Commit Graph

1330 Commits

Author SHA1 Message Date
Drew T eadfa5977d phase-36: S104 checkpoint — d1–d19 all at 0, generators R27–R34, census 4,732 / 0 unmarked (exit 0), R22 218/218; d20–d24 in flight; METHOD step 14 | 🛑 T7 RUNNING 2026-09-10 22:51:40 -06:00
Drew T c48582300c phase-36: S104 R22 check-all 218/218 after d11–d19 + copies; census 4,753 sites, 0 unmarked, exit 0; lever_progress snapshot | 🛑 T7 RUNNING 2026-09-10 22:35:45 -06:00
Drew T d94d993102 phase-36: generators R28 merge_pinned_twins, R29 fold_store_temps, R31 shift_operand_casts, R32 compound_assignments, R33 else_arm_assignments, R34 merge_disjoint_locals — harvested from d1/d5/d8/d12/d13/d14/d15/d19, each run against its agent's start text (R31/R32/R33 reproduce the close, R28/R29 the measured single-move score); METHOD step 13 2026-09-10 22:27:07 -06:00
Drew T 06302b97c2 phase-36: S104 — the census counts a marker on a kept ordinary-C fake (do-while / dead init, Drew's ruling (a)) apart instead of as an orphan; R7 marks its do-while; log: d1–d10 all at 0, R27, the R97 correction for 830650946 | 🛑 T7 RUNNING, census 4,928 / 0 unmarked, exit 0 2026-09-10 21:51:49 -06:00
Drew T 30fd6796f9 phase-36: generator R27 named_ports — the same function lever-free in another binary, ported by pairing the two original objects' relocation sequences (+ carried file-scope externs, the target's return type); wired into delever_regen and recipe_candidates; 511/1,010 residue classes have a donor, a 24-class probe closed 4; METHOD step 12 (S104's landings) 2026-09-10 21:43:05 -06:00
Drew T 830650946c phase-36: S104 R22 check-all 218/218 after the d1–d9 + sweep banks; census 5,097 → 4,963 sites, 0 unmarked; lever_progress snapshot | 🛑 T7 RUNNING 2026-09-10 21:35:39 -06:00
Drew T 7b6418c179 phase-36: the census walker defaults to the tree's cross-file asm-macro table for every out-of-census caller (delever scrub/bank/judge) — S103's scrub false positive on an ENGINE_SHB launder reproduced and fixed; control still finds a real orphan; census unchanged 5,097 / 0 unmarked 2026-09-10 20:54:20 -06:00
Drew T 48176e51ff phase-36: delever_regen forks worker processes after warming the shared caches (threads sat on the GIL with zero compiles) and appends each judged class to <label>.jsonl as it lands; the S104 all-families sweep runs 2026-09-10 20:50:56 -06:00
Drew T b27c987ba9 phase-36: S103 ends — c51 func_8012E364 at two marked pins (134 bodies); 46 orphan markers scrubbed (one scrub false positive restored, the defect recorded); census 5,097 sites, 0 unmarked, exit 0; checkpoint final (R22 218/218) 2026-09-10 19:13:58 -06:00
Drew T 94520756e0 phase-36: the R26 regen closes 28 classes (71 bodies); c55 and c53 close five tier classes; census 5,231 sites, 0 unmarked — exit 1 on 45 orphan !FAKE markers, scrubbed next (R22 218/218) 2026-09-10 19:05:22 -06:00
Drew T baac1f851c phase-36: c56 ports the func_8013D9B0 minimum-lever text to ov_MAIN_012's 7-copy class; c54 ports func_8017B238 (8 bodies) (R22 218/218) 2026-09-10 18:48:23 -06:00
Drew T c02fc7cd55 phase-36: minimum-lever banks — func_8013D9B0 (2 marked GTE asm instead of 34 levers) and func_80140958 (2 marked levers), 266 bodies; c52 closes four ov_SC06_010 classes with the R26 alias (R22 218/218) 2026-09-10 18:44:29 -06:00
Drew T 433aa07018 phase-36: c50 closes func_80136824 with zero levers body-only (off the types-phase list, 130 bodies); c49 func_8013F350 at two marked head levers (133 bodies); delever_regen survives stale sites (R22 218/218) 2026-09-10 18:38:42 -06:00
Drew T aada3bdc2b phase-36: the first minimum-lever bank (func_80177B5C: 1 marked launder instead of 23 levers, 133 bodies); c43/c44/c45/c37 closes with their cross-address copies (delever --port-scan); generator R26 alias_repeated_addresses (known-true: c45's close from its start text) (R22 218/218) 2026-09-10 18:32:46 -06:00
Drew T 8bc06a2cb8 phase-36: T7 agent c42 — func_80186A8C and func_80182058 closed through cross-jump readings (10 bodies); related.txt requires evidence before calling a same-name body a variant (R22 218/218) 2026-09-10 18:17:41 -06:00
Drew T 54311fa359 phase-36: T7 agents c38 + c40 — func_80180EDC, func_8018431C, func_80185DD8, func_80184854 closed (30 bodies) (R22 218/218) 2026-09-10 18:11:17 -06:00
Drew T 321b540e7f phase-36: propagate ignores body-local externs (re-propagation: 97 siblings banked of 145 candidates); R19 cast-arity regen 8 classes; c39 ports two variants; c41, c34, c32 closes; related.txt lists the same function lever-free elsewhere; cc1_dumps_tu.sh -dd (R22 218/218) 2026-09-10 18:07:41 -06:00
Drew T 7d5964b279 phase-36: T7 agents c36 + c35 — four tier classes closed (func_8014305C, func_80141874, func_8017DBE4, func_80185994; 39 bodies); R19 reads the arity a call's own cast asserts (known-true: c35's close from its start text) (R22 218/218) 2026-09-10 17:49:55 -06:00
Drew T dd5e44c247 phase-36: T7 agent c33 — func_80169058 and func_80168D94 closed (per-arm call results, a load born last), 12 bodies; c31 proves func_80178970's pin irreducible in plain C (two passes each delete the copy; the milestone question raised) (R22 218/218) 2026-09-10 17:38:58 -06:00
Drew T a2a1fc1865 phase-36: re-draw c30 — func_8017B614 closed with no do-while (one pointer across both arms; struct/array spellings let sched2 restore the order), 125 bodies (R22 218/218) 2026-09-10 17:32:29 -06:00
Drew T 01f066923d phase-36: re-draw c21 — func_801397B0 closed (a do-while reference-weight wrapper, on the a4/c15 precedent), 125 bodies; c22's and c28's readings (func_8012E364 at 4, func_8013F350's head irreducible); --try parallel-safe per call with --keep (R22 218/218) 2026-09-10 17:14:30 -06:00
Drew T e984e5822f phase-36: re-draws c25 (func_80166F58, a narrowing copy) and c26 (func_80133CD4, split temps) closed, 254 bodies; tools/localalloc_sim.py (c26's local-alloc simulator, 0 mismatches over 150 blocks); propagate no longer trusts stale ledger hashes; R25 regen 3 classes; regen reports COMPILE-ERROR (14,xxx -> 13,083 sites, R22 218/218) 2026-09-10 16:58:01 -06:00
Drew T 96820256ce phase-36: re-draws c24 (func_8012956C: a phantom 4th argument + a switch) and c23 (func_80133784: the exit block inside a real loop, overturning b4's de-loop reading) closed, 252 bodies; R25 trim_arguments; argcheck reads K&R definitions (95 callees were invisible); the selftest asserts every dispatched family is registered (R22 218/218) 2026-09-10 16:45:14 -06:00
Drew T 970d88f386 phase-36: T7 agent c15 — func_80135EB0 closed (one if per case defeats jump2's cross-jump, struct-spelled stores keep the dependence; the register swap via a do-while, banked on the a4 precedent and raised with Drew), 128 bodies (R22 218/218) 2026-09-10 16:03:01 -06:00
Drew T a620e1880f phase-36: generator R24 (the addPrim copy read as a whole word, c20's move) + its regen pass (2 classes, the func_80140D68 header on 140 objects); c13's reading of func_80140958 (43 -> 4, not closed) (R22 218/218) 2026-09-10 15:57:16 -06:00
Drew T 5eb46b267f phase-36: T7 agent c20 — func_8013DD68 closed on a re-draw (the bit-field copy read as a whole word: a phantom flow-time mask reference), 128 bodies (16,273 → 16,015 sites, R22 218/218) 2026-09-10 15:49:51 -06:00
Drew T 9f2b6b24aa phase-36: cc1_dumps_tu.sh takes a .c file and resolves ../shared includes (six agents had written their own dump.sh) 2026-09-10 15:43:03 -06:00
Drew T 750797a048 phase-36: T7 agent c18 — func_80176734 closed (one variable per role across blocks, s16 flag in a nested if, u8 copy), 128 bodies (R22 218/218) 2026-09-10 15:39:50 -06:00
Drew T 164825b5d8 phase-36: delever_regen — R22+R23 re-run over the whole residue closes 17 classes / 22 bodies with no agent; --try learns header TUs (24 classes had never been scorable) (17,715 → 17,692 sites, R22 218/218)
- tools/delever_regen.py: read-only pass (both starting texts, only the named families, delever_search --try --body,
  one worker per class) + --bank (re-score on the current tree, apply_body_core, propagate); dictionary + SETUP rows
- pass 1: 1169 classes in 127 s, 14 MATCH; the 25 UNSCORED read before banking: 24 were header-TU classes whose
  includer's ../shared include never resolved in --try (fixed; controlled: unchanged body 0, lever-free 32, mutated 1),
  1 a body-local #define (R22/R23 now refuse preprocessor lines); pass 2 over header TUs: 104 judged, 3 MATCH
- banked: 14/14 + 3/3 (two shared headers IDENTICAL on 141 objects each); R23 12 classes, R22 5
- check-all 218 passed 0 failed; lever_census 17,692 marked 0 UNMARKED
2026-09-10 15:36:01 -06:00
Drew T a060705725 phase-36: T7 agents c14 + c16 — func_801670E4 (all seven levers; its refuted @stuck note replaced in 136 copies) and func_8013D178 (one pointer per if-group), 261 bodies; R23 widened to one open block and now closes func_8013D178 alone; c9's reading of func_8013CF68 (38 -> 10, not closed) (18,776 → 17,715 sites, R22 218/218) 2026-09-10 15:24:01 -06:00
Drew T 6252516263 phase-36: T7 agent c11 — func_80175AB8 closed (derived-pointer reads, one temp for both $a1 values, a cast-wrapped table read), 124 bodies; cc1_dumps_tu.sh dumps .cse2 and .jump2 (R22 218/218) 2026-09-10 15:15:34 -06:00
Drew T e6a8f35052 phase-36: T7 agents c12 + c10 — the func_80148E54/D44 twins (implicit handler argument) and func_80135A4C (cross-jump tails, parameters passed through), 395 bodies; delever_pack writes related.txt (20,206 → 19,276 sites, R22 218/218)
- c12: c3's reading held on both twins — the angle as the handler's first argument + tmp reused as the later operand;
  the stale 'jalr with no args' comment corrected in the 135 files whose body now passes it
- c10: jump2 cross-jump merged two walk tails (exits now fall to the single final return), the s16 SUBREG gate, and
  func_80135480 called at its real arity; its answer was func_80135888 in another file
- delever_pack related.txt: lever-free bodies in the overlay sharing a func_/D_ symbol, ranked (known-true: top hit for
  func_80135A4C is func_80135888); METHOD_S103 +6 emitter entries; SETUP rows
- apply-body IDENTICAL x3, propagate 131/131 x2 + 133/133; check-all 218 passed 0 failed; lever_census 19,276 marked 0 UNMARKED
2026-09-10 15:03:27 -06:00
Drew T 2e61220bde phase-36: T7 wave c — seven agent closes (c4 c6 c1 c7 c3 c5 c8) + func_8017EEC0's parameter, ~1,000 bodies; generator R23; CI's verbatim_check fixed and wired into tools-health (23,988 → 20,206 sites, R22 218/218)
- closes, each --try 0 then apply-body IDENTICAL + propagate N/N 0 refused: func_80133AB0 (u16 width moves), func_80130D48
  (one call per goto-tail site), func_80135168 (reused temps split + H16 member store), func_80134A74 (widths + join
  statement in both arms), func_80148AFC (implicit handler argument + later operand), func_8015D738 (jump threading:
  re-read + a do-while on precedent, the class raised with Drew), func_80135004 (temp split + argument from its global)
- func_8017EEC0: the uninitialised a0v T4 tus10 left is the parameter (8/8, IDENTICAL)
- CI red since cb2fb5e6d: verbatim_check --strict saw the DECOMPILE-NOW row func_8017EEC0 converted; row removed (one
  row), --update keeps order + UTF-8 (proven equal to the hand fix), verbatim_check --strict now in make tools-health
- delever.split_reused_locals = family R23 (selftest + two refusals; known-true: joint split = the agents' measured 12/26)
- check-all 218 passed 0 failed (twice); lever_census 20,206 marked 0 UNMARKED; Drew: at most five concurrent agents
2026-09-10 14:56:17 -06:00
Drew T 205331765f phase-36: T7 agent c2 — func_8013D8FC closed (the walked-pointer merge), 131 bodies; harvested as generator R22 (24,119 → 23,988 sites, R22 218/218)
- agent c2 (Opus): a second pointer q = p + 5 stepped in lockstep with p kept a second biv alive (loop.c strength
  reduction, -dL 'Cannot eliminate biv'); one pointer lets combine_givs fold every field read onto one base
- bank: apply-body IDENTICAL, propagate 130/130, check-all 218 passed 0 failed, lever_census 23,988 marked 0 UNMARKED
- delever.merge_walked_pointers = family R22 (selftest + two refusal controls; known-true: the agent's start text's
  candidate is its closing body, --try score 0); leads the COUNT class after R19 in delever_search; SETUP row
- S103 opening: the method addendum .run/P36/agents/METHOD_S103.md; wave c launched (six agents); Fable out of credits,
  c5/c6 relaunched on Opus
2026-09-10 14:30:30 -06:00
Drew T 82da34b392 phase-36: the S102 checkpoint — the session's method, every new tool documented, and what the next session must not rediscover
30,358 -> 24,119 lever sites (-6,239) in 6,317 bodies; 22 agents across two waves (14 closed, 8 read without closing);
generators R15-R21 added, each with a selftest and a known-true check against the body it was harvested from; 16,759
lying call declarations repaired free across 3,439 units; check-all: 218 passed, 0 failed of 218 at every step.

- docs/SETUP.md gains section P36 S102: the generator table R15-R21 naming the body each came from, the call-signature
  tools, the baseline snapshot that makes the fleet gate and the agents independent, the repaired dump tools, and the
  packs. Every tool has a tool_dictionary row; tool_census --check and doc_links --strict are green.
- the checkpoint carries the operating procedure (the agent lane is the main lane and is never empty; only one writer;
  reconciliation after a killed run), the method that closed 14 of 22 bodies in order, the exact invocations, the
  gotchas that cost something, and the open items by name.
- the three JOINT generators are called out as such: R20, R21 and b7's four-way retype all win only as a single edit
  whose every intermediate step scores WORSE than the start, so a beam that composes one move at a time walks away from
  them. Generate the joint candidate; do not trust the search.
- two refusals recorded as standing practice: an invented identically-zero term is not banked (R20 closed that body
  honestly hours later), and a body whose improvements are compensating errors is reported rather than banked.
2026-09-10 14:07:32 -06:00
Drew T 8a22254bfc phase-36: wave b close — the census and the series brought to this tree (24,119 sites, fleet 218/218) 2026-09-10 13:54:25 -06:00
Drew T d30ccc9a72 phase-36: T7 agent b8 — func_80135888, the largest class left, closed with all five levers gone (134 bodies; 24,789 → 24,119 sites, R22 218/218)
check-all: 218 passed, 0 failed of 218
  lever_census --check: 24,119 pin/asm sites, 24,119 marked !FAKE, 0 UNMARKED — OK

Three moves, each predicted from a dump before it was compiled:
- while -> a guarded do-while (29 to 22). Cross-jump (jump.c:1969 -> find_cross_jump :2371, from toplev.c:3142) had
  matched the load in front of the jump against the one in front of the bottom test and deleted three instructions; the
  guarded form makes the two tails differ.
- the duplicated pre-loop call block -> goto (22 to 6). This is an allocno_compare rank move (global.c:585-611): the
  priority is floor_log2(refs)*refs/live, reg_n_refs is loop-weighted (flow.c:2067), the in-loop copy of that call is
  worth two references, and deleting the out-of-loop copy takes exactly one off — 8 to 7 crosses a floor_log2 step and
  drops the pointer's priority from 3157.9 to 1891.9. The predicted allocation order matched the dump exactly. The
  rewrite is byte-neutral on its own: reorg steals the target's first insn into the delay slot and retargets.
- the two-arm mask temp inlined (6 to 0): set in two arms it has two deaths, fails local-alloc.c:472, and combine_regs
  bails at :1774, so it went to global allocation and took its copy preference.

Harvested as R21 second_consumer, from agents b2 and b6 together: give a computed value a second consumer before its
copy, either by chaining (v = slot = E) or by hoisting the store above it. cse deletes such a copy only when the
producer sits immediately before it (cse.c:7440-7501, guard :7454-7460), and flow links only the FIRST following use
(flow.c:2076-2091), so a store in between defeats both. R9 can never produce it — the two statements share the
identifier, so its independence guard refuses the swap. Known-true: the joint form scores 0 on b6's pre-bank text, and
the single-site forms do not, which is the third measured case this session of a joint edit no hill-climb can reach.

Also recorded from b8, worth a pre-check later: declaration-order moves are PROVABLY DEAD on a register residual whose
allocnos have distinct priorities, because global.c:604-610 compares priority first and only ties by allocno number —
4,811 compiles of those candidates sat flat because of it.
2026-09-10 13:31:47 -06:00
Drew T 0d92d10299 phase-36: T7 agent b7 — func_80166690 closed from a residual of 41 (126 bodies; 24,915 → 24,789 sites)
- the moves: retype four accumulators int -> short in ONE edit, delete the five hand temps that were spelling the
  truncation, and type the colour temp to its destination field's own width (u8). Measured A/B/C on bytes: unsigned int
  34, short 1, unsigned short 1, u8 0.
- mechanism: all four missing instructions were the same one — a move after an addiu whose result is re-read through a
  16-bit shift. A narrowing assignment expands to a mode-changing copy, and combine_regs ties source into destination
  only when the source DIES there (local-alloc.c:1855, return 0 at :1881); the wide temp is still live in the following
  sign-extended test, so the copy survives. At int the copy is same-mode, the source dies, the tie happens, and combine
  then re-selects the whole counter into the pre-shifted domain. The last instruction is cse's mode gate in insert_regs
  (cse.c:1019-1021, :1029-1032).
- it confirms R20's shape and refines it: the group retype must be keyed on the residual's missing-move SET, since R12
  is per-declarator and its single moves topped out at 24 here — a hill-climb cannot reach a four-way retype.
- delever_pack.py was missing an import for the neighbours block added an hour ago, so two packs shipped without
  neighbours.txt and both agents said so. Fixed; all 34 packs now carry it.
- method note from the agent, now in the briefs: dump the target function WHOLE off the tree's own object rather than
  reading the residual's hunks — the hunk view had scrambled two moves into branch delay slots and hid that four
  differences were one repeated shape.
2026-09-10 13:17:56 -06:00
Drew T 17d192d243 phase-36: T7 wave b — four agent closes plus the engine's own two (766 bodies; 26,074 → 24,915 sites, R22 218/218)
check-all: 218 passed, 0 failed of 218
  lever_census --check: 24,915 pin/asm sites, 24,915 marked !FAKE, 0 UNMARKED — OK

- b2 func_80162438 (127 bodies): hoist the store above the assignment and store the EXPRESSION, so the temp falls out.
  cse's 'REG0 is the cheapest' rewrite (cse.c:7440-7501, guarded :7454-7460) deletes a copy only when the insn
  immediately before it set the source; putting a USE between compute and copy defeats that and flow's LOG_LINK, which
  goes only to the first following use (flow.c:2076-2091), so combine is never offered the pair.
- b6 func_80161E08 (127 bodies): the same three blocks written as a CHAINED assignment, p = slot = base + K. The value
  gains a second consumer, flow's only link goes to the store, and the copy survives — the instruction the pin faked.
- b5 func_80145934 + its sibling func_80145A2C (126 + 126 bodies): a body-local symbol ALIAS. Cross-jump's equality test
  compares symbol names by POINTER (jump.c:2440), so two arms referencing one extern merge; an asm-label alias makes the
  identifier distinct, the blocks survive, and assemble_name strips the star so the bytes and relocations are unchanged.
  The barrier it replaces was standing in for symbol identity, not for ordering or liveness.
- the engine banked two of its own while the agents worked: R20 closed func_80139BE0 (129 bodies) by chain-narrowing —
  the body agent a14 could only reach with an INVENTED identically-zero term, which I refused. The refusal was right and
  the honest close arrived hours later from the generator.
- R19 closed func_8017A3D8's ov_SC07_006 copy (16 bodies) by restoring a dropped argument.

Two things to act on, both reported by agents:
- 'a @stuck: note claiming a lever is required should be re-tested, not trusted' — two such notes were refuted on bytes
  today ('natural C ALWAYS coalesces that copy', 'no pure-C spelling survives that fold').
- one pack lacked neighbours.txt because the packs predate that change; the next --build carries it.
2026-09-10 13:12:08 -06:00
Drew T 9d78fc4085 phase-36: T7 agent b3 — func_8016CBC0 closed from a residual of 55 (128 bodies), and its move toolified as R20
- the move: narrow every local in the counter's def-use chain together — the counter, its +/-1 temp and the copy-back —
  and do it for BOTH chains at once. Four instructions were MISSING, not miscoloured, three of them the moves the $0 pin
  was faking. insert_regs (cse.c:1029-1032, early bail :1018-1020) puts two pseudos in one equivalence class only when
  their MODES match, so an all-int copy-back is collapsed and swept, while the narrowed one is a truncation: no
  equivalence, the wide temp stays live and reaches reload as the move the target has. The fourth instruction is
  strength_reduce minting a shift giv from a wide counter whose every use is a cast; a HImode pseudo cannot be that giv.
  delever --propagate: 127 of 127 sibling(s) banked, 0 refused. 26,202 -> the census below.

- R20 narrow_chains: the agent PROVED the joint form is necessary, and the generator reproduces it. Single declarations
  scored 45/72/51/24, each chain alone 43, both chains together 0 — every intermediate worse than the search's own best
  of 11, so a beam over R12's one-declaration width moves cannot reach the answer from either side. Seven runs and 4,811
  compiles stalled at 11; R20 offers six candidates and the right one is a single compile.
- known-true check: run on b3's pre-bank text, R20's joint signed candidate scores 0 (MATCH) and its single-chain
  candidates score 43 and 51 — the agent's own hand-measured numbers, reproduced by the tool.
- chains are built conservatively from the body's text (two locals linked when one is assigned from the other, through a
  cast or a +/- constant), and only whole components are offered, so the partial narrowings the measurement showed are
  always worse are never generated. Selftest: the chain is found whole, an unlinked local is not pulled in, and a body
  with no linked pair offers nothing.
2026-09-10 12:57:06 -06:00
Drew T acba5c59df phase-36: T7 agent b1 — func_801651B8 closed on its FIRST try (127 bodies), and its lesson made part of every pack
- the move: delete the hand-walked pointer's self-increment and recompute p = &tbl[i] from the loop counter each
  iteration. The lever-free body had TWO induction variables — the loop dump says 'Cannot eliminate biv 73: biv used in
  insn 50' (loop.c:5976) because the pointer is itself a call argument — and combine_givs (loop.c:5494/:5527) then
  merged the three +12 field addresses into one giv whose benefit clears the not-worth-while gate at loop.c:3822-3828,
  reducing it to a THIRD walking register and forcing a fourth callee-saved one: the +4 instructions and the whole
  recolouring. Indexing instead leaves one biv, the +12 rides as an immediate, and the body is byte-identical.
  delever --propagate: 126 of 126 sibling(s) banked, 0 refused. 26,456 -> 26,202 sites.

- THE HEADLINE IS THE METHOD, not the crack: the answer was written in English thirty lines above, in the // @class:
  header of an already-matched sibling in the same file, which spells out 'recompute p = &D[i] each iteration (NOT p++)
  so gcc reduces base+i*0x10 into a SINGLE pointer IV'. The pack sent agents to the cookbook and to the compiler source
  and never to the target's own neighbours. This project has been leaving itself notes for months and nobody was reading
  them.
- delever_pack.py now writes PACK/neighbours.txt — the comment headers of the three matched functions either side of the
  target, plus every @class/@stuck/@crack note in the translation unit — and the brief makes reading it step 0.
2026-09-10 12:49:36 -06:00
Drew T dd744df53e phase-36: track readability_progress.py (the census's second oracle caught it untracked, R34)
tool_census's two enumerations disagreed on one file: the new tool was written but never added, so the dictionary row
existed for a path git did not carry. That is exactly the disagreement the second oracle is there to find.
2026-09-10 12:12:18 -06:00
Drew T 69d83f7b61 phase-36: 16,759 lying call declarations repaired across 3,439 units, byte-identical (R22 218/218) + the Gen3 readability series
Drew: we do want C correctness on all funcs, and log it for the story and the chart.

- decl_repair --apply rewrote 3,439 units and repaired 16,759 declarations. check-all: 218 passed, 0 failed of 218.
  lever_census --check: 26,456 pin/asm sites, 0 UNMARKED — unchanged, as expected: this pass fixed TRUTH, not levers.
- only the free set was touched: a declaration is repaired when every call to that function in the unit already passes
  the arguments, so the code was right and only the promise was wrong. Calls that pass too few remain R19's population,
  where the argument must be chosen and the bytes decide.
- tools/readability_progress.py: the Gen3 series beside docs/levers.md, because levers are only one way the source is
  untrue. It counts lying call declarations (split by the K&R-empty and (void) forms, and how many sit in a body still
  holding an argument-register pin) and raw cast dereferences against struct member reads — the struct debt. Each row
  carries its date and commit so the chart is generated, never typed (R75). docs/readability.md renders it.
  First row after the repair: 94,001 lying declarations over 1,564 callees (86,701 (), 7,300 (void)), 461 in 314 pinned
  bodies; 414,148 raw cast dereferences against 173,286 struct member reads.
- dictionary rows for decl_repair and readability_progress; kit corpus regenerated; tool_census --check OK.
2026-09-10 12:11:22 -06:00
Drew T 51028a78d3 phase-36: R19's first sweep (3 classes closed in 2 compiles each) and the declaration scan rebuilt after its control failed
search: 3 of 55 exemplars matched lever-free in 0.33 h (3 of 730 bodies behind them; 12,034 compiles) — NO-MATCH 51 · MATCH 3 · UNSCORED 1
  check-all: 218 passed, 0 failed of 218
  lever_census --check: 26,456 pin/asm sites, 26,456 marked !FAKE, 0 UNMARKED — OK

Every one of the three closes is R19 restoring a dropped call argument, each at depth 1 in two compiles — the class that
seven earlier runs and thousands of compiles could not touch.

THE DECLARATION SCAN, AND THE INSTRUMENT FAILURE IT TOOK TWO TRIES TO SEE (R39/R40):
- first framing: widen every lying declaration and leave the call sites alone. That is not a repair — a prototype
  demanding an argument the call does not pass is a hard error — so 1,766 of the first 3,250 units failed to compile BY
  CONSTRUCTION and none was identical. A measurement that cannot come out any other way is not a measurement. The tool
  now only repairs a declaration when every call to it in that unit ALREADY passes the arguments; calls that pass too
  few are R19's population, where the argument must be chosen and the bytes decide.
- second failure, worse because it looked like a finding: the corrected scan still returned 0 free of 3,634 units. The
  negative control I had not run — compile the UNCHANGED text through the same path — came back DIFFERENT by 9,176
  bytes, because the candidate is built from a scratch copy and the object records its own source filename. Comparing
  only .text/.rodata/.data removes the path, and the control then matches exactly. The control is now part of every
  unit's judgement rather than something I remember to run.
- the corrected result: 3,414 units / 16,732 declarations are FREE to repair (byte-identical with the declarations made
  honest), only 2 units / 3 declarations actually depend on the false declaration, 117 compile errors and 101 units
  whose control failed and are therefore reported as harness failures, not results.
- scope limit stated: declarations inside src/shared headers are not units with recipes and were not tested here.
2026-09-10 11:36:56 -06:00
Drew T f3de70fce5 phase-36: R19 — the argument-restore generator: call signatures become engine work, not agent work
Six T7 agents independently reached score 0 by restoring an argument the decompiled source had dropped, and no generator
could reach the class because every other family rewrites statements that exist while this changes a call's ARITY. R19
closes that gap without cracking anything: it finds every call whose in-scope declaration is narrower than the callee's
real definition, then offers one candidate per value already in scope (each parameter, each local declared before the
call) and lets the byte oracle pick. The missing argument is never inferred.

- known-true check: run on the pre-bank text of func_8017A3D8, which agent a12 solved by hand, R19 emits that agent's
  exact fix and --try scores it 0 (OTHER; mine 53 ins, target 53) — MATCH.
- two spellings were wrong before that passed. It took the return type from the DEFINITION and produced
  ((void (*)(s32))f)(a) != 0, which cannot compile because the defining TU says void where this one says int — it now
  repairs the arity only and keeps the TU's declared return type. And it required a simple statement, so it found
  nothing on the very body it was written from: these calls live in  and  far more often
  than in a plain statement.
- it also sees the cast-wrapped form ((s32 (*)(void))f)(), which is how m2c usually spells a dropped argument, and
  replaces the whole wrapper rather than nesting a second cast.
- ranked FIRST in every residual class: it emits candidates only for calls whose declaration provably disagrees with the
  definition, so it costs nothing when it does not apply. The engine selftest's ordering invariant is updated to say so
  rather than being widened again.
- argcheck now carries each definition's return type, which the cast route needs.
- selftest: two positive assertions and two controls (the declared return type is kept; the definition's is refused; a
  call inside a return statement is seen; a matching declaration offers nothing).
2026-09-10 11:13:34 -06:00
Drew T fc7d8c4019 phase-36: T7 burst — a22 banked (126 bodies), a14 refused as an invented zero term, and the struct question answered on the record
- a22: func_8017B238 closed by giving the if-arm's pointer and the else arm's first table address one function-scope
  local. Three decisions turn on that edit, all dump-proven: make_regs_eqv's head rule (cse.c:840-857), set_preference
  stripping one RTX level so an arithmetic set inherits its operand's register (global.c:1535), and combine_regs with
  birthing_insn_p's reg_n_sets == 1 (local-alloc.c:1765-1788, sched.c:2469) — which is why the merge must be with the
  else arm's non-call-crossing temp. 26,714 -> 26,462 sites.
- a14 reaches score 0 on func_80139BE0 but only by an INVENTED identically-zero term whose sole purpose is to keep a
  value live. NOT BANKED: an invented no-op expression is a compiler-forcing construct in C clothing, and worse than the
  marked launder it replaces because the launder is counted and this would be silent. The phase's own rule is ban the
  silence, not the lever. Parked for the structs/types phase with its reading; the tree comment above it ('no pure-C
  spelling survives that fold') is refuted.
- a6 corrects cookbook 455: cse1 (cse.c:7439-7502) rewrites the producer's destination to the copy's whenever the
  producer is the immediately preceding insn; combine only finishes the job once that adjacency is broken. It enumerated
  the three lever-free blockers can_combine_p admits and showed the body can pay for none, then scanned all 4,284 built
  objects for the shape — 101 hits, every lever-free precedent paying with a genuine second use, a narrow local with two
  consumers, or a join label.
- a24's residual was one absent load: cse forwards a just-stored halfword so no lh is emitted, and seven branch
  displacement mismatches were downstream of it. Its method gap is the instrument to fix next — three agents have now
  asked for local-alloc's quantity table in the pack, and alloc_table.py prints an empty or one-row table because it
  keys on dump lines that are often absent.
- Drew's struct question answered on the record: structs are not in the binary (types are erased; no metadata in a
  retail build), what is there is base + offset + width + stride, so a struct is an inference across every function
  touching a base — which makes per-function struct invention the wrong unit and is the failure P35 already recorded.
  Recommendation: keep pins as the main lane, build a zero-token struct evidence census beside it, park stuck pins with
  their evidence, and fix call signatures first because they are the bigger and cheaper blocker (471 narrow call sites
  in 323 pinned bodies). Measured: 372,224 raw cast dereferences against 92,624 struct member accesses.
2026-09-10 11:02:14 -06:00
Drew T 374c8a0e97 phase-36: apply the R14 premise correction that the previous commit's message claimed but did not contain
The edit in 161d36cf3 failed its match assertion while the commit went through, so that message over-claimed: it said
R14's documented premise was corrected and the file was unchanged. Naming it here rather than quietly fixing it (R66 —
write 'done' only from the tool's own success line; the assertion had printed a traceback and I committed anyway).

The correction itself, byte-proven by agent a15 on func_80166F58: MIPS in gcc 2.7.2 defines only PROMOTE_PROTOTYPES and
not PROMOTE_MODE (config/mips/mips.h:1153), so a narrowed parameter stays a HImode pseudo and the extension still happens
at the use — the prototyped narrow form, the wide form and the K&R form all give the same 67-instruction merged output.
R14's banked closes stand on their bytes rather than on that rationale.
2026-09-10 10:54:31 -06:00
Drew T 3464a25cd0 phase-36: T7 burst — five more banks (631 bodies) and two concurrency defects the agents found
Banked: func_80136334 (126, all four levers), func_8016B234 (129), func_8015FBE0 (125), func_80143D28 (131),
func_8014D820 (126 of 128). 27,984 -> 26,714 sites.
  lever_census --check: 26,714 pin/asm sites, 26,714 marked !FAKE, 0 UNMARKED — OK

THE MISSING CALL ARGUMENT CLASS IS NOW CONFIRMED SIX TIMES, independently, by six agents that never saw each other's
work: a7, a8, a11, a12, a13, a25. In every case the source declares a call with fewer arguments than the callee really
takes — m2c drops arguments at unprototyped and indirect call sites — and the register pin was hired to fake the
instruction the missing argument would have produced. Mechanisms differ and were each proven on bytes: combine.c:1458's
added_sets_2 gate; set_preference (global.c:1535/1589) applied ahead of first-fit at :997-1030, the argument copy
degenerating to a self-move deleted at toplev.c:3142 / jump.c:424-443 so it costs zero instructions; and reorg.c:3374's
liveness half, where restoring the argument adds a use to CALL_INSN_FUNCTION_USAGE (reorg.c:428) so a delay-slot steal
is refused. No generator can reach any of it: every family rewrites statements and declarations, none edits a call's
argument list.

Two concurrency defects, both found by agents rather than by me:
- the includers cache wrote through a FIXED temp name, so concurrent processes clobbered each other's os.replace and the
  loser saw FileNotFoundError, which reads like a compiler crash on the candidate. Now a unique tempfile per process.
- the agent brief now mandates PACK/scratch/ for helper scripts and dumps, and says to retry once when a --try failure
  names something that is not your own text. Three agents had scripts overwritten mid-run by another agent.

One valuable negative: func_80178970 does not close, and the agent proved why by construction rather than by exhaustion
— only a call or a return writes $v0 in plain C, and a return's hard write is always emitted after its guarding branch,
so combine deletes the call-result copy (combine.c:914-917, use_crosses_set_p at :10127-10130; the SMALL_REGISTER_CLASSES
arm at :944-957 is not defined for MIPS). Its early-return rewrite still improves the source from 6 to 2 and reads
better than the pinned original.
2026-09-10 10:46:06 -06:00
Drew T c6b380fcd0 phase-36: T7 burst — 503 more bodies banked, and the per-file scratch-object collision fixed at its cause
The scorer named its scratch object after the FILE (compile_obj tag="score"), so the nine burst agents sharing one
translation unit wrote and read one object. Two reported it independently without seeing the code: spurious
COMPILE-ERRORs naming an unrelated header, and one agent scoring four candidates against another agent's function. The
tag is now per function. Every landed body was re-verified after the fix and all still score 0; the banks were never at
risk, the agents' intermediate readings were.

- banked: func_801627E8 (132), func_8017A3D8 (118), func_80141874 (119 of 125), func_801345F8 (134). 28,887 -> 27,984.
  lever_census --check: 27,984 pin/asm sites, 27,984 marked !FAKE, 0 UNMARKED — OK
- THE FINDING: the biggest lever class in this phase is a WRONG DECLARATION, not codegen. Four agents independently
  reached score 0 by restoring a call's real arity, each in a different spelling — a function-pointer cast, a widened
  block-scope prototype, a call given its argument, and a definition given its two parameters. The mechanisms differ
  (combine.c:1458's added_sets_2 gate; set_preference global.c:1589 ahead of first-fit at :1001-1015, the argument copy
  becoming a self-move deleted at toplev.c:3142 so it costs zero instructions; assign_parms' parameter home copies) but
  the class is one: a truncated (void) declaration removes an instruction the pin was then hired to fake. No generator
  can reach it — every generator rewrites statements that exist, and this changes a call's arity.
- func_80157D20 does not bank body-only (gcc rejects a block-scope redeclaration), so its Path A joins func_80136824 and
  func_80168828 as the third measured case for the types phase.
- two more new classes, byte-proven: a store sinking past a load because true_dependence's exception (sched.c:837-839)
  discards the edge, fixed by declaring the global an array and storing through [0] to set MEM_IN_STRUCT_P; and a
  post-decrement queued by expand_increment until the next sequence point, fixed by splitting the statement plus a u16
  destination cse refuses to join (cse.c:1017-1019).
- correction to record: an uninitialised register __asm__("$0") is an opaque operand, not a constant holder — R16 must
  refuse it.
- snapshot row 20.
2026-09-10 10:38:24 -06:00
Drew T fb6c857f7c phase-36: the build/ coupling fixed (a baseline snapshot the fleet gate cannot wipe) + T7 agent a4 — func_8016C49C closed by one do-while on the last statement (126 bodies)
Drew: fix the build issue so agents' effort doesn't get wiped, this needs to be parallelizable.

- every score compares a candidate with the fleet run's object under build/, and the R22 gate starts with make clean,
  which deletes exactly that. With agents scoring in parallel, a fleet gate would make every live --try compare against a
  missing or half-written baseline and report nonsense in the agent's own voice.
- fixed at the single accessor: delever_oracle.baseline_path(obj) returns the snapshot under .run/P36/delever/baseline/
  when it holds the object and falls back to build/ when it does not, so nothing silently scores against half a snapshot.
  baseline_bytes and both direct readers in delever_search.py go through it. --snapshot-baseline refreshes it:
  7,428 objects, 188 MB, taken at 9f5b22176. Valid until the fleet stops being green: the baseline is the original game's
  bytes and a bank is byte-identical by construction.
- known-true test both ways: func_800123F0 in src/800.c scores 0 MATCH with build/src/800.o present; the object was moved
  away and it scores 0 MATCH unchanged; restored.
- a4: func_8016C49C from a seed of 34 to score 0 by one move — do { param_1[1] = sVar1; } while (0); on the function's
  LAST statement. The residual was a single qsort comparison in global_alloc lost by 142 units out of 6666 (global.c:546
  sort, :587 priority, :904 first-fit). reg_n_refs is loop-weighted and computed before combine and sched, so the
  reference inside the do-while is counted twice (flow.c:434, :440-443, :2067/:2501/:2711): refs 23->24, priority
  6524->6808 > 6666, the order flips and all 34 words fall into place. A plain block at the same site still scores 34,
  which proves it is the loop notes and not the scope.
  delever --propagate: 125 of 125 sibling(s) banked, 0 refused
  lever_census --check: 28,887 pin/asm sites, 28,887 marked !FAKE, 0 UNMARKED — OK
- two instrument findings to act on: the candidate ranking buried the winning move at 438 of 439 so --cap 48 discarded it
  in six runs (~4,300 compiles), and history.txt's 'R15 sink @2777 -> 1' is not reproducible (the generator's own text
  scores 40) — to be checked against the bytes before either is trusted.
- snapshot row 19.
2026-09-10 10:30:38 -06:00