Stage 0a's first defect, and the largest single zero-token bank of the session.
family_remap's kind test asked ONE question — is this address a function in the SIBLING'S OWN sig?
— and defaulted to `D_` on "no". But a body calls outside its image constantly: an overlay calls
resident helpers, an md_* module calls the overlay-range engine. Those addresses are absent from
the sibling's sig, so the test fell through and emitted a DATA NAME FOR A FUNCTION —
`D_800183E0`, `D_800D1EBC`, `D_80171A1C`. None exist anywhere in src/ or config/symbols.us.txt,
while `func_80171A1C` alone has 1,061 references. Measured: 611 member-rows across 45 symbols,
the largest named residue class. "Not in MY sig" means "not mine", not "is data".
Fix — three oracles, strongest first, never a blanket fallback:
1. the sibling's own sig (authoritative for its image; this is what preserves the Phase-29 T82
case where a slot is a function in the exemplar and DATA in the member — unioning every sig
would have re-broken the 251 members T82 fixed),
2. the always-linked images via extern_fn_addrs() — resident + main, 2,146 addresses whose ranges
cannot collide with an overlay's,
3. the exemplar reached it by `jal` — a call target is a function BY DEFINITION, which covers an
external address neither sig claims (0x80171A1C from an md_* module, 112 rows).
Only a non-call reloc no oracle claims still falls to `D_`.
Result: BANKED 205 member-matches, failures 670 -> 575, derived net = report = 205.
R22 clean-fleet 213 passed / 0 failed of 213.
Fleet 94.4% instr / 88.3% distinct / 96.27 -> 96.33% fn-count; stubs 13,563 -> 13,345.
THE RESIDUE HAS CROSSED OVER: DIFF is now the LARGEST class at 143 of 575 — real byte divergence
outranks plumbing for the first time this session (undefined-ref 611 -> ~8, PLUMBING-other
231 -> 81). The ~5:1 plumbing:DIFF ratio that justified "tooling beats volume" has inverted in this
queue, exactly as the frontier analysis predicted: the declaration-axis vein was one-time.
The new head class is `conflicting types for func_80175414` (27) — the same addresses this fix
started naming correctly, now surfacing the NEXT layer (the symbol resolves; its declared signature
disagrees). That is the conform axis, not the remap axis.
Note for anyone auditing this class: rtu_match MASKS HI16/LO16, so a wrong %hi/%lo symbol still
reports MATCH (the T82 comment records `MATCH (10 ins)` on a member the fleet gate refused). This
defect is invisible to the per-function tool by construction — only the whole-binary gate sees it.
The 10 exemplars from W1 flipped modal -> matched in the regenerated map, so family_sweep could
template them. 9 non-jr families swept: BANKED 140 member-matches / 32 failed across 50 overlays.
Derived net = report = 140 (no untracked carve files this time, so the two counts agree).
R22 clean-fleet: check-all 213 passed / 0 failed of 213.
Fleet 94.3 -> 94.4% instr / 88.2 -> 88.3% distinct / 96.22 -> 96.27% fn-count; stubs 13,713 -> 13,563.
WAVE ONE, FULLY ACCOUNTED: 10 agent cracks + 140 templated members = 150 functions for 1.36M
tokens (~9k tokens/function). Still owed from this wave: 73 member-slots in 2 NEAR families,
34 in 3 rate-limited targets, 9 in the jr family (routes to jtbl_family_bank, §53).
TWO MEASUREMENTS THAT CORRECT MY OWN FORECASTS (R14):
1. Conversion was 81%, not the 58% I projected from this morning's propagation run. Today's
plumbing fixes (alias-drop, cpp-derived TU type map, group-level draft-vs-draft aliasing) are
paying off in a population they were not tuned for.
2. The effective multiplier was 15x, not the 2-3.5x I predicted. That estimate used the MEAN
family size across the whole zero-crack pool (3.55); this wave deliberately targeted the TOP of
the reach distribution, where families run 10-28 members. Ordering waves by reach is what
produced the difference — the mean was the wrong statistic for a wave that selects on the tail.
The regen step is load-bearing and now byte-proven twice: a fresh crack reads as `modal` until sigs
+ family_hseq are rebuilt, and family_sweep templates only from `matched`. Skipping it sweeps a
stale map and the multiplier evaporates (the Phase-26 finding, whose surviving qualifier is that
remap works BEHIND a fresh crack).
- slot A 29/29 (md_MAIN_013..041 @ 0x800CAE08), slot B 6/6 (md_MAIN_042..047 @ 0x800CCB1C),
boot trio 3/3 (md_MAIN_001 [=MAIN/0 twin], md_MAIN_008, md_MAIN_011 @ 0x800CEDF8) — every one
BYTE-IDENTICAL on its FIRST build (byte-corroborating the §S44 loader table for slots A/B/boot)
- TLO roster derived from the §154 id-word law (.run/s45/derive_tlo.py): 0x4 default;
011=0x7C, 025=0xC, 034=0x80, 039=0xC (first-prologue scan)
- new_binary.sh: module hdr carve is now a dot-typed .rodata PAIRED with the c segment —
a header can hold a function's jump table (md_MAIN_034), and standalone rodata emits
.L locals that don't cross objects; bin links in the data block (both refuted by bytes)
- A4 law: symbols.resident.txt dropped from the boot trio's stacks (windows inside the
resident region; DsMix @0x800D1BD8 had minted a phantom fn boundary in md_MAIN_011) —
re-extracted clean, all three byte-identical, phantom gone
Drew T