check-all: 218 passed, 0 failed of 218
lever_census --check: 24,915 pin/asm sites, 24,915 marked !FAKE, 0 UNMARKED — OK
- b2 func_80162438 (127 bodies): hoist the store above the assignment and store the EXPRESSION, so the temp falls out.
cse's 'REG0 is the cheapest' rewrite (cse.c:7440-7501, guarded :7454-7460) deletes a copy only when the insn
immediately before it set the source; putting a USE between compute and copy defeats that and flow's LOG_LINK, which
goes only to the first following use (flow.c:2076-2091), so combine is never offered the pair.
- b6 func_80161E08 (127 bodies): the same three blocks written as a CHAINED assignment, p = slot = base + K. The value
gains a second consumer, flow's only link goes to the store, and the copy survives — the instruction the pin faked.
- b5 func_80145934 + its sibling func_80145A2C (126 + 126 bodies): a body-local symbol ALIAS. Cross-jump's equality test
compares symbol names by POINTER (jump.c:2440), so two arms referencing one extern merge; an asm-label alias makes the
identifier distinct, the blocks survive, and assemble_name strips the star so the bytes and relocations are unchanged.
The barrier it replaces was standing in for symbol identity, not for ordering or liveness.
- the engine banked two of its own while the agents worked: R20 closed func_80139BE0 (129 bodies) by chain-narrowing —
the body agent a14 could only reach with an INVENTED identically-zero term, which I refused. The refusal was right and
the honest close arrived hours later from the generator.
- R19 closed func_8017A3D8's ov_SC07_006 copy (16 bodies) by restoring a dropped argument.
Two things to act on, both reported by agents:
- 'a @stuck: note claiming a lever is required should be re-tested, not trusted' — two such notes were refuted on bytes
today ('natural C ALWAYS coalesces that copy', 'no pure-C spelling survives that fold').
- one pack lacked neighbours.txt because the packs predate that change; the next --build carries it.
- the move: narrow every local in the counter's def-use chain together — the counter, its +/-1 temp and the copy-back —
and do it for BOTH chains at once. Four instructions were MISSING, not miscoloured, three of them the moves the $0 pin
was faking. insert_regs (cse.c:1029-1032, early bail :1018-1020) puts two pseudos in one equivalence class only when
their MODES match, so an all-int copy-back is collapsed and swept, while the narrowed one is a truncation: no
equivalence, the wide temp stays live and reaches reload as the move the target has. The fourth instruction is
strength_reduce minting a shift giv from a wide counter whose every use is a cast; a HImode pseudo cannot be that giv.
delever --propagate: 127 of 127 sibling(s) banked, 0 refused. 26,202 -> the census below.
- R20 narrow_chains: the agent PROVED the joint form is necessary, and the generator reproduces it. Single declarations
scored 45/72/51/24, each chain alone 43, both chains together 0 — every intermediate worse than the search's own best
of 11, so a beam over R12's one-declaration width moves cannot reach the answer from either side. Seven runs and 4,811
compiles stalled at 11; R20 offers six candidates and the right one is a single compile.
- known-true check: run on b3's pre-bank text, R20's joint signed candidate scores 0 (MATCH) and its single-chain
candidates score 43 and 51 — the agent's own hand-measured numbers, reproduced by the tool.
- chains are built conservatively from the body's text (two locals linked when one is assigned from the other, through a
cast or a +/- constant), and only whole components are offered, so the partial narrowings the measurement showed are
always worse are never generated. Selftest: the chain is found whole, an unlinked local is not pulled in, and a body
with no linked pair offers nothing.
- the move: delete the hand-walked pointer's self-increment and recompute p = &tbl[i] from the loop counter each
iteration. The lever-free body had TWO induction variables — the loop dump says 'Cannot eliminate biv 73: biv used in
insn 50' (loop.c:5976) because the pointer is itself a call argument — and combine_givs (loop.c:5494/:5527) then
merged the three +12 field addresses into one giv whose benefit clears the not-worth-while gate at loop.c:3822-3828,
reducing it to a THIRD walking register and forcing a fourth callee-saved one: the +4 instructions and the whole
recolouring. Indexing instead leaves one biv, the +12 rides as an immediate, and the body is byte-identical.
delever --propagate: 126 of 126 sibling(s) banked, 0 refused. 26,456 -> 26,202 sites.
- THE HEADLINE IS THE METHOD, not the crack: the answer was written in English thirty lines above, in the // @class:
header of an already-matched sibling in the same file, which spells out 'recompute p = &D[i] each iteration (NOT p++)
so gcc reduces base+i*0x10 into a SINGLE pointer IV'. The pack sent agents to the cookbook and to the compiler source
and never to the target's own neighbours. This project has been leaving itself notes for months and nobody was reading
them.
- delever_pack.py now writes PACK/neighbours.txt — the comment headers of the three matched functions either side of the
target, plus every @class/@stuck/@crack note in the translation unit — and the brief makes reading it step 0.
tool_census's two enumerations disagreed on one file: the new tool was written but never added, so the dictionary row
existed for a path git did not carry. That is exactly the disagreement the second oracle is there to find.
Drew: we do want C correctness on all funcs, and log it for the story and the chart.
- decl_repair --apply rewrote 3,439 units and repaired 16,759 declarations. check-all: 218 passed, 0 failed of 218.
lever_census --check: 26,456 pin/asm sites, 0 UNMARKED — unchanged, as expected: this pass fixed TRUTH, not levers.
- only the free set was touched: a declaration is repaired when every call to that function in the unit already passes
the arguments, so the code was right and only the promise was wrong. Calls that pass too few remain R19's population,
where the argument must be chosen and the bytes decide.
- tools/readability_progress.py: the Gen3 series beside docs/levers.md, because levers are only one way the source is
untrue. It counts lying call declarations (split by the K&R-empty and (void) forms, and how many sit in a body still
holding an argument-register pin) and raw cast dereferences against struct member reads — the struct debt. Each row
carries its date and commit so the chart is generated, never typed (R75). docs/readability.md renders it.
First row after the repair: 94,001 lying declarations over 1,564 callees (86,701 (), 7,300 (void)), 461 in 314 pinned
bodies; 414,148 raw cast dereferences against 173,286 struct member reads.
- dictionary rows for decl_repair and readability_progress; kit corpus regenerated; tool_census --check OK.
search: 3 of 55 exemplars matched lever-free in 0.33 h (3 of 730 bodies behind them; 12,034 compiles) — NO-MATCH 51 · MATCH 3 · UNSCORED 1
check-all: 218 passed, 0 failed of 218
lever_census --check: 26,456 pin/asm sites, 26,456 marked !FAKE, 0 UNMARKED — OK
Every one of the three closes is R19 restoring a dropped call argument, each at depth 1 in two compiles — the class that
seven earlier runs and thousands of compiles could not touch.
THE DECLARATION SCAN, AND THE INSTRUMENT FAILURE IT TOOK TWO TRIES TO SEE (R39/R40):
- first framing: widen every lying declaration and leave the call sites alone. That is not a repair — a prototype
demanding an argument the call does not pass is a hard error — so 1,766 of the first 3,250 units failed to compile BY
CONSTRUCTION and none was identical. A measurement that cannot come out any other way is not a measurement. The tool
now only repairs a declaration when every call to it in that unit ALREADY passes the arguments; calls that pass too
few are R19's population, where the argument must be chosen and the bytes decide.
- second failure, worse because it looked like a finding: the corrected scan still returned 0 free of 3,634 units. The
negative control I had not run — compile the UNCHANGED text through the same path — came back DIFFERENT by 9,176
bytes, because the candidate is built from a scratch copy and the object records its own source filename. Comparing
only .text/.rodata/.data removes the path, and the control then matches exactly. The control is now part of every
unit's judgement rather than something I remember to run.
- the corrected result: 3,414 units / 16,732 declarations are FREE to repair (byte-identical with the declarations made
honest), only 2 units / 3 declarations actually depend on the false declaration, 117 compile errors and 101 units
whose control failed and are therefore reported as harness failures, not results.
- scope limit stated: declarations inside src/shared headers are not units with recipes and were not tested here.
Six T7 agents independently reached score 0 by restoring an argument the decompiled source had dropped, and no generator
could reach the class because every other family rewrites statements that exist while this changes a call's ARITY. R19
closes that gap without cracking anything: it finds every call whose in-scope declaration is narrower than the callee's
real definition, then offers one candidate per value already in scope (each parameter, each local declared before the
call) and lets the byte oracle pick. The missing argument is never inferred.
- known-true check: run on the pre-bank text of func_8017A3D8, which agent a12 solved by hand, R19 emits that agent's
exact fix and --try scores it 0 (OTHER; mine 53 ins, target 53) — MATCH.
- two spellings were wrong before that passed. It took the return type from the DEFINITION and produced
((void (*)(s32))f)(a) != 0, which cannot compile because the defining TU says void where this one says int — it now
repairs the arity only and keeps the TU's declared return type. And it required a simple statement, so it found
nothing on the very body it was written from: these calls live in and far more often
than in a plain statement.
- it also sees the cast-wrapped form ((s32 (*)(void))f)(), which is how m2c usually spells a dropped argument, and
replaces the whole wrapper rather than nesting a second cast.
- ranked FIRST in every residual class: it emits candidates only for calls whose declaration provably disagrees with the
definition, so it costs nothing when it does not apply. The engine selftest's ordering invariant is updated to say so
rather than being widened again.
- argcheck now carries each definition's return type, which the cast route needs.
- selftest: two positive assertions and two controls (the declared return type is kept; the definition's is refused; a
call inside a return statement is seen; a matching declaration offers nothing).
- a22: func_8017B238 closed by giving the if-arm's pointer and the else arm's first table address one function-scope
local. Three decisions turn on that edit, all dump-proven: make_regs_eqv's head rule (cse.c:840-857), set_preference
stripping one RTX level so an arithmetic set inherits its operand's register (global.c:1535), and combine_regs with
birthing_insn_p's reg_n_sets == 1 (local-alloc.c:1765-1788, sched.c:2469) — which is why the merge must be with the
else arm's non-call-crossing temp. 26,714 -> 26,462 sites.
- a14 reaches score 0 on func_80139BE0 but only by an INVENTED identically-zero term whose sole purpose is to keep a
value live. NOT BANKED: an invented no-op expression is a compiler-forcing construct in C clothing, and worse than the
marked launder it replaces because the launder is counted and this would be silent. The phase's own rule is ban the
silence, not the lever. Parked for the structs/types phase with its reading; the tree comment above it ('no pure-C
spelling survives that fold') is refuted.
- a6 corrects cookbook 455: cse1 (cse.c:7439-7502) rewrites the producer's destination to the copy's whenever the
producer is the immediately preceding insn; combine only finishes the job once that adjacency is broken. It enumerated
the three lever-free blockers can_combine_p admits and showed the body can pay for none, then scanned all 4,284 built
objects for the shape — 101 hits, every lever-free precedent paying with a genuine second use, a narrow local with two
consumers, or a join label.
- a24's residual was one absent load: cse forwards a just-stored halfword so no lh is emitted, and seven branch
displacement mismatches were downstream of it. Its method gap is the instrument to fix next — three agents have now
asked for local-alloc's quantity table in the pack, and alloc_table.py prints an empty or one-row table because it
keys on dump lines that are often absent.
- Drew's struct question answered on the record: structs are not in the binary (types are erased; no metadata in a
retail build), what is there is base + offset + width + stride, so a struct is an inference across every function
touching a base — which makes per-function struct invention the wrong unit and is the failure P35 already recorded.
Recommendation: keep pins as the main lane, build a zero-token struct evidence census beside it, park stuck pins with
their evidence, and fix call signatures first because they are the bigger and cheaper blocker (471 narrow call sites
in 323 pinned bodies). Measured: 372,224 raw cast dereferences against 92,624 struct member accesses.
The edit in 161d36cf3 failed its match assertion while the commit went through, so that message over-claimed: it said
R14's documented premise was corrected and the file was unchanged. Naming it here rather than quietly fixing it (R66 —
write 'done' only from the tool's own success line; the assertion had printed a traceback and I committed anyway).
The correction itself, byte-proven by agent a15 on func_80166F58: MIPS in gcc 2.7.2 defines only PROMOTE_PROTOTYPES and
not PROMOTE_MODE (config/mips/mips.h:1153), so a narrowed parameter stays a HImode pseudo and the extension still happens
at the use — the prototyped narrow form, the wide form and the K&R form all give the same 67-instruction merged output.
R14's banked closes stand on their bytes rather than on that rationale.
Banked: func_80136334 (126, all four levers), func_8016B234 (129), func_8015FBE0 (125), func_80143D28 (131),
func_8014D820 (126 of 128). 27,984 -> 26,714 sites.
lever_census --check: 26,714 pin/asm sites, 26,714 marked !FAKE, 0 UNMARKED — OK
THE MISSING CALL ARGUMENT CLASS IS NOW CONFIRMED SIX TIMES, independently, by six agents that never saw each other's
work: a7, a8, a11, a12, a13, a25. In every case the source declares a call with fewer arguments than the callee really
takes — m2c drops arguments at unprototyped and indirect call sites — and the register pin was hired to fake the
instruction the missing argument would have produced. Mechanisms differ and were each proven on bytes: combine.c:1458's
added_sets_2 gate; set_preference (global.c:1535/1589) applied ahead of first-fit at :997-1030, the argument copy
degenerating to a self-move deleted at toplev.c:3142 / jump.c:424-443 so it costs zero instructions; and reorg.c:3374's
liveness half, where restoring the argument adds a use to CALL_INSN_FUNCTION_USAGE (reorg.c:428) so a delay-slot steal
is refused. No generator can reach any of it: every family rewrites statements and declarations, none edits a call's
argument list.
Two concurrency defects, both found by agents rather than by me:
- the includers cache wrote through a FIXED temp name, so concurrent processes clobbered each other's os.replace and the
loser saw FileNotFoundError, which reads like a compiler crash on the candidate. Now a unique tempfile per process.
- the agent brief now mandates PACK/scratch/ for helper scripts and dumps, and says to retry once when a --try failure
names something that is not your own text. Three agents had scripts overwritten mid-run by another agent.
One valuable negative: func_80178970 does not close, and the agent proved why by construction rather than by exhaustion
— only a call or a return writes $v0 in plain C, and a return's hard write is always emitted after its guarding branch,
so combine deletes the call-result copy (combine.c:914-917, use_crosses_set_p at :10127-10130; the SMALL_REGISTER_CLASSES
arm at :944-957 is not defined for MIPS). Its early-return rewrite still improves the source from 6 to 2 and reads
better than the pinned original.
The scorer named its scratch object after the FILE (compile_obj tag="score"), so the nine burst agents sharing one
translation unit wrote and read one object. Two reported it independently without seeing the code: spurious
COMPILE-ERRORs naming an unrelated header, and one agent scoring four candidates against another agent's function. The
tag is now per function. Every landed body was re-verified after the fix and all still score 0; the banks were never at
risk, the agents' intermediate readings were.
- banked: func_801627E8 (132), func_8017A3D8 (118), func_80141874 (119 of 125), func_801345F8 (134). 28,887 -> 27,984.
lever_census --check: 27,984 pin/asm sites, 27,984 marked !FAKE, 0 UNMARKED — OK
- THE FINDING: the biggest lever class in this phase is a WRONG DECLARATION, not codegen. Four agents independently
reached score 0 by restoring a call's real arity, each in a different spelling — a function-pointer cast, a widened
block-scope prototype, a call given its argument, and a definition given its two parameters. The mechanisms differ
(combine.c:1458's added_sets_2 gate; set_preference global.c:1589 ahead of first-fit at :1001-1015, the argument copy
becoming a self-move deleted at toplev.c:3142 so it costs zero instructions; assign_parms' parameter home copies) but
the class is one: a truncated (void) declaration removes an instruction the pin was then hired to fake. No generator
can reach it — every generator rewrites statements that exist, and this changes a call's arity.
- func_80157D20 does not bank body-only (gcc rejects a block-scope redeclaration), so its Path A joins func_80136824 and
func_80168828 as the third measured case for the types phase.
- two more new classes, byte-proven: a store sinking past a load because true_dependence's exception (sched.c:837-839)
discards the edge, fixed by declaring the global an array and storing through [0] to set MEM_IN_STRUCT_P; and a
post-decrement queued by expand_increment until the next sequence point, fixed by splitting the statement plus a u16
destination cse refuses to join (cse.c:1017-1019).
- correction to record: an uninitialised register __asm__("$0") is an opaque operand, not a constant holder — R16 must
refuse it.
- snapshot row 20.
Drew: fix the build issue so agents' effort doesn't get wiped, this needs to be parallelizable.
- every score compares a candidate with the fleet run's object under build/, and the R22 gate starts with make clean,
which deletes exactly that. With agents scoring in parallel, a fleet gate would make every live --try compare against a
missing or half-written baseline and report nonsense in the agent's own voice.
- fixed at the single accessor: delever_oracle.baseline_path(obj) returns the snapshot under .run/P36/delever/baseline/
when it holds the object and falls back to build/ when it does not, so nothing silently scores against half a snapshot.
baseline_bytes and both direct readers in delever_search.py go through it. --snapshot-baseline refreshes it:
7,428 objects, 188 MB, taken at 9f5b22176. Valid until the fleet stops being green: the baseline is the original game's
bytes and a bank is byte-identical by construction.
- known-true test both ways: func_800123F0 in src/800.c scores 0 MATCH with build/src/800.o present; the object was moved
away and it scores 0 MATCH unchanged; restored.
- a4: func_8016C49C from a seed of 34 to score 0 by one move — do { param_1[1] = sVar1; } while (0); on the function's
LAST statement. The residual was a single qsort comparison in global_alloc lost by 142 units out of 6666 (global.c:546
sort, :587 priority, :904 first-fit). reg_n_refs is loop-weighted and computed before combine and sched, so the
reference inside the do-while is counted twice (flow.c:434, :440-443, :2067/:2501/:2711): refs 23->24, priority
6524->6808 > 6666, the order flips and all 34 words fall into place. A plain block at the same site still scores 34,
which proves it is the loop notes and not the scope.
delever --propagate: 125 of 125 sibling(s) banked, 0 refused
lever_census --check: 28,887 pin/asm sites, 28,887 marked !FAKE, 0 UNMARKED — OK
- two instrument findings to act on: the candidate ranking buried the winning move at 438 of 439 so --cap 48 discarded it
in six runs (~4,300 compiles), and history.txt's 'R15 sink @2777 -> 1' is not reproducible (the generator's own text
scores 40) — to be checked against the bytes before either is trusted.
- snapshot row 19.
A new class, and the cheapest one found so far. ov_SC04_011.c:197 declares extern void func_8013BC7C(void); while that
function's real byte-verified definition, src/shared/ov/func_8013BC7C__8042ae05.h:3, is void func_8013BC7C(void *arg0).
The $a0 instruction the pin was forcing is the argument the TU's own declaration denies.
- the move: a block-local s32 *p = &D_801F1640; tested and passed through a function-pointer cast,
((void (*)(void *))func_8013BC7C)(p); — the idiom this TU already uses for two other calls. Score 0 on the first
spelling tried, where seven mechanical runs and 4,000+ compiles had sat at 3, because every generator rewrites
statements already present and this move adds an argument.
- mechanism, both halves proven on bytes: update_equiv_regs (local-alloc.c:947, the referenced-exactly-twice test at
:1066, substitution at :1085-1112) — the second reference keeps the address in a register, which is what the volatile
was faking; and combine_regs (local-alloc.c:1722, hard-reg path :1797-1818) records $4 in qty_phys_copy_sugg so
find_free_reg (:2073, restricted at :2145-2150) colours the quantity $4, which is what the pin was faking.
Controls: reading the global directly scores 9; declaring the pointer at function top scores 4.
- unlike agent a2's case this truncation is a LOCAL extern, so the cast keeps the bank body-only.
delever --apply-body: ... IDENTICAL on 1 object(s) — KEPT, ledgered (rung E, a7)
delever --propagate: 126 of 126 sibling(s) banked, 0 refused
lever_census --check: 29,013 pin/asm sites, 29,013 marked !FAKE, 0 UNMARKED — OK
- the R22 fleet gate is deferred until the burst of 20 agents drains: make clean deletes the build/ baseline object that
every live --try scores against. Banking and propagation only read build/, so the writing lane runs beside the agents.
- snapshot row 18.
Drew, on waking: he expected dozens of agents overnight and got three. The cause is the cadence, not the agents — the loop
ran strictly serially (agent, gate, toolify, sweep) and the sweeps are hours long, so most of the night had no agent
running. His rule was one agent at a time so the methodology is honed each time one lands, not one agent per sweep.
- correction: agents run back-to-back, the next launched the moment the last lands; a sweep runs only when it does not
stand between two agents, and never on the TU a live agent is scoring in (the scratch object is keyed by the TU).
- stopping s7 cost a lesson worth keeping: the kill landed mid-write, inflight.json was empty, and --restore refused
loudly with instructions instead of guessing (R102). 8 dirty files: 5 the run's recorded banks, 3 with no bank; the
fleet named exactly those 3 binaries (ov_SC03_113, ov_SC04_004, ov_SC04_011), restored from HEAD.
check-all: 218 passed, 0 failed of 218
lever_census --check: 29,140 pin/asm sites, 29,140 marked !FAKE, 0 UNMARKED — OK
- snapshot row 17.
search: 25 of 337 exemplars matched lever-free in 1.39 h (25 of 337 bodies behind them; 57,838 compiles) — NO-MATCH 307 · MATCH 25 · UNSTRIPPABLE 4 · UNSCORED 1
- the draw asked for 1,200 and the ledger could offer 337: s5 had taken the easy half and the never-attempted pool is now
empty — every remaining residue class has been offered at least one shape. The yield falling from 36% to 7% on exactly
the bodies s5's ordering left for last is what an exhausted pool looks like, not a broken instrument.
- check-all: 218 passed, 0 failed of 218
lever_census --check: 29,148 pin/asm sites, 29,148 marked !FAKE, 0 UNMARKED — OK
- what is left and what it costs (R41): 9,010 bodies in ~1,300 classes, every one already refuted at beam 3 x depth 2 x
cap 48. The next zero-token lever is a wider re-draw over the NO-MATCH population (--include-done, beam 4 x depth 3-4),
the same move that took g1's 1-of-16 to g3's 13-of-64 in S101. The head's 57 classes remain the agents'.
- snapshot row 16.
search: 285 of 800 exemplars matched lever-free in 2.32 h (285 of 800 bodies behind them; 94,627 compiles) — NO-MATCH 499 · MATCH 285 · UNSTRIPPABLE 9 · UNSCORED 7
- the first broad draw of non-head classes, at the cheap width, with the full generator set. By first move:
R7 105, R10 59, R12 42, R6 26, R9 20, R18 13, R8 9, R3 6, R15 4, R14 1 — and 242 of the 285 closed in ONE move.
These are not deep searches; they are bodies nobody had ever offered a single shape to. R18, one day old, is 13 of them.
- the contrast that steers the rest of T7: 36% of the tail closes mechanically, against 6 closes in ~128,000 compiles on
the head. The head's 57 classes are the agents' work; everything else is the engine's, at zero tokens. Sweep the whole
residue before spending another agent.
- check-all: 218 passed, 0 failed of 218
lever_census --check: 29,204 pin/asm sites, 29,204 marked !FAKE, 0 UNMARKED — OK
- snapshot row 15.
The third agent produced no bank and a precise refutation plus a generator, which is the deliverable the brief asks for.
- it refuted the a2 hypothesis on its own body: git grep returns 1,770 declarations in two forms, both (s32 a0), no (void)
anywhere, and the pin is on a local rather than the parameter. Three lever-free spellings reach the target's complete
register assignment, so the class is reachable from plain C.
- its best is score 2, class ORDER, 89/89 instructions, every register correct, one displaced bystander store. The target's
sw sits inside the lbu->addiu window and that position is forced: anti_dependence and true_dependence (sched.c:817/845)
both hold, so the store can neither hoist nor sink. Post-sched1 stream and reg_live_length then match ours, leaving
reg_n_refs — computed by flow on the pre-combine RTL — as the only remaining input.
- R18 moves one simple statement to each other position in its own block, up to six away. R9's adjacent swap is the special
case; the distance is the point. It costs no instruction where R7's LOOP notes are a full sched1 barrier and always cost
one displaced insn, so R18 is ranked ahead of R7 in every class.
- two wrong spellings before the known-true check passed: identifier-disjointness as a requirement offered three candidates
and none of them the agent's (it is only an ordering preference now — byte-identical output is the same program, so the
oracle is the whole correctness proof, which is R9's own footing), and a blank line counted as an obstacle, so the
generator never offered the very move it was written from. It now reproduces that body exactly: bystander @21->17.
- delever_pack.py now writes each trace candidate's residual class beside its score, from the agent's method note: a bare
number hid that a move had already turned this body's residual from REG into ORDER.
- delever --selftest OK (3 new controls incl. the nested-block refusal); delever_search --selftest OK; tool_census OK.
search: 1 of 80 exemplars matched lever-free in 0.89 h (6 of 486 bodies behind them; 28,042 compiles) — BUDGET 59 · NO-MATCH 18 · UNSTRIPPABLE 2 · MATCH 1
- func_801621CC by R6 inline lo + R7 do-while; delever --propagate: 5 of 5 sibling(s) banked, 0 refused.
- the figure that prices the draw is BUDGET 59 of 80: three quarters of the remaining bodies exhausted 400 compiles rather
than being refuted, so this family is sampled, not measured. s3 had already taken its cheap half (10 bodies).
- two UNSTRIPPABLE recorded by name: func_8017DC80 (a launder with 2 outputs), func_80181A4C (instruction lw has no C
spelling in the table).
- check-all: 218 passed, 0 failed of 218
lever_census --check: 29,527 pin/asm sites, 29,527 marked !FAKE, 0 UNMARKED — OK
- snapshot row 14. Loop economics two agents in (R41): 30,358 -> 29,527 sites, 9,747 -> 9,320 bodies; the agents' own two
bodies account for 255 of that and their toolified moves for the other 576, at zero drafting tokens.
- s2 (the head, with R16/R17 added): search: 0 of 140 exemplars matched lever-free in 0.24 h (0 of 7,085 bodies behind
them; 23,689 compiles). The two new generators closed nothing on the head; recorded as measured.
- agent a2's "284 constant-holder pins of 10,958" verified against the source rather than believed (R14), and my first
instrument was wrong (R40): asking R16 directly answered 33, because R16 only fires on a split declaration while most
pins carry their value as an initialiser. R3 converts one form to the other, so the reachable family is R3+R16.
Corrected, both figures derived: 537 constant-holder pin sites of 17,302, in 510 bodies (152 initialiser, 385 separate
assignment; by register $2 282, $20 136, $3 28).
- s3 drew exactly those 99 function names and closed 10 bodies before crashing with
AttributeError: 'Namespace' object has no attribute 'allow_residue'
in propagate — the a2 fix read the flag off the caller's namespace and the search engine builds its own Namespace for
that in-process call. Fixed with getattr(a, "allow_residue", False): a library must not assume its caller's namespace
shape (R43).
- the ten banks were real, proven by gating the tree the crash left:
check-all: 218 passed, 0 failed of 218
lever_census --check: 29,533 pin/asm sites, 29,533 marked !FAKE, 0 UNMARKED — OK
- by first move the ten are R15 x3, R6 x4, R7 x2, R9 x1 — the draw was right about the family even though R16 did not fire.
- snapshot row 13; s3 re-runs from the top with the fix.
- R16 writes a local whose only assignment is one integer literal at every use and deletes it. R6 stops at a temp read
exactly once, so a holder read four times was invisible to the search and its whole family with it. Deleting it is
byte-neutral alone but removes a quantity from the block, which is what lets the next move reach the allocator.
- R17 splits a run of consecutive same-literal assignments by moving the nearest differently-valued one into it, at each
interior split point. find_free_reg's live-range scan (local-alloc.c:2109-2110): while the two constants' ranges are
disjoint they share a caller-saved register; splitting makes the first live across the second and it takes another colour.
- known-true check: on the seed that keeps func_80168828's semantically-forced $4 pin, R16 then R17 reaches
score 0 (OTHER; mine 108 ins, target 108) — MATCH at three of the six offered split points, in ten compiles where the
blind search needed 2,271.
- the engine selftest's caller-saved assertion is now the ordering invariant (every targeted lever before every blind
family) rather than a fixed window widened once per new generator.
- delever --selftest OK (4 new controls); delever_search --selftest OK; tool_census --check OK; SETUP row (R21).
- two moves: delete `register s32 c40 __asm__("$3")` and its `c40 = 0x40;`, writing the literal at its four uses (byte-neutral
on its own — the pin was never doing the work); then swap the adjacent `f1e = 0x40;` and `f1a = 0x10;` so the 0x10 store
splits the run of 0x40 stores.
- the residual reads like cse/sched and the decision is local-alloc's. Dumps of the real TU in both orderings differ on one
.lreg line — `Register 76 used 5 times across 10 insns` -> `across 14 insns`, `Register 76 in 2.` -> `in 3.` — which is
find_free_reg's live-range scan at local-alloc.c:2109-2110: unswapped the two constants' ranges are disjoint and share $v0,
swapped they overlap and the first takes $v1.
- the $4 pin STAYS, and not as a lever: src/shared/ov/func_801687CC.h declares extern void func_80168828(void), so the
target's `move s1,a0` has no C source. An uninitialised local, a pointer-typed one, a split declaration and deleting it
outright all give the identical score-25 residual; both parameter forms are hard cc1 errors against that header. This is
the first measured pin that only a declaration fix can remove — one of the 51 conflicts P35 ledgered for the types phase.
The engine's score-1 text is a coincidence (its andi truncates garbage in $s1 and never reads $a0); not proposed.
- instrument fixed in the same change: --propagate refused all 124 siblings because the reshape deliberately keeps a lever.
The allowance is now derived from the exemplar's own banked text (its surviving !FAKE markers), and a sibling whose remap
would carry more levers than the exemplar is refused by name.
delever --propagate: 124 of 124 sibling(s) banked, 0 refused
- check-all: 218 passed, 0 failed of 218
lever_census --check: 29,572 pin/asm sites, 29,572 marked !FAKE, 0 UNMARKED — OK
- snapshot row 12; delever --selftest OK. The toolify (R16, the constant-run split) follows.
The harvest half of agent a1 paying off. With R15 in the registry the engine was swept over the rest of the residue head
(--only the 56 other head functions, which draws every body of those names: 147 exemplars judged).
search: 6 of 147 exemplars matched lever-free in 0.28 h (267 of 7,477 bodies behind them; 23,892 compiles) — NO-MATCH 141 · MATCH 6
- all six closes are R15, each in FOUR compiles: func_8013EB7C (126 + 7 copies) and func_8016DF5C (127 + 4 + 2 + 1) across
their fleet copies. Every propagation 0 refused. R15 also moved func_80136824 from 21 to 2 as a first move.
- the loop's economics with denominators (R41): one agent's reading (~221k tokens) bought 130 bodies directly and 267 more
for zero tokens — 397 bodies, 30,358 -> 29,697 sites (-661).
- check-all: 218 passed, 0 failed of 218
lever_census --check: 29,697 pin/asm sites, 29,697 marked !FAKE, 0 UNMARKED — OK
- snapshot row 11 (9,617 -> 9,350 bodies); the checkpoint headline and loop state refreshed (R101).
The harvest half of the one-at-a-time loop (R16): agent a1's reading of func_80156044 is now a move the engine can make
on any body, so the remaining head classes get it for free.
- R15 sinks the statement AFTER an if/else chain into every arm and deletes the variables it consumed:
`if (c) { v = e1; } else { v = e2; } w = f(v);` -> `if (c) { w = f(e1); } else { w = f(e2); }`.
- it is a REGISTER move, not a scheduling one. A value set in every arm and read after the merge is a cross-block pseudo
local-alloc never gives a quantity (local-alloc.c:472, next_qty reset at :517), so the arm holds two quantities and
takes block_alloc's unrolled case 2 (:1499-1502, qty_compare :1578-1596). Sinking makes it a third block-local
quantity, and case 3 (:1491-1496) falls through into case 2 and applies that comparison a second time, undoing its own
exchange — the two caller-saved colours swap. It also takes the value out of global.c, where set_preference
(global.c:1535+) had given it a copy preference through the merge result's argument copy.
- applicability is checked, never assumed: each consumed variable must be assigned exactly once in every arm by a simple
statement, appear in the merge statement, and occur nowhere else in the function.
- if_chains() counts a line's CLOSING braces before its opening ones. On a `} else if (...) {` line the two net to zero
and the first version's depth counter never closed the arm — the generator found 0 candidates on the very body it was
written from. Caught by running it on that known-true case before believing it.
- ranked third in REG-caller / REG-mixed / COUNT; the engine selftest's "R5 in the first three" assertion widened to
"R5 and R15 in the first four" rather than de-ranking the new move.
- verified: delever --selftest OK (3 new controls: a variable read after the merge, a variable one arm does not set, the
brace walk's three arms); delever_search --selftest OK; and the known-true check — R15 run on func_80156044's
pre-bank text emits the agent's crack and `--try` scores it
`score 0 (OTHER; mine 74 ins, target 74) — MATCH`.
- SETUP row rewritten (R21), kit corpus regenerated, tool_census --check OK (371 copies + 30 pointers, 0 gaps).
- no src/ change in this commit; the sweep of the other 56 head classes follows.
The first agent of the one-at-a-time T7 loop, on the rank-1 head class (130 copies, two NEEDED pins $2/$3). Six mechanical
rung-G runs had been stuck at best 1 on this body; the agent closed it at 0.
- the move is not a dial: the iVar3/puVar2 pair that every arm of the if/else chain set is deleted, and each arm gets the
whole address expression (puVar4 = &D_80192454 + (((u32)param_2) & 0xffff) * 0x14). Two locals fewer than the levered
text — shorter AND byte-identical, which is what this phase is for.
- mechanism, read from gcc 2.7.2's own source and confirmed in the .lreg/.greg dumps: scoping the base into the arm makes
the block hold THREE local quantities instead of two, and block_alloc's unrolled case 3 (local-alloc.c:1491-1496) falls
through into case 2 and applies qty_compare(0,1) a second time, undoing its own exchange — so the $2/$3 assignment flips
(density formula local-alloc.c:1578-1596); deleting the cross-block variable also takes it out of global.c, where
set_preference (global.c:1535+) had given it a copy preference for $5 through puVar4's argument copy, merged by
expand_preferences (global.c:781-825) and overriding first-fit at global.c:1034-1067.
- why the engine could not find it: the u16-width move six runs found is a local optimum that IMITATES the fix by
manufacturing the third quantity while paying an andi. No generator in the registry deletes a variable, so the search
could not leave that basin. That is the toolify target and it follows in its own commit (R16).
- verified before banking (--try: score 0, mine 74 ins, target 74 — MATCH), then
delever --apply-body: ... IDENTICAL on 1 object(s) (0.11 s) — KEPT, ledgered (rung E, a1)
delever --propagate: 129 of 129 sibling(s) banked, 0 refused
check-all: 218 passed, 0 failed of 218
lever_census --check: 30,098 pin/asm sites, 30,098 marked !FAKE, 0 UNMARKED — OK
audit_public: OK — 0 offenders among 11445 tracked paths
- snapshot row 10; the agent's body.c and mechanism.md kept in the pack as the reading behind the generator.
- delever --propagate: 132 + 130 + 131 + 132 siblings banked, 0 refused; each sibling's body is the exemplar's reshaped
text with ITS OWN func_/D_ addresses (the class is "identical modulo addresses", so the two old bodies' tokens
correspond one for one), judged on its own objects before it is kept
- the class key comes from the FIRST bank in a body's chain, not the last: a body that was reshaped and then tidied has
two rows, and the later row's before-hash describes a text only that body ever had (func_80163EC8 found 0 siblings
until this was fixed, then 132)
- R22 clean fleet: `check-all: 218 passed, 0 failed of 218`
- lever_census --check: 33,427 pin/asm sites, 33,427 marked, 0 UNMARKED — 664 sites gone this session (34,091 at S99's
open); lever_progress snapshot "T6 p1"
- delever_permute --bank: 4 winners applied through delever --apply-body, each IDENTICAL on its own object; the winner is
now TIDIED first (pycparser reprints a body it parsed: two-space indent and a corpse `;` where a statement was inlined
away) and the tidy is judged like any other candidate, so the source keeps the tree's shape; parenthesisation and brace
style are deliberately left to the formatting phase, over the whole tree at once
- a slip, named: --bank re-applied a permuter body over the ONE-LINE version rung R had already banked for
func_80135D20; the clean text was restored through the oracle (label d1fix) and --bank now skips any body the ledger
already calls LEVER-FREE
- --recipes is killable now: the oracle writes the candidate into the tree to compile it, so the original goes into
inflight.json first (P35's rule: a tool restores from its own snapshot) — a killed run had left a candidate in src/
- rung R's R6 generalised from "assigned once, read once" to "dead after one read" (the lever rung D actually found:
uVar5 is assigned in two branches and only one was inlined); it still does not reproduce that class's win, which is
recorded as an open item rather than papered over
- lever_census: 33,953 sites (was 33,957), 0 UNMARKED; lever_progress snapshot "T6 d1"; R22 218 passed, 0 failed of 218
The pin/hint removal's COUNT OVER TIME is a deliverable in its own right: the post-100% chart, the story's spine, a wiki
page, and the day-one rule the decomp-architect kit should carry. It is only ever counted by the phase that removes it, so
it has to be captured while the work happens — a census is a moment.
- docs/levers.md: the taxonomy (A pins · B1-B4 barriers/launders/keep-alives/hand-placed instructions · B5 GTE, not a
lever · C volatile · D bare register · E asm-label aliases · F builtins · G attributes); a GENERATED §2; how the levers
got in phase by phase (P18's pin toolkit took the wave close-rate 33% -> 56% -> 90%; the family engine then copied every
lever across up to 134 overlays, which is why 1,758 distinct bodies are 12,578); the ladder with each rung's measured
yield; §5 the prevent-vs-defer argument; §6 what the wiki, the kit and the story each take.
- tools/lever_progress.py: --snapshot appends a milestone row (the census's totals by class + HEAD) to
docs/lever-progress.tsv and re-renders the document; the campaign table is derived from the de-lever ledger on every
render and scored as state TRANSITIONS, so the rung that FINISHES a body gets the credit (counting first-rows-only
reported rung R's 134-body batch as zero); --check refuses a series that is not this tree's.
- the numbers, generated: 21,061 sites removed or rewritten across 17,119 bodies against 33,957 still standing — 38% of
the class A/B population came off with no understanding at all, which is the evidence behind §5's rule:
BAN THE SILENCE, NOT THE LEVER (a lever is allowed and is a marked, ledgered, published debt from the first bank, with a
one-compile bank-time trial; never block the byte gate on it).
- Reference-index row (doc_links OK), SETUP row, tool dictionary row, CURRENT_PHASE entry for the story.
THE INSTRUMENT (R40). Two campaigns returned "0 of 16" with a straight face; both were the harness. The target object had
been assembled from a DISASSEMBLY LISTING, which is a second toolchain with its own answers:
- objdump prints the pseudo-instruction `move` for `addu rX,rY,$zero`; gas assembles `move` as `or` — 24 wrong words in
one 234-instruction function, silently;
- a listing's %hi/%lo pairs come back RESOLVED with no relocation, while every candidate carries one, and the masked
scorer compares reloc operands.
The permuter therefore scored 28 for a body that IS byte-identical: score 0 was unreachable and every NO-MATCH was its own.
- tools/delever_permute.py: the target is now the tree's OWN (levered) body compiled by the build's tail into a
one-function object — the candidates' relocations by construction — and `match_one` must call that body a MATCH against
the ROM listing before the search starts (R34 keeps it from being circular). Base score for the tree's own body: 0.
- tools/p16_permute.py `setup(target_o=)` + tools/permuter_ils.py `--target-o` (defaults unchanged).
- `--positive-control TU FN`: perturb a matching body by one commutative swap, require the permuter back to 0.
- tools/verbatim_target_s.py --gas now VERIFIES itself: assemble, disassemble, compare word by word with the image,
`.word 0x…`-patch what does not reproduce (24 in that function), REFUSE what still disagrees. The listing is a public
artifact (decomp.me) and was wrong for every function containing a `move`.
THE PROFILE. The weight profile now comes from the register a needed pin names, not just the site kind: callee-saved
($16-$23) is an allocation-order residual -> regalloc; caller-saved ($2/$3/$4-$7) is not -> cse. Read from the bytes: the
residual on func_80163EC8 (`register … __asm__("$2")`) is `and v0,v1,v0` against `and v0,v0,v1` — the operand order of one
`&` — and the regalloc profile weights perm_commutative 2.0 while cse weights it 40.0.
RUNG R (tools/delever.py --recipes): the cookbook's byte-neutral shape recipes, mechanically, seeded with the body's
lever-free text — R2 the formerly-pinned declarations permuted, R4 one moved through the whole declaration run, R3 an
initializer split placed after the run (C89), R5 the operand order of one commutative operator (the caller-saved lever, and
the only recipe needing no pinned declaration). Identity control on both the splice and the oracle before any verdict;
markers scrubbed within the banked body's own span only; selftest cases on a fixture whose answers are known by hand.
Also: a threading race in the site cache published the empty dict before filling it and made a whole batch report
"no site in this TU"; the file-scope asm dropper took an asm-LABEL clause for a statement. SETUP + dictionary rows.
- tools/delever_permute.py: one exemplar per RESIDUE text class from the ledger (copies desc, needed asc) prepared as a
single-function TU (delever's rung-A rewrite; other definitions -> prototypes; shared-header includes -> their prototypes;
INCLUDE_ASM and file-scope asm dropped; the build's own CPPFLAGS through cpp -P), the target regenerated from the ROM image in
BOTH forms (--gas for target.o, splat for match_one), permuter_ils with the profile from the NEEDED kinds, a winner banked only
through delever --apply-body + the GTE re-fold. Scratch/winners keyed alias+fn (R48).
- the control (R39/R56, new): every attempt first requires the LEVERED body to be match_one MATCH against the regenerated target,
then records the lever-free body's distance. --calibrate --limit 12: 12 of 12 MATCH; starting distance min 8 / median 78 / max 276.
- delever: ("B","gte-lever") joins REMOVABLE — a direct statement's clobbers reset to its canonical set, a variant-macro use pointed
at the canonical macro whose name comes from the variant definition's SIGNATURE (gte_rt_m -> gte_rtv0tr, not Sony's gte_rt);
462 of 462 gte-lever sites now offered to the ladder, 0 before. gte_consolidate.canonical_match() is the one reader of the
canonical table (R33), direct_rewrite refactored onto it; both selftests green.
- p16_permute.setup(outdir=) + permuter_ils --pd: a scratch dir keyed by the caller, defaults unchanged.
- four harness defects found by running it: the splat listing is not assemblable (R98 in a second place); pycparser rejects
__attribute__ and the permuter then silently permutes nothing; include_asm.h injects a file-scope .include "labels.inc" that
collides with the permuter's own macro.inc; an asm-LABEL clause is not an asm statement (a bare scan ate one and left a headless
K&R body). SETUP row (R21), dictionary row (R87), .gitignore allowlist for the outcomes ledger.
Drew T