- func_80164930 (81 ins) CRACKED + swept x134 = 134 fns (133/0 siblings, family_sweep --reconcile).
The crack = the read-global fix: flip the file-scope decl s16->u16 (byte-neutral to the store-only
caller func_801647A4) + reference the global directly, so the read lowers to direct-addressed `lhu`.
- TWO DURABLE FINDINGS (cookbook §42b):
(1) THE STALE-OBJECT GATE TRAP: a piped `make build >/dev/null` that FAILS leaves a stale .o, and
`asm-differ -o` then reports a phantom score-0. This invalidated wave-2's "iso-drift" labels --
a rigorous re-check (rm .o + build exit-code + real whole-binary SHA) shows all 4 remaining
iso-drift drafts NOCOMPILE (unreconciled callee externs vs the TU canonical-sig layer). Every
gate MUST rm the split .o + check the exit code (compounds the §42a --out gotcha).
(2) canon_sig_reconcile `*(T*)&D_sym` READ-global drift: &sym forces the address into a held register
(kills direct %hi/%lo -> schedule drift); write-only globals unaffected. Fix = file-scope exact-type
decl + direct ref (a block-scoped `extern u16` vs ambient s16 is a hard cc1 conflicting-types error).
- Frontier reassessed: the 9 remaining wave-3 targets each need real-TU reconcile-cracking (NOT gating the
broken wave-2 drafts); each cracks -> ~134 fns (all x134 families). ~1,200 fleet potential.
- R22 clean-fleet 136/136 BYTE-IDENTICAL from a fully clean tree; NON_MATCHING 7 (0 in default build, G4).
- tools/t7_bank.py: the M1 driver (reconcile-at-bank-time against the CURRENT TU + harvest_verify
whole-binary gate; chunk-bet + per-round re-reconcile for cross-fn ambient mutation; giants first)
- canon_sig_reconcile v3.2: uniquify ALL draft-defined type names AND struct/union TAGS to <name>_<addr>
(byte-neutral) -> collision-proof when many exemplars bank into one TU (the 'redefinition of struct Fr'
class); banked func_8016A290 (284-ins giant) + fixed the inter-draft collisions
- 37/40 non-jumptable M1 exemplars banked BYTE-IDENTICAL (ov_SC01_077 d19c9580, clean rebuild); each is
currently ×1 (M2 sweeps them ×134 next)
- R14 CORRECTION (cookbook §41b): the T6 object-only probe OVER-counted BANKABLE by 7 -- it is blind to
rodata + link. (a) 4 jump-table fns (3 _o0 giants + func_8012ACE0): .text byte-perfect but a switch
jump table in rodata diverges -> REFUTES the T6 'Q3 -O0 REFUTED' claim; F-band jump-table workflow.
(b) 3 last-referencer link-walls (func_8016D688/D1D8/165240): C-ifying the only asm referencer of a
scratch data symbol drops splat's auto-symbol -> ld undefined reference; M-linkwall tier, deferred
- ov_SC01_077 REAL 32 stub-exemplars -> 37 more defined; whole binary byte-identical throughout (G3/P9)
- batch-3: the 3 _o0 giants 3/3 isolation-MATCH at -O0 (new tools/match_one.py --o0 flag);
0 banked — an -O0 in-context byte-diff (canon_sig_reconcile's void->s32 is NOT byte-neutral
at -O0) -> deferred to T7. Frontier 125/127 draftable exemplars measured.
- R14 correction: the mechanical reconcile-sweep is NOT the clean 51-target x134 win first
hoped. The frontier "match" status carried un-verified agent claims (5-sample spot-check
= 3/5 genuine); ~19/51 have clean engine_core.h canonicals (the reliable canon_sig_reconcile
tier), the rest hit VARIED walls (callee-sig conflicts, non-identical types Vec3/SVEC,
macro-local data) -> this is the genuine Fable5/T6 residual, not a mechanical sweep.
- docs/phase25-t6-fable-brief.md: the grounded Step-B input package for the fresh Fable5Max
session to author the crack curriculum (95-stub worklist by wall-class + tools + 5 swing
questions). CURRENT_PHASE: T6 hand-off (fresh session, Fable5Max, read the brief). Phase OPEN.
- A/B gate-true: v4 <= v3 (marginally worse on medium, tie easy/hard) -> discard v4, keep v3 (frozen ceiling)
- 'corpus quality > size' confirmed; 7B is capacity-bound (0/5 even on trained fns, not truncation)
- decision-log (R31): the local-7B tier is off the endgame critical path; engine = frontier-crack -> deterministic-propagate -> byte-gate + permuter
- gen2-mips-matching-model: the A/B + the maxlen-2048 truncation flaw (drop-over-length OR grad-checkpointing, NOT CPU offload) for any future retrain
- CURRENT_PHASE: T4 done/failed; NEXT = T5 (Ultracode measure-wave); phase OPEN, no PhaseEnd
- func_80128EA8 + func_80132EC4: h_exact-identical fleet-wide but stub in 100 overlays each; family_remap could not extract them (DEFINE_func macro, not an inline def) so they were T7 remap-fails
- dedup_propagate --addr --tier h_exact instantiates the shared engine_core.h macro at each stub sibling, byte-gated (118 overlays byte-identical per fn)
- R22 clean-fleet 136/136 from clean tree; dedup-check 1813/0; fleet 71.32%->71.36%
- remaining edge cases deferred to Phase 26: 2 h_norm-macro remap-fails (8012A568/80138C30, family_remap can't extract macro bodies), 8013C360 (-O0 cluster)
The mechanical remap method (crack one exemplar -> remap per-overlay symbols to bank the ~133
siblings ~free). Captured now (R30) before the fresh-session handoff. h_norm families are templates
not free dedup; family_remap/family_sweep; plain harvest_verify gate; type-lift for local types;
uppercase func_ hex. Fleet 66.02->70.82% in one deterministic pass.
- housekeeping: deleted stale root gccdump.lreg (gcc default -da RTL dump, dumpbase
"gccdump"; a one-off RTL-inspection run at root CWD, NOT a committed tool). Practice:
RTL dumps go to a .run/ CWD or -dumpbase .run/gccdump (R12)
- make sig-overlays (134 sigs); worklist.py --refresh -> build_fuel_manifest + backlog
render: docs/worklist.md + docs/backlog.md regenerated (stale Jun-26 ranking killed;
the banked whale func_80144B9C dropped from backlog, P9)
- fix tools/sig_image.py docstring: h_norm is the live norm_stream normalizer, not a
"T5 placeholder" (R21/R30)
- CURRENT_PHASE.md: Phase-25 plan-of-record + T0 frontier survey (R14): h_norm 2,764
multi-member families / 11.1 MB; 46% of large solo monsters (3,989/8,670) are family
members; reach-134 h_exact warm-up = 130 classes / 4.11 MB
The single biggest byte-weight lever (770 ins ×134 ~ +1.6% byte-weight), banked across all 134
overlays as -O0 compiled C (was ×1 in ov_SC01_077, commit:0463).
- ROLLOUT (tools/rollout_whale_o0.py): per single-file overlay, LINE-split <ov>.c at the whale
(splat emits in vram order), carve the yaml code subseg into before/<ov>_o0b(-O0)/<ov>_after,
thin <ov>_o0b.c #includes the shared src/shared/func_80144B9C.h (the whale C moved there — DRY,
TU-local typedefs, not a fragile 200-line DEFINE_ macro). Makefile WHALE_O0B_OBJS wildcard -O0.
- DEDUP: group E_func_80144B9C (134 members, h_exact 74186b97, source=the header; group_members
keys on binary+vram so a header-share validates like a macro-share).
- MILESTONE: clean fleet check-all 136/136 (R22); dedup-check 1811/0; FLEET REAL 225816->225949,
byte-identical 65.91->65.95% function-count (the gain is byte-weighted). Validated on ov_SC01_000
+ spot-checks SC02/SC03/SC07 before the full fleet.
- cookbook §38 + SETUP inventory.
- CRACK (cheap Opus, no Fable5/calls.c): the 770-ins reach-134 whale's 2-insn residual was a
STRUCT ASSIGN `D_80078E50 = *ent;` (sizeof(ENT)==0x24), NOT an explicit memcpy() call — gcc-2.7.2
-O0 expands a >MOVE_RATIO-word struct copy via emit_block_move->emit_library_call(memcpy),
precomputing dst/src into pseudos then addu into $a0/$a1 = the exact 2 missing moves.
- -O0 SPLIT: whale is a 2nd -O0 region (prologue 21F0A003) in the -O2 'after' segment; carved into
its own -O0 object o0b (splat.ov_SC01_077.yaml 3-way + Makefile CC1FLAGS=-O0; address-sorted
line-split preserves all banked C). ov_SC01_077 == d19c9580.
- memcpy: memcpy=0x8005C324 in symbols.resident.txt (overlays+resident only; main untouched vs its
MEMCPY.o) + __asm__("memcpy") on the engine_core.h block-copy macro (non-builtin C name -> no
built-in codegen, same call).
- MILESTONE: CLEAN fleet check-all 136/136 byte-identical (R22), dedup 1810/0. reach-134 -> ×134 (W9) next.
- R14: diagnosed the prior "×134 BLOCKED / all overlays excluded" by RUNNING it — refuted.
func_80129CF8's ×1 bank was already fleet-canonical; dedup_propagate --recover propagates it
to all 134 overlays byte-identical (no new tool needed). The "wall" was a stale-asm /
incremental-tree artifact (the T5c/T6-§A trap).
- banked ×134 via existing dedup_propagate --recover; clean fleet check-all 136/136,
fleet 64.90→65.52%, dedup 1799→1800/0, 0 NON_MATCHING (G4).
- T7b reframed: the reconcile tool automates the manual decl-reconcile for FRESHLY-matched
giant drafts (the 6 sibling giants + wave tail), not an 'unlock' of already-reconciled giants.
- CURRENT_PHASE: T1 done + the R14 finding logged; plan plan-…mossy-dawn.md (T1-T6).
- Fable5Max cracked func_80129CF8 (191-ins region-a camera giant; match_one MATCH, 0-off): struct-base
hoisting via SOURCE-LOCAL pointers (gcc-2.7.2 has no cross-bb CSE → a callee-saved base can only come
from a local, NO pins), branch-polarity-off-the-opcode, S12 reused-temp fence, expand_block_move
struct-assignment for the grouped copy, dead-local-aggregate for the frame. Distilled → cookbook §32.
- banked ×1 in ov_SC01_077_a.c (d19c9580; clean fleet 136/136) after reconciling its loose-typed decls
(u8[]/s32[]/struct BigCopy/s8-vs-u8; func_80012F74 s16-vs-s32) to canonical + byte-neutral access casts;
RView (GsRVIEW2-shaped 32B) lifted to engine_types.h.
- FINDING (byte-proven): ×134 propagation is BLOCKED by the fleet-wide loose-typing wall — the giant's
shared callees/data are declared incompatibly across overlays, so the macro's externs conflict per
overlay (dedup_propagate --recover only fixes the propagated fn's CALLER extern, not its callee/data).
Unlike the flagship func_80132784 (compatible → ×134), loose-typed giants bank ×1, not ×134.
- Drew's call (A, invest): build the fleet-wide canonical-decl reconcile tool = the ×134 giant unlock.
Spec + conflict taxonomy + byte-neutral cast patterns: docs/canonical-decl-reconcile-design.md.
- clean fleet check-all 136/136 BYTE-IDENTICAL (R22). No new governance rules.
- find_site extern-collection: allow a trailing `/* comment */` after the `;`. The
comment-blind regex `^\s*extern\b.*;\s*$` stopped the backward scan at
`extern u8 D_801152A8[]; /* canonical TU type */`, dropping every EARLIER extern →
compiles_standalone failed on the now-undeclared callees/data (func_80135A4C,
func_80133784, D_801152A8). R14: THIS — not "pin/asm" as the backlog framed it — was
func_8014E048's real self-containment blocker.
- propagated func_8014E048 (the T5b S11 pins+barrier crack) + func_80157580 ×134;
dedup 1797→1799 groups (0 failed). CLEAN fleet check-all 136/136 BYTE-IDENTICAL (R22).
Fleet byte-identical 65.40% → 65.48%.
find_site + dedup_propagate --recover + build_engine_types fixes, then re-bank
the 13 recover_integration leaf-MATCHes and propagate each across all 134 overlays.
- find_site: match INDENTED inline defs (was column-0 only, silently dropping every
recover_integration-banked def from propagation — T6 blocker 1). Unit-tested:
indented defs match; indented call-exprs (if/assign/bare/return) correctly rejected.
- dedup_propagate --recover: on a straggler byte-gate failure, FIRST no-proto that
overlay's conflicting caller extern + re-gate (Part B, byte-neutral, same lever as
fix_arity_callers --any-proto); else EXCLUDE only that overlay (Part A, ×N-1) rather
than the historical all-or-nothing drop. Wired into gate_stage.
- build_engine_types: comment-aware find_defs/find_typedefs (blank_comments). The
generated header's own "...typedef lift" comment was captured as a bogus `typedef
vec`, self-colliding and blocking every --strip. NOTE: full --strip still conflicts
with the _a/_o0 split files, so split-file overlays need a TARGETED lift.
- banked + propagated 13 fns ×134: func_8014F74C 801542A4 8015BE94 8015F380 80160F00
801653B8 80166244 8016E778 801732C4 8017331C 80173374 80174554 801745AC.
func_8014F74C needed PosT/MoveT lifted to engine_types.h (targeted, byte-neutral).
- dedup 1784→1797 groups (0 failed). CLEAN fleet check-all 136/136 BYTE-IDENTICAL (R22:
make clean && extract-all && check-all). Fleet REAL 224073, byte-identical 65.40%.
R14: the confounding stale-asm/ tree (13 missing .s) that masked the first --recover
test is fixed by re-extract; the 3 pre-existing --auto-from stragglers (0x80174650/
8012A018/80165CA0) are pin/asm + uncaptured-local-macro (SHB) bodies, correctly dropped.
Pre-existing latent breakage (Phase-21 close commit:0292, "+62 PsyQ names"), found during T5b's
R22 fleet verify. A genuinely-clean `make clean` + re-extract + build of `main` failed with
dozens of `can't open asm/nonmatchings/800c3/func_*.s` — clean-rebuild broken since Phase 21,
masked all along by incremental builds reusing stale pre-rename .s/.o (the exact R22 failure mode).
- Root cause (byte-proven): Phase-21 xdedup renamed 62 PsyQ library functions to their proper
names (InitHeap, FlushCache, GetTPage, SysEnqIntRP, SpuWrite, CdMix, __main …) in
symbols.us.txt, but never regenerated/renamed the committed src/*.c stub refs that call them by
the OLD func_<ADDR> name. splat's FRESH regeneration of a stub .c uses the CURATED names (move
src/800c3.c aside -> splat writes INCLUDE_ASM(InitHeap) + emits InitHeap.s); the committed stubs
were simply stale.
- Fix: rename all 62 INCLUDE_ASM(func_<ADDR>) -> the curated name across 12 files (800c.c 1,
800c3.c 22, apicard1/2/4 4/6/2, boot.c 1, libcd1.c 8, libetc.c 6, libgpu.c 3, sgap.c 1,
snd1.c 7, snd2.c 1). Pure rename to match splat's canonical output; byte-neutral.
- VERIFIED: main clean-builds 143dbb89 from a fully clean tree; full clean fleet check-all 136/136.
- Lesson (cookbook): a symbols.us.txt rename must be propagated to (a) shared-macro bodies
(engine_core.h — the T5b GetTPage fix) AND (b) INCLUDE_ASM stub refs (this), AND verified by a
genuinely-clean check-all (make clean + full re-extract), never incremental. Added a lint check.
Both concerns byte-verified from a fully-clean tree (ov_SC01_077 d19c9580, ov_SC07_009 2a6499b6
+ 133 overlays). Fleet is 135/136 — the 1 remaining failure is `main`, a SEPARATE pre-existing
Phase-21 breakage (62 dangling INCLUDE_ASM refs, tracked in CURRENT_PHASE, fix in progress),
NOT introduced by this commit.
[FIX (partial) — pre-existing Phase-21 latent breakage, found during T5b's fleet verify]
- A genuinely-clean `make check-all` failed 135/136 (overlays: `undefined reference to func_80058B40`;
main: dozens of `can't open asm/nonmatchings/800c3/func_*.s`). This commit fixes the OVERLAY side.
- Root cause: Phase-21 xdedup renamed func_80058B40 -> GetTPage in symbols.us.txt (one of the
+62 PsyQ names) but did NOT update the two shared engine_core.h macros that CALL it
(DEFINE_func_80139680, DEFINE_func_8012E28C — in all 134 overlays + ov_SC01_077_a). Since
Phase 21 a clean rebuild couldn't link; incremental builds reused stale .o's and masked it
(the R22 failure mode) — every "check-all 136/136" Phase 21->23 was incrementally-stale.
- Scope = exactly 1 symbol (static scan of all func_/D_ refs in the shared headers vs symbols).
- Fix: rename the 4 occurrences -> GetTPage (byte-neutral, same addr 0x80058b40 -> identical jal;
G6 curated-name). ov_SC07_009 link-fail -> byte-identical 2a6499b6.
- Lesson: a symbols.us.txt rename must be propagated to shared-macro bodies AND verified by a
genuinely clean (make clean + full re-extract) check-all, never incremental.
[FEAT — T5b: the S11 class crack, Fable5 spike]
- The S11 LUID(x)alloc "intrinsic" verdict was MAP-INCOMPLETENESS. func_8014E048 (143 ins,
reach-134; "not source-steerable" since the map wave; 28-off even after T5's directed permuter)
-> MATCH (143/143) -> whole-binary BANKED (ov_SC01_077 d19c9580). Derived by reading gcc-2.7.2
source + RTL dumps (12 experiments .run/gccmap/exp/e1a..e1k.c).
- NEW LEVERS (byte-proven): S12 reused-s32-temp fence (u16 temps DON'T work — combine folds the
unpromoted-HI zext temps away); S13 head-skip escape (body-local param copies conflict-steer the
scratch contest; volatile-asm dead-read wedge fence; multi-input dead-read K2 rebalance);
cse-opaque asm-copy; RC-4b pinned store-temp; RC-10 preference-cascade mechanics.
- Integration reconciles (both T6 classes): engine_core.h caller decl s16*->u16* (codegen-neutral)
+ canonical data decls w/ *(u16*) casts (D_801152A8 u8[] / D_801152AC s16). x134 lift blocked by
dedup_propagate self-containment (pins/asm) -> T6 target (joins func_80132784).
- Distilled (R30/R16): sched.md §6 (S12/S13) + regalloc.md §F (RC-10 + RC-6/S11 downgrade) +
cookbook §31 triage update; backlog re-logged (capped); memory updated.
- cookbook §29: reasoning-model reconciliation idioms (match-pointer-type-to-TU-decl, call-site cast
for value mismatch, cast-a-callee-definition, data-type match) + the narrow-param hard limit
- gen2-mips-matching-model.md + CURRENT_PHASE: Option-3 verdict (GLM reasons the wall expertly but
banks 1/7; wall INTRINSIC, Fable5 §3c triple-confirmed); GLM role = $0.03-0.08/fn hard-band drafter
+ idiom teacher; real lever past the wall = public flip, not a bigger model
- scorecard: original 2026-06-10 scope vs 22 phases of byte-verified reality (what held,
what emerged beyond scope, what deviated and should be revisited)
- adversarial pass: P21 no-shortcut + giant scheduler walls HOLD; P16 loose-typing wall has
a TIMESTAMP GAP (declared 06-19, pre-dating cast_call_sites/block-scope-externs/v3) -> re-test
- July-2026 resources: frontier-on-hard-band (T10.7 re-aim), continuous architect-tier judgment,
RE-ELEVATE THE PUBLIC FLIP (community labor = the only lever that scales into the proven tail)
- strategic fork: posture A/B/C on the byte-match goal; recommends dual-metric (B), Drew's call
- ranked recs 1-6 + explicit endorsements of what not to change
Drew T