39 files from the three behemoth agents: the matched drafts (s21_func_80183814_b2.c,
s21_func_8017D2DC_b1.c, s21_func_8017DC1C_b1.c), their reports with do-not-re-buy tables AND BASES
(§80), and the reusable harnesses — including s21_g21_reloc_verify.py, which resolves every
relocation (incl. the implicit MIPS-REL addend objdump -r does not print) against the target and is
the missing rung between match_one and the binary (§88f). ~735k agent tokens of work; .run/giants is
the curated allowlist.
367k agent tokens of recon: the 99.3%-structural draft, the 15-row do-not-re-buy table WITH BASES
(§80), and the 6-file harness that regenerates the draft identically (edit the 72-ins template once
-> re-propagates to all 35 sites). .run/giants/*.{c,md,py} is the curated allowlist; round 2 starts
from these rather than re-deriving.
- family_remap alone: -56 LENGTH-DRIFT. §77's own text predicted the cause verbatim (a "static"
helper is a preamble construct the extractor does not carry): the exemplar uses
"static inline void bandsetup(...)" -- the §82-oracle-1 inlined helper -- and none was carried.
helper + its 5 externs: -56 -> -34. Whole 2,993-line region file as preamble: MATCH (1061 ins).
- BUT the full-file carry is wrong for BANKING (my error): right for a standalone match_one
compile, collides wholesale in the real TU. Gate -> PLUMBING, reported as "conflicting types
for memcpy" = the §58 red-herring; the real cause needs a hand-splice + real cc1 stderr.
- NAMED NEXT STEP: minimal preamble = bandsetup + its 5 externs + the 18 gte_* macros from that
region file, then the §81 carve chain (this sibling is ALSO a jr function). Draft preserved at
.run/giants/s19_func_8017C730_SC03_013_nearmiss.c
- §77 gains its 4th measured variant (static helper) + a NEW COROLLARY: the right carry is the
MINIMAL CLOSURE of what the body references, not the whole file -- over-carrying trades a
match_one failure for an in-TU collision. Also: s19_remap_tu.py's walk-back-to-previous-brace
heuristic breaks on an isolated region file, where the preceding construct IS the needed helper.
- CRACKED at xHigh and VERIFIED INDEPENDENTLY: match_one MATCH (1061 ins); agent re-matched 3x
from clean runs (100% register-masked AND register-kept, all 10 regions, frame 0x270 exact).
§81 carve chain clean first try: jr_isolate_all --only -> byte-identical cacaf7c2 -> jtbl_carve
(43-piece set) -> byte-identical -> bank -> R22 clean-fleet 140/140, tools-health OK.
instr 80.6%; distinct-code 3,844,100 -> 3,845,161.
- WHAT IT IS: the matched base func_8017CA80 + camera height-band cull + distance-driven CLUT
fade. func_8004974C (TransposeMatrix) sits in a 36-ins prologue deriving a Y band; the
part-level `lim >= g.otz` cull is GONE; flat arms gain an `sz < lim` near-plane cull. The
base+one-extra-callee fingerprint predicted this exactly.
- §82 ORACLE 1 -- A DUPLICATED `addiu $aN,$sp,K` ACROSS A `jal` MEANS THE BLOCK WAS INLINED.
`&X` on any non-first local always creates a pseudo and CSE always merges two of them
(expr.c:6260 ADDR_EXPR -> force_operand(..., NULL); exception: virtual-stack-vars offset 0).
So the same stack address re-materialised at two sites separated by a jal means CSE was
PREVENTED from merging => not the same function body. 17 non-inline spellings failed; a
`static inline` helper reproduced the prologue BYTE-FOR-BYTE first try. Reusable probe: scan
the ~1,200 built objects for that signature in NON-INCLUDE_ASM functions.
- §82 ORACLE 2 -- SCALAR vs AGGREGATE DECIDES *WHEN* A STACK SLOT IS ALLOCATED: lazily at first
`&` for a scalar, AT DECLARATION for an aggregate. Six GTE result words had to be six separate
longs, not a struct, or they don't land after the inlined helper's temps and the frame isn't
0x270. Second-order: it also flips MEM_IN_STRUCT_P (§30's /s) -- with one word a fixed-address
scalar, ((PolyF3*)pkt)->rgbc stops aliasing it, so a store needed respelling to keep the
target's nop. A scalar-vs-struct choice is simultaneously a frame-layout AND an aliasing
decision.
- BANKING FOOTNOTE (§75a class A): first bank rejected `conflicting types for ApplyMatrixSV` --
draft (MATRIX2*, SVECTOR2*, SVECTOR2*) vs the TU/fleet canon (void*, void*, void*), 2,286 of
2,835 sites. Conforming the decl is byte-neutral and banked first try. On a jr function expect
BOTH gates to speak: the carve chain answers the jump table, §75a answers the declarations.
- Also reproduced: §78 (reuse a busy variable), §80(i) (a lever went -8 -> exactly neutral as the
base moved), §72 (a register pin made it worse).
- AGENT'S OWN CAVEAT, recorded not hidden: one zero-byte __asm__ keeps a vestigial `mnc = hmid`
alive that flow.c would delete (costing 10 ins + the 0x130 spill slot). Emits nothing, compile
is 1061 exact, but it is a documented stand-in -- 12 natural spellings measured, all DCE'd.
- CRACKED by an Opus 5 agent @ xHigh and VERIFIED INDEPENDENTLY: match_one -> MATCH (1194 ins),
100% every region, 1129 -> 1069 -> 37 -> 28 -> MATCH. It is the matched base func_8017CA80
(952) + two deltas: a 14-ins grey-colour prologue from D_801DCCA0, and a FIFTH switch arm
(case 2 / case 3 split, proved against the real jump table) emitting a POLY_FT4 plus a 7-word
subtractive overlay.
- NOT BANKED. The whole-binary gate said DIFF and it is RIGHT: this is a jr (jump-table) function
(jr $v0 at .s:409; table jtbl_801DB70C in asm/ov_SC06_029/data/tail21.data.s). Matching the C
makes gcc emit that jtbl into .rodata while the raw copy stays in the data tail -> duplicate +
wrong address. match_one masks jal/HI16/LO16 so it CANNOT see this -- the §53 carve law.
- THE CHAIN, each step failing LOUD with its own remedy (the tooling behaved well, R32/R35):
(1) harvest_verify -> DIFF, not PLUMBING.
(2) jtbl_carve --func func_8017C954 -> refuses: subseg ov_SC06_029_jr_8017AE2C would host
NON-CONTIGUOUS .rodata carves (0xb3468, 0xb35b4); one object can't leave a gap for the
unmatched jtbl between them. Remedy: isolate into its own code subseg first.
(3) jr_isolate_all --dry-run (47 jr / 21 objects) -> REFUSES: 2 file-scope decls
(extern struct PW8017E6D8 D_801E1EC4/EC8) could not be placed, and it will not emit a region
that silently omits them ("a dropped prototype is a SILENT BYTE-CHANGER" -- C89 implicit
int f(), and return type drives delay-slot fill here). NB struct PW8017E6D8 IS already in
engine_types.h:658, so this looks like a placement-logic gap, not a missing type -- that is
the precise next thing to check.
- => banking is a bounded BUILD-INFRA task (T2 config resegment => full R22), not more matching.
Deliberately not started this deep into the session. Match + harness preserved and tracked.
- AGENT FINDINGS: §80(i) confirmed twice more (x_e1swap measured exactly neutral then later paid
-2; the za lever measured worse and became necessary two levers on). NEW DIAGNOSTIC: when a
residual is "a whole block of registers renamed by ONE SLOT", read the .greg `;; N conflicts:`
AND `;; N preferences:` lines for the block's top allocno -- a missing hard-reg conflict plus a
new copy preference is the signature of a one-slot slide, one dial away not forty bugs
(c954_reg.py, the per-region scorer, is the reusable tool).
- HONEST CAVEAT (the agent's own): its lever 1 is a hand-placed byte-free __asm__ register-clobber
dial, not a construct the original author would have typed; 14 natural spellings were tried and
measured. Bytes unaffected, true source shape unfound; the report names the next probe.
- 45 -> 37 -> 33 -> 21 -> 11 -> 3 -> 2 -> 0, reproduced 3x from independent work dirs. Verified
independently before believing it (R14): match_one MATCH (4763 ins), then harvest_verify
--binary ov_SC03_116 BYTE-IDENTICAL, then R22 clean-fleet 140 passed, 0 failed of 140.
distinct-code 3,838,143 -> 3,842,906 = 68.1% -> 68.2%. instr 80.5%. Agent was interrupted by a
weekly API limit and RESUMED FROM ITS TRANSCRIPT -- its round-2 harness survived, nothing was
re-derived.
- §80 THE PROCESS CORRECTION, worth more than the match: A DO-NOT-RE-BUY ENTRY IS SCOPED TO ITS
BASE, NOT TO THE FUNCTION. Three of round 1's ~40 measured negatives INVERTED on round 2's
base -- the same edit (qsingle23) measured 1,040 mismatched on the 45-base and 11 on the
21-base. Re-testing the round-1 negative list cost ~20s and produced THREE of the seven winning
levers. Such a table records (edit, base) -> result, NOT edit -> useless; after any lever that
moves the base materially, RE-RUN THE NEGATIVE LIST. This retroactively qualifies every
do-not-re-buy table in the cookbook (§45, §60b, §75a, §76, §78, §79). Concrete: round 1 measured
"removing the va->$t2 pin costs 4% elsewhere" => keep the pin; on a base with c0..c3 at function
scope, removing those pins is worth 21->13. Same experiment, opposite conclusion.
- MY FLAGGED "#1 MOVE" LOST, and the failure is the finding. I briefed variable REUSE (§45-A /
RC-14) as the top lever because it took func_8017F510 from 97->10. Swept in full here: EVERY
merge lost, 43-3294 across 8 merges. Reason: the TRI and QUAD grants did not differ by RANK but
by IDENTITY -- two independent allocno sets, and re-ranking inside one set cannot fix a two-set
problem. Diagnose ranking-vs-identity before reaching for a merge. The actual fix (c0..c3 at
FUNCTION scope, 33->21) was read off the two matched relatives (b5:310, b4:338) and confirmed
against the target -- the 4th time today that reading a matched relative beat the clever lever.
- PIN'S HIDDEN COST, cited: combine_regs' hard-register branch (local-alloc.c:1795, reached from
:1295 with already_dead==0) records the pinned reg in qty_phys_sugg UNCONDITIONALLY -- no death
guard. A pin invites local-alloc to tie producer chains into it. New cure R7: a zero-byte
__asm__ ref keeping the pinned value live past the temp so find_free_reg can't honour the
suggestion -- closed the last 2 ins (c1->$a0 is uniquely load-bearing; every alternative pin
lost 64 ins).
- §78's attribution primitive RUN and REPRODUCED: under -fno-schedule-insns, -fno-schedule-insns2
and both, order unchanged => the rgb transposition was never a sched.c decision.
- Cold-start economics complete: round 1 = decode + exact length + exact frame + 99.06%; round 2 =
the last 45, and cheaper. Budget TWO passes at this size. 5th source copy-paste artefact found.
- COLD-START RESULT (verified independently): 4763/4763 ins, 45 mismatched = 99.06% byte /
99.94% structural, exact frame, exact opcode histogram. NOT a match; nothing banked (45 != 0,
the byte-gate is the sole arbiter). The residual is 3 register-grant ties, 0 structural
divergence. Named next move: variable REUSE across c0..c3/a0v..a3v, the one §76 lever class
the pass never reached.
- MY BRIEF'S PREMISE WAS WRONG BY CONSTRUCTION -> §79. I chose this target partly because §71's
callee-set fingerprint returned 0.00 against every matched giant = "a genuine cold start". But
the function makes ZERO jal calls, so its callee fingerprint is EMPTY and §71 CANNOT FIRE:
0.00 meant "cannot answer", not "no relative". Grepping the target's DATA symbol D_800A5E60
found the matched func_8017BEBC at once -- func_8017BF14 is the 4-light-box member of the same
renderer family whose 3-box sibling func_8017D960 was matched hours earlier. RULE: when §71
returns an empty/zero-overlap callee set, fall back to DATA-symbol fingerprinting; an empty
fingerprint must never become a cold-start brief.
- NEW LEVER (§79): THE FRAME LAYOUT IS A DECLARATION-ORDER ORACLE. gcc-2.7.2 assigns stack slots
to spilled pseudos in pseudo-number order, and pseudo numbers follow first use ~ declaration
order -- so the target's frame map reads back its source's declaration order. Moving ONE line
took 73% -> 84% structural and brought all 127 slots into exact correspondence.
- §76 CONFIRMED AT SCALE: the entire -62 length residual was ONE allocno-class decision (c0..c3
declared inside the cull blocks -> 1-death local allocnos -> global.c:668-671 removes those
regs from the global pool -> r1lo spills), 52% -> 93%. An __asm__ ref-dial reached the same
spill and scored WORSE -- declaration scope beat the ref dial again.
- PIN NUANCE: pins are safe on a 0-jal function (§74's hazard cannot arise), 4 pins took
94% -> 99%; but §72 held -- pins 5 and 6 made it worse.
- EFFORT ANSWER, HONEST: xHigh from a genuine cold start on a 4,763-ins giant bought the decode,
the exact length, the exact frame and 99.06%, and did NOT close. Budget a SECOND pass at this
size: the first buys structure, the last ~1% is register grants.
- FULL R22 DISCHARGED: make clean + extract-all + check-all -> 140 passed, 0 failed of 140 (run
after the agent finished, per the deferral recorded in the pool commit). tools-health OK.
- BANKED (each whole-binary byte-gated; make check-all -> 140 passed, 0 failed of 140):
func_80130D48 ×4 (1,064) · func_8018F3E4 (478) · func_8018B3D0 (478) · 13 × 223-ins siblings
of func_8017E6D8 (2,899). distinct-code 3,833,224 -> 3,838,143 = 68.0% -> 68.1%.
- TWO OF MY OWN COUNTS COLLAPSED UNDER SCRUTINY BEFORE I ACTED ON EITHER (R14/R35):
"func_8017CA80's family = 102 unmatched" was really 13 -- my count tallied family members whose
NAME appears as a stub anywhere in the fleet, not instances actually unmatched (a semantics
error, not arithmetic). "56,267 ins remappable" was really 8,114 -- 86% was the known -O0 /
deferred set (the func_80144B9C whale, the func_8013C414 cluster). I nearly recommended a
target on the first number.
- THE §77 CARRY GAP IS THE DOMINANT COST OF MECHANICAL REMAP: 23 of 27 first-pass CC1-FAILs.
NEW .run/giants/s19_remap_tu.py sources the preamble from the exemplar's OVERLAY TU (the block
between the previous top-level `}` and the def), applies family_remap's own substitution map,
and adds the two includes match_one never adds -> 21 drafts went 0 MATCH -> 14 MATCH. The 13
223-ins siblings share ONE exemplar, so a single preamble fix cleared all 13.
- USEFUL ASYMMETRY: func_8018F3E4/func_8018B3D0 FAILED match_one but BANKED in the whole-binary
gate -- the real TU supplies decls the standalone compile lacks. A match_one CC1 FAIL is not a
reason to skip the real gate on a remapped sibling.
- RESIDUAL 3,195 ins, causes NAMED not guessed: func_8017D5C0 (952) matches standalone, gate
reports `conflicting types for memcpy` = the §58 red-herring (a warning from an unrelated TU
position; SESSION-14 hit the same label and the true cause needed a hand-splice + real cc1
stderr). func_80166994 ×3 + func_8016A290 ×4 still CC1-FAIL after the TU carry.
- FULL R22 DEFERRED DELIBERATELY: make clean wipes asm/, which the concurrently-running BF14
agent reads on every probe. This batch changed only src/*.c (no config), so check-all is sound;
the clean R22 must still run once the agent finishes.
- CRACKED pin-free at xHigh (Opus 5 agent), then ALL FOUR family siblings banked via §40 remap,
each MATCHING FIRST TRY: ov_SC03_090 (the crack) · ov_SC03_089 · ov_SC03_104 ·
func_8017E778 @ ov_SC03_091 · func_8017CD9C @ ov_SC03_102 (the last two cross-address).
Verified independently before believing the report (R14): match_one MATCH (3338 ins), then
harvest_verify BYTE-IDENTICAL on all five binaries, then R22 clean-fleet 140/140.
- METRICS: distinct-code 3,816,534 -> 3,833,224 (+16,690) = 67.7% -> 68.0%, the first
percentage-point movement in that metric all session. instr-weighted 80.3% -> 80.5%.
Session distinct-code total +19,712 ins, ALL from the three behemoths; propagation gave +0.
- MY BRIEF WAS WRONG IN AN INSTRUCTIVE WAY -> §78. I said a negative length drift means "missing
instructions". The 4 absent instructions were 4 emit tails × 1 nop -- delay slots the target
could NOT FILL because the register it wanted was still live. otp at function scope has 4
deaths -> fails local-alloc.c:472 -> global allocno in $a2 -> via global.c:668-671 pushes tp
off $a1 -> the 0xFFFFFF mask is free early -> maspsx hoists it into the slot. Declaring otp
PER EMIT ARM fixed the whole drift in one edit (3334->3338, 1806->333).
SECOND TIME IN ONE SESSION a "structural"-looking residual was an allocno-class choice (the
first: F510's "scheduling" transposition, §76). A nop present in the target but absent from the
draft is usually a register-liveness fact, not missing code.
- TWO MORE REUSABLE FINDINGS (§78): gcc-2.7.2 fold NEVER leaves a literal first in an `|` chain
(7 parenthesisations, all reassociate) -- so `or acc, var, K` first in the target means K was a
VARIABLE in the source, an asm->source read that retires a whole sweep family. And "make it a
variable" has TWO separable effects (fold-opacity vs a new allocno): a fresh short-lived local
fixes structure and wrecks allocation (690 mismatched, damage ~300 ins away); reuse a busy one.
- ECONOMICS: 9 levers, each necessary by drop-one ablation, and 5 of the 9 were read straight off
the MATCHED relatives func_8017F510 (cracked earlier today) and func_8017CA80. Crack the
smaller family member first -- it is a lever library for the larger one.
- NEW TOOL .run/giants/s19_remap_family.py: family_remap + the §77 preamble carry in one step
(reproduces the exemplar's FULL file-scope preamble with the tool's own substitution map
applied). Took the 4 siblings from "4 rounds of CC1 FAIL each" to MATCH first try, ×4.
- func_8017F5B4 @ ov_SC02_031 shares behemoth #3's h_norm AND h_seq (96fe0455c344 /
9a6bd2b91fd4) with a different h_exact = the same instruction stream differing only in masked
reloc fields. The §40 family_remap case exactly, so NO agent was spent: family_remap
--addr 0x8017F510 --from ov_SC03_006 --to ov_SC02_031 --to-addr 0x8017F5B4 substituted 52
per-overlay symbols correctly on the FIRST invocation.
- match_one -> MATCH (1511 ins); harvest_verify --binary ov_SC02_031 -> BYTE-IDENTICAL;
R22 clean-fleet 140 passed, 0 failed of 140.
- DISTINCT-CODE 3,815,023 -> 3,816,534 (+1,511). With behemoth #3 that is +3,022 distinct-code
instructions from the two behemoths, versus +0 from every propagation win this session.
- ALL the work was PREAMBLE, none of it the body -> cookbook §77. Four CC1 FAIL rounds, each
naming one construct the extractor drops: (1) multi-line `typedef struct {...} PolyGT4;` --
family_remap's backward walk accepts a line only if it STARTS with extern/typedef/comment, and
a multi-line typedef ENDS with `} PolyGT4;`, so the walk halts there AND LOSES EVERYTHING ABOVE
IT; (2) hence the file-scope extern block above the #define BOXTEST/ATTEN block; (3) the
exemplar's own #include lines (PolyFT3/PolyFT4 live in engine_types.h).
- THIRD CONFIRMATION TODAY OF ONE DEFECT CLASS, NOW ACROSS TWO TOOLS. §75b found
dedup_propagate dropping a file-scope #define and PREDICTED the generalisation; family_remap
then dropped a typedef, an extern block, and the includes. RULE (§77): after any mechanical
template/propagate step, diff the exemplar's full file-scope preamble against what the tool
emitted. A CC1 FAIL on a remapped sibling is a PREAMBLE report until proven otherwise -- it
says nothing about whether the remap was right.
- Artifact preserved: .run/giants/s19_func_8017F5B4_remap.c
- BANKED into ov_SC03_006 through the whole-binary byte-gate (G3/P9); R22 clean-fleet
140 passed, 0 failed of 140. Verified independently before believing the agent's report
(R14): match_one -> MATCH (1511 ins), then harvest_verify -> BYTE-IDENTICAL.
- DISTINCT-CODE 3,813,512 -> 3,815,023 = +1,511, EXACTLY the function's instruction count and
the ONLY distinct-code movement of the entire session. Reach is ×1 by sig, no propagation --
which is precisely why it moves the metric propagation cannot touch. instr 80.3%, fn 89.18%.
- EFFORT EXPERIMENT (Drew): behemoths #1-#3 were worked at High; this is the first at xHigh
(Opus 5 agent). It closed a residual the lower tier had fully localized but could not move,
and that 3,663 permuter candidates at base 97 had failed to improve by even 1.
- MECHANISM -> cookbook §76: the allocno CLASS (local vs global) is the dominant regalloc lever
and C reaches it ONLY through declaration scope and variable reuse -- unreachable by statement
order, expression shape, pins, or random search, which is exactly why the permuter was spent.
(1) `otp` per emit ARM: 4 deaths -> four 1-death local pseudos (local-alloc.c:472); its
second-order effect via global.c:668-671 (local placements re-marked as HARD regs for
global-alloc) had made the target's otp=$a0 STRUCTURALLY IMPOSSIBLE, visible as hard-reg 4 in
the `;; N conflicts:` tail of the .greg dump. (2) `cb` reused as the unlit rgbc temp: refs
27->39 lifts its global.c:594 allocno_compare priority past `tp`, flipping the 3-colouring ->
97 -> 10. (3) one shared `rgbw` temp -> 10 -> 2. (4) mny-before-my + one zero-byte __asm__ at
the head of the tri cull block -> MATCH.
- THREE CORRECTIONS TO MY OWN BRIEF, all byte-evidenced: residual B was never a scheduling
residual (it fell out free with lever 2 -- a register grant seen as a schedule diff); residual
A is RTL EXPANSION order, proven with -fno-schedule-insns AND -fno-schedule-insns2 (source
order survives both -- that attribution primitive is the reusable bit); residual C had no
single c3 seed (c3 has no lever of its own, it moves only when cb out-ranks tp).
- FIXED a latent SHARED-HEADER defect, pre-existing and unrelated to the draft:
src/shared/engine_types.h closed its include guard at line 1174 of 1259, leaving 11 typedefs /
85 lines OUTSIDE the guard since the crack-wave lift. A TU including it twice re-declares them
and gcc-2.7.2 rejects a repeated typedef even when identical -> `conflicting types for
Blk16_956C`. Guard moved to EOF; byte-neutral.
- ARTIFACTS TRACKED (R20): .run/giants/s19_func_8017F510_b4.c (130-line dossier) +
s19_f510_report.md, whose ~50-row do-not-re-buy table is arguably worth more than the match,
+ the s19_* analysis tooling.
- STRETCH, MEASURED: func_8017F5B4 (1,511 ins, ov_SC02_031) has a DIFFERENT h_exact -- not a
dedup sibling, a family_remap TEMPLATE candidate off the b4 source.
func_8017F510 (1,511 ins): EXACT length, frame 0x258 exact, byte-exact prologue AND epilogue,
identical sp-slot set, 99.5% register-masked structural / 93.3% byte-aligned, SYMS-OK, 97 divergent.
Not a match (G3). §71's callee-set lever delivered ~90% of the C and a first compile at 1528/1511.
- CORRECTNESS FINDING (qualifies §17): a local `register s32 x __asm__("$30")` pin produced a
seductive 1511 ins / 98.9% and was a MISCOMPILE -- gcc-2.7.2 ALSO allocated $s8 to an unrelated
live value. A pin is a HINT to the allocator, not a reservation. Never ship one without inspecting
the pinned register's defs. Banked work is safe by construction (the byte-gate rejects a
miscompile); the exposure is UN-GATED drafts. ACTION: behemoth-2's draft carries FIVE pins
($25 $17 $19 $20 $21) and must be re-checked before anyone builds on it.
- THE HONEST FIX was source-level: the +17 drift was live-range stretching from REUSING w/wz for the
vertex-word reads (spilling amb, 7 lw+nop pairs). Dedicated temps -> 1528->1511, 88%->99.6%, no pin.
- GIV RECORD ORDER (§70 family): part->prim must be read BEFORE part->nprim -- loop.c:combine_givs
walks bl->giv in REVERSE record order, so the last-recorded giv becomes the combined base.
- RESIDUAL 97 traced to ONE seed: c3 is $a2 in the target, $a3 in the draft; tp takes the other of
the pair and renames the whole 4-tail block. Fix c3 -> $a2 and ~93 should fall together.
- SPENT, byte-recorded: decl-order permutations, block-scoping, splitting/inlining tp, reusing f0,
vertex axis orders, and decomp-permuter (4,724 candidates, base 97, ZERO improvement -- a §3 hard
tail outside the C-randomisation space).
- b3_align.py / b3_pos.py supersede the b2_* aligners.
func_8017D960 (3,338 ins): 3,334 ins drafted, 98.8% register-masked-identical, 88.3% byte-aligned,
byte-exact prologue AND epilogue, exact 0x320 frame, same 10 saved regs, identical ~110 stack slots,
SYMS-OK. NOT a match (G3) -- but an order of magnitude closer than behemoth #1.
- THE LEVER: it is the LIT VARIANT of func_8017CA80, the 952-ins renderer immediately above it in the
same file (already matched). Diffing the sibling gave ~90% of the C free and a 3334/3338 draft on
the FIRST compile. GENERALISED: before mapping any giant, grep for an already-matched adjacent
function that is the same routine. One grep can replace days of analysis.
- §69 PARTLY REFUTED: its law 1 (write whole body coarsely -> correct frame/saved-reg set) CONFIRMED
and decisive; law 2 (measure region-aligned) confirmed but its TOOL did not transfer (per-switch-
case); its HEADLINE ("the deliverable is the map, not a match") is refuted for non-dispatchers --
§69 was derived from a 359-call dispatcher with no sibling.
- TOOL SUPERSESSION: .run/giants/b2_mask.py + b2_full.py = shape-agnostic masked sequence aligner
(structural AND byte numbers). Replaces s18_regions_comparator.py for all giants.
- FAMILY: func_8017CD9C + func_8017E778 are the same 3,338-ins fn with only 3 light-descriptor
symbols changed -> one crack templates x3.
- MY OWN PROFILING ERROR, recorded (R14/R35): I briefed "no switch" from a sltiu jump-table grep; the
switch is a COMPARISON TREE (23 slti). A jtbl grep is not a switch detector.
First attempt on the game's largest unmatched function. No match (never the goal); the deliverable
is the map, and every claim is byte-verified against the target .s.
- STRUCTURE: an actor state machine, not a straight-line giant. 21-case switch via jtbl_801F4CE4
(sltiu 0x15); 359 jals to only 37 DISTINCT callees (verified); 48-ins preamble + 19-ins shared tail.
- THE FINDING: it decomposes into repeated templates, not 5122 unique instructions —
35 instances of one "spawn-effect" packet (~1400 ins, crack one -> 34 free),
7 "wait/countdown" (already reproduced at 0 skeleton diffs), 12 "HUD/text",
plus twin cases (0≈3, 1≈4). Only 3 cross-jump edges couple anything.
- TWO GENERAL LAWS FOR GIANTS, measured: (1) register pressure is GLOBAL, so a partial draft gets
10 callee-saved regs instead of 8 and a matching PREFIX is structurally unavailable — write all
cases coarsely first, then refine; (2) match_one's global number is meaningless on a partial giant
(666 vs 5122) — measure REGION-ALIGNED instead.
- NEW REUSABLE TOOL: .run/giants/s18_regions_comparator.py (region-aligned skeleton comparator, works
on any giant). Caveat travels with it: masks register numbers + jal targets, so it proves STRUCTURE,
never closeness; finish on the whole-binary gate (G3/P9).
- 2 idioms cracked in passing (the D_x[t+K] constant-fold needing a separate index statement; the
(s16)*(u16*)p + /455 magic-0x90090091 form).
- VERDICT: tractable but a ~2000-line WRITE, not a hard puzzle — no scheduler wall, no unsteerable
regalloc. Recipe for the next attempt recorded.
- artifacts preserved under the tracked .run/giants/ path (.gitignore now allowlists *.py there).
- PROBE ANSWERED (the SESSION-17 open item): a0's first use is body-line 41, a1's is 28
-> use order ALREADY matched the target's birth order while birth order was inverted.
The §31 RC-1/RC-2/RC-3 first-use-order hypothesis is REFUTED for this class; decl order
is inert too. Both retired, do not re-buy.
- ROOT CAUSE (byte-read): gcc schedules the arg->pseudo entry copies as ordinary in-block
insns and hoists an unconstrained one to the earliest slot. Mine raced `move $s4,$a0` to
idx 2, which freed $a0 to become the early load temp (target: $v1) and left the target's
idx-12 load-delay slot unfilled. The "wrong temp reg", the mirrored `sw $sN`/`move $sN`
prologue and the +1 instruction were ONE defect in three costumes.
- THE LEVER (cookbook §67, written in-session per R30): an UNPINNED launder
`__asm__ __volatile__("" : "=r"(pv) : "0"(p));` placed at the statement where the target's
copy lands, later uses rewritten to pv. Zero instructions. Prerequisite: collapse redundant
pointer aliases first (the two-pseudo split made gcc serve the first use from the incoming
arg reg). Placement is the knob and is NOT linear -- sweep 3-4 anchors (3-statement plateau).
- 25 -> 16 by reading; permuter_ils (REGALLOC, 10x180s) 16 -> 14 in cycle 1 then x9 unchanged
(§66d-3: a repeat means stop). Its edit is semantics-preserving (hoists desc.y+0x10) and
cleared the idx 271/272 cluster. Seeds tracked: s18_func_8014D820_close{16,14}.c.
- MEASURED NEGATIVES recorded so they are never re-bought: pinning the laundered var to $s4
(pre-stages via $t0, 305 ins); pinning the reused temp t to $3 (287/303); an artificial
"r"(t) dependency (inert -- gcc still hoists); laundering after the beqz (305); dropping the
a2 pin (29); wholesale pos/desc reorder or sinking z0=ent->z (+1 ins).
- NOT banked (G3) -- residual 14 in 2 clusters: idx 21/22 scratch $v1 vs $a0, idx 84-98 the
desc.y/currentLocationId schedule. SCHEDULE-weighted ILS running from the close=14 seed.
- Also measured: func_80140958 260/260 54 - func_80176734 371/371 56 - func_80176218 328 vs
327, whose +1 is NOT §67 (it hoists a global address into an extra callee-saved $s6 that the
target rematerializes -> the §17 array-decay lever).
- 3 falsified hypotheses, then MATCH (101 ins) with direct-symbol scalar decls. The length gap was
the target re-materializing "lui $at,%hi(sym)" per scalar store while array/struct forms let gcc
CSE the address into a register (1-ins stores) -> mine was exactly one instruction short.
- Remaining blocker NAMED: the TU's canonical decl is "extern u8 D_80126BE0[]" INSIDE a DEFINE_func_*
macro body (engine_core.h:19813), so the matching u16 form gives conflicting types in the real TU
(real cc1, via rtu_match --stderr-out).
- demacroize would clear it but banks x1 (+101 ins) and forfeits x138 — a trap, not a win. The right
exit is the §H CSE address-fold antidote (balanced if/else diamond, zero asm) so the canonical u8[]
decl stays and the bank propagates x138 (+13,938 ins). Both draft forms preserved.
- rtu MATCH (101 ins) vs gate reject, baseline intact -> divergence had to be in a relocation.
All 9 jal targets agreed; of 15 data symbols the target uses, the draft referenced 14 — missing
exactly D_80126BE8.
- CAUSE: the draft declared D_80126BE0_s / D_80126BE8_s — `_s`-suffixed aliases NO symbol table
defines, invented because D_80126BE0 was already declared at a different type in the same draft.
- MECHANISM CORRECTED (§65c refinement): rtu over-claims not merely because it is relocation-masked
but because it COMPILES WITHOUT LINKING — an unresolvable extern is invisible to it by construction.
Cheap general guard: diff the draft's symbol set against the target .s's %hi/%lo/jal set before
gating (one comm over two greps; found this in seconds).
- FIXED: real symbols referenced, duplicate u8[] decl dropped, store re-expressed via &. Residual is
now an ORDINARY near-miss (100 vs 101 ins, 36 mismatched, regalloc/fold) -> permuter fuel.
Draft preserved at .run/giants/s17_func_801463A0_symfix.c.
- func_80176734: 76 -> 57 in cycle 1, then flat x9 (converged). Completes the queue.
- Seeds TRACKED at .run/giants/s17_*.c — the allowlist covers .run/giants/*.c but NOT subdirectories,
so they go at the top level (the R20 trap: a subdir would have left them untracked and one
git clean from gone).
- Queue state: 80177940 BANKED x138 | 8014D820 25 (toolkit exhausted -> Fable5) | 80140958 56 |
80176734 57 | 80176218 271 (never run). ~+1.3pp instr if the four crack.
The session-7 checkpoint gated the entire jtbl track behind one finding: the
carve+isolation path yields a bank that is incrementally valid and clean-invalid
(139/140, [FAIL] ov_SC06_018, "twice, identically"). The prescribed diagnosis
(diff the incremental vs clean object set) never ran, because the failure does
not reproduce.
MEASURED, with the bank applied through the single-function automated path
(harvest_verify --chunk 1 -> [jtbl] carved -> + chunk(1) -> BYTE-IDENTICAL):
per-binary clean (rm asm+build; extract; build) -> BYTE-IDENTICAL cbbc4f44
make clean && extract-all && check-all (run 1) -> 140 passed, 0 failed of 140
make clean && extract-all && check-all (run 2) -> 140 passed, 0 failed of 140
ATTRIBUTION (best-supported; the failing tree is gone): the 139/140 runs were
taken on the tree left by the BATCH _jtbl_prep (6 table-bearing -> 1 carved,
4 isolate-FAILED, 1 stale-asm carve fail) — five failed preps' residue of
stranded carves + half-applied isolations. The per-function snapshot-restore
that removes exactly that residue landed AFTER those runs, in commit:0803, the
same commit that named the blocker.
THE LESSON (R35 on ourselves, -> decision-log): "twice, identically" was not a
replication — two reads of the SAME contaminated state is one observation. A
replication must RE-CREATE the state, not re-run the check. Standing guard:
re-apply a fault from a known-clean tree before writing it down as a property
of the mechanism. Sixth "structural wall" to resolve to our own tree/tooling.
- BANKED: func_80135A4C (181 ins) x1 in ov_SC06_018 — isolated into its own
code subseg + .rodata carve (single-table, no JTBL_PADS; tail3..tail18 renumber)
- §61c faults 1-2 STAND: a stranded carve poisons the overlay; per-function undo
is unsound in a batch -> ONE jtbl draft per harvest_verify invocation.
jr_inventory's 1:1 ownership assertion was right and is unchanged.
- UNFROZEN: this family = 138 members / PURE / 24,978 ins ~ +0.19pp (jtbl_family_bank,
§53 carve law); the 9 preserved t5wave cracks (Task 14 stages 2-3, §57 plumbing)
- R22 clean-fleet 140/140 x2; tools-health OK (dedup 1848/0, C1 234481/234481,
cdecl 53189/53189, audit-binaries 140); 0 NON_MATCHING (G4)
- fleet 78.0% instr / 66.5% distinct / 87.95% fn-count
- also: preserve the 4 untracked wave-4 .o0 drafts (R20); killed an orphaned cc1
from the Jul-21 session burning a full core for 13h23m
Ultracode wave, 12 agents (~2M tokens), over freshly-prefetched ov_SC06_018 exemplars.
11 MATCH / 1 near, INCLUDING ALL THREE GIANTS (710/673/478 ins). Whole-binary gate: ZERO.
Splicing each failure individually (the gate's own label is §58's memcpy red-herring) gave
THREE DISTINCT blockers, none of which the ladder clears:
(1) §8e-2 jtbl table-count drift -- 10 of 12. "more rodata .align directives than pad specs".
STRUCTURAL FINDING: fresh crack fuel in a well-matched overlay CONCENTRATES in jtbl-carved
TUs (the non-carved ones were harvested first), so §8e-2 GATES the next tranche of
substantial cracking rather than being a straggler.
(2) §57 self-decl conflict -- the 2 plain-TU drafts ("argument 'arg2' doesn't match prototype").
normalize_self_decls exists, is wired into family_sweep, and is NOT in gate_stage -- the
same gap the arity pre-pass had.
(3) local-type redefinition (from the Task-14 diagnosis set) -- wants the type-lift.
So gate_stage needs THREE stages; only the arity pre-pass landed today.
All 12 drafts PRESERVED at .run/giants/t5wave_* (R20): genuine cracks with per-function lever
notes (cross-jump barrier placement, MEM_IN_STRUCT_P store/load ordering, §43 K&R s16 params,
$s-pins, CSE-break barriers). Do NOT re-draft -- they bank the moment the stages exist.
METHOD NOTE: `make build | grep -i error` missed the real failure TWICE (the jtbl_rodata_pads
line contains no "error" token; and the build failed at a later stage than the warnings I read).
Check rc, read the tail unfiltered -- a filtered build log is a selection tool, and every
selection tool here has eventually lied (R32/R35).
Tree reverted clean; nothing banked. cookbook §61a.
The 2 Task-3 cores banked x1 but skipped by dedup_propagate ("not self-contained: local types").
Lifted EntSC01077 (func_8014E284) + P_TAG_80137DD4 (func_80137DD4) into src/shared/engine_types.h
(fleet-included via engine_core.h), and inlined func_80137DD4's file-local `#define OTE` into the body
(byte-neutral macro expansion, re-evaluated per use to preserve codegen). Both now self-contained ->
dedup_propagate --recover = 138 overlays byte-identical, 0 stragglers, 2 new dedup groups.
~+32.7k ins (108+129 x138). R22 clean-fleet 140/140 byte-identical; tools-health OK; dedup 1846->1852;
C1 coverage 234205. §55c local-type propagation cap lifted for these 2.
SESSION-2 close: this session banked ~94k ins across 4 fns x~137 overlays (2 non-jtbl giants fully
propagated + this 2-core type-lift); fleet 71.4->72.1% instr (+0.7pp), 140/140 throughout. The 4 jtbl
giants remain deferred on the byte-proven 8-align jtbl-carve gap (root cause half-pinned: cc1+maspsx
both emit .align 2, so the +4B pad is a downstream as/ld_interleave artifact) -> teed up as the next task.
TASK 3 COMPLETE (both deliverables):
(a) jr cores: a 2nd ultracode wave cracked all four giants at match_one — func_8013F350 (490),
func_80131340 (424, verified TWICE: standalone AND in-TU cc1 rc=0), func_80159C84 (337),
func_8013C414 (329, -O0). ALL FOUR gate-rejected on INTEGRATION (def-sig / §8a rodata island /
decl conflict), not codegen; each blocker NAMED. func_8013C414 matched ONLY because of the new
worker_wave --o0 fix (a -O0 target self-checked at -O2 can never match — the §53/§54 wrong-build-step
trap that produced Phase-28's "~3%" artifact).
(b) §53 has_mid_jr INTERLOCK: built + negative-control-proven (commit:0670).
PRESERVED (R20 — ~2.6M agent tokens to reproduce; bank them, do NOT re-draft):
.run/giants/p29t3_*.c (12 drafts) + p29t3_README.md — every draft is match_one-MATCH or a
characterized near-miss, with its exact blocker + a cheapest-first bank order. Best value:
func_8013FAF8 (312, MATCH, pure def-sig plumbing); then func_80131340 (in-TU-proven);
func_8013F350 (§30#2 macro-widen void->s32); func_8013C414 (§8a rodata-island carve).
Permuter fuel: func_80177940 (close=5), func_801670E4 (16 — strip pins first, permuter can't
ingest them), func_8014D820 (33), func_80140958 (116).
SESSION CHECKPOINT — safe to open a fresh session:
140/140 byte-identical; tools-health OK; dedup 1843/0; 0 NON_MATCHING (G4); main 143dbb89.
Fleet 68.9 -> 71.4% instr / 49.5 -> 53.3% distinct-code / 83.94 -> 86.42% fn-count.
Tasks 1,2,3,6 DONE. Remaining: T4 (member harvest + grinder warm-start/bug-fixes), T5 (Ghidra-C
prefetch, needs /mcp), T7 (burn-down + ROI close). Carried: the 2 local-type-blocked cores
(func_8014E284, func_80137DD4) need the build_engine_types type-lift to propagate x137.
The last Fable5 pass of the sprint (Drew capped further waves at 86% context). func_80176734 (371 ins,
fresh un-drafted core): NO bank (mine=370 vs 371, 5 permuter-shaped clusters — entry-schedule tie,
caller-saved shuffles, a combine-merge missing insn, qty ties), pin-free, honestly handed off (P9;
match_one confirms the DIFF). Draft -> decomp-permuter warm-start (P29).
Idiom harvest (cookbook cse_expr §H):
- THE CSE ADDRESS-FOLD ANTIDOTE (zero asm): find_best_addr's cost-ungated qty-const fold + from_plus
re-association eat reg-based global accesses on every cse walk; a balanced if/else DIAMOND makes the
merge label barrier-preceded -> fresh cse table -> both folds die with no #APP. Replaced two asm dials.
- update_equiv_regs doubles live_length for single-set REG_EQUIV pseudos (local-alloc.c:1064) — a 2nd
set forfeits the doubling, ~4x the allocno priority; explains a "my dial broke the $s-order" class.
- record_jump_equiv fall-through delete (cse.c:7511) — a recognition tell for genuine dead source logic.
T1 sprint COMPLETE: 4 cracks + the SIGABRT characterization, 0 direct banks, but 3 wall reclassifications
+ 2 cracked roots + the pin-crash wall dissolved + ~9 new pin-free levers. Fable5 DISCOVERS, cheap-Opus
APPLIES — the ROI is idioms, not banks (docs/calibration.md).
The Fable5 discovery sprint's irreplaceable output, banked before the distillation (that's the
pending Max task). Each is the product of a ~250k-token Fable5 pass; the bulk beside them (260M of
RTL dumps + bisection .s under pincrash/) is regenerable and stays ignored (R33).
- wave-1 crack recon: func_8014D820 (block-0 cracked pin-free 261->110, "reused-load-temp
serialization" lever), func_801670E4 (RC-6-not-S3 reclassification + the reg_renumber-swap oracle),
func_8016CBC0 (root-A cracked byte-zero, "coalescing knife-edge" refuted, density-dial lever) +
the workhorse variant.
- pin_crash_sigabrt.md + pincrash/{minimal_repro.c, *.gdb}: the §42e pin-crash wall CHARACTERIZED and
REFUTED as a compiler wall — it's the extract_unit macro-drop (fixed in T5); sched.c:2725
create_reg_dead_note abort; pinned families stage 133/133 clean once macros ride along.
All three wave-1 seeds produced oracle-proven reclassifications refuting cookbook §44-Lever-5 wall
names + new pin-free levers (Fable5 discovers, cheap-Opus applies). Distillation -> cookbook is next.
Found while reading the seeds for T1: cookbook §45 names
.run/giants/func_80133CD4.fable.c as its worked example and .run/giants/fable_cd4/
as the flagship's gdb oracle — BOTH were untracked. The docs cite artifacts that
were not in the repo.
- .gitignore: widen by FILE TYPE, not directory — .run/giants/*.{c,md,sh} +
fable_cd4/*.{c,md,sh,gdb,txt}. +49 files / 460K.
- Now preserved: the flagship func_80133CD4 crack + its gdb oracle (§45's cited
worked example); the byte-verified pf*.c regression ladder (the seeds' own
Method/reproducibility section cites it: pf2 78, pf_c2 30, pf_d1 35, pf_h1 280);
the dump.sh/mon*.sh RTL harnesses; the banked giants' drafts (80135480, 80163EC8,
80166994).
- Still ignored (regenerable via dump.sh, R33): d_pf*.i.*, *.s, dumps_m*/, and the
ILS/permuter .log files. Negative control re-verified: all 5 probes IGNORED, no
db.*.gbf staged (R23).
Lesson (R31 candidate): a doc that cites a path is an untested claim about the repo.
The §45 citation and its file were 4 days out of sync; only reading the seed for an
unrelated reason caught it. Candidate lint: cookbook path citations must resolve to
tracked files.
Pulled ahead of T1: the Fable5 sprint's agents work inside .run/, and its Phase-25
seed recons were untracked — an agent overwriting .run/giants/*.opus.c would have
destroyed irreplaceable input. 5 minutes to remove that risk.
- .gitignore: /.run/ -> contents-exclude form (/.run/* + ! exceptions), following the
/tools/bin/*.sha256 precedent. Resolves R20 (commit irreplaceable RE work) vs R12
(.run/ is scratch) by splitting the directory on the real axis: what a rerun CANNOT
reproduce.
- PRESERVED (~2.2M / 31 files): the 6 Phase-25 *.opus.{c,md} giant seed recons (49K);
the func_80178004 gdb-on-cc1 harness + ORACLE_PROOF.md + the v00-v07 draft ladder +
the sched/combine .lst evidence (~110K — the distilled output of a 477k-token Fable5
pass, and the method §52 lever 6 depends on); backlog.jsonl (1.9M) + fuel_manifest.json.
- STILL IGNORED (regenerable, R33): dumps_v00..v07/ and d_pf*.i.* gcc RTL scratch —
12.3M reproducible via runorc.sh + the .gdb scripts; the MCP log; draft scratch.
The plan said "track the dirs"; the bytes said the dirs are 96% regenerable.
- VERIFIED both directions: git add --dry-run stages exactly the 30 intended files and
0 bulk; negative control — ghidra-mcp.log / dumps_v00 / d_pf.i.sched / d_pf.s all
still IGNORED. No db.*.gbf staged (R23 restart-noise).
Drew T