- family_hseq: widened from src/ov_*+sig.ov_* to every non-main binary (resident + md_*); the map
now carries 139 binaries incl. resident (was overlays-only — which is exactly why the R36 gate's
CHECK 4 could never see them). Self-count uses the SAME widened globs (cannot drift).
- progress --weighted :647 + audit_frontier :57: + sig.md_* globs.
- corpus.sig_is_independent: md_* sigs are sig_image-signed => independent (R34 trust).
- backlog alias regex + prefetch_fleet (md_* derived from splat configs) + dedup_propagate
(reads modules.mk alongside overlays.mk — excluding modules would re-create the SC07
invisible-work bug one class over).
- VERIFIED: family map regenerated with resident (139 binaries); audit-binaries OK over 140;
all six tools parse.
Drew asked whether we should build a master list of all funcs, a banked list, and a
MASTER_REMAINING = total - banked that we hand-edit on every bank. Assessment in
docs/decision-log.md (2026-08-04): ADOPT THE GOAL, REJECT THE MECHANISM.
The triple already exists and is DERIVED, not maintained:
total = .run/sig.*.jsonl (sig_image over the ORIGINAL bytes, independent of splat)
banked = sig - stubs (INCLUDE_ASM pastes the original asm => not-wrapped == byte-exact)
remaining = corpus.stubs() (filesystem-derived, coverage-asserted)
and "remove it when we bank it" already happens -- banking IS deleting the INCLUDE_ASM line. A
hand-maintained file would drift SILENTLY and flatteringly, which is the exact failure R33 exists
for (fuel_manifest recorded 130 live stubs when the truth was 30, hiding 91.6% of remaining gain).
What was genuinely missing is CROSS-ASSERTION. Six artifacts answer "what's left" -- corpus.stubs,
worklist, backlog, family_hseq, fuel_manifest, progress.fleet -- each individually derived, none
ever compared to the others. That is what cost P30 T0 a hand-reconciliation (family_hseq 29,961 vs
progress.py 28,296). R34: not a better assertion inside one oracle, but a second one that can argue.
tools/audit_frontier.py takes corpus.stubs as the reference and checks every other view against it:
rows/targets naming an already-banked function, and any view whose PUBLISHED count disagrees with a
recount. On first run it immediately caught a real one:
family_hseq publishes 11,456 unmatched instances; only 11,297 of its members are still open
per the corpus (delta +159) -- the map predates tonight's 159 banks. Ranking work off it would
have mis-scoped by that much.
It also PRINTS ITS OWN SCOPE LIMIT, deliberately: agreement here does NOT mean the denominator is
complete. Every view, and the byte-gate itself, is blind to never-onboarded code -- the 39 type-1
modules and main's missing independent boundary oracle stay open (R34/R36).
DELIBERATELY NOT wired into tools-health (Drew said "dont do this now" about the master list; this
is the additive half). --strict exits 1 for when he wants it binding; wiring is one line.
Drew T