | §55a | New byte-proven levers (each from a banked or near draft) |
-| L4122 | §55b | THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost) |
-| L4141 | §55c | Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TR |
-| L4163 | §54 | `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-poo |
-| L4187 | §56 | Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls,  |
-| L4232 | §56b | PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft' |
-| L4256 | §57 | The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (t |
-| L4303 | §57a | Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026 |
-| L4343 | §58 | match_one MATCH ≠ BANK: the four blind spots + the crack-wave reconcile-before-bank law (P |
-| L4377 | §59 | Three h_seq sweep-residual classes match_one/the-exemplar-bank don't reveal (Phase 29 crac |
-| L4407 | §60 | Classify the residual, don't rank it: the deterministic residual→class classifier and what |
-| L4431 | What | it measured — the whole open backlog, byte-grounded |
-| L4450 | §3-Two | corollaries worth remembering |
-| L4463 | §3-The | parallel-probe race this surfaced |
-| L4472 | §60a | What the first DIRECTED grinder run exposed (Phase 29 Task-13B, 2026-07-21) |
-| L4510 | §60b | The plateau autopsy's verdict: a `partial` drift is a WRONG DRAFT, not a missing transform |
-| L4545 | §61 | Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draf |
-| L4606 | §61a | The Task-5 wave: 11/12 MATCH, 0 banked — three DISTINCT integration walls, each now named  |
-| L4658 | §61b | The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 202 |
-| L4713 | §61c | The jtbl bank is INCREMENTALLY valid and CLEAN-INVALID (Phase 29, 2026-07-21) — the blocki |
-| L4779 | §61d | The undo was eating the tree: two tools, one defect, invisible to the byte-gate (Phase 29, |
-| L4833 | §62 | The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_ve |
-| L4877 | §63 | The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`,  |
-| L4908 | §64 | The §20 type-lift's three laws: fold the tagged typedef, check VISIBILITY, and strip only  |
-| L4957 | §64a | VARIANT types: UNIQUIFY the camps, do not reconcile them (`uniquify_type.py`, Phase 29 SES |
-| L5000 | §63 | UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST  |
-| L5015 | §65 | The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refu |
-| L5030 | §65a | The blast-radius taxonomy (makes §61's law structural instead of remembered) |
-| L5045 | §65b | The escape: de-macroize the instantiation, don't touch the shared header |
-| L5081 | §65c | `rtu_match` MATCH → bank held 13/13 on self-decl, but broke on the FIRST callee-decl case |
-| L5091 | §65d | Existing-ladder baseline, measured (do this before building a recovery stage) |
-| L5101 | §65e | Two oracles, and the disagreement is the finding (R34 in practice) |
-| L5118 | §65f | The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is w |
-| L5139 | §65g | Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield |
-| L5159 | §66 | Exercise a banking driver's SUCCESS path before pointing it at a wave: the free re-bank te |
-| L5181 | §66a | The widest write in a pipeline is the one most likely to be UNDECLARED |
-| L5200 | §66b | A metric parsed out of another tool's prose goes NULL silently when the label changes |
-| L5217 | §66c | Before a wave, verify the FUEL exists; an "already attempted" set built from the wrong dir |
-| L5245 | §66d | The permuter⇄reader loop: alternate a random search with a byte-verified idiom, and let `r |
-| L5280 | §66d-1 | What transfers between giants is the LOOP, not the PIN |
-| L5289 | §66d-2 | Two operational sharp edges |
-| L5300 | §66d-3 | Read the ILS per-cycle SERIES, not its final best: a repeated score and a still-falling on |
-| L5315 | §67 | The arg-copy PLACEMENT lever: launder a parameter into a fresh pseudo AT the statement whe |
-| L5405 | §67a | Run the symbol-set guard BEFORE you pay for a gate (`tools/symcheck.py`, Phase 29 SESSION- |
-| L5438 | §66d-4 | "ILS converged" means converged FOR THAT WEIGHT PROFILE, not a floor (amends §66d-3; Phase |
-| L5491 | §66d-5 | `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations |
-| L5524 | §68 | A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase  |
-| L5569 | §69 | How to attack a behemoth: map it, don't draft it (Phase 29 SESSION-18, `func_80183814`, 5, |
-| L5619 | §70 | The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `fu |
-| L5660 | §71 | Before mapping a giant, look for an already-matched SIBLING beside it (Phase 29 SESSION-18 |
-| L5726 | §72 | A `register __asm__` pin is a PREFERENCE, not a reservation (Phase 29 SESSION-18, `func_80 |
-| L5750 | §3-The | honest fix was source-level and cheap |
-| L5760 | §3-Giv | record order (the §70 family) |
-| L5766 | What | is left, and what is byte-recorded as SPENT |
-| L5783 | §73 | A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at  |
-| L5822 | §74 | Auditing a pinned draft: the §72 hazard is CALLER-SAVED pins spanning a call, and only the |
-| L5866 | §75 | A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the ca |
-| L5925 | §75a | The exclusion classes, enumerated with named causes (Phase 29 SESSION-19, the 134-binary ` |
-| L5948 | §75b | A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the exte |
-| L5997 | §75c | Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix mo |
-| L6028 | §76 | The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY  |
-| L6037 | §3-The | mechanism, with citations |
-| L6057 | §3-The | attribution primitive (use this before calling anything a scheduling residual) |
-| L6064 | §3-Two | diagnosis traps this function proved |
-| L6074 | Practice | Practice |
-| L6084 | §77 | Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silent |
-| L6124 | §3-The | CANDIDATE gate and the REAL gate need DIFFERENT preambles — keep the difference out of the |
-| L6174 | §78 | A LENGTH drift can be a register grant in disguise; and `fold` never leaves a literal firs |
-| L6180 | §3-The | drift was an allocation decision, not missing code |
-| L6211 | §3-The | economics |
-| L6220 | §79 | For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT OR |
-| L6226 | §71 | has a blind spot, and this is it |
-| L6240 | §3-NEW | LEVER — the frame layout reads back the original declaration order |
-| L6251 | §76 | confirmed at scale, and a pin nuance |
-| L6260 | §3-The | residual, and the honest read |
-| L6270 | §80 | A do-not-re-buy entry is scoped to its BASE, not to the function; and the pin's hidden cos |
-| L6291 | §3-The | pin's hidden cost, with the citation |
-| L6302 | §3-The | flagged "#1 move" LOST — and why the failure is informative |
-| L6312 | §78 | 's attribution primitive, run and reproduced |
-| L6318 | Cold-start | economics, now complete |
-| L6323 | §81 | Banking a jr (jump-table) function: the 3-step carve chain, and why `match_one` cannot see |
-| L6354 | §3-The | defect this exposed: a shared type that is present but invisible |
-| L6370 | §82 | Two source-shape oracles from behemoth #6: a duplicated `addiu $aN,$sp,K` across a `jal` m |
-| L6375 | §3-1. | The inlined-helper signature |
-| L6389 | §3-2. | Scalar vs aggregate decides *when* the slot is allocated |
-| L6401 | Also | reproduced on this function |
-| L6405 | §3-And | the banking footnote (§75a class A, one line) |
-| L6412 | §83 | The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a p |
-| L6419 | §83a | READ THE HEADLINE NUMBER CORRECTLY: a LENGTH drift makes `match_one`'s count meaningless |
-| L6427 | §83b | THE LEVER: find the parameterised REPEAT before decoding case-by-case |
-| L6445 | §83c | TRAP: a "dead local" in a prior draft may be gcc's OWN spill area |
-| L6452 | §83d | CSE's quantity budget is WHOLE-FUNCTION, so a local rewrite cannot fix a local symptom |
-| L6466 | §83e | §80 vindicated again, on the same day it was written |
-| L6472 | §84 | The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between tw |
-| L6477 | §3-The | construct |
-| L6495 | §3-Why | it survived every candidate gate |
-| L6510 | §3-THE | FIX IS MECHANICAL — the tool already holds the answer |
-| L6518 | Scope | , measured (do not over-generalise — §80) |
-| L6528 | §3-Two | ladder lessons banked with it |
-| L6539 | §85 | The RETURN-axis fleet widen is ALL-OR-NOTHING: widening the shared header alone guarantees |
-| L6544 | §3-The | conflict |
-| L6552 | §3-THE | FAILURE MODE — widening only `engine_core.h` is worse than not starting |
-| L6559 | §3-The | precondition, and how to check it in one grep |
-| L6567 | §3-Do | the WHOLE axis in one edit, then R22 once |
-| L6576 | Reading | , for the next person |
-| L6589 | §86 | Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §4 |
-| L6591 | §3-The | guard refuses a class that largely works |
-| L6600 | §3-THE | LAW: all-or-nothing PER FAMILY |
-| L6627 | §3-Why | the two live families differ from the three dead ones — the open question |
-| L6633 | §87 | `match_one` COMPILES but never LINKS, so an unresolvable data symbol reads as MATCH; and s |
-| L6649 | §3-The | blindness ladder, now complete — FOUR classes `match_one` cannot see |
-| L6659 | Consequence | for the backlog ledger |
-| L6666 | §3-The | cheap discriminator, before spending a sweep |
-| L6674 | §88 | `cross_jump` will not merge a common suffix containing a CALL; and §78 is scoped to ORDERE |
-| L6679 | §88a | repeated CALL-shaped blocks are left UNMERGED; call-free tails are merged for you |
-| L6686 | §88b | the `slti` literal-position law (extends §78 to comparisons) |
-| L6701 | §88d | BANKING ORDER: run the §81 carve chain BEFORE banking, never after |
-| L6708 | §88e | a wrong diagnosis, refuted properly (the model for how to treat an inherited lever) |
-| L6718 | §88f | the missing rung: a RELOCATION gate between `match_one` and the binary |
-| L6726 | §89 | Two throughput rules the project already had written down and was not following (Phase 29  |
-| L6732 | §89a | MEASURE the write set; do not assert its tier (`tools/blast_radius.py`) |
-| L6745 | §89b | the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel. |
-| L6758 | §3-The | standing sequence |
-| L6766 | §90 | Five tool-integrity laws from one session, each of which changed an answer (Phase 29 SESSI |
-| L6772 | §90a | A comparison tool MUST share its reference oracle's index space, exactly |
-| L6789 | §90b | "Byte-neutral" is not "wanted": undo on the SUCCESS path too |
-| L6799 | §90c | A library-callable function must FAIL CLOSED on an unconfigured module |
-| L6810 | §90d | Do not measure a live wave's drafts (§87 in real time) |
-| L6818 | §90e | An agent's CONCLUSION and its EVIDENCE fail independently — re-derive the premise, not the |
-| L6842 | §91 | A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap |
-| L6871 | §3-The | three-hypothesis trail, because two of them were wrong and the wrongness is instructive |
-| L6891 | §92 | Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not |
-| L6922 | §93 | `set -o pipefail` attributes a pipeline failure to the LAST stage, not the failing one (Ph |
-| L6947 | §94 | A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's |
-| L6983 | §95 | `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 S |
-| L7018 | §96 | The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so e |
-| L7066 | §97 | The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that c |
-| L7113 | §98 | `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION |
-| L7167 | §99 | The narrow-param wall is a DEF-side problem with a ZERO-blast-radius fix: convert the defi |
-| L7190 | §3-Two | `reconcile_tu` bugs found underneath, one introduced while fixing the other |
-| L7216 | §100 | Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a sh |
-| L7245 | §101 | The STALE DEFAULT class: a guard whose cause was removed is a silent skip wearing a safety |
-| L7272 | §102 | A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSI |
-| L7307 | §103 | A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER functio |
-| L7395 | §104 | Two silent-skip defects in one scan: match on MASKED text, emit from the ORIGINAL (Phase 2 |
-| L7431 | §105 | A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_ |
-| L7470 | §106 | Persist the MEASUREMENT, derive the POLICY: a stored route let a stale file out-vote the l |
-| L7513 | §107 | A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `fun |
-| L7551 | §108 | Diagnosing a family `0/N`: the four causes, and the third opt-in lever (Phase 29 T59) |
-| L7600 | §109 | Conforming a definition to a shared header: fix the NAMES, then check the RETURN precondit |
-| L7640 | §110 | A unit must define exactly ONE function, and "ends in `;`" does not tell you which line de |
-| L7681 | §111 | The distinct-code metric is not noisy: a family pays it only if its members are byte-VARIA |
-| L7730 | §112 | A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69 |
-| L7776 | §113 | An ARITY blocker only exists if the macro CALLS the function; an address-taken use has no  |
-| L7808 | §114 | The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29  |
-| L7850 | §115 | A `func_XXXXXXXX` predicate rots by design: the same name-form assumption in THREE places  |
-| L7877 | §116 | Optimization level is a property of the FILE, not the function: read a family 0/N against  |
-| L7895 | §3-The | fix moves the DEFINITION, not the stub — and here is why the obvious shortcut fails |
-| L7926 | §117 | Spell the sibling's symbol from the SIBLING's address, not the exemplar's kind (Phase 29 T |
-| L7953 | §3-Why | it survived so long: a MASKED oracle will MATCH a wrong symbol |
-| L7963 | §118 | Ordinal (positional) immediate resolution: compare C tokens to the DIFFERING asm uses (Pha |
-| L7997 | §119 | Two levers on the SAME axis, opposite directions: test the off-diagonal (Phase 29 T89) |
-| L8026 | §120 | Uniquify draft-defined TYPE names; and check which of N staging sites you actually patched |
-| L8037 | §3-Do | NOT "strip the duplicate typedef" — it breaks the extern that uses it |
-| L8043 | §3-The | wiring trap that cost two attempts |
-| L8061 | §121 | Synthesise externs for macro-DEFINED callees from the macro's own definition head (Phase 2 |
-| L8084 | §122 | GATE RAW BEFORE TRANSFORMING; the undo belongs to the WRITER, as a per-edit journal (P30 T |
-| L8116 | §123 | PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its re |
-| L8153 | §124 | A "not matched" verdict can mean the definition is there under a DIFFERENT C NAME: the asm |
-| L8198 | §124a | a family sweep's `0 matched-exemplar families` may be a FILTER, not a wall |
-| L8206 | §125 | Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA f |
-| L8213 | §3-The | method (keep this) |
-| L8223 | §3-The | instrument rules that make its answer trustworthy (this is where I failed) |
-| L8238 | §3-The | corrected results (each SHA-verified, from a clean tree, restore re-verified) |
-| L8248 | §3-Two | further notes worth keeping |
-| L8257 | §3-The | meta-lesson |
-| L8264 | §126 | The carve-within-a-carve: an ADDRESS RANGE is not an OPTIMIZATION REGION (P30 T2, byte-pro |
-| L8279 | §3-The | finding: opt level is per FILE, so the file's contents must be opt-HOMOGENEOUS |
-| L8290 | §3-The | instrument trap that hid it (and it is §124's shape again) |
-| L8299 | §3-The | mechanics |
-| L8317 | §126a | a bare `except: continue` around a coverage-asserting oracle re-creates the silent skip (P |
-| L8349 | §127 | The `-O0` regime: the CONSTANT-OFFSET FOLD, and why `-O0` needs its own idiom set (P30 T3  |
-| L8356 | §3-The | idiom they kept re-deriving: the constant-offset fold |
-| L8367 | §3-The | rest of the `-O0` regime (write PLAIN C, and mean it) |
-| L8377 | §127a | §71 (sibling-first) is the strongest `-O0` lever, and it beats the index |
-| L8386 | §127b | the knowledge was in a SOURCE COMMENT, not the cookbook |
-| L8393 | §128 | A raw NUL in C source makes grep SILENTLY SKIP the file (P30 S28, 137 files) |
-| L8425 | §128a | a negative control must corrupt a SCRATCH COPY, never the tracked file |
-| L8437 | §129 | Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must |
-| L8441 | §129a | the target instruction count is INFLATED after a carve |
-| L8462 | §129b | never commit a carve whose owner is still a stub (it strands the carve) |
-| L8477 | §3-The | real blocker underneath, for the record |
-| L8486 | §130 | An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LI |
-| L8523 | §3-The | diagnostic ladder that finally located it (reusable) |
-| L8533 | §131 | The jtbl OVER-SPAN: `sltiu N` is ground truth in BOTH directions, and the zero-word rule o |
-| L8570 | §132 | The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the |
-| L8579 | Defect | 1 — a pre-§8e MERGED DOUBLE is not a single-table predecessor |
-| L8597 | Defect | 2 — `as` writes a corpse and nothing deletes it |
-| L8607 | §3-The | fingerprint, and the 30-second ladder that found it |
-| L8628 | §3-The | transferable rule |
-| L8635 | §132a | `--like` is for a sibling with NO record; against one that HAS a record it over-derives (P |
-| L8660 | §132b | When the span's already-matched owner is ITSELF multi-switch: `--span-rel` (P30 S1, `func_ |
-| L8685 | §133 | The DEFAULT-FILTER class: three times in one session, a tool silently answered a narrower  |
-| L8711 | §134 | MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P3 |
-| L8765 | §135 | Six byte-verified gcc-2.7.2 idioms from the P30 S6f-h waves (and the two-lane wave shape t |
-| L8770 | §3-The | codegen idioms |
-| L8804 | §3-The | integration idioms (these decide whether a byte-correct draft BANKS) |
-| L8819 | §3-The | wave shape that produced these |
-| L8837 | §136 | The LOCAL-VARIABLE lever: how many C locals, at what scope (P30 wave 4a, 25 byte-verified  |
-| L8853 | §3-The | splitting/merging rules (each closed a residual, byte-gated) |
-| L8879 | §3-The | type-form rules |
-| L8912 | §3-The | scheduling rules (refining §135-2 and §135-4) |
-| L8941 | §3-The | declaration surface (integration, not codegen) |
-| L8953 | Wave | economics (measured, for the next batch's sizing) |
-| L8976 | §136a | Blocker capture: classify on the OUTPUT, never on the exit status |
-| L9033 | §136b | A prior wave's "genuine byte-DIFF" verdict is NOT reliable evidence (4 of 4 refuted) |
-| L9069 | §136c | SIBLING-FIRST is a DERIVATION shortcut, not just a conflict fix (the fastest route in a fa |
-| L9094 | §136d | Four gcc-2.7.2 levers the redraft lane found (each closed a residual no other lever moved) |
-| L9138 | §136e | §136c's PRECONDITION, and two more symptom keys (wave 4b batch 3) |
-| L9186 | §136f | Two declaration sub-cases the reconcile lane surfaced (lane now 15/15 lifetime) |
-| L9211 | §136g | When the index points at the WRONG lever: two byte-refuted routings (func_801863B4) |
-| L9240 | §136h | CORRECTION: the zero-crack pool does NOT "refill with cheap work" (my error, byte-measured |
-| L9270 | §136i | The drafter model LADDER: Haiku → **Sonnet** → Opus → Fable5 (Drew, 2026-08-03) |
-| L9302 | §136j | The failure MIX flips with function size (measured across four bands, one session) |
-| L9344 | §137 | REGALLOC-PERM is a TWO-COMPILE ARITHMETIC PROBLEM, not a permuter job |
-| L9386 | §137a | A gate verdict has a TIMESTAMP; re-check it against the draft's mtime |
-| L9415 | §138 | The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on |
-| L9421 | §3-The | triage, cheapest first |
-| L9473 | §3-The | DEFINITION-side alias is the only escape when the fleet canon disagrees on a promoting par |
-| L9481 | Rank | the lane by measured concentration, not by class count |
-| L9490 | THREE | carry variants hide in one "CARRY-FIXABLE" bucket — and they need different fixes |
-| L9526 | §134 | again, in a second tool — and the waiter rule corrected |
-| L9546 | STEP | 0 of sibling-first: grep `src/` for a distinctive LITERAL from the `.s` |
-| L9565 | Reconciling | a gate-refused draft: which way you edit depends on WHERE the TU's decl is |
-| L9594 | §139 | A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not s |
-| L9626 | §3-The | generalisation — three corollaries worth more than the bug |
-| L9643 | §3-And | the inverse-lookup trap, same session |
-| L9660 | §140 | A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a |
-| L9680 | §3-The | three-line proof (do this before diagnosing any metric movement) |
-| L9689 | §3-The | two instrument defects it exposed |
-| L9709 | §3-The | same swallow, twice more, in the integration spine |
-| L9720 | §3-Two | wrong mechanisms I chased first, and why they were wrong |
-| L9740 | §141 | The §134 class is CLOSED: every line-shape decision now routes through `cdecl._mask` (P30  |
-| L9778 | §142 | An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do no |
-| L9790 | §3-The | measurement (do this before any wave; it is ~20 lines and needs no builds) |
-| L9805 | §3-The | trap that hid it — SAME FUNCTION, TWO ROUTES, ONLY ONE IS FREE |
-| L9814 | Route | selection (why `--addr` sometimes says "nothing changed") |
-| L9822 | §3-And | the report-vs-bytes lesson attached to it |
-| L9834 | §143 | `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep beca |
-| L9888 | §144 | THE LITERAL'S SPELLING PICKS THE IMMEDIATE ENCODING (P30 S40 wave 1, `func_801822E0`) |
-| L9927 | §145 | Three loop/combine levers from the S40 wave-2 drafters (16/16 match_one) |
-| L9977 | §146 | RE-MEASURE A WALL BEFORE YOU RESPECT IT. Both "permanent" giants fell to drafts already on |
-| L9988 | §3-Why | a correct draft can read as an intrinsic wall |
-| L10000 | Then | propagation returned 0/137 TWICE — both times a missing TYPE |
-| L10009 | §3-Two | errors of mine, both instructive |
-| L10023 | §3-The | rule |
-| L10036 | §147 | The three-stratum FRAME LAW, and four "stop searching" verdicts (P30 S42, `func_8017C294`, |
-| L10041 | §3-A. | The frame has THREE strata, and stratum 3 is unreachable from C |
-| L10057 | §3-B. | A `?:` on MEMORY operands costs ~16 bytes of invisible frame; on REGISTER operands, zero |
-| L10068 | §3-C. | Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED |
-| L10073 | §3-D. | A lone `$t8`/`$t9` in the target is RELOAD SCRATCH — reproduce the spill, don't pin the re |
-| L10083 | §3-E. | A `qty_compare` TIE is not spelling-reachable — recognise it and stop |
-| L10095 | Consequence | for the family (a real scheduling decision) |
-| L10145 | §148 | The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds |
-| L10151 | §3-A. | `move_movables` hoists iff `threshold × savings × lifetime ≥ insn_count` — and you can rea |
-| L10170 | §3-B. | `(v < 0x40) ? v : 0x3F` is folded to `MIN_EXPR` and expands to the WRONG SHAPE |
-| L10184 | §3-C. | A zero-byte ALLOCNO-PRIORITY slider |
-| L10194 | §3-D. | Reproduce the original's BUGS verbatim |
-| L10243 | §149 | Four instrument defects in one session, and the two questions they were hiding (P30 S43) |
-| L10249 | §3-A. | A prep step that returns its input on failure is indistinguishable from a search that foun |
-| L10267 | §3-B. | Same address + same name ≠ same body — and the ledger keys on address |
-| L10283 | §3-C. | `make: *** [...] Error N` is a summary, never a diagnosis |
-| L10293 | §3-D. | "Cheap fuel" that was never probed: 0 of 31 templatable |
-| L10312 | §150 | A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocato |
-| L10319 | §3-The | fix |
-| L10329 | §3-The | method that found it (this is the transferable part) |
-| L10345 | §3-Two | corrections to the record |
-| L10356 | Diagnostic | order (adopt this) |
-| L10367 | §151 | THE GHOST WEDGE: when a load-before-store transposition is unreachable by ANY statement or |
-| L10372 | §3-The | mechanism (read from cc1's own `-dR` trace, not inferred) |
-| L10387 | §3-The | lever — a zero-emission insn that absorbs the blocked tick |
-| L10395 | §3-The | two fallouts, and how to close them (both measured, in order) |
-| L10407 | When | to reach for it |
-| L10418 | §152 | BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC fa |
-| L10423 | §3-The | finding |
-| L10432 | §3-The | key |
-| L10443 | §3-Two | cautions that must travel with this technique |
-| L10454 | §3-The | companion defect (open) |
-| L10466 | §153 | THE ADDRESS-REMATERIALISATION LAUNDER: a third zero-emission asm lever (P30 S43, `func_801 |
-| L10474 | Symptom | Symptom |
-| L10479 | Mechanism | (gcc source + RTL dumps, not inferred) |
-| L10486 | What | does NOT work (14 byte-measured probes) |
-| L10492 | §3-The | cure — a fresh launder per site, each in its own block |
-| L10502 | Companion | levers from the same function |
-| L10522 | §154 | Reading a disc payload: the module-id word, static base derivation, and "type 1 = uncompre |
-| L10527 | §3-A. | Payload word0 is a global MODULE ID; code starts after the header |
-| L10536 | §3-B. | Two static base-derivation methods that must AGREE (use both) |
-| L10548 | §3-C. | PAC type 1 = the same payload class as type 4, just NOT compressed |
-| L10558 | §155 | hi/lo literal scanning MUST track base registers (S45) |
-| L10567 | §155a | the same failure class, one level up: SHAPE-blind table scanning (S45 p5) |
-| L10587 | §155b | check the TYPE your oracle returns before comparing against it (S45 p5) |
-| L10610 | §155c | the ZERO-REFERENCE trap: gcc splits a global-array address across the `lui` and the LOAD ( |
-| L10640 | §156 | an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7) |
-| L10687 | §157 | the cheap-tier size cliff, measured (S45 p6) |
-| L10712 | §158 | The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S4 |
-| L10721 | Symptom | Symptom |
-| L10727 | §3-Why | the fork is chained (gcc source, validated insn-by-insn against -dS/-dR dumps) |
-| L10740 | §3-The | method (dump-arithmetic first, then place — no probing) |
-| L10757 | Bonus | facts worth keeping |
-| L10772 | §156 | THE PREFERENCE-DONOR MERGE: cross-region variable reuse is what fills a0-a3, and a call-ar |
-| L10828 | §159 | THE DECLARATION AXIS: conform to byte-truth, and make every guard state its COVERAGE (P30  |
-| L10893 | §160 | THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall |
-| L10969 | §161 | THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47) |
-| L11014 | §162 | S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 target |
-| L11041 | §162a | SHARPENS  *(sharpens §161a, §131, §8a-pad, §129a)* |
-| L11070 | §162b | SHARPENS  *(sharpens §48-A3, §156, §150, §76)* |
-| L11099 | §162d | SHARPENS  *(sharpens §31, §21, §30, §55a)* |
-| L11141 | §162e | NEW |
-| L11143 | §162 | THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the  |
-| L11209 | §162f | SHARPENS  *(sharpens §42d, §41d, §73, §10)* |
-| L11264 | §162g | NEW |
-| L11266 | §162 | CROSS-JUMP DIRECTION: the surviving copy is always the LATER one, so a BACKWARD `j` into a |
-| L11300 | §162h | SHARPENS  *(sharpens §88, §88a, §50-B, §8)* |
-| L11302 | §162 | The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_801 |
-| L11368 | §162i | SHARPENS  *(sharpens §135, §21, §42, §32)* |
-| L11393 | §162j | SHARPENS  *(sharpens §25, §136d-1, §48-B, §46-L2)* |
-| L11422 | §162k | SHARPENS  *(sharpens §1-I2, §12, §160d, §21)* |
-| L11485 | §162l | SHARPENS  *(sharpens §48-B, §48-C1, §20, §21)* |
-| L11540 | §162m | SHARPENS  *(sharpens §36, §158, §148, §153)* |
-| L11542 | §158a | THE FIFTH LEVER IS NOT AN ASM: `do { } while (0)` is a REGION ref-multiplier you MINT (P30 |
-| L11549 | §3-The | law |
-| L11560 | Size | it before you write it (§158 step 1-2, applied) |
-| L11581 | §3-The | wrap BOUNDARY is the dial — and it is indiscriminate |
-| L11587 | §3-Not | a pure dial |
-| L11591 | DIAGNOSTIC | TELL — two faces, one law |
-| L11613 | §162n | NEW |
-| L11646 | §162o | SHARPENS  *(sharpens §158, §136-1, §136-6, §79)* |
-| L11705 | §162p | SHARPENS  *(sharpens §48-B, §46-L2, §156, §136d-1)* |
-| L11722 | §162q | SHARPENS  *(sharpens §30, §30a, §135-2, §136-13)* |
-| L11760 | §163 | S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actiona |
-| L11828 | §163z | THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass) |
-| L11848 | §164 | S48 §163z SKEPTIC PASS (P30, 2026-08-12): 190 claims vetted, 82 banked |
-| L12300 | §16Xy | SHARPENS  *(sharpens §136d-3, §37 /s-DEP LATTICE, §135-2, §136-13, §162q)* |
-| L12302 | §3-The | `/s` drop clause is in ALL THREE dependence predicates, so the FIXED-ADDRESS STORE is what |
-| L13636 | §164z | REFUTED CLAIMS: do NOT re-derive these |
-| L13702 | §165 | S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed |
-| L14353 | §16Z | SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2- |
-| L14355 | §3-The | ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `f |
-| L14871 | §165z | REFUTED THIS WAVE: do NOT re-derive |
-| L14915 | §166 | THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen |
-| L14971 | §167 | S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point |
-| L16167 | §167z | REFUTED IN WAVES 5/6: do NOT re-derive |
-| L16224 | §168 | THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the  |
-| L16276 | §169 | THE MICRO-ADAPT LANE (P30 S49): edit a proven body, don't crack a new one |
-| L16323 | §170 | THE A-PROP WORD-DIFF CARD (P30 S49): the lane that had no owner |
-| L16367 | §171 | THE STALE SEED SYMBOL (P30 S50, 2026-08-13): why §170's 91%→57% was never codegen |
-| L16433 | §171a | THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop |
-| L16483 | §171b | THREE CARRIES THE MECHANICAL DRAFT NEEDS (P30 S50, banking the top-reach families) |
-| L16516 | §172 | THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 |
-| L16570 | §172a | TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max) |
-| L16586 | §172b | THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask) |
-| L16629 | §173 | THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where |
-| L16665 | §174 | THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery |
-| L16735 | §175 | A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wa |
-| L16760 | §176a | THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot pr |
-| L16800 | §176b | BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c |
-| L16826 | §176d | THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15) |
-| L16865 | §176e | SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py` |
-| L16922 | §176f | THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P3 |
-| L16953 | §176g | SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine) |
-| L16991 | §176h | THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law |
-| L16999 | §3-A. | The seven under-reporting holes (all in `gate_main`, all the same shape) |
-| L17017 | §3-B. | Typedef handling — the only strategy that survives contact |
-| L17039 | §3-C. | The limit that remains (recorded, not solved) |
-| L17046 | §3-C2. | RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier |
-| L17069 | §3-D. | The measured cost shape, and what to build next |
-| L17087 | §176i | WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q) |
-| L17119 | §176j | STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable) |
-| L17145 | §176j-2 | THE REPAIR PASS, MEASURED (do this instead of resuming) |
-| L17165 | §176k | TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE |
-| L17182 | §177 | 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING |
-| L17239 | §178 | SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited |
-| L17251 | §3-A. | THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins) |
-| L17267 | §3-B. | A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, |
-| L17280 | §3-C. | SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins) |
-| L17288 | §3-D. | A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom) |
-| L17295 | §3-E. | THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins) |
-| L17304 | §3-F. | `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins) |
-| L17310 | §3-G. | TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES |
-| L17326 | §179 | IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass) |
-| L17336 | §179-A | 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proof |
-| L17385 | §179-B | 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs) |
-| L17435 | §179-C | 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__a |
-| L17486 | §179-D | `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE |
-| L17506 | §179-E | A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP |
-| L17532 | §179-F | PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION |
-| L17555 | §179-G | 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1) |
-| L17582 | §179-H | A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE |
-| L17605 | Considered | and NOT banked |
-| L17622 | §176c | MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY |
-| L17633 | §176 | SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, a |
-| L17639 | §176-A | "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first |
-| L17663 | §176-B | "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation |
-| L17709 | §176-C | 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine |
-| L17735 | §176-D | CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2) |
-| L17761 | §176-E | Two cheap source spellings, both cc1-probed |
-| L17783 | §176-F | Misdiagnosis triage: four residual verdicts that were lying |
-| L17800 | What | is NOT banked here |
-| L17813 | §180 | THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW |
-| L17842 | §180b | WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt) |
-| L17861 | §180c | WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER |
-| L17879 | §181 | WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile) |
-| L17880 | Only | ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable. |
-| L17935 | §182 | §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held |
-| L17949 | §180d | THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE |
-| L17961 | §183 | THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts) |
-| L17962 | §3-18 | of 20 reconciled while keeping the match. The two that did not are mechanism, not effort. |
-| L18032 | §184 | COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one  |
-| L18060 | §185 | EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES |
-| L18092 | §186 | CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT |
-| L18113 | §186b | A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL |
-| L18121 | §186c | WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER |
-| L18138 | §187 | 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOP |
-| L18176 | §188 | 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE |
-| L18226 | §189 | FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-de |
-| L18301 | §190 | THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled) |
-| L18338 | §191 | WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-der |
-| L18360 | §192 | THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54) |
-| L18361 | Three | defects in one call path; the overlay slates that carry most of the wave work were being w |
-| L18425 | §193 | THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-cover |
-| L18442 | §193-A | The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar |
-| L18509 | §193-B | A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTE |
-| L18547 | §193-C | gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head mer |
-| L18581 | §193-D | A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's  |
-| L18652 | §193-E | A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it i |
-| L18682 | §193-F | §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, no |
-| L18746 | §193-G | §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live  |
-| L18807 | §193-H | A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call  |
-| L18847 | §193-I | A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS T |
-| L18906 | §193-REJECTED | what this harvest did NOT bank (recorded so it is not re-derived) |
-| L18933 | §194 | THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-cove |
-| L18950 | §194-A | A zero-byte scheduling fence goes AFTER the defining statement to make that computation em |
-| L19016 | §194-B | A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — th |
-| L19054 | §194-C | A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share  |
-| L19117 | §194-D | Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication  |
-| L19158 | §194-E | The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a |
-| L19195 | §194-F | `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value &&  |
-| L19268 | §194-G | Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling |
-| L19311 | §194-H | §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a  |
-| L19349 | §194-I | §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmeti |
-| L19392 | §194-J | Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volati |
-| L19444 | §194-K | Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, n |
-| L19522 | §194-L | §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-const |
-| L19570 | §194-M | A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — |
-| L19628 | §194-N | §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real inc |
-| L19688 | §194-REJECTED | what this harvest did NOT bank (recorded so it is not re-derived) |
-| L19709 | §195 | THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-cove |
-| L19723 | §195-A | §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class:  |
-| L19794 | §195-B | A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a L |
-| L19836 | §195-C | A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-d |
-| L19884 | §195-D | §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` desti |
-| L19952 | §195-E | A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the s |
-| L20010 | §195-F | fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-c |
-| L20062 | §195-G | §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CO |
-| L20110 | §195-H | §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT Z |
-| L20157 | §195-I | §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of |
-| L20222 | §195-J | GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexis |
-| L20266 | §195-K | At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when  |
-| L20318 | §195-L | The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the r |
-| L20370 | §195-M | Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) t |
-| L20419 | §195-N | In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LA |
-| L20466 | §195-REJECTED | what this harvest did NOT bank (recorded so it is not re-derived) |
-| L20512 | §196 | PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54) |
-| L20567 | §197 | THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-cover |
-| L20581 | §197-A | A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM |
-| L20619 | §197-B | A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_c |
-| L20647 | §197-C | Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set alre |
-| L20692 | §197-REJECTED | §197-REJECTED |
-| L20707 | §199 | THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-c |
-| L20718 | §199-A | §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui |
-| L20767 | §199-B | A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent  |
-| L20812 | §199-C | A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever S |
-| L20860 | §199-D | A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is |
-| L20920 | §199-E | §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper  |
-| L20979 | §199-F | §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN ` |
-| L21033 | §199-G | At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positiv |
-| L21088 | §199-REJECTED | §199-REJECTED |
-| L21099 | §200 | THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P3 |
-| L21148 | §201 | THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered |
-| L21158 | §201-A | §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definit |
-| L21190 | §201-B | In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sig |
-| L21270 | §201-C | §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE IN |
-| L21321 | §201-D | THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER |
-| L21368 | §201-E | §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in t |
-| L21424 | §201-REJECTED | eight, the session's highest |
-| L21449 | §202 | THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56) |
-| L21486 | §203 | A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56) |
-| L21547 | §204 | THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered |
-| L21566 | §204-A | A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JO |
-| L21641 | §204-B | A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can  |
-| L21705 | §204-C | WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S B |
-| L21763 | §204-D | A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.fie |
-| L21838 | §204-E | `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of  |
-| L21890 | §204-CONFIRMED | 30 reports that the index already answered |
-| L21984 | §204-REJECTED | sixteen, twice the previous record |
-| L22057 | §205 | THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy t |
-| L22112 | §206 | THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns |
-| L22181 | §207 | THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-ga |
-| L22202 | §208 | TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity own |
-| L22251 | §209 | THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND |
-| L22328 | §210 | THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a ST |
-| L22374 | §211 | HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips  |
-| L22433 | §212 | THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one |
-| L22478 | §213 | INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE |
-| L22514 | §214 | THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 si |
-| L22560 | §215 | PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing |
-| L22616 | §216 | DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array de |
-| L22656 | §217 | DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(s |
-| L22682 | §218 | A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well |
-| L22711 | §219 | COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE  |
-| L22738 | §220 | THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and pla |
-| L22778 | §221 | A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **( |
-| L22794 | §222 | SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys  |
-| L22836 | §223 | READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER t |
-| L22898 | §224 | CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31  |
-| L22934 | §225 | THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58) |
-| L22977 | §226 | FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58) |
-| L23018 | §227 | TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58) |
-| L23038 | §228 | READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discrimin |
-| L23075 | §229 | THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPO |
-| L23124 | §230 | THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which ass |
-| L23139 | §231 | TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58) |
-| L23180 | §232 | WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(sing |
-| L23216 | §30 | addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual w |
-| L23236 | §194-B | addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A |
-| L23242 | §176-B | addendum (P31 S58) — the misdiagnosis direction |
-| L23248 | §165-40 | addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects |
-| L23257 | §164-63 | addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignm |
-| L23266 | §193-A | / §194-E addendum (P31 S58) — where the twin's body actually lives |
-| L23272 | §233 | THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 |
-| L23316 | §234 | CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S |
-| L23357 | §235 | THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b) |
-| L23386 | §236 | THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS TH |
-| L23465 | §237 | THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCA |
-| L23520 | §238 | SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b) |
-| L23560 | §239 | TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPER |
-| L23594 | §240 | `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b) |
-| L23623 | §241 | THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b) |
-| L23652 | §242 | `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDI |
-| L23680 | §243 | SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P |
-| L23710 | §244 | `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC ( |
-| L23745 | §245 | THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b) |
-| L23792 | §246 | THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P3 |
-| L23832 | §247 | TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b) |
-| L23866 | §248 | SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS D |
-| L23890 | §249 | THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INS |
-| L23932 | §250 | `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 |
-| L23969 | §251 | IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b) |
-| L23991 | §252 | THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b) |
-| L24012 | §253 | POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet  |
-| L24026 | §254 | THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-conf |
-| L24038 | §255 | THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b) |
-| L24073 | §256 | GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS |
-| L24110 | §257 | THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED |
-| L24153 | §258 | ADDENDA TO EXISTING SECTIONS (P31 S58b) |
-| L24158 | §30 | addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-O |
-| L24179 | §194-B | / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS |
-| L24202 | §202 | addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT |
-| L24213 | §205 | addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMI |
-| L24230 | §208 | addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE |
-| L24259 | §210 | addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL |
-| L24275 | §211 | addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST |
-| L24318 | §213 | addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES |
-| L24347 | §214 | addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES |
-| L24383 | §215 | addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS |
-| L24435 | §217 | CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR |
-| L24452 | §220 | addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS) |
-| L24477 | §222 | addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS |
-| L24495 | §223 | addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE |
-| L24519 | §224 | addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR |
-| L24549 | §225 | addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES |
-| L24576 | §226 | addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATIO |
-| L24621 | §229 | addendum (P31 S58b) — NAME IT **INSIDE** THE ARM |
-| L24632 | §230 | CROSS-CONFIRMED (P31 S58b) |
-| L24641 | §231 | addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS |
-| L24672 | §232 | CROSS-CONFIRMED (P31 S58b) |
-| L24683 | §259 | THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY |
-| L24722 | §260 | THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S |
-| L24772 | §260-A | STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day |
-| L24808 | §261 | THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59) |
-| L24834 | §261a | THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-pro |
-| L24856 | §262 | A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59) |
-| L24886 | §263 | A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCH |
-| L24927 | §264 | FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59) |
-| L24977 | §265 | THE VERBATIM-ASM BANK LANE: A FUNCTION NO -O2 C CAN EVER MATCH BANKS AS A RAW `__asm__` BO |
-| L25039 | §266 | THE INERT-RIDER LAW: A LEVER IS ONLY CITABLE WHEN ITS SOLO REMOVAL BREAKS THE MATCH (P31 S |
-| L25079 | §267 | ADDENDA HARVESTED FROM WAVES at/bh/bk/bl (P31 S59b) |
-| L25087 | ADD-1 | → §231 addendum (also cross-ref from §195-D) — THE MASKED-`jal` "MISSING CALL" ILLUSION |
-| L25096 | ADD-2 | → §42a addendum — A SHARED CONSTANT *NAMED IN A LOCAL* ACROSS A `jal` IS AN ISO→TU DRIFT H |
-| L25108 | ADD-3 | → §236, item 10 — THE UN-DELETED `INCLUDE_ASM` STUB IS A DUPLICATE DEFINITION |
-| L25118 | ADD-4 | → §225-3/-4 addendum — THE MIRROR ROW: VALUE-RETURN IN THE *TAKEN* ARM + TRAILING BARE `re |
-| L25132 | ADD-5 | → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TR |
-| L25141 | ADD-6 | → §172b-1 / §264 addendum — SHIFT-AS-TEST: `(x << 16) != 0` TESTS THE LOW HALF WITHOUT TRU |
-| L25150 | ADD-7 | → §256 addendum — THE SINGLE-GUARD GOTO: THEN-BLOCK OUT OF LINE AT THE TAIL |
-| L25162 | ADD-8 | → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6) |
-| L25174 | ADD-9 | → §213-3 / §217 addendum — ADJACENT PRE-CALL FRAME STORES ARE ONE AGGREGATE; THE UNESCAPED |
-| L25184 | ADD-10 | → §237 addendum (arity-evidence paragraph) — AN `la` PAIR ABOVE THE PROLOGUE `sw $ra` IS A |
-| L25193 | ADD-11 | → Cross-confirmation card block (per §259's standing instruction: confirmation, not news) |
-| L25244 | §268 | A `register __asm__` PIN ON A CALL-CLOBBERED REGISTER IS HONORED EXACTLY WHEN THE PINNED R |
-| L25298 | §269 | ADDENDA HARVESTED FROM WAVES ax/bm (P31 S59c) |
-| L25313 | ADD-1 | → §257-8 addendum — THE INTERPOSED ASM'S `__volatile__` IS A PER-SHAPE DIAL, AND THE "NO-O |
-| L25326 | ADD-2 | → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HA |
-| L25340 | ADD-3 | → §238 addendum — TWO BINARIES CAN EACH DEFINE THE SAME `func_` NAME WITH DIFFERENT BYTES, |
-| L25353 | ADD-4 | → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAM |
-| L25370 | ADD-5 | → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON |
-| L25386 | ADD-6 | → §220-addendum — THE FOURTH FACE: WHEN THE NAMED COPY ITSELF BUYS THE EXTRA CALLEE-SAVED, |
-| L25402 | ADD-7 | → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE |
-| L25415 | ADD-8 | → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST |
-| L25430 | ADD-9 | → §255 "AND CASE-BODY PLACEMENT" bound / §222-addendum-3 — ON A LARGE SPARSE TREE, BODIES  |
-| L25444 | ADD-10 | → Cross-confirmation card block (per §259's standing instruction: confirmation, not news) |
-| L25485 | §3-1a. | The §266 sweep — every solo-lever A/B run for this batch |
-| L25518 | §270 | The A-prop 0-bank anatomy: a byte-correct body still needs FOUR layers to agree (P31 S59) |
-| L25536 | §271 | Ordinal IMM pairing: text order is NOT emission order; emit CANDIDATES, let the oracle pic |
-| L25558 | §272 | The `(void)`-decl + empty-call wall: K&R the DEFINITION, not just the decls (P31 S59) |
-| L25578 | §273 | A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59) |
-| L25593 | §274 | ADDENDA HARVESTED FROM 18 WAVES (P31 S60): 315 candidates, 255 already covered, 21 sharpen |
-| L25599 | ADDENDUM | to §179-C — the `.type NAME, @function` requirement |
-| L25646 | ADDENDUM | to §134 — a typedef defined BELOW the splice point is stripped anyway |
-| L25676 | ADDENDUM | to §179-D (GTE macro reference family) — `gte_SetRotMatrix`/`gte_SetTransMatrix` bodies |
-| L25702 | ADDENDUM | to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save |
-| L25740 | ADDENDUM | to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads |
-| L25779 | ADDENDUM | to §20 — a global declared as `T *` may itself BE the array base, not a pointer to derefer |
-| L25808 | ADDENDUM | to §1-I5 |
-| L25873 | ADDENDUM | to §164-51 |
-| L25889 | ADDENDUM | to §176-F5 |
-| L25918 | ADDENDUM | to §225 |
-| L25963 | ADDENDUM | to §224 — CROSS-JUMP: THE DUPLICATE CAN BE A PLAIN STORE, NOT ONLY A CALL |
-| L25997 | ADDENDUM | to §164-64 — AN EMPTY CLOBBER ON AN ARGUMENT REGISTER CAN BE THE DELIBERATE FIX, NOT JUST  |
-| L26028 | ADDENDUM | to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTE |
-| L26059 | ADDENDUM | to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECL |
-| L26106 | ADDENDUM | to §229 — A POINTER'S NUMBER OF USES DECIDES WHETHER ITS ADDRESS FOLDS OR SURVIVES A CALL |
-| L26151 | ADDENDUM | to §172b-4 — THE PLAIN CAST-DIVISION ALREADY PRODUCES THE PATTERN; DON'T HAND-ROLL THE BIA |
-| L26181 | ADDENDUM | to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT |
-| L26224 | ADDENDUM | to §226 — A DEAD LOCAL SCOPED TO A NESTED BLOCK BUYS A MID-FUNCTION `addiu sp` PAIR, NOT A |
-| L26263 | ADDENDUM | to §172a — RE-READING MEMORY (NOT NAMING A TEMP) IS WHAT KEEPS AN INCREMENT'S DELAY-SLOT F |
-| L26294 | ADDENDUM | to §225 / §256 — A GOTO TO A SHARED SET-POINT PREVENTS IF-CONVERSION FROM COLLAPSING A LAT |
-| L26336 | ADDENDUM | to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIAL |
-| L26371 | §275 | THE LEFTOVER-REGISTER READ |
-| L26411 | §276 | MIXED ADDRESS-EXPRESSION SPELLING FOR ADJACENT RELOCATABLE SYMBOLS IS A CSE-UNIFICATION DI |
-| L26520 | §277 | RETURN-TAIL C SPELLING PICKS THE DELAY-SLOT-FILL vs TRAILING-MOVE TOPOLOGY, AND A NARROWER |
-| L26584 | §278 | ADDENDA HARVESTED FROM WAVE cf (P31 S60): 34 candidates, 13 already covered, 8 sharpenings |
-| L26592 | ADDENDUM | to §74 (func_800D0E30, resident) |
-| L26628 | ADDENDUM | to §172b-4 (func_80185054, ov_SC03_097) |
-| L26666 | ADDENDUM | to §265 (func_8017DC80, ov_SC07_002) |
-| L26705 | ADDENDUM | to §17 (func_800CB794, md_MAIN_036) |
-| L26753 | ADDENDUM | to §162p (func_8017C120, ov_MAIN_012) |
-| L26787 | ADDENDUM | to §20 (~L1947) (func_80186AD0, ov_SC06_032) |
-| L26817 | ADDENDUM | to §164-56 (func_8017F644, ov_SC04_005) |
-| L26852 | ADDENDUM | to §237 (func_8017F7FC, ov_SC03_092) |
-| L26881 | §279 | A `do/while (p < end)` LOOP UNDER AN ENTRY GUARD: the guard decides the compare, not the l |
-| L26882 | §NNN | A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: T |
-| L26915 | §280 | THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, |
-| L26916 | §NNN | A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TE |
-| L26949 | §281 | GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, t |
-| L26950 | §NNN | A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AN |
-| L26995 | §282 | gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no h |
-| L26996 | §NNN | WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS |
-| L27033 | What | I could not verify |
-| L27080 | §283 | ADDENDA HARVESTED FROM THE 36-WAVE BATCH (P31 S60): 1,216 candidates, 859 already covered, |
-| L27090 | ADDENDUM | to §164-75 — the fold-reassociation law also fires at a variable's INITIALIZER, not only a |
-| L27116 | ADDENDUM | to §21 — the `bltz`+`slti` (or N-separate-compares) signed-range-split bullet is now CONFI |
-| L27162 | ADDENDUM | to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not |
-| L27185 | ADDENDUM | to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, s |
-| L27204 | ADDENDUM | to §195-E — a goto-ladder's STORES must sit AT the labels, after the gotos, not inline bef |
-| L27266 | ADDENDUM | to §195-N — a GNU statement-expression slider must sit INSIDE the conditional arm's value  |
-| L27323 | ADDENDUM | to §176-B2 — in a micro-function with no long/short lifetime asymmetry, BOTH contending ps |
-| L27370 | ADDENDUM | to §199-G — A `default:` LABEL GROUPED ONTO THE LAST CASE REMOVES THE `j default` TAIL, EV |
-| L27439 | ADDENDUM | to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SA |
-| L27497 | ADDENDUM | to §252 — a `>=0`/`<0` split on an unconditionally-decremented value needs the POSTFIX ope |
-| L27524 | ADDENDUM | to §215 — FIFTH SHAPE: reused mask constants across two call-free merge sites each get the |
-| L27607 | What | I could not verify |
-| L27678 | Harness-defect | flags |
-| L27771 | ADDENDUM | to §167-40 (func_8017E2CC, ov_SC04_015 — wave dg) |
-| L27791 | ADDENDUM | to §20's cross-jump EXPLOIT bullet (func_8017E360, ov_SC05_007 — wave dg) |
-| L27805 | ADDENDUM | to §87 (func_801815F4 ov_SC06_032; corroborating func_801840DC ov_SC05_017, func_80189C68  |
-| L27824 | ADDENDUM | to §153 / §236-5 (func_801A419C, md_SC07_003 — waves di and dl, corroborating; refutes a c |
-| L27844 | ADDENDUM | to §263 (func_801E83AC, md_SC04_029 — wave dj) |
-| L27858 | ADDENDUM | to §265 (func_8017D878, ov_SC03_107 — wave dj; corroborated by a REJECTED, contradicted ca |
-| L27872 | ADDENDUM | to §6 (func_801811F0, ov_SC03_102 — waves dj and dl, corroborated by a self-reported "noth |
-| L27886 | ADDENDUM | to §195-G (func_80183BB0, ov_SC05_001 — wave dj) |
-| L27914 | ADDENDUM | to the zero-byte-asm-slider family (§47 / §148-C / §153) (func_800CB874, md_MAIN_040 — wav |
-| L27932 | ADDENDUM | to §194-B (func_8017EB34, ov_SC03_117 — wave dk; distinct from the §74 co-pinning finding  |
-| L27964 | ADDENDUM | to §74 (func_8017EB34, ov_SC03_117 — counter/clamp variant; wave dj, corroborated by dk/dl |
-| L27984 | ADDENDUM | §37 — merged into the §153/§236-5 entry above (func_801A419C, wave dl) |
-| L27992 | ADDENDUM | §6 — merged into the §6 entry above (func_801811F0, wave dl) |
-| L28000 | ADDENDUM | to §238 (func_80182CB4, ov_SC02_000 — wave dl) |
-| L28018 | ADDENDUM | to §137a (func_801684B4, ov_MAIN_012; corroborated independently by func_80189E68, func_80 |
-| L28034 | ADDENDUM | to §8c / §88d (func_8016AB6C, ov_MAIN_012 — wave dm) |
-| L28048 | ADDENDUM | to §73 / §30#2 (func_800D1984, resident — wave dm) |
-| L28064 | What | I could not verify |
-| L28084 | ADDENDUM | to §174 Law 4 (func_8017E9A8, ov_SC06_015) |
-| L28124 | ADDENDUM | the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_ |
-| L28176 | From | ck + cl + cm |
-| L28182 | ADDENDUM | §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE |
-| L28219 | ADDENDUM | §NNN — sharpens §167-13's boundary: CHAINING TWO IDENTICAL SIDE-BY-SIDE STORES INTO ONE C  |
-| L28252 | ADDENDUM | §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED  |
-| L28285 | ADDENDUM | §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWE |
-| L28318 | ADDENDUM | to §5a (func_80181F74, ov_SC03_112, wave cn) |
-| L28368 | ADDENDUM | to §265 (func_8017E26C, ov_SC04_016, wave cn) |
-| L28406 | ADDENDUM | to §42b (func_8018247C, ov_SC07_002, waves cu + cw) |
-| L28437 | ADDENDUM | to §199-F family (func_8017EFB0, ov_SC02_021, wave cu) |
-| L28492 | ADDENDUM | to §195-E (func_800CFC1C, md_MAIN_003, wave cv) |
-| L28537 | ADDENDUM | to §215 addendum (func_800CB2C8, md_MAIN_033, waves cv + cw) |
-| L28593 | ADDENDUM | to §236 item 4 (func_8017D268, ov_SC04_006, wave cw) |
-| L28622 | What | I could not verify |
-| L28654 | Harness-defect | flags (not idioms — flagged for the operator) |
-| L28695 | ADDENDUM | to §250 (func_8017D7CC, ov_SC03_115 — cx/cy/cz/dr) |
-| L28740 | ADDENDUM | to §225 (func_8017E190, ov_SC03_115 — cx/cy/cz) |
-| L28793 | ADDENDUM | to §45-A (func_8017F6A4, ov_SC02_016 — cy/cz) |
-| L28837 | ADDENDUM | to §249 (func_80182ED4, ov_SC04_004 — dp/dr/dt) |
-| L28882 | ADDENDUM | to §199-A (func_801816FC, ov_SC02_005 — dp/dr/dt) |
-| L28928 | What | I could not verify |
-| L28971 | Harness-defect | flags |
-| L29033 | §284 | COMBINE CAN REASSOCIATE TWO SEQUENTIAL BITWISE-AND MASKS INTO ONE AGAINST THE PRE-MASK VAL |
-| L29037 | §285 | PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE  |
-| L29041 | §286 | FOLD A STATEMENT'S SIDE EFFECT INTO A COMMA-EXPRESSION IN AN ARGUMENT POSITION TO PLACE IT |
-| L29045 | §287 | A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE |
-| L29049 | §288 | A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES |
-| L29053 | §289 | an array local's address-taken base keeps every element's store alive, even though only on |
-| L29057 | §290 | A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EA |
-| L29061 | §291 | THE DELAY-SLOT FALSE-VALUE: A CONDITIONAL BRANCH'S ZERO ARM MUST BE A FALL-THROUGH-ADJACEN |
-| L29065 | §292 | DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPL |
-| L29068 | §293 | THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND T |
-| L29118 | §294 | ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · |
-| L29129 | ADDENDUM | to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the in |
-| L29157 | ADDENDUM | to §261a — FOUR MORE -O0 DIALS BEYOND THE RELOAD COUNT (boot.c + md_MAIN_011/003, wave m0a |
-| L29207 | ADDENDUM | to §264-3 — the explicit entry copy's BOUND: required exactly when the RAW value must outl |
-| L29227 | ADDENDUM | to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator |
-| L29239 | ADDENDUM | to §276 — the SHARE direction: spell the second adjacent symbol RELATIVE to force ONE anch |
-| L29255 | ADDENDUM | to §31's density-dummy dial (L2460/L2497) — the dose is TWO refs, and the dummy must sit w |
-| L29272 | ADDENDUM | to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction birt |
-| L29295 | ADDENDUM | to §253 — SECOND byte-proven card (upgrade from single-observation), and the placement fac |
-| L29316 | ADDENDUM | to the L1800 anchor-steer bullet — a DERIVED-POINTER local silently flips the merged giv's |
-| L29339 | ADDENDUM | to §31's asm→layout inference — TWO WIDTH-PAIR DISCRIMINATORS (same offset, different widt |
-| L29360 | §295 | THE KERNEL-TRAP STUB: §81's jr-DETECTOR WITHOUT A TABLE IS A PsyQ SYSCALL TRAMPOLINE — ROU |
-| L29415 | §296 | THE FRAME CHECK OUTRANKS THE ATLAS LEVER: READ PROLOGUE/EPILOGUE BEFORE DRAFTING ANY C — A |
-| L29458 | §297 | ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX S |
-| L29501 | §298 | THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUP |
-| L29526 | §299 | TWO INDEPENDENT EXTRACTION CHAINS EMIT CONTIGUOUSLY INSIDE ONE EXPRESSION; ONLY A STATEMEN |
-| L29561 | §300 | S61 DISTILL BATCH NOTES (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2 · m0b) |
-| L29630 | §301 | AN INTERNAL `j` CARRIES `R_MIPS_26 .text`: rtu/match_one "MATCH" COULD NOT SEE WHICH LABEL |
-| L29678 | §302 | A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO |
-| L29722 | §303 | MODULE ISLAND TABLES: DERIVE THE PADS AT BUILD TIME, PEEL NOTHING — THE §154-A/§260 "islan |
-| L29758 | §304 | SELF-DEFINING RODATA: WHEN A FUNCTION'S `.s` IS THE ONLY OWNER OF THE DATA IT REFERENCES,  |
-| L29781 | §305 | "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE  |
-| L29833 | §306 | A HAZARD `nop` IN FRONT OF A DIV-RESULT STORE IS A STATEMENT-ORDER DEFECT: THE INDEPENDENT |
-| L29860 | §306a | T4 DISTILL ADDENDA (P31 S62; four byte-proven refinements to existing laws, verified again |
-| L29898 | §307 | THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHED |
-| L29942 | §308 | A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if |
-| L29971 | §308a | A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j`  |
-| L30005 | §309 | A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD |
-| L30045 | §310 | A TWO-OPERAND `subu`'s DESTINATION TIES ONLY TO THE OPERAND THAT IS BLOCK-LOCAL: SHARE *ON |
-| L30076 | §311 | A JOIN-BLOCK STORE CAN SWALLOW AN ARM'S LOAD-DELAY `nop`: WHEN ONE ARM'S VALUE COMES FROM  |
+| L2769 | §41a | v3.1: the def-side wall was ~71% TOOL-shaped — the five measured defects + the laws that d |
+| L2824 | §41b | T7 execution: the object-only probe OVER-counts BANKABLE by two link/rodata classes (Phase |
+| L2854 | §41c | T7-M2: the ×134 def-side-wall sweep via per-sibling RE-reconcile (Phase 25, 2026-07-10; 4, |
+| L2873 | §41b | addendum — M4 "reconcile_decls" tier is ALSO a probe over-count: 0/8 mechanical (Phase 25  |
+| L2893 | §41d | `void`→`s32` is NOT always byte-neutral: gate the RAW draft FIRST (Phase 26 session 6, byt |
+| L2915 | §42 | The F-band ≤28 regalloc crack wave: register-pin/DENSITY levers beat the permuter (Phase 2 |
+| L2968 | §42a | addendum — wave 2 (residuals + 29-100 band): iso-MATCH ≠ real-TU bank, the memcpy→struct-a |
+| L3009 | §42b | addendum — wave 3 (Max, 2026-07-10c): THE STALE-OBJECT GATE TRAP + the read-global `&`-cas |
+| L3048 | §42c | addendum — wave 3 (Max orchestrator + CORRECTED Ultracode fan-out, 2026-07-10c): the real- |
+| L3097 | §42d | addendum — wave 4 (rtu_match fan-out over the mapped frontier, 2026-07-10c): 24/26 MATCH,  |
+| L3136 | §42e | propagating a CRACK ×134: the def-finder bug + the byte-drift residual (the "remap-fail" m |
+| L3210 | §43 | The K&R s16-param definition DISSOLVES the "narrow-param wall" for by-value register args  |
+| L3257 | §44 | The Phase-25 cheap-Opus giant batch: 5 structural levers + the §43 extension (2026-07-11,  |
+| L3313 | §45 | The flagship `func_80133CD4` crack (399 ins ×134): the merged-variable permutation-breaker |
+| L3328 | §46 | The `func_80178D40` crack (890 ins ×134, the heaviest core in the game): four LOOP-STRUCTU |
+| L3380 | §47 | The live-length SLIDER: splitting a global.c allocno-priority TIE with one zero-byte asm ( |
+| L3420 | §48 | The 12-core jr crack wave: the ALLOCNO-PRICING dials and the EBB rule (Phase 26 session 8, |
+| L3428 | §3-A. | ALLOCNO-PRICING DIALS — move a value into the register you want, byte-neutrally |
+| L3459 | §3-A4 | SINK THE CONSUMER CALL INTO THE ARMS (the inverse of A1; `func_8016AB6C`, byte-proven) |
+| L3483 | §3-B. | THE EBB RULE — the general form of §46-L2 |
+| L3499 | §3-C. | TYPE- AND SHAPE-DRIVEN CODEGEN (the C type literally selects the addressing mode) |
+| L3523 | §3-D. | THE CROSS-JUMP RATCHET (the sharpest new trap — `func_80131340` L-C) |
+| L3533 | §3-E. | Meta |
+| L3542 | §49 | The LUID DIAL: a zero-byte SCHEDULING dial (the sched.c analogue of §47) — `func_8017A4AC` |
+| L3591 | §50 | Refinements that BOUND §47/§48 (from the `func_80135EB0` wall, 21→6; Phase 26 session 8) |
+| L3645 | §51 | TOOLING INTEGRITY: the silent skip, and how to hunt it |
+| L3651 | §51a | The bug class |
+| L3667 | §51b | Why the byte-gate cannot save you |
+| L3677 | §51c | THE METHOD (do not audit by reading the regex) |
+| L3692 | §51d | THE LAWS |
+| L3754 | §51e | The false-wall pipeline (why this is not just hygiene) |
+| L3770 | §51f | Checklist for any new corpus-scanning tool |
+| L3784 | §51g | When the thing you are scanning has a GRAMMAR, parse the grammar (`tools/cdecl.py`) |
+| L3928 | §52 | The WALKER-FAMILY skeleton: 6 regalloc-order levers + a deeply-characterized intrinsic wal |
+| L3939 | §3-The | 6 levers (the "walker-family skeleton" — apply to the 12 siblings; levers 1-5 retire ~half |
+| L3960 | §3-Why | the wall is (probably) intrinsic |
+| L3974 | §52a | The regalloc sibling wave: new levers + two new wall classes (cheap-Opus applying §52, 202 |
+| L4012 | §52b | Sibling wave 2: more de-pin levers, a third wall class, and the match_one→whole-binary gap |
+| L4043 | §53 | SWEEP A FAMILY WITH THE TOOL ITS EXEMPLAR NEEDED: the jr/switch carve, and how omitting it |
+| L4048 | §3-The | case |
+| L4060 | §3-Why | 0/8 was structural, and predictable from two words |
+| L4077 | §3-The | rule |
+| L4093 | §3-The | meta-lesson (R35, and why this one is expensive) |
+| L4108 | §55 | Core-crack wave levers + the GATE-ORCHESTRATION law (Phase 29 T3, 13-agent ultracode wave, |
+| L4113 | §55a | New byte-proven levers (each from a banked or near draft) |
+| L4137 | §55b | THE GATE-ORCHESTRATION LAW (3 traps, ~3.5h lost; all recovered, 0 data lost) |
+| L4156 | §55c | Sizing the propagate: a TARGETED propagate is ~4 min/core, and "it's slow" was a BROKEN-TR |
+| L4178 | §54 | `--fix-def-sig`: the member's CANONICAL DECLARATION is a build step too (tiny-IMM mega-poo |
+| L4202 | §56 | Banking a hand-drafted GIANT into its exemplar TU: self-contained draft vs live-TU decls,  |
+| L4247 | §56b | PROPAGATING an h_seq giant: the exemplar's externs MUST be fleet-canonical, not the draft' |
+| L4271 | §57 | The SELF-decl normalize: the sibling's OWN caller declares the templated fn divergently (t |
+| L4318 | §57a | Two NSD corrections + the SURGICAL-ONLY law + the honest broad-sweep yield (Phase 29, 2026 |
+| L4358 | §58 | match_one MATCH ≠ BANK: the four blind spots + the crack-wave reconcile-before-bank law (P |
+| L4392 | §59 | Three h_seq sweep-residual classes match_one/the-exemplar-bank don't reveal (Phase 29 crac |
+| L4422 | §60 | Classify the residual, don't rank it: the deterministic residual→class classifier and what |
+| L4446 | What | it measured — the whole open backlog, byte-grounded |
+| L4465 | §3-Two | corollaries worth remembering |
+| L4478 | §3-The | parallel-probe race this surfaced |
+| L4487 | §60a | What the first DIRECTED grinder run exposed (Phase 29 Task-13B, 2026-07-21) |
+| L4525 | §60b | The plateau autopsy's verdict: a `partial` drift is a WRONG DRAFT, not a missing transform |
+| L4560 | §61 | Task 14: the gate ladder's missing stage is the ARITY pre-pass, and it is TU-side not draf |
+| L4621 | §61a | The Task-5 wave: 11/12 MATCH, 0 banked — three DISTINCT integration walls, each now named  |
+| L4673 | §61b | The jtbl gate stage: built, and the ORDERING law it exposed (Phase 29 Task-14 stage 4, 202 |
+| L4728 | §61c | The jtbl bank is INCREMENTALLY valid and CLEAN-INVALID (Phase 29, 2026-07-21) — the blocki |
+| L4794 | §61d | The undo was eating the tree: two tools, one defect, invisible to the byte-gate (Phase 29, |
+| L4848 | §62 | The jtbl RECONCILE must also follow the carve: the post-carve draft reconcile (`harvest_ve |
+| L4892 | §63 | The fresh-138 DEF-SIDE blocker: fix the HEADER decl, not the draft (`fix_header_decl.py`,  |
+| L4923 | §64 | The §20 type-lift's three laws: fold the tagged typedef, check VISIBILITY, and strip only  |
+| L4972 | §64a | VARIANT types: UNIQUIFY the camps, do not reconcile them (`uniquify_type.py`, Phase 29 SES |
+| L5015 | §63 | UPDATE (Phase 29 SESSION-14) — `fix_header_decl`'s "SAFE" verdict is FLEET-BLIND; it MUST  |
+| L5030 | §65 | The stranded-draft recovery: BLAST-RADIUS TIERS, and the per-overlay de-macroize that refu |
+| L5045 | §65a | The blast-radius taxonomy (makes §61's law structural instead of remembered) |
+| L5060 | §65b | The escape: de-macroize the instantiation, don't touch the shared header |
+| L5096 | §65c | `rtu_match` MATCH → bank held 13/13 on self-decl, but broke on the FIRST callee-decl case |
+| L5106 | §65d | Existing-ladder baseline, measured (do this before building a recovery stage) |
+| L5116 | §65e | Two oracles, and the disagreement is the finding (R34 in practice) |
+| L5133 | §65f | The de-macroize lever's BOUNDARY, measured: byte-neutral 14 times of 15, and the 15th is w |
+| L5154 | §65g | Where the cheap levers STOP: the local-type and in-TU-self-decl classes did not yield |
+| L5174 | §66 | Exercise a banking driver's SUCCESS path before pointing it at a wave: the free re-bank te |
+| L5196 | §66a | The widest write in a pipeline is the one most likely to be UNDECLARED |
+| L5215 | §66b | A metric parsed out of another tool's prose goes NULL silently when the label changes |
+| L5232 | §66c | Before a wave, verify the FUEL exists; an "already attempted" set built from the wrong dir |
+| L5260 | §66d | The permuter⇄reader loop: alternate a random search with a byte-verified idiom, and let `r |
+| L5295 | §66d-1 | What transfers between giants is the LOOP, not the PIN |
+| L5304 | §66d-2 | Two operational sharp edges |
+| L5315 | §66d-3 | Read the ILS per-cycle SERIES, not its final best: a repeated score and a still-falling on |
+| L5330 | §67 | The arg-copy PLACEMENT lever: launder a parameter into a fresh pseudo AT the statement whe |
+| L5420 | §67a | Run the symbol-set guard BEFORE you pay for a gate (`tools/symcheck.py`, Phase 29 SESSION- |
+| L5453 | §66d-4 | "ILS converged" means converged FOR THAT WEIGHT PROFILE, not a floor (amends §66d-3; Phase |
+| L5506 | §66d-5 | `residual_class`'s "structural ⇒ permuter CPU is waste" is WRONG for schedule permutations |
+| L5539 | §68 | A comment-only line halted the extern scan, and the skip label blamed the type cap (Phase  |
+| L5584 | §69 | How to attack a behemoth: map it, don't draft it (Phase 29 SESSION-18, `func_80183814`, 5, |
+| L5634 | §70 | The giv-init base register: walk the PARAMETER, not a copy of it (Phase 29 SESSION-18, `fu |
+| L5675 | §71 | Before mapping a giant, look for an already-matched SIBLING beside it (Phase 29 SESSION-18 |
+| L5741 | §72 | A `register __asm__` pin is a PREFERENCE, not a reservation (Phase 29 SESSION-18, `func_80 |
+| L5765 | §3-The | honest fix was source-level and cheap |
+| L5775 | §3-Giv | record order (the §70 family) |
+| L5781 | What | is left, and what is byte-recorded as SPENT |
+| L5798 | §73 | A def-side self-decl conflict has TWO axes: RETURN (fleet widen, T2) and PARAMS (casts at  |
+| L5837 | §74 | Auditing a pinned draft: the §72 hazard is CALLER-SAVED pins spanning a call, and only the |
+| L5881 | §75 | A propagation cap is usually a MINORITY-SPELLING SOURCE OVERLAY, not a wall: census the ca |
+| L5940 | §75a | The exclusion classes, enumerated with named causes (Phase 29 SESSION-19, the 134-binary ` |
+| L5963 | §75b | A body's preamble can carry `#define`s, not just `extern`s; extraction lifts only the exte |
+| L6012 | §75c | Class-B's remedy is the FULL §17a-1 PAIR (decl **and** call-site cast); a decl-only fix mo |
+| L6043 | §76 | The allocno CLASS (local vs global) is the dominant regalloc lever, and C reaches it ONLY  |
+| L6052 | §3-The | mechanism, with citations |
+| L6072 | §3-The | attribution primitive (use this before calling anything a scheduling residual) |
+| L6079 | §3-Two | diagnosis traps this function proved |
+| L6089 | Practice | Practice |
+| L6099 | §77 | Every extraction tool carries a NARROW hard-coded preamble set; anything outside it silent |
+| L6139 | §3-The | CANDIDATE gate and the REAL gate need DIFFERENT preambles — keep the difference out of the |
+| L6189 | §78 | A LENGTH drift can be a register grant in disguise; and `fold` never leaves a literal firs |
+| L6195 | §3-The | drift was an allocation decision, not missing code |
+| L6226 | §3-The | economics |
+| L6235 | §79 | For a 0-callee giant, fingerprint by DATA symbols (§71 cannot fire); and the STACK-SLOT OR |
+| L6241 | §71 | has a blind spot, and this is it |
+| L6255 | §3-NEW | LEVER — the frame layout reads back the original declaration order |
+| L6266 | §76 | confirmed at scale, and a pin nuance |
+| L6275 | §3-The | residual, and the honest read |
+| L6285 | §80 | A do-not-re-buy entry is scoped to its BASE, not to the function; and the pin's hidden cos |
+| L6306 | §3-The | pin's hidden cost, with the citation |
+| L6317 | §3-The | flagged "#1 move" LOST — and why the failure is informative |
+| L6327 | §78 | 's attribution primitive, run and reproduced |
+| L6333 | Cold-start | economics, now complete |
+| L6338 | §81 | Banking a jr (jump-table) function: the 3-step carve chain, and why `match_one` cannot see |
+| L6369 | §3-The | defect this exposed: a shared type that is present but invisible |
+| L6385 | §82 | Two source-shape oracles from behemoth #6: a duplicated `addiu $aN,$sp,K` across a `jal` m |
+| L6390 | §3-1. | The inlined-helper signature |
+| L6404 | §3-2. | Scalar vs aggregate decides *when* the slot is allocated |
+| L6416 | Also | reproduced on this function |
+| L6420 | §3-And | the banking footnote (§75a class A, one line) |
+| L6427 | §83 | The parameterised-repeat law, the spill-area trap, and why a per-case edit cannot move a p |
+| L6434 | §83a | READ THE HEADLINE NUMBER CORRECTLY: a LENGTH drift makes `match_one`'s count meaningless |
+| L6442 | §83b | THE LEVER: find the parameterised REPEAT before decoding case-by-case |
+| L6460 | §83c | TRAP: a "dead local" in a prior draft may be gcc's OWN spill area |
+| L6467 | §83d | CSE's quantity budget is WHOLE-FUNCTION, so a local rewrite cannot fix a local symptom |
+| L6481 | §83e | §80 vindicated again, on the same day it was written |
+| L6487 | §84 | The DERIVED-OFFSET remap bug: a hand-computed literal that encodes the DISTANCE between tw |
+| L6492 | §3-The | construct |
+| L6510 | §3-Why | it survived every candidate gate |
+| L6525 | §3-THE | FIX IS MECHANICAL — the tool already holds the answer |
+| L6533 | Scope | , measured (do not over-generalise — §80) |
+| L6543 | §3-Two | ladder lessons banked with it |
+| L6554 | §85 | The RETURN-axis fleet widen is ALL-OR-NOTHING: widening the shared header alone guarantees |
+| L6559 | §3-The | conflict |
+| L6567 | §3-THE | FAILURE MODE — widening only `engine_core.h` is worse than not starting |
+| L6574 | §3-The | precondition, and how to check it in one grep |
+| L6582 | §3-Do | the WHOLE axis in one edit, then R22 once |
+| L6591 | Reading | , for the next person |
+| L6604 | §86 | Pinned-exemplar templatability is a PER-FAMILY property, not a per-member rate; and the §4 |
+| L6606 | §3-The | guard refuses a class that largely works |
+| L6615 | §3-THE | LAW: all-or-nothing PER FAMILY |
+| L6642 | §3-Why | the two live families differ from the three dead ones — the open question |
+| L6648 | §87 | `match_one` COMPILES but never LINKS, so an unresolvable data symbol reads as MATCH; and s |
+| L6664 | §3-The | blindness ladder, now complete — FOUR classes `match_one` cannot see |
+| L6674 | Consequence | for the backlog ledger |
+| L6681 | §3-The | cheap discriminator, before spending a sweep |
+| L6689 | §88 | `cross_jump` will not merge a common suffix containing a CALL; and §78 is scoped to ORDERE |
+| L6694 | §88a | repeated CALL-shaped blocks are left UNMERGED; call-free tails are merged for you |
+| L6701 | §88b | the `slti` literal-position law (extends §78 to comparisons) |
+| L6716 | §88d | BANKING ORDER: run the §81 carve chain BEFORE banking, never after |
+| L6723 | §88e | a wrong diagnosis, refuted properly (the model for how to treat an inherited lever) |
+| L6733 | §88f | the missing rung: a RELOCATION gate between `match_one` and the binary |
+| L6741 | §89 | Two throughput rules the project already had written down and was not following (Phase 29  |
+| L6747 | §89a | MEASURE the write set; do not assert its tier (`tools/blast_radius.py`) |
+| L6760 | §89b | the parallel gate farm existed; the family path could not reach it (`tools/sweep_parallel. |
+| L6773 | §3-The | standing sequence |
+| L6781 | §90 | Five tool-integrity laws from one session, each of which changed an answer (Phase 29 SESSI |
+| L6787 | §90a | A comparison tool MUST share its reference oracle's index space, exactly |
+| L6804 | §90b | "Byte-neutral" is not "wanted": undo on the SUCCESS path too |
+| L6814 | §90c | A library-callable function must FAIL CLOSED on an unconfigured module |
+| L6825 | §90d | Do not measure a live wave's drafts (§87 in real time) |
+| L6833 | §90e | An agent's CONCLUSION and its EVIDENCE fail independently — re-derive the premise, not the |
+| L6857 | §91 | A structure-TRANSFER is only valid where the structure corresponds: the `--like` role trap |
+| L6886 | §3-The | three-hypothesis trail, because two of them were wrong and the wrongness is instructive |
+| L6906 | §92 | Conforming a DECLARATION: pointer changes are caller-neutral, scalar-WIDTH changes are not |
+| L6937 | §93 | `set -o pipefail` attributes a pipeline failure to the LAST stage, not the failing one (Ph |
+| L6962 | §94 | A family sweep's `0/N` is a TYPE-CARRY failure until proven otherwise: lift the exemplar's |
+| L6998 | §95 | `reconcile_tu` dropped the SIBLING declarators of a multi-symbol `extern` line (Phase 29 S |
+| L7033 | §96 | The same rewrite, one shape down: `reconcile_tu` matched statements to lines by TEXT, so e |
+| L7081 | §97 | The gate's own tree hygiene: a refused carve, an unchecked recovery, and a snapshot that c |
+| L7128 | §98 | `conform_decls` had three defects, and only the third needed R22 to find (Phase 29 SESSION |
+| L7182 | §99 | The narrow-param wall is a DEF-side problem with a ZERO-blast-radius fix: convert the defi |
+| L7205 | §3-Two | `reconcile_tu` bugs found underneath, one introduced while fixing the other |
+| L7231 | §100 | Prefer the DRAFT-LOCAL fix: a type only one function uses belongs in its BODY, not in a sh |
+| L7260 | §101 | The STALE DEFAULT class: a guard whose cause was removed is a silent skip wearing a safety |
+| L7287 | §102 | A PLUMBING verdict can MASK a DIFF; and K&R is not always a codegen change (Phase 29 SESSI |
+| L7322 | §103 | A FILE-scope `extern` in a shared overlay TU is a GLOBAL constraint on every LATER functio |
+| L7410 | §104 | Two silent-skip defects in one scan: match on MASKED text, emit from the ORIGINAL (Phase 2 |
+| L7446 | §105 | A gate's revert must survive an EXCEPTION, not just a failure (Phase 29 T53, `jtbl_family_ |
+| L7485 | §106 | Persist the MEASUREMENT, derive the POLICY: a stored route let a stale file out-vote the l |
+| L7528 | §107 | A lever wired into ONE gate path is a lever most families cannot reach (Phase 29 T56, `fun |
+| L7566 | §108 | Diagnosing a family `0/N`: the four causes, and the third opt-in lever (Phase 29 T59) |
+| L7615 | §109 | Conforming a definition to a shared header: fix the NAMES, then check the RETURN precondit |
+| L7655 | §110 | A unit must define exactly ONE function, and "ends in `;`" does not tell you which line de |
+| L7696 | §111 | The distinct-code metric is not noisy: a family pays it only if its members are byte-VARIA |
+| L7745 | §112 | A macro-scoped declaration only collides where the macro is INSTANTIATED (Phase 29 T67/T69 |
+| L7791 | §113 | An ARITY blocker only exists if the macro CALLS the function; an address-taken use has no  |
+| L7823 | §114 | The THIRD decl axis: a CALLEE the draft declares differently from the target TU (Phase 29  |
+| L7865 | §115 | A `func_XXXXXXXX` predicate rots by design: the same name-form assumption in THREE places  |
+| L7892 | §116 | Optimization level is a property of the FILE, not the function: read a family 0/N against  |
+| L7910 | §3-The | fix moves the DEFINITION, not the stub — and here is why the obvious shortcut fails |
+| L7941 | §117 | Spell the sibling's symbol from the SIBLING's address, not the exemplar's kind (Phase 29 T |
+| L7968 | §3-Why | it survived so long: a MASKED oracle will MATCH a wrong symbol |
+| L7978 | §118 | Ordinal (positional) immediate resolution: compare C tokens to the DIFFERING asm uses (Pha |
+| L8012 | §119 | Two levers on the SAME axis, opposite directions: test the off-diagonal (Phase 29 T89) |
+| L8041 | §120 | Uniquify draft-defined TYPE names; and check which of N staging sites you actually patched |
+| L8052 | §3-Do | NOT "strip the duplicate typedef" — it breaks the extern that uses it |
+| L8058 | §3-The | wiring trap that cost two attempts |
+| L8076 | §121 | Synthesise externs for macro-DEFINED callees from the macro's own definition head (Phase 2 |
+| L8099 | §122 | GATE RAW BEFORE TRANSFORMING; the undo belongs to the WRITER, as a per-edit journal (P30 T |
+| L8131 | §123 | PROPAGATE A FAMILY WITH THE TOOL ITS TIER NEEDS: `dedup_propagate` is h_exact-only; its re |
+| L8168 | §124 | A "not matched" verdict can mean the definition is there under a DIFFERENT C NAME: the asm |
+| L8213 | §124a | a family sweep's `0 matched-exemplar families` may be a FILTER, not a wall |
+| L8221 | §125 | Split the CARVE from the BODY before calling a jr residue a wall — and measure it by SHA f |
+| L8228 | §3-The | method (keep this) |
+| L8238 | §3-The | instrument rules that make its answer trustworthy (this is where I failed) |
+| L8253 | §3-The | corrected results (each SHA-verified, from a clean tree, restore re-verified) |
+| L8263 | §3-Two | further notes worth keeping |
+| L8272 | §3-The | meta-lesson |
+| L8279 | §126 | The carve-within-a-carve: an ADDRESS RANGE is not an OPTIMIZATION REGION (P30 T2, byte-pro |
+| L8294 | §3-The | finding: opt level is per FILE, so the file's contents must be opt-HOMOGENEOUS |
+| L8305 | §3-The | instrument trap that hid it (and it is §124's shape again) |
+| L8314 | §3-The | mechanics |
+| L8332 | §126a | a bare `except: continue` around a coverage-asserting oracle re-creates the silent skip (P |
+| L8364 | §127 | The `-O0` regime: the CONSTANT-OFFSET FOLD, and why `-O0` needs its own idiom set (P30 T3  |
+| L8371 | §3-The | idiom they kept re-deriving: the constant-offset fold |
+| L8382 | §3-The | rest of the `-O0` regime (write PLAIN C, and mean it) |
+| L8392 | §127a | §71 (sibling-first) is the strongest `-O0` lever, and it beats the index |
+| L8401 | §127b | the knowledge was in a SOURCE COMMENT, not the cookbook |
+| L8408 | §128 | A raw NUL in C source makes grep SILENTLY SKIP the file (P30 S28, 137 files) |
+| L8440 | §128a | a negative control must corrupt a SCRATCH COPY, never the tracked file |
+| L8452 | §129 | Post-carve, `rtu_match`/`match_one` COUNT THE JUMP TABLE AS INSTRUCTIONS; and a carve must |
+| L8456 | §129a | the target instruction count is INFLATED after a carve |
+| L8477 | §129b | never commit a carve whose owner is still a stub (it strands the carve) |
+| L8492 | §3-The | real blocker underneath, for the record |
+| L8501 | §130 | An INCREMENTAL build can report BYTE-IDENTICAL for a change the CLEAN build cannot even LI |
+| L8538 | §3-The | diagnostic ladder that finally located it (reusable) |
+| L8548 | §131 | The jtbl OVER-SPAN: `sltiu N` is ground truth in BOTH directions, and the zero-word rule o |
+| L8585 | §132 | The `JR-PAIR-IN-ONE-O0-OBJECT` "wall" was TWO instrument defects: a merged-double span the |
+| L8594 | Defect | 1 — a pre-§8e MERGED DOUBLE is not a single-table predecessor |
+| L8612 | Defect | 2 — `as` writes a corpse and nothing deletes it |
+| L8622 | §3-The | fingerprint, and the 30-second ladder that found it |
+| L8643 | §3-The | transferable rule |
+| L8650 | §132a | `--like` is for a sibling with NO record; against one that HAS a record it over-derives (P |
+| L8675 | §132b | When the span's already-matched owner is ITSELF multi-switch: `--span-rel` (P30 S1, `func_ |
+| L8700 | §133 | The DEFAULT-FILTER class: three times in one session, a tool silently answered a narrower  |
+| L8726 | §134 | MULTI-LINE BLINDNESS: one root cause, four faces, in `family_remap`'s preamble scanner (P3 |
+| L8780 | §135 | Six byte-verified gcc-2.7.2 idioms from the P30 S6f-h waves (and the two-lane wave shape t |
+| L8785 | §3-The | codegen idioms |
+| L8819 | §3-The | integration idioms (these decide whether a byte-correct draft BANKS) |
+| L8834 | §3-The | wave shape that produced these |
+| L8852 | §136 | The LOCAL-VARIABLE lever: how many C locals, at what scope (P30 wave 4a, 25 byte-verified  |
+| L8868 | §3-The | splitting/merging rules (each closed a residual, byte-gated) |
+| L8894 | §3-The | type-form rules |
+| L8927 | §3-The | scheduling rules (refining §135-2 and §135-4) |
+| L8956 | §3-The | declaration surface (integration, not codegen) |
+| L8968 | Wave | economics (measured, for the next batch's sizing) |
+| L8991 | §136a | Blocker capture: classify on the OUTPUT, never on the exit status |
+| L9048 | §136b | A prior wave's "genuine byte-DIFF" verdict is NOT reliable evidence (4 of 4 refuted) |
+| L9084 | §136c | SIBLING-FIRST is a DERIVATION shortcut, not just a conflict fix (the fastest route in a fa |
+| L9109 | §136d | Four gcc-2.7.2 levers the redraft lane found (each closed a residual no other lever moved) |
+| L9153 | §136e | §136c's PRECONDITION, and two more symptom keys (wave 4b batch 3) |
+| L9201 | §136f | Two declaration sub-cases the reconcile lane surfaced (lane now 15/15 lifetime) |
+| L9226 | §136g | When the index points at the WRONG lever: two byte-refuted routings (func_801863B4) |
+| L9255 | §136h | CORRECTION: the zero-crack pool does NOT "refill with cheap work" (my error, byte-measured |
+| L9285 | §136i | The drafter model LADDER: Haiku → **Sonnet** → Opus → Fable5 (Drew, 2026-08-03) |
+| L9317 | §136j | The failure MIX flips with function size (measured across four bands, one session) |
+| L9359 | §137 | REGALLOC-PERM is a TWO-COMPILE ARITHMETIC PROBLEM, not a permuter job |
+| L9401 | §137a | A gate verdict has a TIMESTAMP; re-check it against the draft's mtime |
+| L9430 | §138 | The propagation lanes: a gate refusal is a DECLARATION, and which lever you owe depends on |
+| L9436 | §3-The | triage, cheapest first |
+| L9488 | §3-The | DEFINITION-side alias is the only escape when the fleet canon disagrees on a promoting par |
+| L9496 | Rank | the lane by measured concentration, not by class count |
+| L9505 | THREE | carry variants hide in one "CARRY-FIXABLE" bucket — and they need different fixes |
+| L9541 | §134 | again, in a second tool — and the waiter rule corrected |
+| L9561 | STEP | 0 of sibling-first: grep `src/` for a distinctive LITERAL from the `.s` |
+| L9580 | Reconciling | a gate-refused draft: which way you edit depends on WHERE the TU's decl is |
+| L9609 | §139 | A GATE THAT GREPS FOR VERDICTS MUST ASSERT 1:1 ACCOUNTING; and a `--src` filter must not s |
+| L9641 | §3-The | generalisation — three corollaries worth more than the bug |
+| L9658 | §3-And | the inverse-lookup trap, same session |
+| L9675 | §140 | A METRIC IS NOT A MEASUREMENT UNTIL IT IS REPRODUCIBLE FROM THE COMMITTED TREE (P30 S1e: a |
+| L9695 | §3-The | three-line proof (do this before diagnosing any metric movement) |
+| L9704 | §3-The | two instrument defects it exposed |
+| L9724 | §3-The | same swallow, twice more, in the integration spine |
+| L9735 | §3-Two | wrong mechanisms I chased first, and why they were wrong |
+| L9755 | §141 | The §134 class is CLOSED: every line-shape decision now routes through `cdecl._mask` (P30  |
+| L9793 | §142 | An open stub whose `h_exact` class is MATCHED elsewhere is FREE. Propagate the body; do no |
+| L9805 | §3-The | measurement (do this before any wave; it is ~20 lines and needs no builds) |
+| L9820 | §3-The | trap that hid it — SAME FUNCTION, TWO ROUTES, ONLY ONE IS FREE |
+| L9829 | Route | selection (why `--addr` sometimes says "nothing changed") |
+| L9837 | §3-And | the report-vs-bytes lesson attached to it |
+| L9849 | §143 | `cast_call_sites` read a RETURN STATEMENT as a prototype and deleted it. A 0/39 sweep beca |
+| L9903 | §144 | THE LITERAL'S SPELLING PICKS THE IMMEDIATE ENCODING (P30 S40 wave 1, `func_801822E0`) |
+| L9942 | §145 | Three loop/combine levers from the S40 wave-2 drafters (16/16 match_one) |
+| L9992 | §146 | RE-MEASURE A WALL BEFORE YOU RESPECT IT. Both "permanent" giants fell to drafts already on |
+| L10003 | §3-Why | a correct draft can read as an intrinsic wall |
+| L10015 | Then | propagation returned 0/137 TWICE — both times a missing TYPE |
+| L10024 | §3-Two | errors of mine, both instructive |
+| L10038 | §3-The | rule |
+| L10051 | §147 | The three-stratum FRAME LAW, and four "stop searching" verdicts (P30 S42, `func_8017C294`, |
+| L10056 | §3-A. | The frame has THREE strata, and stratum 3 is unreachable from C |
+| L10072 | §3-B. | A `?:` on MEMORY operands costs ~16 bytes of invisible frame; on REGISTER operands, zero |
+| L10083 | §3-C. | Inner-block declaration does NOT delay slot allocation — BYTE-REFUTED |
+| L10088 | §3-D. | A lone `$t8`/`$t9` in the target is RELOAD SCRATCH — reproduce the spill, don't pin the re |
+| L10098 | §3-E. | A `qty_compare` TIE is not spelling-reachable — recognise it and stop |
+| L10110 | Consequence | for the family (a real scheduling decision) |
+| L10160 | §148 | The loop.c hoisting THRESHOLD is arithmetic you can compute, and the `?:` clamp that folds |
+| L10166 | §3-A. | `move_movables` hoists iff `threshold × savings × lifetime ≥ insn_count` — and you can rea |
+| L10185 | §3-B. | `(v < 0x40) ? v : 0x3F` is folded to `MIN_EXPR` and expands to the WRONG SHAPE |
+| L10199 | §3-C. | A zero-byte ALLOCNO-PRIORITY slider |
+| L10209 | §3-D. | Reproduce the original's BUGS verbatim |
+| L10258 | §149 | Four instrument defects in one session, and the two questions they were hiding (P30 S43) |
+| L10264 | §3-A. | A prep step that returns its input on failure is indistinguishable from a search that foun |
+| L10282 | §3-B. | Same address + same name ≠ same body — and the ledger keys on address |
+| L10298 | §3-C. | `make: *** [...] Error N` is a summary, never a diagnosis |
+| L10308 | §3-D. | "Cheap fuel" that was never probed: 0 of 31 templatable |
+| L10327 | §150 | A register ROTATION across symmetric blocks is VARIABLE-IDENTITY evidence, not an allocato |
+| L10334 | §3-The | fix |
+| L10344 | §3-The | method that found it (this is the transferable part) |
+| L10360 | §3-Two | corrections to the record |
+| L10371 | Diagnostic | order (adopt this) |
+| L10382 | §151 | THE GHOST WEDGE: when a load-before-store transposition is unreachable by ANY statement or |
+| L10387 | §3-The | mechanism (read from cc1's own `-dR` trace, not inferred) |
+| L10402 | §3-The | lever — a zero-emission insn that absorbs the blocked tick |
+| L10410 | §3-The | two fallouts, and how to close them (both measured, in order) |
+| L10422 | When | to reach for it |
+| L10433 | §152 | BYTE SIZE is the family key that name- and h_seq-grouping both miss (P30 S43, the 0xECC fa |
+| L10438 | §3-The | finding |
+| L10447 | §3-The | key |
+| L10458 | §3-Two | cautions that must travel with this technique |
+| L10469 | §3-The | companion defect (open) |
+| L10481 | §153 | THE ADDRESS-REMATERIALISATION LAUNDER: a third zero-emission asm lever (P30 S43, `func_801 |
+| L10489 | Symptom | Symptom |
+| L10494 | Mechanism | (gcc source + RTL dumps, not inferred) |
+| L10501 | What | does NOT work (14 byte-measured probes) |
+| L10507 | §3-The | cure — a fresh launder per site, each in its own block |
+| L10517 | Companion | levers from the same function |
+| L10537 | §154 | Reading a disc payload: the module-id word, static base derivation, and "type 1 = uncompre |
+| L10542 | §3-A. | Payload word0 is a global MODULE ID; code starts after the header |
+| L10551 | §3-B. | Two static base-derivation methods that must AGREE (use both) |
+| L10563 | §3-C. | PAC type 1 = the same payload class as type 4, just NOT compressed |
+| L10573 | §155 | hi/lo literal scanning MUST track base registers (S45) |
+| L10582 | §155a | the same failure class, one level up: SHAPE-blind table scanning (S45 p5) |
+| L10602 | §155b | check the TYPE your oracle returns before comparing against it (S45 p5) |
+| L10625 | §155c | the ZERO-REFERENCE trap: gcc splits a global-array address across the `lui` and the LOAD ( |
+| L10655 | §156 | an ORPHANED reconcile poisons the fleet: `dedup_propagate`'s kept edit (S45 p6/p7) |
+| L10702 | §157 | the cheap-tier size cliff, measured (S45 p6) |
+| L10727 | §158 | The RANGE-EXTENDER: a fourth zero-emission asm lever completes the allocno toolkit (P30 S4 |
+| L10736 | Symptom | Symptom |
+| L10742 | §3-Why | the fork is chained (gcc source, validated insn-by-insn against -dS/-dR dumps) |
+| L10755 | §3-The | method (dump-arithmetic first, then place — no probing) |
+| L10772 | Bonus | facts worth keeping |
+| L10787 | §156 | THE PREFERENCE-DONOR MERGE: cross-region variable reuse is what fills a0-a3, and a call-ar |
+| L10843 | §159 | THE DECLARATION AXIS: conform to byte-truth, and make every guard state its COVERAGE (P30  |
+| L10908 | §160 | THE REACH-15 WAVE HARVEST: an align-1 block move, and the instrument that called it a wall |
+| L10984 | §161 | THE RETRY-WAVE HARVEST: a jump table indexed from zero, and two allocator traps (P30 S47) |
+| L11029 | §162 | S48 WAVE-1 HARVEST (P30, 2026-08-11): the reach-ordered sibling campaign's first 12 target |
+| L11056 | §162a | SHARPENS  *(sharpens §161a, §131, §8a-pad, §129a)* |
+| L11085 | §162b | SHARPENS  *(sharpens §48-A3, §156, §150, §76)* |
+| L11114 | §162d | SHARPENS  *(sharpens §31, §21, §30, §55a)* |
+| L11156 | §162e | NEW |
+| L11158 | §162 | THE LICM PAIR: what makes an address a movable AT ALL, and why the preheader order is the  |
+| L11224 | §162f | SHARPENS  *(sharpens §42d, §41d, §73, §10)* |
+| L11279 | §162g | NEW |
+| L11281 | §162 | CROSS-JUMP DIRECTION: the surviving copy is always the LATER one, so a BACKWARD `j` into a |
+| L11315 | §162h | SHARPENS  *(sharpens §88, §88a, §50-B, §8)* |
+| L11317 | §162 | The cross-jump "CALL veto" is a COUNT law, not a CALL law (BOUNDS §88a; P30 S48, `func_801 |
+| L11383 | §162i | SHARPENS  *(sharpens §135, §21, §42, §32)* |
+| L11408 | §162j | SHARPENS  *(sharpens §25, §136d-1, §48-B, §46-L2)* |
+| L11437 | §162k | SHARPENS  *(sharpens §1-I2, §12, §160d, §21)* |
+| L11500 | §162l | SHARPENS  *(sharpens §48-B, §48-C1, §20, §21)* |
+| L11555 | §162m | SHARPENS  *(sharpens §36, §158, §148, §153)* |
+| L11557 | §158a | THE FIFTH LEVER IS NOT AN ASM: `do { } while (0)` is a REGION ref-multiplier you MINT (P30 |
+| L11564 | §3-The | law |
+| L11575 | Size | it before you write it (§158 step 1-2, applied) |
+| L11596 | §3-The | wrap BOUNDARY is the dial — and it is indiscriminate |
+| L11602 | §3-Not | a pure dial |
+| L11606 | DIAGNOSTIC | TELL — two faces, one law |
+| L11628 | §162n | NEW |
+| L11661 | §162o | SHARPENS  *(sharpens §158, §136-1, §136-6, §79)* |
+| L11720 | §162p | SHARPENS  *(sharpens §48-B, §46-L2, §156, §136d-1)* |
+| L11737 | §162q | SHARPENS  *(sharpens §30, §30a, §135-2, §136-13)* |
+| L11775 | §163 | S48 WAVES 2-3 HARVEST (P30, 2026-08-11/12): the five that were byte-probed and are actiona |
+| L11843 | §163z | THE UNVETTED REMAINDER (do not cite as law; each needs a dedupe pass) |
+| L11863 | §164 | S48 §163z SKEPTIC PASS (P30, 2026-08-12): 190 claims vetted, 82 banked |
+| L12315 | §16Xy | SHARPENS  *(sharpens §136d-3, §37 /s-DEP LATTICE, §135-2, §136-13, §162q)* |
+| L12317 | §3-The | `/s` drop clause is in ALL THREE dependence predicates, so the FIXED-ADDRESS STORE is what |
+| L13651 | §164z | REFUTED CLAIMS: do NOT re-derive these |
+| L13717 | §165 | S48 WAVE-4 HARVEST (P30, 2026-08-12): banked the same day the wave landed |
+| L14368 | §16Z | SHARPENS  *(sharpens §37 "the /s-DEP LATTICE", §136-13, §136-14, §16Xy, §162q, `gcc-2.7.2- |
+| L14370 | §3-The | ADDRESS-CLASS TABLE: which load/store pairs even REACH the `/s` clause (P30 S48 wave 4, `f |
+| L14886 | §165z | REFUTED THIS WAVE: do NOT re-derive |
+| L14930 | §166 | THE DESTINATION-TU ORACLE (P30 S48): the seven-attempt bug that was never codegen |
+| L14986 | §167 | S48 WAVE-5/6 HARVEST (P30, 2026-08-12): the saturation point |
+| L16182 | §167z | REFUTED IN WAVES 5/6: do NOT re-derive |
+| L16239 | §168 | THE COUSIN TIER (P30 S49, 2026-08-12): h_seq's exact-hash brittleness, measured — and the  |
+| L16291 | §169 | THE MICRO-ADAPT LANE (P30 S49): edit a proven body, don't crack a new one |
+| L16338 | §170 | THE A-PROP WORD-DIFF CARD (P30 S49): the lane that had no owner |
+| L16382 | §171 | THE STALE SEED SYMBOL (P30 S50, 2026-08-13): why §170's 91%→57% was never codegen |
+| L16448 | §171a | THE MECHANICAL A-PROP DRAFT (P30 S50): 256 members banked with no agent in the loop |
+| L16498 | §171b | THREE CARRIES THE MECHANICAL DRAFT NEEDS (P30 S50, banking the top-reach families) |
+| L16531 | §172 | THE ORPHAN-SLOT MECHANISM v2 (P30 S50-Max): the complete frame-residue model for gcc-2.7.2 |
+| L16585 | §172a | TWO DECOMPILATION TELLS FROM THE SAME DIG (P30 S50-Max) |
+| L16601 | §172b | THREE MORE TELLS FROM THE GCC READ (P30 S50-Max, banked on Drew's ask) |
+| L16644 | §173 | THE STORED-PLUMBING RECOVERY RECIPE (P31 T6): symfix-first, per-group isolation, and where |
+| L16680 | §174 | THE ADAPT-CARD WAVE RECIPE (P31 waves A/B, 2026-08-14): prevention beats recovery |
+| L16750 | §175 | A CALLER-SAVED REGISTER PIN CAN BE A CORRECTNESS BUG, NOT JUST A SCHEDULING CHOICE (P31 wa |
+| L16775 | §176a | THE VERIFICATION-LAYER LAWS (P31 overnight, 2026-08-15). What each check can and cannot pr |
+| L16815 | §176b | BATCH-GATING MECHANICS (P31): what changes when N drafts land in ONE .c |
+| L16841 | §176d | THE CONFLICT TABLE MUST BE SEEDED FROM THE TU, AND KEYED PER FILE (P31 S52, 2026-08-15) |
+| L16880 | §176e | SYMBOL IDENTITY IS COMPUTABLE OFFLINE (P31 S52): `tools/reloc_identity.py` |
+| L16937 | §176f | THE DECLARATION FORM IS A MATCHING LEVER, SO RECONCILE TOWARD THE FORM THE MATCH NEEDS (P3 |
+| L16968 | §176g | SIZE A WAVE BY INSTRUCTIONS, NOT BY CARDS (P31 S52 — the adopted doctrine) |
+| L17006 | §176h | THE BATCH-SUBSTITUTION HAZARD MAP (P31 S52): seven holes, three wrong fixes, one law |
+| L17014 | §3-A. | The seven under-reporting holes (all in `gate_main`, all the same shape) |
+| L17032 | §3-B. | Typedef handling — the only strategy that survives contact |
+| L17054 | §3-C. | The limit that remains (recorded, not solved) |
+| L17061 | §3-C2. | RECONCILE BEFORE THE FIRST GATE — a parked draft gets HARDER to bank, not easier |
+| L17084 | §3-D. | The measured cost shape, and what to build next |
+| L17102 | §176i | WHAT A STATIC PRE-GATE CHECK CAN AND CANNOT PROVE (P31 S52, wave Q) |
+| L17134 | §176j | STOPPING A WAVE MID-FLIGHT COSTS THE IN-FLIGHT TAIL (and how much is recoverable) |
+| L17160 | §176j-2 | THE REPAIR PASS, MEASURED (do this instead of resuming) |
+| L17180 | §176k | TWO SELECTOR BUGS THAT SILENTLY SHRINK A WAVE |
+| L17197 | §177 | 🔴 THE EPILOGUE RETURN-DELAY SLOT IS DECIDED BY YOUR SAVED-REGISTER SET, NOT BY SCHEDULING |
+| L17254 | §178 | SIX LEVERS MINED FROM THE WAVE-P JOURNALS (P31 S52), each byte-proven and source-cited |
+| L17266 | §3-A. | THE `$0`-ADD OPAQUE COPY defeats `make_regs_eqv` (func_80033398, 93 ins) |
+| L17282 | §3-B. | A `return <const>` IS A PRIORITY-1 HARD-REG SET THE SCHEDULER PLACES FIRST (func_8001BE30, |
+| L17295 | §3-C. | SINGLE-SET TEMPS GET THE BIRTHING BOOST (func_8001D3FC, 196 ins) |
+| L17303 | §3-D. | A NARROW TYPE BLOCKS COPY ELISION (func_8001D3FC — new idiom) |
+| L17310 | §3-E. | THE ZERO-OFFSET ALIAS HOLE (func_80037028, 71 ins) |
+| L17319 | §3-F. | `MEM_IN_STRUCT_P` ASYMMETRY IN `true_dependence` (func_80037144, 124 ins) |
+| L17325 | §3-G. | TWO MODELLING TRAPS THAT COST THESE AGENTS SWEEPS OF HUNDREDS OF COMPILES |
+| L17341 | §179 | IDIOMS MINED FROM THE WAVE P/Q JOURNALS (P31 S52, harvest pass) |
+| L17351 | §179-A | 🔴 A LOOP-WALKED POINTER **PARAMETER** HANDS ITS ARGUMENT REGISTER TO THE GIV (9 byte-proof |
+| L17400 | §179-B | 🔴 THE HAND-WRITTEN-ASM TRANSCRIPTION CHECKLIST (maspsx + masked_diff; 10 byte-proofs) |
+| L17450 | §179-C | 🔴 A FUNCTION WITH NO EPILOGUE (falls into a sibling's shared tail) MUST BE FILE-SCOPE `__a |
+| L17501 | §179-D | `gte_stflg` MUST CLOBBER `"$12"` OR THE WHOLE TEMP FILE ROTATES BY ONE |
+| L17521 | §179-E | A `>2*MAX_MOVE_BYTES` BLOCK COPY IS A **STRUCT ASSIGNMENT**, NOT A HAND LOOP |
+| L17547 | §179-F | PINNING A LOOP-WALKED POINTER IS A TOTAL OFF-SWITCH FOR STRENGTH REDUCTION |
+| L17570 | §179-G | 🟡 A PIN CAN **CREATE** A COMBINE `LOG_LINK` AND DELETE AN `andi` (sixth RC-5 channel, n=1) |
+| L17597 | §179-H | A MID-BODY `.global LABEL` PAIR SLICES A BYTE-COMPARABLE FRAGMENT OUT OF A LARGER ROUTINE |
+| L17620 | Considered | and NOT banked |
+| L17637 | §176c | MAIN (SLUS_007.26) CANNOT BE GATED INCREMENTALLY |
+| L17648 | §176 | SEVEN LEVERS FROM THE P31 OVERNIGHT WAVES (2026-08-15): statement order, false regalloc, a |
+| L17654 | §176-A | "SCHEDULE / DELAY-SLOT / LENGTH-DRIFT ±1" ⇒ check STATEMENT ORDER around the call first |
+| L17678 | §176-B | "REGALLOC-PERM, 1-4 instructions off" ⇒ it is usually NOT register allocation |
+| L17724 | §176-C | 🔴 WALL REFUTATION: a hard-register pin CANNOT schedule around a call, because of a genuine |
+| L17750 | §176-D | CSE-class levers used in reverse (two sharpenings of §153 and cse_expr §2) |
+| L17776 | §176-E | Two cheap source spellings, both cc1-probed |
+| L17798 | §176-F | Misdiagnosis triage: four residual verdicts that were lying |
+| L17815 | What | is NOT banked here |
+| L17828 | §180 | THE LEFTOVER-DRAFT HARVEST: RE-VERIFY WHAT YOU ALREADY HAVE BEFORE DRAFTING ANYTHING NEW |
+| L17857 | §180b | WHAT THE PRE-GATE LADDER ACTUALLY FINDS IN A COLD PILE (the shape of integration debt) |
+| L17876 | §180c | WHEN A BINARY'S MASS BAND IS SPENT, THE FLEET-WIDE DRAW IS STRICTLY BETTER |
+| L17894 | §181 | WHAT A WAVE'S GATE ACTUALLY REJECTS (P31 S53, measured on wave R's 45-draft main pile) |
+| L17895 | Only | ONE of 27 blocked drafts was wrong. The other 26 were correct and unbankable. |
+| L17950 | §182 | §177's HONEST NEGATIVE: the epilogue lever cracked 4 of 16, and the `800c3` cluster held |
+| L17964 | §180d | THE `pgrep` BRACKET TRICK PROTECTS THE PATTERN, NOT THE COMMAND LINE |
+| L17976 | §183 | THE DECLARATION-RECONCILIATION PLAYBOOK (P31 S53, measured on 20 byte-verified drafts) |
+| L17977 | §3-18 | of 20 reconciled while keeping the match. The two that did not are mechanism, not effort. |
+| L18047 | §184 | COMMENT-BLINDNESS IS A DEFECT CLASS, NOT A BUG (P31 S53: three tools, one root cause, one  |
+| L18075 | §185 | EDIT THE SIDE THAT IS CHEAP TO VERIFY, AND CHECK A TU RETYPE AT ITS USE SITES |
+| L18107 | §186 | CROSS-JUMPING RUNS **AFTER** SCHEDULING, SO NO C-LEVEL BARRIER CAN STEER IT |
+| L18128 | §186b | A NO-SAVE 16-BYTE FRAME IN A LEAF FUNCTION MEANS `s16` LOCALS, NOT A HIDDEN CALL |
+| L18136 | §186c | WHERE A VALUE IS LOADED DECIDES WHICH ALLOCATOR OWNS IT, AND THEREFORE ITS REGISTER |
+| L18153 | §187 | 🔴 "SAME SOURCE" IS NOT "SAME OBJECT": THE SDK BUILD AND THE GAME BUILD DISAGREE ON GTE NOP |
+| L18191 | §188 | 🔴 THE `jr $ra` + `addiu $sp` TAIL IS AN **ASSEMBLER** ARTIFACT, NOT A FRAME SHAPE |
+| L18241 | §189 | FIVE COMPILER LAWS MINED FROM THE WAVE R/S JOURNALS (P31 S53), each source-cited and re-de |
+| L18316 | §190 | THREE PRESCRIPTIONS FROM THE SAME HARVEST (weaker evidence than §189, honestly labelled) |
+| L18353 | §191 | WHAT THIS HARVEST DID **NOT** BANK (4 rejected, 4 narrowed) — recorded so it is not re-der |
+| L18375 | §192 | THE PRE-GATE LADDER WAS MAIN-ONLY, AND NOBODY COULD SEE IT (P31 S54) |
+| L18376 | Three | defects in one call path; the overlay slates that carry most of the wave work were being w |
+| L18440 | §193 | THE WAVE-T HARVEST (P31 S54): 71 index_gap reports -> 9 laws, 5 rejected, 61 already-cover |
+| L18457 | §193-A | The wave card ships only OPEN-set pointers and discards the atlas's BANKED one — `exemplar |
+| L18524 | §193-B | A NARROW CAST OF A WIDE PARAMETER COSTS ONE EXTRA INSTRUCTION WHEN ITS STATEMENT SITS AFTE |
+| L18562 | §193-C | gcc-2.7.2 cross_jump merges the SCHEDULED common SUFFIX only — there is no prefix/head mer |
+| L18596 | §193-D | A COMPILER-GENERATED ARGUMENT COPY IS A `optimize_reg_copy_1` TRIGGER: when the pointer's  |
+| L18667 | §193-E | A varying-address (pointer) load is re-emitted once per CSE-LIVE INTERVAL, and naming it i |
+| L18697 | §193-F | §148-A2 — The `threshold -= 3` STAIRCASE: `move_movables` admits a COUNT of invariants, no |
+| L18761 | §193-G | §164-54's "scope to ≥4 arms" bound is byte-wrong — the dispatch-topology oracle goes live  |
+| L18822 | §193-H | A pointer-derived base load `*(s32*)(p+K)` is uncacheable across ANY memory write or call  |
+| L18862 | §193-I | A DECLARED AGGREGATE LOCAL HAS AN 8-BYTE FRAME STRIDE — CEIL(size,8), NOT size. N ARRAYS T |
+| L18921 | §193-REJECTED | what this harvest did NOT bank (recorded so it is not re-derived) |
+| L18948 | §194 | THE WAVE-U HARVEST (P31 S54): 64 index_gap reports -> 14 laws, 5 rejected, 44 already-cove |
+| L18965 | §194-A | A zero-byte scheduling fence goes AFTER the defining statement to make that computation em |
+| L19031 | §194-B | A `addu $rA,$rB,$zero` copy feeding ≥2 `sh` stores is a SECOND, 16-BIT-DECLARED local — th |
+| L19069 | §194-C | A CALLER-SAVED loop counter proves its live range crosses ZERO calls — so it cannot share  |
+| L19132 | §194-D | Declared width of a computed-value local is a sched1 dial (count-neutral) — a replication  |
+| L19173 | §194-E | The wave card's `exemplar` is the TARGET ITSELF on 42/73 wave-U and 36/71 wave-T cards — a |
+| L19210 | §194-F | `if ((*p = v = f()) == 0)` is an expand-time pseudo SPLITTER (store_expr's `want_value &&  |
+| L19283 | §194-G | Reading the integer half of a 16.16 stack aggregate: REGISTER-LIVENESS, not the C spelling |
+| L19326 | §194-H | §164-29's WAR fence runs again at SCHED2 ON HARD REGISTERS: an in-place `v &= K` before a  |
+| L19364 | §194-I | §16N+2's magic-per-odd-part ladder has exactly one broken row — read the divisor arithmeti |
+| L19407 | §194-J | Back-to-back identical stores: flow.c's `last_mem_set` deletes the first, and only `volati |
+| L19459 | §194-K | Blind sched1's alias oracle with a second SET of a pointer pseudo — the first zero-byte, n |
+| L19537 | §194-L | §88b and §189-E are BOTH half-wrong, but not the way the candidate says: the compare-const |
+| L19585 | §194-M | A STORE in a CONDITIONAL branch's delay slot proves its C statement DOMINATES the branch — |
+| L19643 | §194-N | §193-D's C dial is misstated: the lever is a SURVIVING CODE_LABEL (a label with a real inc |
+| L19703 | §194-REJECTED | what this harvest did NOT bank (recorded so it is not re-derived) |
+| L19724 | §195 | THE WAVE-V HARVEST (P31 S54): 67 index_gap reports -> 14 laws, 9 rejected, 76 already-cove |
+| L19738 | §195-A | §167-08's "an $aN READ before the jal is scratch" has a byte-proven FALSE-NEGATIVE class:  |
+| L19809 | §195-B | A CALL_INSN does not start a basic block in gcc-2.7.2 — so a call-crossing temp can be a L |
+| L19851 | §195-C | A call-argument `%hi/%lo` pair sitting at the block head, far above its `jal`, is a load-d |
+| L19899 | §195-D | §195 — `masked_diff.mask_for` returns 0 for EVERY `j`/`jal` word, so an internal `j` desti |
+| L19967 | §195-E | A 0/1 materialised at a JOIN immediately before the controlling `beqz`/`bnez` proves the s |
+| L20025 | §195-F | fold-const.c:4825 canonicalises a `?:` whose THEN arm is zero (or constant against a non-c |
+| L20077 | §195-G | §NEW — TWO ARMS CALLING THE SAME CALLEE MERGE INTO ONE `jal` UNLESS EACH ARM'S OWN CODE CO |
+| L20125 | §195-H | §165-27g — ON A FIXED-SYMBOL GLOBAL, `extern T D[];` + `D[0]` IS THE CSE RELOAD DIAL, AT Z |
+| L20172 | §195-I | §145(b) AMENDED — the pointer-bump `addiu` is saved by cse, not combine: ANY second SET of |
+| L20237 | §195-J | GTE / PsyQ op CALL-vs-INLINE is a PER-SITE SOURCE FACT, not a TU style — both forms coexis |
+| L20281 | §195-K | At -O2 the §18 array-of-struct lever is a FRAME lever, not a length lever — but only when  |
+| L20333 | §195-L | The cse store-re-seed does not cross a JOIN LABEL: per-arm stores + a join read keep the r |
+| L20385 | §195-M | Frame `vars` is a SEQUENTIAL bump-allocation, not a flat sum: §193-I's CEIL(aggregate,8) t |
+| L20434 | §195-N | In a call-bearing chain of N≥2 `if (f(...)) return 1;` tests closed by `return 0;`, the LA |
+| L20481 | §195-REJECTED | what this harvest did NOT bank (recorded so it is not re-derived) |
+| L20527 | §196 | PUT ON THE CARD WHAT THE TREE ALREADY KNOWS: the fleet's declaration consensus (P31 S54) |
+| L20582 | §197 | THE WAVE-W HARVEST (P31 S54): 68 index_gap reports -> 4 laws, 3 rejected, 41 already-cover |
+| L20596 | §197-A | A NARROW SIGNED MEMORY READ FEEDING A CONSTANT `>>` LOSES ITS `lh`, AND THE CURE IS AN ASM |
+| L20634 | §197-B | A REPEATED COMPARE OF ONE VALUE AGAINST ONE CONSTANT IS DELETED BY cse's `qty_comparison_c |
+| L20662 | §197-C | Fix A1 (operand order) cannot move a commutative destination whose .greg conflict set alre |
+| L20707 | §197-REJECTED | §197-REJECTED |
+| L20722 | §199 | THE WAVE-X HARVEST (P31 S54/S55): 63 index_gap reports -> 7 laws, 2 rejected, 56 already-c |
+| L20733 | §199-A | §189-A's asm→source inference is byte-FALSE: an interloper between a split constant's `lui |
+| L20782 | §199-B | A permutation sweep that holds ANY statement fixed is not a sweep: the statement an agent  |
+| L20827 | §199-C | A NEGATIVE CONSTANT MULTIPLY ALWAYS TAKES expmed's negate_variant — but whether you ever S |
+| L20875 | §199-D | A narrow UNSIGNED value compared in an ordered `if` emits `sltiu`/`sltu`; the only dial is |
+| L20935 | §199-E | §189-A BOUNDED AND CORRECTED — the discriminator is INSN_PRIORITY, not "is the interloper  |
+| L20994 | §199-F | §164-36b — THE TARGET-HEAD FENCE IS A DELAY-SLOT THREAD SELECTOR, AND IT ONLY FIRES WHEN ` |
+| L21048 | §199-G | At TWO case nodes the switch-vs-if oracle is not blind — but the tell is ALL tests positiv |
+| L21103 | §199-REJECTED | §199-REJECTED |
+| L21114 | §200 | THE ALIAS IS THE UNIVERSAL DECLARATION ESCAPE: stop negotiating with the TU's spelling (P3 |
+| L21163 | §201 | THE WAVE-Y HARVEST (P31 S55): 67 gap reports -> 5 laws, 8 rejected, 53 already-covered |
+| L21173 | §201-A | §150-B applies to `decl_prior`'s DEF row: for an overlay-window symbol the banked "definit |
+| L21205 | §201-B | In a narrowed PLUS/MINUS/AND/IOR/XOR expression the destination pointee is INERT — the sig |
+| L21285 | §201-C | §X — A CALL'S OWN DELAY SLOT AND THE UPSTREAM CONDITIONAL BRANCH'S SLOT COMPETE FOR ONE IN |
+| L21336 | §201-D | THE SIGNEDNESS OF A div/mod MAGIC IS DECIDED BY THE STATIC TYPE OF THE DIVIDEND TREE AFTER |
+| L21383 | §201-E | §194-J-2 — The `last_mem_set` deletion window is measured in SOURCE/expand order, not in t |
+| L21439 | §201-REJECTED | eight, the session's highest |
+| L21464 | §202 | THE ALIAS CARRIES A DEFINITION, NOT JUST A DECLARATION: the DEF-SIDE-RETURN wall (P31 S56) |
+| L21501 | §203 | A DEDUPED TYPEDEF MUST PRECEDE EVERY SPLICE POINT, NOT JUST ITS OWN (P31 S56) |
+| L21562 | §204 | THE WAVE-Z HARVEST (P31 S56): 82 gap reports -> 5 laws, 16 rejected, 30 already-covered |
+| L21581 | §204-A | A COMPARE THAT APPEARS BOTH IN A BRANCH'S DELAY SLOT AND AGAIN ON THE FALL-THROUGH IS A JO |
+| L21656 | §204-B | A LOOP COUNT THAT ARRIVES ON THE STACK IS DECREMENTED IN PLACE: a fresh counter local can  |
+| L21720 | §204-C | WHEN A LOCAL BUFFER'S ADDRESS IS PASSED TO A CALL, ITS SIZE IS A FACT ABOUT THE CALLEE'S B |
+| L21778 | §204-D | A LOOP-INVARIANT LOAD IS ADMITTED AS A MOVABLE ONLY IF ITS ADDRESS CANNOT TRAP: `local.fie |
+| L21853 | §204-E | `decl_prior`'s `%hi/%lo` ARM HAS NEVER FIRED: the card's promised GLOBAL-TYPE row is 0 of  |
+| L21905 | §204-CONFIRMED | 30 reports that the index already answered |
+| L21999 | §204-REJECTED | sixteen, twice the previous record |
+| L22072 | §205 | THE CHAINED ASSIGNMENT IS ITS OWN SCHEDULING DIAL: `*b = *a = v;` moves an argument copy t |
+| L22127 | §206 | THE JTBL-CARVE DRAFTING IDIOM: the bounds check is the entry count, and an EMPTY case owns |
+| L22196 | §207 | THE WAVE ab–ag HARVEST (P31 S58): 278 byte-banked notes → 25 laws, 103 self-reported no-ga |
+| L22217 | §208 | TWO NAMED LOCALS FOR ONE RELOADED EXPRESSION BUY TWO ALLOCNOS — the naming granularity own |
+| L22266 | §209 | THE NARROW LOCAL IS A DIAL IN TWO OPPOSITE DIRECTIONS, AND §194-B's "≥2 `sh` STORES" BOUND |
+| L22343 | §210 | THE SINGLE-BIT MASK IN A BOOLEAN TAIL: `andi K ; sltu $zero,v` vs `srl n ; andi 1` is a ST |
+| L22389 | §211 | HOIST THE LOOP INIT ABOVE THE DOMINATING GUARD: it fills the guard's delay slot AND flips  |
+| L22448 | §212 | THE WALKING CURSOR IS COUNTABLE: `*wp++` emits one `addiu` PER STORE, `wp[0..2]` emits one |
+| L22493 | §213 | INDEPENDENT SAME-BASE STORES: THE EMISSION ORDER IS A PERMUTATION OF SOURCE ORDER, AND THE |
+| L22529 | §214 | THE BANKED TWIN MAY BE A MACRO, A DELETED `.s`, OR A SEMANTIC INVERSE — six ways a ≥0.9 si |
+| L22575 | §215 | PIN ECONOMY: the twin's pins are NOT part of the shape, and §17's "pin every call-crossing |
+| L22631 | §216 | DISTINCT ADJACENT SCALARS vs ONE ARRAY: one `lui` per access is the tell, and the array de |
+| L22671 | §217 | DECODING A CALL'S STACK ARGUMENT SLOTS: `sw` at `0x10`/`0x14`/`0x18` are params 5/6/7 **(s |
+| L22697 | §218 | A NARROW TYPE AT THE ABI BOUNDARY COSTS AN IN-PLACE `sll/sra` PAIR — on the RETURN as well |
+| L22726 | §219 | COMPOUND `+=`, FULL ASSIGNMENT, AND AN EXPLICIT TEMP ARE THREE DIFFERENT SCHEDULES OF ONE  |
+| L22753 | §220 | THE PARAMETER ITSELF IS A REGALLOC DIAL: use it directly, prefer `s32` to `void*`, and pla |
+| L22793 | §221 | A CONSTANT SHARED BY TWO STORES DIES AT THE CALL WHOSE DELAY SLOT REFILLS ITS REGISTER **( |
+| L22809 | §222 | SWITCH vs IF-CHAIN, PART 3: source arm order IS emission order, a leading EMPTY case buys  |
+| L22851 | §223 | READING A `jal` DELAY SLOT: the value in it was produced BEFORE the call, so it is NEVER t |
+| L22913 | §224 | CROSS-JUMP: WRITE THE DUPLICATE, AND READ A SHARED DELAY SLOT AS THE MERGE SIGNATURE (P31  |
+| L22949 | §225 | THREE CONTROL-FLOW SHAPES NO STRUCTURED SPELLING REACHES (P31 S58) |
+| L22992 | §226 | FRAME PADS: FOUR WAYS §162i1/§2429's DEAD-LOCAL LEVER MISFIRES (P31 S58) |
+| L23033 | §227 | TYPE THE SOURCE BY THE **LOAD** WIDTH, NOT BY THE STORE WIDTH (P31 S58) |
+| L23053 | §228 | READING THE DIVIDE, PART N: the off-by-one compare is `% K == 1`, and three more discrimin |
+| L23090 | §229 | THE ADDRESS IS A VALUE: NAMING IT MOVES THE `lui`/`addiu` PAIR — AND §L14410 SAYS THE OPPO |
+| L23139 | §230 | THE ANCHOR PROBE: with `%hi`/`%lo` masked, the surviving `addiu` deltas tell you which ass |
+| L23154 | §231 | TRANSCRIPTION AND SEMANTIC-READ HYGIENE: six ways the listing misleads (P31 S58) |
+| L23195 | §232 | WHEN THE `jr` DELAY SLOT'S STORE STORES THE RETURN VALUE, TIE THEM WITH ONE PSEUDO **(sing |
+| L23231 | §30 | addendum (P31 S58) — the `/s` grant closes a SCHEDULING residual and a REGISTER residual w |
+| L23251 | §194-B | addendum (P31 S58) — BOUND 2 is byte-wrong; see §209 Direction A |
+| L23257 | §176-B | addendum (P31 S58) — the misdiagnosis direction |
+| L23263 | §165-40 | addendum (P31 S58) — the barrier goes at the COPY SITE, not inside the region it protects |
+| L23272 | §164-63 | addendum (P31 S58) — the interposed asm works when the SECOND value is an ordinary assignm |
+| L23281 | §193-A | / §194-E addendum (P31 S58) — where the twin's body actually lives |
+| L23287 | §233 | THE WAVE aa–bg HARVEST (P31 S58b): 1,101 byte-banked notes → 24 new laws, 21 addenda, ~700 |
+| L23331 | §234 | CONSTANT MATERIALISATION: THE STORE LVALUE'S SIGNEDNESS PICKS `addiu` vs `li`/`ori` (P31 S |
+| L23372 | §235 | THE PHANTOM SYMBOL: A MASKED `MATCH` CAN CARRY A RELOCATION THAT DOES NOT EXIST (P31 S58b) |
+| L23401 | §236 | THE DECLARATION LAYER IS THE DOMINANT BANK-BLOCKER: NINE WAYS A BYTE-PERFECT BODY FAILS TH |
+| L23480 | §237 | THE CAST-AT-CALL-SITE DECISION TABLE: WHAT §17a-1 FIXES, WHAT IT CANNOT, AND THE FOUR ESCA |
+| L23535 | §238 | SAME NAME, DIFFERENT FUNCTION: THE OVERLAY-HOMONYM TRAP (P31 S58b) |
+| L23575 | §239 | TWO-STATEMENT INTEGER-SPACE MATERIALISATION REORDERS `la` vs `sll`; AND THE PLUS-TREE OPER |
+| L23609 | §240 | `A + K + B`: WRITE THE CONSTANT **BETWEEN** THE TWO RUNTIME TERMS (P31 S58b) |
+| L23638 | §241 | THE FOLDED SIGN-EXTEND-AND-SCALE: `sll 16 ; sra (16 − log2 scale)` (P31 S58b) |
+| L23667 | §242 | `*k` vs `<<n`, AND `/2^n` vs `>>n`: EXPRESSION SPELLING OWNS THE LOAD WIDTH AND THE ROUNDI |
+| L23695 | §243 | SPELL THE CSE BARRIER AS A REASSIGNED POINTER; AND THE `nop`-AFTER-EVERY-`lh` SIGNATURE (P |
+| L23725 | §244 | `volatile` IS A COUNTING INSTRUMENT, A STORE-ORDER PIN, AND MUST SOMETIMES BE ASYMMETRIC ( |
+| L23760 | §245 | THE CALL'S ARGUMENT LIST IS A SCHEDULING SLOT (P31 S58b) |
+| L23807 | §246 | THREE-LIVE-VALUE SCAN LOOPS WANT ADDRESS-FROM-INDEX; AND TWO SYMBOLS CAN SHARE ONE giv (P3 |
+| L23847 | §247 | TWO BRANCHES TO **ONE** LABEL MEANS THE SOURCE CONDITION IS NEGATED (P31 S58b) |
+| L23881 | §248 | SPLIT THE LOAD FROM THE ARITHMETIC: A FUSED `g + K` DENIES THE CALLEE-SAVED REGISTER ITS D |
+| L23905 | §249 | THE SELF-ASSIGN, THE DEAD RE-ASSIGN, AND THE `+ zr` COPY: THREE WAYS TO MAKE A DELETED INS |
+| L23947 | §250 | `%hi/%lo` vs `lw`: THE EXTERN'S ARRAY-vs-SCALAR SHAPE DECIDES ADDRESS MATERIALISATION (P31 |
+| L23984 | §251 | IMMEDIATE-SPELLING TRIGGERS: `+= 0xFF`, FULL-WIDTH `~K`, AND THE TWO-OR SPLIT (P31 S58b) |
+| L24006 | §252 | THE GUARDED PRE-DECREMENT: `(x != 0) && (--x == 0)` (P31 S58b) |
+| L24027 | §253 | POSTFIX `++` vs `+= 1` PICKS A DIFFERENT SCRATCH REGISTER **(single observation — not yet  |
+| L24041 | §254 | THE DEAD PARAMETER IS A REGISTER-PLACEMENT TOOL **(single observation — not yet cross-conf |
+| L24053 | §255 | THE EMPTY CASE, PART 2: FOUR TREE SHAPES IT BUYS (P31 S58b) |
+| L24088 | §256 | GOTOS IN THE TARGET'S BLOCK ORDER REPRODUCE SWITCH PLACEMENT WITHOUT SWITCH'S SIDE EFFECTS |
+| L24125 | §257 | THE DEAD-END LEDGER (P31 S58b): ELEVEN LEVERS THAT MEASURED NULL OR BACKFIRED |
+| L24168 | §258 | ADDENDA TO EXISTING SECTIONS (P31 S58b) |
+| L24173 | §30 | addendum (P31 S58b) — THE ANONYMOUS STRUCT MEMBER REF GRANTS `/s`, AND THAT IS A TWO-FOR-O |
+| L24194 | §194-B | / §209 addendum (P31 S58b) — TWO MORE INSTANCES, AND THE BOUND IS NOW REFUTED FOUR WAYS |
+| L24217 | §202 | addendum (P31 S58b) — THE DEF-SIDE ALIAS ALSO CLEARS A RETURN+PARAM DOUBLE CONFLICT |
+| L24228 | §205 | addendum (P31 S58b) — CHAINED ASSIGNMENT: N≥3 IS INNERMOST-FIRST, AND THE TEXT MIRRORS EMI |
+| L24245 | §208 | addendum (P31 S58b) — IT SCALES TO SIX SITES, AND IT HAS AN EXACT INVERSE |
+| L24274 | §210 | addendum (P31 S58b) — THREE CONFIRMED SPELLINGS OF THE BOOLEAN TAIL |
+| L24290 | §211 | addendum (P31 S58b) — INIT PLACEMENT: FIVE MORE DIALS BEYOND THE GUARD HOIST |
+| L24333 | §213 | addendum (P31 S58b) — THREE MORE PERMUTATION LAWS FOR INDEPENDENT SAME-BASE STORES |
+| L24362 | §214 | addendum (P31 S58b) — FOUR MORE WAYS A HIGH-SIMILARITY TWIN LIES |
+| L24398 | §215 | addendum (P31 S58b) — PIN ECONOMY, PART 2: NINE REFINEMENTS |
+| L24450 | §217 | CROSS-CONFIRMED (P31 S58b) — AND THE INCOMING HOME SLOT IS THE MIRROR |
+| L24467 | §220 | addendum (P31 S58b) — THE PARAMETER, NOT A COPY (SEVEN CARDS) |
+| L24492 | §222 | addendum (P31 S58b) — IF-CHAIN vs SWITCH: THREE MORE DISCRIMINATORS |
+| L24510 | §223 | addendum (P31 S58b) — FIVE MORE CONFIRMATIONS, AND THE CONSTANT-IN-`$v0` CASE |
+| L24534 | §224 | addendum (P31 S58b) — CROSS-JUMP MERGES *CALLS*, AND THE DELAY SLOT IS THE DISCRIMINATOR |
+| L24564 | §225 | addendum (P31 S58b) — THE GUARD-CLAUSE FINGERPRINT, AND THREE MORE SHAPES |
+| L24591 | §226 | addendum (P31 S58b) — THE FRAME CATALOGUE: SEVEN MORE LEVERS, AND SLOT ORDER IS DECLARATIO |
+| L24636 | §229 | addendum (P31 S58b) — NAME IT **INSIDE** THE ARM |
+| L24647 | §230 | CROSS-CONFIRMED (P31 S58b) |
+| L24656 | §231 | addendum (P31 S58b) — FOUR MORE WAYS THE LISTING MISLEADS |
+| L24687 | §232 | CROSS-CONFIRMED (P31 S58b) |
+| L24698 | §259 | THE DISCARD LEDGER FOR THE aa–bg HARVEST (P31 S58b): WHAT WAS MINED AND REJECTED, AND WHY |
+| L24737 | §260 | THE §154-A LEADING-ISLAND SPLIT: ONE CONFIG LINE, AND THE ISLAND PEELS FROM THE END (P31 S |
+| L24787 | §260-A | STAGE 2 IS PROVEN, AND THE WHOLE jtbl PIPELINE IS AUTOMATED AT THE GATE (P31 S59, same day |
+| L24823 | §261 | THE -O0 ORACLE: DERIVE THE OPT LEVEL FROM THE TARGET, AND `$fp` IS NOT THE TELL (P31 S59) |
+| L24849 | §261a | THE -O0 FRAME-RELOAD GRAMMAR: reload COUNT disambiguates the C spelling (P31 S59, byte-pro |
+| L24871 | §262 | A LANE'S YIELD IS ONLY A LANE FACT IF IT IS SIZE-MATCHED (P31 S59) |
+| L24901 | §263 | A STOLEN DELAY SLOT WHOSE INSTRUCTION IS AN ARG-REGISTER COPY IS AN ARITY ERROR, NOT A SCH |
+| L24942 | §264 | FOUR TELLS-LANE C RECIPES, EACH DRIVEN TO MATCH (P31 S59) |
+| L24992 | §265 | THE VERBATIM-ASM BANK LANE: A FUNCTION NO -O2 C CAN EVER MATCH BANKS AS A RAW `__asm__` BO |
+| L25054 | §266 | THE INERT-RIDER LAW: A LEVER IS ONLY CITABLE WHEN ITS SOLO REMOVAL BREAKS THE MATCH (P31 S |
+| L25094 | §267 | ADDENDA HARVESTED FROM WAVES at/bh/bk/bl (P31 S59b) |
+| L25102 | ADD-1 | → §231 addendum (also cross-ref from §195-D) — THE MASKED-`jal` "MISSING CALL" ILLUSION |
+| L25111 | ADD-2 | → §42a addendum — A SHARED CONSTANT *NAMED IN A LOCAL* ACROSS A `jal` IS AN ISO→TU DRIFT H |
+| L25123 | ADD-3 | → §236, item 10 — THE UN-DELETED `INCLUDE_ASM` STUB IS A DUPLICATE DEFINITION |
+| L25133 | ADD-4 | → §225-3/-4 addendum — THE MIRROR ROW: VALUE-RETURN IN THE *TAKEN* ARM + TRAILING BARE `re |
+| L25147 | ADD-5 | → §1/I1 addendum — THE INVERTED RANGE TEST: `(u32)(x-lo) >= N` WITH THE ZERO-ARM AS THE TR |
+| L25156 | ADD-6 | → §172b-1 / §264 addendum — SHIFT-AS-TEST: `(x << 16) != 0` TESTS THE LOW HALF WITHOUT TRU |
+| L25165 | ADD-7 | → §256 addendum — THE SINGLE-GUARD GOTO: THEN-BLOCK OUT OF LINE AT THE TAIL |
+| L25177 | ADD-8 | → §245 addendum — THE RE-TIE BARRIER PINS CALL-ARG SETUP TO SOURCE ORDER (construct 6) |
+| L25189 | ADD-9 | → §213-3 / §217 addendum — ADJACENT PRE-CALL FRAME STORES ARE ONE AGGREGATE; THE UNESCAPED |
+| L25199 | ADD-10 | → §237 addendum (arity-evidence paragraph) — AN `la` PAIR ABOVE THE PROLOGUE `sw $ra` IS A |
+| L25208 | ADD-11 | → Cross-confirmation card block (per §259's standing instruction: confirmation, not news) |
+| L25259 | §268 | A `register __asm__` PIN ON A CALL-CLOBBERED REGISTER IS HONORED EXACTLY WHEN THE PINNED R |
+| L25313 | §269 | ADDENDA HARVESTED FROM WAVES ax/bm (P31 S59c) |
+| L25328 | ADD-1 | → §257-8 addendum — THE INTERPOSED ASM'S `__volatile__` IS A PER-SHAPE DIAL, AND THE "NO-O |
+| L25341 | ADD-2 | → §236 addendum (item 1 corollary) — THE SILENT-SPLICE DECLARATION LADDER: WHERE THE TU HA |
+| L25355 | ADD-3 | → §238 addendum — TWO BINARIES CAN EACH DEFINE THE SAME `func_` NAME WITH DIFFERENT BYTES, |
+| L25368 | ADD-4 | → §167-37 addendum — THE FIFTH PRECONDITION, NOW MEASURED: DOWNSTREAM FIELD RE-READS ⇒ NAM |
+| L25385 | ADD-5 | → §267-ADD-6 / §172b-1 addendum — THE SIGN-TEST FACE: `(s16)v < 0` IS `sll 16` + `bgez` ON |
+| L25401 | ADD-6 | → §220-addendum — THE FOURTH FACE: WHEN THE NAMED COPY ITSELF BUYS THE EXTRA CALLEE-SAVED, |
+| L25417 | ADD-7 | → §229 addendum — THE VALUE FACE: A LOOP-STORE CONSTANT SPELLED AS A LITERAL HAS NO SOURCE |
+| L25430 | ADD-8 | → §30a addendum — THE THIRD COLUMN: `*p++` IS ALSO SERIALIZED BUT BURNS `addiu`; ONLY CAST |
+| L25445 | ADD-9 | → §255 "AND CASE-BODY PLACEMENT" bound / §222-addendum-3 — ON A LARGE SPARSE TREE, BODIES  |
+| L25459 | ADD-10 | → Cross-confirmation card block (per §259's standing instruction: confirmation, not news) |
+| L25500 | §3-1a. | The §266 sweep — every solo-lever A/B run for this batch |
+| L25533 | §270 | The A-prop 0-bank anatomy: a byte-correct body still needs FOUR layers to agree (P31 S59) |
+| L25551 | §271 | Ordinal IMM pairing: text order is NOT emission order; emit CANDIDATES, let the oracle pic |
+| L25573 | §272 | The `(void)`-decl + empty-call wall: K&R the DEFINITION, not just the decls (P31 S59) |
+| L25593 | §273 | A standalone compile is the WRONG oracle for a TU-destined draft (P31 S59) |
+| L25608 | §274 | ADDENDA HARVESTED FROM 18 WAVES (P31 S60): 315 candidates, 255 already covered, 21 sharpen |
+| L25614 | ADDENDUM | to §179-C — the `.type NAME, @function` requirement |
+| L25661 | ADDENDUM | to §134 — a typedef defined BELOW the splice point is stripped anyway |
+| L25691 | ADDENDUM | to §179-D (GTE macro reference family) — `gte_SetRotMatrix`/`gte_SetTransMatrix` bodies |
+| L25717 | ADDENDUM | to §82 — struct copies must stay MEMBER-WISE, not block-moved, to match a spill-slot save |
+| L25755 | ADDENDUM | to §136d-1 (RC-12, the `$0`-add / opaque-copy family) — two symptoms beyond "compare reads |
+| L25794 | ADDENDUM | to §20 — a global declared as `T *` may itself BE the array base, not a pointer to derefer |
+| L25823 | ADDENDUM | to §1-I5 |
+| L25888 | ADDENDUM | to §164-51 |
+| L25904 | ADDENDUM | to §176-F5 |
+| L25933 | ADDENDUM | to §225 |
+| L25978 | ADDENDUM | to §224 — CROSS-JUMP: THE DUPLICATE CAN BE A PLAIN STORE, NOT ONLY A CALL |
+| L26012 | ADDENDUM | to §164-64 — AN EMPTY CLOBBER ON AN ARGUMENT REGISTER CAN BE THE DELIBERATE FIX, NOT JUST  |
+| L26043 | ADDENDUM | to §244 — THE COMPILER BARRIER, NOT `volatile`, BLOCKS A STORE→LOAD HOIST THROUGH A POINTE |
+| L26074 | ADDENDUM | to §172b-1 — TWO PLACEMENT DIALS THE PROMOTION LAW DOESN'T NAME: NARROW THE COUNTER'S DECL |
+| L26121 | ADDENDUM | to §229 — A POINTER'S NUMBER OF USES DECIDES WHETHER ITS ADDRESS FOLDS OR SURVIVES A CALL |
+| L26166 | ADDENDUM | to §172b-4 — THE PLAIN CAST-DIVISION ALREADY PRODUCES THE PATTERN; DON'T HAND-ROLL THE BIA |
+| L26196 | ADDENDUM | to §8 — WHEN `INCLUDE_RODATA` NEEDS A STANDALONE `.s` YOU CAN'T CREATE, CARRY THE FRAGMENT |
+| L26239 | ADDENDUM | to §226 — A DEAD LOCAL SCOPED TO A NESTED BLOCK BUYS A MID-FUNCTION `addiu sp` PAIR, NOT A |
+| L26278 | ADDENDUM | to §172a — RE-READING MEMORY (NOT NAMING A TEMP) IS WHAT KEEPS AN INCREMENT'S DELAY-SLOT F |
+| L26309 | ADDENDUM | to §225 / §256 — A GOTO TO A SHARED SET-POINT PREVENTS IF-CONVERSION FROM COLLAPSING A LAT |
+| L26351 | ADDENDUM | to §211 — AN IN-LOOP ACCUMULATOR WANTS A CLOSED-FORM EXPRESSION WHEN THE TARGET REMATERIAL |
+| L26386 | §275 | THE LEFTOVER-REGISTER READ |
+| L26426 | §276 | MIXED ADDRESS-EXPRESSION SPELLING FOR ADJACENT RELOCATABLE SYMBOLS IS A CSE-UNIFICATION DI |
+| L26535 | §277 | RETURN-TAIL C SPELLING PICKS THE DELAY-SLOT-FILL vs TRAILING-MOVE TOPOLOGY, AND A NARROWER |
+| L26599 | §278 | ADDENDA HARVESTED FROM WAVE cf (P31 S60): 34 candidates, 13 already covered, 8 sharpenings |
+| L26607 | ADDENDUM | to §74 (func_800D0E30, resident) |
+| L26643 | ADDENDUM | to §172b-4 (func_80185054, ov_SC03_097) |
+| L26681 | ADDENDUM | to §265 (func_8017DC80, ov_SC07_002) |
+| L26720 | ADDENDUM | to §17 (func_800CB794, md_MAIN_036) |
+| L26768 | ADDENDUM | to §162p (func_8017C120, ov_MAIN_012) |
+| L26802 | ADDENDUM | to §20 (~L1947) (func_80186AD0, ov_SC06_032) |
+| L26832 | ADDENDUM | to §164-56 (func_8017F644, ov_SC04_005) |
+| L26867 | ADDENDUM | to §237 (func_8017F7FC, ov_SC03_092) |
+| L26896 | §279 | A `do/while (p < end)` LOOP UNDER AN ENTRY GUARD: the guard decides the compare, not the l |
+| L26897 | §NNN | A DO-WHILE'S GUARD AND LATCH MUST REPEAT THE SAME BOUND EXPRESSION, NOT SHARE ONE LOCAL: T |
+| L26930 | §280 | THE CURSOR'S DECLARED TYPE PICKS `sltu` vs `slt`: a `T*` bound test is UNSIGNED by C rule, |
+| L26931 | §NNN | A LOOP CURSOR'S C TYPE (POINTER vs PLAIN INTEGER) SELECTS `sltu` vs `slt` FOR ITS BOUND TE |
+| L26964 | §281 | GROUP COPY-THEN-RMW BY OPERATION KIND, NOT FIELD BY FIELD: sched1 does the interleaving, t |
+| L26965 | §NNN | A DEPENDENT COPY-THEN-RMW BLOCK MUST BE SOURCE-GROUPED BY OPERATION KIND, NOT BY FIELD, AN |
+| L27010 | §282 | gcc's OWN LOOP REVERSAL PUTS THE COUNTER INIT AFTER THE HOISTED MOVABLES — a position no h |
+| L27011 | §NNN | WRITE THE UP-COUNT LOOP: gcc's OWN REVERSAL PRODUCES A COUNTER-INIT INSTRUCTION THAT LANDS |
+| L27048 | What | I could not verify |
+| L27095 | §283 | ADDENDA HARVESTED FROM THE 36-WAVE BATCH (P31 S60): 1,216 candidates, 859 already covered, |
+| L27105 | ADDENDUM | to §164-75 — the fold-reassociation law also fires at a variable's INITIALIZER, not only a |
+| L27131 | ADDENDUM | to §21 — the `bltz`+`slti` (or N-separate-compares) signed-range-split bullet is now CONFI |
+| L27177 | ADDENDUM | to §202 — the DEF-SIDE ALIAS also resolves a function-vs-DATA-symbol identifier clash, not |
+| L27200 | ADDENDUM | to §22 (`volatile`-qualified-global reload lever, cookbook ~L1922) — for a NON-constant, s |
+| L27219 | ADDENDUM | to §195-E — a goto-ladder's STORES must sit AT the labels, after the gotos, not inline bef |
+| L27281 | ADDENDUM | to §195-N — a GNU statement-expression slider must sit INSIDE the conditional arm's value  |
+| L27338 | ADDENDUM | to §176-B2 — in a micro-function with no long/short lifetime asymmetry, BOTH contending ps |
+| L27385 | ADDENDUM | to §199-G — A `default:` LABEL GROUPED ONTO THE LAST CASE REMOVES THE `j default` TAIL, EV |
+| L27454 | ADDENDUM | to §220 — REFERENCING THE RAW PARAMETER (NO NAMED COPY, NOT EVEN A PIN) LETS THE CALLEE-SA |
+| L27512 | ADDENDUM | to §252 — a `>=0`/`<0` split on an unconditionally-decremented value needs the POSTFIX ope |
+| L27539 | ADDENDUM | to §215 — FIFTH SHAPE: reused mask constants across two call-free merge sites each get the |
+| L27622 | What | I could not verify |
+| L27693 | Harness-defect | flags |
+| L27786 | ADDENDUM | to §167-40 (func_8017E2CC, ov_SC04_015 — wave dg) |
+| L27806 | ADDENDUM | to §20's cross-jump EXPLOIT bullet (func_8017E360, ov_SC05_007 — wave dg) |
+| L27820 | ADDENDUM | to §87 (func_801815F4 ov_SC06_032; corroborating func_801840DC ov_SC05_017, func_80189C68  |
+| L27839 | ADDENDUM | to §153 / §236-5 (func_801A419C, md_SC07_003 — waves di and dl, corroborating; refutes a c |
+| L27859 | ADDENDUM | to §263 (func_801E83AC, md_SC04_029 — wave dj) |
+| L27873 | ADDENDUM | to §265 (func_8017D878, ov_SC03_107 — wave dj; corroborated by a REJECTED, contradicted ca |
+| L27887 | ADDENDUM | to §6 (func_801811F0, ov_SC03_102 — waves dj and dl, corroborated by a self-reported "noth |
+| L27901 | ADDENDUM | to §195-G (func_80183BB0, ov_SC05_001 — wave dj) |
+| L27929 | ADDENDUM | to the zero-byte-asm-slider family (§47 / §148-C / §153) (func_800CB874, md_MAIN_040 — wav |
+| L27947 | ADDENDUM | to §194-B (func_8017EB34, ov_SC03_117 — wave dk; distinct from the §74 co-pinning finding  |
+| L27979 | ADDENDUM | to §74 (func_8017EB34, ov_SC03_117 — counter/clamp variant; wave dj, corroborated by dk/dl |
+| L27999 | ADDENDUM | §37 — merged into the §153/§236-5 entry above (func_801A419C, wave dl) |
+| L28007 | ADDENDUM | §6 — merged into the §6 entry above (func_801811F0, wave dl) |
+| L28015 | ADDENDUM | to §238 (func_80182CB4, ov_SC02_000 — wave dl) |
+| L28033 | ADDENDUM | to §137a (func_801684B4, ov_MAIN_012; corroborated independently by func_80189E68, func_80 |
+| L28049 | ADDENDUM | to §8c / §88d (func_8016AB6C, ov_MAIN_012 — wave dm) |
+| L28063 | ADDENDUM | to §73 / §30#2 (func_800D1984, resident — wave dm) |
+| L28079 | What | I could not verify |
+| L28099 | ADDENDUM | to §174 Law 4 (func_8017E9A8, ov_SC06_015) |
+| L28139 | ADDENDUM | the zero-emission-asm family gains a REF-SLIDER PLACEMENT LAW and a paired RESTORER (func_ |
+| L28191 | From | ck + cl + cm |
+| L28197 | ADDENDUM | §NNN — sharpens §55a / §164-37 / §165-28 (switch-vs-tree cluster): A SHAPE THAT LOOKS LIKE |
+| L28234 | ADDENDUM | §NNN — sharpens §167-13's boundary: CHAINING TWO IDENTICAL SIDE-BY-SIDE STORES INTO ONE C  |
+| L28267 | ADDENDUM | §NNN — sharpens §162a3/§60b: A `sll $v0,16 / sltiu $v0,1` ZERO-TEST OF A JUST-DECREMENTED  |
+| L28300 | ADDENDUM | §NNN — sharpens §37/§124 (unspecified-parameter-list family): DERIVE A CALLEE'S ARITY LOWE |
+| L28333 | ADDENDUM | to §5a (func_80181F74, ov_SC03_112, wave cn) |
+| L28383 | ADDENDUM | to §265 (func_8017E26C, ov_SC04_016, wave cn) |
+| L28421 | ADDENDUM | to §42b (func_8018247C, ov_SC07_002, waves cu + cw) |
+| L28452 | ADDENDUM | to §199-F family (func_8017EFB0, ov_SC02_021, wave cu) |
+| L28507 | ADDENDUM | to §195-E (func_800CFC1C, md_MAIN_003, wave cv) |
+| L28552 | ADDENDUM | to §215 addendum (func_800CB2C8, md_MAIN_033, waves cv + cw) |
+| L28608 | ADDENDUM | to §236 item 4 (func_8017D268, ov_SC04_006, wave cw) |
+| L28637 | What | I could not verify |
+| L28669 | Harness-defect | flags (not idioms — flagged for the operator) |
+| L28710 | ADDENDUM | to §250 (func_8017D7CC, ov_SC03_115 — cx/cy/cz/dr) |
+| L28755 | ADDENDUM | to §225 (func_8017E190, ov_SC03_115 — cx/cy/cz) |
+| L28808 | ADDENDUM | to §45-A (func_8017F6A4, ov_SC02_016 — cy/cz) |
+| L28852 | ADDENDUM | to §249 (func_80182ED4, ov_SC04_004 — dp/dr/dt) |
+| L28897 | ADDENDUM | to §199-A (func_801816FC, ov_SC02_005 — dp/dr/dt) |
+| L28943 | What | I could not verify |
+| L28986 | Harness-defect | flags |
+| L29048 | §284 | COMBINE CAN REASSOCIATE TWO SEQUENTIAL BITWISE-AND MASKS INTO ONE AGAINST THE PRE-MASK VAL |
+| L29052 | §285 | PRE-INITIALIZING A VARIABLE WITH A SHARED CONSTANT BEFORE A BRANCH MAKES BOTH ARMS OF THE  |
+| L29056 | §286 | FOLD A STATEMENT'S SIDE EFFECT INTO A COMMA-EXPRESSION IN AN ARGUMENT POSITION TO PLACE IT |
+| L29060 | §287 | A STACK-FRAME HOLE BELOW TWO ADDRESS-TAKEN AGGREGATE LOCALS IS A LEADING PAD MEMBER OF ONE |
+| L29064 | §288 | A REGISTER PIN DECLARED UNINITIALIZED AND ASSIGNED ONLY AT ITS LATE, SOLE USE STILL FORCES |
+| L29068 | §289 | an array local's address-taken base keeps every element's store alive, even though only on |
+| L29072 | §290 | A SINGLE STRENGTH-REDUCED GIV CAN DRIVE STORES TO SEVERAL DISTINCT RELOCATABLE SYMBOLS, EA |
+| L29076 | §291 | THE DELAY-SLOT FALSE-VALUE: A CONDITIONAL BRANCH'S ZERO ARM MUST BE A FALL-THROUGH-ADJACEN |
+| L29080 | §292 | DECLARING A SYMBOL UPSTREAM OF AN ALREADY-BANKED SIBLING THAT RELIES ON THAT SYMBOL'S IMPL |
+| L29083 | §293 | THE "WHOLE-OBJECT GATE NEEDS EVERY SIBLING" LAW, WRITTEN PROPERLY: IT IS THREE LAWS, AND T |
+| L29133 | §294 | ADDENDA HARVESTED FROM THE S61 GEN0/MAXTOK/MAIN/DEEPSEEK BATCH (waves ab8/ab16/ab24/ab32 · |
+| L29144 | ADDENDUM | to §127 — the -O0 constant-offset fold keys on the MEMBER-ACCESS tree shape, not on the in |
+| L29172 | ADDENDUM | to §261a — FOUR MORE -O0 DIALS BEYOND THE RELOAD COUNT (boot.c + md_MAIN_011/003, wave m0a |
+| L29222 | ADDENDUM | to §264-3 — the explicit entry copy's BOUND: required exactly when the RAW value must outl |
+| L29242 | ADDENDUM | to §172b-1 (counter-type dial) — the sll's SOURCE REGISTER is the placement discriminator |
+| L29254 | ADDENDUM | to §276 — the SHARE direction: spell the second adjacent symbol RELATIVE to force ONE anch |
+| L29270 | ADDENDUM | to §31's density-dummy dial (L2460/L2497) — the dose is TWO refs, and the dummy must sit w |
+| L29287 | ADDENDUM | to §282 — the ADDRESS-GIV face: write the walked address INLINE so strength reduction birt |
+| L29310 | ADDENDUM | to §253 — SECOND byte-proven card (upgrade from single-observation), and the placement fac |
+| L29331 | ADDENDUM | to the L1800 anchor-steer bullet — a DERIVED-POINTER local silently flips the merged giv's |
+| L29354 | ADDENDUM | to §31's asm→layout inference — TWO WIDTH-PAIR DISCRIMINATORS (same offset, different widt |
+| L29375 | §295 | THE KERNEL-TRAP STUB: §81's jr-DETECTOR WITHOUT A TABLE IS A PsyQ SYSCALL TRAMPOLINE — ROU |
+| L29430 | §296 | THE FRAME CHECK OUTRANKS THE ATLAS LEVER: READ PROLOGUE/EPILOGUE BEFORE DRAFTING ANY C — A |
+| L29473 | §297 | ONE GIV SERVING MIXED-WIDTH LOADS *AND* A STORE NEEDS STRUCT-MEMBER SPELLING; CAST/INDEX S |
+| L29516 | §298 | THE SHARED-TAIL POSITION DIAGNOSTIC: A FOLDED TAIL *BETWEEN* SWITCH ARMS MEANS PER-ARM DUP |
+| L29541 | §299 | TWO INDEPENDENT EXTRACTION CHAINS EMIT CONTIGUOUSLY INSIDE ONE EXPRESSION; ONLY A STATEMEN |
+| L29576 | §300 | S61 DISTILL BATCH NOTES (waves ab8/ab16/ab24/ab32 · g0a–g0f · m0a · ds1/ds2 · m0b) |
+| L29645 | §301 | AN INTERNAL `j` CARRIES `R_MIPS_26 .text`: rtu/match_one "MATCH" COULD NOT SEE WHICH LABEL |
+| L29693 | §302 | A RED BINARY IS A DRIFTED SPEC, NOT A MYSTERY: THE THREE CARVE-STATE INVARIANTS AND HOW TO |
+| L29737 | §303 | MODULE ISLAND TABLES: DERIVE THE PADS AT BUILD TIME, PEEL NOTHING — THE §154-A/§260 "islan |
+| L29773 | §304 | SELF-DEFINING RODATA: WHEN A FUNCTION'S `.s` IS THE ONLY OWNER OF THE DATA IT REFERENCES,  |
+| L29796 | §305 | "CARVE-REFUSED" AT GATE TIME IS THREE NAMED, DETERMINISTIC CLASSES — NONE OF THEM A CARVE  |
+| L29848 | §306 | A HAZARD `nop` IN FRONT OF A DIV-RESULT STORE IS A STATEMENT-ORDER DEFECT: THE INDEPENDENT |
+| L29875 | §306a | T4 DISTILL ADDENDA (P31 S62; four byte-proven refinements to existing laws, verified again |
+| L29913 | §307 | THE BRUTE-FORCE-THE-STATEMENT-ORDERS LEVER HAS A BOUND: A FAN-OUT COPY'S PRIORITY IS SCHED |
+| L29957 | §308 | A NAIVE FINAL `goto` DELETES THE TARGET'S `j`+`nop`: SPELL THAT EDGE AS A TAUTOLOGICAL `if |
+| L29986 | §308a | A TWO-INSTRUCTION ARM STUB LAID *BEFORE* THE OTHER ARM AND REACHED ONLY BY A TRAILING `j`  |
+| L30020 | §309 | A FRAME-ADDRESS EQUIVALENCE RIDES *THROUGH* A SKIPPABLE CONDITIONAL: POST-`if` STORES FOLD |
+| L30060 | §310 | A TWO-OPERAND `subu`'s DESTINATION TIES ONLY TO THE OPERAND THAT IS BLOCK-LOCAL: SHARE *ON |
+| L30091 | §311 | A JOIN-BLOCK STORE CAN SWALLOW AN ARM'S LOAD-DELAY `nop`: WHEN ONE ARM'S VALUE COMES FROM  |
+| L30133 | §312 | A BARE RELATIONAL IN AN `if` GIVES THE `slt` NO TARGET: ASSIGN THE COMPARISON INTO THE ALR |
diff --git a/docs/matching-cookbook.md b/docs/matching-cookbook.md
index 72f86116e..70709f5c3 100644
--- a/docs/matching-cookbook.md
+++ b/docs/matching-cookbook.md
@@ -2709,6 +2709,21 @@ tie in `global.c`): compiles fine, wrong bytes → exactly an R17/§45-B target.
 
 ## §41 — The DEF-SIDE canonical-sig wall: mechanically banking a drafted giant past `conflicting types` (Phase 25 T5b batch-2, 2026-07-09; `tools/canon_sig_reconcile.py`, byte-proven on `func_8013B274`)
 
+**Addendum (P31 S64 t5o-t5r, func_8017BEBC @ ov_SC03_007, 246 ins) — A FINDABILITY KEY, not a new law.** §41 step 3
+("Cast each type-changed param AT ITS USES — NEVER via an intermediate local") also owns a purely **REGALLOC**
+symptom, and this section's declaration-wall title hides it: a drafter hunting a register residual greps past §41
+entirely. **The tell:** a closeness plateau that will NOT move under clamp / loop-shape / integer-width levers,
+with the instruction COUNT already exact, on a function whose C declares `T *out = (T *)paramN;` and stores through
+`out[i]`. The named alias is a fresh pseudo — gcc gives it its own register, which frees the incoming arg register
+for a competing tail temp and shifts the whole prologue schedule. Casting in place at each store
+(`((T *)paramN)[i] = …`) adds no pseudo and is byte-free. **Byte evidence:** n7 (`s16 *out = (s16 *)a1; out[i] = …`)
+= near, closeness 17, nins 246; n9 (same body, alias deleted, `((s16 *)a1)[i] = …`) = **MATCH, closeness 0, nins 246**;
+n11 re-confirms. **⚠ The decl-order control is INERT (§67):** n10 swapped the two pointer locals' declaration order,
+kept the alias, and stayed at 17 — so an unchanged closeness under reordering does NOT exonerate the alias. This is
+the FOURTH confirmation of §41 step 3 / §67's two-pseudo law, and the transcript printed only aggregate
+`status closeness nins` lines, so it sharpens findability, not the mechanism.
+
+
 **The wall (dominant for GIANTS — ~universal, vs ~35% clean-bank for small fns):** a drafter writes an
 **isolation-MATCH** giant body (`match_one` c=0) with Ghidra-derived **TYPED** params — `void func(u32 *a0, s16 *a2)`.
 Placed in the real overlay TU it fails the whole-binary gate on `conflicting types for func_X` (a *declaration*
@@ -30113,3 +30128,30 @@ else      { *(s32 *)(p + 0x14) = TBL[*(u8 *)(p + 5)]; }
 **BYTE EVIDENCE.** `func_8017D7E0` (ov_SC06_033, 166 ins, banked at `src/ov_SC06_033/ov_SC06_033_jr_8017C24C.c:3568-3572`). v3 (pointer-CSE, `val` temp present): `closeness 22 / nins 165 / LENGTH-DRIFT/-1?` at 127, `explains: partial`. v4a/b/c reordered the tail statements around the temp — **inert, still 22**, which is what rules out §176-A2's statement-move lever. v5 (temp deleted, store duplicated into both arms): **closeness 2, nins 165 → 166, the LENGTH-DRIFT class gone entirely**, leaving only an unrelated 2-insn operand-order residual at `[127,128]`. The final 2 → 0 came one step later from an ordinary source-order edit (`D_801274EA` before `D_801274EC`, inlining a `(u16)` cast condition) — §176-A / §165-14 territory, **not part of this law**. *Re-read at vet time out of the banked object:* `objdump` of the banked build shows `nop` at 0x240 and exactly **one** `sw $v0,0x14($s1)` at 0x244 — the merge is visible in the bytes, and 0x240/4 = 144 is the residual's own index.
 
 **⚠ MECHANISM BOUND (R14).** No `-dS`/`-dR` dump was taken. The step "an independent join-block insn covers the cross-block hazard" is read off the final stream plus the pass order, not off the scheduler; `-dS` on the two spellings is the cheap confirmation and has not been run. What is **measured** is: the temp spelling is −1 with the `nop` absent, the duplicated spelling restores it at the correct byte, and the object still emits only one store.
+
+
+## §312 — A BARE RELATIONAL IN AN `if` GIVES THE `slt` NO TARGET: ASSIGN THE COMPARISON INTO THE ALREADY-ALLOCATED VARIABLE TO CHOOSE ITS DESTINATION REGISTER, AT ZERO INSTRUCTION COST (P31 S64 t5o-t5r; byte-proven func_80180DCC)
+
+*(NEW axis, not a restatement. §164-38/§164-39 and §164-39's t5j-t5m addendum own the compare's **INPUT** colouring — which operand got which register — and their levers are the in-out fence on operand 0 and the relational transposition; both are the wrong door when the inputs are already correct. §197-C/§164-64 own "write it IN PLACE so the destination **is** an existing pseudo" for `*`/`+`/`|`/`&`; this extends that lever to the relational operator, where §197-C's companion note — "a pinned pseudo can never be the load's destination" — had left the impression that a pin cannot own a computed dest at all. §164-65 also names a value you were going to consume inline, but its payload is allocno REF COUNT, not `SET_DEST`. §195-E is the other naming law and is about whether a 0/1 **materialises** at a join; here naming is length-neutral, which is exactly what makes this lever free.)*
+
+**THE TELL.** The target's `slt` writes back into one of its **own two source registers** — an in-place compare, `slt $v0,$v0,$v1` — and is immediately consumed by a `bnez`/`beqz` on that same register. Your draft emits the identical pair with **every operand register already correct and only the destination one register over**: `match_one` reports `REGALLOC-PERM` with a single-register cycle (`{"$v1":"$v0"}`, `kinds:{"reg":2}`), residual exactly 2 instructions — the `slt` and its branch — and zero length drift. That is not structure and it is not input colouring; nothing but the compare's `SET_DEST` is wrong.
+
+**THE MECHANISM — INFERRED, NOT TRACED (cite as a place to look, never as proven pass behaviour; §164z / §137's bar).** A truth value used only inside an `if` reaches `do_jump`/`expand_expr` with no fixed target, so the `slt`'s destination is synthesised from whatever pseudo is cheapest at that point, tied to **neither** compared operand — which is why it can land one register away even when both operands are correctly pinned. Writing the comparison as an assignment hands `expand_expr` an explicit target pseudo and `store_expr` honours it, forcing the `slt`'s `SET_DEST` to that variable's hard register. No `-dS`/`-dg`/`-dl`/`-dg` dump was taken; `local-alloc.c combine_regs`' tie-to-a-dying-source-operand (§10 Residual A) is the other place worth dumping first if this recurs.
+
+**THE C SHAPE.**
+
+    /* wrong — dest register unpredictable */
+    if (v0 < v1) { goto TRUE1; }
+
+    /* right — forces the slt's dest into v0's pinned hard reg */
+    v0 = (v0 < v1);
+    if (v0 != 0) { goto TRUE1; }
+
+    /* v0 is `register s32 v0 __asm__("$2")`; v1 a sibling pinned s16-cast temp,
+       `register s32 v1 __asm__("$3")` */
+
+The two spellings cost the **same instruction count** — a bare relational has no join and no constant arms, so §195-E's "naming materialises a 0/1" does not fire and the naming is byte-free apart from the register it buys.
+
+**BYTE EVIDENCE.** `func_80180DCC`, 66 ins, all quotes from `match_one --json` on the pinned triple. v0 (backlog draft, `register s16 s1` pin + call-site `(s16)` casts) → closeness 9, `STRENGTH/sll!=sra`. Unpinning `s1` → closeness 6, same sig (block 2 clean, block 1's `sll/sra/slt/bnez` still wrong). v6 (pin `register s32 v1 __asm__("$3")`, hoist `v1 = (s16)s1; v0 = (s16)v0;` as statements ahead of a still-bare `if (v0 < v1)`) → **6 → 2**: `{"status":"near","closeness":2,"residual":[[34,"0043182a slt v1,v0,v1","0043102a slt $v0, $v0, $v1"],[35,"14600013 bnez v1,…","14400013 bnez $v0, .L80180EA8"]],"verdict":{"klass":"REGALLOC-PERM","sig":"REGALLOC-PERM/$v1>$v0","detail":{"map":{"$v1":"$v0"}}}}`. v7, the **only** change being `if (v0 < v1) {…}` → `v0 = (v0 < v1); if (v0 != 0) {…}` → **2 → 0**: `{"status":"match","closeness":0,"residual":[],"verdict":{"klass":"MATCH"}}`.
+
+**BOUND.** (1) n = 1. (2) Only the **v6 → v7** delta is solo-proven (§266): the pins and the cast hoist arrived in compound edits and are co-requisites of the shape, not separately ablated — the pin is what makes "the variable's hard register" a nameable thing here, and an unpinned local would only move the dest to whatever that local got. (3) Routing: on a REGALLOC-PERM whose single wrong register is the compare's **DEST**, try this first — one statement, zero bytes; go to §164-39's fence or its addendum's transposition only when the wrong register is one of the compare's **INPUTS**. (4) Says nothing about compare-against-constant shape (`slti`/`sltiu` immediate-vs-register is §194-L's 2-D lookup) or about signedness (§280).