- Fable5 subagent cracked func_80166994 (trail/afterimage ring recorder, 369 ins) — FULLY
STRUCTURAL, zero register pins -> swept ×134 CLEAN (exemplar + 133 siblings byte-identical).
R22 clean-fleet 136/136; instr-weighted 56.8% -> 57.2%; distinct-code 27.3% -> 28.2%
- NEW IDIOM cookbook §43: a K&R s16-param DEFINITION dissolves the §17/§29 "narrow-param wall".
On MIPS K&R promotes s16->int (ABI-identical to the canon-sig s32), body keeps the in-place
sll aN,16 narrow/extend the (s16)cast form can't reproduce. void->s32 return-flip pair:
split //@EDIT (self-fn, ov077-specific) + engine_core.h ec_edit ×5 (byte-neutral, callers discard)
- family_sweep --edit-remap: split-edits now OPTIONAL (apply where present, never skip; the
whole-binary byte-gate is the sole arbiter, G3/P9) — a sibling lacking the ov077 canon-sig decl
still banks via ec_edit + body. edit-absent tracked, not skipped
- R14: the prior wave's "@stuck: none — MATCH" note on func_80166994 was STALE/FALSE (re-ran DIFF
366/369). Verify a MATCH claim vs the bytes, never a stale note
- structural cracks are the ×134-SAFE ones (contrast §42e pin-heavy families that cc1-SIGABRT in
sibling TUs). Other 6 giants -> cheap-Opus applying §43+§31, Fable5 only on new-class evidence
- family_sweep.py: new --edit-remap MANIFEST mode (§42e) — per family, symbol-remap the
split-scope //@EDIT old||new per sibling + apply once-global engine_core.h ec_edits
(byte-neutral), stage the family_remap body, gate via harvest_verify (the sole arbiter)
- BANKED 266/266 (0 failed): func_80136824 + func_80136334 (array-decay ptr-flip) ×133
siblings each — full ×134. R22 clean-fleet 136/136, fleet 74.40% -> 74.48%, dedup 1813/0
- R14 FINDING (cookbook §42e addendum + decision-log): the other 4 byte-drift families
(func_80133AB0 zero-reg pin, func_8016DF5C/8013D9B0 GTE-pin, func_80156044 trampoline)
cc1-SIGABRT (Error 134) in the SIBLING TU — hand pins are ov077-TU-context-specific,
NOT mechanically ×134-recoverable; backlogged as ×1/permuter fuel. rtu_match/match_one
are blind here (neutralized/isolation compiles crash too); only make build is truth
- 0 NON_MATCHING in any default build (G4)
- R14 CORRECTION of the prior "family_remap limitation" call: it was a MISDIAGNOSIS. family_remap
succeeds on all droppers; the "remap-fail" family_sweep reports was a mislabeled canon_sig_reconcile
throw ("no definition of func_X found in draft") — the def-finder regex required a leading \n, so a
//@EDIT-stripped raw draft with the fn definition on line 1 was not found.
- FIX: def-finder regex \n -> (?:^|\n) (also match a def at draft start; strictly additive, low-risk).
- Recovered func_8014FE60 fully: 133/133 siblings banked (fix + engine_core.h DEFINE_func_8014FDF4
extern void->s32 global flip, byte-neutral fleet-wide; caller discards return).
- Residual (the genuine, small --edit-remap): func_8016DF5C/80136334/8013D9B0/80156044 reconcile but
byte-drift per sibling (out-of-body fixes: pointer //@EDIT, no-proto, return-flip not carried per sibling).
- cookbook §42e (the two-layer diagnosis + the forward ×134-leverage-realism rule); decision-log corrected.
- R22 clean-fleet 136/136 BYTE-IDENTICAL from a fully clean tree; NON_MATCHING 7 (0 in default build, G4).
- func_80164930 (81 ins) CRACKED + swept x134 = 134 fns (133/0 siblings, family_sweep --reconcile).
The crack = the read-global fix: flip the file-scope decl s16->u16 (byte-neutral to the store-only
caller func_801647A4) + reference the global directly, so the read lowers to direct-addressed `lhu`.
- TWO DURABLE FINDINGS (cookbook §42b):
(1) THE STALE-OBJECT GATE TRAP: a piped `make build >/dev/null` that FAILS leaves a stale .o, and
`asm-differ -o` then reports a phantom score-0. This invalidated wave-2's "iso-drift" labels --
a rigorous re-check (rm .o + build exit-code + real whole-binary SHA) shows all 4 remaining
iso-drift drafts NOCOMPILE (unreconciled callee externs vs the TU canonical-sig layer). Every
gate MUST rm the split .o + check the exit code (compounds the §42a --out gotcha).
(2) canon_sig_reconcile `*(T*)&D_sym` READ-global drift: &sym forces the address into a held register
(kills direct %hi/%lo -> schedule drift); write-only globals unaffected. Fix = file-scope exact-type
decl + direct ref (a block-scoped `extern u16` vs ambient s16 is a hard cc1 conflicting-types error).
- Frontier reassessed: the 9 remaining wave-3 targets each need real-TU reconcile-cracking (NOT gating the
broken wave-2 drafts); each cracks -> ~134 fns (all x134 families). ~1,200 fleet potential.
- R22 clean-fleet 136/136 BYTE-IDENTICAL from a fully clean tree; NON_MATCHING 7 (0 in default build, G4).
- tools/t7_bank.py: the M1 driver (reconcile-at-bank-time against the CURRENT TU + harvest_verify
whole-binary gate; chunk-bet + per-round re-reconcile for cross-fn ambient mutation; giants first)
- canon_sig_reconcile v3.2: uniquify ALL draft-defined type names AND struct/union TAGS to <name>_<addr>
(byte-neutral) -> collision-proof when many exemplars bank into one TU (the 'redefinition of struct Fr'
class); banked func_8016A290 (284-ins giant) + fixed the inter-draft collisions
- 37/40 non-jumptable M1 exemplars banked BYTE-IDENTICAL (ov_SC01_077 d19c9580, clean rebuild); each is
currently ×1 (M2 sweeps them ×134 next)
- R14 CORRECTION (cookbook §41b): the T6 object-only probe OVER-counted BANKABLE by 7 -- it is blind to
rodata + link. (a) 4 jump-table fns (3 _o0 giants + func_8012ACE0): .text byte-perfect but a switch
jump table in rodata diverges -> REFUTES the T6 'Q3 -O0 REFUTED' claim; F-band jump-table workflow.
(b) 3 last-referencer link-walls (func_8016D688/D1D8/165240): C-ifying the only asm referencer of a
scratch data symbol drops splat's auto-symbol -> ld undefined reference; M-linkwall tier, deferred
- ov_SC01_077 REAL 32 stub-exemplars -> 37 more defined; whole binary byte-identical throughout (G3/P9)
- func_80128EA8 + func_80132EC4: h_exact-identical fleet-wide but stub in 100 overlays each; family_remap could not extract them (DEFINE_func macro, not an inline def) so they were T7 remap-fails
- dedup_propagate --addr --tier h_exact instantiates the shared engine_core.h macro at each stub sibling, byte-gated (118 overlays byte-identical per fn)
- R22 clean-fleet 136/136 from clean tree; dedup-check 1813/0; fleet 71.32%->71.36%
- remaining edge cases deferred to Phase 26: 2 h_norm-macro remap-fails (8012A568/80138C30, family_remap can't extract macro bodies), 8013C360 (-O0 cluster)
The family-sweep driver validated end-to-end: remap ov_SC01_077 exemplar -> 133 h_norm-siblings,
plain harvest_verify banked 133/133 byte-identical (0 failed). func_80141100 now matched in all 134
overlays. Added a match_one pre-classify so the full sweep gates only clean drafts (type-using
families -> .run/sweep_deferred.txt for the decl-reconcile pass, avoiding bisection blowup).
- func_801770E0 (152 ins, reach-134) propagated ×134 via dedup_propagate --recover.
Chose the NATIVE DEFINE-macro path over a hand-rolled shared header: func_8014E048
(pins+asm) is already ×134 via a DEFINE macro, proving that path handles pin/asm -O2
giants (the whale needed a shared header only because it is -O0 -> separate object).
Clean fleet check-all 136/136 (R22), dedup-check 1811->1812/0.
- R14: func_8014E048 was ALREADY ×134 (T6 §A) — the whale-session handoff was stale;
only func_801770E0 + func_801372B0 actually remained ×1.
- tooling (reusable): dedup_propagate.overlay_files now also scans the whale-rollout
_o0b/_after splits — post-whale-region fns (func_801770E0 in _after.c) were invisible
for both source-def-find and stub-replacement. func_801770E0 extern block made
contiguous (a comment between externs made find_site drop 5 externs; byte-neutral).
The single biggest byte-weight lever (770 ins ×134 ~ +1.6% byte-weight), banked across all 134
overlays as -O0 compiled C (was ×1 in ov_SC01_077, commit:0463).
- ROLLOUT (tools/rollout_whale_o0.py): per single-file overlay, LINE-split <ov>.c at the whale
(splat emits in vram order), carve the yaml code subseg into before/<ov>_o0b(-O0)/<ov>_after,
thin <ov>_o0b.c #includes the shared src/shared/func_80144B9C.h (the whale C moved there — DRY,
TU-local typedefs, not a fragile 200-line DEFINE_ macro). Makefile WHALE_O0B_OBJS wildcard -O0.
- DEDUP: group E_func_80144B9C (134 members, h_exact 74186b97, source=the header; group_members
keys on binary+vram so a header-share validates like a macro-share).
- MILESTONE: clean fleet check-all 136/136 (R22); dedup-check 1811/0; FLEET REAL 225816->225949,
byte-identical 65.91->65.95% function-count (the gain is byte-weighted). Validated on ov_SC01_000
+ spot-checks SC02/SC03/SC07 before the full fleet.
- cookbook §38 + SETUP inventory.
- CRACK (cheap Opus, no Fable5/calls.c): the 770-ins reach-134 whale's 2-insn residual was a
STRUCT ASSIGN `D_80078E50 = *ent;` (sizeof(ENT)==0x24), NOT an explicit memcpy() call — gcc-2.7.2
-O0 expands a >MOVE_RATIO-word struct copy via emit_block_move->emit_library_call(memcpy),
precomputing dst/src into pseudos then addu into $a0/$a1 = the exact 2 missing moves.
- -O0 SPLIT: whale is a 2nd -O0 region (prologue 21F0A003) in the -O2 'after' segment; carved into
its own -O0 object o0b (splat.ov_SC01_077.yaml 3-way + Makefile CC1FLAGS=-O0; address-sorted
line-split preserves all banked C). ov_SC01_077 == d19c9580.
- memcpy: memcpy=0x8005C324 in symbols.resident.txt (overlays+resident only; main untouched vs its
MEMCPY.o) + __asm__("memcpy") on the engine_core.h block-copy macro (non-builtin C name -> no
built-in codegen, same call).
- MILESTONE: CLEAN fleet check-all 136/136 byte-identical (R22), dedup 1810/0. reach-134 -> ×134 (W9) next.
- R14: diagnosed the prior "×134 BLOCKED / all overlays excluded" by RUNNING it — refuted.
func_80129CF8's ×1 bank was already fleet-canonical; dedup_propagate --recover propagates it
to all 134 overlays byte-identical (no new tool needed). The "wall" was a stale-asm /
incremental-tree artifact (the T5c/T6-§A trap).
- banked ×134 via existing dedup_propagate --recover; clean fleet check-all 136/136,
fleet 64.90→65.52%, dedup 1799→1800/0, 0 NON_MATCHING (G4).
- T7b reframed: the reconcile tool automates the manual decl-reconcile for FRESHLY-matched
giant drafts (the 6 sibling giants + wave tail), not an 'unlock' of already-reconciled giants.
- CURRENT_PHASE: T1 done + the R14 finding logged; plan plan-…mossy-dawn.md (T1-T6).
- Fable5Max cracked func_80129CF8 (191-ins region-a camera giant; match_one MATCH, 0-off): struct-base
hoisting via SOURCE-LOCAL pointers (gcc-2.7.2 has no cross-bb CSE → a callee-saved base can only come
from a local, NO pins), branch-polarity-off-the-opcode, S12 reused-temp fence, expand_block_move
struct-assignment for the grouped copy, dead-local-aggregate for the frame. Distilled → cookbook §32.
- banked ×1 in ov_SC01_077_a.c (d19c9580; clean fleet 136/136) after reconciling its loose-typed decls
(u8[]/s32[]/struct BigCopy/s8-vs-u8; func_80012F74 s16-vs-s32) to canonical + byte-neutral access casts;
RView (GsRVIEW2-shaped 32B) lifted to engine_types.h.
- FINDING (byte-proven): ×134 propagation is BLOCKED by the fleet-wide loose-typing wall — the giant's
shared callees/data are declared incompatibly across overlays, so the macro's externs conflict per
overlay (dedup_propagate --recover only fixes the propagated fn's CALLER extern, not its callee/data).
Unlike the flagship func_80132784 (compatible → ×134), loose-typed giants bank ×1, not ×134.
- Drew's call (A, invest): build the fleet-wide canonical-decl reconcile tool = the ×134 giant unlock.
Spec + conflict taxonomy + byte-neutral cast patterns: docs/canonical-decl-reconcile-design.md.
- clean fleet check-all 136/136 BYTE-IDENTICAL (R22). No new governance rules.
- find_site extern-collection: allow a trailing `/* comment */` after the `;`. The
comment-blind regex `^\s*extern\b.*;\s*$` stopped the backward scan at
`extern u8 D_801152A8[]; /* canonical TU type */`, dropping every EARLIER extern →
compiles_standalone failed on the now-undeclared callees/data (func_80135A4C,
func_80133784, D_801152A8). R14: THIS — not "pin/asm" as the backlog framed it — was
func_8014E048's real self-containment blocker.
- propagated func_8014E048 (the T5b S11 pins+barrier crack) + func_80157580 ×134;
dedup 1797→1799 groups (0 failed). CLEAN fleet check-all 136/136 BYTE-IDENTICAL (R22).
Fleet byte-identical 65.40% → 65.48%.
find_site + dedup_propagate --recover + build_engine_types fixes, then re-bank
the 13 recover_integration leaf-MATCHes and propagate each across all 134 overlays.
- find_site: match INDENTED inline defs (was column-0 only, silently dropping every
recover_integration-banked def from propagation — T6 blocker 1). Unit-tested:
indented defs match; indented call-exprs (if/assign/bare/return) correctly rejected.
- dedup_propagate --recover: on a straggler byte-gate failure, FIRST no-proto that
overlay's conflicting caller extern + re-gate (Part B, byte-neutral, same lever as
fix_arity_callers --any-proto); else EXCLUDE only that overlay (Part A, ×N-1) rather
than the historical all-or-nothing drop. Wired into gate_stage.
- build_engine_types: comment-aware find_defs/find_typedefs (blank_comments). The
generated header's own "...typedef lift" comment was captured as a bogus `typedef
vec`, self-colliding and blocking every --strip. NOTE: full --strip still conflicts
with the _a/_o0 split files, so split-file overlays need a TARGETED lift.
- banked + propagated 13 fns ×134: func_8014F74C 801542A4 8015BE94 8015F380 80160F00
801653B8 80166244 8016E778 801732C4 8017331C 80173374 80174554 801745AC.
func_8014F74C needed PosT/MoveT lifted to engine_types.h (targeted, byte-neutral).
- dedup 1784→1797 groups (0 failed). CLEAN fleet check-all 136/136 BYTE-IDENTICAL (R22:
make clean && extract-all && check-all). Fleet REAL 224073, byte-identical 65.40%.
R14: the confounding stale-asm/ tree (13 missing .s) that masked the first --recover
test is fixed by re-extract; the 3 pre-existing --auto-from stragglers (0x80174650/
8012A018/80165CA0) are pin/asm + uncaptured-local-macro (SHB) bodies, correctly dropped.
The 400-ins giant func_80132784 (S11 prologue-weave; cracked T4, banked ×1) is now shared across
ALL 134 overlays byte-identical — the highest single byte-weight lever in the project.
- Blocker (T4-deferred): dedup_propagate's single-`--addr` plan is all-or-nothing; ONE straggler
overlay (ov_SC02_005) failed to compile the shared macro -> the whole fn dropped, kept ×1.
- Root cause: ov_SC02_005 declared a CONFLICTING caller extern `void func_80132784(s32,s32,s32)`
while the def is `(s32,s32,u32)` (3rd param s32 vs u32) -> `conflicting types`. The call site
casts `((void(*)(u8*,u8*,u16))func_80132784)(...)` so the extern type is codegen-irrelevant.
- Fix (T6 integration-recovery pattern, proven): reconcile the straggler's caller extern to the
def's canonical signature (s32->u32, byte-neutral), then propagate. dedup_propagate then rebuilt
all 134 overlays BYTE-IDENTICAL; registered group E_func_80132784 (134 members).
- dedup-check: 1784 validated, 0 failed. Verified by a clean R22 fleet check-all (136/136).
- This is the concrete spec for the T6 tool: detect a straggler's conflicting caller decl,
reconcile to the def's canonical sig, re-gate, propagate full (vs. the all-or-nothing drop).
Pre-existing latent breakage (Phase-21 close commit:0292, "+62 PsyQ names"), found during T5b's
R22 fleet verify. A genuinely-clean `make clean` + re-extract + build of `main` failed with
dozens of `can't open asm/nonmatchings/800c3/func_*.s` — clean-rebuild broken since Phase 21,
masked all along by incremental builds reusing stale pre-rename .s/.o (the exact R22 failure mode).
- Root cause (byte-proven): Phase-21 xdedup renamed 62 PsyQ library functions to their proper
names (InitHeap, FlushCache, GetTPage, SysEnqIntRP, SpuWrite, CdMix, __main …) in
symbols.us.txt, but never regenerated/renamed the committed src/*.c stub refs that call them by
the OLD func_<ADDR> name. splat's FRESH regeneration of a stub .c uses the CURATED names (move
src/800c3.c aside -> splat writes INCLUDE_ASM(InitHeap) + emits InitHeap.s); the committed stubs
were simply stale.
- Fix: rename all 62 INCLUDE_ASM(func_<ADDR>) -> the curated name across 12 files (800c.c 1,
800c3.c 22, apicard1/2/4 4/6/2, boot.c 1, libcd1.c 8, libetc.c 6, libgpu.c 3, sgap.c 1,
snd1.c 7, snd2.c 1). Pure rename to match splat's canonical output; byte-neutral.
- VERIFIED: main clean-builds 143dbb89 from a fully clean tree; full clean fleet check-all 136/136.
- Lesson (cookbook): a symbols.us.txt rename must be propagated to (a) shared-macro bodies
(engine_core.h — the T5b GetTPage fix) AND (b) INCLUDE_ASM stub refs (this), AND verified by a
genuinely-clean check-all (make clean + full re-extract), never incremental. Added a lint check.
Both concerns byte-verified from a fully-clean tree (ov_SC01_077 d19c9580, ov_SC07_009 2a6499b6
+ 133 overlays). Fleet is 135/136 — the 1 remaining failure is `main`, a SEPARATE pre-existing
Phase-21 breakage (62 dangling INCLUDE_ASM refs, tracked in CURRENT_PHASE, fix in progress),
NOT introduced by this commit.
[FIX (partial) — pre-existing Phase-21 latent breakage, found during T5b's fleet verify]
- A genuinely-clean `make check-all` failed 135/136 (overlays: `undefined reference to func_80058B40`;
main: dozens of `can't open asm/nonmatchings/800c3/func_*.s`). This commit fixes the OVERLAY side.
- Root cause: Phase-21 xdedup renamed func_80058B40 -> GetTPage in symbols.us.txt (one of the
+62 PsyQ names) but did NOT update the two shared engine_core.h macros that CALL it
(DEFINE_func_80139680, DEFINE_func_8012E28C — in all 134 overlays + ov_SC01_077_a). Since
Phase 21 a clean rebuild couldn't link; incremental builds reused stale .o's and masked it
(the R22 failure mode) — every "check-all 136/136" Phase 21->23 was incrementally-stale.
- Scope = exactly 1 symbol (static scan of all func_/D_ refs in the shared headers vs symbols).
- Fix: rename the 4 occurrences -> GetTPage (byte-neutral, same addr 0x80058b40 -> identical jal;
G6 curated-name). ov_SC07_009 link-fail -> byte-identical 2a6499b6.
- Lesson: a symbols.us.txt rename must be propagated to shared-macro bodies AND verified by a
genuinely clean (make clean + full re-extract) check-all, never incremental.
[FEAT — T5b: the S11 class crack, Fable5 spike]
- The S11 LUID(x)alloc "intrinsic" verdict was MAP-INCOMPLETENESS. func_8014E048 (143 ins,
reach-134; "not source-steerable" since the map wave; 28-off even after T5's directed permuter)
-> MATCH (143/143) -> whole-binary BANKED (ov_SC01_077 d19c9580). Derived by reading gcc-2.7.2
source + RTL dumps (12 experiments .run/gccmap/exp/e1a..e1k.c).
- NEW LEVERS (byte-proven): S12 reused-s32-temp fence (u16 temps DON'T work — combine folds the
unpromoted-HI zext temps away); S13 head-skip escape (body-local param copies conflict-steer the
scratch contest; volatile-asm dead-read wedge fence; multi-input dead-read K2 rebalance);
cse-opaque asm-copy; RC-4b pinned store-temp; RC-10 preference-cascade mechanics.
- Integration reconciles (both T6 classes): engine_core.h caller decl s16*->u16* (codegen-neutral)
+ canonical data decls w/ *(u16*) casts (D_801152A8 u8[] / D_801152AC s16). x134 lift blocked by
dedup_propagate self-containment (pins/asm) -> T6 target (joins func_80132784).
- Distilled (R30/R16): sched.md §6 (S12/S13) + regalloc.md §F (RC-10 + RC-6/S11 downgrade) +
cookbook §31 triage update; backlog re-logged (capped); memory updated.
- GLM deep-solved 15 fresh 25-118-ins hard fns: 4/15 match_one, 2 whole-binary banks (func_8017DE28,
func_8015EEE0), $2.00. def-side wall caps the other 2 correct bodies.
- IDIOM VERDICT (Drew's fair test): GLM's correct bodies reason about KNOWN gcc mechanics (delay slots,
callee-saved $s0, reload-after-call aliasing, switch jump tables) — cookbook §10/§17/jump-table.
NO new idiom. The quirk space is largely mapped (22 phases of Opus-Max mining). Well DRY confirmed
from BOTH angles: failed-residual (T10.8) AND fresh-hand-solve (T10.9).
- tools/glm_reconcile.py (NEW): aim GLM's reasoning at the DEF-side loose-typing wall (body + conflicting
TU decls + reconciliation toolkit -> consistent buildable byte-identical decls); captures reasoning
(.run/glm_reason/, idiom source R16); relax-in-any-TU-file + crash-robust call
- api_draft: REASON=1 saves the reasoning trace per draft (idiom mining on any GLM run)
- fix_arity_callers: --any-proto (relax any prototype, not just (void))
- RESULT: GLM's reasoning is expert-level (store-width/sh-vs-sw awareness, K&R promotion, independently
derives the cast idiom) but banks only 1/7 reconciliations; mechanical relaxation 0/7. The def-side
wall is INTRINSIC (narrow-param + byte-level addressing defeat reconciliation) — Fable5 §3c re-test
CONFIRMS the wall holds even vs a frontier reasoning model aimed directly at it. func_80175184 banked,
check-all 136/136
- def-side conflict (engine_core.h forward-declared func_801577C8(void) vs GLM's byte-correct
(s32) def) resolved by relaxing the caller decl to no-proto; strip GLM externs + gate. 136/136.
- FINDING: only +1 of 8 stranded recovers mechanically; the other 7 are the intrinsic Phase-16/20
DEF-side loose-typing wall (5 have non-(void) conflicting forward-decls, 1 narrow-param) — the
wall caps ANY drafter, not a v3-tuning artifact (Fable5 review §3c re-test: wall HOLDS)
Drew T