- cookbook §28: the 4-way triage of a close=0 gate-rejected giant (pure-extern plumbing /
masked-residual / struct-walled / regressed-draft) + the canonical-extern recovery (the NEW
lever that banked func_8015126C, which Phase-21 left as a close=0 wall) + the coalescing pin
(register __asm__ + lazy in-&& assign). §28a: PS1-applicable decomp.wiki GCC patterns
(negative-offset loops, branch-duplication, load-coalescing, div-magic table, slti-0)
- tools/recover_giant.py: canonicalize a draft's engine_core.h-callee externs to def-sigs +
move all externs block-scope (validated func_8015126C -> MATCH)
- R14: close=0-giant fan-out NOT uniformly near-free — only func_8015126C was pure-extern;
the rest are struct-walled / masked-residual / regressed -> genuine per-giant hand-work
Drew chose deep re-RE of func_8014EA4C's real frame. Finding: the frame is a DEAD aggregate
copy (8 bytes unaligned-copied to sp+0x20, never read; gcc-2.7.2 keeps it, no DSE). The agent's
buf[16]+memcpy(buf+16) PRECISELY reproduces the exact gcc stack layout (local[0x38] -> frame
0x88, wrong). So the frame is already correct at close=6; the 6 residuals are NOT frame-caused
-- they're loop-body scheduler (global-store vs call-arg-load order) + regalloc (abs vs
in-place ), the irreducible §20/§25 wall. Deep frame-RE is a dead end for schedule/regalloc
residuals -- only the permuter explores that space. 5 levers (cheap-recovery, permuter,
giant-wave, hand-finish, deep-RE) byte-proven exhausted at fleet 63.17% for the reach-134 tail.
Hand-finish attempt on func_8014EA4C (close=6, Drew's choice): 2 byte-proven attempts both
cascaded — q0_arg reorder swapped p/q regalloc (6->123); abs-ternary dropped the load-bearing
dead buf[16] frame hack -> frame 0x60->0x58 -> offset cascade (6->23). Confirms the agent: the
residuals (store/load schedule + abs regalloc) are pressure-locked by the frame-forcing hack;
C-steering breaks the frame. The fix is the decomp-permuter (grinder), not C — it explores the
frame-preserving regalloc/schedule space. Grinder is now auto-permuting func_8014EA4C +
func_80144090 (re-logged close=6/25, token-free). cookbook §27.
- 6-giant worker_wave (1.16M tokens) BANKED 0. Agents got the SHAPE (§27 recipe works) but the
whole-binary byte-gate (G3/P9) rejected all 6. func_8014F74C close=0 match_one MATCH yet its RAW
draft FAILS the byte-gate (no plumbing/data conflict) -> match_one OVER-predicted (§25 masked
residual). The rest are pure regalloc/scheduling 'not C-steerable -> permuter' (close 6/25/53/91/164).
- Confirms cont.2/Phase-20/Phase-16: giants are HAND-FINISH/permuter fuel, NOT auto-bankable.
cookbook §27 updated. Do NOT scale giant auto-waves for % (1.16M tokens -> 0 banks).
- GATE BUG (R16, noted): canon/cast/sig_unify regressed near-misses (func_8014EA4C 6->128) and
poisoned the backlog. Re-logged the 6 with TRUE closeness + raw drafts (source=giant-raw);
func_8014EA4C(6)+func_80144090(25) now grinder-eligible (token-free).
- INFLECTION (P9): the automated reach-134 harvest is COMPLETE at 63.17% — cheap recovery (0 fresh),
permuter (~0), giant wave (0/6) all exhausted. Forward % = hand-finishing or close Phase 21.
- R14: sig_image h_exact = SHA1(raw IMAGE bytes), UNMASKED (sig_image.py:170-171) -> reach is
the ACCURATE shipped-byte reach; a resolved-reach probe just reproduces it. The real gap is
reach (shipped identical) >= realizable-x134 (shared-C reproduces all N), measurable ONLY by
dedup_propagate's byte-gate on a MATCHED fn. No cheap static probe -> cont.7 'build it' WITHDRAWN.
- R14: func_801775E0 backlog close=1 but saved draft compiles 31-off from source (prologue
save-scheduling/branch-sense/block-order, the S20 wall) -> close=1 was permuter-achieved.
RULE (S26): match_one a draft for SOURCE closeness before assuming a pin crack. The close-1..4
codegen tail is permuter-class (grinder territory), not cheap pin targets.
- INFLECTION (P9): the cached reach-134 automated harvest is COMPLETE; forward %-progress needs
a token-heavy lever (8 giants / per-fn pin-cracking) -> Drew's ROI greenlight. cookbook S26.
- THE FINDING (R14/P9): the _a close=0 recovery banks 0/20 (same def-side multi-way
loose-typing wall as MAIN 0/40, cont.6). cont.6's func_8012F568 was the lone simple-arity
win; the rest need a C type that conflicts caller-decl-vs-def with no single fitting sig.
The cheap close=0 ×134 recovery lever is EXHAUSTED.
- TOOLING (R16, idiom_loop.py --assess was DOUBLY inflated, now fixed):
(1) load_backlog drops banked-since-logged fns (intersect ledger w/ live INCLUDE_ASM stub
set, mirrors backlog._matched_now) -> killed the bogus 'unknown 14' class + ~10/class
stale-matched inflation (schedule 49->39 r134, regalloc 44->39).
(2) DETERMINISTIC-RECOVERY splits FRESH (never recovery-gated = genuine fuel) vs WALLED
(recovery-failed = def-side wall, do NOT re-run). Post-fix: 0 FRESH / 46 WALLED.
- schedule wave NOT fired (ROI-gate, S20/S26): ~50% x134 fraction on n=2, median 15 ins off,
over an h_exact-inflated count. No tokens spent speculatively.
- cont.6 option-3 CONFIRMED: cached reach-134 cheap fuel is dry; the genuine levers are
token-heavy fresh-session work (the 8 giants / per-fn pin-cracking / build a resolved-reach
probe). cookbook S26. 0 banks; fleet 63.17% unchanged; 136/136 byte-identical; 0 NON_MATCHING.
- dedup_propagate split-aware: overlay_files() handles ov_SC01_077's Phase-19 split (main + _a/_o0);
source-find scans all, member-loop edits the right file, structural-check spans all. Single-file
overlays unchanged (default path). Validated: source-find (--check-only 134 members) + fail-closed revert.
- cast_call_sites --src-file: canonicalize callee decls against the file the draft lands in (cross-file
loose typing — a callee declared differently in main vs _a.c). Default = main, unchanged.
- FINDING (cookbook §24): the fresh reach-134 fuel (66+ fns) is in ov_SC01_077_a.c (a tooling gap, not
difficulty); bodies are matchable (func_8012C098 cast-banked) BUT matching/propagation hits the same
§16/§20 loose-typing wall (func_8012C098 cross-overlay def-conflict -> x1; func_8012F274 within-_a
RotTransSV multi-sig). x134 yield uncertain -> a small measurement wave is the next probe.
- no net banks this turn; fleet 62.31% unchanged; ov_SC01_077 verified d19c9580 (R22). sig_unify reverted.
- SELF-CORRECTION: a per-fn objdump diff that didn't remove .o/.elf reported 10 FALSE giant
byte-MATCHes (the §20 stale-.o trap). The real gate (harvest_verify, removes output) banks 0/10:
the MAIN giants' prior-wave drafts are STALE+INCOMPLETE vs the grown engine_core.h (conflicting/
undeclared data decls, link errors). They need RE-DRAFTING fresh, not a recovery transform.
- fixed .run/diag_funcdiff.py to os.remove artifacts first (gitignored tool); the whole-binary SHA
gate is the sole arbiter (G3/P9) — it was right while the diag lied.
- cookbook §23 rewritten: func_80153E00 (cracked, scalar-data CAST) stands; the 'giants are
near-misses' generalization corrected. sig_unify trailing-/* */-comment extern skip documented
(fix reverted — unproven + data-cast is the right lever). 11 _a.c giants need split-aware tooling.
- no new banks this turn; fleet 62.31% unchanged; ov_SC01_077 verified d19c9580 (R22).
- grinder.py: persistent blacklist for permuter-won/gate-rejected (plumbing-bound) fns;
stops the tried.clear()-after-idle churn (was 0 banks in 8h on func_8014F3E8/func_8014FE60)
- sig_unify.py rewrite_def: adopt the canonical param list on arity mismatch (DEF-side
loose-typing wall) — unused extras sit in $a0-$a3, free at -O2; banked func_8016EDEC/EE40
- cookbook §22 (DEF-side recovery + grinder blacklist); CURRENT_PHASE option-C log
- compounds: sig_unify is in the gate pipeline -> every future wave + the grinder auto-recover
- the %lo-folding indexed-global -O0 residual (§18, long "irreducible") is CRACKED: declare
the global as "extern Struct base[]" (sizeof == stride) and access "base[i].field" -> gcc
keeps sym a symbol_ref and folds %lo(sym+off) into the store, byte-matching. The failing
forms "*(T*)(&sym + i*stride)" materialize &sym as a value first, blocking the fold.
- func_8013B7AC byte-gated + banked (x1 — the -O0 cluster is overlay-local, R14 finding above);
the idiom is reusable fleet-wide for ANY indexed-global access (-O0 or -O2).
- cookbook §18 ("%lo-folding indexed global — CRACKED") + §20 placeholder closed.
- the other 9 -O0 stubs: idiom applies but need per-fn -O0 drafting (3 quick ones tried, failed
on -O0 codegen detail; 4 are large) -> backlog/autonomy fuel. clean rebuild d19c9580 (R22).
- byte-proven: 0 drafts declare an extern struct/union data conflict; the lone apparent
DATA-conflict (func_8016A8FC/D_800AE620) was a typedef-REDEFINITION (Blk20 inline vs
engine_types.h, same type) masking the def-sig loose-typing wall. Stripping the inline
typedef compiles but still byte-mismatches. data-cast = code for 0 cases -> not built.
- cookbook §20 DATA-conflict note corrected; fleet unchanged 58.82%.
- byte-proven: only 1/134 overlays shares ov_SC01_077's -O0 cluster bytes; the 6 matched
-O0 fns reference per-overlay data addresses (func_8013B568 -> D_80187270 in ov_SC01_077
but 0x80182B04 in ov_SC01_005), so they're overlay-LOCAL, not ×134-shareable. The
Phase-18/19 'reach-134' label conflated function-present with byte-identical (R14).
- the §18 split infra (rollout tool + Makefile %_o0.o pattern + PROVIDE .ld) was built and
byte-validated to compile/link a 2nd overlay; the whole-binary gate then exposed the
per-overlay-data wall -> reverted (the finding is the deliverable, P9).
- -O0 rollout = ×1 per-overlay-unique re-matching (~0.2-0.3%), NOT +0.6% free -> SKIP.
cookbook §18 corrected; fleet unchanged 58.82%, 136/136 byte-identical.
- tools/cast_call_sites.py: per draft, callee whose canonical TU sig != draft's
intended sig -> decl->canonical (kills in-TU conflicting types, keeps symbol in
scope) + call-site cast ((ret(*)(args))func_X)(args) (codegen-neutral: gcc folds
the cast of a known symbol -> direct jal). Pure --in/--out; whole-binary gate is
the arbiter (G3/P9). Pipeline: canon_resident_calls -> cast_call_sites ->
sig_unify -> harvest_verify --chunk 1
- recovered 6 of T6 batch-1's 33 gate-fails byte-identical (func_80153C44/8015CF58/
801711FC/80161BE0/801683D8/8015F948); 5 propagated x134 + 1 local; check-all 136/136
- R14 CORRECTION of cookbook §20's '~33' projection (byte-proven): the batch is NOT
mostly callee-conflicts — ~6 callee (cast-recovered), ~18 DEF-side loose-typing wall
(def's matchable sig conflicts with the unchangeable caller-canonical; caller-side
fix BLOCKED because INCLUDE_ASM declares no symbol -> a shared macro's internal
extern is load-bearing in the 133 stub overlays), + a small DATA tail. The def-side
needs re-drafting under the caller-canonical sig (future wave), not a text transform
- cookbook §20 RESOLUTION + SETUP tool inventory (R16/R21/R30); CURRENT_PHASE log (R28)
- fleet 58.63% -> 58.82%, dedup 1501 -> 1508, 0 NON_MATCHING (G4)
- R14 finding: the 3 Phase-18 "implicit-int / propagate-first" near-misses are NOT
implicit-int (reproduced each through the byte-gate). Real classes:
(a) resident-callee LINK-miss: draft calls func_<ADDR> but the addr has a curated
name (0x8004CFEC = ratan2) -> "undefined reference to func_8004CFEC". NEW
tools/canon_resident_calls.py rewrites func_<ADDR> -> curated name (pure draft
text, body bytes unchanged) -> run FIRST in the recovery pipeline.
(b) shared-caller ARITY conflict: an engine_core.h caller macro declares the callee
file-scope `extern void func_X(void)` then calls func_X(); the real def takes an
arg -> "conflicting types". FIX = caller extern -> no-proto `extern void func_X();`
(byte-neutral for the caller; compatible with promotion-safe params int/long/ptr).
- 3 matches banked in ov_SC01_077: func_8017209C (ratan2 rewrite), func_80147514 (s32),
func_80168F40 (void*); 2 no-proto lines in src/shared/engine_core.h
- recovery pipeline: draft -> canon_resident_calls -> sig_unify -> harvest_verify --chunk 1
- make check-all 136/136 BYTE-IDENTICAL (full extract, R22); dedup 1450 validated/0 failed;
0 NON_MATCHING in any default build (G4); fleet 56.64% (the 3 are ov_SC01_077-local,
x134 propagation rides T3/Phase-20)
- cookbook §17a-3 corrected (R14/R16); SETUP tool inventory (R21); CURRENT_PHASE T2 done
- §17 rewritten: the call-crossing register-ORDER class is MATCHABLE with register
__asm__ pins + a scheduling barrier (byte-proven func_8012B8E4), not unsteerable.
The wall was a missing lever (the pins), not an impossibility. Recipe documented as
a TOOLKIT: triage with match_one -> reconstruct / array-decay / PINS / barrier.
- §16 cross-refs + hand-matching §8e corrected to match. The ONLY genuine stub-and-skip
left is the narrow-param loose-typing conflict (func_80146A6C).
- self-correction (P9/R14): I concluded 'unsteerable' before trying the pins; Drew's
hand-match-everything directive exposed the gap. Recorded honestly.
- canonical-sig layer (session 4): tools/census_conflict_callees.py + derive_canonical_sigs.py
-> a 20-extern byte-neutral block atop ov_SC01_077.c (LOCAL, not engine_core.h); census
conflict callees 20->0, blocked targets 24->0; gate pipeline now draft -> sig_unify (MANDATORY)
-> harvest_verify --chunk 1; fleet 136/136 byte-identical (R22), 55.51% (no regression)
- FINDING (R14/P9): the conflict wall is 7%-reach not ~2x; the 4 reach-134 circular targets are
ALL gcc-quirk/regalloc/layout-bound (0 banked); the high-reach core IS the quirk tail; struct
types are byte-neutral for matching (the wall is gcc codegen, not knowledge)
- leverage analysis: fleet % is function-count-weighted (size adds no %); "unblock many" = the
layer (declaration, not matching); reach is the lever (already reach-sorted); 247 tractable
reach-134 stubs ~ +3-4% projected
- GO/NO-GO: NO-GO on brute waves at the current ceiling; GO on a compiler-quirk research phase
(read gcc-2.7.2 source + Xenogears + the §10/regalloc classes, R17) -> then resume the wave
- docs: cookbook §16 corrected + hand-matching-process.md §8 (the layer + the finding + handoff)
- worklog archived -> phase-ends/logs/Phase17.md (R19); bumps 1.15.0 -> 1.16.0
- CURRENT_PHASE.md: new session-4 START HERE (build the canonical-sig layer, then
scale the wave); old demo-protocol START HERE marked superseded
- hand-matching-process.md S7: the Ultracode harvest wave (pipeline, calibration
result 60% match_one / 33% whole-binary / +0.47%) + THE CANONICAL-SIG WALL (the
60->33 gap is 100% sig conflicts; surgical per-callee canonicalization = ~2x lever)
- matching-cookbook.md S16: guided-hand-matching breakthrough + new idioms (mask-local,
shared-ret0 goto, v0/v1 coalescing) + the wave/canonical-sig finding (R16 flywheel)
- SETUP.md: DecompileFunctions.java (headless batch Ghidra-C pre-pass) in the inventory (R21)
- S0 (cookbook §15): ran m2c on real ov_SC01_077 stubs (R14). Finding: m2c
--valid-syntax output COMPILES via m2c_macros.h (M2C_FIELD = byte-faithful cast);
30/30 sampled targets use only byte-faithful macros. Compiling != matching: the
residual is regalloc/schedule -> decomp-permuter is the byte-closer; struct types
are an enhancer, not the sole gate (S3/GATE-B measures the lift). ML parked (owner).
- common.h: add s64/u64/f64 + M2C_UNK* typedefs + byte-faithful M2C_FIELD/M2C_BITWISE
macros (non-faithful m2c macros left UNDEFINED = early 'defer' signal). Byte-neutral:
main 143dbb89 (clean rebuild, R22), resident 8e17e02f, ov_SC01_077 d19c9580 all OK.
- CURRENT_PHASE.md: Phase 16 plan + S0-S9 gated tasks + Sun-afternoon timeline +
known-answer oracle test method.
Drew T