diff --git a/.run/P36/agents/METHOD_S103.md b/.run/P36/agents/METHOD_S103.md
index f0344ca240..17790e7e86 100644
--- a/.run/P36/agents/METHOD_S103.md
+++ b/.run/P36/agents/METHOD_S103.md
@@ -292,3 +292,25 @@
     - The ORDER of a block's independent constant stores sets a birthing load's LIFE (`schedule_select`, `sched.c:2614-2660`: the
       load is "blocked for 1 cycle" behind every store issued the cycle before) and so its `qty_compare_1` rank — permute the stores;
       the sched1 trace, not the allocation table, is the instrument (36 of 120 orders close, exactly those with the 0xdc store first).
+21. **S105 f6 (`ov_SC07_007_jr_8017BEBC`, 6 of 6 at 0: 1 plain C, 2 zero-pin with a marked do-while, 3 minimum-lever):**
+    - A local assigned a CONSTANT in ≥2 blocks that outranks a parameter copy: `update_equiv_regs` (`local-alloc.c:1049-1064`)
+      DOUBLES the live length of a set-once REG_EQUIV-constant pseudo — split it into one set-once local per block at the original
+      statement position (never inline the constant: loop hoisting reorders the `lui/addiu`).
+    - The do-while ref-weight tell: the loser needs EXACTLY +1 flow-time ref (`flow.c:2067`) on a statement that does not mention
+      the winner (two parameters with 2 refs each → 5000 vs 3333 → +1 → a tie the lower allocno wins); a real callee argument does the
+      same when one exists — never a fake argument (`func_801812BC` is really `(void)`).
+    - A `$4–$7` pin copied once before the first call while all the callers cast to a WIDER arity = the function's own parameter N
+      (`assign_parms`, `function.c:3620-3679`): signature patch parked, minimum-lever body passing it to the callees that take it.
+    - `qty_compare_1` contests whose births/deaths are FIXED by sched1's backward LUID tie-breaks (`sched.c:3160-3260`) and refs by the
+      bytes (14/226 = 1858 vs 13/222 = 1756) are "unreachable by priority": print both knobs from `localalloc_sim.py`; a loop-weight
+      lever only works after the point where the target sinks its frame adjust, else it costs a `nop`.
+    - P_TAG bitfield READS (not only the stores, step 17): the 0xFFFFFF mask pseudo gets 7 refs (`expmed.c:556-706`) and takes the
+      target's register; and a pointer used for all-but-the-first access of a symbol → use it for the first too (combine folds the
+      constant into `(mem (plus reg symbol))` and orphans the plus pseudo → the target's extra 8-byte slot, `reload1.c:2331`: the pad
+      shrinks by two words).
+    - A parameter reused as a later pointer + a `$sN` ROTATION among block-local temps: split the roles (parameter used directly,
+      the pointer a block-local record base) — local-alloc allocates block-local quantities BEFORE the global parameter (allocation
+      ORDER, not priority; the alloc table wants a "local vs global" column). A base with MIXED `sw K($sN)` / `lui $at` stores is a
+      cse-opaque base beside own-symbol scalars — `find_best_addr` folds `(plus p K)` via `equiv_constant` before any cost compare
+      whenever `p ≡ symbol` and the block has no ebb boundary: unreachable in plain C, mark the `la`. A tail `addiu s0,s0,32; move
+      a1,s0` needs a CALL_INSN between the add and the arg copy or combine folds them (`combine.c:929`).
diff --git a/.run/P36/census/lever_census.json b/.run/P36/census/lever_census.json
index eaa50e8103..6fd29c12a9 100644
--- a/.run/P36/census/lever_census.json
+++ b/.run/P36/census/lever_census.json
@@ -69,7 +69,7 @@
  },
  "binaries": 218,
  "cfake_markers": {
-  "count": 50,
+  "count": 52,
   "sample": [
    "src/800.c:12543",
    "src/800_b_2.c:2948",
@@ -115,15 +115,15 @@
  },
  "classes": {
   "A": {
-   "bodies": 1343,
-   "distinct_bodies": 512,
+   "bodies": 1340,
+   "distinct_bodies": 509,
    "file_scope": 0,
-   "in_bodies": 2179,
+   "in_bodies": 2172,
    "kinds": {
-    "pin": 2179
+    "pin": 2172
    },
-   "marked": 2179,
-   "sites": 2179,
+   "marked": 2172,
+   "sites": 2172,
    "tus": 1075,
    "unmarked": 0
   },
@@ -250,9 +250,9 @@
  "coverage": {
   "asm": {
    "comment_dead": 6781,
-   "live": 15016,
+   "live": 15009,
    "macro_block": 194,
-   "raw": 21991
+   "raw": 21984
   },
   "attribute": {
    "comment_dead": 0,
@@ -268,9 +268,9 @@
   },
   "register": {
    "comment_dead": 8574,
-   "live": 2229,
+   "live": 2222,
    "macro_block": 18,
-   "raw": 10821
+   "raw": 10814
   },
   "volatile": {
    "comment_dead": 2607,
@@ -280,7 +280,7 @@
   }
  },
  "coverage_ok": true,
- "elapsed_s": 22.0,
+ "elapsed_s": 22.5,
  "generated": "2026-09-11",
  "gte_levers": {
   "direct": 357,
@@ -291,15 +291,15 @@
   "via_macro": 94,
   "what": "GTE ops whose clobbers exceed the canonical macro's (a scheduling steer): class-B levers INSIDE the headline number since T5 (2026-09-09), marked, 0 at the close"
  },
- "head": "d85a4e387",
+ "head": "4bca24866",
  "headers": 3181,
  "levers_AB": {
   "asm": 1886,
-  "bodies": 2003,
-  "distinct_bodies": 697,
-  "marked": 4065,
-  "pins": 2179,
-  "sites": 4065,
+  "bodies": 2000,
+  "distinct_bodies": 694,
+  "marked": 4058,
+  "pins": 2172,
+  "sites": 4058,
   "unmarked": 0,
   "what": "register pins + asm statements excluding GTE ops: the classes the phase drives to 0"
  },
@@ -438,14 +438,14 @@
    "$0": 54,
    "$10": 10,
    "$11": 5,
-   "$12": 9,
-   "$13": 6,
+   "$12": 8,
+   "$13": 5,
    "$14": 5,
    "$15": 1,
-   "$16": 77,
-   "$17": 29,
+   "$16": 75,
+   "$17": 28,
    "$18": 26,
-   "$19": 17,
+   "$19": 16,
    "$2": 757,
    "$20": 7,
    "$21": 5,
@@ -455,7 +455,7 @@
    "$3": 159,
    "$4": 490,
    "$5": 375,
-   "$6": 60,
+   "$6": 59,
    "$7": 25,
    "$8": 23,
    "$9": 21,
@@ -464,29 +464,29 @@
    "a1": 2,
    "v0": 2
   },
-  "sites": 2179,
+  "sites": 2172,
   "sp": 0,
   "spelling": {
-   "__asm__": 2156,
+   "__asm__": 2149,
    "asm": 23
   },
   "volatile_qualified": 0,
   "zero": 54
  },
- "src_stamp": "38f4f9771c81f665",
+ "src_stamp": "96584aa5c5fa03e6",
  "tus": 4121,
  "unclassified": 0,
  "union_AD": {
-  "bodies": 5768,
+  "bodies": 5765,
   "by_kind": {
    "main": 124,
    "md": 105,
-   "ov": 5374,
+   "ov": 5371,
    "resident": 6,
    "shared": 159
   },
   "copies_in_multi": 4849,
-  "distinct_bodies": 1029,
+  "distinct_bodies": 1026,
   "multi_copy_classes": 110
  },
  "verbatim_excluded": {
diff --git a/.run/P36/census/lever_census.txt b/.run/P36/census/lever_census.txt
index eab3b38d2b..ff1d8b5a8e 100644
--- a/.run/P36/census/lever_census.txt
+++ b/.run/P36/census/lever_census.txt
@@ -1,24 +1,24 @@
 lever_census: 218 binaries · 4,121 TUs + 3,181 headers · coverage OK · unclassified 0 · verbatim excluded 13 fn / 14 sites (manifest 13)
-  coverage asm       raw  21991 = live  15016 + macro-block   194 + comment/dead  6781
-  coverage register  raw  10821 = live   2229 + macro-block    18 + comment/dead  8574
+  coverage asm       raw  21984 = live  15009 + macro-block   194 + comment/dead  6781
+  coverage register  raw  10814 = live   2222 + macro-block    18 + comment/dead  8574
   coverage volatile  raw   4372 = live   1683 + macro-block    82 + comment/dead  2607
   coverage builtin   raw    599 = live    445 + macro-block     0 + comment/dead   154
   coverage attribute raw     76 = live     76 + macro-block     0 + comment/dead     0
   class  sites  in-bodies  file-scope  bodies  distinct  TUs  marked  unmarked   kinds
-  A pins         2179      2179          0    1343       512  1075    2179         0   {'pin': 2179}
+  A pins         2172      2172          0    1340       509  1075    2172         0   {'pin': 2172}
   B asm         11193     11180         13    4606       673  1425    2370      8823   {'gte': 6355, 'gte-lever': 451, 'gte-unsigned': 270, 'barrier': 247, 'launder': 620, 'instruction': 224, 'asm-body': 13, 'keepalive': 331, 'verbatim-body': 2682}
   C volatile     1589      1437        152     495        94   609      14      1575   {'decl-body': 58, 'decl-file': 152, 'cast': 1377, 'param': 2}
   D register       50        50          0      47        47     6       0        50   {'register': 50}
   E asm-label    7800      1368       6432    1099       160  2090       0      7800   {'asm-label': 7800}
   F builtin       445       445          0     428        27   302       0       445   {'builtin': 445}
   G attribute      76         1         75       1         1    40       0        76   {'attribute': 76}
-  UNION A–D: 5,768 bodies · 1,029 distinct (addresses normalized) · 110 multi-copy classes holding 4,849 bodies · by kind {'ov': 5374, 'shared': 159, 'main': 124, 'md': 105, 'resident': 6}
-  THE PHASE'S NUMBER (pins + asm statements, GTE excluded): 4,065 sites in 2,003 bodies (697 distinct) · marked !FAKE 4,065 · UNMARKED 0
+  UNION A–D: 5,765 bodies · 1,026 distinct (addresses normalized) · 110 multi-copy classes holding 4,849 bodies · by kind {'md': 105, 'ov': 5371, 'shared': 159, 'main': 124, 'resident': 6}
+  THE PHASE'S NUMBER (pins + asm statements, GTE excluded): 4,058 sites in 2,000 bodies (694 distinct) · marked !FAKE 4,058 · UNMARKED 0
   orphan !FAKE markers (no pin/asm site on the line nor below): 0
-  marked ordinary-C fakes kept by Drew's S104 ruling (a) (`do { } while (0)`, dead initialisers; NOT levers): 50
+  marked ordinary-C fakes kept by Drew's S104 ruling (a) (`do { } while (0)`, dead initialisers; NOT levers): 52
   GTE levers (clobbers beyond the canonical macro's): 451 sites (94 via a variant macro, 357 direct) · marked 451 · UNMARKED 0 · unsigned GTE statements 270
   per-TU asm macro definitions outside the GTE header: 314 {'gte': 150, 'launder': 154, 'instruction': 9, 'barrier': 1} (GTE variants 64)
-  pins: 2,179 · $0 54 · $sp 0 · with initializer 203 · volatile-qualified 0 · bare-name 8 · spellings {'__asm__': 2156, 'asm': 23}
+  pins: 2,172 · $0 54 · $sp 0 · with initializer 203 · volatile-qualified 0 · bare-name 8 · spellings {'__asm__': 2149, 'asm': 23}
   whole-body asm routines in C shells, manifest PERMANENT (hand asm, NOT levers): 22 routines · 2,682 sites (2,660 private copies + 22 shared headers); asm-bodies NOT permanent (levers): 13 site(s) ['func_8001E378:DECOMPILE-NOW', 'func_80020F34:DECOMPILE-NOW', 'func_800249F0:DECOMPILE-NOW', 'func_80025CBC:DECOMPILE-NOW', 'func_80026514:UNCERTAIN', 'func_800268D0:UNCERTAIN', 'func_80027058:DECOMPILE-NOW', 'func_80027200:DECOMPILE-NOW', 'func_800CBA44:DECOMPILE-NOW', 'func_8017D810:DECOMPILE-NOW', 'func_8017E26C:UNCERTAIN', 'func_80184440:DECOMPILE-NOW', 'func_801A3BCC:DECOMPILE-NOW']
   asm kinds: {'asm-body/direct': 13, 'barrier/direct': 247, 'gte/direct': 197, 'gte/via-macro': 6158, 'gte-lever/direct': 357, 'gte-lever/via-macro': 94, 'gte-unsigned/direct': 270, 'instruction/direct': 202, 'instruction/via-macro': 22, 'keepalive/direct': 331, 'launder/direct': 578, 'launder/via-macro': 42, 'verbatim-body/direct': 2682}
   instruction mnemonics: {'la': 136, 'addiu': 22, 'addu': 22, 'RTP_SND': 22, '.section': 7, 'lui': 3, 'lh': 3, 'and': 2, 'mult': 1, 'mfhi': 1, 'sll': 1, 'li': 1, 'lw': 1, 'nop': 1, 'srl': 1}
@@ -29,4 +29,4 @@ lever_census: 218 binaries · 4,121 TUs + 3,181 headers · coverage OK · unclas
     src/shared/ov/func_80178004.h pins                   got 8      expected 26  N-A
     ov_SC03_006 func_80184034 bare-name pins             got 0      expected 3  N-A
     engine_prelude.h asm sites (a macro definition only) got 0      expected 0  OK
-  elapsed 22.0 s
+  elapsed 22.5 s
diff --git a/docs/lever-progress.tsv b/docs/lever-progress.tsv
index ef9f533014..1a76e8d547 100644
--- a/docs/lever-progress.tsv
+++ b/docs/lever-progress.tsv
@@ -70,3 +70,4 @@ date	milestone	head	sites_AB	pins	asm	bodies_AB	distinct_AB	marked	unmarked	gte_
 2026-09-11	S105 f3 (4 + 1 proven)	cadb6cacc	4111	2203	1908	2021	715	4111	0	451	314	1589	50	7800	445	76
 2026-09-11	S105 f4 (5) + f5 (7)	4a503fce1	4077	2188	1889	2009	703	4077	0	451	314	1589	50	7800	445	76
 2026-09-11	S105 f7 (6) + R22 regen (1)	d85a4e387	4065	2179	1886	2003	697	4065	0	451	314	1589	50	7800	445	76
+2026-09-11	S105 f6 (6)	4bca24866	4058	2172	1886	2000	694	4058	0	451	314	1589	50	7800	445	76
diff --git a/docs/levers.md b/docs/levers.md
index a198ad816d..f8cab17b3a 100644
--- a/docs/levers.md
+++ b/docs/levers.md
@@ -116,6 +116,7 @@ counted, not marked). E, F and G belong to the canonical type layer and are the
 | 2026-09-11 | S105 f3 (4 + 1 proven) | 2203 | 1908 | **4111** | 2021 | 715 | 451 | 314 | 1589 | 50 | 7800 | 445 | 76 | `cadb6cacc` |
 | 2026-09-11 | S105 f4 (5) + f5 (7) | 2188 | 1889 | **4077** | 2009 | 703 | 451 | 314 | 1589 | 50 | 7800 | 445 | 76 | `4a503fce1` |
 | 2026-09-11 | S105 f7 (6) + R22 regen (1) | 2179 | 1886 | **4065** | 2003 | 697 | 451 | 314 | 1589 | 50 | 7800 | 445 | 76 | `d85a4e387` |
+| 2026-09-11 | S105 f6 (6) | 2172 | 1886 | **4058** | 2000 | 694 | 451 | 314 | 1589 | 50 | 7800 | 445 | 76 | `4bca24866` |
 
 ### The campaign — every batch, from the ledger (derived on every render)
 
@@ -422,7 +423,9 @@ counted, not marked). E, F and G belong to the canonical type layer and are the
 | `s105_f7` | 2026-09-11 | E | 0 | 0 | 0 | 9 | 5 |
 | `s105_f7_minlever` | 2026-09-11 | E | 0 | 0 | 0 | 2 | 0 |
 | `s105_r22b` | 2026-09-11 | E | 0 | 0 | 0 | 1 | 1 |
-| **total** | | | **17,122** | **20,778** | **283** | **30,360** | **10,743** |
+| `s105_f6` | 2026-09-11 | E | 0 | 0 | 0 | 5 | 3 |
+| `s105_f6_minlever` | 2026-09-11 | E | 0 | 0 | 0 | 2 | 0 |
+| **total** | | | **17,122** | **20,778** | **283** | **30,367** | **10,746** |
 
 *Generated by `tools/lever_progress.py --render` from `.run/P36/census/lever_census.json` and `.run/P36/delever/ledger.jsonl`; the series lives in `docs/lever-progress.tsv` (R75: published numbers are generated, never typed).*
 
diff --git a/phase-ends/CURRENT_PHASE.md b/phase-ends/CURRENT_PHASE.md
index fde9f1ff65..5080bd3143 100644
--- a/phase-ends/CURRENT_PHASE.md
+++ b/phase-ends/CURRENT_PHASE.md
@@ -2047,13 +2047,27 @@ accumulate here as the phase produces them.**
   by their id so they pickup where they left off"* → both RESUMED by SendMessage to their ids** (R67 held: f6 had `body.c` +
   `mechanism.md` on disk for 5 of its 6 packs, f8 for 2 of 5 — nothing lost). No new draws (Drew's earlier word).
 
-## 🛑 SESSION CHECKPOINT — S105 (2026-09-11, LIVE — refreshed at every landing): T0–T6 ☑, **T7 RUNNING at Drew's cap of TWO agents**. 4,152 → **4,065 sites** so far; f1–f5 + f7 landed (31/31), f6 + f8 IN FLIGHT — **Drew: no new agents after these**; generators **R44–R46** + the R22 `&&` blind-spot fix; R22 `check-all: 218 passed, 0 failed of 218` at `d85a4e387` | `lever_census --check` exit 0 (4,065 marked, 0 UNMARKED, 0 orphans)
+- **S105 — f6 landed (resumed after the limit cut): 6 of 6 at 0 (1 plain C, 2 zero-pin with a marked do-while, 3 minimum-lever), R22
+  218/218; 4,065 → 4,058 sites.** f6 (`ov_SC07_007_jr_8017BEBC`, ≈485k tokens): `func_8017F584` 13 → 0 (a twice-set constant local split
+  set-once per block — `update_equiv_regs` doubles a REG_EQUIV constant's live length, `local-alloc.c:1049-1064`), `func_8018122C` 7 → 0
+  with one marked do-while (a +1 flow-time ref breaks a 5000-vs-3333 `allocno_compare` tie; the fake-argument alternative refused —
+  the callee is really `(void)`; 1 pin → 0), `func_80182184` 30 → 0 with one marked do-while (P_TAG bitfield READS give the mask pseudo
+  7 refs; the OT base used for every read shrinks the pad by two words — the tree's "+1 insn" claim refuted; 3 pins → 0),
+  `func_80180FA4` 7 → 0 only as a THREE-parameter function (all 17 callers cast to 3 args; patch in the pack, PARKED) → minimum-lever
+  2 → 1, `func_80181F4C` 29 → 0 only with its `$8` pin (`qty_compare_1` 1858 vs 1756 with births fixed by the bytes) → PROVEN 1 → 1,
+  `func_8017DFB8` 32 → 0 with 3 of its 4 levers (the `$16` pin off by splitting the parameter's and the pointer's roles — allocation
+  ORDER, block-locals before the global parameter; the `la` is a cse-opaque base beside own-symbol scalars, `find_best_addr` via
+  `equiv_constant`; the `addiu` needs a CALL_INSN between the add and the arg copy, `combine.c:929`) → 4 → 3. `bank_list.sh`:
+  `IDENTICAL … KEPT` ×6 (`bd461c81b`…`4bca24866`). METHOD step 21. R22 (`.run/P36/s105/r22_f.log`) **`check-all: 218 passed, 0 failed of
+  218`** (88 s) → baseline at `4bca24866` → `lever_census --check: 4,058 pin/asm sites, 4,058 marked !FAKE, 0 UNMARKED — OK` (exit 0)
+  → snapshot (4,065 → **4,058**). f8 still in flight (resumed); nothing else drawn.
+
+## 🛑 SESSION CHECKPOINT — S105 (2026-09-11, LIVE — refreshed at every landing): T0–T6 ☑, **T7 RUNNING at Drew's cap of TWO agents**. 4,152 → **4,058 sites** so far; f1–f7 landed (37/37), f8 IN FLIGHT (resumed after a limit cut) — **Drew: no new agents after it**; generators **R44–R46** + the R22 `&&` blind-spot fix; R22 `check-all: 218 passed, 0 failed of 218` at `4bca24866` | `lever_census --check` exit 0 (4,058 marked, 0 UNMARKED, 0 orphans)
 
 ### 0. How to use this block — READ THIS FIRST
 A fresh session reads CLAUDE.md's load order, replays this block verbatim, confirms the effort (S105 runs at `/effort high` on Opus 5 1M;
 every agent on Opus) and executes §2. **Drew's cap is TWO concurrent agents (S105 open).** What may be in flight when this is read:
-**f6** (`src/ov_SC07_007/ov_SC07_007_jr_8017BEBC.c`: func_8018122C, func_80180FA4, func_8017F584, func_80181F4C, func_80182184,
-func_8017DFB8) and **f8** (`src/ov_SC02_005/ov_SC02_005_jr_80185E80.c`: func_8018622C, func_80186424, func_8018A6A0, func_8018CA74,
+**f8** (`src/ov_SC02_005/ov_SC02_005_jr_80185E80.c`: func_8018622C, func_80186424, func_8018A6A0, func_8018CA74,
 func_8018D270). **Drew (S105, mid-turn): no new agents after these — let them finish.** A dead session's agents leave `body.c` + `mechanism.md` in
 `.run/P36/agents/<alias>__<fn>/` (R67): `--try` each `body.c`; a 0 banks via `.run/P36/s105/bank_list.sh` (one line per body
 `TU FN FILE LABEL MSG`; a `*minlever*` label adds `--allow-residue`); anything else is a reading to record. Briefs for the NEXT draws are