- docs/commit-map.tsv: 4,032 rows (ordinal of the ORIGINAL main -> rewritten hash, author/committer dates, subject);
1 pruned row of zeros (ordinal 1712, "session archive update"); 0 old hashes asserted; ordinal 1 unchanged by the
rewrite (byte-identical)
- resolve_tokens: 1,238 commit:NNNN tokens -> shortest-unique new hashes in 98 files (docs, phase-ends, logs, tool
docstrings, 2 C comments, the A5 evidence logs); residue left as tokens: commit:1712 x4 (the pruned commit),
commit:orphan-24 x2, commit:orphan-26, commit:orphan-35 (cited commits that exist in no lineage)
- the rewrite (C4): filter-repo 2.47.0 on a bare clone of the C2 tip, 311 s, exactly 1 pruned, main 4,032 -> 4,031;
the pre-rewrite history is mirrored in the private archive repo and in the local bundle
- the proof (C5): verify_rewrite 4,031 pairs / 0 failures; absent_scan 0 offenders; gate_scan 0 offenders on the clone
- adoption (C6): 100 text files differ at the tip, 0 purge paths, 0 added/deleted; leftover refs dropped; no gc yet
- resolver skips tools/public_rewrite/ (its self-test fixtures are the token grammar, not citations); repo-local
identity is the GitHub noreply address from here on; CURRENT_PHASE: C4–C7 logged, checkpoint -> NEXT = C8
- hash_dict (4,420 commit objects -> commit:NNNN / twin / orphan; 150,280 prefixes; 0 ambiguous; 0 collisions with 1,480
cited content hashes; scratch mailmap), scrub (12/12 self-test; HEAD sample 731 distinct tokens == git's own lookup),
gate_scan (+ expected_offenders.txt fixture: the R39 negative control, PASS over 16.8 GB in 2 m 25 s; rom_blob_ids =
content/signature hits U purge-path blobs not shared with any other path), run_filter (module API; --force only for the
deleted tag), verify_rewrite (pairwise proof + no purge path survives + pruned set == derived purge-only set),
build_commit_map (0 old hashes asserted; unchanged commits exempted), resolve_tokens, absent_scan (positive control on the
current repo: FAIL 82,362), probe_github.sh (skips unchanged commits)
- trial #1 found two defects the plan had not foreseen: the EMPTY blob in the strip list (--strip-blobs-with-ids then
undid every "file emptied" change in history and pruned a restore commit) and the byte-identical Initial commit keeping
its hash; both fixed with controls
- trial #2: filter 269 s, exactly 1 pruned, verify 4,029 pairs / 0 failures, map 4,030 rows, absent_scan + gate PASS on
the clone, 1,231 tokens resolved at a trial tip (residue 7: the pruned commit x3, orphans x4), aggressive repack 500 -> 80 MB
- SETUP P33 C1 section + rows (R21); runbook §3/§5/§6/§10 measured; requirements-python.txt; CURRENT_PHASE -> NEXT = C2
- pre-checks: census (nothing project-authored under a purged dir), ignore coverage with `git check-ignore --no-index`
on every path, and the control that the public build needs none of it (main 143dbb89 byte-identical with tools/psyq
+ .run/obj40 + .run/obj42 moved aside; WITH state restored)
- after: git ls-files on every purge path = 0; no untracked purge path; tools/audit_public.py OK — 0 offenders among
6,566 tracked paths (255 before; the no-rom `audits` CI job goes green from here); make check-env 0
- docs/public-flip-runbook.md (NEW): Block C operational — decisions, actor table, C3..C11 with commands/checks, the
Support-ticket text, the probe, the fallback, the risk register, rollback; the mailmap is scratch, no personal
address in any tracked file
- SETUP §2.3/§2.4: the zips' sha256 + sizes (download-only now); verification.md: a --cached removal changes no
tracked-content byte, A5 holds for this tip; CLAUDE.md fail-safe: never `git clean -x` (ignored-but-present RE data);
decision-log R31 entry (why the purge leaves the index before the rewrite); CURRENT_PHASE -> NEXT = C1
- audit_public: purge paths from purge_set.txt (the C1 rewrite's own input) + a DERIVED ROM-hash set (1,801 manifest
rows + 218 check.*.sha + redump Track 1) + 50 MiB cap; controls: the current tree FAILS naming exactly the purge set
(255 rows), a clean subset OK, a renamed EXE copy caught by content; zero-length files exempt (the empty-file SHA1 is
also the zero-length SC04/SC05 FILE_029/1.6 payloads')
- compile_only: Makefile flags parsed at run time; TUs from <alias>_SRC_DIR with nested-binary pruning; skips derived
(70 LINKED tiles, 47 INCLUDE_ASM TUs), -O0 TUs compiled at -O0; PR scope 54/54 in 1.6 s; fleet 4,170/4,170 in 123 s
at -j32, failed 0; unknown alias refused (R43)
- no-rom.yml: audits (8 commands, each re-run under the system python without the venv -> rc 0) + compile-only (apt
binutils-mipsel + cpp-mipsel-linux-gnu, cc1 from the sha256-checked tarball, maspsx submodule; PR scope on push/PR,
--all weekly + dispatch); the audits job is RED until C3 by design
- SETUP P33 B7 section + 4 inventory rows (R21); CURRENT_PHASE log + checkpoint -> NEXT = B8
- ImportAnnotations.java: the S86 OSGi-bundle blocker was 3 javac errors (Long->int unboxing x2, a nonexistent
LocalVariableImpl ctor -> VariableStorage); "/undefined" resolves to DataType.DEFAULT (it lives in neither type
manager — main's first proof passed the cmp with failed=13 because the plate-comment rows had set the same function
comments); ghidra_rebuild.sh now dies unless the import printed failed=0 (R49), writes .proof markers
- ghidra_annotations_delta.py: analysis drift measured and encoded as three counted classes — Error/Analysis bookmarks;
auto-named DEFAULT functions the rebuild did not create (29 in main's LINKED regions); auto-named rows lagging the curated
symbol file (10 sep8 + 5 aug31, R15). Result: main 38 hand-authored rows (13 annotated fns incl. 3 the ELF does not
define, 22 comments, 3 labels); resident/overlays/protos container rows only; the DB holds no hand-authored types
- controls (R39): mutated block row -> PROOF FAIL; synthetic comment/bookmark/label/signature round-trip -> PROOF PASS
twice (idempotent); the filter keeps the synthetic rows and a hand-renamed name-only diff; fake failed=2 refused,
resident re-proven; roster --check controls both ways
- proofs, all PASS failed=0: resident 65s, ov_SC01_077 169s, ov_SC06_018 173s, SLUS_007.26 210s, sep8 202s, aug31 206s
- tools/ghidra_roster.py -> config/ghidra/ROSTER.md (--check in tools-health, ignores the per-machine proof column)
- .claude/settings.json hooks $CLAUDE_PROJECT_DIR-relative; ghidra_mcp_start.sh is a silent exit 0 without Ghidra or
the project (both controlled); SETUP P33 B5 section + 5 inventory rows + §2.8 (R21); CURRENT_PHASE log + checkpoint
- ov_SC03_105:func_80185810 banked in commit:4004 (bank.sh: rtu MATCH 489/489, build rc 0, sha d305ff6d… == config)
- §501-P: shape-grep the idiom's constants (`'0x200) << 2'`) and objdump the sibling's window before any dial; a pin/fence a draft
"needs" is a property of its other dials — remove every pin after a sibling port (d9 = no pins = MATCH); census: F2 polarity 42,
2-set uu 63, ot16 pin load-bearing only next to 2-set neighbours (d3 = 4); the S83 "hard reg hides nonzero_bits" guess refuted (d5)
- post-bank: twin_rescan 2 open / 0 free; verbatim_check --strict 5==5; backlog.py render 3 open; frontier_t4b_final.json 2 / 940
- .gitignore allowlist for .run/P32/t4d/ (variants, logs, notes, the banked body; rtu/ compile dirs stay ignored)
- fleet R22 running in the background (.run/P32/t4d/r22_*.log) — recorded at the T4b close
- (c): cnt's slot is spill_stack_slot[23] (evicted from $s7), so the phantom @0x8 must be an initial-loop no-traffic slot; every producer refuted on dump facts (leaf: no save area; LO spilled after GR and products alternate to GR_REGS — C3 measured; no unallocated single-block equiv pseudo; expand-time locals precede; 13 lh single-use, no lb). Rows 49/50 = two move_movables hoists in body order.
- row (d) read only (rtu DIFF 13 re-verified); brief + step 0 (§501-N banked-sibling search on its symbol set) in the checkpoint
- no src/ change in this commit; fleet R22 owed at the T4b close (last check-all 218/218 before the (b) bank)
- main:func_80032A74 (422 ins, closeness 1): the residual is ONE reload-time slot at sp+0x48 (u16 draft = 422/422 code, DIFF 22 frame
rows; s16 draft = DIFF 1 at idx 244 lh vs lhu). Every post-parameter slot producer enumerated from gcc-2.7.2 (reload1.c:658 ghost
alter_reg / caller-save.c:249 area / reload1.c:879 invalid-equiv / reload1.c:3499 spill_stack_slot) and refuted on the bytes: combine's
newi2pat ghosts re-derive a narrow load and the site is lhu (no lb, no double load); a save area without sw/lw needs sched.c:4962
staleness and no register-only insn shares a block with a call; $t0 holds no pseudo; LO mult results retry into GR_REGS. Verdict
PROVED at 1 (pin kept with the verdict; ledger WALL-PROVED).
- NEW mechanism measured: local-alloc.c optimize_reg_copy_2 (tmp = x; tmp op= c; x = tmp) mints a ghost with stale refs, but after
regclass -> GR_REGS, allocated, no slot (P13/P14). 18 isolated reproducers, 0 draft variants; cookbook §501-M; accelerators (12).
- tools/ghost_census.py (new): ghosts in a .lreg dump with their class (ST_REGS => slot). tools/cc1_dumps.sh: prints the .frame line,
ins count, spill lines and the census; the under-counting standalone-(use) grep is gone. SETUP rows (R21).
- tools/backlog.py: load_best kept the EARLIEST record at equal closeness (docstring said latest) — the S84 row never rendered; fixed.
- CURRENT_PHASE.md: S84 log + refreshed 🛑 checkpoint (rows (b)(c)(d) next, then T5). No src/config/carve change; fleet check-all
218/218 rc 0 at the S84 preflight.
Drew T