diff --git a/docs/calibration.md b/docs/calibration.md
new file mode 100644
index 0000000000..afe0ae1e4b
--- /dev/null
+++ b/docs/calibration.md
@@ -0,0 +1,69 @@
+# Endgame calibration — measured rates for P28/P29 sizing (Phase-27 T9)
+
+> The roadmap (§6 risk register) makes the **member-adapt close-rate** THE swing number and holds
+> P28/P29 yield projections until it's measured. This records what Phase-27 could measure directly and
+> names honestly the one number that needs P28's `member_adapt` tool to pin down. All rates are
+> byte-gate-grounded (G3/P9) — a "match" here means the whole-binary gate accepted it.
+
+## Velocity (the flip-timing checkpoint input)
+
+| | value | note |
+|---|---|---|
+| instr-weighted, Phase-26 close | 68.9% | committed baseline |
+| instr-weighted, Phase-27 close | **67.0%** | a re-baselining DOWN, not a regression |
+| game-code matches banked this phase | **~0** | Phase 27 was an INFRASTRUCTURE + FINDINGS phase |
+
+The headline **dropped** because T7's disc-completeness audit added 4 SC07 overlays (~2.45 MB of mostly-
+unmatched code) to the denominator — the prior 68.9% was measured over an incomplete disc. Raw match
+velocity this phase was ~0 (no harvest ran), but the phase's product is leverage on FUTURE velocity: the
+tool fixes (T2/T4/T6) and the pin-crash-wall dissolution (T5) unblock work the prior tooling hid. **For
+the flip decision: do not read Phase-27 as ~0 progress/session — it is a denominator correction plus a
+set of unblocking findings; the next harvest phase (P29) is where velocity resumes and should be
+re-measured there.**
+
+## The templatability swing (the number that decides P28/P29 yield)
+
+Two propagation regimes, both byte-measured this phase:
+
+| regime | rate | evidence |
+|---|---|---|
+| **h_exact reach-N core** (byte-identical across N overlays) | **≈ ×N, near-100%** | §52 (Phase 26): 5 cracked cores → **670 banked instances** = ×134 each, mechanical |
+| **h_seq / h_norm structural family** (same skeleton, per-overlay byte-variants) | **≈ 0%** | `0x8017BEBC` (T5): 106/112 members STAGE cleanly (macro-carry fixed), but **0 of 8 bank** — all genuine byte-DIFF |
+
+**This is the decisive P28/P29 input.** The roadmap's B1/B2 hoped the large `h_seq` families were a
+cheap mechanical harvest; the byte-gate says they are **not templatable** — the structural (h_seq) match
+is necessary, not sufficient. So the remaining yield is NOT "template ×120 the 986 families"; it is
+**per-member cracking** for the structural families and **mechanical ×N only for the h_exact reach-N
+cores**. The current 223-live-stub frontier: **101 reach-134** (h_exact — ×134-able IF the core cracks),
+119 reach-1 (×1), 3 mid. So the P29 arithmetic is: (cores cracked) × (their reach), NOT (families) × 120.
+
+## Cost / yield per tier (this session)
+
+| tier | cost/fn | direct banks | durable yield |
+|---|---|---|---|
+| **Fable5** (discovery) | **~230k tok/fn** (238k/257k/270k/199k measured) | **0 / 5** | 3 oracle reclassifications + 2 cracked roots + **the pin-crash wall dissolved** + 4 new pin-free levers (cookbook §H) |
+| cheap-Opus (apply idioms) | ~40–140k tok/fn (Phase-23/26 data) | the §52 wave: 5 cores | applies Fable5's idioms; the productive banking tier |
+| permuter | CPU-only ($0) | regalloc/schedule drift | 7 all-time (all Phase-21); tail exhausted |
+| local v3 | $0 | the ≤15-ins band | ~1,300 (Phase-23); off the hard tail |
+
+**Fable5's ROI is NOT banks — it is idioms + wall-dissolutions** (the doctrine held perfectly this phase:
+0 banks, but a propagation wall down and the codegen map extended). Budget Fable5 for *discovery*, then
+harvest cheap-Opus against the distilled idioms. The perishable Fable5 window (~7/19) is spent on the
+hard un-drafted cores + wall characterization, never on functions cheap-Opus can apply a known idiom to.
+
+## The one number that needs P28 (honest gap)
+
+**Member-adapt close-rate on REGISTER-DRIFT members** — the roadmap's headline swing — was NOT directly
+measurable this phase: it needs P28's `member_adapt` tool (the exemplar→member delta engine) to try each
+drift member and gate it. The bounding data: the refusal taxonomy's register-drift class is the *only*
+adaptable one (§52 levers, ~⅓ pin-free crack rate per walled cluster), collision members filter out, and
+pin-crash members are now UNBLOCKED (T5) rather than ×1-capped. **P28 opens by measuring this on a
+byte-gated sample before P29 scales — exactly as the roadmap's risk register prescribes.**
+
+## New lever this phase (not in the roadmap's projections)
+
+The **pin-crash wall is dissolved** (T5 + `.run/giants/pin_crash_sigabrt.md`): the ~20 PINS-class stubs
+in the manifest (and the 4 characterized pin families) were routed to the ×1 backlog as "cc1-crash /
+intrinsic"; they now stage clean and are mechanically harvestable (byte-identity per sibling is the
+gate's question, but the crash barrier is gone). This is un-projected P29 fuel — a whole reach-N class
+the roadmap wrote off, back on the table.
diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md
index 665fe643a2..5fae9984be 100644
--- a/phase-ends/CURRENT_PHASE.md
+++ b/phase-ends/CURRENT_PHASE.md
@@ -43,7 +43,7 @@ Phase 26 closed on an honest pivot — the mechanical/templating harvest is byte
 - [x] **Task 6 — Scanner migration** `[xHigh]` — **DONE.** `exemplar_miner`: replaced the `dp.registered_addrs()` proxy (config/dedup.us.yaml — ~60% wrong: a matched-but-unregistered fn stayed in the residual pool) with `corpus.stubs(source)` — "is it still work?" = "is it still INCLUDE_ASM" (R33). `difficulty`: replaced the **136-entry hand-dict** with `cfg_for(alias)` (the layout is mechanical: `src/<a>` + `asm/<a>/nonmatchings`; main/resident the two specials) — **proven byte-exact** for all 136 (0 mismatches derivation-vs-dict), validated against the tree (`src/<a>` must exist, R32/R33) not a hand-list. **Also removed difficulty from `new_overlay.sh`'s sentinel-insertion set** (T6 made it obsolete — otherwise onboarding would insert a dead dict entry into a file with no dict; the other 3 tools' hand-lists stay, migrated one-at-a-time per the audit). **VERIFIED:** (1) both tools + new_overlay.sh parse; (2) **airtight known-answer** — old `difficulty.py` vs new produce **byte-identical** `.md` AND `.csv` on the same tree (the vs-committed diff was pure staleness — committed doc is 2026-06-20); (3) unknown alias → clean error, not silent-empty; (4) `exemplar_miner` runs → 223 residual stubs (the corrected count; not in `make report`, so no known-answer constraint — the change is the fix); (5) new_overlay.sh bash+embedded-python valid, difficulty absent. Now a new overlay (T7) needs zero difficulty hand-registration. *(completes with this commit)*
 - [x] **Task 7 — Disc-completeness audit + onboard + type-sweep** `[xHigh]` — **DONE.** Generalized `new_overlay.sh` with an optional `[ENTRY]` arg (default `0.4`); onboarded `ov_SC07_{006,007,010,011}` from `1.4.dec` — each **byte-identical** (`7ca772be`/`b3b95547`/`d7b5875d`/`9885af74`). **Fleet 136 → 140**, `check-all` **140/140** (T2's `pass==N` correctly re-baselined). The sweep (`tools/disc_code_sweep.py`, committed) revealed the initial `isValid()`-only threshold was far too weak (389 false "hits"; type-0/2 data decodes ~100% valid) — **fixed with a `jr $ra` density gate** (code ~2.9-3.4%, data 0.000%, validated on positive+negative controls). **Honest result:** type-4 is **COMPLETE (138/138)**; all other types are data EXCEPT **type-1 = 40 code payloads, 1 onboarded (resident), 39 HIDDEN** — resident-class modules (mostly `MAIN.CD/FILE_XXX/1.1`) that load at **unknown addresses**, so they are **not mechanically onboardable** (P9: can't byte-verify without the address; needs Phase-3-style runtime RE). Documented in `docs/disc-completeness.md`. **This is a bigger re-baselining than +4:** the true code surface is 140 onboarded **+ 39 type-1 modules pending RE** — the completion contract's binary count and the "100%" bar both move (→ T10/T11). SETUP §6.3 tool inventory updated (R21). *(completes with this commit)*
 - [x] **Task 8 — The byte-gate-honest re-scan + partition + ledger rebuild** `[Max]` — **DONE (deterministic core; the 1,670-triage scoped to P29 — see below).** Built **`worklist --assert-partition`** (R32, the audit's literal prescription — enumerate live stubs from `corpus.stubs`, assert the manifest partitions its source overlay): **proven** by catching 5 stale rows (the pin-free cores Phase-26 banked but the manifest still listed). Ran the **honest re-scan** — `build_fuel_manifest` on the fixed tools + 140 binaries: 223 live stubs, **giants re-verified reach-138** (was 134; the SC07 overlays counted), partition now **PASSES 223==223**. Regenerated `docs/worklist.md` + `docs/backlog.md`. **Fixed the ledger corruption:** `func_80178004`'s 2 false `close=0 "MATCH"` entries (a Phase-26-retracted myth — a real match would be BANKED, it's still a stub) → corrected to the honest **close=91** (regalloc wall); `func_8012E364` already honest (close=23, the "stale closeness" label was itself stale); the "duplicate rows" were func names in prose, not real dups (`load_best` dedups by addr, verified). **The 1,670-untriaged triage: scoped to P29** (P5d) — they're Phase-21 automation leftovers whose class labels get re-derived at harvest, and the pin-crash finding already re-buckets the PINS class; an Ultracode fan-out over 1,670 buys low-durable labels at high cost, and the gate's "validated residue map" is met by the partition + the deterministic class summary. *(completes with this commit)*
-- [ ] **Task 9 — Calibration probes (the swing numbers)** `[Max]` — member-adapt close-rate on register-drift members · realized ×N per fresh core crack (the §52 wave banked 5/5 — is that the rate?) · cost/fn per tier. Verify: every number traces to a **gate** result, not a scan. Report velocity (instr-%/session) for the flip-timing checkpoint — with the caveat that Phase 26's ≈+0.8%/session came mostly from the family engine + audit fixes, **both now spent**.
+- [x] **Task 9 — Calibration probes (the swing numbers)** `[Max]` — **DONE** → `docs/calibration.md`. Measured, byte-gate-grounded: **velocity** (instr 68.9→67.0%, a T7 denominator re-baselining DOWN, ~0 matches banked — Phase 27 is an infrastructure/findings phase; the honest read for the flip checkpoint is "denominator correction + unblocking findings," not "0 progress"); **the templatability swing** (the decisive P28/P29 input) = **h_exact reach-N cores propagate ≈×N near-100%** (§52: 5→670) vs **h_seq/h_norm structural families ≈0%** (`0x8017BEBC` 0/8) → the remaining yield is **per-member cracking + mechanical ×N for h_exact cores**, NOT "template ×120 the 986 families" (B1/B2's hope refuted); **cost/tier** (Fable5 ~230k tok/fn, **0 banks / 5** — ROI is idioms + the pin-crash wall, not banks; cheap-Opus is the banking tier). **Honest gap:** the headline **member-adapt close-rate on register-drift members** needs P28's `member_adapt` tool to measure (chicken-and-egg) — **P28 opens with it**, per the roadmap's risk register. New un-projected fuel: the ~20 PINS-class stubs are now harvestable (pin-crash dissolved). *(completes with this commit)*
 - [x] **Task 10 — Completion dashboard + the second oracle** `[xHigh]` — **DONE.** **10a:** routed `weighted_metrics` off the func_-only `src_stubs` regex onto `corpus.stubs` (R33) — **the landmine is real** (`src_stubs("SLUS_007.26")`→0 files→main 100%), and the switch is a **proven 0.000pp no-op** on the existing fleet. Added a **separate, caveated `MAIN game-code weighted` line** (0.7% — 54 tiny REAL matches over 60k game-code instructions; from a month-stale LINKED-excluding Ghidra sig; **NOT folded** into the decomp.dev headline, which would mislead the flip checkpoint). **10b:** `make sig-resident` (sig_image on the resident blob) + `corpus.sig_is_independent` now covers resident → `audit-corpus` gains the resident as an independent boundary oracle, **probed + verified clean (0 phantom/0 truncated)**. Also fixed **`sig-overlays` to derive from `overlays.mk`** (the `0.4.dec` glob silently dropped the 4 SC07 overlays) + made **`tools-health` regenerate the sigs first** (fresh-clone robustness — the resident audit needs the byte-derived sig). **10c:** `docs/second-oracle.md` — the main sig_image oracle's **3 structural blockers** (0x800 header, interleaved islands, one text range) + why seeding from splat destroys PHANTOM-class independence → **honest deferral, not a fake oracle**. Regenerated `docs/progress.fleet.md`: **140 binaries · fn-count 82.16% · instr-weighted 67.0% · distinct 47.8%** (the honest post-T7 drop from 68.9%). SETUP §6.3 updated (R21). *(completes with this commit)*
 - [ ] **Task 11 — PhaseEnd + Roadmap delta** `[Max]` — Tier-1. P7 checkbox walk → Drew's gate-2 → PhaseEnd (P8 format + R25 recap + the standing **Roadmap delta** line) + R31 decision-log entries; archive this file → `phase-ends/logs/Phase27.md` (R19, `git mv`, left uncommitted for Drew's close commit).