Wave s67m2_1: 7 sonnet agents, 1 MATCH banked, 6 NEAR — but 4 of the 7 are NOT drafting failures:
* func_8005FA94 / func_8005D244 — oracle_reorder.py bypass gives 0/55 and 0/62 diffs: the C is
byte-correct, the pinned as -O1 cannot emit the §188 epilogue. func_8005D244 is additionally
libpad pdent3.o, an SDK object owned by psyq_integrate.py — it should never have been drawn.
* func_80062144 / func_8005DBD8 — §332, traced to the compiler sources: gcc-2.7.2 emits a symbolic
la as ONE atomic length-2 insn (no HIGH/LO_SUM split in this backend), eligible_for_delay requires
length==1, so it can never fill a jump delay slot; the retail split is ASPSX macro-hopping that
maspsx does not replicate. Byte-verified by running maspsx over cc1's raw -dS output.
6 such functions fleet-wide, NONE banked.
§332a records the draw-policy consequence: main's cheap population is spent and the residual is
ENRICHED in toolchain walls, so main's apparent match rate is contamination, not a model signal.
Wall ledger at .run/S67_walls.txt for the --exclude mechanism.
Wave s67m1: 7 sonnet agents, 0 errors. 5 MATCH banked after bisection in 9 rebuilds;
the 2 NEAR drafts rejected exactly as their agents predicted (func_80013154 close=12,
func_8005ECC0 close=6).
One draft's declaration refused the whole batch first: func_8002A088 declared
`extern s32 func_8002A108(void);` while src/800.c DEFINES it as (s32) at line 15270.
Fixed with the no-proto half of cookbook §324 (`extern s32 func_8002A108();`) — a
no-prototype decl is compatible with a promotion-safe definition and leaves the 0-arg
call unchecked, byte-neutral for the emitted jal. Argues for wiring §324 into the ladder
rather than hand-applying it; it cost a full main gate cycle.
NOTE for the ledger: func_8005E8E8 and func_8005EC00 are verbatim file-scope __asm__
transcriptions, not decompiled C — both hit the §188 wall (2 callee-saved regs with
jr $ra + addiu $sp in the delay slot, unreachable from cc1 under the pinned as -O1),
and both follow established in-TU precedent (func_8005E79C, func_8005EB28).
WALL LEDGER candidates: func_8005ECC0's epilogue tail is proven unreachable via
oracle_reorder.py; only idx24-26 (a beq delay-slot steal) remains open there, and it has
now resisted 8 prior wave attempts plus 3 today.
R22 caught it: 212/213 after the S67-cc1 gate run. `ov_SC04_018` was RED.
ROOT CAUSE (from the diff, not inferred). Commit commit:3354's propagation replaced three bodies in
`ov_SC04_018_jr_80135D20.c` with DEFINE_func_*() instantiations and deleted the 981 lines they
occupied — INCLUDING the TU's file-scope declaration layer, which the two surviving non-deduped
bodies still referenced. A duplicate copy of those decls survived at line 225, BELOW the function
that uses them at line 42, so C89 ordering made it fatal (`D_8018D7A4' undeclared).
THE STRUCTURAL GAP: gate_stage byte-gates the SOURCE binary, then propagation writes to N OTHER
binaries and nothing re-verifies them. "fleet 99.2%" in the commit subject is a metric, not a gate.
This is the blind spot R50 exists for, and only the periodic whole-fleet R22 could see it.
REPAIR: restored src/ov_SC04_018 to commit:3354^, re-extracted (banking had pruned the .s stubs the
restored INCLUDE_ASM lines need), rebuilt rc=0 at the locked SHA fe9b413f. dedup-check clean
(2193 validated, 0 failed, C1 255302/255302). Cost: the 2 banks in that binary.
NEW tools/restore_dropped_decls.py — compiler-driven recovery for this failure mode: build, read
which identifiers cc1 calls undeclared, look each one up in the pre-deletion git ref, insert it
above the leading #include block, repeat. Two defects found and fixed in it while using it:
* anchoring after "the last extern in the first 400 lines" inserts BELOW the point of use, so the
build fails identically and the loop re-inserts forever (measured: 25 rounds, 100 dead decls).
The only safe anchor is the top of the file.
* a no-progress guard now REFUSES when a round asks for what the last round already inserted.
It also correctly refused when the failure changed class (link-level undefined references), which
is how the wider damage was found rather than papered over.
NOT a defect of the S67 §8d rung: scope_demote_drafts only ever writes draft dirs under .run/.
FLEET: make clean + extract-all + check-all = 213 passed, 0 failed of 213.
FRONTIER: 530 -> 526 (4 functions closed this session, measured from corpus.stubs).
src/800.c declares func_8002A544/func_8002A2D4/func_8002A7B4 as `extern void f(s32)`, but each
body genuinely materializes a value in $v0 on both exits (asm-proven). Under a true void signature
gcc-2.7.2 dead-codes exactly those materializations, so the byte-correct s32 body can never compile
in this TU — cookbook §43's 'return-type flip pair', which §183 records as TU-edit-required.
All three call sites discard the result (`func_8002A544(0x32);` as a bare statement), so widening
the declaration cannot change a caller. NEGATIVE CONTROL, run twice: with the edit applied and NO
draft substituted, main still builds 143dbb89f34491258bbc27810d0a12ec8b43a8dd, identical to
config/check.us.sha. The edit is byte-neutral by measurement, not by argument.
Committing it SEPARATELY because gate_main snapshots and restores the TU between passes: an
uncommitted edit is reverted before the gate ever sees it (measured — the first attempt banked 4 of
7 and left all three of these as stubs).
Note for the record: the S66 overlay reconcile lane proved this class also has DRAFT-ONLY escapes
that need no TU edit at all — §202's asm-label alias (`s32 aF800CCBC0(void) __asm__("func_800CCBC0")`,
used byte-proven on func_800CCBC0 and func_800D30D0) and a new register-$2 + input-barrier + shared
goto-exit lever (func_800D2A24). Those are the smaller blast radius and should be preferred where
the TU is shared; this edit is kept because it is proven neutral and these three drafts already
exist in s32 form.
Drew T