- 38 targets / 44,297 templ ins, model-routed (Haiku <=89 + Opus escalation, Opus direct >=90):
52 agents, ~4.1M tokens -> gate 27/38 (71%). All 11 failures captured + classified: 8 declaration/
link plumbing, 3 genuine byte-DIFF. An 8-agent Opus reconcile wave fixed 8/8 (7 banked) ->
wave-3 total 34/38 = 89%. Propagation +639 members / 1 failed / 83 overlays.
R22 clean-fleet 140/140. Fleet 95.42% fn / 92.4% instr / 85.5% distinct.
- DESIGN (S27 law applied BEFORE it bit): six of eight reconcile targets share ONE TU, so this wave
FORBADE agents any build — six concurrent splice-builds would have clobbered a tracked file.
- THE AGENTS OUT-DIAGNOSED MY BLOCKERS:
* func_801848B0 — an agent REJECTED MY PREMISE: I said byte-correct + decl-blocked; it ran
match_one first, found a real 1-ins DIFF, fixed both. R14 aimed back at me, correctly.
* func_8017C5F0 — the "invented symbol" D_801DA0F0 is an INTERIOR ADDRESS: offset 0x6C into
D_801DA084 (0x801DA084..0x801DA103). The lui/addiu pair builds an interior pointer.
* func_8018A860 — the TU declares memcpy THREE times with incompatible signatures, with a latent
byte bug behind it. One symbol declared three ways is a defect awaiting the next draft.
- Carried (4): func_80184A94 (match_one MATCH, gate-refused) + 3 genuine byte-DIFFs
(func_801845B0, func_8017BEBC@ov_SC02_026, func_8018480C).
- 15 targets (11 fresh Haiku + 4 gate-failed reconciles on Opus), 15 agents, ~0.74M tokens.
Gate banked 14/15 (93%) vs wave 1's 20/24 (83%); ALL 4 RECONCILES BANKED.
Propagation +328 members / 0 failed / 76 overlays. R22 clean-fleet 140/140.
Fleet 95.23% fn-count / 92.1% instr / 85.0% distinct (phase opened 92.00 / 87.5 / 78.0).
- THE 83->93% CAME FROM THREE FIXES, ONE PER WAVE-1 FAILURE (the S27 finding reproducing):
(1) args pasted from the DERIVED manifest, never typed — all 30 paths verified on disk first;
(2) blocker-capture BEFORE the reconcile fan-out (S29 law: agents cannot run the gate, so a
match_one-MATCH draft dying on `conflicting types` reads to them as a codegen wall) —
each got the exact symbol+line plus the two byte-neutral levers;
(3) wave-1's Opus DISCOVERIES became wave-2's Haiku INSTRUCTIONS (ori-vs-addiu unsigned
destination; store-sinking scheduler order).
- THE RECONCILES OUT-DIAGNOSED MY CAPTURE: func_80189B78's error named ONE symbol; the agent found
SIX invented prototypes, two AFTER the splice point where cc1 had not yet reached — all fixed by
copying the TU's decls verbatim + casting at the call site, zero bytes changed. func_8018584C had
lever (A) blocked in BOTH directions (the draft must also compile standalone for match_one) and
closed with the DATA form of the asm-label alias. func_80180A4C was one character class (s32[] vs
the TU's u8[], declared 11 lines after the splice point).
- Carried: func_80189C4C (the one agent that returned no structured result; gate refused).
- POOL (derived from the regenerated map): 36 families / 28,829 templatable ins, kind=modal (no
member matched ANYWHERE so no sweep could reach them), >=20 members, <=60 ins, non-jr, and NOT
ONE exemplar in ov_SC01_077. Hand-calibrated 3/3 one-shot before scaling (Phase-15/18 discipline).
- WAVE (ultracode; Haiku drafters + Opus escalation, 24 targets): 31 agents, 0 errors, ~2.0M tokens,
12.5 min. Agents claimed 24/24 MATCH; the whole-binary gate banked 20/24 (83%); propagation
+524 members / 0 failed / 91 overlays. 17 of 20 banks were HAIKU, 3 Opus — the
cheap-tier-ab-validated call (Haiku == Opus at <=~50 ins, ~4.8x cheaper) held on real work.
- WHAT OPUS BOUGHT: (1) a `sh` of a constant with the stored width's top bit set needs a u16
destination — via s16 gcc folds it sign-extended and li emits addiu, via u16 force_fit_type keeps
it positive and li emits ori; (2) a schedule-reorder closed by STATEMENT ORDER not the permuter
(gcc's list scheduler preserves relative order of disambiguable stores); (3) three loose-typing
fn-ptr casts a cheap drafter had misread as delay-slot/permuter residuals.
- MY ERROR (R37/R14): I generated the manifest to .run/s6f_wave_targets.json then HAND-TRANSCRIBED
the args into the Workflow call, pattern-filling _jr_8017BEBC across overlays where no such split
exists (corpus.stubs says _jr_8017AE2C). Three agents lost time rediscovering real paths. The gate
driver written after (.run/s6f_gate.py) DERIVES every TU/split from corpus.stubs and asserts
nothing. Assert nothing you can derive.
- The 24->20 gap is the known match_one->gate gap (standalone compile cannot see a TU decl conflict;
Phase 19 measured 88-92% -> 60-71%). 4 carried: func_8018584C, func_80180A4C, func_8017CC80,
func_80189B78.
- R22 clean-fleet 140/140. Fleet 95.13% fn-count / 92.0% instr / 84.9% distinct
(phase opened 92.00 / 87.5 / 78.0).
- func_8017E934 (ov_SC05_001, 29 ins x65): hand-drafted off the .s, match_one MATCH first try,
whole-binary gate byte-identical, propagated 64 members / 0 failed across 63 overlays.
- That makes the B-shaped lane 3-for-3 one-shot (func_8017CDD8 17ins, func_8017CE7C 16ins,
func_8017E934 29ins) for ~0 agent tokens = 330 member-matches from 62 instructions of C.
- THE POOL (derived from the regenerated map): 36 families / 28,829 templatable ins that are
kind=modal (NO member matched anywhere, so no sweep could ever reach them) with >=20 members
and <=60 ins, non-jr. NOT ONE exemplar is in ov_SC01_077 — they are invisible to exactly the
two habits this phase already corrected (the ov077-source default and --band substantial).
- The calibrated recipe, now the wave prompt: read the .s as ground truth (a cached Ghidra-C seed
was measured this session decompiling a DIFFERENT body) -> conform every callee decl to what the
TU already says (the PLUMBING class: standalone-MATCH C is gate-REJECTED as `conflicting types`
when it redeclares a callee the TU defines as (void)) -> match_one -> whole-binary gate.
- R22 clean-fleet 140/140; fleet 94.96% fn-count / 91.9% instr / 84.7% distinct.
- A: frontier regen at HEAD (sigs + family_hseq) before pricing anything (R35). Also the reason
it was needed: .run/hseq_verified.*.txt has accumulated 22,841 files across every sweep ever
run, so any per-family analysis globbing them over-counts; the regenerated map derives state
from sigs + corpus.stubs (R33), which is the authority.
- B / THE FINDING (third §133-class miss in a row): the S29 checkpoint's structural signal
"after S2 the x138 era ENDS — those are the last two crackable fleet-wide families" — the stated
TRIGGER for the phase close — is wrong. Two fresh-crack families with >=126 members were open:
0x8017cdd8 ov_SC02_039 17 ins x 142 members PURE
0x8017ce7c ov_SC03_114 16 ins x 126 members IMM
Both kind=modal (NO member matched anywhere, so no sweep could reach them) and neither exemplar
in ov_SC01_077 — invisible to exactly the two habits this phase already corrected.
- Both hand-drafted off the .s, match_one MATCH on the FIRST try, ~0 agent tokens. First gate
attempt failed PLUMBING (not DIFF): the draft declared `extern void func_8017CFCC(s32 a0)` while
the TU DEFINES `void func_8017CFCC(void)` — the target passes $a0 only because the caller's
incoming argument still sits in the register (loose typing). Byte-true C calls it with no
argument; re-verified MATCH, gated byte-identical, propagated 266 members / 0 failed / 118 overlays.
- R14 on the seed: the cached Ghidra-C for func_8017CE7C decompiled an entirely DIFFERENT body
(three calls absent from the asm). Reading the .s is what made it one-shot.
- R22 clean-fleet 140/140. Fleet 94.88->94.96% fn-count, 91.9% instr, 84.6->84.7% distinct.
- ONE root cause, four faces (cookbook §134): extract_unit's preamble scanner reads C
one line at a time, so every construct that WRAPS was misread.
D1 the {-guard fired on a documentation comment mentioning a brace -> carry truncated
mid-comment -> `parse error before 'the'`.
D2 _def_head_at's "param list continues -> ANSI definition" fallback accepted a WRAPPED
DECLARATION as a definition head -> a 16-line fragment with no body, closed by a brace
pair inside a comment -> a silent 0/137 that reads exactly like a compiler wall.
D5 the backscan met a multi-line typedef's CLOSING line `} T;` first and stopped -> the
type never travelled -> `T undeclared` across 17 families / 24,332 templatable ins.
(The code comment claimed they "route through the engine_types.h lift"; measured, they
routed nowhere.)
D4 wrapped __asm__("func_...") alias invisible to a single-line regex — MEASURED (1 exemplar,
3,288 ins, second blocker behind it) and deliberately NOT fixed; it now returns None so the
sweep reports a VISIBLE skip instead of 137 silent failures (R32).
- Fixes: _def_head_at(ln, idx, more=()) lookahead (no-lookahead keeps the historical answer);
{-guard exempts comment-only lines + an R32 dangling-comment backstop; forward brace scan
counts over cdecl._mask (R33, one masking oracle); _typedef_block_start carries whole blocks.
- BLAST RADIUS (R14): extract_unit diffed vs the pre-fix tool over all 181 zero-crack exemplars
-> 157 byte-IDENTICAL, 24 changed, all in the intended direction.
- PAYOFF: D1+D2 +323 members from families that banked ZERO; D5 +417 incl. func_8012B77C 139/139
(8,062 ins) and func_80128C98 137/275. S6 total 1,582 members (pre-fix tool scored 842).
- R22 clean-fleet 140/140. Fleet 94.43->94.88% fn-count, 91.4->91.9% instr, 84.0->84.6% distinct.
- TELL worth keeping (§134): bimodal bank rates (57 all / 52 zero / 8 partial) are a TOOLING
signature, not codegen. Probe one member and read one compiler error before writing a family off.
- family_sweep --hseq --band all (no --source override), 117 pre-classified families:
staged 2735 drafts / 1239 groups / 0 skips -> BANKED 842, R22 clean-fleet 140/140.
Fleet 94.43->94.67% fn-count, 91.4->91.6% instr, 84.0->84.5% distinct.
- R37 setup: the 190 zero-crack families decomposed with ZERO builds — 117 sweepable /
17 §94-§100 multi-line-typedef-blocked (24,332 ins incl. the 275-member 0x80128c98) /
9 jr (§53 carve path) / 47 remap-REFUSED.
- R14 PREMISE CORRECTION: the "every sweep passed --source ov_SC01_077" mechanism in the
post-wave checkpoint is wrong (that IS the default and overrides nothing). The real gate
was --band substantial: only 13 of 181 non-jr families are substantial. --band all is it.
- FINDING: the residue is bimodal — 57 families ALL-banked, 52 ZERO, 8 partial — the shape
of a per-family blocker, not per-member codegen. 8 probed via the new generic
.run/s6_diag.py (one build per family, not 137): 7 of 8 are declaration/carry plumbing.
Two proven family_remap defects located at source (D1 comment-line {-guard truncating the
preamble carry; D2 _def_head_at accepting a wrapped multi-line DECLARATION as a def head).
The reconcile lane's second pass. Every one match_one-verified by me before gating, then
whole-binary byte-gated: 11 verified / 0 failed.
Escapes used (no header edit anywhere): the §37/§124 ASM-LABEL ALIAS for return/arity conflicts on
the function itself (7 of 11), and conform-the-decl + cast-at-use for conflicts on OTHER symbols —
func_80142A80, RotTransSV, func_80146C3C (4 of 11). Agents also proved each fix WITHOUT the gate by
compiling the real TU with the body spliced on a .run/ copy.
R14 on my own capture: the ':5201/:5219/:5223/:5228 note:' lines I fed the agents were pre-existing
SHB macro-redefinition NOISE, not the conflict — my blocker filter let 'note:' lines through and I
mislabelled one target as a redefinition on that basis. The agents caught it and said so.
Banked: func_80170CF0 func_801708B0 + the six gate-blocked wave-1 survivors (func_80151664
func_801376E8 func_80176144 func_8012EFB8 func_80146AFC func_8014E5B4). Every one match_one-verified
by me before gating (19/19), then whole-binary byte-gated.
The reconcile lane's whole premise held: agents cannot run the gate, so I captured each blocker with
a splice-build-revert first and embedded the exact compiler error in the brief. Three of the six
conflicts were on a DIFFERENT symbol than the function (D_800AF634, D_8011D030, func_80153C18) —
invisible in the summary, decisive in the brief. All six cleared WITHOUT a header edit, via the
§37/§124 asm-label alias (aF<ADDR> __asm__("func_<ADDR>")) or conform-the-decl + cast-at-use.
Structure-first crack (agent, 371/371 byte-exact, independently re-verified by match_one before
gating). Levers were type- and placement-driven rather than pins: u8 locals produce the andi masks
(a QImode result sends the arithmetic arms through force_to_mode while the comparison keeps its
zero_extend); cross-BB placement defeats combine (LOG_LINKS are per-BB); a DUPLICATED store keeps
the following re-read in a fresh EBB so it stays a real lbu; and a deliberately-unused u8 dum[8]
because the target's .frame says vars=8 with no spill in the body — the original had a dead local.
Only non-call-spanning pins used, so the body is x137-safe (§44).
Family: 371 ins x 138 = 51,198 templatable ins — the single largest item on the board.
func_8016706C func_80131A34 func_80161A90 func_801549F8 func_8014C4AC — each match_one-verified
by me before gating (R14), then whole-binary byte-gated. func_8014C4AC is the standout: the agent
resolved its 'conflicting types' with the §37/§124 ASM-LABEL ALIAS (s32 aF8014C4AC(...) __asm__
("func_8014C4AC")) instead of a header edit — exactly the alternative to the fleet-sed that failed
earlier today. 9 remain blocked on declaration conflicts.
The stored backlog draft was 2 mismatches from perfect (88/88, DELAY-SLOT) for one reason its own
notes had already recorded: the definition must return VOID, not the canonical s32. An s32 return
keeps $v0 live-out at the epilogue, so dbr refuses to steal the loop-top addiu $v0,$zero,0x1858
into the loop-back bne delay slot -> nop + a branch target one insn early. void -> steal -> MATCH.
This is the one place §3a-1's 'void->s32 is byte-neutral' claim is FALSE (S27 finding, now banked).
Applied with the draft's own //@EDIT directive: 5 in-TU 'extern s32 func_8016EC0C' decls flipped
to void (every call site already casts the fn pointer, so no caller changes). ov_SC01_077
d19c9580 BYTE-IDENTICAL. Family: 88 ins × 138 = 12,144 templatable ins; sweep next.
S1's head family (0x8014032C, 183 ins ×137 = 25,071 templatable ins) gate-failed on its probe
sibling. Diagnosis (the §132 ladder, one build): the object emits FOUR tables — BOTH functions in
it are multi-switch (8+5 entries each) — while the carve derived THREE starts.
The missing start belongs to the ALREADY-MATCHED owner func_8013FFD8, and neither oracle can see
it: its stub .s is pruned by extract, and its second table abuts its first with NO pad (8 entries
= 32 B = 0 mod 8, so `.align 3` emits nothing) — precisely the honest limit §132's payload
zero-word recovery documents. Note the true pads [0,0,4,0] are exactly what natural alignment
produces; the build breaks only because a SHORT spec gets written.
Fix: thread the documented `--span-tables` escape through the sweep as `--span-rel` — offsets
relative to the FIRST NEW table, which func_jtbls reads from the sibling's own .s. Byte-verified
family-invariant before use (identical relative offsets on 3 sampled siblings; same code, same
entry counts, only the base moves). Empty by default => every other family untouched.
Also clears my own §132a guard of suspicion (R14): the --like transfer was inert here regardless
(exemplar subseg `ov_SC01_077` vs sibling `_jr_8013FFD8` — roles never matched).
The one sibling both sweeps failed on. `--like <exemplar>` transfers the exemplar span's table
STRUCTURE, and jtbl_carve matches donor to recipient by the subseg's ROLE NAME. ov_SC07_010's
-O0 region is named `_o0` — the same role as ov_SC01_077's, and the ONLY other overlay so named
(the other 136 are `_o0c`, whose role never matched, which is the only reason the sweep worked).
The exemplar had just banked 2 more owners than the sibling has, so the transfer unioned its
rebased 4 offsets with the sibling's real 2 + the new table: SIX starts for THREE emitted tables
-> jtbl_rodata_pads refused ("consumed 3 rodata .align(s) but 6 pad spec(s)").
Guard (tools/jtbl_family_bank.py like_arg): suppress --like when the sibling already carries a
committed `tables=` for the target subseg — its own record is authoritative, and jtbl_carve's new
payload zero-word recovery covers the incomplete-record case that --like used to paper over.
Derived via jtbl_carve.func_subseg, the same derivation the carve itself uses (R33); never blocks
a bank (any failure falls back to the old behaviour). Inert for all 136 siblings already banked;
fixes exactly the broken one. Both fns now bank on ov_SC07_010 => 137/137 siblings each.
The 1-sibling probe (R37) gate-failed: ov_SC01_000's object emitted only func_8013C0F8 +
func_8013C414 tables, because BD74's body never compiled — `E_13BD74' undeclared. The draft
declared E_13BD74/P_13BD74 at FILE scope and extract_unit/remap_hseq carry only the BODY, so
the types stay behind in the exemplar. Same §94 class that held func_8013C08C at 0/137 earlier
this phase; fix is §100 (block-scope types travel with the body, byte-neutral — a type emits no
code). Exemplar re-gated: ov_SC01_077 d19c9580 BYTE-IDENTICAL. B83C's draft was already
draft-local. Named in one command by the §132 ladder.
S28 ledgered `JR-PAIR-IN-ONE-O0-OBJECT` (two jr fns matched in one -O0 object => a clean
build that cannot link: `undefined reference to $L105` + `func_8013C938`) with §81 step 1
(isolate one into its own code subseg) as the untested escape. BOTH the class and the escape
are REFUTED — no isolation, no compiler wall, both fns banked from a genuinely clean fleet.
The 4th consecutive "structural wall" to resolve to our own tooling (§124/§125/§126/§131).
- DEFECT 1 (tools/jtbl_carve.py): ov_SC01_077_o0's carve at 0xb01a4 predates the §8e
`tables=` persistence and is a MERGED DOUBLE (func_8013C0F8 $L75 + func_8013C414 $L105);
the 2nd owner is MATCHED so extract pruned the stub .s naming its table. The single-table-
predecessor inference derived 3 starts where the object emits 4 tables -> JTBL_PADS 0,4,4
-> jtbl_rodata_pads refused mid-stream, correctly. FIX: R32 coverage assertion + payload
recovery at the single choke point (spec_from_starts) — every zero word inside a span is an
original `.align 3` pad (the tool's own axiom), so the word after it STARTS a table;
recovered starts are logged. No-op where structure is known (the 134 sibling _o0c spans
carry tables=+0x0,+0x70). Honest limit: tight (0-pad) boundaries stay unrecoverable but
fail LOUD via the filter's count guard — never silent.
- DEFECT 2 (Makefile): no .DELETE_ON_ERROR, so `as` (a pipeline consumer) left a TRUNCATED .o
on disk — 12 of 16 T func_, undefined $L57/$L59/$L63/$L75/$L76 — newer than its .c, and the
NEXT build linked the corpse. That IS the S28 link error, one build downstream of a loud,
correct compile error. Negative-control-proven on a scratch invocation.
- BANKED: func_8013B83C (272 ins) + func_8013BD74 (198 ins) in ov_SC01_077 (d19c9580).
Byte proof: 4 tables 0x801D8254/828C/82FC/836C (13/27/27/27 entries, each zero-pad
separated); span 0xb00fc..0xb0280 = 388 B = 52+4+108+4+108+4+108 exactly; spec 0,4,4,4.
- R22 clean-fleet (make clean + extract-all + check-all): 140 passed, 0 failed of 140.
The incremental result was NOT trusted (§130). Fleet 93.25% fn-count / 89.2% instr /
80.5% distinct; dedup 1905/0; 0 NON_MATCHING (G4).
- cookbook §132 + index (356 sections): the mechanism, the fingerprint (an undefined $L<n> in
a LINK error is a truncated object, never codegen), the 30-second standalone-TU ladder that
named the 4th table owner before any build, and the transferable rule — a fail-loud guard is
only as trustworthy as the artifact hygiene around it.
The last surviving "compiler wall" of the session turned out to be an off-by-one-word
carve. Chain, all byte-grounded:
SYMPTOM jtbl_carve diverges on ov_SC06_018 after a BYTE-NEUTRAL jr_isolate_all.
SHAPE image -3 bytes; 853 differing bytes in 699 scattered runs; **812 at byte 0 of a
word** = the low byte of a 16-bit immediate, every sampled one changing by
exactly -4. Not a shift, not a pad: hundreds of `%lo` operands 4 bytes low.
CAUSE func_80191C50's own `sltiu $v0,$v1,0xC` names 12 entries; the emitted .rodata
holds 12 words; the carve reserved 13. The 13th word (0x3038200A) is ordinary
NON-ZERO data that spimdisasm ran into the dlabel span (the next dlabel sits
past it). Reserve 13 / supply 12 => the .rodata piece UNDER-FILLS by one word
=> every later symbol slides down 4 bytes.
WHY MISSED The trailing-trim's axiom is "0x00000000 cannot be a jump target", so it only
trims ZERO words. This surplus is non-zero, so nothing trimmed. The tool already
treats `sltiu` as ground truth - it EXTENDS a table spimdisasm cut in half, and
it WARNS when a span is too short - but had no clamp for a span too LONG.
FIX: an over-span clamp with the SAME authorization as the existing extension logic -
only when the `sltiu` bound is UNAMBIGUOUS (one bound; a multi-switch fn cannot say which
table owns which), and only when the surplus words are NOT plausible code addresses. If any
surplus word looks like a real entry it REFUSES LOUDLY rather than silently dropping one.
jtbl_carve: jtbl_801D3BA4: clamped 1 trailing NON-ZERO word(s) - func_80191C50's own
`sltiu 12` names 12 entries and the surplus is not code
Then: carve BYTE-IDENTICAL, draft spliced, **func_80191C50 (710 ins) BANKED**.
R22 CLEAN-FLEET: extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140.
Retires the JTBL-CARVE-BREAKS-BYTES ledger class: the one instrument failure that survived
this morning's retraction round was REAL, and is now a named bug with a fix - not a wall.
The last 133 members of the -O0 cluster's sweep residue, banked. R22 CLEAN-FLEET:
extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140.
METHOD NOTE, because it is the difference from the two failures before it: my hypothesis
(the 5-vs-133 split tracks which -O0 file the member lives in) was cleanly REFUTED —
ov_SC07_006/007/011 were sub-split by me TODAY into _o0c and banked anyway. Instead of
forming a fourth theory I staged ONE member and compiled it. Two blockers, each only
visible after the previous was cleared:
1. `conflicting types for S_8013BC7C` — the templated body carried a typedef TEXTUALLY
IDENTICAL to one in engine_types.h, and gcc-2.7.2 (C89) rejects even an identical
typedef redefinition. The exemplar TU includes only common.h; the new _o0c files pull
engine_types.h via engine_core.h. (harvest_verify already strips provided typedefs at
gate time via cdecl.strip_provided_typedefs, so this half was self-solving.)
2. `previous declaration of func_8013BC7C` — the SIBLING's own TU declares the templated
function divergently: SS57's self-decl class, lever = --normalize-self-decls.
One flag. 133 staged / 133 BANKED / 0 failed.
Running total for today's follow-ups: func_8013C08C 137/137 + this 133 = 270 members banked,
against one genuine integration wall (JR-PAIR-IN-ONE-O0-OBJECT). Every blocker in all three
was a DECLARATION-ENVIRONMENT problem, and none was visible without compiling and reading
the output — three wrong guesses where I theorised, zero where I read first.
SS94 said treat a family 0/N as a TYPE-CARRY failure until proven otherwise. It was one.
MECHANISM (read from the source, not inferred - SS125 rule 1): E_13C08C was a MULTI-LINE
typedef at FILE scope. extract_unit's preceding-decl backscan walks back over
extern/comment/blank/typedef lines, but a multi-line typedef presents its CLOSING line
(`} E_13C08C;`) first, which matches none of those prefixes. The scan stopped there, so every
templated sibling received the body WITHOUT its type and all 137 failed to compile.
FIX = SS100 (prefer the DRAFT-LOCAL form): a type only one function uses belongs in its BODY,
where it is part of the unit by construction. Byte-neutral (a type declaration emits no code),
gated on ov_SC01_077 before and after.
family_sweep --hseq --only 0x8013c08c --band all -j8 -> 137 BANKED / 0 failed
R22 CLEAN-FLEET: extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140
WHY THE DIAGNOSIS WAS REDONE FROM SCRATCH (R35): the first pass concluded "the type is not
defined anywhere" - because grep was SILENTLY SKIPPING the file (SS128, the raw-NUL defect fixed
at commit:1284). That conclusion pointed the same direction by luck, but it came from a broken
instrument and none of it was trustworthy. With grep working, the typedef was visible at
ov_SC01_077_o0.c:137 immediately.
A FRESH TRAP FOUND WHILE FIXING IT: my explanatory comment contained a literal `}`, and
extract_unit's forward brace-scan does NOT strip comments - it decremented depth and TRUNCATED
the extracted unit. Caught only because I verified the unit was complete instead of assuming
the edit worked. Comment reworded to contain no brace characters, with an in-place note saying
why. That hazard is now also documented in the body itself for the next reader.
FOUND BY ACCIDENT, WHICH IS THE POINT. `grep -rn func_8013C08C src/` returned NOTHING for
a function that is defined right there. The file held a RAW NUL byte inside a character
literal — the source read `== '<NUL>'` where it should read `== '\0'`. It COMPILES (the
fleet was byte-identical), so no byte-gate ever objected. But file(1) classifies such a
file as `data`, and **grep treats a file containing NUL as BINARY and reports nothing,
silently**. The whole file therefore vanished from every grep-based audit and every hand
search. I burned real time chasing a phantom missing function before `file` gave it away.
SCOPE, measured: 137 files — every `_o0c`/`_o0e` region created in THIS session. The
templated bodies carried the NUL fleet-wide, so I propagated the defect today. All fixed
(`'<NUL>'` -> `'\0'`); R22 CLEAN-FLEET 140 passed, 0 failed of 140 => byte-neutral.
NEW ORACLE: tools/audit_text_sources.py + `make audit-text-sources`, wired into
tools-health, coverage-asserting over all 3,887 tracked .c/.h files (R32). This is the
SAME silent-skip family as SS124 (a scanner that cannot see something reports it is not
there) and SS126a (a bare except swallowing a coverage assertion) — but one layer LOWER,
in the tool everyone reaches for first. The byte-gate is structurally blind to it (R34):
the bytes are correct, so it has nothing to say. It needs its own oracle.
MY OWN ERROR, RECORDED: proving the new guard fires, I injected a NUL into the REAL tracked
file and restored it through nested shell escaping. The restore left `'\\0'` — an escaped
backslash, i.e. a multi-character constant, NOT a NUL — a genuine semantic change. R22 caught
it (139/140) in one cycle, before any commit; repaired to `'\0'` (10465 -> 10466 bytes) and
re-verified 140/140. The lesson is not "be careful": a negative control must corrupt a SCRATCH
COPY under .run/, never the tracked file it is testing. Testing a guard must not risk
introducing the defect the guard exists to catch.
First Ultracode wave against the population the -O0 routing made draftable. 30 agents
(15 drafters + 15 adversarial verifiers), 1.33M tokens, 8.8 min. Every drafter self-checked
with match_one --o0 AND rtu_match --o0; every MATCH claim was then re-run from scratch by an
independent skeptic instructed to default to REFUTED. Result: 15/15 confirmed, 0 disputed.
WHOLE-BINARY GATE (the sole arbiter, G3/P9): **12 banked / 3 failed** — a textbook SS52b
outcome (an rtu MATCH is a CANDIDATE, not a bank). All three failures are NAMED INTEGRATION
classes, none a compiler wall:
func_8013BD74 CARVE-REFUSED — it is a jr function; needs the SS81 carve chain (reach 138)
func_8013B83C CC1-FAIL — real-TU compile, error not yet read (reach 138)
func_80184058 PLUMBING — recovery ladder
BANKED: func_8013C08C + the 11 fourth-region fns (func_80183CF0/D50/F28, func_80184028/264/
2E0/354/474/538, func_801847EC, func_80184868).
Bank truth read from the SOURCE (INCLUDE_ASM absence), never the gate report (SS55b trap 4).
R22 CLEAN-FLEET: extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140.
PROPAGATION OF func_8013C08C (reach 138) IS NOT DONE: the first sweep returned "0 families"
because the family map still listed it as a stub — regenerated it (the documented
crack-wave-sweep-map-regen path), after which the sweep found 137 candidates and banked
**0/137**. Per SS94 a family 0/N is a TYPE-CARRY failure until proven otherwise, and this
body carries a SS100 body-scoped typedef, so that is the first hypothesis to test. Recorded as
open, NOT as a wall.
FLYWHEEL FEEDBACK (R16), the honest read: the cookbook index fired on only 3/15 targets.
Agents independently re-derived the SAME undocumented idiom — the -O0 CONSTANT-OFFSET FOLD
(`p->f` folds to `lbu 3(r)`; `p[i]` does NOT, it emits `addiu; lw 0(r)`) — and two found their
decisive levers in a SOURCE HEADER COMMENT in ov_SC01_077_o0.c rather than in the cookbook.
The -O0 regime is under-documented relative to how much of the frontier now lives in -O0 TUs.
SS71 also generalises to -O0: several agents cracked their target off an already-banked sibling
in the same TU (func_80184868 came straight off the shape banked earlier today).
The second and last has_mid_jr family of the -O0 cluster. Same route as func_8013C0F8:
jtbl_family_bank (the SS81 carve chain per sibling) -> 137 BANKED / 0 failed.
Both jr families together: 274 members, 483 ins x137 = ~66k instructions, 0 failures.
Neither was bankable before commit:1270 routed the destination TUs to -O0.
R22 CLEAN-FLEET: extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140.
The first of the two has_mid_jr families SS53 correctly refused from the carve-less
family_sweep. Routed through the tool its tier needs (jtbl_family_bank, the SS81 carve
chain per sibling) it banks CLEAN:
jtbl_family_bank func_8013C0F8 ov_SC01_077 0x8013c0f8 -> 137 BANKED / 0 failed
~7s per sibling (carve + extract + remap + whole-binary gate), ~16 min total
Only possible now because commit:1270 routed each destination TU to -O0; before that the
member's home file compiled -O2 and no body could ever match there (SS116).
INDEPENDENT CONFIRMATION OF THE SS125 DIAGNOSIS: this is the SAME tool that returned
gate-fail on every group-B (func_8017BEBC) probe earlier today. 137/137 here versus 0/4
there, same jr machinery, is exactly what the carve-vs-body diagnostic concluded --
group B's failures are its BODY, not the carve. I had first blamed the carve; the
body-free probe corrected it, and this run corroborates the correction from the other side.
R22 CLEAN-FLEET: extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140.
The payoff of routing the cluster to -O0 (commit:1270). These functions were ALREADY
CRACKED in ov_SC01_077 and could not be banked anywhere else purely because every
destination file compiled -O2. With the destinations now -O0, they template in
deterministically -- no drafting, no agents.
dedup_propagate --recover 0x8013C360 (h_exact x138) -> 137 overlays byte-identical
family_sweep --hseq 10 variant families -> 1,227 banked / 133 failed (90%)
1360 staged across 136 groups
------------------------------------------------------------------------------------
1,364 new banks
FLEET: fn-count 92.71 -> 93.09% · instr 88.3 -> 88.6% · distinct-code 78.7 -> 79.3%
(71,756 / 87,459 unique fns; +1,162 unique). dedup 1904 -> 1905 groups, 0 failed;
C1 coverage 240496/240496. 0 NON_MATCHING in any default build (G4).
R22 CLEAN-FLEET: extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140.
--recover WAS LOAD-BEARING (SS75): without it dedup_propagate took its historical
all-or-nothing branch -- one failing overlay (the SOURCE, ov_SC01_077) dropped the whole
function and it printed "all candidates dropped", which reads exactly like a wall. Reading
the exclusion code instead of believing the message showed the remedy: --recover excludes
only that overlay (kept x1 with its own inline match) and propagates to the other 137.
The two has_mid_jr families in the cluster were REFUSED BY DESIGN, not attempted (SS53
interlock): 0x8013C0F8 (154 ins) and 0x8013C414 (329 ins), ~137 members each = ~466
members queued behind the jtbl carve path they actually need, rather than a fake 0% from
the wrong tool.
REMAINING in the cluster: the 133 sweep failures + the 2 jr families + the 3 addresses
never cracked anywhere (0x8013B83C, 0x8013BD74, 0x8013C08C) -- the last are genuine
drafting work, now finally possible since their TU is -O0.
Applies tools/o0_subsplit.py across every overlay whose 0x8013B568..0x8013C98C -O0
cluster was trapped inside an -O2 jr split. This is the population the phase opened
against, and it has never been buildable-at--O0 before.
135/135 sub-splits applied, 0 tool refusals
140 new -O0 region files; corpus.o0_sources() 137 -> 277
0 of them invisible to the -O0 oracle (verified explicitly -- a SILENT -O0 miss is
the exact failure SS126 warns about: the region would compile -O2 and every residual
it produced would be a pure artifact)
**2,200 open stubs now live in a genuinely -O0 translation unit**
R22 CLEAN-FLEET: extract-all 139/139 (+main); check-all 140 passed, 0 failed of 140.
make tools-health OK: corpus(+resident) 0 PHANTOM/0 TRUNCATED; cdecl ALL ORACLES GREEN;
audit-binaries 140 onboarded, every one a full citizen (R36); dedup-check 1904/0,
C1 coverage 240359/240359; cookbook-index 336 sections.
The transform is byte-neutral by construction (it only moves subseg boundaries and
repartitions source), so the whole batch was gated by one clean-fleet R22 rather than
135 individual builds -- after a single-overlay probe (ov_SC01_000) proved it (R37).
NOTE THE POPULATION CORRECTION (R14, mine): I earlier reported this cluster as "275 open
stubs across 18 overlays". That was WRONG -- the sizing scan ran while R22 was rebuilding
in the background, so corpus.stubs() raised for most overlays and my bare `except:
continue` SWALLOWED the very coverage assertion R32 exists to raise. The true figure is
2,184 open stubs across 138 overlays, which vindicates the T0(f) pin of "2,192 open
members" that I had called stale. The target list for this sweep was rebuilt with NO bare
except, so R32 can do its job.
Drafting fuel confirmed present: cached Ghidra-C seeds exist for the cluster's addresses.
Drafting the 2,200 is crack-wave work (T3), not T2.
Drew T