# Phase 3.39 — Casts to declared data        (implements GENERATION_PLAN.md phase 3.39)
Milestone: 0 uncovered raw address casts in the 4 census forms: every raw P/I/X/M site is a member access, a declared symbol, a reinterpret macro backed by its KEPT row, or covered by a latest restruct ledger RESIDUAL row naming its cause (reading A, REPLAN 2026-10-02; the canonical-types campaign that removes TYPE-NOT-CANONICAL residue is 3.40's input, sized by that ledger); `lever_census --check --strict --residue config/lever_residue.tsv` 0 (reading A, 2026-10-01; literal --strict 0 moves to 3.40); lying-decl census 0 outside ledgered exceptions; R22 218/218 — verified by: `PY tools/type_census.py --check-casts --residue` exit 0 (T10's gate: uncovered raw P+I+X+M = 0, unbacked macros 0, `types_floor_lying` 0 outside `config/lying_exceptions.tsv`), `PY tools/restruct.py --rung S --check-residue --only <seg>` exit 0 for each of `ov_*`, `md_*`, `main`, `src/shared/*`, `PY tools/lever_census.py --check --strict --residue config/lever_residue.tsv` exit 0, and `make clean && make extract-all JOBS=16 && make check-all JOBS=16` → `check-all: 218 passed, 0 failed of 218`, all at the closing commit
Approved: 2026-10-02   Planner: claude-opus-5-5/medium   Plan-hash: 6ca6c442da914fdccccf68d4512af29ae92e09cc772eb7a0ec98ce2f9c2ad84e

## Context
- Product: the matched C of Brave Fencer Musashi (218/218 binaries byte-identical). Gen 3 makes it legible; source may be rewritten freely, the object bytes are the gate (R22). This phase = legacy T6 "the cast campaign".
- State at 3.38 close: 1,650 struct defs in `src/shared/engine_types.h` + `include/struct_types.h` (via `include/common.h`); `type_census --check-structs` 0; parse_error_decls 0; R22 218/218.
- Raw casts (instrument `tools/type_census.py`, regexes :134-137): 503,016 at P37 T1 = P `*(T *)(base+k)` 409,007 + I `*(T *)ident` / `&D_x` / `0x80…` 60,666 + X `((T *)e)[i]` 13,800 + M `M2C_FIELD(` 19,543; 502,983 in 69,492 bodies at P38 close. Counted apart, not gated: A address-of `(T *)(base+k)` 18,912 (:138), C typed cast-member 36,681 (:139), ABS_ADDR :140. Struct map explains 99.2% of sites by base; legacy estimate of the floor: ~4% kept casts (S2) + up to ~24% the current layouts cannot hold (misaligned, pointer fields needing the pointee, sign-mismatch loads, non-struct bases). Per-form/per-binary split lives in `.run/P37/census/*` (regenerate in T1).
- `type_census --check` (:1905-1918) already fails on any raw deref and any lying decl, but also on block-scope defs (629 block_frames, non-gating under the ratified 3.38 reading) — hence a new `--check-casts` gate (T2), not a re-reading of `--check`.
- Only reinterpret macro today: `M2C_FIELD(expr, type_ptr, offset)` `include/common.h:43`, which IS form M (raw). Legacy also proved LOBU/LOH/HIH/LOHU/HIHU/LOW/LOWU byte-equal (PhaseEnd_Phase37:36-37); retriever found none of them in `include/` — T2 confirms and decides.
- Byte law behind kept casts (C0507 §458): in gcc 2.7.2 `*(T*)(p+k)` carries no MEM_IN_STRUCT_P; `p->f`, `((S*)p)->f`, `q[k]` do (expr.c:4568-4577); sched.c:837-865 and the cse kill table differ, so cast → member IS a byte edit. Ladder: rung S1 = convert every cast on one base to member spelling (126/139 bodies IDENTICAL in the probe); S2 = greedy leave-one-out/revert in ≤ 2n+1 compiles, minimal kept set ledgered `KEPT` (27 of 716 kept). Recipes for globals: R1 pointer global as struct member, R2 `extern T X[]`, R3 walked pointer (`restruct --try … --recipes`). A parameter cannot be retyped while its body still has `*(T*)(a0+k)` (pointer arithmetic scales): signature change is a per-callee S → T → D unit.
- Oracle hazard: the whole-object oracle reports DIFFERS on a correct global-block edit (relocation spelling only); use the linked oracle (R110, `delever_oracle --linked-control`, SHA vs `config/check.*.sha`).
- Header economics: a header is judged on every includer (~35 s per judgement at -j16, `tools/restruct_cycle.sh:19`); a canonical-header edit re-fans ~3,900 objects (~6 min full). Header edits are batched: dozens of field additions per fan-out, never one per site.
- Levers (`tools/lever_census.py`): `--check` (:1188-1210) fails on any class A/B site (pins + asm statements) without a `// !FAKE:` marker (FAKE_MARK :83) and on orphan markers; `--strict` (:1190-1204) fails on ANY pin/asm site, any direct GTE statement in a body, any per-TU asm macro definition. 3,730 = pins 1,868 + asm 1,862 over 1,838 bodies (`docs/levers.md:127-128`); also GTE levers 450, per-TU asm macros 314; direct GTE statements 6,717 (decision-log:3843). P36 composition: 691 parked signature/carve, ~1,150 in five proven head classes, 450 GTE clobber variants, 94 missing-parameter pins, 1,548 drawable singletons. P37 T4 removed 280.
- GTE: `include/gte_inline.h` = one definition per signature (51 #defines, majority spelling, generated by `tools/gte_consolidate.py --header`); a def differing only by an extra clobber lives in its TU as `<name>_m` (~60 files, e.g. `src/ov_SC06_030/ov_SC06_030_jr_801380E0.c`). Hazards: C0209 §187 (inline `sqr` emits two hazard nops, SDK Square0 one) and C0217 §195-J (call vs inline is a per-site source fact; tell = target opcodes `lwc2/sqr/swc2` vs `jal`). Never unify by TU style; prove per site.
- Lying decls (`type_census.py:1354-1362`, via `tools/argcheck.py`): `lying` = argcheck rows not K&R-marked and not cross-binary; 229 at 3.38 close over 24 callees (K&R-empty 216, narrow 13); `func_80146C3C` left K&R-marked (zero-arg `$a0` callers in shared headers). Declaration byte facts C0508 §459: "pin was missing argument" = unit of def + all callers; a def in a shared header is per-definition. 40 TU-CONFLICT rows already ledgered in `config/dedup_exceptions.tsv` (PsyQ ApplyMatrixSV 8, RotTransPers 5, …).
- Carry from 3.38: 18 stale `conflicting types` ledger rows (func_800D20C0 15 .c + 1 .h, func_8012C098 1 .c + 1 .h; sources canonical; restruct writes no row for a hand-fixed unit); `restruct --selftest --real` is red after any commit until R22 → `delever_oracle --snapshot-baseline` → `--calibrate ov_SC04_011 ov_SC03_015 md_SC07_004 main -j 16`; `lever_progress --check` goes red after a census-moving commit until `--snapshot`; timeline and README regenerate after the previous phase's last commit (README Levers should read 3,729; `timeline.py --check` reports STALE).
- Gates: `make check BINARY=<alias>` per touched binary; main only through `tools/gate_main.py` (never incremental); R22 clean fleet run after any shared body/header/executable edit; read exit codes (R53); `restruct_cycle.sh` runs R22 itself and commits each green batch (R42), detached via setsid nohup (R115), batches < 10 min.
- Mutation discipline: restruct writes `inflight.json` (originals) under a lock; recover with `restruct --restore`, never `git checkout` (R102). Every latest-verdict reader goes through `restruct.ledger_latest` (R100).
- Hand-edited: `src/**`, `include/common.h`, `config/*.tsv`. Generated (regenerate, never hand-edit): `include/struct_types.h` between `head_types:begin/end` (`tools/head_types.py`), `include/gte_inline.h` (`gte_consolidate.py --header`), `docs/levers.md`, `docs/readability.md` series, `docs/struct-twins.md` (`struct_twins.py --write`).
- Replan 2026-10-02 (T4 blocked, critic needs-developer, developer chose option 1 = reading A): T1-T4 done. Rung S has drawn every base the tools can draw (ov T3, md/main/shared T4; byte-identical, R22 218/218, `restruct --rung S --check-residue` uncovered 0 for `ov_*`, `md_*`, `main`, `src/shared/*`). Raw at T4 close: P=257,464 I=51,505 X=13,790 M=15,130; unbacked 0; lying 229 (tasks/T4.md Verified). P/X residue cause is overwhelmingly TYPE-NOT-CANONICAL (struct-map type with no canonical definition; ov 234,400 sites, md 4,815, main 1,712, shared 11,353; 18,526 map types vs 1,650 defined); T3 binding: residual for rung S, ledger-only RESIDUAL rows. Other ov causes: NO-TYPE-IN-MAP 2,444, NO-FIELD (IN-LEAF, needs union/split, deferred by 3.38) 1,910, NO-EDIT 482, INDEX 471, FILE-SCOPE 167.
- Coverage gap the replan closes (T10): `--check-residue` (restruct.py:3521) counts a P/X body covered when ANY latest rung-S row exists for it (`residue_sites` :3456 skips on key presence, any verdict); it does not match sites to per-site `RESIDUAL(<cause>)` entries, and no code covers I/M sites with ledger rows. `--check-casts` (type_census.py:1982) fails on every raw site. Reading A needs a per-site covered/uncovered split.
- Out of scope: `tools/` harness files of Project Architect, `.claude/`, hooks, templates (harness gotchas only). The decomp's own tools under `tools/` (type_census, restruct, lever_census, delever, gte_consolidate) are in scope.

## Rationale
- Order: instruments first (T2), then the biggest form by leverage (P on struct-map bases, T3/T4), then globals and absolute addresses (I, M; T5), declarations (T6), GTE (T7), then pins (T8) — the pins "the unified types now explain" only become removable after the bodies are re-spelled, so T8 runs last on the rewritten tree. Legacy order (S → S+A → X → R, largest leverage first) kept.
- Kept casts: the milestone allows reinterpret macros counted apart, each with its instrument. A kept cast is respelled as a named macro whose expansion is the identical cast (preprocessor-identical, so the respelling is byte-neutral by construction, still gated), and every macro site must match a restruct ledger row (`KEPT` + cause) — the instrument. A macro site without its row fails `--check-casts`. This keeps "kept only where the gate proves the spelling moves bytes" machine-checked rather than a relabel. Unions stay deferred (3.38 binding decision); a width-conflict loser offset is a kept-cast cause, not a union.
- T2 is `effort: high` (expert-fable): the judgment is the design of the reinterpret-macro set, the cause classes and the gate's reading of "raw" — a definition no test can arbitrate, and every later task inherits it. It is the only high mark (1 of 9).
- Split T3/T4 by fleet segment (overlays vs md_*/main/shared) so each expert's context holds one segment's batches; main needs `gate_main.py` and shared bodies re-fan the fleet, which makes T4 the riskier half, run second with T3's ledger as its model.
- Lying decls are drawn here (the milestone needs 0 outside a ledger), not left to 3.40; what cannot be drawn mechanically is ledgered with cause in a new `config/lying_exceptions.tsv` and becomes 3.40 residue. Kept apart from `dedup_exceptions.tsv`, which keys TU conflicts, not callee lies.
- `--strict` 0 conflicts with the phase's own scope ("the surviving pins that the unified types now explain") and with 3.40's existence: removing all 3,730 levers is the agent-priced lane legacy P36 measured at 9 sessions / ~15-20M tokens, and the Standing constraints allow agent waves only at the developer's cap. That is money and scope — the one Developer-decides item. The plan is drafted for the recommended reading (A); reading B changes only T8's cap and the milestone line.
- No new dependency. New code only in the decomp's own tools: `type_census --check-casts` (the existing census already computes every count; delta = the macro/ledger cross-check and the lying ledger) and, under reading A, a `lever_census --residue` exclusion keyed by a ledger.
- Coders: opus55 everywhere code or sweeps run; T9 is the record and gate, still coder opus55 (the clean R22 and the snapshots are coder-run loops).
- Replan (developer, option 1): the milestone reads raw casts as covered or uncovered, the same reading A already approved for levers; the literal 0 needs canonical definitions for thousands of map types (several sessions, header fan-outs) and becomes 3.40's input, sized by the RESIDUAL ledger T10 renders. T4 closes done on its swept work. T10 is a new id (not T4.1: T4 is not reopened) and runs between T4 and T5 so T5 can ledger undrawable I/M sites in the shape T10 defines. T10 is medium: covered/uncovered is arbitrated by its selftest controls (a covered and an uncovered site per form), not by judgment. High marks stay 1 of 10 (T2).
- Per-site coverage, not per-body: a drawn body (MEMBERS/KEPT) can still hold raw sites whose own entry is `RESIDUAL(<CLS>)`, and a body may hold a raw site its row never listed; counting the body as covered would hide an un-ledgered site. T10 matches each raw census site to a site entry of its body's latest ledger row (key chosen by T10 from form/base/off/type; line numbers drift after edits, so line alone is not the key) and reads the entry's cause; no matching entry, or an entry without a cause, is uncovered.
- T5-T9 unchanged except: T5 deps T10 and ledgers what no recipe draws (the amended milestone needs it on I/M); T9 done-when and verify carry the new gate.
- Triage P3.38-1 lands in T1: the previous phase's last commit has happened, and the INBOX asks for it first.

## Interfaces
- `tools/type_census.py`: forms `FORM_P` :134, `FORM_I` :135, `FORM_X` :136, `FORM_M` :137, `FORM_A` :138, `FORM_C` :139, `ABS_ADDR` :140; `parse_base(expr)` :189; `find_sites(masked, rel, span_of_line, line_of, params_of)` :275; `walk_file(raw, rel)` :593; `run_census(jobs, use_cache=True, out_dir, want_sites=False)` :1171; lying :1354-1362; `summary['casts']` = {deref_total, by_form{P,I,X,M}, addr_form, typed_cast_member, bodies, by_bclass, coverage_ok} :1425; render :1635, :1669; `main()` :1879, flags `-j --out-dir(.run/P37/census) --no-cache --sites --check --check-structs --selftest --quiet` :1881-1888; `--check` verdict :1905-1918; `--check-structs` :1919-1926 (`check_structs_inputs()`, `check_structs_verdict(summary, pad, parse)`); struct map JSON written :1468 (`.run/P37/census/struct_map.json`).
- `tools/argcheck.py`: `definitions()` :71; `scan(defs, only_needed_argpins=False)` :164; `main` :230.
- `tools/lever_census.py`: `classify_asm_body` :176; `walk_file` :434; `run_census` :774; controls :991; selftest :1109; `main` :1159; `--check` :1188-1210; `--strict` :1190-1204; `FAKE_MARK` :83; `C_FAKE_RX` :84; `NON_LEVER_KINDS` {gte, verbatim-body, gte-unsigned} :85; `GTE_LEVER_KIND "gte-lever"` :86; `GTE_HEADER_DEFAULT include/gte_inline.h` :67; out `.run/P36/census` :53. Flags `--check --strict --gte-header --out-dir --sites -j --no-cache --selftest --quiet`.
- `tools/restruct.py`: docstring :1-52 (rungs S struct spelling, D declaration redraw, L definition fold; residual classes :31-33); `RUN=.run/P37/restruct` :85; `LEDGER=RUN/ledger.jsonl` :86, row {rung, tu, unit, verdict, cause, before/after hashes}, key (rung, tu, unit); `INFLIGHT` :87 (fcntl lock :429-452); `ledger_latest(rows)` :402 → {(rung,tu,unit): row}; `ledger_index` :411; argparse `main()` :4490-4532: `--try TU FN` :4492, `--plan/--apply` :4495-4496, `--rung S|D|L` :4497, `--batch --label --only --headers`, `--redraw` :4503, `--try-file` :4504, D flags `--callee --signature --body --all-defs --map-data --with --tu --unalias` :4505-4512, `--restore` :4513, `--status` :4514, `--check-ledger` :4515, `--audit-types --write-types --type --top` :4516-4519, `--selftest [--real]` :4523 (body :4054-4484), `--fanout-cost` :4528, `-j` :4532.
- `tools/restruct_cycle.sh:14`: `[LABEL_PREFIX=] [TASK=] [REDRAW=] [CENSUS=0] START END [BATCH=50] [RUNG=D|S|L] [ONLY] [HEADERS=1]`; clean src/config required :36; calibrate when red :38-43; apply `-j 12` :44, needs `final N/N` :45-50; skips R22 if src unchanged :52-54; R22 :56 (`.run/P37/baseline/r22_<label>.log`); FLEET = count of `config/check.*.sha`.
- `tools/delever_oracle.py`: `main()` :608; `--recipes` :610, `--calibrate <aliases>` :611/:639, `--status` :612, `--snapshot-baseline` :613 (:241-280, `.run/P36/delever/baseline/`), `--linked-control` :615, `-j` :616.
- `tools/delever.py`: `main()` :6002; `--plan --apply --batch --headers --only --rejudge --redraw --restore --scrub --propagate --recipes [--cap --control --limit] --apply-body` :6027 `--rung` (default E) :6028 `--allow-residue`; apply refuses without current calibration :1115, :5872 (R56).
- `tools/gte_consolidate.py`: `inventory` :246; `canonical_table` :303; `render_header` :398; `write_header` :421; `plan_files` :457; `file_edits` :532; `apply_batch` :627; `sweep` :783; `remark` :915; `status` :979; `selftest` :987; `main` :1115. Flags `--inventory --header --apply --sweep --remark --status --selftest --batch N(400) --label --only --rejudge --dirty-ok -j(12)`.
- `tools/head_types.py`: `resolve` :124, `main` :202 (writes `include/struct_types.h` region from `struct_map.json`). `tools/struct_layout.py:370` `field_offsets(res, d)`.
- `include/common.h:43` `M2C_FIELD(expr, type_ptr, offset)`. `include/gte_inline.h:1-7` header contract.
- Gates: `Makefile` `kit-corpus` :255, `tools-health` :269, `extract-all` :1219 (JOBS ?= 16 :1215), `check-all` :1241, `check` :1262 (`make check BINARY=<alias>`). `tools/gate_main.py` `main()` :870: `gate_main.py <slate.json> [--apply] [--no-bisect] [--no-resume] [--allow-dirty] [--assert-baseline]`.
- Also used: `tools/cast_call_sites.py` main :293; `tools/conform_decls.py` main :209 (`--fn --draft --check --apply --cast-zero-arg-calls`); `tools/decl_from_use.py` main :1178.
- Post-T2/T3 lines (retriever, 2026-10-02): `type_census.py` `check_casts_counts` :1203; `run_census` :1211 (counts :1367; casts dict with `check_raw`, `macro_sites` :1470); selftest :1811 (check-casts controls :1885-1921); `BACKED_S_VERDICTS` :1963; `check_casts_inputs()` :1966 (`import restruct as rs; latest = rs.ledger_latest(rs.load_ledger())` :1969); `check_casts_verdict(raw_by_form, macro_sites, latest, lying_rows, exceptions)` :1982 → (rc, line), format :2005-2006; `main` :2010; `--check-casts` :2018, use :2059-2064. Site dict (sites.jsonl): form, tu, fn, line, pos, end, base, bclass, off, width, type, cls.
- `restruct.py`: `load_ledger` :391; `ledger_latest` :407; `site_row` :1053 → {form, line, base, off, width, sign, access, type, field, verdict MEMBER|KEPT(<cls>)|RESIDUAL(<CLS>), cause}; `S_KEPT_MACRO` :1061; `site_class` :1066 (MISALIGNED, SIGN, WIDTH, SCHED-ALIAS, INDEX, NEGATIVE-OFFSET, NON-STRUCT, else NO-FIELD/NO-EDIT/POINTEE); `S_NO_EDIT_VERDICTS` :1189; `matches_only(only, tu, unit, extra=())` :3366 (`main` = top-level src/*.c + src/resident/); `RESIDUE_FILE_UNIT "<file-scope>"` :3436; `RESIDUE_DEFAULT_ONLY ["ov_*"]` :3437; `residue_cause` :3440 (FILE-SCOPE, NO-TYPE-IN-MAP, TYPE-NOT-CANONICAL, TYPE-NOT-VISIBLE); `residue_sites` :3456 (P/X only, filter :3462); `residue_rows` :3472, row :3504-3506 = {ts, label, rung "S", calib, tu, unit, fn, addr, header, nhash_before, nhash_after, bases[{base,type,status}], skips, sites[{form,line,base,off,type,verdict "RESIDUAL(<cause>)",cause}], verdict (shared TNC/TNV cause or "RESIDUAL")}: cause per site, no row-level cause; `residue(a)` :3510; `check_residue(a)` :3521 prints `uncovered <n> sites / <m> bodies`; argparse `--only` :5104, `--residue` :5119, `--check-residue` :5120.
- New in the replan (T10 owns the exact shape): `type_census.py --check-casts --residue` prints `check-casts: raw P=<n> I=<n> X=<n> M=<n> (uncovered P=<n> I=<n> X=<n> M=<n>); macros … (unbacked <n>); lying=<n> (ledgered <n>)` plus one by-cause line; writes `.run/P37/census/residue_census.{json,txt}` (by form, cause, segment; top 50 map types by covered sites with body counts); exits 1 on uncovered > 0, unbacked > 0 or unledgered lying > 0. Without `--residue`, T2 behaviour unchanged. I/M residue rows: ledger-only rows from `restruct --residue` extended to forms I and M (or a sibling flag T10 names), same per-site `{form, …, verdict "RESIDUAL(<cause>)", cause}` entries, read through `ledger_latest` (R100).
- New in this phase (T2 owns the exact shape; later tasks read T2's summary):
  - `type_census.py --check-casts` → prints `check-casts: raw P=<n> I=<n> X=<n> M=<n>; macros <name>=<n>… (unbacked <n>); lying=<n> (ledgered <n>)` and exits 1 on any raw > 0, unbacked > 0 or unledgered lying > 0.
  - reinterpret macros in `include/common.h`, each expanding to the identical cast; instrument = restruct ledger row `{rung:"S", verdict:"KEPT", cause:<class>}` keyed (binary, address, body) per R99.
  - `config/lying_exceptions.tsv`: `callee \t def_file \t kind \t cause \t task`.
  - Reading A only: `lever_census.py --strict --residue config/lever_residue.tsv` (`file \t func \t kind \t pass \t instrument \t cause`), rows excluded from `--strict`, still counted.

## Cookbook
C0507 (§458 struct spelling is a per-access dial; S1/S2 ladder), C0508 (§459 declaration byte facts), C0503 (§454 rungs D/R), C0504 (§455 rung G), C0505 (§456 lever-removal move catalog), C0506 (§457 S105 TU batches), C0420 (§379 MEM_IN_STRUCT_P member vs cast), C0392 (§351 /s per access), C0209 (§187 GTE nops SDK vs game), C0217 (§195-J GTE call vs inline per site), C0368 (§328 volatile alias must be an object), C0383 (§342 void* param cast not byte-neutral), C0502 (§453 one source per unique function), C0510-C0513 (phase 3.38 struct entries), C0036 (§33 reconcile_decls fleet-majority oracle), C0081/C0086 (§73/§75c decl + call-site cast pair).
Rules: R22, R40 (retry a fan-out failure once), R42, R53, R56, R99, R100, R102, R110, R112, R113 (marker names pass and instrument), R115, R122, G53 (producer census before a spelling sweep), G61.

## Research
R3.38-001 (remaining work after P37; Gen3 constraints), R3.38-002 (type_census / lift_types mechanics). Pending, for T1 to adopt: `phase-ends/current/research/pending/retriever-code-p39-cast-instruments.md` (cast forms, lever_census flags, lying source, gte_consolidate CLI).

## Developer decides
(none open) Answered: lever gate reading A (`--strict --residue`, 2026-10-01); cast gate reading A (`--check-casts --residue`, REPLAN option 1, 2026-10-02).

## Triage
- P3.38-1: T1 -- the 3.38 close has landed; regenerating the timeline and README is phase-start bookkeeping (INBOX asks it first)

## Tasks

- T1 | done | expert-opus55 | title: phase-start health, carry cleanup and baselines | coder: opus55 | effort: medium | files: docs/story-timeline.md, README.md, .run/P37/restruct/ledger.jsonl, docs/readability-progress.tsv | done-when: timeline.py --check fresh and README Levers reads the live lever count; the 18 stale conflicting-types ledger rows removed through restruct (--check-ledger clean); make tools-health OK; R22 218/218 on the start commit; delever_oracle --snapshot-baseline + --calibrate ov_SC04_011 ov_SC03_015 md_SC07_004 main -j 16 green and restruct --selftest --real green; fresh type_census (--sites) and lever_census baselines recorded in the summary: raw per form, per binary, per base class (struct-map-explained vs not, top 20 bases), lever split (pins/asm/GTE statements/asm macros/gte-levers), lying 229 by callee; pending report adopted | verify: PY tools/timeline.py --check && make tools-health && PY tools/restruct.py --check-ledger && PY tools/type_census.py --check-structs --quiet | reads: R3.38-001, phase-3.38/tasks/T6.md, phase-3.38/tasks/T7.md | deps: — | est-ctx: 90k | review: no | wait-for: —
  Timeline: `PY tools/timeline.py` then `PY tools/progress.py --readme`; commit before R22. The census baselines are the denominators every later task and the closing record quote; key sites by (binary, address, body) (R99).
- T2 | done   | expert-fable | title: cast and lying gate instruments, reinterpret-macro set | coder: opus55 | effort: high | files: tools/type_census.py, tools/lever_census.py, include/common.h, config/lying_exceptions.tsv, config/lever_residue.tsv, docs/gen3-standards.md | done-when: `type_census --check-casts` exists with the Interfaces output line; it FAILS on the T1 tree with T1's counts; selftest has positive/negative controls for each form, for a macro site with and without its ledger row, and for a ledgered vs unledgered lying callee; the reinterpret-macro set (names, expansion = identical cast, one cause class each: at minimum SCHED-ALIAS, SIGN, WIDTH/overlap loser, MISALIGNED, NON-STRUCT base) is defined in include/common.h and documented in docs/gen3-standards.md, with one byte-proof per macro (an existing kept site respelled → make check IDENTICAL); M2C_FIELD stays raw form M; under reading A, lever_census --strict --residue with its selftest; the census caches invalidated; type_census --check-structs still 0 | verify: PY tools/type_census.py --selftest && PY tools/lever_census.py --selftest && PY tools/type_census.py --check-structs --quiet && (PY tools/type_census.py --check-casts; test $? -eq 1) | reads: T1 | deps: T1 | est-ctx: 130k | review: no | wait-for: —
  Judgment: what counts as raw vs a backed reinterpret macro, and the cause classes; decide whether legacy LOBU/LOH/HIH… are reinstated as macros of this set. Header edit to common.h re-fans the fleet: land the macro set in ONE edit + one R22. The gate cross-checks macro sites against `restruct.ledger_latest` rows (R100), never a second filter.
- T3 | done   | expert-opus55 | title: rung S sweep, overlays (forms P and X) | coder: opus55 | effort: medium | files: src/ov_*/**/*.c, include/struct_types.h, src/shared/engine_types.h, .run/P37/restruct/ledger.jsonl | done-when: every ov_* body with a P or X site on a struct-map base processed by restruct --rung S (S1 then S2) through restruct_cycle.sh batches, each batch R22-green and committed; kept casts respelled with T2 macros backed by KEPT rows; missing fields added to the canonical types in batched header edits (≤ 1 fan-out per batch of field additions); residual P/X on ov_* each ledgered with a cause class; summary records before/after per form, kept count by cause, bodies refused and why | verify: PY tools/type_census.py --check-casts --quiet; PY tools/type_census.py --check-structs --quiet && make clean && make extract-all JOBS=16 && make check-all JOBS=16 | reads: T1, T2 | deps: T2 | est-ctx: 160k | review: no | wait-for: —
  Isolate on one TU first (C0507 exemplar `func_801814AC`, ov_SC05_010_jr_80180F84.c:3030: the +0x34 store must stay cast). Parameter retyping is a per-callee S → T → D unit (C0507). Use the linked oracle for global-block edits (R110). Retry a fan-out failure once (R40). Run cycles detached (skill restruct-cycle-watch). `--check-casts` still exits 1 here (other segments); read its P/X counts for ov_*.
- T4 | done   | expert-opus55 | title: rung S sweep, md_*, main and shared bodies (forms P and X) | coder: opus55 | effort: medium | files: src/md_*/**/*.c, src/main/**/*.c, src/shared/**, include/struct_types.h, src/shared/engine_types.h | done-when: as T3 for md_*, main and shared bodies; main gated only by tools/gate_main.py; shared-body edits followed by R22; P and X raw = 0 fleet-wide except sites ledgered with a cause that T5 owns (non-struct base) | verify: PY tools/type_census.py --check-casts --quiet; make clean && make extract-all JOBS=16 && make check-all JOBS=16 | reads: T1, T2, T3 | deps: T3 | est-ctx: 160k | review: no | wait-for: —
  Shared bodies (C0502 §453 include-at-site share) re-fan every includer: batch them, one R22 per batch.
  Closed done by the 2026-10-02 replan: swept work stands; the fleet-wide P/X clause is superseded by the reading-A milestone (residue covered per site, T10).
- T10 | queued | expert-opus55 | title: residue coverage gate (--check-casts --residue) and 3.40 sizing | coder: opus55 | effort: medium | files: tools/type_census.py, tools/restruct.py, .run/P37/restruct/ledger.jsonl, docs/ops/, HOW_WE_WORK.md | done-when: `type_census --check-casts --residue` exists with the Interfaces line; a raw P/I/X/M site counts covered only when its body's latest ledger row (via restruct.ledger_latest) has a matching site entry `RESIDUAL(<cause>)` with a non-empty cause; selftest controls per form: one covered site passes, one uncovered site (no row; row present but site absent; entry without cause) fails, plus a KEPT macro site still counted under macros, not residue; restruct --residue can write ledger-only I/M rows with causes (selftest control) and `--check-residue` matches per site, not per body (selftest control: a MEMBERS body with an unlisted raw site reports uncovered); any P/X gap the per-site match exposes on the T4 tree is closed by a ledger-only `--residue` rerun (no source edit); on the T4 tree the gate reads P/X uncovered 0 and fails only on I/M uncovered and lying, counts in the summary; `residue_census.{json,txt}` written and its by-cause / top-50-type tables quoted in the summary as 3.40's sizing; `--help` and docs/ops note updated, HOW_WE_WORK tools row updated | verify: PY tools/type_census.py --selftest && PY tools/restruct.py --selftest && PY tools/restruct.py --rung S --check-residue --only "ov_*" && PY tools/restruct.py --rung S --check-residue --only "md_*" && PY tools/restruct.py --rung S --check-residue --only main && PY tools/restruct.py --rung S --check-residue --only "src/shared/*" && (PY tools/type_census.py --check-casts --residue; test $? -eq 1) | reads: T2, T3, T4 | deps: T4 | est-ctx: 110k | review: no | wait-for: —
  No source or header edit: tool code and ledger-only rows. Key sites by (binary, address, body) (R99); read verdicts only through `ledger_latest` (R100), never a second filter. Ledger writes go through restruct's lock (inflight/fcntl); commit the ledger before and after any `--residue` rerun. Keep `--check-casts` without `--residue` byte-for-byte as T2 left it (T2 selftest stays green). The top-50-type table is what the 3.40 planner sizes the canonical-types campaign from: report sites and bodies per type, and how many of the 18,526 map types cover 50/80/95% of TNC sites.
- T5 | queued | expert-opus55 | title: globals and absolute addresses to declared symbols (forms I and M, residual non-struct bases) | coder: opus55 | effort: medium | files: src/**/*.c, src/shared/engine_types.h, include/common.h, config/symbols.*.txt | done-when: form I (`*(T *)D_x`, `&D_x` reinterpret, absolute `0x80…`) and form M (`M2C_FIELD`) at 0 uncovered: each site is a typed extern / declared symbol (recipes R1 pointer global as struct member, R2 `extern T X[]`, R3 walked pointer), a member access, a T2 macro backed by its row, or (no recipe draws it) a ledger-only RESIDUAL entry with a specific cause in T10's I/M row shape; absolute addresses become symbols named in the binary's symbol file (unnamed `D_<addr>` form, no invented names, G5); every touched binary make check / gate_main green and R22 green | verify: PY tools/type_census.py --check-casts --residue --quiet; make clean && make extract-all JOBS=16 && make check-all JOBS=16 | reads: T1, T2, T3, T4, T10 | deps: T10 | est-ctx: 150k | review: no | wait-for: —
  Verify reads I/M uncovered from `--check-casts --residue` (still exit 1 on lying until T6). Ledger RESIDUAL only after the recipe ladder refused the site; cause names the recipe that failed.
  `restruct --try TU FN --base global:D_x --recipes` per class before fanning out; a global's declared type change is a header/def edit seen by every user — batch. Symbol-file edits follow the symbol-file path (R15), never generated asm.
- T6 | queued | expert-opus55 | title: lying declarations to 0 outside the ledger | coder: opus55 | effort: medium | files: src/**/*.c, src/**/*.h, config/lying_exceptions.tsv | done-when: types_floor_lying 0 outside config/lying_exceptions.tsv; each of the 24 callees either drawn by restruct --rung D (--callee/--signature/--all-defs, def + all callers as one unit, C0508) and R22-green, or ledgered with kind and cause (e.g. func_80146C3C zero-arg `$a0` callers); --check-structs still 0 | verify: PY tools/type_census.py --check-casts --quiet; PY tools/type_census.py --check-structs --quiet | reads: T1, T2 | deps: T2 | est-ctx: 110k | review: no | wait-for: T5
  Runs after T5 so declarations are drawn on the final symbol types (wait-for keeps the tree single-writer; no file overlap with T3-T5 otherwise). Shared-header prototypes conform in every includer at once.
- T7 | queued | expert-opus55 | title: GTE to one spelling | coder: opus55 | effort: medium | files: include/gte_inline.h, src/**/*.c, tools/gte_consolidate.py | done-when: 0 direct GTE statements in bodies and 0 per-TU asm macro definitions (lever_census --strict counts); every `_m` variant either replaced by its canonical macro (byte-proven IDENTICAL) or kept as a header-level variant in include/gte_inline.h with a `// !FAKE:` marker naming pass and instrument (R113), one definition per variant; call vs inline left per site (§195-J); gte_inline.h regenerated by gte_consolidate --header, not hand-edited; R22 green | verify: PY tools/gte_consolidate.py --selftest && PY tools/lever_census.py --check && make clean && make extract-all JOBS=16 && make check-all JOBS=16 | reads: T1, T2 | deps: T6 | est-ctx: 130k | review: no | wait-for: —
  If gte_consolidate cannot express a header-level variant, extend it (decomp tool, in scope). gte-lever sites after this task are marked levers; under reading A they enter T8's residue ledger, under B T8 removes them.
- T8 | queued | expert-opus55 | title: pins and asm the unified types explain; residue ledger | coder: opus55 | effort: medium | files: src/**/*.c, config/lever_residue.tsv, docs/levers.md | done-when: delever (rungs A/B strip, R recipes with --propagate) run over every lever-carrying body rewritten by T3-T7, removals R22-green and committed; reading A: every remaining pin/asm/gte-lever site has a config/lever_residue.tsv row (pass, instrument, cause; agent-shaped ones flagged for 3.40) and `lever_census --check --strict --residue config/lever_residue.tsv` exits 0; reading B: literal --strict 0 under the developer's cap; lever_census --check 0 UNMARKED | verify: PY tools/lever_census.py --check && PY tools/lever_census.py --check --strict --residue config/lever_residue.tsv | reads: T1, T2, T7 | deps: T7 | est-ctx: 140k | review: no | wait-for: —
  Calibration current before delever --apply (R56). Seed rung D only with the tree's own lever-free body (C0503). The residue ledger is 3.40's input: the 3.40 planner reads it, so causes must be specific (head class, missing parameter, carve, singleton).
- T9 | queued | expert-opus55 | title: milestone gate and record | coder: opus55 | effort: medium | files: docs/readability.md, docs/readability-progress.tsv, docs/levers.md, docs/story-timeline.md, README.md, cookbook/ | done-when: on one commit from a clean tree: type_census --check-casts --residue 0, restruct --rung S --check-residue 0 for ov_*/md_*/main/src/shared/*, --check-structs 0, lever_census --check --strict (as the developer's reading) 0, R22 218/218, make tools-health OK; delever snapshot + calibrate and restruct --selftest --real green; lever_progress --snapshot taken; readability and lever series rendered; timeline/README regenerated; cookbook entries for the phase's byte facts added; summary states before/after per form, covered residue by form and cause (from residue_census, the 3.40 canonical-types input), kept casts by cause, lying ledger size, lever residue size | verify: PY tools/type_census.py --check-casts --residue && PY tools/restruct.py --rung S --check-residue --only "ov_*" && PY tools/restruct.py --rung S --check-residue --only "md_*" && PY tools/restruct.py --rung S --check-residue --only main && PY tools/restruct.py --rung S --check-residue --only "src/shared/*" && PY tools/lever_census.py --check --strict --residue config/lever_residue.tsv && make clean && make extract-all JOBS=16 && make check-all JOBS=16 && make tools-health | reads: T1, T2, T3, T4, T5, T6, T7, T8 | deps: T8 | est-ctx: 100k | review: no | wait-for: —
  Both gates read A (levers 2026-10-01, casts 2026-10-02). Do not edit the plan between the R22 and the commit.

## Risks
- The ~24% of sites the layouts cannot hold blows up kept-cast counts or header churn. Detection: T1's per-base split and T3's first batches; if kept > ~25% of a segment, T3 returns `question` with the cause histogram before fanning out.
- A reinterpret macro reads as relabeling. Mitigation: every macro site needs its KEPT row (T2 selftest proves an unbacked site fails); the closing summary reports kept by cause.
- False DIFFERS from the whole-object oracle on global edits (relocation spelling) — use the linked oracle (R110); a correct edit refused shows in the ledger as REFUSED with a relocation-only diff.
- Header fan-out cost (~6 min per canonical-header edit): unbatched field additions multiply wall time. Detection: R22 logs per cycle in `.run/P37/baseline/`.
- Main regresses silently if gated incrementally — gate_main.py only.
- `--selftest --real` and `lever_progress --check` read red after commits by design; a task that treats that as a failure stalls. Each task refreshes snapshot/calibration after its R22.
- Reading B without a cap leaves T8 open-ended; the critic should stop T8 at the cap and ledger the rest.
- GTE respellings that differ only in hazard nops (C0209) pass a careless check on one binary and fail another; T7 gates fleet-wide.

- Per-site matching (T10) may expose P/X sites T3/T4 never listed in any row (e.g. sites added by a later respell, or bodies whose row predates the census). Mitigation: T10 closes them by ledger-only `--residue` reruns; a gap that needs a source edit returns `question`.
- Covered residue can grow silently in T5-T8 (a site ledgered instead of drawn). Detection: T9 quotes covered-by-cause against T10's numbers; growth in a cause without a recorded refusal is a defect.

## Changes
- 2026-10-01 router: T1 next -> done
- 2026-10-01 router: T2 next -> done
- 2026-10-02 router: T3 next -> done