- lane-A jr re-sweep: 9/9 siblings banked (SC03_001/002/124/125, SC04_015/019/020,
SC05_017/018), per-binary SHA-gated by the carve driver; new jr splits + yaml carves.
- func_80189540 family 0/4: reconcile-transform defect ('syntax error before *') — tool
class, ledgered, NOT codegen. §154-A md probe x4: fresh refusal 'jump tables only, not
an island of mixed included data' — 20 md jr members ledgered as the known structural gap.
Wave 6 (wf_9729fd89-c16, 76 agents, 6.7M tok): 40 targets -> 35 agent-MATCH,
1 refuted, 0 UNVERIFIED (the new field works), 4 NEAR -> 24 BANKED.
*** THE FINDING OF THE CAMPAIGN, and it is not a compiler idiom ***
func_8017F2D4 had been "MATCH standalone / DIFF at gate" SEVEN times across
five waves. Every attempt hunted codegen. The body was byte-correct the whole
time. The fault was that the prior notes named the WRONG DESTINATION TU:
..._jr_8017C340.c holds only a CALLER and a prototype; the INCLUDE_ASM lives in
..._jr_8017ED5C.c. Splicing into the wrong file is a no-op, the binary differs,
and harvest recorded its canned string "match_one MATCH but gate rejected
(declaration/TU plumbing)" — A GUESS, NOT A MEASUREMENT. No declaration
conflict ever existed.
NEW LAW (zero-cost oracle): THE SPLAT ASM SUBDIR NAMES THE DESTINATION TU.
asm/<overlay>/nonmatchings/<TU_basename>/<fn>.s => the INCLUDE_ASM is in
src/<overlay>/<TU_basename>.c, always — the third path component IS the TU
stem. Never accept a prose TU citation that disagrees with the --asm-subdir you
were handed: a grep for the function name also hits callers and prototypes in
OTHER TUs and reads exactly like a destination hit. Corollary: re-derive the TU
path from the asm subdir BEFORE hunting codegen on any gate-refused backlog
entry.
The agent proved it properly: in-situ splice into BOTH TUs, full pinned triple,
279/279 with 0 masked diffs, plus a collateral-drift check (71/71 other sized
symbols byte-identical). It also corrected the reach to x2 (only two .s files
for that function exist, byte-identical modulo the overlay name).
Bank rate across six waves: 67% -> 79% -> 69% -> 68% -> 73% -> 60%.
Wave 5 (wf_7bce6c28-9f4, 78 agents, 11.4M tok across both halves): 40 targets
-> 36 agent-MATCH, 2 refuted, 2 NEAR, 0 FAIL, 0 drafts lost -> 29 BANKED.
RESUMED THROUGH A USAGE-LIMIT OUTAGE. The first run lost 40 agents mid-wave
(18 cracks + 22 verifiers). Resuming with byte-identical args replayed the 22
completed cracks from cache and re-ran only the dead ones — a limit outage
costs the unfinished work only.
⚠ THE INTERRUPTED RESULT WAS MISLEADING AND THAT IS MY BUG: crack_wave.js
classifies anything without verdict_check.confirmed as `refuted`, so 22 drafts
whose VERIFIER DIED read as 22 refutations. A dead oracle must not be
indistinguishable from a negative verdict — split `refuted` from `unverified`.
Two prior-seeded agents did better than asked:
- func_8017F2D4: found the prior draft SURVIVED in .run/wave3/, recovered it,
then gated it IN SITU — spliced into the real destination TU, full pinned
triple, masked-diff of the function out of the whole-TU object: 0 mismatched,
279/279. That closes the §52b gap instead of trusting a standalone match. It
also byte-confirmed the x5 reach on three symbol-remapped siblings and fixed
the prior notes' TU pointer (they named a file holding only a caller).
- func_8017FFD0: VALIDATED its predecessor's claim rather than assuming it —
built a no-barrier variant and reproduced the predicted -7 ins drift exactly,
proving the __asm__ __volatile__("") cross-jump barrier is a real lever.
Bank rate across five waves: 67% -> 79% -> 69% -> 68% -> 73%.
Wave 4 (wf_05895a19-121, 75 agents, 7.9M tok): 40 targets -> 35 agent-MATCH,
0 refuted, 5 NEAR, 0 FAIL, 0 drafts lost. 18 banked so far on the whole-binary
gate across 9 binaries; the other 17 are re-gating on a clean tree (see below).
PRIOR-NOTES SEEDING HELD AT SCALE: 10 of 12 seeded targets confirmed (wave 3
was 7 of 9). func_8017C294 — the x16 family, the largest single item on the
board — is now NEAR at **2 ins** (18 -> 11 -> 2 across three seeded attempts).
THE 4th COMMENT-BLINDNESS DEFECT OF THE SESSION, and the first with blast
radius. A crack agent annotated a decl in its draft:
extern void func_801842DC(s32 a0); /* TU:4023 INCLUDE_ASM (no decl) */
`corpus._INCLUDE_ASM_CAND` only skips lines that BEGIN with a comment marker,
so it read `INCLUDE_ASM (` out of the trailing PROSE, found no quoted path, and
refused the whole binary's stub oracle — correctly, by its own R32 contract.
That then failed gate_stage for every LATER binary in the run, because they all
walk the corpus: 12 binaries banked, then 5 were blocked by one comment in a
13th. Fixed the same way as the other three today: decide candidacy on
cdecl._mask'ed text, PARSE FROM THE ORIGINAL (the mask blanks string content
and would erase the asm path). Verified on 4 binaries incl. main (2,002 stubs).
AND THE DAMAGE IT LEFT: gate_stage raised out of the CorpusError BEFORE its
revert, stranding failed drafts spliced in src/. The 17 solo re-gates that
followed all read 0/17 — they were building a POISONED TREE, not judging their
own drafts. Residue reverted here; the 17 re-gate clean next.
The pattern is now sharp enough to state: any scanner that greps C source for a
token must mask comments and strings FIRST — and agent-authored drafts make it
far likelier, because their prose mentions the exact tokens our tools hunt for.
Wave 3 (wf_2680d8ff-539, 74 agents, 8.08M tok): 39 targets -> 35 agent-MATCH,
0 refuted, 4 NEAR, 0 FAIL -> 27 BANKED on the whole-binary gate (69%).
THE HARDENED HARNESS HELD: 0 drafts missing on disk (wave 2 lost 21 of 26 to a
shared output dir). Per-agent dirs + "never touch anything outside your own
directory" + a verifier that re-runs sha1sum LAST.
PRIOR-NOTES SEEDING IS THE SESSION'S BEST LEVER: 7 of 9 seeded targets
converted, including all three wave-2 whole-binary-gate misses and both big
NEARs — func_80189540 (551 ins, was NEAR +2) and func_8017C3BC (407 ins, was
NEAR 17). func_8017C294 (the x16 family) went 18 -> 11 ins: narrowing, not a
wall.
func_80189540 also required the one host edit its agent byte-probed:
src/ov_SC04_018/ov_SC04_018_jr_80188E1C.c:3093
extern s32 func_80189540(s32 a0, s16 a1) -> (s16 a0, s16 a1)
That TU has no call site, so the edit is inert; the OTHER TUs' (s32,s16) decls
are deliberately left alone (real call sites, and an s16 prototype there would
force caller-side truncation and could de-match banked callers).
Its agent also recovered a better draft that already existed at
.run/backlog_drafts/func_80189540.c — a 551-ins MATCH that had been DE-matched
to 549 by "fixing" the definition's s16 first parameter to s32, the exact
inverse of that draft's own warning. Restoring s16 recovered the match.
Wave 2 (wf_d804f25a-f6f, 54 agents, 6.76M tok, 66 min): 28 targets ->
26 agent-MATCH (93%, vs wave 1's 75%), 0 refuted, 2 NEAR, 0 FAIL.
Then only 5 of the 26 drafts still existed on disk. The verifiers were NOT
lying — their evidence quotes exact instruction counts matching each target
(101/187/108/77 ins), so the files existed when they ran. Later crack agents
DELETED them while tidying the SHARED .run/wave2/ directory; one agent's own
notes say "scratch dir removed afterwards so .run/wave2/ contains only draft
.c files". 28 agents, one output dir, and a prompt line ("drafts to .run/wave2
ONLY") that invited cleanup.
Zero-token recovery: re-gated every surviving .c under .run/wave2/** whose
text DEFINES the target function -> 2 of 21 recovered.
Banked (5/5 through the whole-binary gate — every draft that survived passed):
ov_SC01_005 func_8017ED5C x5 func_8017DEFC x5
ov_SC03_093 func_801818F0 x5
ov_SC04_018 func_80188B84 x5
ov_SC06_018 func_80183F50 x6
The 21 lost cracks keep their full agent notes in .run/jr48/wave2_lost.json —
idioms, integration surface, family maps. They are re-runnable from those
notes at a fraction of a cold crack.
Drew T