- profiled the clean-fleet R22: extract-all ~6m11s (136 serial `splat split`) + check-all
~2m58s (136 serial builds) = ~9 min, all serial on a 32-core box
- the only shared WRITE is the 4 generated include/*.inc macros at extract time (identical
content per binary); everything else is per-binary-disjoint and include/ is read-only during
a build -> concurrent builds/extracts don't race
- Makefile: JOBS ?= 16 + `make extract-all` (seed main serial for the macros, then parallel-
extract the rest via xargs -P) + parallel `make check-all` (xargs -P), correctness-gated
- MEASURED: `make clean && make extract-all && make check-all` = ~50s, check-all 136/136
BYTE-IDENTICAL (== the serial result) -> ~10.5x. Compounds across the endgame (R22 per commit)
- new R22 recipe: `make clean && make extract-all && make check-all` (was the serial for-loop)
- the jr-function ×134 harvest pipeline, proven end-to-end: per family sibling,
jtbl_carve (per-sibling jtbl-rodata carve, computed from THAT sibling's own jtbl
address — the fn is at the same vram across overlays but its jtbl floats) -> make
extract (auto ld_interleave) -> remap_hseq + canon_sig_reconcile -> whole-binary gate
- tools/jtbl_carve.py: per-overlay §8 carve generator (config data-tail split +
<ov>_JTBL_INTERLEAVE var)
- tools/jtbl_family_bank.py: the sibling sweep driver (idempotent, revert-on-fail, byte-gated)
- tools/family_remap.py: extract_unit now carries single-line typedefs (jr-function bodies
define local `typedef struct{} Foo_<addr>;` that must template with the body — the
propagation cap for these; additive, byte-gate-protected)
- func_8012ACE0 family: 133/133 siblings BANKED, 0 failures; R22 clean-fleet 136/136
byte-identical; 0 NON_MATCHING (G4)
- metrics: distinct-code 39.1% (50,698 unique fns), instr-weighted 63.0%
- opportunity (has_mid_jr families): 237 total (5,805 members) = 46 small mid/tiny
(771 members, same mechanical pipeline) + 191 substantial (the Fable5 cores, Task 7 paused)
- NEXT: R22 profiling/parallelization; then the other 45 small jr families
- overlay jr-functions can now bank as C: gcc switch jump tables form a .rodata island at
the overlay TAIL; carve a matched fn's jtbl into a dotted [.rodata, <code-subseg>] subseg
+ ld_interleave (data->rodata->data sandwich) places it byte-exact. cookbook §8a + SETUP.
- tools/ld_interleave.py: --section .<binary> param (derives the <binary>_TEXT/DATA/RODATA/
DATA2/BSS symbol prefix); default .main = the EXE, byte-identical (backward-compat proven)
- Makefile + config/overlays.mk: <bin>_JTBL_INTERLEAVE hook + a $(strip)-guarded extract
branch (gotcha caught: a trailing #comment on the := left whitespace -> non-empty -> the
branch misfired on resident with the EXE defaults)
- PoC: func_8012ACE0 (25-ins jr-fn in ov_SC01_077) reconciled (canon_sig_reconcile) + banked
BYTE-IDENTICAL d19c9580 -- the first overlay jr-function matched through the C pipeline
- R22 FULL-FLEET clean rebuild: 136 passed, 0 failed (main 143dbb89 unaffected by the
ld_interleave change); 0 NON_MATCHING in any default build (G4)
- P9 findings: func_80159C84/func_8015444C (the 2 carried Fable5 jr bodies) are rtu_match
FALSE-matches (incomplete jtbls: 52B vs 56B -> never bank); the maspsx "hang" scare was a
truncated experimental-file artifact (real pipeline builds in ~1s)
- metrics: distinct-code 39.1% (50,572 unique fns), instr-weighted 62.9%
- NEXT: the ×134 automation (generate the per-overlay carve + template the reconciled body)
Comprehensive CURRENT_PHASE handoff for a fresh session: committed baseline commit:0528 (729 banks, R22
136/136); the h_seq engine + reconcile-raw tooling map; the mid-band harvest in flight (~2477+ banked,
uncommitted -> R22 + commit next); the two harvest gaps (§8 jtbl-rodata [Drew-approved] + reconcile
fn-ptr-extern); the Fable5 rtu_match-vs-whole-binary finding (no more Fable5 until re-approval); and the
mechanical next-steps priority order. R30 knowledge capture before context handoff.
- +266 member-matches: func_8015CD20/func_8015C128 templated x133 via --reconcile-raw (each SHA-gated
per-overlay vs config/check.<ov>.sha = byte-identical, G3). Full R22 deferred until func_80176218
releases asm/ (established per-overlay-gate + deferred-R22 pattern, as the committed 463 which R22'd 136/136).
- family_sweep: --reconcile-raw now also covers draft-ov077 (unbanked) cracks (template from the RAW seed).
- P9 CORRECTION + decision-log 2026-07-12: the 2 Fable5 cracks rtu_match-MATCH but FAIL the whole-binary
gate (both jr-functions; rtu_match masks relocs + excludes neutralized INCLUDE_ASM rodata, so it never
verifies the §8 jtbl rodata). TWO harvest gaps: §8 jtbl-rodata (blocks all jr cracks) + reconcile
data-extern (D_801891B8-class, blocks ~15/21 no-jtbl triage cracks). 6 no-jtbl reconcile-clean cracks
bank whole-binary (729 members). rtu_match is NOT a sufficient arbiter for jr-functions.
- BUILT the per-sibling reconcile: family_remap.remap_hseq_body (h_seq-remap a RAW crack draft: symbol +
immediate + cross-address self-rename) + family_sweep.reconcile_remap_hseq + --reconcile-raw. Per sibling,
remap the RAW crack then canon_sig_reconcile against that sibling's own TU (the h_seq port of the h_norm
M2 path) — because a reconciled body is TU-specific and can't template plainly (validation: 0/4).
- HARVEST: the 4 triage isolation-cracks (func_80155800/80167540/801506A4/8016A73C) templated 463/0 x~133
via --reconcile-raw (0 failures). Metrics: instr 58.5->58.9%, distinct 30.9->31.1%.
- each overlay SHA-gated by harvest_verify vs config/check.<ov>.sha (byte-identical = the match def, G3).
FULL R22 clean-fleet DEFERRED until the concurrent Fable5 crack agents release asm/ (their m2c needs it);
R22 fleet-confirm to follow post-window.
- cookbook §40c (the h_seq per-sibling reconcile technique, R30).
- pre-Fable5-window de-risk (Drew): validate reconcile→gate→template on the triage cracks before the window.
- reconcile→bank WORKS: raw 0/23 (§41 def-side wall) -> canon_sig_reconcile v3.2 -> 4/15 banked into ov077
(func_801506A4/8016A73C/80167540/80155800), byte-identical, R22 clean-fleet 136/136.
- templating a RECONCILED body x133 FAILS 0/4: reconciled bodies are ov077-TU-specific (canonical-sig casts
+ collision-renames) -> need per-sibling re-reconcile (§41c). Task-8 prerequisite: port the h_norm
--reconcile M2 path into hseq_sweep so the type-using families (triage cracks + the 61 Fable5 cores) can
template x134. PURE families already template plainly (Task 5: 399 banked).
- decision-log 2026-07-11: the slice paid for itself — found the templating gap BEFORE spending the window.
Paused before building the wiring per Drew.
- full triage complete: cheap 29 (23 closeness-0 isolation-MATCH) / permuter 29 / fable5 61 (1.71M ins).
- attempted to bank the 23 cracked wins into ov077 -> 0/23: the match_one isolation-MATCHes are genuine
function matches but carry standalone struct/scalar typedefs + Ghidra-typed sigs that conflict with the
real ov077 TU (redefinition of struct Obj / conflicting types) = the §41 def-side wall. Banking needs
the Task-8 --reconcile / canon_sig_reconcile pass (not run — paused before Task 8 per Drew).
- docs/phase26-triage.md carries the crack curriculum + the caveat; seeds in .run/phase26-seeds/.
- src pristine, ov077 byte-identical.
- remap_hseq.gather_externs: carry file-scope externs for body-referenced symbols (extract_unit only
grabbed adjacent ones) — the decl class that blocked per-location bodies indexing a global. func_8015F118
gate-fail -> BYTE-IDENTICAL; the 3 tracker-miss PURE families then bank 133/133 each.
- ran the real whole-binary byte-gate on the 29 substantial matched-exemplar families:
532 members BANKED (byte-gated). Per-family: 3 tracker-miss PURE (0x8015d5e8/0x8015f118/0x801407f4)
bank 100% x133 = 399 byte-perfect (the tracker-fix free win); 1 cross-addr family 50%; 9 zero-bank
families are type-using (Work8016/Prim/...) -> the existing --reconcile/type-lift follow-on (Task 8);
16 families pinned -> Task 7 pin-free re-crack.
- VERDICT: the h_seq machinery (tracker + imm + cross-address + extern-carry) is byte-proven 100% correct
on clean families. GO to scale.
- R22 clean-fleet: make clean + extract-all-136 + check-all = 136 passed, 0 failed. 0 NON_MATCHING (G4).
Metrics: distinct-code 30.3->30.9% (+375 fns), instr-weighted 58.2->58.5%.
- decision-log 2026-07-11 (R31: stratify a mechanical-harvest rate by family/class before judging it).
- Fable5 subagent cracked func_80166994 (trail/afterimage ring recorder, 369 ins) — FULLY
STRUCTURAL, zero register pins -> swept ×134 CLEAN (exemplar + 133 siblings byte-identical).
R22 clean-fleet 136/136; instr-weighted 56.8% -> 57.2%; distinct-code 27.3% -> 28.2%
- NEW IDIOM cookbook §43: a K&R s16-param DEFINITION dissolves the §17/§29 "narrow-param wall".
On MIPS K&R promotes s16->int (ABI-identical to the canon-sig s32), body keeps the in-place
sll aN,16 narrow/extend the (s16)cast form can't reproduce. void->s32 return-flip pair:
split //@EDIT (self-fn, ov077-specific) + engine_core.h ec_edit ×5 (byte-neutral, callers discard)
- family_sweep --edit-remap: split-edits now OPTIONAL (apply where present, never skip; the
whole-binary byte-gate is the sole arbiter, G3/P9) — a sibling lacking the ov077 canon-sig decl
still banks via ec_edit + body. edit-absent tracked, not skipped
- R14: the prior wave's "@stuck: none — MATCH" note on func_80166994 was STALE/FALSE (re-ran DIFF
366/369). Verify a MATCH claim vs the bytes, never a stale note
- structural cracks are the ×134-SAFE ones (contrast §42e pin-heavy families that cc1-SIGABRT in
sibling TUs). Other 6 giants -> cheap-Opus applying §43+§31, Fable5 only on new-class evidence
- family_sweep.py: new --edit-remap MANIFEST mode (§42e) — per family, symbol-remap the
split-scope //@EDIT old||new per sibling + apply once-global engine_core.h ec_edits
(byte-neutral), stage the family_remap body, gate via harvest_verify (the sole arbiter)
- BANKED 266/266 (0 failed): func_80136824 + func_80136334 (array-decay ptr-flip) ×133
siblings each — full ×134. R22 clean-fleet 136/136, fleet 74.40% -> 74.48%, dedup 1813/0
- R14 FINDING (cookbook §42e addendum + decision-log): the other 4 byte-drift families
(func_80133AB0 zero-reg pin, func_8016DF5C/8013D9B0 GTE-pin, func_80156044 trampoline)
cc1-SIGABRT (Error 134) in the SIBLING TU — hand pins are ov077-TU-context-specific,
NOT mechanically ×134-recoverable; backlogged as ×1/permuter fuel. rtu_match/match_one
are blind here (neutralized/isolation compiles crash too); only make build is truth
- 0 NON_MATCHING in any default build (G4)
- R14 CORRECTION of the prior "family_remap limitation" call: it was a MISDIAGNOSIS. family_remap
succeeds on all droppers; the "remap-fail" family_sweep reports was a mislabeled canon_sig_reconcile
throw ("no definition of func_X found in draft") — the def-finder regex required a leading \n, so a
//@EDIT-stripped raw draft with the fn definition on line 1 was not found.
- FIX: def-finder regex \n -> (?:^|\n) (also match a def at draft start; strictly additive, low-risk).
- Recovered func_8014FE60 fully: 133/133 siblings banked (fix + engine_core.h DEFINE_func_8014FDF4
extern void->s32 global flip, byte-neutral fleet-wide; caller discards return).
- Residual (the genuine, small --edit-remap): func_8016DF5C/80136334/8013D9B0/80156044 reconcile but
byte-drift per sibling (out-of-body fixes: pointer //@EDIT, no-proto, return-flip not carried per sibling).
- cookbook §42e (the two-layer diagnosis + the forward ×134-leverage-realism rule); decision-log corrected.
- R22 clean-fleet 136/136 BYTE-IDENTICAL from a fully clean tree; NON_MATCHING 7 (0 in default build, G4).
- func_80164930 (81 ins) CRACKED + swept x134 = 134 fns (133/0 siblings, family_sweep --reconcile).
The crack = the read-global fix: flip the file-scope decl s16->u16 (byte-neutral to the store-only
caller func_801647A4) + reference the global directly, so the read lowers to direct-addressed `lhu`.
- TWO DURABLE FINDINGS (cookbook §42b):
(1) THE STALE-OBJECT GATE TRAP: a piped `make build >/dev/null` that FAILS leaves a stale .o, and
`asm-differ -o` then reports a phantom score-0. This invalidated wave-2's "iso-drift" labels --
a rigorous re-check (rm .o + build exit-code + real whole-binary SHA) shows all 4 remaining
iso-drift drafts NOCOMPILE (unreconciled callee externs vs the TU canonical-sig layer). Every
gate MUST rm the split .o + check the exit code (compounds the §42a --out gotcha).
(2) canon_sig_reconcile `*(T*)&D_sym` READ-global drift: &sym forces the address into a held register
(kills direct %hi/%lo -> schedule drift); write-only globals unaffected. Fix = file-scope exact-type
decl + direct ref (a block-scoped `extern u16` vs ambient s16 is a hard cc1 conflicting-types error).
- Frontier reassessed: the 9 remaining wave-3 targets each need real-TU reconcile-cracking (NOT gating the
broken wave-2 drafts); each cracks -> ~134 fns (all x134 families). ~1,200 fleet potential.
- R22 clean-fleet 136/136 BYTE-IDENTICAL from a fully clean tree; NON_MATCHING 7 (0 in default build, G4).
- batch-3: the 3 _o0 giants 3/3 isolation-MATCH at -O0 (new tools/match_one.py --o0 flag);
0 banked — an -O0 in-context byte-diff (canon_sig_reconcile's void->s32 is NOT byte-neutral
at -O0) -> deferred to T7. Frontier 125/127 draftable exemplars measured.
- R14 correction: the mechanical reconcile-sweep is NOT the clean 51-target x134 win first
hoped. The frontier "match" status carried un-verified agent claims (5-sample spot-check
= 3/5 genuine); ~19/51 have clean engine_core.h canonicals (the reliable canon_sig_reconcile
tier), the rest hit VARIED walls (callee-sig conflicts, non-identical types Vec3/SVEC,
macro-local data) -> this is the genuine Fable5/T6 residual, not a mechanical sweep.
- docs/phase25-t6-fable-brief.md: the grounded Step-B input package for the fresh Fable5Max
session to author the crack curriculum (95-stub worklist by wall-class + tools + 5 swing
questions). CURRENT_PHASE: T6 hand-off (fresh session, Fable5Max, read the brief). Phase OPEN.
- A/B gate-true: v4 <= v3 (marginally worse on medium, tie easy/hard) -> discard v4, keep v3 (frozen ceiling)
- 'corpus quality > size' confirmed; 7B is capacity-bound (0/5 even on trained fns, not truncation)
- decision-log (R31): the local-7B tier is off the endgame critical path; engine = frontier-crack -> deterministic-propagate -> byte-gate + permuter
- gen2-mips-matching-model: the A/B + the maxlen-2048 truncation flaw (drop-over-length OR grad-checkpointing, NOT CPU offload) for any future retrain
- CURRENT_PHASE: T4 done/failed; NEXT = T5 (Ultracode measure-wave); phase OPEN, no PhaseEnd
Swing question resolved. h_norm families are byte-shattered by PER-OVERLAY symbols, so free
--tier h_norm dedup fails (0/133 on 0x80141100). BUT the mechanical remap works: disassemble
two h_norm-identical members, positionally pair their reloc targets, substitute the exemplar
per-overlay symbol names -> the sibling C. Verified: reloc decoder 22/22 vs .s; 0x80141100->
ov_SC01_000 whole-binary byte-identical + harvest_verify banked; 12/12 siblings; 7/9 families
x3 = 21/27 match_one. The 2 fails = decl/type plumbing (T7 refinement), not remap fails.
Reshapes the endgame: crack ONE exemplar/family -> remap+gate members (~0 tokens/member); the
11.1 MB is cheaply mechanical. Members no longer need drafting; only exemplars do.
recover_integration split-awareness landed at commit:0470. --auto --limit 20 banked 0/16:
the closeness-0 caller-arity cohort is exhausted (Phase 24 got the cheap ones). Residuals
are per-function TU-context matching (8-byte struct-assign lowers to a memcpy CALL in a TU
that declares memcpy -> byte mismatch; use explicit memcpy()/lhu-sh, the sibling convention).
Drew: conclude T1, residuals backlogged, proceed to T2 (the structural-family lever).
Drew T