diff --git a/.gitignore b/.gitignore
index 499be1f0a..361ec54dc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,6 +49,8 @@
 /.run/s43/*
 !/.run/s43/*.c
 !/.run/s43/*.log
+!/.run/s43/*.py
+!/.run/s43/*.json
 !/.run/probe_jtbl/
 /.run/probe_jtbl/*
 !/.run/probe_jtbl/verdict.md
diff --git a/.run/backlog.jsonl b/.run/backlog.jsonl
index f254282f6..bb324f8e1 100644
--- a/.run/backlog.jsonl
+++ b/.run/backlog.jsonl
@@ -837,3 +837,4 @@
 {"ts": "2026-08-05 14:54:19", "addr": "0x8017C294", "name": "func_8017C294", "reach": 16, "klass": "regalloc: qty_compare tie + stratum-3 frame slot (cookbook 147)", "nins": 246, "status": "near", "closeness": 12, "where_stuck": "ov_SC01_077", "best_draft": ".run/s42/ov_SC01_077/func_8017C294.c", "binary": null, "source": "s42-serial", "residual": null, "passes_tried": null}
 {"ts": "2026-08-05 14:54:22", "addr": "0x8017C6F4", "name": "func_8017C6F4", "reach": 3, "klass": "regalloc: one register rotation; permuter UNTRIED (make_base_c fails on gte_ macros) - demacroize first (cookbook 148)", "nins": 947, "status": "near", "closeness": 63, "where_stuck": "ov_SC03_126", "best_draft": ".run/s42/ov_SC03_126/func_8017C6F4.c", "binary": null, "source": "s42-serial", "residual": null, "passes_tried": null}
 {"ts": "2026-08-05 16:05:31", "addr": "0x8017C6F4", "name": "func_8017C6F4", "reach": 3, "klass": "regalloc: register rotation (mnc/xmx1/cell/prim); ILS took hand-63 -> 42, flat across 5 restarts", "nins": 947, "status": "near", "closeness": 42, "where_stuck": "ov_SC03_126; permuter ILS plateau (masked 44 over 6 warm restarts); residual still the register rotation, fewer instances", "best_draft": ".run/s43/func_8017C6F4.ils44.c", "binary": "ov_SC03_126", "source": "s43-permuter-ils", "residual": null, "passes_tried": null}
+{"ts": "2026-08-05 16:17:15", "addr": "0x8017C6F4", "name": "func_8017C6F4", "reach": 3, "klass": "regalloc: register rotation; hand 63 -> ILS 42 (pin-free seed) -> ILS 41 (pin-t5 seed); both basins plateau", "nins": 947, "status": "near", "closeness": 41, "where_stuck": "ov_SC03_126; BEST KNOWN. permuter ILS from the pin-t5 seed, masked 43, flat over 5 warm restarts", "best_draft": ".run/s43/func_8017C6F4.ils43-pin.c", "binary": "ov_SC03_126", "source": "s43-permuter-ils", "residual": null, "passes_tried": null}
diff --git a/.run/s43/func_8017C6F4.ils43-pin.c b/.run/s43/func_8017C6F4.ils43-pin.c
new file mode 100644
index 000000000..52966575b
--- /dev/null
+++ b/.run/s43/func_8017C6F4.ils43-pin.c
@@ -0,0 +1,821 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+typedef struct 
+{
+  u32 w0;
+  u32 w1;
+  u32 w2;
+} Prim126;
+typedef struct 
+{
+  u8 *vtx;
+  u32 f4;
+  u32 xx;
+  u32 yy;
+  u32 zz;
+  Prim126 *prim;
+  Prim126 *end;
+} Cell126;
+typedef struct 
+{
+  s16 vx;
+  s16 vy;
+} DVECTOR2;
+typedef struct 
+{
+  s16 vx;
+  s16 vy;
+  s16 vz;
+  s16 pad;
+} SVECTOR2;
+typedef struct 
+{
+  s16 m[3][3];
+  s32 t[3];
+} MATRIX2;
+typedef struct 
+{
+  u32 tag;
+  u32 rgbc;
+  s16 x0;
+  s16 y0;
+  s16 x1;
+  s16 y1;
+  s16 x2;
+  s16 y2;
+} PolyF3;
+typedef struct 
+{
+  u32 tag;
+  u32 rgbc;
+  s16 x0;
+  s16 y0;
+  s16 x1;
+  s16 y1;
+  s16 x2;
+  s16 y2;
+  s16 x3;
+  s16 y3;
+} PolyF4;
+typedef struct 
+{
+  u32 tag;
+  u32 rgbc;
+  s16 x0;
+  s16 y0;
+  u32 uvc0;
+  s16 x1;
+  s16 y1;
+  u32 uvp1;
+  s16 x2;
+  s16 y2;
+  u16 uv2;
+  u16 p2;
+} PolyFT3;
+typedef struct 
+{
+  u32 tag;
+  u32 rgbc;
+  s16 x0;
+  s16 y0;
+  u32 uvc0;
+  s16 x1;
+  s16 y1;
+  u32 uvp1;
+  s16 x2;
+  s16 y2;
+  u16 uv2;
+  u16 p2;
+  s16 x3;
+  s16 y3;
+  u16 uv3;
+  u16 p3;
+} PolyFT4;
+void func_8017C6F4(s32 arg0)
+{
+  extern s32 func_800491EC(void);
+  extern void func_800547D8(s32, MATRIX2 *);
+  extern void func_80052E38(MATRIX2 *);
+  extern void func_8017C014(void *, void *, s32);
+  extern u8 D_8018F9C0[];
+  extern u8 *D_800A5E60;
+  extern u8 D_800A6610[];
+  extern short D_800B9A02;
+  s16 rect[4];
+  DVECTOR2 tmpxy[4];
+  SVECTOR2 box[8];
+  SVECTOR2 sxy[8];
+  MATRIX2 mtx;
+  struct 
+  {
+    long flag;
+    long opz;
+    long sz0;
+    long sz1;
+    long sz2;
+    long sz3;
+  } g;
+  s32 cx0;
+  s32 cx1;
+  s32 cy0;
+  s32 cy1;
+  s32 y;
+  s32 col;
+  Cell126 **rowptr;
+  Cell126 **p;
+  Cell126 *cell;
+register Prim126 *prim __asm__("$13");
+  Prim126 *end;
+  u8 *pkt;
+  u32 ot;
+  u8 *vtx;
+  u8 *va;
+  u8 *vb;
+  u8 *vc;
+  u8 *vd;
+  u32 w;
+  u32 code;
+  u32 wx;
+  u32 wy;
+  u32 wz;
+  u32 xlo;
+  u32 xhi;
+  u32 ylo;
+  u32 yhi;
+  u32 zlo;
+  u32 zhi;
+  s32 xa32;
+  s32 xb32;
+  s32 t32;
+  s32 xmn1;
+  s32 xmx1;
+  s32 xmn2;
+  s32 xmx2;
+  s32 mnc;
+  s32 mxc;
+  s32 my;
+  s32 mny;
+  s32 mx;
+  s32 mn;
+  func_800491EC();
+  func_800547D8(arg0 + 0x10, &mtx);
+  func_80052E38(&mtx);
+  func_8017C014(D_8018F9C0, rect, *((s32 *) (arg0 + 0x60)));
+  pkt = D_800A5E60;
+  ot = (u32) (&D_800A6610[(*((u16 *) (&D_800B9A02))) << 14]);
+  cx0 = (rect[0] + 0x4000) / 512;
+  cx1 = (((rect[0] + rect[2]) + 0x4000) / 512) + 2;
+  cx0 = (cx0 < 0) ? (0) : ((cx0 > 0x3F) ? (0x3F) : (cx0));
+  cx1 = (cx1 < 0) ? (0) : ((cx1 > 0x3F) ? (0x3F) : (cx1));
+  cy0 = ((rect[1] + 0x4000) / 512) - 1;
+  cy1 = (((rect[1] + rect[3]) + 0x4000) / 512) + 2;
+  cy0 = (cy0 < 0) ? (0) : ((cy0 > 0x3F) ? (0x3F) : (cy0));
+  cy1 = (cy1 < 0) ? (0) : ((cy1 > 0x3F) ? (0x3F) : (cy1));
+  rowptr = ((Cell126 **) (*((s32 *) (arg0 + 0xC)))) + ((cy0 * 64) + cx0);
+  for (y = cy0; y < cy1; y++, rowptr += 0x40)
+  {
+    for (col = cx0, p = rowptr; col < cx1; col++, p++)
+    {
+      cell = *p;
+      if (cell == 0)
+      {
+        continue;
+      }
+      wx = cell->xx;
+      xlo = wx & 0xFFFF;
+      xhi = wx >> 16;
+      wy = cell->yy;
+      ylo = wy & 0xFFFF;
+      yhi = wy >> 16;
+      wz = cell->zz;
+      zlo = wz & 0xFFFF;
+      zhi = wz >> 16;
+      box[0].vx = xlo;
+      box[0].vy = ylo;
+      box[0].vz = zlo;
+      box[1].vx = xhi;
+      box[1].vy = ylo;
+      box[1].vz = zlo;
+      box[2].vx = xlo;
+      box[2].vy = ylo;
+      box[2].vz = zhi;
+      box[3].vx = xhi;
+      box[3].vy = ylo;
+      box[3].vz = zhi;
+      box[4].vx = xlo;
+      box[4].vy = yhi;
+      box[4].vz = zlo;
+      box[5].vx = xhi;
+      box[5].vy = yhi;
+      box[5].vz = zlo;
+      box[6].vx = xlo;
+      box[6].vy = yhi;
+      box[6].vz = zhi;
+      box[7].vx = xhi;
+      box[7].vy = yhi;
+      box[7].vz = zhi;
+__asm__ volatile ( "lwc2 $0, 0( %0 );" "lwc2 $1, 4( %0 );" "lwc2 $2, 8( %0 );" "lwc2 $3, 12( %0 );" "lwc2 $4, 16( %0 );" "lwc2 $5, 20( %0 )" : : "r"( &box[0] ) );
+__asm__ volatile ("nop;nop;rtpt");
+__asm__ volatile ( "swc2 $12, 0( %0 );" "swc2 $13, 0( %1 );" "swc2 $14, 0( %2 )" : : "r"( &sxy[0] ), "r"( &sxy[1] ), "r"( &sxy[2] ) : "memory" );
+__asm__ volatile ( "lwc2 $0, 0( %0 );" "lwc2 $1, 4( %0 )" : : "r"( &box[3] ) );
+__asm__ volatile ("nop;nop;rtps");
+__asm__ volatile ( "swc2 $14, 0( %0 )" : : "r"( &sxy[3] ) : "memory" );
+__asm__ volatile ( "lwc2 $0, 0( %0 );" "lwc2 $1, 4( %0 );" "lwc2 $2, 8( %0 );" "lwc2 $3, 12( %0 );" "lwc2 $4, 16( %0 );" "lwc2 $5, 20( %0 )" : : "r"( &box[4] ) );
+__asm__ volatile ("nop;nop;rtpt");
+__asm__ volatile ( "swc2 $12, 0( %0 );" "swc2 $13, 0( %1 );" "swc2 $14, 0( %2 )" : : "r"( &sxy[4] ), "r"( &sxy[5] ), "r"( &sxy[6] ) : "memory" );
+__asm__ volatile ( "lwc2 $0, 0( %0 );" "lwc2 $1, 4( %0 )" : : "r"( &box[7] ) );
+__asm__ volatile ("nop;nop;rtps");
+__asm__ volatile ( "swc2 $14, 0( %0 )" : : "r"( &sxy[7] ) : "memory" );
+      xa32 = sxy[0].vx;
+      xb32 = sxy[1].vx;
+      if (xb32 < xa32)
+      {
+        xmx1 = xa32;
+        xmn1 = xb32;
+      }
+      else
+      {
+        xmn1 = xa32;
+        xmx1 = xb32;
+      }
+      t32 = sxy[2].vx;
+      if (xmx1 < t32)
+      {
+        xmx1 = t32;
+      }
+      else
+        if (t32 < xmn1)
+      {
+        xmn1 = t32;
+      }
+      t32 = sxy[3].vx;
+      if (xmx1 < t32)
+      {
+        xmx1 = t32;
+      }
+      else
+        if (t32 < xmn1)
+      {
+        xmn1 = t32;
+      }
+      xa32 = sxy[4].vx;
+      xb32 = sxy[5].vx;
+      if (xb32 < xa32)
+      {
+        xmx2 = xa32;
+        xmn2 = xb32;
+      }
+      else
+      {
+        xmn2 = xa32;
+        xmx2 = xb32;
+      }
+      t32 = sxy[6].vx;
+      if (xmx2 < t32)
+      {
+        xmx2 = t32;
+      }
+      else
+        if (t32 < xmn2)
+      {
+        xmn2 = t32;
+      }
+      t32 = sxy[7].vx;
+      if (xmx2 < t32)
+      {
+        xmx2 = t32;
+      }
+      else
+        if (t32 < xmn2)
+      {
+        xmn2 = t32;
+      }
+      mnc = xmn1;
+      if (xmn2 < mnc)
+      {
+        mnc = xmn2;
+      }
+      mxc = xmx1;
+      if (mxc < xmx2)
+      {
+        mxc = xmx2;
+      }
+      if (mxc < (-0xA0))
+      {
+        continue;
+      }
+      if (!(mnc < 0xA1))
+      {
+        continue;
+      }
+      xa32 = sxy[0].vy;
+      xb32 = sxy[1].vy;
+      if (xb32 < xa32)
+      {
+        xmx1 = xa32;
+        xmn1 = xb32;
+      }
+      else
+      {
+        xmn1 = xa32;
+        xmx1 = xb32;
+      }
+      t32 = sxy[2].vy;
+      if (xmx1 < t32)
+      {
+        xmx1 = t32;
+      }
+      else
+        if (t32 < xmn1)
+      {
+        xmn1 = t32;
+      }
+      t32 = sxy[3].vy;
+      if (xmx1 < t32)
+      {
+        xmx1 = t32;
+      }
+      else
+        if (t32 < xmn1)
+      {
+        xmn1 = t32;
+      }
+      xa32 = sxy[4].vy;
+      xb32 = sxy[5].vy;
+      if (xb32 < xa32)
+      {
+        xmx2 = xa32;
+        xmn2 = xb32;
+      }
+      else
+      {
+        xmn2 = xa32;
+        xmx2 = xb32;
+      }
+      t32 = sxy[6].vy;
+      if (xmx2 < t32)
+      {
+        xmx2 = t32;
+      }
+      else
+        if (t32 < xmn2)
+      {
+        xmn2 = t32;
+      }
+      t32 = sxy[7].vy;
+      if (xmx2 < t32)
+      {
+        xmx2 = t32;
+      }
+      else
+        if (t32 < xmn2)
+      {
+        mxc = xmx1;
+        xmn2 = t32;
+      }
+      mnc = xmn1;
+      if (xmn2 < mnc)
+      {
+        mnc = xmn2;
+      }
+      if (mxc < xmx2)
+      {
+        mxc = xmx2;
+      }
+      if (mxc < (-0x78))
+      {
+        continue;
+      }
+      if (!(mnc < 0x79))
+      {
+        continue;
+      }
+      prim = cell->prim;
+      end = cell->end;
+      vtx = cell->vtx;
+      while (prim < end)
+      {
+        w = prim->w1;
+        va = vtx + (w & 0xFFFF);
+        vb = vtx + (w >> 16);
+        w = prim->w2;
+        vc = vtx + (w & 0xFFFF);
+        w = w >> 16;
+__asm__ volatile ( "lwc2 $0, 0( %0 );" "lwc2 $1, 4( %0 );" "lwc2 $2, 0( %1 );" "lwc2 $3, 4( %1 );" "lwc2 $4, 0( %2 );" "lwc2 $5, 4( %2 )" : : "r"( va ), "r"( vb ), "r"( vc ) );
+__asm__ volatile ("nop;nop;rtpt");
+__asm__ volatile ( "cfc2 $12, $31;" "nop;" "sw $12, 0( %0 )" : : "r"( &g.flag ) : "$12", "memory" );
+        if (!(g.flag & 0x7F85E000))
+        {
+__asm__ volatile ("nop;nop;nclip");
+          code = w & 0xF;
+          vd = vtx + ((w & 0xFFF0) >> 1);
+__asm__ volatile ( "swc2 $24, 0( %0 )" : : "r"( &g.opz ) : "memory" );
+          if (g.opz > 0)
+          {
+            switch (code)
+            {
+case 4:
+                        case 5:
+                            __asm__ volatile ( "swc2 $12, 8( %0 );" "swc2 $13, 12( %0 );" "swc2 $14, 16( %0 )" : : "r"( pkt ) : "memory" );
+__asm__ volatile ( "swc2 $17, 0( %0 );" "swc2 $18, 0( %1 );" "swc2 $19, 0( %2 )" : : "r"( &g.sz0 ), "r"( &g.sz1 ), "r"( &g.sz2 ) : "memory" );
+              if (((PolyFT3 *) pkt)->x0 > ((PolyFT3 *) pkt)->x1)
+              {
+                mx = ((PolyFT3 *) pkt)->x0;
+                mn = ((PolyFT3 *) pkt)->x1;
+              }
+              else
+              {
+                mn = ((PolyFT3 *) pkt)->x0;
+                mx = ((PolyFT3 *) pkt)->x1;
+              }
+              if (((PolyFT3 *) pkt)->x2 > mx)
+              {
+                mx = ((PolyFT3 *) pkt)->x2;
+              }
+              else
+                if (((PolyFT3 *) pkt)->x2 < mn)
+              {
+                mn = ((PolyFT3 *) pkt)->x2;
+              }
+              if ((mx >= (-0xA0)) && (mn < 0xA1))
+              {
+                if (((PolyFT3 *) pkt)->y0 > ((PolyFT3 *) pkt)->y1)
+                {
+                  my = ((PolyFT3 *) pkt)->y0;
+                  mny = ((PolyFT3 *) pkt)->y1;
+                }
+                else
+                {
+                  mny = ((PolyFT3 *) pkt)->y0;
+                  my = ((PolyFT3 *) pkt)->y1;
+                }
+                if (((PolyFT3 *) pkt)->y2 > my)
+                {
+                  my = ((PolyFT3 *) pkt)->y2;
+                }
+                else
+                  if (((PolyFT3 *) pkt)->y2 < mny)
+                {
+                  mny = ((PolyFT3 *) pkt)->y2;
+                }
+                if ((my >= (-0x78)) && (mny < 0x79))
+                {
+                  s32 za;
+                  u32 *otp;
+                  if (g.sz0 > g.sz1)
+                  {
+                    za = g.sz0;
+                    if (za < g.sz2)
+                    {
+                      za = g.sz2;
+                    }
+                  }
+                  else
+                  {
+                    za = g.sz1;
+                    if (za < g.sz2)
+                    {
+                      za = g.sz2;
+                    }
+                  }
+                  g.opz = za;
+                  if (code != 4)
+                  {
+                    g.opz = za + 0x200;
+                  }
+                  ((PolyF3 *) pkt)->rgbc = prim->w0;
+                  otp = (u32 *) (((g.opz >> 2) << 2) + ot);
+                  *((u32 *) pkt) = ((*otp) & 0xFFFFFF) | 0x4000000;
+                  *otp = ((*otp) & 0xFF000000) | (((u32) pkt) & 0xFFFFFF);
+                  pkt += 0x14;
+                }
+              }
+              break;
+case 6:
+                        case 7:
+                            __asm__ volatile ( "swc2 $12, 0( %0 );" "swc2 $13, 4( %0 );" "swc2 $14, 8( %0 )" : : "r"( &tmpxy[0] ) : "memory" );
+__asm__ volatile ( "swc2 $17, 0( %0 );" "swc2 $18, 0( %1 );" "swc2 $19, 0( %2 )" : : "r"( &g.sz0 ), "r"( &g.sz1 ), "r"( &g.sz2 ) : "memory" );
+              if (tmpxy[0].vx > tmpxy[1].vx)
+              {
+                mx = tmpxy[0].vx;
+                mn = tmpxy[1].vx;
+              }
+              else
+              {
+                mn = tmpxy[0].vx;
+                mx = tmpxy[1].vx;
+              }
+              if (tmpxy[2].vx > mx)
+              {
+                mx = tmpxy[2].vx;
+              }
+              else
+                if (tmpxy[2].vx < mn)
+              {
+                mn = tmpxy[2].vx;
+              }
+              if ((mx >= (-0xA0)) && (mn < 0xA1))
+              {
+                if (tmpxy[0].vy > tmpxy[1].vy)
+                {
+                  my = tmpxy[0].vy;
+                  mny = tmpxy[1].vy;
+                }
+                else
+                {
+                  mny = tmpxy[0].vy;
+                  my = tmpxy[1].vy;
+                }
+                if (tmpxy[2].vy > my)
+                {
+                  my = tmpxy[2].vy;
+                }
+                else
+                  if (tmpxy[2].vy < mny)
+                {
+                  mny = tmpxy[2].vy;
+                }
+                if ((my >= (-0x78)) && (mny < 0x79))
+                {
+                  s32 za;
+                  u32 *otp;
+                  u32 *tp;
+__asm__ volatile ("nop;nop;avsz3");
+                  if (g.sz0 > g.sz1)
+                  {
+                    za = g.sz0;
+                    if (za < g.sz2)
+                    {
+                      za = g.sz2;
+                    }
+                  }
+                  else
+                  {
+                    za = g.sz1;
+                    if (za < g.sz2)
+                    {
+                      za = g.sz2;
+                    }
+                  }
+                  g.opz = za;
+                  if (code != 6)
+                  {
+                    g.opz = za + 0x200;
+                  }
+                  *((u32 *) (&((PolyFT3 *) pkt)->x0)) = *((u32 *) (&tmpxy[0]));
+                  *((u32 *) (&((PolyFT3 *) pkt)->x1)) = *((u32 *) (&tmpxy[1]));
+                  *((u32 *) (&((PolyFT3 *) pkt)->x2)) = *((u32 *) (&tmpxy[2]));
+                  tp = (u32 *) prim->w0;
+                  ((PolyFT3 *) pkt)->rgbc = tp[0];
+                  ((PolyFT3 *) pkt)->uvc0 = tp[1];
+                  ((PolyFT3 *) pkt)->uvp1 = tp[2];
+                  ((PolyFT3 *) pkt)->uv2 = tp[3];
+                  otp = (u32 *) (((g.opz >> 2) << 2) + ot);
+                  *((u32 *) pkt) = ((*otp) & 0xFFFFFF) | 0x7000000;
+                  *otp = ((*otp) & 0xFF000000) | (((u32) pkt) & 0xFFFFFF);
+                  pkt += 0x20;
+                }
+              }
+              break;
+case 0:
+                        case 1:
+                            __asm__ volatile ( "swc2 $12, 8( %0 );" "swc2 $13, 12( %0 );" "swc2 $14, 16( %0 )" : : "r"( pkt ) : "memory" );
+__asm__ volatile ( "lwc2 $0, 0( %0 );" "lwc2 $1, 4( %0 )" : : "r"( vd ) );
+__asm__ volatile ("nop;nop;rtps");
+              if (((PolyF4 *) pkt)->x0 > ((PolyF4 *) pkt)->x1)
+              {
+                mx = ((PolyF4 *) pkt)->x0;
+                mn = ((PolyF4 *) pkt)->x1;
+              }
+              else
+              {
+                mn = ((PolyF4 *) pkt)->x0;
+                mx = ((PolyF4 *) pkt)->x1;
+              }
+              if (((PolyF4 *) pkt)->x2 > mx)
+              {
+                mx = ((PolyF4 *) pkt)->x2;
+              }
+              else
+                if (((PolyF4 *) pkt)->x2 < mn)
+              {
+                mn = ((PolyF4 *) pkt)->x2;
+              }
+              if (((PolyF4 *) pkt)->y0 > ((PolyF4 *) pkt)->y1)
+              {
+                my = ((PolyF4 *) pkt)->y0;
+                mny = ((PolyF4 *) pkt)->y1;
+              }
+              else
+              {
+                mny = ((PolyF4 *) pkt)->y0;
+                my = ((PolyF4 *) pkt)->y1;
+              }
+              if (((PolyF4 *) pkt)->y2 > my)
+              {
+                my = ((PolyF4 *) pkt)->y2;
+              }
+              else
+                if (((PolyF4 *) pkt)->y2 < mny)
+              {
+                mny = ((PolyF4 *) pkt)->y2;
+              }
+__asm__ volatile ( "cfc2 $12, $31;" "nop;" "sw $12, 0( %0 )" : : "r"( &g.flag ) : "$12", "memory" );
+              if (!(g.flag & 0x7F85E000))
+              {
+__asm__ volatile ( "swc2 $16, 0( %0 );" "swc2 $17, 0( %1 );" "swc2 $18, 0( %2 );" "swc2 $19, 0( %3 )" : : "r"( &g.sz0 ), "r"( &g.sz1 ), "r"( &g.sz2 ), "r"( &g.sz3 ) : "memory" );
+__asm__ volatile ( "swc2 $14, 0( %0 )" : : "r"( (long *)&((PolyF4 *)pkt)->x3 ) : "memory" );
+                if (((PolyF4 *) pkt)->x3 < mn)
+                {
+                  mn = ((PolyF4 *) pkt)->x3;
+                }
+                else
+                  if (mx < ((PolyF4 *) pkt)->x3)
+                {
+                  mx = ((PolyF4 *) pkt)->x3;
+                }
+                if ((mx >= (-0xA0)) && (mn < 0xA1))
+                {
+                  if (((PolyF4 *) pkt)->y3 < mny)
+                  {
+                    mny = ((PolyF4 *) pkt)->y3;
+                  }
+                  else
+                    if (my < ((PolyF4 *) pkt)->y3)
+                  {
+                    my = ((PolyF4 *) pkt)->y3;
+                  }
+                  if ((my >= (-0x78)) && (mny < 0x79))
+                  {
+                    s32 za;
+                    s32 zb;
+                    u32 *otp;
+                    zb = g.sz2;
+                    if (zb < g.sz3)
+                    {
+                      zb = g.sz3;
+                    }
+                    za = g.sz0;
+                    if (za < g.sz1)
+                    {
+                      za = g.sz1;
+                    }
+                    if (za < zb)
+                    {
+                      za = zb;
+                    }
+                    g.opz = za;
+                    if (code != 0)
+                    {
+                      g.opz = za + 0x200;
+                    }
+                    ((PolyF4 *) pkt)->rgbc = prim->w0;
+                    otp = (u32 *) (((g.opz >> 2) << 2) + ot);
+                    *((u32 *) pkt) = ((*otp) & 0xFFFFFF) | 0x5000000;
+                    *otp = ((*otp) & 0xFF000000) | (((u32) pkt) & 0xFFFFFF);
+                    pkt += 0x18;
+                  }
+                }
+              }
+              break;
+case 2:
+                        case 3:
+                            __asm__ volatile ( "swc2 $12, 0( %0 );" "swc2 $13, 4( %0 );" "swc2 $14, 8( %0 )" : : "r"( &tmpxy[0] ) : "memory" );
+__asm__ volatile ( "lwc2 $0, 0( %0 );" "lwc2 $1, 4( %0 )" : : "r"( vd ) );
+__asm__ volatile ("nop;nop;rtps");
+__asm__ volatile ( "cfc2 $12, $31;" "nop;" "sw $12, 0( %0 )" : : "r"( &g.flag ) : "$12", "memory" );
+              if (!(g.flag & 0x7F85E000))
+              {
+__asm__ volatile ( "swc2 $14, 0( %0 )" : : "r"( &tmpxy[3] ) : "memory" );
+__asm__ volatile ( "swc2 $16, 0( %0 );" "swc2 $17, 0( %1 );" "swc2 $18, 0( %2 );" "swc2 $19, 0( %3 )" : : "r"( &g.sz0 ), "r"( &g.sz1 ), "r"( &g.sz2 ), "r"( &g.sz3 ) : "memory" );
+                if (tmpxy[0].vx > tmpxy[1].vx)
+                {
+                  mx = tmpxy[0].vx;
+                  mn = tmpxy[1].vx;
+                }
+                else
+                {
+                  mn = tmpxy[0].vx;
+                  mx = tmpxy[1].vx;
+                }
+                if (tmpxy[2].vx > mx)
+                {
+                  mx = tmpxy[2].vx;
+                }
+                else
+                  if (tmpxy[2].vx < mn)
+                {
+                  mn = tmpxy[2].vx;
+                }
+                if (tmpxy[3].vx > mx)
+                {
+                  mx = tmpxy[3].vx;
+                }
+                else
+                  if (tmpxy[3].vx < mn)
+                {
+                  mn = tmpxy[3].vx;
+                }
+                if ((mx >= (-0xA0)) && (mn < 0xA1))
+                {
+                  if (tmpxy[0].vy > tmpxy[1].vy)
+                  {
+                    my = tmpxy[0].vy;
+                    mny = tmpxy[1].vy;
+                  }
+                  else
+                  {
+                    mny = tmpxy[0].vy;
+                    my = tmpxy[1].vy;
+                  }
+                  if (tmpxy[2].vy > my)
+                  {
+                    my = tmpxy[2].vy;
+                  }
+                  else
+                    if (tmpxy[2].vy < mny)
+                  {
+                    mny = tmpxy[2].vy;
+                  }
+                  if (tmpxy[3].vx > my)
+                  {
+                    my = tmpxy[3].vx;
+                  }
+                  else
+                    if (tmpxy[3].vx < mny)
+                  {
+                    mny = tmpxy[3].vx;
+                  }
+                  if ((my >= (-0x78)) && (mny < 0x79))
+                  {
+                    s32 za;
+                    s32 zb;
+                    u32 *otp;
+                    u32 *tp;
+                    u32 uvw;
+__asm__ volatile ("nop;nop;avsz4");
+                    zb = g.sz2;
+                    if (zb < g.sz3)
+                    {
+                      zb = g.sz3;
+                    }
+                    za = g.sz0;
+                    if (za < g.sz1)
+                    {
+                      za = g.sz1;
+                    }
+                    if (za < zb)
+                    {
+                      za = zb;
+                    }
+                    g.opz = za;
+                    if (code != 2)
+                    {
+                      g.opz = za + 0x200;
+                    }
+                    *((u32 *) (&((PolyFT4 *) pkt)->x0)) = *((u32 *) (&tmpxy[0]));
+                    *((u32 *) (&((PolyFT4 *) pkt)->x1)) = *((u32 *) (&tmpxy[1]));
+                    *((u32 *) (&((PolyFT4 *) pkt)->x2)) = *((u32 *) (&tmpxy[2]));
+                    *((u32 *) (&((PolyFT4 *) pkt)->x3)) = *((u32 *) (&tmpxy[3]));
+                    tp = (u32 *) prim->w0;
+                    ((PolyFT4 *) pkt)->rgbc = tp[0];
+                    ((PolyFT4 *) pkt)->uvc0 = tp[1];
+                    ((PolyFT4 *) pkt)->uvp1 = tp[2];
+                    uvw = tp[3];
+                    ((PolyFT4 *) pkt)->uv2 = uvw;
+                    ((PolyFT4 *) pkt)->uv3 = uvw >> 16;
+                    otp = (u32 *) (((g.opz >> 2) << 2) + ot);
+                    *((u32 *) pkt) = ((*otp) & 0xFFFFFF) | 0x9000000;
+                    *otp = ((*otp) & 0xFF000000) | (((u32) pkt) & 0xFFFFFF);
+                    pkt += 0x28;
+                  }
+                }
+              }
+              break;
+            }
+
+          }
+        }
+        prim++;
+      }
+
+    }
+
+  }
+
+  D_800A5E60 = pkt;
+}
\ No newline at end of file
diff --git a/.run/s43/ils_round2.log b/.run/s43/ils_round2.log
new file mode 100644
index 000000000..5b36fbe3d
--- /dev/null
+++ b/.run/s43/ils_round2.log
@@ -0,0 +1,19 @@
+=== ILS from the improved 42-seed ===
+ILS func_8017C6F4: 8 cycles x 300s @ -j10, klass=REGALLOC
+  cycle 1: best score = 44  [output-44-1]
+  cycle 2: best score = 44 (unchanged)  [output-44-1]
+  cycle 3: best score = 44 (unchanged)  [output-44-1]
+  cycle 4: best score = 44 (unchanged)  [output-44-1]
+  cycle 5: best score = 44 (unchanged)  [output-44-1]
+  cycle 6: best score = 44 (unchanged)  [output-44-1]
+  cycle 7: best score = 44 (unchanged)  [output-44-1]
+  cycle 8: best score = 44 (unchanged)  [output-44-1]
+ILS done: best=44 (no score-0; seed for Fable5 or a longer run)
+=== ILS on the pin-t5 variant (hand NEAR 47) ===
+ILS func_8017C6F4: 5 cycles x 300s @ -j10, klass=REGALLOC
+  cycle 1: best score = 43  [output-43-1]
+  cycle 2: best score = 43 (unchanged)  [output-43-1]
+  cycle 3: best score = 43 (unchanged)  [output-43-1]
+  cycle 4: best score = 43 (unchanged)  [output-43-1]
+  cycle 5: best score = 43 (unchanged)  [output-43-1]
+ILS done: best=43 (no score-0; seed for Fable5 or a longer run)
diff --git a/.run/s43/leftover_probe.json b/.run/s43/leftover_probe.json
new file mode 100644
index 000000000..316e0b01e
--- /dev/null
+++ b/.run/s43/leftover_probe.json
@@ -0,0 +1,188 @@
+[
+ {
+  "fn": "func_8017DC38",
+  "target": "ov_SC03_013",
+  "n_sources": 2,
+  "result": "reloc-mismatch (2 srcs tried): _013): reloc-count mismatch 12!=8 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017DC38",
+  "target": "ov_SC03_114",
+  "n_sources": 2,
+  "result": "reloc-mismatch (2 srcs tried): _114): reloc-count mismatch 12!=2 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017E02C",
+  "target": "ov_SC02_026",
+  "n_sources": 3,
+  "result": "reloc-mismatch (3 srcs tried): _026): reloc-count mismatch 12!=4 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017E1AC",
+  "target": "ov_SC01_084",
+  "n_sources": 4,
+  "result": "reloc-mismatch (4 srcs tried): 1_084): reloc-count mismatch 2!=6 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017E1AC",
+  "target": "ov_SC07_010",
+  "n_sources": 4,
+  "result": "reloc-mismatch (4 srcs tried): 7_010): reloc-count mismatch 2!=8 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017E3B0",
+  "target": "ov_SC03_094",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _094): reloc-count mismatch 12!=9 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017E640",
+  "target": "ov_SC02_039",
+  "n_sources": 4,
+  "result": "reloc-mismatch (4 srcs tried): _039): reloc-count mismatch 12!=7 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017E950",
+  "target": "ov_SC04_018",
+  "n_sources": 4,
+  "result": "reloc-mismatch (4 srcs tried): 4_018): reloc-count mismatch 1!=3 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017E950",
+  "target": "ov_SC04_019",
+  "n_sources": 4,
+  "result": "reloc-mismatch (4 srcs tried): 4_019): reloc-count mismatch 1!=3 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017ED60",
+  "target": "ov_SC04_011",
+  "n_sources": 4,
+  "result": "reloc-mismatch (4 srcs tried): 4_011): reloc-count mismatch 9!=6 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017ED60",
+  "target": "ov_SC05_018",
+  "n_sources": 4,
+  "result": "reloc-mismatch (4 srcs tried): 5_018): reloc-count mismatch 9!=4 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017F940",
+  "target": "ov_SC05_002",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 5_002): reloc-count mismatch 8!=5 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8017F940",
+  "target": "ov_SC06_014",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 6_014): reloc-count mismatch 8!=4 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_801809E4",
+  "target": "ov_SC01_080",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _080): reloc-count mismatch 2!=15 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_801809E4",
+  "target": "ov_SC06_010",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 6_010): reloc-count mismatch 2!=4 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80180EB8",
+  "target": "ov_SC05_004",
+  "n_sources": 2,
+  "result": "reloc-mismatch (2 srcs tried): 5_004): reloc-count mismatch 8!=3 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80181490",
+  "target": "ov_SC05_017",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _017): reloc-count mismatch 11!=6 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_801814FC",
+  "target": "ov_SC03_090",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _090): reloc-count mismatch 11!=4 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8018163C",
+  "target": "ov_SC03_006",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _006): reloc-count mismatch 12!=2 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80181BB4",
+  "target": "ov_SC02_031",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 2_031): reloc-count mismatch 2!=5 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80181BB4",
+  "target": "ov_SC06_033",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 6_033): reloc-count mismatch 2!=0 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80181FC4",
+  "target": "ov_SC03_101",
+  "n_sources": 2,
+  "result": "reloc-mismatch (2 srcs tried): 3_101): reloc-count mismatch 8!=2 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_801823F8",
+  "target": "ov_SC03_118",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _118): reloc-count mismatch 12!=3 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_801823F8",
+  "target": "ov_SC03_119",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _119): reloc-count mismatch 12!=3 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_801828A4",
+  "target": "ov_SC04_002",
+  "n_sources": 3,
+  "result": "reloc-mismatch (3 srcs tried): _002): reloc-count mismatch 12!=6 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80183560",
+  "target": "ov_SC02_041",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 2_041): reloc-count mismatch 8!=2 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_801853B4",
+  "target": "ov_SC03_006",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): _006): reloc-count mismatch 11!=8 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80185DA8",
+  "target": "ov_SC04_002",
+  "n_sources": 2,
+  "result": "reloc-mismatch (2 srcs tried): 002): reloc-count mismatch 11!=20 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_80186074",
+  "target": "ov_SC03_007",
+  "n_sources": 2,
+  "result": "reloc-mismatch (2 srcs tried): _007): reloc-count mismatch 11!=5 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8018676C",
+  "target": "ov_SC03_007",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 3_007): reloc-count mismatch 7!=2 (not an h_norm-clean pair)"
+ },
+ {
+  "fn": "func_8018676C",
+  "target": "ov_SC03_105",
+  "n_sources": 1,
+  "result": "reloc-mismatch (1 srcs tried): 3_105): reloc-count mismatch 7!=5 (not an h_norm-clean pair)"
+ }
+]
\ No newline at end of file
diff --git a/.run/s43/probe_leftovers.py b/.run/s43/probe_leftovers.py
new file mode 100644
index 000000000..e184e3184
--- /dev/null
+++ b/.run/s43/probe_leftovers.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""P30 S43 — is the '26 unpropagated members' item really cheap fuel?
+
+For every member still open from the S40 propagation, try to mechanically remap it from EVERY
+binary where the same function is already matched. A success means it is templatable (cheap fuel,
+as the checkpoint claims); a reloc-count mismatch on every source means the body is structurally
+distinct and there is nothing to template from — i.e. genuine work, not plumbing.
+
+SCAN, don't sample (S4's lesson): report the rate over the whole set.
+"""
+import json, os, subprocess, sys
+sys.path.insert(0, 'tools')
+import corpus, dup_report
+
+LEFTOVERS = {
+    'func_801809E4': ['ov_SC01_080', 'ov_SC06_010'], 'func_8017E1AC': ['ov_SC01_084', 'ov_SC07_010'],
+    'func_80181BB4': ['ov_SC02_031', 'ov_SC06_033'], 'func_8018676C': ['ov_SC03_007', 'ov_SC03_105'],
+    'func_8017DC38': ['ov_SC03_013', 'ov_SC03_114'], 'func_801823F8': ['ov_SC03_118', 'ov_SC03_119'],
+    'func_8017ED60': ['ov_SC04_011', 'ov_SC05_018'], 'func_8017E950': ['ov_SC04_018', 'ov_SC04_019'],
+    'func_8017F940': ['ov_SC05_002', 'ov_SC06_014'], 'func_8017E02C': ['ov_SC02_026'],
+    'func_8017E640': ['ov_SC02_039'], 'func_80183560': ['ov_SC02_041'],
+    'func_8018163C': ['ov_SC03_006'], 'func_801853B4': ['ov_SC03_006'],
+    'func_80186074': ['ov_SC03_007'], 'func_801814FC': ['ov_SC03_090'],
+    'func_8017E3B0': ['ov_SC03_094'], 'func_80181FC4': ['ov_SC03_101'],
+    'func_801828A4': ['ov_SC04_002'], 'func_80185DA8': ['ov_SC04_002'],
+    'func_80180EB8': ['ov_SC05_004'], 'func_80181490': ['ov_SC05_017'],
+}
+MAX_SRC = 4
+
+def matched_sources(fn, skip):
+    """binaries where fn exists in source and is NOT an open stub (i.e. already matched)."""
+    out, nm = [], fn.upper().replace('FUNC_', 'func_')
+    for b in sorted(dup_report.BINARIES):
+        if b in skip or not b.startswith('ov_'):
+            continue
+        try:
+            if nm in corpus.stubs(b):
+                continue
+        except Exception:
+            continue
+        hit = subprocess.run(['bash', '-c', f'grep -rlF "{fn}" src/{b}/ 2>/dev/null | head -1'],
+                             capture_output=True, text=True).stdout.strip()
+        if hit:
+            out.append(b)
+        if len(out) >= MAX_SRC:
+            break
+    return out
+
+os.makedirs('.run/s43/remap', exist_ok=True)
+rows, ok, bad = [], 0, 0
+for fn, openbins in sorted(LEFTOVERS.items()):
+    addr = '0x' + fn.split('_')[1].lower()
+    srcs = matched_sources(fn, set(openbins))
+    for tgt in openbins:
+        res = 'NO-SOURCE'
+        for s in srcs:
+            out = f'.run/s43/remap/{fn}.{tgt}.c'
+            p = subprocess.run(['.venv/bin/python', 'tools/family_remap.py', '--addr', addr,
+                                '--from', s, '--to', tgt, '--out', out],
+                               capture_output=True, text=True)
+            if p.returncode == 0 and os.path.exists(out):
+                res = f'REMAPPED from {s}'
+                break
+            err = (p.stderr or p.stdout or '').strip().splitlines()
+            res = ('reloc-mismatch (' + str(len(srcs)) + ' srcs tried): ' +
+                   (err[-1][-60:] if err else '?'))
+        rows.append((fn, tgt, len(srcs), res))
+        if res.startswith('REMAPPED'):
+            ok += 1
+        else:
+            bad += 1
+        print(f'  {fn} -> {tgt}: {res}', flush=True)
+
+print(f'\n=== RESULT: {ok} templatable / {bad} not, of {ok+bad} open member instances ===')
+json.dump([{'fn': f, 'target': t, 'n_sources': n, 'result': r} for f, t, n, r in rows],
+          open('.run/s43/leftover_probe.json', 'w'), indent=1)
diff --git a/docs/backlog.md b/docs/backlog.md
index ec6c60d9a..405d79e0d 100644
--- a/docs/backlog.md
+++ b/docs/backlog.md
@@ -2,12 +2,12 @@
 
 > Generated by `tools/backlog.py render` from `.run/backlog.jsonl`. These are functions the Phase-21 automation got **close** on but did NOT byte-match. The whole-binary byte-gate is the sole arbiter (G3/P9): **byte-matches bank and are NOT listed here** — only genuine near-misses/blockers are. Ranked by hand-session priority: **reach** (×N propagation leverage) → **closeness** (match_one mismatch count, lower = closer) → **size**. Each row's `best_draft` is the closest C the machine reached — resume from there.
 
-**Open near-misses:** 837  ·  by status {'near': 797, 'failed': 40}  ·  by class {'regalloc: qty_compare tie + stratum-3 frame slot (cookbook 147)': 1, 'regalloc: register rotation (mnc/xmx1/cell/prim); ILS took hand-63 -> 42, flat across 5 restarts': 1, 'plumbing': 3, 'struct': 4, 'regalloc-order': 3, 'schedule': 2, 'loose-typing': 1, 'WAVE': 8, None: 805, 'STRUCT': 9}
+**Open near-misses:** 837  ·  by status {'near': 797, 'failed': 40}  ·  by class {'regalloc: qty_compare tie + stratum-3 frame slot (cookbook 147)': 1, 'regalloc: register rotation; hand 63 -> ILS 42 (pin-free seed) -> ILS 41 (pin-t5 seed); both basins plateau': 1, 'plumbing': 3, 'struct': 4, 'regalloc-order': 3, 'schedule': 2, 'loose-typing': 1, 'WAVE': 8, None: 805, 'STRUCT': 9}
 
 | # | addr | reach | class | nins | status | closeness | where it stuck | best draft |
 |--:|------|------:|-------|-----:|--------|----------:|----------------|------------|
 | 1 | func_8017C294 | 16 | regalloc: qty_compare tie + stratum-3 frame slot (cookbook 147) | 246 | near | 12 | ov_SC01_077 | `.run/s42/ov_SC01_077/func_8017C294.c` |
-| 2 | func_8017C6F4 | 3 | regalloc: register rotation (mnc/xmx1/cell/prim); ILS took hand-63 -> 42, flat across 5 restarts | 947 | near | 42 | ov_SC03_126; permuter ILS plateau (masked 44 over 6 warm restarts); residual still the register rotation, fewer instances | `.run/s43/func_8017C6F4.ils44.c` |
+| 2 | func_8017C6F4 | 3 | regalloc: register rotation; hand 63 -> ILS 42 (pin-free seed) -> ILS 41 (pin-t5 seed); both basins plateau | 947 | near | 41 | ov_SC03_126; BEST KNOWN. permuter ILS from the pin-t5 seed, masked 43, flat over 5 warm restarts | `.run/s43/func_8017C6F4.ils43-pin.c` |
 | 3 | func_8017F714 | 1 | plumbing | 27 | near | 0 | none — MATCH (27/27 ins, match_one verified) | `.run/backlog_drafts/func_8017F714.c` |
 | 4 | func_8017E224 | 1 | struct | 29 | near | 0 | none — MATCH (unaligned 8-byte memcpy of global onto stack + cond byte incr) | `.run/backlog_drafts/func_8017E224.c` |
 | 5 | func_80184A68 | 1 | regalloc-order | 33 | near | 0 | none — MATCH | `.run/backlog_drafts/func_80184A68.c` |
diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md
index abaab03d8..672cf6921 100644
--- a/phase-ends/CURRENT_PHASE.md
+++ b/phase-ends/CURRENT_PHASE.md
@@ -181,7 +181,69 @@ stub on a named wall/behemoth/queue ledger** — 140/140 byte-identical througho
 
 ---
 
-# 🛑 SESSION S39–S42 CHECKPOINT (2026-08-05) — FRESH SESSION SAFE HERE
+# 🛑 SESSION S43 CHECKPOINT (2026-08-05) — FRESH SESSION SAFE HERE
+> **Tree CLEAN** but for R23 `db.*.gbf` churn (never stage). **Nothing running.** Effort **Max**.
+> **NO phase close** — T5 unopened, needs Drew's gate-2.
+> **No src/ or config/ change this session** ⇒ the fleet cannot have moved: metrics below are S42's,
+> carried forward unchanged, and no R22 run was owed (nothing was banked).
+
+## WHAT S43 WAS: FOUR INSTRUMENT DEFECTS, AND THE TWO QUESTIONS THEY HID
+The session opened on the serial crack queue's named next move ("demacroize `func_8017C6F4` so the
+permuter can be aimed") and found that neither the blocker nor the two work items behind it were what
+the checkpoint said. **Nothing was banked; four tools now tell the truth, one floor moved, and one
+phantom item left the board.** Full detail in the S43-1..4 per-task log entries below.
+
+| # | recorded as | actually | consequence |
+|---|---|---|---|
+| 1 | "the GTE `#define` block defeats `make_base_c` — demacroize first" (§148) | `cpp_expand_macros` ran BEFORE `#include` was stripped → cpp rc=1 → **silent fallback** returned the unexpanded draft | the permuter was **silently dead on 63 stored drafts**, incl. the behemoth renderer drafts |
+| 2 | "an artifact-less backlog rumour outranks the real 63" | the row is real and reproduces (14/15) — but on a **different body**: `0x8017C6F4` is 15 ins in SC03_010/011/013, **948** in SC03_126/003, SC04_021, SC05_019 | `load_best` keyed on ADDRESS → 7%-correct masked 93%-correct; and `binary:null` → absent scored as **banked** |
+| 3 | "the classifier writes `CC1-FAIL: make: *** Error 33`" | `errs[-1]` and make prints its summary LAST, always | **~3,000 of ~4,000** CC1-FAIL labels were content-free |
+| 4 | "26 unpropagated members — cheapest fuel, levers exist, ~0 tokens" | **0 of 31 templatable** from any matched source | phantom item; they are **per-member drafting work** |
+
+## THE ONE NUMBER THAT MOVED
+`func_8017C6F4` (947 ins): hand floor **63** → permuter **41**. Both basins then plateau flat
+(pin-free masked 44 / 8 cycles; `pin-t5` masked 43 / 5 cycles). **Best draft
+`.run/s43/func_8017C6F4.ils43-pin.c` (closeness 41), logged + allowlisted.** The ~40 hand probes that
+"proved" 63 unmovable were all run while the permuter was silently broken.
+
+## ▶ RESUME HERE (S43)
+1. **`func_8017C6F4` — do NOT re-run the ILS on these two seeds** (measured flat, 14 restarts).
+   Remaining levers: **§148-C** the zero-byte allocno-priority slider (`__asm__ ("" :: "r"(a),"r"(b))`
+   inside the loop — the documented lever for exactly this two-callee-saved-register swap) by hand;
+   then Fable5 on a fresh seed. Then the rest of the serial queue (`func_8017C59C` 947 reach 6,
+   `func_8017CE58` 733×3, `func_8017EF68` 969, …) — **every brief opens with the all-drafts scan +
+   the §147-A frame test**, and any ×N claim needs the §148-E draft test.
+2. **`func_8017C294` NEAR(12)** still parked on §147-A stratum 3; its 15 siblings stay parked with it.
+3. **Re-check the 63 GTE drafts** the silent fallback disabled — the behemoth renderer drafts are the
+   high-byte-weight ones and have **never** actually had a permuter run.
+4. **Then L1+L2 disc audit (task #10), then L3 + type-1 onboarding (task #11)** — Drew's agreed plan,
+   unchanged, below.
+5. **Cheap fuel:** the 61 SC07 `-O0` members · `func_80183BAC`'s R22 revert (capture WHICH binary) ·
+   2 resident stubs with gate-rejected match_one-MATCH drafts · the 263×5 cluster (`0x80182fd4`,
+   `parse error before 'unsigned'`, undiagnosed — **the fixed classifier will now name it**).
+   ⚠️ **"26 unpropagated members" is REFUTED — struck from this list** (S43-4).
+
+## 🧰 HAZARD INTRODUCED-AND-DOCUMENTED THIS SESSION
+`tools/harvest_verify.py` has **no `if __name__ == '__main__'` guard**: `import harvest_verify` runs a
+full build, splices drafts, and overwrites `.run/harvest_*.txt`. I tripped it unit-testing
+`classify_fail` (no damage — resident stayed `8e17e02f`, 0 banked, tree clean). Nothing imports it, so
+it is flagged in the file header rather than fixed by a risky 500-line refactor of our most
+load-bearing gate. **To test a helper in it, `exec` that function's source — never import the module.**
+
+## 🧰 MY PROCESS ERRORS THIS SESSION
+1. **Queried the wrong field name** (`draft` vs `best_draft`) and briefly read *all 838* rows as
+   artifact-less — the §133 default-filter shape, self-inflicted. Caught by sanity-checking a number
+   that was too round.
+2. **Inherited a checkpoint claim without probing it** ("no draft survives on disk"); the draft was
+   there, and one `ls` would have shown it. The whole S43-4 refutation exists because I probed the
+   *second* such claim instead of the first.
+3. **Imported a module that runs a build** (above).
+4. **Wrote a "negative control" that never exercised the changed branch** — the PLUMBING path returned
+   first, so old and new agreed and the test proved nothing. Rebuilt it to hit the branch under test.
+
+---
+
+# 🛑 (superseded) SESSION S39–S42 CHECKPOINT (2026-08-05)
 > **Tree CLEAN** but for R23 `db.*.gbf` churn (never stage). **MCP was stopped by me for the main sig
 > regen** — the SessionStart hook restarts it; **run `/mcp` before any Ghidra work (R29)**.
 > **ONE AGENT MAY STILL BE RUNNING:** a serial crack on `func_8017C6F4` writing to
@@ -2096,6 +2158,13 @@ function after ~40 hand probes** — and it came from repairing an instrument, n
 Draft preserved + allowlisted: `.run/s43/func_8017C6F4.ils44.c` (+ `ils_8017C6F4.log`), logged to the
 backlog at closeness 42.
 
+**Final permuter verdict for this function (14 warm restarts across two basins):** pin-free seed
+**masked 44 / match_one 42** (flat over 8 cycles); the `pin-t5` seed **masked 43 / match_one 41**
+(flat over 5). **Best known draft = `.run/s43/func_8017C6F4.ils43-pin.c` at closeness 41**, logged.
+So the permuter is worth **63 → 41** here and is now itself exhausted on both basins — the residual
+register rotation survives it. Next lever is §148-C (the zero-byte allocno-priority slider) by hand,
+or Fable5 on a genuinely fresh seed; **do not re-run the ILS on these two seeds, it is measured flat.**
+
 **The S42 "rumour row" claim was WRONG (R14) — and the truth is a worse defect.** The 2026-07-01 row
 *does* have an artifact, it *is* on disk (`.run/backlog_drafts/func_8017C6F4.c`, one of 3,335 there),
 and it *reproduces exactly*: `match_one` vs `ov_SC03_010` → **14 mismatched of 15 target ins**,