docs(phase-33): D4 the SETUP.md public-clean pass — public-from-P33 header refresh, the remote (origin + the private archive), generic dump path, §4.7 tarballs tracked, §6.5 the decomp.me preset line, the backup section rewritten as the PUBLIC posture with the private era as a dated note (two-repo mirror plan superseded), ledger row 11 closed / 14 → E1, the one missing R21 row (verify_contract.sh); checkpoint -> NEXT = D5

docs/SETUP.md

@@ -3,6 +3,7 @@
 > **This file is the EVOLVABLE reference layer.** Unlike `PROJECT_CONTEXT.md` (permanent, never edited), this document holds volatile facts — pinned versions, URLs, commands, ports — and **may be updated freely** as tools move. Note each change in the active phase log (`CURRENT_PHASE.md`). Items marked **TBD** / **UNVERIFIED** / **JP-only — re-derive for US** are honest gaps: confirm before relying on them, then update this file.
 
 Last full revision: 2026-06-10 (initial authoring, pre-Phase-1 — nothing below is installed yet except the repo itself; same-day conversion to the all-in-WSL / Linux-first architecture — everything now runs inside a single WSL2 Ubuntu 24.04 clone, no Windows/WSL split).
+**Refresh 2026-09-07 (P33 D4, the public-clean pass):** the repository is PUBLIC from Phase 33 (in-place flip with the full, rewritten history — `docs/public-flip-runbook.md`); H1 is in force again (no ROM-derived bytes in git); every "private repo / vendored / mirror" passage below was reviewed and rewritten or dated as history; the canonical remote is `https://github.com/Druthulu/BFM-decomp.git`.
 **Refresh 2026-06-15:** added a tooling/MCP-lifecycle/session-hooks/backup-posture pass after the doc had drifted past the as-built reality — new §1a (`.run/` scratch), §2.8 (MCP lifecycle, persistence model & session hooks), a `## Tooling inventory` table, and a `## Backup & private-repo posture` section. Rule **R21** (added this session) now requires keeping THIS file current whenever tooling / MCP / hooks / env change.
 
 ## Version pin summary
@@ -239,7 +240,7 @@ Under the all-in-WSL architecture there is **no cross-OS networking**. Ghidra/Gh
 cd ~ && git clone <remote-url> bfm-decomp
 ```
 
-The single clone lives at `~/bfm-decomp` (ext4). Builds, splat, asm-differ, Ghidra, and Claude Code all run here. In this clone: `git config core.filemode true`. **TBD:** the canonical remote URL (GitHub private repo planned; not created as of this writing).
+The single clone lives at `~/bfm-decomp` (ext4). Builds, splat, asm-differ, Ghidra, and Claude Code all run here. In this clone: `git config core.filemode true`. **Remote (P33):** `origin` = `https://github.com/Druthulu/BFM-decomp.git` (public from Phase 33 C10); the pre-rewrite history lives in the private archive `Druthulu/BFM-decomp-archive`. Claude commits, Drew pushes (R6).
 
 ### §4.4 Copy the disc dump into the clone
 
@@ -257,7 +258,7 @@ cp '<dump-source>/Brave Fencer Musashi (USA)/'*.bin \
 
 `<dump-source>` is wherever the disc dump currently lives (e.g. a one-time download into `~/Downloads`, or a one-shot copy from external media). `disks/` is gitignored — no ROM-derived bytes ever reach the remote (rule H1).
 
-**Status (Phase 2, 2026-06-13):** the disc was staged early — extraction needs it before Phase 4. Track 1 alone (it holds all 27 root files) was copied once from the `/mnt/z` dump to ext4 at `disks/Brave Fencer Musashi (USA) (Track 1).bin` (364,846,944 bytes). WSL `extract_exe.py --bin "disks/…(Track 1).bin" --verify-disc` **PASSED** — SHA1 `b44f0f0a19936f23b26188b658e13201a6a9c211`, CRC32 `c238191b`, both == redump — which **closes the Phase-1 deferral** (verify-disc had previously only run on Windows; PhaseEnd_Phase1 Deviations).
+**Status (Phase 2, 2026-06-13):** the disc was staged early — extraction needs it before Phase 4. Track 1 alone (it holds all 27 root files) was copied once from the author's dump location (a `<dump-source>` as above) to ext4 at `disks/Brave Fencer Musashi (USA) (Track 1).bin` (364,846,944 bytes). WSL `extract_exe.py --bin "disks/…(Track 1).bin" --verify-disc` **PASSED** — SHA1 `b44f0f0a19936f23b26188b658e13201a6a9c211`, CRC32 `c238191b`, both == redump — which **closes the Phase-1 deferral** (verify-disc had previously only run on Windows; PhaseEnd_Phase1 Deviations).
 
 ### §4.5 apt packages
 
@@ -321,6 +322,10 @@ tar xzf gcc-2.7.2-psx.tar.gz -C gcc-2.7.2-psx
 tar xzf gcc-2.7.2-cdk.tar.gz -C gcc-2.7.2-cdk
 ```
 
+**As-built (P33 B3):** the two tarballs are TRACKED in the repository (`tools/bin/*.tar.gz`, GCC = GPL; sha256s in
+`tools/bin/CHECKSUMS.sha256`) and `tools/bootstrap.sh` does exactly the check-and-extract above on a fresh clone — the
+`wget` lines are how they were first obtained, not a step a contributor runs.
+
 - `gcc-2.7.2-psx` = community GCC 2.7.2 PSX build (primary candidate).
 - `gcc-2.7.2-cdk` = **cygnus-2.7.2-970404**, the exact base of PsyQ 4.0/4.1's CC1PSX (added in old-gcc 0.14).
 - **sha256 (RECORDED Phase 4, old-gcc 0.17, ledger #7):** `gcc-2.7.2-psx.tar.gz` = `500a459b3485e885a8d302cac23c2a4632f3900e03a09153f6190699fd723571`; `gcc-2.7.2-cdk.tar.gz` = `42bb0df96db11a9b5d2e23d78bdc962791f40046280d3d360da93fe5eef6f0bb`. Committed to `tools/bin/CHECKSUMS.sha256` (gitignore exception `!/tools/bin/*.sha256`); re-verify with `sha256sum --check tools/bin/CHECKSUMS.sha256`.
@@ -513,6 +518,9 @@ Modern cpp preprocesses → **vintage cc1** compiles to asm → **maspsx** emula
 - Starting flags: `-O2 -G0` (adjust per §5).
 - **Do NOT use the SOTN preset** (`Castlevania: Symphony of the Night` / `gcc 2.6.3-psx` / `psyq_263_221`) — wrong era, guaranteed near-miss diffs.
 - decomp.me's API is Cloudflare-challenged (403 to scripts) — scratch searches/uploads needing the API must be done manually in a browser.
+- **The project's preset (P33 E1, `docs/decompme-preset.md`):** platform `ps1`, compiler `gcc2.7.2-psx`, flags
+  `-O2 -G0 -mips1 -mcpu=3000 -mgas -msoft-float -fgnu-linker -Wa,--aspsx-version=2.56,--expand-div` (decomp.me's image wraps
+  `as` with maspsx and forwards `-Wa,` args). Presets are created in the browser by a logged-in user (Drew, after the flip).
 
 ### §6.6 Matching a function (INCLUDE_ASM → C; the NON_MATCHING guard) — As-built Phase 6
 
@@ -749,6 +757,7 @@ Every script under `tools/` (plus the two report make-targets), grouped by purpo
 | | `DefineFunctions.java` | Disassemble + create functions at splat's validated entry points (`.run/<prog>_funcs.txt`) — completes a raw-blob program's function set (Phase 10). |
 | | `ApplySymbols.java` + `tools/ghidra_apply_symbols.sh` | **(P31 S78) The Ghidra MIRROR of the curated symbol file (R15/G6), headless with a real save.** `tools/ghidra_apply_symbols.sh [PROG] [symbols files…]` (defaults `SLUS_007.26 config/symbols.us.txt`; MCP must be STOPPED first) reads `name = 0xADDR;` rows and sets every function/label to its curated name; a name held by another address is moved to that address's own curated name first (`firstfile`/`firstfile2`), else to `<name>__at_<addr>`. Idempotent; prints `BFMAPPLY renamed_funcs=… unchanged=…`; R9-verify with `ghidra_mcp_verify.sh`. **Use this, not MCP `rename_symbol`/`batch_rename`, for renames:** S78 observed 47 MCP renames NOT persisting through the sentinel stop ("Save succeeded", DB grew, names gone — R9 caught it; cause not yet isolated), while the postScript path persisted 73/73 on the first run. |
 | **Public flip / CI** | `.github/workflows/no-rom.yml` | **(P33 B7) The ROM-free CI**: job `audits` (audit_public, audit_text_sources, verbatim_check --strict, cookbook_index --check, ghidra_roster --check, work_evidence --selftest, test_lzss, lint_symbol_refs — ≈45 s of checks) + job `compile-only` (binutils-mipsel + `cpp-mipsel-linux-gnu` from apt, cc1 from the tracked tarball sha256-checked, maspsx submodule; PR scope `main resident ov_SC01_077 md_MAIN_013`; `--all` weekly Mon 06:17 UTC + `workflow_dispatch`). Byte-identity is NOT proven in CI (needs the disc) — `docs/verification.md`. |
+| **Verification** | `tools/verify_contract.sh` | **(P33 A5/C8) THE recorded contract run**: 00 tree · 01 check-env · 02 family_hseq · 03 `make clean && extract-all && check-all` · 04 sdk-dual (or a recorded SKIP) · 05 tools-health (zero `[warn]`) · 06 audit-frontier · 07 audit-disc · 08 report; one log per step ending `EXIT=<rc>`, abort on the first red (R53), every step asserted by its contract line (R49), `SUMMARY.md` generated → `.run/P33/verify/` (tracked evidence, quoted by `docs/verification.md` §2); step 00 ignores its own output dir. ≈14 min on 32 CPUs. |
 | **Publishing** | `tools/progress.py --json \| --readme [--check]` | **(P33 D1/D3)** The same numbers as DATA: `--json` → `docs/progress.json` (schema 1: the four metrics with numerator/denominator/pct, the counts, 218 per-binary rows incl. instruction totals; no run date) + `docs/badges/{fleet_instr,fleet_fn,distinct,binaries}.json` (shields endpoint format; the README references `fleet_instr` + `binaries` by name); `--readme` rewrites the README's `<!-- progress:begin/end -->` block (refuses a README without the markers); `--check` asserts JSON + block + badges are fresh (in `make audit-digest`). Run by `make report BINARY=main`. |
 | | `tools/objdiff_report.py [--in docs/progress.json] [--out report.json]` | **(P33 D3)** progress.json → objdiff's report format (report.proto v2, snake_case — validated with `objdiff-cli` 3.8.1 `report changes`): one unit per binary (code = instructions × 4, functions byte-identical / matchable, metadata complete), categories `game-code` and `linked-sony-objects` (functions only). `.github/workflows/progress.yml` runs it on every push (no rebuild — the committed JSON) and uploads the artifact **`SLUS_007.26_report`** for decomp.dev (Drew registers at decomp.dev/manage/new after the flip). |
 | | `tools/frogress_upload.py [--push --project bfm --version us]` | **(P33 D3)** stdlib; `--dry-run` is the default (prints the payload); `--push` POSTs `{"api_key","entries":[{git_hash,timestamp,categories:{default:{measures…}}}]}` to `progress.deco.mp/data/<project>/<version>/` with `FROGRESS_API_SECRET` from the environment (never a file). frogress projects are admin-created — Drew requests the slug + key after the flip. |
@@ -904,25 +913,19 @@ Every script under `tools/` (plus the two report make-targets), grouped by purpo
 
 ---
 
-## Backup & private-repo posture (rules R20/R21)
+## Backup & repository posture (rules R20/R21) — PUBLIC since Phase 33
 
-This project lives in a **private** remote (rule H1, relaxed: ROM-derived material may be committed while the repo is private). Per-session checkpoint backups (R20) push all irreplaceable work; the lists below record what is and is not pushed as of 2026-06-15.
+The repository is **public** (`https://github.com/Druthulu/BFM-decomp`, AGPL-3.0 for `tools/`+`docs/`, `src/NOTICE.md`
+for the game sources, `THIRD_PARTY.md`). **H1 is in force:** no ROM-derived or proprietary bytes are in git or in its
+history — the retail EXE, the RAM dumps, the Ghidra project, the Sony SDK, the session archive, the extension zips and
+`brave.exe` were purged from every commit before the flip (`docs/public-flip-runbook.md`), and `tools/audit_public.py` +
+CI (`.github/workflows/no-rom.yml`) keep it that way. The disc dump (`disks/`), `extracted/`, `build/`, `asm/`, `expected/`
+and `.venv/` are regenerable or user-supplied and are never committed (`.venv/` from `requirements-python.txt`).
 
-**Backed up to the private remote (2026-06-15):**
-
-- The **Ghidra project** (`ghidra/`) — with `*.lock` / `tmp*.ps` transients excluded (regenerable / ext4-local lock files).
-- **PsyQ SDK working artifacts** (`tools/psyq/`) **MINUS** the two >100 MB raw source archives — the `psyq40usa.zip` and the DTL-S2002 disc `.bin`/`.cue` (re-sourceable, over GitHub's file-size limit).
-- **Old-gcc cc1 compiler tarballs** (`tools/bin/*.tar.gz`) — the extracted binaries are regenerable from these, so only the tarballs are kept.
-- **Ghidra extension installers** — `tools/ghidra-ext/GhidrAssistMCP_2.8.0.zip` + `ghidra_psx_ldr_2026.06.04.zip` (hard to re-source at exact pinned versions).
-
-**Deliberately NOT backed up** (regenerable, or >100 MB and re-sourceable):
-
-- The disc dump (`disks/`).
-- The `extracted/` bulk — regenerate via `make extract`.
-- `build/`, `expected/`, `asm/` — all generated.
-- `.venv/` — recreate from `tools/requirements-python.txt`.
-- The two >100 MB raw PsyQ archives (the `psyq40usa.zip` + DTL-S2002 disc).
-- The unused PCSX-Redux Linux AppImage — the real runtime oracle is the Windows-native build.
+*Historical note (2026-06-15 → 2026-09-06, the private era):* while the repository was private, rule R1 relaxed H1 and the
+Ghidra project, the PsyQ working artifacts (minus the >100 MB raw archives), the cc1 tarballs and the extension installers
+were committed as the R20 backup. That state is preserved, unrewritten, in the private archive repository
+`Druthulu/BFM-decomp-archive` and in the local bundle made at C4 — it is not the public history.
 
 **P33 update (B5/B8, 2026-09-06) — R20's new home after the public flip.** The Ghidra project, the RAM dumps, the PsyQ
 SDK, the session archive and the extension zips leave git at C3 (`tools/public_rewrite/purge_set.txt`). What R20 backs up
@@ -937,7 +940,7 @@ the purged paths become ignored files and a `-x` clean deletes the RE database (
 - **R20** — back up all irreplaceable RE/decomp work plus gathered hard-to-re-source tooling at per-session checkpoints. This **loosens R8** (which mandated a single commit at phase end): checkpoint commits are now expected within a phase.
 - **R21** — keep **THIS file** (`docs/SETUP.md`) current whenever tooling, the MCP setup, the session hooks, or the environment changes.
 
-Sony **PsyQ libs and cc1 stay PRIVATE** — they are excluded from the future curated public mirror (the two-repo public-release plan; see `docs/gen2-roadmap.md`). The four submodules (asm-differ / m2c / maspsx / decomp-permuter) stay **gitlinks** on GitHub (the deliberate no-bloat choice over vendoring); residual risk = upstream deletion of a pinned commit.
+Sony's **PsyQ libraries are never distributed** (user-supplied, `tools/fetch_psyq.sh`, checksums only); the gcc-2.7.2 **cc1 tarballs ARE tracked** (GCC, GPL; sha256-verified). The two-repo "curated public mirror" plan of `docs/gen2-roadmap.md` was SUPERSEDED by the in-place flip with the full rewritten history (decision log, P33 S86). The four submodules (asm-differ / m2c / maspsx / decomp-permuter) stay **gitlinks** on GitHub (the deliberate no-bloat choice over vendoring); residual risk = upstream deletion of a pinned commit.
 
 ---
 
@@ -970,10 +973,10 @@ A Track-1 match proves the dump is the canonical redump dump, which transitively
 | 8 | `gp_value` in SLUS_007.26 header → -G0 vs -G8 | **RESOLVED (Phase 5): -G0** — zero $gp-relative addressing in the disasm (§5.3) |
 | 9 | ASPSX tier for game code: 2.56 vs 2.67 | **OPEN** — Phase 6 empirical (§5.2 tell) |
 | 10 | Cross-OS networking | **N/A under all-in-WSL** — MCP is local loopback (§4.2); no mirrored mode, firewall rule, or host-IP discovery |
-| 11 | Canonical git remote URL (off-box push/pull backup) | **TBD** (§4.3) |
+| 11 | Canonical git remote URL (off-box push/pull backup) | **CLOSED (P33 C9, 2026-09-07):** `https://github.com/Druthulu/BFM-decomp.git`, public from C10; the pre-rewrite history in the private archive `Druthulu/BFM-decomp-archive` (§4.3) |
 | 12 | Per-libnum stamp detail (raw-track scan reported 16 hits vs 12 genuine in extracted EXE — extracted-EXE scan is ground truth, see §5.1) | **RESOLVED 2026-06-13** — DetectPsyQ at headless import recorded `PsyQ Version = 4.0.0` (§2.5 step 3) |
 | 13 | Overlay load addresses (resident 0x800CDF58 / location 0x80128508, EXE ptr table ~0x62620) | **JP-only — re-derive for US** (owned by docs/memory-map.md) |
-| 14 | Greenfield claim: decomp.me scratch search is script-blocked (Cloudflare) | **TBD** — one-time manual browser check for BFM scratches |
+| 14 | Greenfield claim: decomp.me scratch search is script-blocked (Cloudflare) | **TBD → closes at P33 E1:** the preset-creation session (Drew, in the browser, after the flip) includes the one-time manual search for BFM scratches; record the result here |
 
 ### `tools/gap_triage.py` — harvest pre-filter (added P31 S55)
 

phase-ends/CURRENT_PHASE.md

@@ -74,7 +74,7 @@ one-time snapshot, `CLAUDE.md` gains "never `git clean -x`" (R20 amendment propo
 - [x] **D1** README rewrite — Max — see Log 2026-09-07 D1
 - [x] **D2** LICENSE + `src/NOTICE.md` + `THIRD_PARTY.md` — Max wording — see Log 2026-09-07 D2
 - [x] **D3** Progress publishing (progress.json, badges, frogress_upload, objdiff_report + progress.yml) — xHigh — see Log 2026-09-07 D3
-- [ ] **D4** SETUP.md public-clean pass — xHigh
+- [x] **D4** SETUP.md public-clean pass — xHigh — see Log 2026-09-07 D4
 - [ ] **D5** Governing-docs consistency pass + `tools/doc_links.py` — xHigh
 - [ ] **F1** timeline.py + story — xHigh tool / Max narrative
 - [ ] **F2** retrospective — Max
@@ -386,14 +386,26 @@ Mid-phase rules check after every 4 completed tasks (P6). Commit banked artifact
   `.github/workflows/progress.yml`: converts the committed JSON, uploads `SLUS_007.26_report` (no rebuild in CI). SETUP: 3
   inventory rows + a P33 D1–D3 section (R21). Outward (Drew, after the flip): decomp.dev registration, frogress slug + key.
   Commit: see below.
+- **2026-09-07 (S87) — D4 the SETUP.md public-clean pass.** Header refresh line (public from P33, H1 in force, the remote);
+  the `TBD` remote sentence → `origin` = the public repo + the private archive; §4.4's `/mnt/z` → a generic `<dump-source>`;
+  §4.7 as-built note (the cc1 tarballs are TRACKED, sha256-verified, `bootstrap.sh` extracts them — the wget lines are
+  provenance, not a contributor step); §6.5 gains the project's decomp.me preset line (compiler `gcc2.7.2-psx`, the exact
+  flags incl. `-Wa,--aspsx-version=2.56,--expand-div`; E1 creates `docs/decompme-preset.md`); the "Backup & private-repo
+  posture" section rewritten as **"Backup & repository posture — PUBLIC since Phase 33"** (H1 in force, what is never
+  committed, the private era as a dated historical note pointing at the archive repo + bundle; the two-repo mirror plan
+  stated SUPERSEDED; Sony libs never distributed, cc1 tarballs tracked); `requirements-python.txt` path fixed; ledger row 11
+  CLOSED (the remote), row 14 annotated to close at E1; the one R21 gap found by the census (`git log --diff-filter=A` on
+  `tools/` since the P32 close vs the inventory: 25 P33 tools, 1 missing) filled — a `tools/verify_contract.sh` row.
+  Residual grep for `curated public mirror|two-repo|private repo|/mnt/z`: only the new sentences that describe the change.
+  Commit: see below.
 
-## 🛑 SESSION CHECKPOINT — A1–A5 ✓, B1–B9/C3 ✓, C1–C9 ✓, D1–D3 ✓; C10 IN PROGRESS ON DREW'S SIDE (the Support ticket + the daily probe); NEXT = D4 (2026-09-07 ~08:20 UTC, written by session fa49faf3 "S87" after the D3 commit; SUPERSEDES the earlier blocks)
+## 🛑 SESSION CHECKPOINT — A1–A5 ✓, B1–B9/C3 ✓, C1–C9 ✓, D1–D4 ✓; C10 IN PROGRESS ON DREW'S SIDE (the Support ticket + the daily probe); NEXT = D5 (2026-09-07 ~08:45 UTC, written by session fa49faf3 "S87" after the D4 commit; SUPERSEDES the earlier blocks)
 
 ### 0. How to use this block
 You are a FRESH SESSION that has read `PROJECT_CONTEXT.md`, `phase-ends/DIGEST.md`, `PhaseEnd_Phase30/31/32.md` and this file,
 and nothing else (R64). Replay this block verbatim, state phase / done / NEXT / effort, list the rules from the digest
-(R1–R73), then WAIT for Drew. **NEXT = two tracks.** **Drew (C10):** open the GitHub Support ticket (text in `docs/public-flip-runbook.md` §11), then run `tools/public_rewrite/probe_github.sh` daily (gh is authenticated in WSL; 31 of 33 sampled old hashes were alive at S87's baseline) until it prints PASS — only then the visibility flip, and only after Blocks D/E/F have landed. **Claude (NEXT = D4, xHigh): the SETUP.md public-clean pass** — header date; §2.3/§2.4 → download-only wording (drop the "vendored zip" lines the plan cites at 16-17/861-862 — grep `vendored`); §4.4 a generic dump path; §4.7 the tarballs; §4.8 + §5.6 PsyQ = user-supplied; §6.5 → the decomp.me preset (E1); the "Backup & private-repo posture" section → the PUBLIC posture (R1/R20 historical; the archive repo; `config/ghidra/` as R20's home — the P33 paragraph is already there, the private-era prose above it is not); ledger rows 11/14 closed; an R21 row for every P33 tool (audit against `git log --diff-filter=A --name-only <P33 range> -- tools/`); every `gitignored|private|curated public mirror|two-repo` mention reviewed line by line. Then D5 (governing docs + `tools/doc_links.py`) → F1 → F2 → F3 → E3 → E4 → E5 → E6; E1/E2 and D3's outward actions after the flip. **Every commit cites NEW hashes only; `.run/public_rewrite/` (scratch: dict, mailmap, old-to-new, bundle 556 MB, the rewritten bare clone) holds the old ones — keep until the probe passes, then delete (C11).**
-one TaskCreate per plan item A1…G2, 40 items, mark A1–A5 + B1–B9/C3 + C1–C9 + D1–D3 completed; R28). The SessionStart hook restarts the headless
+(R1–R73), then WAIT for Drew. **NEXT = two tracks.** **Drew (C10):** open the GitHub Support ticket (text in `docs/public-flip-runbook.md` §11), then run `tools/public_rewrite/probe_github.sh` daily (gh is authenticated in WSL; 31 of 33 sampled old hashes were alive at S87's baseline) until it prints PASS — only then the visibility flip, and only after Blocks D/E/F have landed. **Claude (NEXT = D5, xHigh): the governing-docs consistency pass + `tools/doc_links.py`** — `CLAUDE.md:61` ("the Ghidra project stay out of git" is true again; add the SDK/dumps/archive to that sentence), the `.gitignore` header (already H1 — re-read), `dumps/INDEX.md` (done at B6 — re-read), `docs/roadmap-to-100.md` §1 → a dated "status at P33" block (218 binaries, 0 stubs, the second oracle closed, the flip), `docs/gen2-roadmap.md` Phase-14 → a "SUPERSEDED at P33" banner (delete nothing), `phase-ends/DIGEST.md` §0/§1 (H1 re-tightened, R1/R20 historical, the corrections: session start unchanged; R65–R73 already in §3), `docs/backlog.md` (0 rows — nothing to do); NEW `tools/doc_links.py`: every relative link/path in README, THIRD_PARTY, SETUP, verification.md, the runbook, the wiki (later) must resolve — in `tools-health`; plus the line-by-line grep review for `gitignored|private|curated public mirror|two-repo` across the governing docs. Then F1 → F2 → F3 → E3 → E4 → E5 → E6; E1/E2 and D3's outward actions after the flip. **Every commit cites NEW hashes only; `.run/public_rewrite/` (scratch: dict, mailmap, old-to-new, bundle 556 MB, the rewritten bare clone) holds the old ones — keep until the probe passes, then delete (C11).**
+one TaskCreate per plan item A1…G2, 40 items, mark A1–A5 + B1–B9/C3 + C1–C9 + D1–D4 completed; R28). The SessionStart hook restarts the headless
 MCP server when `ghidra/bfm.rep` exists (it did not stay up in S87 — `ss -tln` showed nothing on :8080; harmless): B6/B7/B8
 need no Ghidra; run `tools/ghidra_mcp_stop.sh` before any headless step (R23).
 
@@ -429,16 +441,13 @@ still stand for the tasks ahead — restate them, Drew decides (R7/R27).
 1. **C10** (Drew; decision Max): the Support ticket (text in `docs/public-flip-runbook.md` §11), then `tools/public_rewrite/
    probe_github.sh` daily until PASS (gh auth done in S87; `old-to-new.tsv` + `old_tag_tip.txt` in scratch); the flip only
    after the probe passes AND Blocks D/E/F have landed.
-2. **D4 — SETUP.md public-clean pass** (xHigh; see the NEXT line above). Then **D5**: CLAUDE.md:61 wording (true again),
-   `.gitignore` header, `dumps/INDEX.md:8`, `docs/roadmap-to-100.md` §1 → a dated "status at P33" block, `docs/gen2-roadmap.md`
-   Phase-14 → a "SUPERSEDED at P33" banner, `phase-ends/DIGEST.md` §0/§1/§3 (H1 re-tightened, R1/R20 historical, the
-   PROJECT_CONTEXT corrections, R65–R73 full text — already there), `docs/backlog.md` (0 rows — done); NEW `tools/doc_links.py`
-   (relative link/path checker over README, THIRD_PARTY, SETUP, verification, the runbook, the wiki; in tools-health) + a
-   line-by-line grep review for `gitignored|private|curated public mirror|two-repo`.
+2. **D5 — governing-docs consistency + `tools/doc_links.py`** (see the NEXT line above). Then **F1** (`tools/timeline.py` +
+   `docs/story-timeline.md` + `.svg` + `docs/story.md`), **F2** (`tools/mine_hindsight.py` + `docs/retrospective.md`), **F3**
+   (`docs/wiki/` + `docs/how-to-ai-decomp/` + `tools/wiki_sync.sh`), **E3–E6**, then the flip-gated E1/E2, C11, G1, G2.
 3. Aftercare reminders (C11): `gh auth logout` in WSL after the flip; `git remote remove archive`; other clones reset, never
    pull; `.run/public_rewrite/` deleted after the probe passes (keep the bundle off-machine if wanted).
 ### 4. Files S87 touched
-D3: `tools/progress.py` (per_bin, badges, --check), `docs/badges/*.json` (4, new), `docs/progress.json`, `tools/objdiff_report.py` (new), `tools/frogress_upload.py` (new), `.github/workflows/progress.yml` (new), `Makefile` (audit-digest), `docs/SETUP.md`. Scratch: `.run/objdiff/` (the objdiff-cli 3.8.1 validator + reports). D2: `LICENSE` (new), `src/NOTICE.md` (new), `THIRD_PARTY.md` (new), `tools/README.md` (new). D1: `README.md` (rewritten), `docs/progress.json` (new, generated), `tools/progress.py` (`--json`/`--readme`/`--check`), `Makefile` (report wiring). C9: `tools/public_rewrite/probe_github.sh` (422 = gone), `docs/public-flip-runbook.md` §10/§12; `.git` (the archive remote removed, 12 worktrees removed, repacked to one 80 MB pack). C8: `.run/P33/verify/*` (the recorded run, tracked), `docs/verification.md` §2, `docs/family-hseq.md`, `tools/verify_contract.sh` (the step-00 fix). C4–C7: `docs/commit-map.tsv` (new), the 98 token-resolved files (see the C7 entry), `tools/public_rewrite/resolve_tokens.py` (the skip rule), `.git/config` (repo-local noreply identity). Scratch `.run/public_rewrite/`: `pre-rewrite.bundle`, `repo.git` (the rewritten bare clone, keep until C9), `c4c5.{sh,log}`, `old-to-new.tsv`, `unchanged_commits.txt`, `old_tag_tip.txt`, `c5_commit-map.tsv`, `ids_after.txt`, `refs_*.txt`. C1: `tools/public_rewrite/{common,hash_dict,scrub,gate_scan,run_filter,verify_rewrite,build_commit_map,resolve_tokens,absent_scan}.py`, `probe_github.sh`, `expected_offenders.txt` (all new), `requirements-python.txt`, `docs/SETUP.md`, `docs/public-flip-runbook.md`. Scratch `.run/public_rewrite/`: `dict.json`, `mailmap`, `rom_blob_ids.txt`, `old_tag_tip.txt`, `trial*.{sh,log}`, `trial_commit-map.tsv`, `trial_old-to-new.tsv`, `unchanged_commits.txt`, `nonpurge_blob_ids.txt`, `filter.log`. B9/C3: 251 index removals (files on disk), `docs/public-flip-runbook.md` (new), `docs/SETUP.md` §2.3/§2.4, `docs/verification.md`, `CLAUDE.md`, `docs/decision-log.md`. A5: `tools/verify_contract.sh` (new), `tools/audit_frontier.py` (derived denominator lines), `.gitignore` (the `.run/P33/verify/` allowlist), `.run/P33/verify/*` (tracked evidence), `docs/verification.md` §2, regenerated `docs/family-hseq.md` + `docs/progress*.md`/`duplicates*.md`. B8: `docs/verification.md` (new), `docs/SETUP.md` (§4.4/§4.6/§4.8/§6.3 pointers, backup posture). B7: `.github/workflows/no-rom.yml`, `tools/audit_public.py`, `tools/compile_only.py`, `tools/public_rewrite/purge_set.txt` (all new), `docs/SETUP.md`. B6: `dumps/CHECKSUMS.sha1` (new), `dumps/INDEX.md`, `docs/memory-map.md`. B5: `tools/ghidra_scripts/ImportAnnotations.java` (3 compile fixes + the `/undefined` resolver), `tools/ghidra_rebuild.sh`
+D4: `docs/SETUP.md` (the public-clean pass). D3: `tools/progress.py` (per_bin, badges, --check), `docs/badges/*.json` (4, new), `docs/progress.json`, `tools/objdiff_report.py` (new), `tools/frogress_upload.py` (new), `.github/workflows/progress.yml` (new), `Makefile` (audit-digest), `docs/SETUP.md`. Scratch: `.run/objdiff/` (the objdiff-cli 3.8.1 validator + reports). D2: `LICENSE` (new), `src/NOTICE.md` (new), `THIRD_PARTY.md` (new), `tools/README.md` (new). D1: `README.md` (rewritten), `docs/progress.json` (new, generated), `tools/progress.py` (`--json`/`--readme`/`--check`), `Makefile` (report wiring). C9: `tools/public_rewrite/probe_github.sh` (422 = gone), `docs/public-flip-runbook.md` §10/§12; `.git` (the archive remote removed, 12 worktrees removed, repacked to one 80 MB pack). C8: `.run/P33/verify/*` (the recorded run, tracked), `docs/verification.md` §2, `docs/family-hseq.md`, `tools/verify_contract.sh` (the step-00 fix). C4–C7: `docs/commit-map.tsv` (new), the 98 token-resolved files (see the C7 entry), `tools/public_rewrite/resolve_tokens.py` (the skip rule), `.git/config` (repo-local noreply identity). Scratch `.run/public_rewrite/`: `pre-rewrite.bundle`, `repo.git` (the rewritten bare clone, keep until C9), `c4c5.{sh,log}`, `old-to-new.tsv`, `unchanged_commits.txt`, `old_tag_tip.txt`, `c5_commit-map.tsv`, `ids_after.txt`, `refs_*.txt`. C1: `tools/public_rewrite/{common,hash_dict,scrub,gate_scan,run_filter,verify_rewrite,build_commit_map,resolve_tokens,absent_scan}.py`, `probe_github.sh`, `expected_offenders.txt` (all new), `requirements-python.txt`, `docs/SETUP.md`, `docs/public-flip-runbook.md`. Scratch `.run/public_rewrite/`: `dict.json`, `mailmap`, `rom_blob_ids.txt`, `old_tag_tip.txt`, `trial*.{sh,log}`, `trial_commit-map.tsv`, `trial_old-to-new.tsv`, `unchanged_commits.txt`, `nonpurge_blob_ids.txt`, `filter.log`. B9/C3: 251 index removals (files on disk), `docs/public-flip-runbook.md` (new), `docs/SETUP.md` §2.3/§2.4, `docs/verification.md`, `CLAUDE.md`, `docs/decision-log.md`. A5: `tools/verify_contract.sh` (new), `tools/audit_frontier.py` (derived denominator lines), `.gitignore` (the `.run/P33/verify/` allowlist), `.run/P33/verify/*` (tracked evidence), `docs/verification.md` §2, regenerated `docs/family-hseq.md` + `docs/progress*.md`/`duplicates*.md`. B8: `docs/verification.md` (new), `docs/SETUP.md` (§4.4/§4.6/§4.8/§6.3 pointers, backup posture). B7: `.github/workflows/no-rom.yml`, `tools/audit_public.py`, `tools/compile_only.py`, `tools/public_rewrite/purge_set.txt` (all new), `docs/SETUP.md`. B6: `dumps/CHECKSUMS.sha1` (new), `dumps/INDEX.md`, `docs/memory-map.md`. B5: `tools/ghidra_scripts/ImportAnnotations.java` (3 compile fixes + the `/undefined` resolver), `tools/ghidra_rebuild.sh`
 (`.proof` markers; dies unless `failed=0`), `tools/ghidra_annotations_delta.py` (the three drift classes), new
 `tools/ghidra_roster.py`, `tools/ghidra_mcp_start.sh` (silent no-op guard), `.claude/settings.json` (relative hooks),
 `Makefile` (roster check in tools-health), `docs/SETUP.md` (P33 B5 section, 5 inventory rows, §2.8), `config/ghidra/*`