Cutting func_80178D40 out of ov_SC01_000_jr_801734BC adds the region's banked LEADER (0x801734BC)
as a cut too (the one-carve-per-object rule), making region 0 EMPTY (the object's first item IS the
first cut) — and region 1's derived name equals the object name, so emitting region 0 duplicated the
line exactly -> splat "segments out of order". Skip an empty region 0; region 1 rightly claims the
object's offset and name. First sibling then banks through the full chain (isolation validation
green -> carve -> --raw remap -> stage ladder -> whole-binary gate): ov_SC01_000 BANKED, included
here. The remaining 132 siblings sweep next.
Three-layer fix for the func_80178D40 ×133 sweep failures:
- LAYER 1 (the residue): jtbl_family_bank.revert() restored carve pieces + src/ but NOT the
isolation's CODE-subseg lines in the splat config. A failed bank attempt (BEBC's first try)
left its isolation config in place; the successful retry re-isolated on top and a DUPLICATE
`- [0x4b364, c, ov_SC01_000_jr_801734BC]` line rode into the commit (harmless to splat —
zero-length — so R22 stayed green). revert() now also restores config/splat.<ov>.yaml.
The committed duplicate is removed (ov_SC01_000 rebuilt BYTE-IDENTICAL 9052dc0e).
- LAYER 2 (the detonation): jr_isolate_all walked the duplicated object TWICE -> two
replacements -> a reversed duplicate block -> splat "segments out of order". It now VALIDATES
the generated config (code subsegs strictly ascending, names unique) and refuses to write on
violation, naming the likely cause — a corrupt input dies at the tool, not three tools later.
- LAYER 3 (the sweep template): jtbl_family_bank gains --raw <crack.c> — template from the RAW
crack via remap_hseq_body instead of the exemplar's banked source unit. REQUIRED when the
exemplar banked at the `reconciled` stage: a reconciled body is TU-SPECIFIC (§41c — uniquified
type names, TU-targeted casts), so extract_unit hands the sweep a polluted template and every
sibling gate-fails (byte-proven: 178D40 banked reconciled -> sweep 0/4; 8015AE2C banked raw ->
sweep 133/133). Same law as family_sweep --reconcile-raw.
- _body_open_brace only matched a `{` on its own line (the K&R shape), so fix() SILENTLY NO-OP'D on
every ANSI draft — the same silent-skip disease as the four catalogued in §40/§8d, caught because
the h_seq re-sweep banked 0/780. Now brace-scans forward from the signature (ANSI same-line,
ANSI own-line, and K&R all work). Load-bearing for func_80178D40's upcoming ×134 bank.
- family_sweep --hseq now applies the §8d scoped stage at staging time.
- HONEST RESULT: still 0/780 — the substantial-band h_seq rejections are a DIFFERENT (sibling) class,
now fully diagnosed against the bytes:
gcc-2.7.2 decl-conflict semantics: a VISIBLE file-scope decl + a conflicting later decl (file OR
block) is a HARD ERROR; a limbo-only block decl (scope closed) + a conflicting later decl is a
warning. The h_seq drafts carry the EXEMPLAR TU's spellings; sibling TUs legitimately spell the
same symbol differently (loose typing), and the visible decl is often MACRO-INJECTED — a
DEFINE_func_* leading extern (§8c), invisible to any col-0 scan (e.g. D_80115158's `short` decl
enters ov_SC01_000.c via DEFINE_func_8014168C() @4637; the draft carries ov077's
`unsigned short` -> conflicting types at ANY scope).
Sub-class (a) no-visible-decl -> §8d demotion (the jr class, proven x133). Sub-class (b) visible
decl, different spelling -> needs reconcile-to-TU-VISIBLE (rewrite the draft decl to the TU-visible
spelling + byte-neutral access cast; oracle = col-0 decls above the stub + engine_core.h macro
externs for the DEFINE_ invocations above). Parked as a designed follow-up task; the 780 members
are mechanical-recovery fodder once the tool exists.
- BUG: the guard `not ln.rstrip().endswith(";")` misses m2c's declaration form
`M2C_UNK func_80178D40(s32, s32); /* extern */` — the raw line ends in `*/`, not `;`, so a
DECLARATION was accepted as a DEFINITION and the forward brace-scan swallowed the NEXT
function's body, handing remap_hseq a garbage unit.
- BLAST RADIUS (measured): 15 of 35 substantial-family exemplars were phantom "matches" — all
still INCLUDE_ASM stubs (incl. func_80178D40 and the carried-queue func_801670E4); 3 more
anchored on the Phase-17 canonical-sig layer's `extern … /* match-first, arity N */` decls and
templated garbage, leaving those families SILENTLY UNBANKABLE. The whole-binary byte-gate
rejected every one — no wrong match was ever banked (G3/P9 held) — but the engine burned a
build per sibling and every extract_unit-based readiness analysis was wrong.
- FIX: strip trailing comments before the `;` test.
- REGRESSION-GATED over the whole corpus (6,286 family exemplars, .run/_eu_before.json):
15 phantom exemplars now correctly refused; 3 garbage units corrected to the REAL definition
(found in the right region file); 0 real definitions lost; 0 unit contents otherwise changed.
src/ and config/ untouched, so the committed build is unaffected.
- cookbook §40: the trap + the general lesson — this is the phase's FOURTH silent-skip bug
(find_site braces, overlay_files splits, reconcile_decls fn-ptr regex, now this). A tool that
silently no-ops on input it cannot parse is indistinguishable from one that had nothing to do.
- ROOT CAUSE (R14 — the session-7 diagnosis was half right): the isolated region builds [ OK ]
WITHOUT the body, so §8b isolation was never implicated. `family_remap.gather_externs` prepends
carried decls at FILE scope; D_801812A4 is a fn-ptr dispatch table the sibling declares FOUR
incompatible ways at BLOCK scope inside its own later functions, so the carried file-scope decl
ESTABLISHES A GLOBAL THE TU NEVER HAD and every later block-scope extern must now agree with it.
Byte-proven asymmetry: BLOCK(int)->BLOCK(struct*)->FILE(void*) builds; FILE(void*)->BLOCK(int)
errors. It was the ONLY hard error in the build — all 27 carried function externs were fine raw.
- THE FIX (demote, don't reconcile): tools/scope_data_externs.py emits a carried D_ extern at BLOCK
scope inside the function body when the TU has no file-scope decl of it above the insertion point.
Byte-neutral (an extern emits no code; type + access opcodes unchanged) and never worse than raw,
so it needs no oracle, no type comparator, no fn-ptr parser. Restores fidelity — the original
declares these symbols at block scope in exactly this way. Wired into jtbl_family_bank as the
`scoped` stage: raw -> scoped -> recovered -> reconciled (scoped is the base for the later stages).
- reconcile_decls is the WRONG instrument for this class, twice: its oracle answers "what does the
FLEET call this symbol" when the question is "what can THIS TU see", and its DATA_DECL_LINE_RE
cannot parse `extern void (*D_x[])(void *);` — silently skipping the very symbols that were
failing (the phase's third silent-skip bug, after find_site braces + overlay_files splits).
- R17 TRIAGE RULE, first real test, held: `conflicting types` = the compiler REFUSED TO COMPILE =
a C front-end diagnostic = our Python. Reading cse.c/global.c would have taught nothing.
- RESULT: func_8015AE2C (562 ins, reach 134) swept 133/133 siblings, 0 failures. R22 clean-fleet
136/136 BYTE-IDENTICAL (534 changed src files); dedup-check 1813 validated / 0 failed; 0
NON_MATCHING (G4). instr-weighted 63.0 -> 63.6%; distinct-code 39.1 -> 40.5% (+256 unique fns /
+79,957 ins) — one core, ~0 agent tokens.
- knowledge captured during the producing session (R30/R31/R21): cookbook §8d, decision-log
2026-07-13 session 8, SETUP tool-inventory row; CURRENT_PHASE session-8 checkpoint.
- NEW "recovered" stage between raw and reconciled: cast_call_sites + reconcile_decls run
against THIS sibling's TU. The recovery must be redone per sibling because the conflicting
symbols are largely PER-OVERLAY (D_801812A4 in ov_SC01_000 vs D_800D4F8C in ov_SC01_077),
so the exemplar's recovered decls do not transfer through the remap.
- The stage loop no longer aborts a sibling when a stage cannot PRODUCE a candidate. It skips
to the next one. canon_sig_reconcile raises on a K&R definition (it expects an ANSI
signature), and a K&R def is MANDATORY whenever a zero-arg engine_core.h thunk calls the
function (func_8015AE2C) — so that must not kill the bank.
- gate-fail now reports the last stage error instead of an empty string.
STATUS (P9): the func_8015AE2C x133 sweep is still BLOCKED and this commit does not close it.
Remaining blocker, precisely diagnosed: the remapped body's DATA externs conflict with the
sibling's §8b carried decl layer (which carries the macro externs of earlier regions and
faithfully reproduces the original TU's declaration environment). reconcile_decls resolves
against a FLEET-MAJORITY canonical oracle, not against the TU's actually-visible decl, so it
picks a type that still conflicts. Fix direction: reconcile the body's externs against the
TU's carried layer (authoritative) — or drop body externs the layer already provides and cast
at use. The exemplar itself is banked and green.
Exemplar banked byte-identical (d19c9580); R22 clean-fleet 136/136.
Fable5 crack: MATCH 562/562, pin-free, jump table verified.
THREE REAL BUGS the bank exposed in jr_isolate_all (each byte-proven; each would have
silently corrupted every future heavy-core bank):
1. --only filtered `banked` as well as the cut set, so already-banked jr went untracked
and their carves were never followed. --only selects what to CUT; it must not erase
the record of what is already banked.
2. carve ownership was read from splat .s — but splat emits NO .s for a MATCHED function
(its .c holds real C), so the lookup found nothing. Now resolved from the extracted
IMAGE via family_remap.reloc_targets (byte-exact: func_801734BC -> 0x801d8c68 etc).
3. THE STRUCTURAL ONE: a region may host at most ONE .rodata carve, because an object's
.rodata is a single CONTIGUOUS section. Cutting at func_8015AE2C (jtbl 0x801D8B54)
left the banked func_801734BC (jtbl 0x801D8C68) inside the same region, so the object
emitted a 0x34 .rodata spanning BOTH tables (image +33 B). Every already-banked jr in
a cut object is now cut too -> exactly one carve per object. Cookbook 8b's "bank
same-subseg families ASCENDING" note warned about this; it is now enforced by
construction instead of left to discipline.
Also required (per the crack's own analysis, all byte-verified):
- engine_core.h: DEFINE_func_8015BEC4's zero-arg thunk returns func_8015AE2C(), so the
extern must drop its (void) prototype and the def must stay K&R/unprototyped.
Byte-neutral across all 136 (R22 green).
- recovery chain: cast_call_sites (27 callees) + reconcile_decls (3 data syms). The raw
body declares callees with types that conflict with their real engine_core.h defs; the
original never redeclares them, it CASTS at the call site (cookbook 20).
Layout now exact: .rodata 0x801d8b54/0x1c (7 entries, pad trimmed) + 0x801d8c68/0x14 +
0x801d92a0/0x20 — one table per object, each at its true address.
Second silent no-op of the §G class, found while permuting func_8017BEBC (close=2):
- hide_asm() is built for __asm__ STATEMENTS and `register __asm__("$sN")` pins inside a
function body (it scans back to the previous ;{} and forward to the next top-level ;).
A draft whose GTE ops are #defines CONTAINING __asm__ (the PsyQ inline_c.h convention,
i.e. most renderer code) therefore had its macro DEFINITIONS chewed up, swallowing the
function itself -> pycparser 'Function <fn> not found in base.c' -> decomp-permuter
no-op'd in 0s. base.c contained ZERO occurrences of the target function.
FIX: cpp_expand_macros() pre-expands with `cpp -P` so each GTE op becomes an inline
__asm__ statement hide_asm can carry via the b64 pragma. Applied ONLY when a
'#define ... __asm__' is present -> macro-free drafts byte-untouched.
- p16_permute was hardcoded to OV=ov_SC01_077's MAIN object, so no core in another overlay
or split object could be permuted at all. Added --asm-subdir (threaded explicitly: a
def-time default arg cannot see a mutated global).
LESSON (cookbook): permuter 'no match (0s)' is a TOOLING failure signature, never a real
search result. Verify workers actually ran.
Verified: base.c now holds the function; 16 workers searching on func_8017BEBC.
A trailing `.word 0x00000000` under a jtbl dlabel is the ORIGINAL TU's intra-rdata
.align 3 padding, NOT a table entry (0x00000000 is not a jump target). The true entry
count is the fn's `sltiu <n>` bound: func_8015AE2C has sltiu 0x7 = 7 entries yet its
raw dlabel spans 8 words.
maspsx drops all .align, so a C-emitted jump table can never reproduce the pad. Carving
to the next dlabel would reserve 8 words while the compiled object supplies 7 ->
.rodata under-fills by 4 B -> every later symbol shifts +4 (the same image-corruption
class as §41d). jtbl_range now trims trailing zero words, leaving the pad in the raw
post-carve data piece.
Retroactively explains the §8a func_80159C84 '5 words vs the real 6' false-MATCH.
Existing carves are parsed from CONFIG, not re-derived, so committed banks are
unaffected (verified: the 3 carved jtbls are absent from the raw data asm). The build
never invokes jtbl_carve, so the fleet is inert to this change until the next bank.
Found by the Fable5 crack of func_8015AE2C (562 ins x134, MATCH, pin-free).
Two bugs the func_80182268 sibling sweep exposed (both would have silently capped
every future jr family bank):
- extract_unit walks BACKWARD from a definition absorbing preceding extern/comment
lines as the fn's preamble. The §8b carried decl layer sits directly above the
FIRST item of an isolated region, so the unit swallowed the whole layer -> the
template dragged ~140 unrelated externs into each sibling (some naming types the
sibling TU lacks) -> gate-fail. jr_isolate_all now emits an explicit end-marker and
extract_unit stops at it (also guards the Phase-17 canonical-sig layer).
- jtbl_family_bank passed the EXEMPLAR's name to the sibling's carve/isolate/stub
lookup. Cross-address families (same engine fn at a different vram per overlay)
therefore never resolved: ov_SC01_077 @0x80182268 -> ov_SC02_000/003 @0x8017FCB0.
The sibling's name is now derived from to_addr. The first two banked jr families
were same-address, so this had never surfaced.
ov_SC01_077 d19c9580 byte-identical; R22 clean-fleet 136/136.
End-to-end proof of the §8b lazy bank composition on a real cracked jr core:
lazy isolate -> jtbl_carve into the isolated subseg -> C body -> whole-binary gate
-> d19c9580 BYTE-IDENTICAL; R22 clean-fleet 136/136.
- func_80182268 (31-ins jr, ov_SC01_077_after) MATCHED first try: shared-tail
fallthrough (jtbl cases 3+7 enter case 4's tail) + the u16-shift sign-extend idiom
((s8)(*(u16*)(p+0x70) >> 8) -> lhu/sll16/sra24). Carve collided with the committed
func_801734BC carve -> lazy isolation fired exactly as designed.
- R14 FINDING (cookbook §41d): the Phase-17 canonical convention "void->s32 return is
byte-neutral (§3a-1)" is FALSE for a void body with no `return` — it costs ONE extra
instruction. canon_sig_reconcile applies it unconditionally, so it turned a perfect
31-ins MATCH into 32 ins. That extra word made the isolated object's .text 4 B long,
shifting EVERY data symbol +4 -> ~271k differing bytes, image +5 B. match_one said
MATCH; only the whole-binary gate caught it (G3/P9).
- FIX (generalizes the §19 sig_unify lesson): every recovery pass is a FALLBACK, never
unconditional. jtbl_family_bank now gates RAW first, reconciled only on failure.
- 136/136 byte-identical from a clean tree (R22); 0 NON_MATCHING (G4).
The full 54-jr isolate-all on ov_SC01_077 now builds d19c9580 BYTE-IDENTICAL
(R22 clean-fleet 136/136) — the configuration session 5 could not build. The
heavy-jr harvest (191 cores / 5.53M templatable ins) is unblocked.
- R14 CORRECTION: session-5's "gcc-2.7.2 block-scope-extern TU-persistence" root
cause was WRONG. There is no gcc quirk — DEFINE_func_* macros expand at FILE
scope, so their leading externs are genuine file-scope decls that merely live in
engine_core.h, invisible to any col-0 .c scan (1377 macros / 3929 lines / 1462 syms).
- REJECTED the approved "global symbol->type map + shadow set" design: the engine is
loosely typed (func_80173544 is DEFINED `s32 f(void*)` yet declared `extern void
f(void);` inside func_801734BC's body), so declaring every USED symbol hoists that
block-scope shadow to file scope and CREATES the conflict a shadow-set then dodges.
Instead reconstruct the original TU's file-scope decl environment and carry it
strictly FORWARD — conflict-free by construction (every carried decl already
coexisted with every definition in the one original TU; compatibility is
order-symmetric; shadows stay in bodies and travel with their item).
- The byte-gate found two MORE lost decl sources, not predicted: (a) a definition is
itself a declaration for everything below it in its TU (func_8012B2CC undeclared);
(b) file-local typedefs used by a carried prototype (parse error, Vec3s). K&R defs
must render `extern T f();` (unprototyped), never f(void).
- LAZY per-core isolation wired into jtbl_family_bank (Drew's call — upfront-x134 =
~7,200 region files): jtbl_carve NON-CONTIGUOUS fail-loud -> jr_isolate_all --only
<core> -> re-extract -> re-carve. Proven on func_80178D40 (890x134, heaviest core):
carve blocked -> isolated (byte-neutral d19c9580) -> carve in its own subseg.
- TWO LATENT BUGS fixed (both would have corrupted the heavy sweeps):
* jtbl_carve.func_subseg derived the owning subseg from the ASM TREE, which `make
extract` never prunes -> after an isolation it returned the STALE owner and
silently re-created the very collision the isolation removed. Now config-derived.
* jtbl_family_bank/jtbl_carve revert() DELETED the shared overlays.mk carve var
unconditionally -> would destroy a COMMITTED carve (all 134 overlays have one) on
any failed sibling. Now restored to its committed value; only region files created
by this attempt are removed; dirty-tree preflight refuses to start a sweep.
- docs: cookbook §8b RESOLVED + new §8c "splitting a TU means rebuilding its
DECLARATION ENVIRONMENT, not moving text"; decision-log 2026-07-13 (R30/R31).
- parser selftest 404/404; R22 clean-fleet 136/136; 0 NON_MATCHING (G4).
Session-4 same-subseg handling (the de-risk preamble's harder half; byte-proof of
the merged build + isolation deferred to Stage 2 with concrete cores):
- jtbl_carve.py: MERGE adjacent same-subseg carves into one spanning .rodata piece
(a code object emits its jtbls contiguous, so two matched jr-fns in one subseg are
byte-correct iff their jtbls abut). BOUND-FIX: a new jtbl's end is bounded by the
next raw dlabel OR the next existing carve start (an already-carved adjacent jtbl
is gone from the data asm -> raw dlabels over-extend it -> false "non-contiguous").
Config-proven (func_80171B4C 801D8C48 merges with func_801734BC 801D8C68). NO-OP
for family-1/cross-subseg (single carve per subseg) -> committed configs unaffected.
- jr_isolate.py (scaffold, NOT yet functional): the non-contiguous case — split a fn
into its own code subseg (whale _o0b precedent) so its jtbl carves independently.
BLOCKED on split_src_region, which can't partition the overlay .c (global canonical-
sig extern layer + per-fn callee-externs + DEFINE_func macros + @class annotations,
~922 non-address items). Stage-2 build item (overlay-.c-aware source split).
- cookbook §8b (the --order sandwich + the two same-subseg cases + the blocker);
CURRENT_PHASE session-4 checkpoint updated with the Stage-2 unblock decision.
- ld_interleave.py --order: address-ordered N-piece data->rodata->data sandwich
for overlays with 2+ matched jr-functions; legacy --front/--tail path is byte-
untouched (main EXE + the 133 single-carve func_8012ACE0 siblings unaffected)
- jtbl_carve.py rewritten additive/regenerate-from-config: parse the tail data
region + existing .rodata carves, split the containing data piece for the new
jtbl, re-emit the address-ordered pieces + the --order arg; same-subseg carve
collision fails loud (-> jr isolation); idempotent
- jtbl_family_bank.py: `make extract` BEFORE the carve (asm must match the reverted
committed config; the old error-string retry was fragile) + revert-on-carve-fail
- family-1: func_801734BC (34-ins PURE jr, ov_SC01_077_after) matched in ov077
(shared-tail switch idiom) + banked 133/133 siblings = x134 — CROSS-subseg
multi-jtbl (func_8012ACE0 in _a + func_801734BC in _after)
- R22 clean-fleet 136/136 byte-identical (~52s); 0 NON_MATCHING (G4)
- the jr-function ×134 harvest pipeline, proven end-to-end: per family sibling,
jtbl_carve (per-sibling jtbl-rodata carve, computed from THAT sibling's own jtbl
address — the fn is at the same vram across overlays but its jtbl floats) -> make
extract (auto ld_interleave) -> remap_hseq + canon_sig_reconcile -> whole-binary gate
- tools/jtbl_carve.py: per-overlay §8 carve generator (config data-tail split +
<ov>_JTBL_INTERLEAVE var)
- tools/jtbl_family_bank.py: the sibling sweep driver (idempotent, revert-on-fail, byte-gated)
- tools/family_remap.py: extract_unit now carries single-line typedefs (jr-function bodies
define local `typedef struct{} Foo_<addr>;` that must template with the body — the
propagation cap for these; additive, byte-gate-protected)
- func_8012ACE0 family: 133/133 siblings BANKED, 0 failures; R22 clean-fleet 136/136
byte-identical; 0 NON_MATCHING (G4)
- metrics: distinct-code 39.1% (50,698 unique fns), instr-weighted 63.0%
- opportunity (has_mid_jr families): 237 total (5,805 members) = 46 small mid/tiny
(771 members, same mechanical pipeline) + 191 substantial (the Fable5 cores, Task 7 paused)
- NEXT: R22 profiling/parallelization; then the other 45 small jr families
- overlay jr-functions can now bank as C: gcc switch jump tables form a .rodata island at
the overlay TAIL; carve a matched fn's jtbl into a dotted [.rodata, <code-subseg>] subseg
+ ld_interleave (data->rodata->data sandwich) places it byte-exact. cookbook §8a + SETUP.
- tools/ld_interleave.py: --section .<binary> param (derives the <binary>_TEXT/DATA/RODATA/
DATA2/BSS symbol prefix); default .main = the EXE, byte-identical (backward-compat proven)
- Makefile + config/overlays.mk: <bin>_JTBL_INTERLEAVE hook + a $(strip)-guarded extract
branch (gotcha caught: a trailing #comment on the := left whitespace -> non-empty -> the
branch misfired on resident with the EXE defaults)
- PoC: func_8012ACE0 (25-ins jr-fn in ov_SC01_077) reconciled (canon_sig_reconcile) + banked
BYTE-IDENTICAL d19c9580 -- the first overlay jr-function matched through the C pipeline
- R22 FULL-FLEET clean rebuild: 136 passed, 0 failed (main 143dbb89 unaffected by the
ld_interleave change); 0 NON_MATCHING in any default build (G4)
- P9 findings: func_80159C84/func_8015444C (the 2 carried Fable5 jr bodies) are rtu_match
FALSE-matches (incomplete jtbls: 52B vs 56B -> never bank); the maspsx "hang" scare was a
truncated experimental-file artifact (real pipeline builds in ~1s)
- metrics: distinct-code 39.1% (50,572 unique fns), instr-weighted 62.9%
- NEXT: the ×134 automation (generate the per-overlay carve + template the reconciled body)
- +266 member-matches: func_8015CD20/func_8015C128 templated x133 via --reconcile-raw (each SHA-gated
per-overlay vs config/check.<ov>.sha = byte-identical, G3). Full R22 deferred until func_80176218
releases asm/ (established per-overlay-gate + deferred-R22 pattern, as the committed 463 which R22'd 136/136).
- family_sweep: --reconcile-raw now also covers draft-ov077 (unbanked) cracks (template from the RAW seed).
- P9 CORRECTION + decision-log 2026-07-12: the 2 Fable5 cracks rtu_match-MATCH but FAIL the whole-binary
gate (both jr-functions; rtu_match masks relocs + excludes neutralized INCLUDE_ASM rodata, so it never
verifies the §8 jtbl rodata). TWO harvest gaps: §8 jtbl-rodata (blocks all jr cracks) + reconcile
data-extern (D_801891B8-class, blocks ~15/21 no-jtbl triage cracks). 6 no-jtbl reconcile-clean cracks
bank whole-binary (729 members). rtu_match is NOT a sufficient arbiter for jr-functions.
- BUILT the per-sibling reconcile: family_remap.remap_hseq_body (h_seq-remap a RAW crack draft: symbol +
immediate + cross-address self-rename) + family_sweep.reconcile_remap_hseq + --reconcile-raw. Per sibling,
remap the RAW crack then canon_sig_reconcile against that sibling's own TU (the h_seq port of the h_norm
M2 path) — because a reconciled body is TU-specific and can't template plainly (validation: 0/4).
- HARVEST: the 4 triage isolation-cracks (func_80155800/80167540/801506A4/8016A73C) templated 463/0 x~133
via --reconcile-raw (0 failures). Metrics: instr 58.5->58.9%, distinct 30.9->31.1%.
- each overlay SHA-gated by harvest_verify vs config/check.<ov>.sha (byte-identical = the match def, G3).
FULL R22 clean-fleet DEFERRED until the concurrent Fable5 crack agents release asm/ (their m2c needs it);
R22 fleet-confirm to follow post-window.
- cookbook §40c (the h_seq per-sibling reconcile technique, R30).
- remap_hseq.gather_externs: carry file-scope externs for body-referenced symbols (extract_unit only
grabbed adjacent ones) — the decl class that blocked per-location bodies indexing a global. func_8015F118
gate-fail -> BYTE-IDENTICAL; the 3 tracker-miss PURE families then bank 133/133 each.
- ran the real whole-binary byte-gate on the 29 substantial matched-exemplar families:
532 members BANKED (byte-gated). Per-family: 3 tracker-miss PURE (0x8015d5e8/0x8015f118/0x801407f4)
bank 100% x133 = 399 byte-perfect (the tracker-fix free win); 1 cross-addr family 50%; 9 zero-bank
families are type-using (Work8016/Prim/...) -> the existing --reconcile/type-lift follow-on (Task 8);
16 families pinned -> Task 7 pin-free re-crack.
- VERDICT: the h_seq machinery (tracker + imm + cross-address + extern-carry) is byte-proven 100% correct
on clean families. GO to scale.
- R22 clean-fleet: make clean + extract-all-136 + check-all = 136 passed, 0 failed. 0 NON_MATCHING (G4).
Metrics: distinct-code 30.3->30.9% (+375 fns), instr-weighted 58.2->58.5%.
- decision-log 2026-07-11 (R31: stratify a mechanical-harvest rate by family/class before judging it).
- Fable5 subagent cracked func_80166994 (trail/afterimage ring recorder, 369 ins) — FULLY
STRUCTURAL, zero register pins -> swept ×134 CLEAN (exemplar + 133 siblings byte-identical).
R22 clean-fleet 136/136; instr-weighted 56.8% -> 57.2%; distinct-code 27.3% -> 28.2%
- NEW IDIOM cookbook §43: a K&R s16-param DEFINITION dissolves the §17/§29 "narrow-param wall".
On MIPS K&R promotes s16->int (ABI-identical to the canon-sig s32), body keeps the in-place
sll aN,16 narrow/extend the (s16)cast form can't reproduce. void->s32 return-flip pair:
split //@EDIT (self-fn, ov077-specific) + engine_core.h ec_edit ×5 (byte-neutral, callers discard)
- family_sweep --edit-remap: split-edits now OPTIONAL (apply where present, never skip; the
whole-binary byte-gate is the sole arbiter, G3/P9) — a sibling lacking the ov077 canon-sig decl
still banks via ec_edit + body. edit-absent tracked, not skipped
- R14: the prior wave's "@stuck: none — MATCH" note on func_80166994 was STALE/FALSE (re-ran DIFF
366/369). Verify a MATCH claim vs the bytes, never a stale note
- structural cracks are the ×134-SAFE ones (contrast §42e pin-heavy families that cc1-SIGABRT in
sibling TUs). Other 6 giants -> cheap-Opus applying §43+§31, Fable5 only on new-class evidence
- weighted_metrics() from .run/sig.*.jsonl + src stubs (executable code only, resident + 134
overlays; main EXE excluded). Two framings: fleet instr-weighted (per-overlay, the decomp.dev
-display number) + dedup distinct-code (each unique h_exact once, the distinct-RE number)
- --fleet now emits THREE labeled metrics into docs/progress.fleet.md: fn-count 74.48% (×134-
inflated), instr-weighted 56.8% (shipped .text), distinct-code 27.3% (of 84,996 unique fns)
- --weighted prints the two weighted numbers standalone; degrades gracefully if sigs absent
- corrects the stale "~30-35% byte-weighted" estimate: the giant campaign since Phase 19 raised
the fleet instr-weighted number to 56.8%; the distinct-code 27.3% is the unique-monster-tail truth
- SETUP §tooling row updated (R21)
- family_sweep.py: new --edit-remap MANIFEST mode (§42e) — per family, symbol-remap the
split-scope //@EDIT old||new per sibling + apply once-global engine_core.h ec_edits
(byte-neutral), stage the family_remap body, gate via harvest_verify (the sole arbiter)
- BANKED 266/266 (0 failed): func_80136824 + func_80136334 (array-decay ptr-flip) ×133
siblings each — full ×134. R22 clean-fleet 136/136, fleet 74.40% -> 74.48%, dedup 1813/0
- R14 FINDING (cookbook §42e addendum + decision-log): the other 4 byte-drift families
(func_80133AB0 zero-reg pin, func_8016DF5C/8013D9B0 GTE-pin, func_80156044 trampoline)
cc1-SIGABRT (Error 134) in the SIBLING TU — hand pins are ov077-TU-context-specific,
NOT mechanically ×134-recoverable; backlogged as ×1/permuter fuel. rtu_match/match_one
are blind here (neutralized/isolation compiles crash too); only make build is truth
- 0 NON_MATCHING in any default build (G4)
- R14 CORRECTION of the prior "family_remap limitation" call: it was a MISDIAGNOSIS. family_remap
succeeds on all droppers; the "remap-fail" family_sweep reports was a mislabeled canon_sig_reconcile
throw ("no definition of func_X found in draft") — the def-finder regex required a leading \n, so a
//@EDIT-stripped raw draft with the fn definition on line 1 was not found.
- FIX: def-finder regex \n -> (?:^|\n) (also match a def at draft start; strictly additive, low-risk).
- Recovered func_8014FE60 fully: 133/133 siblings banked (fix + engine_core.h DEFINE_func_8014FDF4
extern void->s32 global flip, byte-neutral fleet-wide; caller discards return).
- Residual (the genuine, small --edit-remap): func_8016DF5C/80136334/8013D9B0/80156044 reconcile but
byte-drift per sibling (out-of-body fixes: pointer //@EDIT, no-proto, return-flip not carried per sibling).
- cookbook §42e (the two-layer diagnosis + the forward ×134-leverage-realism rule); decision-log corrected.
- R22 clean-fleet 136/136 BYTE-IDENTICAL from a fully clean tree; NON_MATCHING 7 (0 in default build, G4).
- tools/t7_bank.py: the M1 driver (reconcile-at-bank-time against the CURRENT TU + harvest_verify
whole-binary gate; chunk-bet + per-round re-reconcile for cross-fn ambient mutation; giants first)
- canon_sig_reconcile v3.2: uniquify ALL draft-defined type names AND struct/union TAGS to <name>_<addr>
(byte-neutral) -> collision-proof when many exemplars bank into one TU (the 'redefinition of struct Fr'
class); banked func_8016A290 (284-ins giant) + fixed the inter-draft collisions
- 37/40 non-jumptable M1 exemplars banked BYTE-IDENTICAL (ov_SC01_077 d19c9580, clean rebuild); each is
currently ×1 (M2 sweeps them ×134 next)
- R14 CORRECTION (cookbook §41b): the T6 object-only probe OVER-counted BANKABLE by 7 -- it is blind to
rodata + link. (a) 4 jump-table fns (3 _o0 giants + func_8012ACE0): .text byte-perfect but a switch
jump table in rodata diverges -> REFUTES the T6 'Q3 -O0 REFUTED' claim; F-band jump-table workflow.
(b) 3 last-referencer link-walls (func_8016D688/D1D8/165240): C-ifying the only asm referencer of a
scratch data symbol drops splat's auto-symbol -> ld undefined reference; M-linkwall tier, deferred
- ov_SC01_077 REAL 32 stub-exemplars -> 37 more defined; whole binary byte-identical throughout (G3/P9)
- batch-3: the 3 _o0 giants 3/3 isolation-MATCH at -O0 (new tools/match_one.py --o0 flag);
0 banked — an -O0 in-context byte-diff (canon_sig_reconcile's void->s32 is NOT byte-neutral
at -O0) -> deferred to T7. Frontier 125/127 draftable exemplars measured.
- R14 correction: the mechanical reconcile-sweep is NOT the clean 51-target x134 win first
hoped. The frontier "match" status carried un-verified agent claims (5-sample spot-check
= 3/5 genuine); ~19/51 have clean engine_core.h canonicals (the reliable canon_sig_reconcile
tier), the rest hit VARIED walls (callee-sig conflicts, non-identical types Vec3/SVEC,
macro-local data) -> this is the genuine Fable5/T6 residual, not a mechanical sweep.
- docs/phase25-t6-fable-brief.md: the grounded Step-B input package for the fresh Fable5Max
session to author the crack curriculum (95-stub worklist by wall-class + tools + 5 swing
questions). CURRENT_PHASE: T6 hand-off (fresh session, Fable5Max, read the brief). Phase OPEN.
The family-sweep driver validated end-to-end: remap ov_SC01_077 exemplar -> 133 h_norm-siblings,
plain harvest_verify banked 133/133 byte-identical (0 failed). func_80141100 now matched in all 134
overlays. Added a match_one pre-classify so the full sweep gates only clean drafts (type-using
families -> .run/sweep_deferred.txt for the decl-reconcile pass, avoiding bisection blowup).
Two-phase: for each matched ov_SC01_077 fn with unmatched same-address h_norm-siblings, remap
(family_remap) to each sibling + byte-gate into that overlay. Stage all drafts per (overlay,split),
gate each group once via PLAIN harvest_verify (remapped drafts need no transforms — T3). Sizing:
169 exemplars, 22,117 member-remaps, ~3.2 MB potential. Type-using families fail-compile -> logged
for the decl-reconcile pass (not remap failures).
Swing question resolved. h_norm families are byte-shattered by PER-OVERLAY symbols, so free
--tier h_norm dedup fails (0/133 on 0x80141100). BUT the mechanical remap works: disassemble
two h_norm-identical members, positionally pair their reloc targets, substitute the exemplar
per-overlay symbol names -> the sibling C. Verified: reloc decoder 22/22 vs .s; 0x80141100->
ov_SC01_000 whole-binary byte-identical + harvest_verify banked; 12/12 siblings; 7/9 families
x3 = 21/27 match_one. The 2 fails = decl/type plumbing (T7 refinement), not remap fails.
Reshapes the endgame: crack ONE exemplar/family -> remap+gate members (~0 tokens/member); the
11.1 MB is cheaply mechanical. Members no longer need drafting; only exemplars do.
--auto silently skipped the 263-stub ov_SC01_077_after cohort: the drift-check hardcoded
the main asm subdir and gate_stage was never passed src/asm/src_file. Now stub_map() reads
each stub asm subdir from its INCLUDE_ASM line, the drift-check uses the per-fn subdir, and
reconcile_and_gate groups targets by split file, gating each via run_gate(src=,asm=,src_file=).
fix_arity_callers/dedup_propagate already split-aware; harvest_verify self-filters per split.
- housekeeping: deleted stale root gccdump.lreg (gcc default -da RTL dump, dumpbase
"gccdump"; a one-off RTL-inspection run at root CWD, NOT a committed tool). Practice:
RTL dumps go to a .run/ CWD or -dumpbase .run/gccdump (R12)
- make sig-overlays (134 sigs); worklist.py --refresh -> build_fuel_manifest + backlog
render: docs/worklist.md + docs/backlog.md regenerated (stale Jun-26 ranking killed;
the banked whale func_80144B9C dropped from backlog, P9)
- fix tools/sig_image.py docstring: h_norm is the live norm_stream normalizer, not a
"T5 placeholder" (R21/R30)
- CURRENT_PHASE.md: Phase-25 plan-of-record + T0 frontier survey (R14): h_norm 2,764
multi-member families / 11.1 MB; 46% of large solo monsters (3,989/8,670) are family
members; reach-134 h_exact warm-up = 130 classes / 4.11 MB
- func_801770E0 (152 ins, reach-134) propagated ×134 via dedup_propagate --recover.
Chose the NATIVE DEFINE-macro path over a hand-rolled shared header: func_8014E048
(pins+asm) is already ×134 via a DEFINE macro, proving that path handles pin/asm -O2
giants (the whale needed a shared header only because it is -O0 -> separate object).
Clean fleet check-all 136/136 (R22), dedup-check 1811->1812/0.
- R14: func_8014E048 was ALREADY ×134 (T6 §A) — the whale-session handoff was stale;
only func_801770E0 + func_801372B0 actually remained ×1.
- tooling (reusable): dedup_propagate.overlay_files now also scans the whale-rollout
_o0b/_after splits — post-whale-region fns (func_801770E0 in _after.c) were invisible
for both source-def-find and stub-replacement. func_801770E0 extern block made
contiguous (a comment between externs made find_site drop 5 externs; byte-neutral).
The single biggest byte-weight lever (770 ins ×134 ~ +1.6% byte-weight), banked across all 134
overlays as -O0 compiled C (was ×1 in ov_SC01_077, commit:0463).
- ROLLOUT (tools/rollout_whale_o0.py): per single-file overlay, LINE-split <ov>.c at the whale
(splat emits in vram order), carve the yaml code subseg into before/<ov>_o0b(-O0)/<ov>_after,
thin <ov>_o0b.c #includes the shared src/shared/func_80144B9C.h (the whale C moved there — DRY,
TU-local typedefs, not a fragile 200-line DEFINE_ macro). Makefile WHALE_O0B_OBJS wildcard -O0.
- DEDUP: group E_func_80144B9C (134 members, h_exact 74186b97, source=the header; group_members
keys on binary+vram so a header-share validates like a macro-share).
- MILESTONE: clean fleet check-all 136/136 (R22); dedup-check 1811/0; FLEET REAL 225816->225949,
byte-identical 65.91->65.95% function-count (the gain is byte-weighted). Validated on ov_SC01_000
+ spot-checks SC02/SC03/SC07 before the full fleet.
- cookbook §38 + SETUP inventory.
- tools/reconcile_decls.py: the DATA-symbol analog of cast_call_sites.py. A fleet-majority
canonical-type ORACLE (engine_core.h-authoritative + plurality across all overlays+resident —
the picker gen_harvest_targets lacked) + a byte-neutral access-cast TRANSFORM (array/struct/
scalar/ptr taxonomy, single-pass so no double-wrap). Mechanizes the manual giant decl-reconcile
that func_80129CF8 got by hand.
- wired into gate_stage after cast_call_sites (canon -> cast -> reconcile_decls -> byte-gate);
idempotent / no-op on drafts without a data conflict -> can't regress the wave; the whole-binary
byte-gate stays the sole arbiter (G3/P9).
- VALIDATED: oracle 8/8 correct picks for func_80129CF8's symbols; full loose giant ->
reconcile_decls -> swapped into the DEFINE_ macro -> make build BINARY=ov_SC01_077 = BYTE-IDENTICAL
d19c9580; idempotent (0 reconciled) on the already-canonical committed draft.
- find_site extern-collection: allow a trailing `/* comment */` after the `;`. The
comment-blind regex `^\s*extern\b.*;\s*$` stopped the backward scan at
`extern u8 D_801152A8[]; /* canonical TU type */`, dropping every EARLIER extern →
compiles_standalone failed on the now-undeclared callees/data (func_80135A4C,
func_80133784, D_801152A8). R14: THIS — not "pin/asm" as the backlog framed it — was
func_8014E048's real self-containment blocker.
- propagated func_8014E048 (the T5b S11 pins+barrier crack) + func_80157580 ×134;
dedup 1797→1799 groups (0 failed). CLEAN fleet check-all 136/136 BYTE-IDENTICAL (R22).
Fleet byte-identical 65.40% → 65.48%.
find_site + dedup_propagate --recover + build_engine_types fixes, then re-bank
the 13 recover_integration leaf-MATCHes and propagate each across all 134 overlays.
- find_site: match INDENTED inline defs (was column-0 only, silently dropping every
recover_integration-banked def from propagation — T6 blocker 1). Unit-tested:
indented defs match; indented call-exprs (if/assign/bare/return) correctly rejected.
- dedup_propagate --recover: on a straggler byte-gate failure, FIRST no-proto that
overlay's conflicting caller extern + re-gate (Part B, byte-neutral, same lever as
fix_arity_callers --any-proto); else EXCLUDE only that overlay (Part A, ×N-1) rather
than the historical all-or-nothing drop. Wired into gate_stage.
- build_engine_types: comment-aware find_defs/find_typedefs (blank_comments). The
generated header's own "...typedef lift" comment was captured as a bogus `typedef
vec`, self-colliding and blocking every --strip. NOTE: full --strip still conflicts
with the _a/_o0 split files, so split-file overlays need a TARGETED lift.
- banked + propagated 13 fns ×134: func_8014F74C 801542A4 8015BE94 8015F380 80160F00
801653B8 80166244 8016E778 801732C4 8017331C 80173374 80174554 801745AC.
func_8014F74C needed PosT/MoveT lifted to engine_types.h (targeted, byte-neutral).
- dedup 1784→1797 groups (0 failed). CLEAN fleet check-all 136/136 BYTE-IDENTICAL (R22:
make clean && extract-all && check-all). Fleet REAL 224073, byte-identical 65.40%.
R14: the confounding stale-asm/ tree (13 missing .s) that masked the first --recover
test is fixed by re-extract; the 3 pre-existing --auto-from stragglers (0x80174650/
8012A018/80165CA0) are pin/asm + uncaptured-local-macro (SHB) bodies, correctly dropped.
The integration-recovery tool for leaf-MATCH-but-whole-binary-gate-rejected fns ("declaration/TU
plumbing" — the dominant residual gate_stage's canon/cast/sig_unify pipeline doesn't reach).
- tools/recover_integration.py (NEW): batch recovery — gather leaf-MATCH candidates (--auto from
the backlog, drift-checked R14; or --funcs/--from-file) → no-proto their conflicting caller decls
→ gate_stage (byte-gate + log). 2-PASS snapshot/restore: pass 1 finds the bankable set, pass 2
re-banks ONLY winners from the clean snapshot (so non-banks are never corrupted).
- tools/fix_arity_callers.py: extended with --binary — scan+rewrite the overlay's OWN inline caller
decls (src/<bin>/<bin>*.c), not just engine_core.h. That was THE gap: a conflicting caller extern
is often inline in the overlay src (e.g. func_8016E778's `extern void f(void)` vs def `f(int)`),
which fix_arity_callers never saw -> the fn stayed unbanked.
- VALIDATED: banked 13 leaf-MATCH fns (func_8014F74C/801542A4/8015BE94/8015F380/80160F00/801653B8/
80166244/8016E778/801732C4/8017331C/80173374/80174554/801745AC), CLEAN-verified together
(ov_SC01_077 d19c9580). The banks themselves are reverted here (they re-bank via the tool and
will land ×134 once propagation-recovery lands — cleaner than committing ×1).
- R14 lesson (clean-verify caught it, R22): fix_arity_callers --revert is LOSSY for --any-proto
(()->(void), not back to the original args) -> corrupted non-banks; fixed with the 2-pass snapshot.
- REMAINING T6 (×134 propagation-recovery, 3 diagnosed blockers): (1) dedup_propagate find_site
misses INDENTED inline defs (Phase-15 class); (2) overlay-local-type lift; (3) auto-reconcile the
straggler's conflicting caller externs (the flagship func_80132784 / ov_SC02_005 class, done by
hand — needs automating). See CURRENT_PHASE.
Drew T