Pre-existing latent breakage (Phase-21 close commit:0292, "+62 PsyQ names"), found during T5b's
R22 fleet verify. A genuinely-clean `make clean` + re-extract + build of `main` failed with
dozens of `can't open asm/nonmatchings/800c3/func_*.s` — clean-rebuild broken since Phase 21,
masked all along by incremental builds reusing stale pre-rename .s/.o (the exact R22 failure mode).
- Root cause (byte-proven): Phase-21 xdedup renamed 62 PsyQ library functions to their proper
names (InitHeap, FlushCache, GetTPage, SysEnqIntRP, SpuWrite, CdMix, __main …) in
symbols.us.txt, but never regenerated/renamed the committed src/*.c stub refs that call them by
the OLD func_<ADDR> name. splat's FRESH regeneration of a stub .c uses the CURATED names (move
src/800c3.c aside -> splat writes INCLUDE_ASM(InitHeap) + emits InitHeap.s); the committed stubs
were simply stale.
- Fix: rename all 62 INCLUDE_ASM(func_<ADDR>) -> the curated name across 12 files (800c.c 1,
800c3.c 22, apicard1/2/4 4/6/2, boot.c 1, libcd1.c 8, libetc.c 6, libgpu.c 3, sgap.c 1,
snd1.c 7, snd2.c 1). Pure rename to match splat's canonical output; byte-neutral.
- VERIFIED: main clean-builds 143dbb89 from a fully clean tree; full clean fleet check-all 136/136.
- Lesson (cookbook): a symbols.us.txt rename must be propagated to (a) shared-macro bodies
(engine_core.h — the T5b GetTPage fix) AND (b) INCLUDE_ASM stub refs (this), AND verified by a
genuinely-clean check-all (make clean + full re-extract), never incremental. Added a lint check.
Both concerns byte-verified from a fully-clean tree (ov_SC01_077 d19c9580, ov_SC07_009 2a6499b6
+ 133 overlays). Fleet is 135/136 — the 1 remaining failure is `main`, a SEPARATE pre-existing
Phase-21 breakage (62 dangling INCLUDE_ASM refs, tracked in CURRENT_PHASE, fix in progress),
NOT introduced by this commit.
[FIX (partial) — pre-existing Phase-21 latent breakage, found during T5b's fleet verify]
- A genuinely-clean `make check-all` failed 135/136 (overlays: `undefined reference to func_80058B40`;
main: dozens of `can't open asm/nonmatchings/800c3/func_*.s`). This commit fixes the OVERLAY side.
- Root cause: Phase-21 xdedup renamed func_80058B40 -> GetTPage in symbols.us.txt (one of the
+62 PsyQ names) but did NOT update the two shared engine_core.h macros that CALL it
(DEFINE_func_80139680, DEFINE_func_8012E28C — in all 134 overlays + ov_SC01_077_a). Since
Phase 21 a clean rebuild couldn't link; incremental builds reused stale .o's and masked it
(the R22 failure mode) — every "check-all 136/136" Phase 21->23 was incrementally-stale.
- Scope = exactly 1 symbol (static scan of all func_/D_ refs in the shared headers vs symbols).
- Fix: rename the 4 occurrences -> GetTPage (byte-neutral, same addr 0x80058b40 -> identical jal;
G6 curated-name). ov_SC07_009 link-fail -> byte-identical 2a6499b6.
- Lesson: a symbols.us.txt rename must be propagated to shared-macro bodies AND verified by a
genuinely clean (make clean + full re-extract) check-all, never incremental.
[FEAT — T5b: the S11 class crack, Fable5 spike]
- The S11 LUID(x)alloc "intrinsic" verdict was MAP-INCOMPLETENESS. func_8014E048 (143 ins,
reach-134; "not source-steerable" since the map wave; 28-off even after T5's directed permuter)
-> MATCH (143/143) -> whole-binary BANKED (ov_SC01_077 d19c9580). Derived by reading gcc-2.7.2
source + RTL dumps (12 experiments .run/gccmap/exp/e1a..e1k.c).
- NEW LEVERS (byte-proven): S12 reused-s32-temp fence (u16 temps DON'T work — combine folds the
unpromoted-HI zext temps away); S13 head-skip escape (body-local param copies conflict-steer the
scratch contest; volatile-asm dead-read wedge fence; multi-input dead-read K2 rebalance);
cse-opaque asm-copy; RC-4b pinned store-temp; RC-10 preference-cascade mechanics.
- Integration reconciles (both T6 classes): engine_core.h caller decl s16*->u16* (codegen-neutral)
+ canonical data decls w/ *(u16*) casts (D_801152A8 u8[] / D_801152AC s16). x134 lift blocked by
dedup_propagate self-containment (pins/asm) -> T6 target (joins func_80132784).
- Distilled (R30/R16): sched.md §6 (S12/S13) + regalloc.md §F (RC-10 + RC-6/S11 downgrade) +
cookbook §31 triage update; backlog re-logged (capped); memory updated.
- cookbook §29: reasoning-model reconciliation idioms (match-pointer-type-to-TU-decl, call-site cast
for value mismatch, cast-a-callee-definition, data-type match) + the narrow-param hard limit
- gen2-mips-matching-model.md + CURRENT_PHASE: Option-3 verdict (GLM reasons the wall expertly but
banks 1/7; wall INTRINSIC, Fable5 §3c triple-confirmed); GLM role = $0.03-0.08/fn hard-band drafter
+ idiom teacher; real lever past the wall = public flip, not a bigger model
- scorecard: original 2026-06-10 scope vs 22 phases of byte-verified reality (what held,
what emerged beyond scope, what deviated and should be revisited)
- adversarial pass: P21 no-shortcut + giant scheduler walls HOLD; P16 loose-typing wall has
a TIMESTAMP GAP (declared 06-19, pre-dating cast_call_sites/block-scope-externs/v3) -> re-test
- July-2026 resources: frontier-on-hard-band (T10.7 re-aim), continuous architect-tier judgment,
RE-ELEVATE THE PUBLIC FLIP (community labor = the only lever that scales into the proven tail)
- strategic fork: posture A/B/C on the byte-match goal; recommends dual-metric (B), Drew's call
- ranked recs 1-6 + explicit endorsements of what not to change
The grinder/backlog pipeline was ov_SC01_077-hardcoded 5 layers deep (same class as the
T7 lora_grind bug). Fixed all so the permuter grinder can process a non-077 near-miss:
1. gate_stage.append_record stores the source "binary"
2. backlog.FIELDS keeps it (else append_record dropped it)
3. backlog.load_best/_open_stubs is fleet-aware: a fn matched in ov_SC01_077 but
propagation-stuck stays OPEN in its overlay, so it surfaces via that record instead
of being dropped as "matched" (the grinder must SEE it to grind it)
4. p16_permute.setup takes the target binary's asm-subdir (was hardcoded 077)
5. grinder resolves per-binary asm + gates grouped by binary + allows unknown nins
Backward-compatible: legacy records (no binary) default ov_SC01_077.
Validated end-to-end: the 3 fresh reach-134 close=1 ov_SC01_000 fns now surface, resolve
to ov_SC01_000's asm, and gate via ov_SC01_000.
TWO byte-evidenced findings (redirect the fuel strategy):
- the reach>=2 close=1 fuel is MODEL semantic-misses, not permuter fuel: func_8012E27C's
target is "return 1" but the 7B drafted an empty "void f(void){}" (corpus overfit
empty-leaf); func_8012BF4C/AD64 are trivial sw/sh setters drafted empty. A corrected
draft banks them (+3 byte-identical via the fixed gate, @commit:0326); the permuter cannot
add a missing return/store. Lever = corpus-v3 leaf variety, not the permuter.
- x reach is propagation-capped: the 3 are inline-matched in ov_SC01_077_a.c (the stuck-
local cap) -> dedup_propagate "nothing to propagate" -> banked x1. Lever = dedup-collapse.
check-all 136/136 throughout. docs/gen2-mips-matching-model.md + CURRENT_PHASE updated.
Add a sig-based reach oracle + --min-reach N to lora_grind so the mass-run can prefer
SHARED functions (one bank propagates x reach — the fleet-% multiplier). The oracle reads
the same .run/sig.ov_*.jsonl dedup_propagate uses (validated: 0 mismatch over 60 stubs +
the func_8017CE24=2 ground truth), so a reach>=N target is exactly one dedup_propagate
will stamp x reach after the bank.
Bounded reach>=2 mass-run (ov_SC01_000, 15 shared <=15-ins stubs): 0/15 banked, vs the
reach-1-heavy spot-run's 7/15. The model is weakest exactly on reach>=2 (shared) code:
(1) the corpus skipped the shared DEFINE_func macro bodies (export_pairs reads only src/
defs -> 96.6% of the corpus is overlay-unique), and (2) the shared engine fns are the
harder regalloc/schedule residuals. So reach>=2 model-only is NOT a fleet lever by itself.
BUT the reach>=2 drafts are high-value FUEL: 5/15 are close<=3 reach-134 near-misses
(3x close=1: func_8012E27C/BF4C/AD64) -> x134 each if closed. The real lever is
reach>=2 draft -> permuter-grinder close (x134), which needs the SAME per-binary fix T7
applied to lora_grind: grinder.py calls run_gate with no binary (-> 077) and the backlog
stores no binary field. That two-part fix is the next step. byte-neutral: check-all 136/136.
- docs/gen2-mips-matching-model.md: T9 RESULT
- phase-ends/CURRENT_PHASE.md: T9 done; next = grinder per-binary fix, then corpus-v3
The 500-fn calibration banked 0/222 across the binary rotation. Root-caused (R14, by
reading the code + the run's own backlog — resolving a flat contradiction between two
scout agents) to TWO independent bugs in lora_grind's use of gate_stage.run_gate, NOT
model quality:
- Bug A: good_sha() passed the sha1sum line "<sha> <name>" vs harvest_verify's bare
sha1() -> 0 banks for EVERY binary incl. 077 (so the "0/12" was a bug artifact, not
an exhausted tail)
- Bug B: the gate call left src/asm/out at the hardcoded ov_SC01_077 defaults -> non-077
drafts dropped at the 077 stub-filter, silently (and the asm mis-resolution contaminated
the backlog near-miss classification)
Fix (tools/gate_stage.py): run_gate resolves src/asm/out/good_sha from `binary` when unset
(binary-agnostic, no silent ov_SC01_077 default an overlay inherits; good_sha bare-hash
normalized) + a loud negative-control guard (0-overlap binary/src mismatch warns, so a 0
can never again masquerade as 'nothing matched'). tools/lora_grind.good_sha fixed at source.
Byte-neutral: make check-all 136/136.
Proof: ov_SC01_000 spot-run banked 7/15 (47%) byte-identical (@commit:0322); reach-2
func_8017CE24 propagated x2. ROI finding: 6/7 banks are reach-1 (overlay-unique) -> broad
rotation is high bank-RATE / low fleet-% ROI; the fleet lever is reach>=2 targeting (T9) +
corpus-v3 (T8). Backlog now correctly classified (4x close=1 = grinder fuel).
- docs/gen2-mips-matching-model.md: T7 RESULT section
- phase-ends/CURRENT_PHASE.md: T7 done; next = T8 corpus-v3 / T9 reach>=2 selection
The fine-tuned 7B (bfm-match-7b-v2) drafted real OPEN ov_SC01_077 stubs; whole-binary gate banked 4
(func_80160B34 func_8015CC74 func_8016084C func_801705C0). Sample: 9/22 match_one proxy -> 4/22
whole-binary banked (18%; the proxy->gate gap is the TU-plumbing wall). Model is format-robust (raw .s
== normalized). api_draft: NORMALIZE_ASM bridge (unused — model handles raw .s) + ghidra_c-empty fix.
7B QLoRA on 638 compile-filtered pairs: trivial ≤5-ins 39/41, but ≥6 ins 0/34, >15 ins 0/24 (=stock);
near-misses far (near≈nins). Root cause: compile-filter dropped the 536 harder global/struct fns →
no non-trivial signal. Fix = corpus-v2 (externs). Cheap-cloud (Haiku/GLM) remains the working tier.
Qwen3.6-35B-A3B stock drafter: fair harness fixed compiles but model stuck at fixed near-misses
(can't refine from diff); full cookbook worse+2.3x slower than curated (dilution). Gets structure,
misses gcc-2.7.2 precision — exactly what src-pair LoRA targets. Forward: fine-tune or permuter-seed.
docs/gen2-mips-matching-model.md: the BFM/gcc-2.7.2 matching-specialist idea (LoRA on our own
gate-verified pairs — the corpus off-the-shelf RE LLMs lack). export_pairs.py mines 1307 banked
(asm<->C) pairs from build objects (asm/ is gitignored, so disasm the ROM-identical build, splat-like
format) + src defs -> datasets/match_pairs/{pairs,train,test}.jsonl (gitignored, 1174/133 split).
api_draft.py: TEMP env-tunable. .gitignore: datasets/ models/ weights.
- from-scratch giant func_801372B0 (207): structurally cracked at xHigh (206/207 ins,
logic 100%%) but byte-blocked by the gcc list-scheduler/regalloc last-mile (§27/§17);
banked the structural draft to backlog as a future permuter head-start
- xHigh finding (Drew's test): giants reach structural match fast — the wall is gcc
determinism, not reasoning depth; xHigh sufficient for this work
- session total: 16 functions ×134 (2 giants type-lift + 14 close=0), fleet 63.22%->63.66%
- docs/{worklist,backlog,progress.fleet}.md regenerated after the func_8015126C x134 bank
- CURRENT_PHASE.md: RESUME HERE block (T2 giant queue + levers + op gotchas) for a fresh session
- grinder stopped (STOP sentinel set); tree clean except R23 db churn
- cookbook §28: the 4-way triage of a close=0 gate-rejected giant (pure-extern plumbing /
masked-residual / struct-walled / regressed-draft) + the canonical-extern recovery (the NEW
lever that banked func_8015126C, which Phase-21 left as a close=0 wall) + the coalescing pin
(register __asm__ + lazy in-&& assign). §28a: PS1-applicable decomp.wiki GCC patterns
(negative-offset loops, branch-duplication, load-coalescing, div-magic table, slti-0)
- tools/recover_giant.py: canonicalize a draft's engine_core.h-callee externs to def-sigs +
move all externs block-scope (validated func_8015126C -> MATCH)
- R14: close=0-giant fan-out NOT uniformly near-free — only func_8015126C was pure-extern;
the rest are struct-walled / masked-residual / regressed -> genuine per-giant hand-work
Drew chose deep re-RE of func_8014EA4C's real frame. Finding: the frame is a DEAD aggregate
copy (8 bytes unaligned-copied to sp+0x20, never read; gcc-2.7.2 keeps it, no DSE). The agent's
buf[16]+memcpy(buf+16) PRECISELY reproduces the exact gcc stack layout (local[0x38] -> frame
0x88, wrong). So the frame is already correct at close=6; the 6 residuals are NOT frame-caused
-- they're loop-body scheduler (global-store vs call-arg-load order) + regalloc (abs vs
in-place ), the irreducible §20/§25 wall. Deep frame-RE is a dead end for schedule/regalloc
residuals -- only the permuter explores that space. 5 levers (cheap-recovery, permuter,
giant-wave, hand-finish, deep-RE) byte-proven exhausted at fleet 63.17% for the reach-134 tail.
Hand-finish attempt on func_8014EA4C (close=6, Drew's choice): 2 byte-proven attempts both
cascaded — q0_arg reorder swapped p/q regalloc (6->123); abs-ternary dropped the load-bearing
dead buf[16] frame hack -> frame 0x60->0x58 -> offset cascade (6->23). Confirms the agent: the
residuals (store/load schedule + abs regalloc) are pressure-locked by the frame-forcing hack;
C-steering breaks the frame. The fix is the decomp-permuter (grinder), not C — it explores the
frame-preserving regalloc/schedule space. Grinder is now auto-permuting func_8014EA4C +
func_80144090 (re-logged close=6/25, token-free). cookbook §27.
- 6-giant worker_wave (1.16M tokens) BANKED 0. Agents got the SHAPE (§27 recipe works) but the
whole-binary byte-gate (G3/P9) rejected all 6. func_8014F74C close=0 match_one MATCH yet its RAW
draft FAILS the byte-gate (no plumbing/data conflict) -> match_one OVER-predicted (§25 masked
residual). The rest are pure regalloc/scheduling 'not C-steerable -> permuter' (close 6/25/53/91/164).
- Confirms cont.2/Phase-20/Phase-16: giants are HAND-FINISH/permuter fuel, NOT auto-bankable.
cookbook §27 updated. Do NOT scale giant auto-waves for % (1.16M tokens -> 0 banks).
- GATE BUG (R16, noted): canon/cast/sig_unify regressed near-misses (func_8014EA4C 6->128) and
poisoned the backlog. Re-logged the 6 with TRUE closeness + raw drafts (source=giant-raw);
func_8014EA4C(6)+func_80144090(25) now grinder-eligible (token-free).
- INFLECTION (P9): the automated reach-134 harvest is COMPLETE at 63.17% — cheap recovery (0 fresh),
permuter (~0), giant wave (0/6) all exhausted. Forward % = hand-finishing or close Phase 21.
- R14: sig_image h_exact = SHA1(raw IMAGE bytes), UNMASKED (sig_image.py:170-171) -> reach is
the ACCURATE shipped-byte reach; a resolved-reach probe just reproduces it. The real gap is
reach (shipped identical) >= realizable-x134 (shared-C reproduces all N), measurable ONLY by
dedup_propagate's byte-gate on a MATCHED fn. No cheap static probe -> cont.7 'build it' WITHDRAWN.
- R14: func_801775E0 backlog close=1 but saved draft compiles 31-off from source (prologue
save-scheduling/branch-sense/block-order, the S20 wall) -> close=1 was permuter-achieved.
RULE (S26): match_one a draft for SOURCE closeness before assuming a pin crack. The close-1..4
codegen tail is permuter-class (grinder territory), not cheap pin targets.
- INFLECTION (P9): the cached reach-134 automated harvest is COMPLETE; forward %-progress needs
a token-heavy lever (8 giants / per-fn pin-cracking) -> Drew's ROI greenlight. cookbook S26.
- THE FINDING (R14/P9): the _a close=0 recovery banks 0/20 (same def-side multi-way
loose-typing wall as MAIN 0/40, cont.6). cont.6's func_8012F568 was the lone simple-arity
win; the rest need a C type that conflicts caller-decl-vs-def with no single fitting sig.
The cheap close=0 ×134 recovery lever is EXHAUSTED.
- TOOLING (R16, idiom_loop.py --assess was DOUBLY inflated, now fixed):
(1) load_backlog drops banked-since-logged fns (intersect ledger w/ live INCLUDE_ASM stub
set, mirrors backlog._matched_now) -> killed the bogus 'unknown 14' class + ~10/class
stale-matched inflation (schedule 49->39 r134, regalloc 44->39).
(2) DETERMINISTIC-RECOVERY splits FRESH (never recovery-gated = genuine fuel) vs WALLED
(recovery-failed = def-side wall, do NOT re-run). Post-fix: 0 FRESH / 46 WALLED.
- schedule wave NOT fired (ROI-gate, S20/S26): ~50% x134 fraction on n=2, median 15 ins off,
over an h_exact-inflated count. No tokens spent speculatively.
- cont.6 option-3 CONFIRMED: cached reach-134 cheap fuel is dry; the genuine levers are
token-heavy fresh-session work (the 8 giants / per-fn pin-cracking / build a resolved-reach
probe). cookbook S26. 0 banks; fleet 63.17% unchanged; 136/136 byte-identical; 0 NON_MATCHING.
Drew T