- log the func_801670E4 (§57 decl-normalize) + func_8016CBC0 (6-typedef lift) completions
- capture the commit gotcha: use 'git add -u src/' for sweeps, not a split-name glob (SC07 carves
members into differently-named files; a glob silently omitted 4 R22-verified banks, fixed by amend)
- SESSION-3 CHECKPOINT: 140/140 byte-identical, fleet 75.1% instr, safe to open a fresh session
- func_8016CBC0's 137 members were NOT self-decl-blocked (§57 survey: 0 divergent self-decls) but blocked
on the exemplar's 6 LOCAL typedefs (Rec_/Blk_/SVEC_/CLR_/Poly_/Mtx8_8016CBC0). Lifted all 6 verbatim into
src/shared/engine_types.h (fleet-visible via engine_core.h) + removed the locals from the exemplar TU.
No fleet name-collision; exemplar rebuilds byte-identical d19c9580 (the type-lift is byte-neutral).
- family_sweep --hseq --only 0x8016CBC0 --no-preclassify --normalize-self-decls -> 137/137 banked, 0 failed
(the decl-normalize stage a correct no-op here — 0 self-decls). 0 func_8016CBC0 stubs remain fleet-wide.
- R22 clean-fleet 140/140 byte-identical; tools-health OK (dedup 1846/0, C1 234205/234205); 0 NON_MATCHING
linked (G4). fleet 74.9->75.1% instr / 60.1->60.6% distinct / 86.96->87.00% fn-count.
- R14 lesson: two families that both looked like a 'stuck 137-family' needed DIFFERENT levers
(decl-normalize §57 vs type-lift) — route by the real cc1 error, not the shape. session-total +270 members.
- new tools/normalize_self_decls.py — the SAME-FUNCTION decl-normalize: drop each decl of the templated
fn F that the sibling TU's OWN already-banked callers declare divergently (block-scope, a different C
form than the exemplar's fn-ptr cast) + cast its in-scope calls (byte-neutral §17a-1). cast_call_sites
does the callee direction, reconcile_tu the data direction; this is the third: F itself.
- family_sweep --normalize-self-decls: new per-sibling stage after reconcile_def_sig (edits the sibling
TU file = harvest_verify's baseline, like edit_remap_sweep) + snapshot/final-SHA-MISMATCH revert backstop.
- byte-proven the sole blocker was the caller-decl conflict, NOT --fix-def-sig (which renamed F's def
params a0..a3 while the body used arg0..arg3 -> arg0 undeclared; R14 confound removed). 133/133 banked,
0 failed, 0 backstop fires; 0 func_801670E4 stubs remain fleet-wide.
- R22 clean-fleet 140/140 byte-identical; tools-health OK (dedup 1846/0, C1 234205/234205); 0 NON_MATCHING
linked (G4). fleet 74.6->74.9% instr / 59.4->60.1% distinct / 86.92->86.96% fn-count. cookbook §57.
- R14: func_8016CBC0 (also stuck 137-family) has NO divergent self-decl -> type-lift-blocked, a SEPARATE
lever (6-typedef cluster, like 8012956c), not this pass. Route by the real cc1 error.
func_801670E4 sibling ov_SC01_004: caller decl 'extern void func_801670E4(Entity*,s32,s32,s32)' conflicts
with canonical 's32(s32,s32,s32,s32)'; exemplar used a fn-ptr cast at that caller. Fix = per-sibling
decl-normalize pass (same-function analog of cast_call_sites). Validation targets + where-to-build named.
- ROOT CAUSE PINNED (the session-2 half-pin was INVERTED; both probes were vacuous, R35):
cc1 emits .align 3 before EVERY jump table; maspsx passes it VERBATIM (the :435 'drop' is
an inventory-only pass); as bakes the pad SECTION-RELATIVE; link placement was never guilty
(SUBALIGN(2) + ALIGN(.,4) place 4-mod-8 carve starts tight). Merging originally-separate
TUs fires an intra-TU align where the original packed tight -> +4 at rodata 0xCC ->
image-wide %lo shift. Honest probes persisted: .run/probe_jtbl/ (verdict.md + objdumps).
- NEW tools/jtbl_rodata_pads.py: post-maspsx filter replaces each rodata .align 3 with the
ORIGINAL's exact pad bytes per a JTBL_PADS spec; fail-loud on table-count drift /
non-align-3 / non-jtbl rodata content. Byte-proven: verbatim 0xE4 pad-at-0xCC ->
filtered 0xE0 tight (= the merged carve span).
- jtbl_carve.py: spec-aware same-subseg merge (gap 0 or 4-with-zero-payload-word; else
NON-CONTIGUOUS -> isolate), interval-arithmetic pad specs (committed values CARRIED,
never re-derived), JTBL_PADS target-var emission into overlays.mk + revert() restore +
stale-.o invalidation; the false 'maspsx drops .align' docstring corrected (H5).
- Makefile: $(if $(JTBL_PADS),| jtbl_rodata_pads.py ...) stage in build/src/%.o + file-scope
empty default (env-shield). jtbl_family_bank.stub_file: duplicate-stub fail-loud (the
earlier 'ladder failure' was a wrong-TU splice into a stale _a.c stub, byte-witnessed).
- R22 clean-fleet WITH the fix wired: 140/140 byte-identical, tools-health green
(dedup 1846/0, C1 234205/234205), ZERO new banks -- fleet-neutral by construction.
- cookbook §8e (the jtbl alignment law) + §8a/§8a-pad corrections; decision-log R31 entry;
SETUP.md tool row; .gitignore allowlist for the probe verdict artifacts.
The 2 Task-3 cores banked x1 but skipped by dedup_propagate ("not self-contained: local types").
Lifted EntSC01077 (func_8014E284) + P_TAG_80137DD4 (func_80137DD4) into src/shared/engine_types.h
(fleet-included via engine_core.h), and inlined func_80137DD4's file-local `#define OTE` into the body
(byte-neutral macro expansion, re-evaluated per use to preserve codegen). Both now self-contained ->
dedup_propagate --recover = 138 overlays byte-identical, 0 stragglers, 2 new dedup groups.
~+32.7k ins (108+129 x138). R22 clean-fleet 140/140 byte-identical; tools-health OK; dedup 1846->1852;
C1 coverage 234205. §55c local-type propagation cap lifted for these 2.
SESSION-2 close: this session banked ~94k ins across 4 fns x~137 overlays (2 non-jtbl giants fully
propagated + this 2-core type-lift); fleet 71.4->72.1% instr (+0.7pp), 140/140 throughout. The 4 jtbl
giants remain deferred on the byte-proven 8-align jtbl-carve gap (root cause half-pinned: cc1+maspsx
both emit .align 2, so the +4B pad is a downstream as/ld_interleave artifact) -> teed up as the next task.
Task-4: the non-jtbl giant func_8013FAF8 (312 ins) is now DONE fleet-wide. It is an h_seq family
(masked-identical body, per-overlay symbols/relocs) so dedup_propagate refused it (reach<2); the
path is family_sweep --hseq --only 0x8013FAF8 --allow-pins (per-overlay symbol remap).
First sweep banked 0/137: family_sweep copies the exemplar's extern block VERBATIM, and the
hand-crafted exemplar had 4 callee externs diverging from the fleet-canonical (func_8005A600
void->s32, func_80024054 s32->void*, func_80137D08 s32*->int, func_8013AB54 s32*->s32) -> every
member threw `conflicting types`. Aligning those 4 in the COMMITTED exemplar .c to the
member-consensus form (byte-neutral; ov_SC01_077 stays byte-identical) -> re-sweep 137/137 banked,
0 failed. +312 ins x137 ~= +42.7k ins.
R22 clean-fleet 140/140 byte-identical; tools-health OK. Cookbook §56b (exemplar externs must be
fleet-canonical for an h_seq sweep; contrast dedup_propagate --recover which auto-reconciles CALLER
externs -- family_sweep does not, so pre-align the CALLEE externs by hand).
Both non-jtbl giants now fully banked+propagated (func_8013FAF8 x137, func_8014F4C0 x134); the 4
jtbl giants remain deferred on the byte-proven 8-align jtbl-carve gap.
Task-4 giant-bank #2. func_8014F4C0 (141 ins) banked x1 in ov_SC01_077_after.c (its earlier
"gate reject" was pure §55b propagate-damage — gated clean on the healthy tree, no fleet change).
h_exact family -> dedup_propagate --addr 0x8014F4C0 --recover: ov_SC01_000 was a cross-overlay
straggler (all-or-nothing h_exact), --recover reconciled the conflicting caller externs and kept
it -> 134 overlays byte-identical after propagation, +1 dedup group in config/dedup.us.yaml.
R22 clean-fleet 140/140 byte-identical; tools-health OK; ~+19k ins.
GIANT TAXONOMY (session finding, cookbook §56 + CURRENT_PHASE): the 12 preserved giants split into
- NON-jtbl (func_8013FAF8, func_8014F4C0): bank clean on a healthy tree, propagate x137 via macro/h_seq.
- jtbl (func_80131340/func_80159C84/func_8013C414/func_8013F350): each needs a per-overlay jtbl carve
x137 AND hits an 8-align gap -> func_80131340 DEFERRED (byte-proven: gcc emits a non-first jump
table .align 3 while the original packs it 4-aligned -> +4B padding shifts the whole data island,
+5B/3077-diff image-wide %lo breakage). A jtbl_carve 8-align/isolation fix unlocks ~4 giants x137.
Task-4 giant-bank #1 of the 12 preserved p29t3 drafts. func_8013FAF8 (312 ins, a
menu/HUD prim builder stubbed in 138 overlays) BANKED x1 in ov_SC01_077, whole-binary
byte-identical; R22 clean-fleet 140/140; tools-health OK (dedup 1843/0, audit-binaries OK).
The README billed it "pure def-sig plumbing" but it was a 5-conflict multi-symbol
reconciliation (~5 gate iterations), all byte-neutral + gate-arbitrated (G3/P9):
- def-sig s16/s16 vs canonical s32/s32 -> NARROWED the extern fleet-wide (404 decls/265
files). NOT --fix-def-sig: the s32 variant diverges at insn 22 (match_one, R35). Neutral
because every fleet caller passes (s16)-cast or small-const args (verified).
- 3 data-symbol conflicts (D_80115128 lh / D_800B9A02 lhu / D_80187AC0 s32[]) declared
BEFORE the splice (block-scope §55a-blocked) -> the TU's §18 cast-at-use-site convention
(*(s16*)&, *(u16*)&, ((s32*)&sym)[i]) forces the load width regardless of decl signedness,
keeps the TU decl untouched, propagation-safe. No CSE-hoist across 5 uses.
- 2 fn-extern conflicts (func_8013FFD8 s16 arg0, func_80141100 int(int)) -> reconciled the
draft decl to the TU def + byte-neutral call-site cast. Still MATCH 312/312.
Stubs 138->137, 1 def, 0 NON_MATCHING (G4). Fleet holds 71.4/53.3/86.42 (the ×1 exemplar is
negligible until propagation ×137, batched per §55b). Technique -> cookbook §56.
TASK 3 COMPLETE (both deliverables):
(a) jr cores: a 2nd ultracode wave cracked all four giants at match_one — func_8013F350 (490),
func_80131340 (424, verified TWICE: standalone AND in-TU cc1 rc=0), func_80159C84 (337),
func_8013C414 (329, -O0). ALL FOUR gate-rejected on INTEGRATION (def-sig / §8a rodata island /
decl conflict), not codegen; each blocker NAMED. func_8013C414 matched ONLY because of the new
worker_wave --o0 fix (a -O0 target self-checked at -O2 can never match — the §53/§54 wrong-build-step
trap that produced Phase-28's "~3%" artifact).
(b) §53 has_mid_jr INTERLOCK: built + negative-control-proven (commit:0670).
PRESERVED (R20 — ~2.6M agent tokens to reproduce; bank them, do NOT re-draft):
.run/giants/p29t3_*.c (12 drafts) + p29t3_README.md — every draft is match_one-MATCH or a
characterized near-miss, with its exact blocker + a cheapest-first bank order. Best value:
func_8013FAF8 (312, MATCH, pure def-sig plumbing); then func_80131340 (in-TU-proven);
func_8013F350 (§30#2 macro-widen void->s32); func_8013C414 (§8a rodata-island carve).
Permuter fuel: func_80177940 (close=5), func_801670E4 (16 — strip pins first, permuter can't
ingest them), func_8014D820 (33), func_80140958 (116).
SESSION CHECKPOINT — safe to open a fresh session:
140/140 byte-identical; tools-health OK; dedup 1843/0; 0 NON_MATCHING (G4); main 143dbb89.
Fleet 68.9 -> 71.4% instr / 49.5 -> 53.3% distinct-code / 83.94 -> 86.42% fn-count.
Tasks 1,2,3,6 DONE. Remaining: T4 (member harvest + grinder warm-start/bug-fixes), T5 (Ghidra-C
prefetch, needs /mcp), T7 (burn-down + ROI close). Carried: the 2 local-type-blocked cores
(func_8014E284, func_80137DD4) need the build_engine_types type-lift to propagate x137.
- targeted dedup_propagate --addr per core (NOT --auto-from), --recover for stragglers:
0x8014ADE0 -> 138 overlays byte-identical
0x801325B8 -> 134 (ov_SC07_011 byte-diverges -> auto-excluded, kept x1 — what --recover is for)
0x801387B8 -> 138 overlays byte-identical
= ~410 member-instances; 3 new dedup groups (1840 -> 1843), C1 coverage 233795/233795.
- 2 of the 5 banked cores (func_8014E284, func_80137DD4) stay ×1: "not self-contained (local types)"
-> blocked on the build_engine_types type-lift (the §19/§20 propagation cap). Carried.
- R22 clean-fleet 140/140 BYTE-IDENTICAL; audit-binaries OK; dedup 1843/0; 0 NON_MATCHING (G4).
Fleet instr 71.0 -> 71.4% / fn-count 86.30 -> 86.42% / distinct-code 53.3%.
- SELF-CORRECTION (R14/R35), now fixed in cookbook §55c + CURRENT_PHASE: my earlier claim that this
propagate "needs ~2h+" was WRONG. That timing was taken while the tree still carried the partial
damage of a killed --auto-from (90/140 overlays broken), so every member-gate was failing/retrying.
On a HEALTHY tree a targeted --addr propagate is ~233s/core (all 3 = ~27 min) — ~20x faster. Only
--auto-from is genuinely fleet-slow. A timing taken on a broken tree measures the breakage, not the
tool — recover the tree FIRST, then measure.
- cookbook §55: the wave's new byte-proven levers (§49-variant birthing-boost suppression via
reg_n_sets 1->2; sched1 birthing/LUID + "cc1 -dL" movable introspection; switch-tree vs jtbl
CASE_VALUES_THRESHOLD=5; block-scope-extern beats *(T*)&sym) + the GATE-ORCHESTRATION law
(--no-propagate per group then ONE targeted --addr; commit banks BEFORE propagating; a reverted src
needs a re-extract; gate_stage's default harvest_verified.txt accumulates -> phantom banks).
- 0x80131eec (2887) + 0x80130d0c (2679): family_sweep --hseq staged 4966, banked 1/4966 (0.0%)
- diff_regions: TEMPLATES / O2:MATCH(0) — remapped C is byte-correct at -O2, jump-table symbol
IS remapped (D_8018708C[idx]() -> D_801815EC[idx]()), but D_801815EC is splat-LOCAL and NOT a
defined linker symbol (absent from config/symbols*) -> named C ref can't resolve -> whole-binary
DIFF; masked_diff hid it (masks %hi/%lo) — R35 (a masked-MATCH contradicting the gate = the tool
hides the divergence)
- FIX (deferred, focused sub-project): define/export per-overlay jump-table data symbols so remapped
C links -> banks ~4,966 members mechanically (the biggest cheap lever left). Same 'reproduce the
build step' class as §53-carve / -O0-flag; here the missing step is symbol DEFINITION
- no banks kept (tree reverted clean); characterization only. CURRENT_PHASE per-task log updated
Acting on Task-1's verdict (the legacy-PURE "~3%" is tooling, not a wall): the -O2
type-lift arm. family_sweep --hseq --no-preclassify --band all --allow-pins templates
each matched exemplar's C onto its unbanked same-family members and whole-binary
byte-gates every one (the sole arbiter, G3/P9). The pin-crash wall being dissolved
(Phase-27/28 _carry_macros) let --allow-pins retry the pinned exemplars.
- BANKED 3,407 member-matches across 136 overlays (INCLUDE_ASM stubs -> matched C).
- R22 clean-fleet verify: 136/137 modified overlays byte-identical from a clean rebuild;
the 1 FAIL (ov_SC07_010) was the SIGTERM mid-gate partial -> reverted, byte-identical.
- make check-all: 140 passed / 140 BYTE-IDENTICAL; dedup-check 1840/0; audit-binaries OK;
audit-cdecl green; 0 NON_MATCHING in any default build (G4).
- Fleet: instr-weighted 68.9 -> 70.2% (+1.3pp) . distinct-code 49.5 -> 51.9% (+2.4pp) .
fn-count 83.94 -> 84.73% (+0.79pp).
- Process lesson (CURRENT_PHASE.md): --band all sweeps are too long for one background
pass (got SIGTERM'd); future Arm B runs go band-bounded + committed-per-batch (resumable).
Residual FAILED members (pin/drift/plumbing) + the -O0 Arm A carve remain.
Phase-29 opens by running the Phase-28 disambiguating probe before scaling any
"(cores)x(reach)" arithmetic on the legacy-PURE-non-jr "~3% as-tooled" swing number.
- NEW tools/diff_regions.py (the deferred roadmap tool): remap the exemplar exactly
as family_sweep --hseq stages it, compile at the EXEMPLAR's real opt level
(auto-detected from the Makefile -O0 rules), masked-diff vs target, classify each
member O0-FLAG / TEMPLATES / PLUMBING-ISO / REGALLOC / NO-TARGET. Composes
family_remap + match_one + masked_diff (R33).
- VERDICT (byte-proven): the 274 DIFF is dominated (~272) by two -O0 families
(0x8013c964, 0x8013c938) that family_sweep compiled -O2 (member stub files are -O2);
an -O2 compile of an -O0 target can never match. Compiled -O0 they masked-MATCH
(func_8013C964->MATCH(10), func_8013C938->MATCH(11)). 106-member sample across
nins 2..133: O0-FLAG 45 / already-banked 29 / TEMPLATES 17 / type-lift-plumbing 15 /
REGALLOC 0. ZERO codegen walls.
- The "~3% ceiling" is RETIRED (a tooling artifact — the 3rd structural wall to resolve
to tooling after B2 and SC07). The member track is a mechanical -O0 split rollout +
type-lift sweep (Task 2a), NOT a per-member grind; member_adapt.py not needed here.
- Honest scope (§52b, R14/R35): masked-MATCH is a CANDIDATE; whole-binary banking is
Task 2a's gate. Verdict + byte evidence -> docs/calibration.md + docs/decision-log.md (R31).
- RE-SCOPED at plan time (R35): the roadmap's swing number rested on a broken-tool probe. B2's
"structural families bank ~0%" (0/8, which reshaped 2 phases of strategy) was a MISSING CARVE ->
8/8, then 102/115 (88.7%). The ~0% doctrine has NO surviving post-fix evidence.
- T0 img_path derive-not-guess -> un-hid a 230,612-ins SC07 pool doubly hidden (P27 onboarded 4
overlays, never regenerated the map; the hardcode would have called every member "LEN").
- T3-A: the SC07 pool is h_exact + UNWIRED, not h_seq. T4 dedup_extend (NEW) wired 6174/6457 (95.6%)
-> groups 134->138 binaries, C1 coverage +6174. NOT member_adapt (the number said build nothing).
- T5: resident 21->14 (90.34%, 7 banked via an Ultracode wave) + honest dossier for the 14; fixed
progress.py (#if 0 + len()-sum) and match_one's FAKE isolation (found by an agent mid-wave).
- T2 purged the poisoned grinder blacklist (8/22 matched anyway). T6 killed the --chunk 1 double-build.
- T7: make audit-binaries (the R36 citizenship gate, negative-control-proven) + fixed disc_code_sweep's
BLINDNESS to compressed code (the type-4 row was vacuous for 138 known binaries) + the worklist key-bug.
- T3b: the legacy h_seq swing number = ~3% AS-TOOLED, CLASSIFIED (274 DIFF / 37 PLUMBING), ceiling
UNKNOWN -- the 274 DIFF is byte-PURE members whose remapped bodies don't reproduce (the same
tooling-vs-wall ambiguity that resolved to TOOLING twice this phase). P29 disambiguates before scaling.
- THREE SELF-INFLICTED DEFECTS fixed forward: the registry yaml.safe_dump (H5, destroyed 47 comments +
1832 hex fields, invisible to every byte-gate), two DIFF mis-reports (R14), the match_one shared scratch.
- rule R36 (a newly-discovered binary is not real until every consumer knows it; enforced by
audit-binaries). cookbook §53. R22 140/140 throughout; tools-health OK; dedup 1840/0.
The roadmap's actual swing number (the LEGACY h_seq templatability rate; T3-A's SC07 pool was a
different question — h_exact + unwired, banked 95.6%). family_sweep --hseq --chunk 1 over 6 legacy
PURE non-jr families (has_mid_jr excluded per §53):
- 9 BANKED / 37 PLUMBING / 274 DIFF (173 skipped not-stub/pinned) = ~3% (9/320). R22 140/140.
UNLIKE Phase 26, the failures are CLASSIFIED — 274 genuine gate-DIFF, not an unclassified 0%.
- THE LOAD-BEARING NUANCE (R14/R35 on my own probe): the 274 DIFF is NOT structural variance. The
members are byte-level PURE (classify_member = reloc-only, 20/20 sampled), genuine h_seq (all
DIFF_BYTES vs the exemplar, so family_sweep is the RIGHT tool not dedup_extend), at the SAME vram.
A PURE family should reproduce once its relocs are remapped -> 274 non-reproducing members means the
remapped body FAILS TO RECOMPILE to the member's bytes: either (a) an incomplete symbol_map (the
recurring jtbl/prefix bug -- B2's 0/8 and T4's 12 DIFFs BOTH resolved to tooling THIS phase) or
(b) genuine TU-context regalloc divergence (a real wall).
- HONEST VERDICT: ~3% as-tooled, CEILING UNKNOWN. Provisionally consistent with "legacy h_seq doesn't
mechanically template" but on a probe whose dominant failure mode is the exact tooling-vs-wall
ambiguity that keeps resolving to TOOLING. Did NOT rush-resolve it at ~40% context (that is how
Phase 26 manufactured a wrong 0%). P29 MUST run the disambiguating probe (diff one PURE DIFF
member's staged bytes region-by-region: reloc-position mismatch = fixable remap; regalloc-away-
from-relocs = TU wall) BEFORE scaling "(cores)x(reach)" on 3%.
- calibration.md + decision-log R31 record the measurement + the named next probe. 9 real banks.
Fleet 67.0 -> 68.9% instr / 47.8 -> 49.5% distinct, 140/140 byte-identical, 0 NON_MATCHING.
Gate items met (swing number measured; resident resolved 90.34% + dossier). T7 (expanded to the
audit-binaries R32/R36 gate + the blind disc_code_sweep fix) and T3b (the legacy h_seq rate) are
recorded in CURRENT_PHASE with full state; both benefit from a fresh session's context. R36 drafted
for PhaseEnd ratification.
The flag-plant did NOT reach 100% (21 -> 14). This records what is left and WHY, per function,
so the next attempt starts from evidence instead of re-deriving it.
- docs/resident-dossier.md: all 14 remaining stubs in 3 honest classes + the 5 deferred jtbl.
Each entry is the agent's own byte-grounded analysis — the levers tried, the exact gcc pass that
blocked it, why it stuck. That analysis cost ~2.4M tokens and IS the durable asset (R30); the 7
banks were the cheap part. Raw verdicts preserved at .run/resident_wave_verdicts.json (R20,
force-added past the .run/ ignore since they are not regenerable).
- 5 PLUMBING: reached match_one MATCH standalone, failed IN-TU on `conflicting types`
(D_8010EDEC / D_80115110 / func_800D1984 / CdReadRequest / cdFileLocTable). The Phase-16
loose-typing wall: the C is byte-correct, the TU cannot hold both spellings. gate_stage's
recovery banked 0/5 — this needs a resident-scoped §41 def-side lever, not more drafting.
- 4 DIFF: genuine gcc-2.7.2 residuals, each with a NAMED mechanism (func_800D2650 close=4 and
func_800CFAD0 close=5 are permuter-class seeds; func_800D0E30 and func_800D27DC carry intrinsic
allocno-priority verdicts).
- 5 jtbl DEFERRED: need the rodata-island carve (§53 + the Phase-7 workflow), which the resident
has no split infra for. Deliberately NOT forced — sweeping a jr function without its carve is
EXACTLY how the "≈0% structural families don't template" doctrine was manufactured (T1), and
that mistake cost two phases of strategy.
- The dossier records the two caveats a future reader needs: the wave ran on a broken match_one
(shared scratch — fixed in commit:0652, verdicts may carry that noise, the GATE results do not),
and the func_800CEDFC / func_800D33E0 sig_image boundary question (defined in resident.c, absent
from the 2nd oracle, while audit-corpus reports 0 PHANTOM/TRUNCATED) -> T7 audit-binaries.
Completes T4 and corrects two defects I introduced, both landed in commit:0649.
- WIRED: 006 1543/1614 · 007 1544/1615 · 010 1544/1614 · 011 1543/1614 = 6174/6457 = 95.6%,
~0 agent tokens. Stubs/overlay ~2400 -> 831/984/898/825. Fleet instr 67.0 -> 68.9%,
fn-count 82.16 -> 83.94%. dedup-check 1840 validated / 0 failed; groups now read
"138 members [138 binaries]" (was 134); C1 coverage 227211 -> 233385 = exactly +6174.
R22 make clean && extract-all && check-all -> 140 passed, 0 failed of 140 at every stage.
- FIX#1 — I DESTROYED THE REGISTRY'S DOCUMENTATION, AND EVERY GATE CALLED IT GREEN (H5).
The first cut wrote config/dedup.us.yaml with yaml.safe_dump, round-tripping the whole file:
47 comment lines -> 0 (including the curated Phase-11 header explaining WHY the share is
source-level) and 1832 `vram: 0x80162FF4` -> `vram: 2148937716` (PyYAML parses YAML-1.1 hex to
int; dumps int as decimal). 25,948 lines rewritten. It passed dedup-check 1840/0 AND check-all
140/140 because _addr() accepts both forms: THE DATA WAS CORRECT AND THE DOCUMENT WAS RUINED.
Fixed forward (R6, no history rewrite): restored from commit:0649~1 and re-applied the 6174
memberships via a surgical text edit (add_members_surgical). Verified: 1545 insertions / 1545
deletions, 0 non-`binaries:` lines changed, 47 comments + 1908 hex fields intact, and the
rebuilt fleet is byte-identical to the destructive version (140/140).
THE LESSON: every oracle this project owns measures BYTES, so a formatting-destructive write is
invisible to all of them by construction. R34 says the byte-gate is a null COVERAGE oracle; this
is the same hole one layer out — it is a null DOCUMENT oracle too.
- FIX#2 — I MIS-REPORTED THE DIFFs, TWICE (R14).
(a) commit:0649 claims ov_SC07_006's 71 non-banks were "ALL PLUMBING, ZERO DIFF". FALSE — I read
head -6 of the classified file and generalized. It has the same 4 DIFFs as the others.
(b) I then built the jr guard assuming those 4 were the §53 jr class BECAUSE ov_SC01_077 hosts
them in _jr_8017A4AC.c / _jr_80182268.c. has_mid_jr is FALSE for all four (33-52 ins, no
jump table): they merely live in a carved jr-REGION split, which sweeps in every function in
its address range. HOSTING FILE != FUNCTION CLASS.
The guard is KEPT (preventive, §53-correct, currently skips 0 — no jr fn is in the extendable
set) with its docstring corrected to record what it is NOT. The 12 DIFFs (0.19%) are UNDIAGNOSED
and logged, correctly left as stubs by the gate — not dressed in a story.
- The 283 non-banks: 271 PLUMBING (the loose-typing conflict class + the whale, whose body lives
in src/shared/func_80144B9C.h so no DEFINE macro exists to expand) + 12 DIFF. Existing tools
cover the plumbing (cast_call_sites / canon_sig_reconcile / reconcile_tu).
Stratum A of the swing-number probe, on the cleanest test available: the 4 highest-byte-weight
SC07-only families are the GIANTS (func_80144B9C 770 "the whale", func_80141CA4 476,
func_80132784 400 "irreducible for 22 phases", func_80133CD4 399 the §45 Fable5 crack).
Exemplars already byte-proven, members PURE, non-jr -> every confound removed.
- RESULT 4 banked / 8 failed / 4 skipped of 16, and the CLASSIFICATION is the finding:
* BANKED 4 = func_80133CD4, a 399-ins Fable5 giant, into 4/4 new overlays, free
* PLUMBING 8 = "parse error before ')'" (func_80144B9C, func_80132784) — never compiled
* skipped 4 = pinned-exemplar (§42e guard; P27 T5 dissolved the wall behind it)
* DIFF 0 <- NOT ONE failure is a byte mismatch
Of the members that reached the gate as valid C: 4/4 = 100%. This is exactly the
DIFF-vs-CC1-FAIL distinction Phase 26 never recorded, and why its 0% couldn't be trusted.
- ROOT CAUSE (byte-verified, far bigger than the parse error): the 4 new overlays were
onboarded byte-clean but NEVER WIRED INTO THE SHARED-BODY ECOSYSTEM.
established ov_SC01_001 : common.h + ../shared/engine_core.h ; DEFINE_func_*() ; ~2150 matched
the 4 new SC07 : common.h ONLY ; ~2400 raw stubs ; ~80 matched
refs in config/dedup.us.yaml: 0. 1689 registry groups say "134 binaries", never 138.
The parse error is a symptom: the drafts need types (P10/P14/P18/P1C/HDR/ENT) that live in
src/shared/func_80144B9C.h — a header the SC07 TU never includes.
- SCALE (measured vs the registry): 6,513 live stubs across the 4 new overlays are byte-identical
to an ALREADY-REGISTERED h_exact group (1625/1628/1627/1633). That is the h_exact class —
which calibration.md itself rates ~xN near-100% — NOT h_seq, and NOT a member_adapt problem.
- MECHANISM PROVEN BY HAND (probe-before-investing): +#include "../shared/engine_core.h" and ONE
stub -> DEFINE_func_80128158() in ov_SC07_006.c -> make build -> 7ca772be... BYTE-IDENTICAL.
Probe reverted; the tool should do it uniformly.
- THE TOOLING GAP -> T4: dedup_propagate --auto-from plans only 11 fns (it authors macros from
ov_SC01_077 INLINE DEFS; the ~1600 shared bodies are ALREADY DEFINE_func_* macros in
engine_core.h), and --addr errors "no source overlay has it matched" because no overlay holds
an inline def. There is NO mode for "extend an existing macro-backed group to a
newly-onboarded binary". T4 builds it (NOT member_adapt — the number says build nothing else).
- R22: make clean && extract-all && check-all -> 140 passed, 0 failed of 140.
- CARRIED -> T3b: strata B (legacy PURE non-jr, 95 fam / 7993 members) and C (legacy IMM, 36 fam
/ 6644) — the LEGACY h_seq rate is still genuinely unmeasured. The SC07 pool answered a
different, cheaper question than T3 set out to ask.
The blacklist recorded "permuter won, byte-gate rejected => plumbing-bound, never
re-permute" for 22 fns. It was manufactured by a gate that no longer exists.
- R14 ON THE PREMISE, TWICE (before touching anything):
* The roadmap's two named grinder bugs are ALREADY FIXED (commit:0327, commit:0200) — stale line.
* docs/tooling-audit.md:933-937 DOWNGRADED ITS OWN FINDING with three corrections: the
prescribed fix is a NO-OP (deleting the scanner banks zero fns — harvest_verify was
single-TU BY CONSTRUCTION, the defect was mislocalized to it); nothing is being discarded
now (grinder STOPPED since 2026-07-02 — confirmed via .run/auto/STOP); queue magnitude
inflated (1252, not 1298). T2's only real content was the persisted artifact.
- AND THE AUDIT'S SNAPSHOT IS ITSELF STALE (verified in code): harvest_verify is now fully
multi-TU — _stubs derives every stub across every TU from the corpus oracle (:122), render()
splices "each draft into the TU that actually holds its stub", _write() writes multiple
paths, un-stubbed drafts are REPORTED not silently dropped (R32). The gate that manufactured
the blacklist is gone. No harvest_verify change was needed or made.
- THE PROOF IT WAS MANUFACTURED, NOT OBSERVED: of the 22 entries, 8 have since MATCHED anyway
(func_80131D68/80149374/8014FE60/80150528/8016BBE0/80171C64/80174684/8017F290); the other 14
are still stubs and would have been skipped FOREVER on a dead gate's verdict. (16 of 22 were
split-hosted, so harvest_verify never compiled them — the permuter's byte-matches were
discarded UNBUILT. The audit predicted 5 matched-anyway; it is 8.)
- DONE: blacklist -> [] (poisoned copy preserved at grinder_blacklist.json.poisoned-pre-T2);
grinder.py now carries the RULE (R35): a blacklist entry is a verdict from a SPECIFIC GATE
and EXPIRES when that gate changes — purge and re-derive from the fixed gate, never inherit.
A persisted negative verdict is only as good as the instrument that produced it.
- No byte claim (analysis tooling + a scratch artifact only) -> no R22 cycle owed.
The family the roadmap recorded as 0/8 ("~0%, structural families do not template" — the
number that rewrote P29's arithmetic to "(cores cracked) x (reach)") banks at 88.7% when
swept with the carve its own exemplar required. ~0 agent tokens.
- SWEEP: jtbl_family_bank.py over the remaining 107 members ->
{'BANKED': 94, 'gate-fail': 7, 'remap-refuse': 6}. Family total 8 (T1) + 94 = 102/115.
R22: make clean && extract-all && check-all -> 140 passed, 0 failed of 140, 0 FAIL lines.
- FLEET (measured, make report): instr-weighted 67.0 -> 67.7% (+0.7pp, +97,104 ins);
distinct-code 47.8 -> 49.4% (+1.6pp); fn-count 82.16 -> 82.19%. 102 x 952 = 97,104 =
the exact measured instruction delta — the arithmetic reconciles to the byte.
- THE 13-MEMBER TAIL is the predicted shape, and both halves are data for T3:
* 6 remap-refuse = EXACTLY the family's 6 IMM members (cls_counts PURE 109 / IMM 6).
imm_map_tier1 REFUSED rather than guessed: "unresolved immediates: [(512,
'asm-ambiguous')]" — 512 also occurs at a non-differing position, so a blind swap could
corrupt it. This is the concrete shape of T3's IMM stratum.
* 7 gate-fail = genuine byte-DIFFs, correctly rejected. Verified to leave NO residue
(all 7: split_file=none, cfg_refs=0) — no false-bank risk.
- HYGIENE: the 7 "git checkout ... did not match any file" errors are benign (revert of a
never-tracked path). Verified 0 untracked splits belong to a non-banked member; 91 new
splits + 3 banked into existing splits = 94.
- SCOPE (P9, unchanged): still n=1 family, and jr is the rarest class (3/163 matched-exemplar
families). This demonstrates the mechanism at family scale; it does NOT give a rate for the
PURE/IMM mass (98% of the population). T3 measures the swing number.
The roadmap's decisive P28/P29 input (h_seq families bank at ~0%) is byte-refuted. Same
family, same era, through the carve path its own exemplar required: 8 of 8 BANKED.
- THE PROBE: jtbl_family_bank.py func_8017BEBC ov_SC01_000 0x8017bebc --raw
.run/phase26-cracks/func_8017BEBC.c over 8 of 115 members (4 same-address + 4
CROSS-address, exercising to_addr) -> {'BANKED': 8}.
R22: make clean && extract-all && check-all -> 140 passed, 0 failed of 140.
- ROOT CAUSE of the P27 0/8, byte-verified: 0x8017BEBC is a jr/switch core. §47 banked its
exemplar as "lazy isolation -> carve (9-piece interleave) -> splice -> BYTE-IDENTICAL" and
called the fix "×N template-safe". family_sweep.hseq_sweep stages C and gates -- it has NO
CARVE STEP -- so gcc's generated jump table is never placed at the sibling's address. The
entire residual is TWO WORDS: classify_member -> PURE, ndiff=2 @ idx 343/345 =
lui/lw %hi/%lo(jtbl_801EC44C). overlays.mk:112 carves ov_SC01_000_jr_8017BEBC.o for the
exemplar; :134 has no such entry for the member. tools/jtbl_family_bank.py exists to do
exactly this per sibling and had NEVER been run on this family.
- THREE COMPOUNDING FAILURES made the doctrine: (1) wrong tool for the class; (2) n=1 on the
LEAST representative family -- has_mid_jr is 3 of 163 matched-exemplar families (120 of
13,232 members) -- generalized to the whole frontier; (3) its corroborating Phase-26 probes
(tiny-IMM 0/241, PURE 0/134, pinned 0/133) ALL predate _carry_macros (P27 T5, commit:0637).
P27's decision-log calls its own re-probe "a FOURTH phantom exhaustion proof" -- naming the
mechanism that would have faked the first three, and never re-running them. The ~0% doctrine
has NO surviving post-fix evidence.
- SCOPE HONESTY (P9): this refutes the EVIDENCE for ~0%; it does NOT establish a general rate.
n=1, and jr is the rarest class by construction. T3 measures the rate over the population
that actually exists: 1418 matched-exemplar families / 21,889 members (PURE 78% / IMM 20% /
STRUCT 1.8% -- note the roadmap sizes its swing number on STRUCT = 1.8% of the input).
- TWO SELF-CORRECTIONS (R14), both mine: (a) the approved plan's "add jtbl_ to symbol_map" was
a WRONG FIX FROM A TRUE DIAGNOSIS -- a compiler-generated switch table is never named in C,
so there is no token to substitute; the fix is PLACEMENT. No symbol_map change was made and
T1 became a run, not a code change. (b) func_8017BEBC.md's header still says "close=2 of 952"
(pre-§47-slider); the .c was updated, the .md was not -- templating from the header's premise
would have produced zeros indistinguishable from a wall.
- DISTILLED IN-SESSION (R30/R16): cookbook §53 (sweep a family with the tool its exemplar
needed: the carve law, the --raw rule, the symbol_map-jtbl trap, and the "before a 0%
retires a lever" three-question test); calibration.md's decisive table REWRITTEN (the ~0%
row marked an artifact, not a rate; the addressable pool tabulated); decision-log R31.
- Carried: the family's remaining 107 members (~101,864 ins, ~0 agent tokens) -> T1b.
R35 sequencing: fix the instrument before the probe that scopes the phase.
- family_remap.img_path: DERIVE the payload from config/splat.<bin>.yaml's target_path
(R33 — the file the BUILD reads, so it cannot drift from the bytes) instead of
reconstructing `.../FILE_{nnn}.dir/0.4.dec` from the alias. RAISES on a missing
payload (R32) — the silent None WAS the defect.
Negative control (the fix must change an answer the old tool gave):
ov_SC01_001 -> 0.4.dec UNCHANGED (no regression)
ov_SC07_006 -> None -> .../1.4.dec
resident -> (n/a) -> MAIN.CD.dir/FILE_010.dir/1.1 (free; feeds T5)
ov_SC99_999 -> None -> raises
Downstream: all 233 shared substantial fns between ov_SC07_006 and ov_SC01_001
classify PURE (reloc-only). Under the old tool every one returned LEN = "not
templatable" AND poisoned its family's diff_class to MIXED (family_hseq.py:141-143).
Same bug class as new_overlay.sh's hardcoded 0.4.dec glob (which hid these four
overlays for a month) — left uncorrected in a second tool. Fourth instance of the
project's dominant defect class, sitting directly under the number P28 must measure.
- .run/family_hseq.json regenerated: 134 -> 138 overlays (the 4 P27 SC07 overlays newly
visible); metrics re-baselined 68.9 -> 67.0% instr (now agreeing with the committed
progress.fleet.md); LEN across the whole frontier = 0 (a phantom-LEN from a missing
image is now structurally impossible). Proven consistent against the post-tools-health
sigs by a second run (byte-identical) rather than assuming sig_image is deterministic.
- FINDING — a large, doubly-hidden target pool: 1255 families / 6268 members / 230,612 ins
whose ONLY unmatched members are in the 4 new SC07 overlays (0 elsewhere — a clean
partition), each behind an ALREADY-MATCHED, byte-proven ov_SC01_077 exemplar. Classes
PURE 5575 (89%) / IMM 633 (10%) / STRUCT 60 (1%). Hidden twice: P27's disc audit created
it by onboarding the overlays but never regenerated the map — and had it, img_path would
have classified every member LEN. Corroborated independently by tools-health: the 4 new
overlays are ~97% unmatched (stubs ~2,400, matched ~80) vs ~85% matched for their
siblings. PREDICTION, not a bank — h_seq predicts, the whole-binary gate decides (G3/P9).
-> T3's headline stratum, and a better probe than planned: the exemplar is already
byte-proven, so a failure isolates the templating mechanism with no drafting variable.
- SELF-CORRECTION (R14): the approved plan's own population figures (163 families /
13,232 members) came from the STALE map — my numbers were an instance of the defect this
phase is about. Honest: 1418 matched-exemplar families / 21,889 unmatched members
(PURE 17,024 = 78% / IMM 4,473 = 20% / STRUCT 392 = 1.8% — the roadmap's "register-drift"
swing class stays ~2% of the input, so that framing is unchanged). Legacy pool unchanged
at 163 families (the fix + the 4 overlays are purely additive).
- T3 strata (honest): SC07-only 1255 fam / 6268 mem / 230,612 ins · legacy PURE non-jr
95 / 7993 / 478,379 · legacy IMM 36 / 6644 / 212,707 · legacy MIXED 30 / 968 / 10,462 ·
legacy PURE w/ jr 2 / 16 / 5,088. Total addressable 937,248 ins = 21.7% of all remaining
weight = 7.16pp of fleet instr if it all banked — the prize the roadmap declared dead.
- tools-health GREEN: sigs fresh; corpus(+resident) 0 PHANTOM + 0 TRUNCATED; cdecl;
report(lint + dedup 1840 validated / 0 failed, C1 coverage 227211/227211). No source or
build input touched (analysis tooling + regenerated digests only) -> no byte claim, no
R22 cycle owed. docs/duplicates.cross.md regenerated: overlays 134x -> 138x, h_exact
cross-binary 9366 -> 9484 groups; resident sig now the sig_image one (P27 T10 intent).
The last Fable5 pass of the sprint (Drew capped further waves at 86% context). func_80176734 (371 ins,
fresh un-drafted core): NO bank (mine=370 vs 371, 5 permuter-shaped clusters — entry-schedule tie,
caller-saved shuffles, a combine-merge missing insn, qty ties), pin-free, honestly handed off (P9;
match_one confirms the DIFF). Draft -> decomp-permuter warm-start (P29).
Idiom harvest (cookbook cse_expr §H):
- THE CSE ADDRESS-FOLD ANTIDOTE (zero asm): find_best_addr's cost-ungated qty-const fold + from_plus
re-association eat reg-based global accesses on every cse walk; a balanced if/else DIAMOND makes the
merge label barrier-preceded -> fresh cse table -> both folds die with no #APP. Replaced two asm dials.
- update_equiv_regs doubles live_length for single-set REG_EQUIV pseudos (local-alloc.c:1064) — a 2nd
set forfeits the doubling, ~4x the allocno priority; explains a "my dial broke the $s-order" class.
- record_jump_equiv fall-through delete (cse.c:7511) — a recognition tell for genuine dead source logic.
T1 sprint COMPLETE: 4 cracks + the SIGABRT characterization, 0 direct banks, but 3 wall reclassifications
+ 2 cracked roots + the pin-crash wall dissolved + ~9 new pin-free levers. Fable5 DISCOVERS, cheap-Opus
APPLIES — the ROI is idioms, not banks (docs/calibration.md).
docs/calibration.md — the byte-gate-grounded rates that size P28/P29 (roadmap §6 held yield
projections until this).
- VELOCITY: instr 68.9->67.0% (a T7 denominator re-baselining DOWN, not a regression) + ~0 matches
banked (an infrastructure/findings phase). The honest flip-checkpoint read: denominator correction
+ unblocking findings, NOT 0 progress/session — velocity resumes at P29, re-measure there.
- THE TEMPLATABILITY SWING (decisive for P28/P29): h_exact reach-N cores propagate ~xN near-100%
(§52: 5 cores -> 670 instances) vs h_seq/h_norm structural families ~0% (0x8017BEBC: 106/112 stage
but 0/8 bank, all genuine DIFF). So remaining yield = per-member cracking + mechanical xN for the
h_exact cores, NOT "template x120 the 986 families" — B1/B2's cheap-harvest hope is byte-refuted.
The 223-stub frontier: 101 reach-134 (xN-able if cracked) + 119 reach-1.
- COST/TIER: Fable5 ~230k tok/fn, 0 banks / 5 — ROI is idioms + the pin-crash wall dissolved, not
banks (the doctrine held). cheap-Opus is the banking tier; permuter tail exhausted; local-v3 $0/<=15.
- HONEST GAP: the headline member-adapt close-rate on register-drift members needs P28's member_adapt
tool (chicken-and-egg) -> P28 opens by measuring it on a byte-gated sample, per the risk register.
- NEW un-projected fuel: ~20 PINS-class stubs now harvestable (pin-crash dissolved, T5).
- worklist --assert-partition: the audit's literal R32 prescription (tooling-audit.md:1173) —
enumerate live stubs from corpus.stubs (the invariant, R33), assert the fuel manifest partitions
its source overlay's stubs, exactly one row each. Scoped honestly (worklist's universe is ONE
overlay ~223 stubs, not the fleet's 53k — a fleet partition is a scope change, not a flag). PROVEN:
it caught 5 stale rows (pin-free cores Phase-26 banked, manifest never re-derived) -> FAIL exit 1.
- honest re-scan: build_fuel_manifest on the fixed tools + 140 binaries. Giants re-verified reach-138
(was 134 — the SC07 overlays now counted). Partition PASSES 223==223 after refresh.
- ledger corruption fixed: func_80178004's 2 false `close=0 "MATCH"` records (a Phase-26-retracted
myth — the seed's best was 5 pinned, and a real close=0 whole-binary match BANKS; it is still a
stub) -> corrected to the honest close=91 regalloc wall. func_8012E364 already honest (close=23 —
the "stale closeness" flag was itself stale). No real duplicate rows (load_best dedups by addr;
the uniq hits were func names in where_stuck prose). docs/worklist.md + docs/backlog.md regenerated.
- the 1,670-untriaged near-miss triage SCOPED TO P29 (P5d): Phase-21 automation leftovers whose class
labels re-derive at harvest, and the pin-crash finding re-buckets the PINS class — an Ultracode
fan-out buys low-durable labels; the gate's residue map is the partition + the class summary, done.
The flywheel step (R16/R30): turn the wave-1 + SIGABRT byte-proven findings into cookbook/codegen-map
knowledge, in the producing session. The distillation REWRITES wall verdicts, so accuracy is load-bearing.
- cookbook §42e-CORRECTION: the "pin-crash wall" (register-pin-heavy families "SIGABRT the sibling TU,
ov077-TU-context-specific, NOT ×134-recoverable") is REFUTED. The SIGABRT is real (sched.c:2725
create_reg_dead_note, a sched1 REG_DEAD-note conservation bug) but was TRIGGERED by extract_unit
dropping file-scope #define macros (the T5 bug) -> implicit-call GTE ops -> caller-saved pins in the
fatal shape. Only 1 of 4 families genuinely crashed; 3 were exit-33 plumbing folded into one crash
bucket. Fixed, all 4 stage 133/133 clean. Per-pin predicate recorded. P31's pin route is OPEN.
- cookbook §44-Lever-5: the 3 functions it cited as intrinsic (func_8014D820/8016CBC0/801670E4) are
each oracle-refuted (2 cracked roots + 1 RC-6-not-S3). Corrected the "NEVER ship pinned, it SIGABRTs"
claim per §42e-CORRECTION.
- gcc-2.7.2-map/regalloc.md §H: THE reg_renumber-swap oracle (discriminate RC-6 allocation from S3
scheduling in one gdb run — patch reg_renumber at reload entry, swap the contested regs; byte-exact =
pure allocation), RC-14 reused-load-temp serialization (the MERGE pole; pin-free, cheap-Opus), RC-15
the density dial across a floor_log2 boundary (subsumes "coalescing knife-edge"), and the local-vs-
global allocation tie as a precisely-named honest sub-class. Continues the §F/§G RC-6-downgrade series.
- decision-log.md R31: the 3 Phase-27 strategic findings (disc is bigger: 140 + 39 modules; a wall was
our tool again; a cheap win is dead) + the through-line — the roadmap's numbers were red-teamed, the
tools under them were not, until this phase.
func_80176734 (fresh-core wave-2 agent) still running; its findings fold in before the PhaseEnd.
family_remap.extract_unit dropped the file-scope function-like #define macros a body references
(the gte_* C inline-asm GTE-op macros live ABOVE the function; the backward preamble walk stopped at
the first #define/continuation line). A staged sibling saw every GTE op as an implicit-declaration
CALL. Two consequences in one bug:
- staging failed: 0x8017BEBC's 112 members all CC1-FAIL'd -> a FAKE 0% probe that reads
"mechanical harvest dead" when the tool was broken (a 4th phantom exhaustion proof, exactly the
26-A audit class).
- the SIGABRT: with a caller-saved register PIN present, the phantom call pushes cc1's sched1 into
create_reg_dead_note's abort (sched.c:2725) — the §42e "pin-crash wall". The wave-2 SIGABRT agent
proved this IS the cause (.run/giants/pin_crash_sigabrt.md): pinned families stage 133/133 clean
once their macros ride along. A propagation wall recorded as a compiler limit for phases = a
staging-tool artefact.
- _carry_macros: prepend the function-like #define macros the unit body references (file order),
not already inside the unit. Safe by construction: feeds only the templating path (remap_hseq),
never make_macro's engine_core.h lift (no #define embedded in a DEFINE_func_*() macro);
gather_externs only scans func_/D_ so no bogus extern; regression-verified non-GTE exemplars
carry 0 macros (a no-op where it should be).
THE HONEST PROBE (R14): staging 0 -> 106/112 (6 skip = IMM tier-2). Bounded 8-member gate sample =
0 banked / 8, ALL genuine DIFF (T4 classifier: compiled, wrong bytes — NOT plumbing). 0x8017BEBC is
BYTE-PROVEN NOT TEMPLATABLE: the roadmap's "largest cheap win left" (B2) is REFUTED. The h_seq match
is necessary, not sufficient. This 0% MEANS something because the tool is fixed first.
Carried to T8: harvest the now-unblocked pin families (verify the 133/133 claim + bank).
The metrics contract (roadmap §1) wants all three metrics WITH main in the denominators, and the
second, independent boundary oracle (R34) extended beyond the overlays. Both had landmines.
10a — main into the weighted metric, safely:
- weighted_metrics off the func_-only src_stubs regex onto corpus.stubs (R33). THE LANDMINE IS
REAL: src_stubs("SLUS_007.26") globs src/SLUS_007.26/*.c -> 0 files -> every row "matched" ->
main 100% + fleet % silently inflates. Routing through corpus.stubs is a PROVEN 0.000pp no-op on
the existing fleet (overlays are all func_) and closes the curated-name leak.
- a SEPARATE "MAIN game-code weighted" line (0.7%): main's Ghidra sig excludes the LINKED PsyQ
objects (Ghidra never analysed them), which is exactly right for a game-code metric (LINKED is
complete, counted in fn-count). Reported un-folded and caveated (month-stale sig, PROVISIONAL) —
folding a stale/incomplete value into the decomp.dev headline would mislead the flip checkpoint.
10b — the resident second oracle:
- make sig-resident: sig_image on the resident flat blob (byte-derived, not Ghidra). corpus.
sig_is_independent now covers resident -> audit-corpus checks its boundaries too. Probed clean
BEFORE wiring (144 fns, all 21 stubs present, 0 phantom), verified 0 phantom + 0 truncated.
- sig-overlays now derives its payload list from config/overlays.mk, not a 0.4.dec glob that
silently dropped the 4 SC07 index-1 overlays (the audit's own silent-skip class). tools-health
regenerates sig-overlays + sig-resident first so the audit never crashes on an absent sig.
10c — main's second oracle: docs/second-oracle.md. sig_image can't sign the PS-X EXE yet (0x800
header offset, interleaved data/linked islands, one text range); seeding from splat would destroy
independence for the PHANTOM class specifically. Honest deferral + scoped design, not a fake oracle.
- docs/progress.fleet.md regenerated: 140 binaries · fn-count 82.16% · instr-weighted 67.0%
(the honest post-T7 drop from 68.9%) · distinct 47.8% · MAIN game-code 0.7% (separate).
- SETUP §6.3 updated (R21).
The whole-binary byte-gate is structurally blind to code nobody onboarded (R34): check-all is
green over the onboarded set no matter what code sits unbuilt on the disc. This reconciles the
onboarded set against every code-bearing PAC payload.
- new_overlay.sh: optional [ENTRY] arg (default 0.4) reaches a non-0.4.dec payload. Onboarded
ov_SC07_{006,007,010,011} from 1.4.dec (they put graphics at PAC entry 0, the code overlay at
entry 1 — invisible to the 0.4 hardcode for a month). Each byte-identical (7ca772be / b3b95547 /
d7b5875d / 9885af74). FLEET 136 -> 140; check-all 140/140 (T2's pass==N re-baselined cleanly).
difficulty.py NOT in the insertion set anymore (it derives, T6) -> only 3 tool dicts touched.
- tools/disc_code_sweep.py: decode every payload (reusing sig_image.make_insn) and gate code on
BOTH valid>=0.90 AND jr_$ra density>=0.01. The jr_$ra gate is decisive: isValid() alone flags
389 false hits (type-0/2 structured data decodes ~100% valid but has ZERO returns); jr_$ra
separates code (~2.9-3.4%) from data (0.000%), validated on positive+negative controls.
- FINDING (docs/disc-completeness.md): type-4 location overlays are COMPLETE (138/138). All other
types are data EXCEPT type-1 = 40 code payloads, 1 onboarded (the resident), 39 HIDDEN
resident-class modules (mostly MAIN.CD/FILE_XXX/1.1). They load at UNKNOWN addresses (not the
shared overlay slot), so they are NOT mechanically onboardable — byte-verifying a build binary
needs its load address (P9), knowable only by runtime RE (the Phase-3 method). Deferred with
evidence, NOT force-onboarded at a guess.
- CONSEQUENCE: game-code TRUE 100% now spans 140 onboarded binaries PLUS ~39 type-1 modules
pending load-address RE. The roadmap assumed 136 — this is a real re-baselining (the +4 overlays
also add ~2.45 MB to the denominator; every family propagation is now x138). Flows to T10/T11.
- SETUP §6.3 tool inventory updated (R21).
Drew T