# CURRENT_PHASE — Phase 32: the last 21 + the parked 5 (short, kill-gated)

> **Gate 1 approved 2026-09-05 (Drew, plan mode, Max, Fable 5.1).** Rules R44–R63 ratified at gate 1 (binding).
> The approved plan (full text): `~/.claude/plans/plan-mode-enabled-max-iterative-ember.md` — its substance is
> this file. Jumping-off document: `docs/frontier-p32.md`. Roadmap: `docs/roadmap-to-100.md` v2 §3 (P32 as
> written is consumed; P32 is this census) + `PhaseEnd_Phase31.md` Roadmap delta.
> **Baseline HEAD at open: `77df1092e`** (Phase-31 close + post-close docs; no `src/`/`config/` change since the
> S80 census — verified `git diff 3c292ef09..HEAD -- src config Makefile` empty).

## Milestone (gate 2)
Every one of the 21 census rows is **BANKED** or carries a **FINAL verdict** (PROVED wall / candidate wall with a
gcc-mechanism citation + a bounded-attempt record / deferred with its cost stated); each of the 5 parked payloads
is **onboarded byte-identical at a byte-proven base** (its stubs then join the census and are banked or ledgered
the same way) **or** carries a documented exclusion with the static + runtime evidence; the fleet is byte-identical
(R22) at every banked batch; the PhaseEnd carries the final wall ledger, the corrected denominators (main game-code
41,556 — the 22-ins Ghidra-boundary gap), all three metrics, and the roadmap delta (P33 = verify + flip).

**Kill gate:** a session that banks nothing and produces no new verdict ends the crack work (T3); the parked-5 work
is bounded to the static candidate list + one static-RE session; no forced banks, no redefinition (P9).
Scale estimate: 3–5 sessions.

## Effort / model (R7/R26/R27 — every transition is PROMPTED, never assumed)
- **Max** through T0–T2 (T2 is non-obvious static RE; T0/T1 are settled-design and would be fine at xHigh).
- Prompt to drop to **xHigh** for T3 (orchestration) and T4 (ledgering); prompt back to **Max** for T5 (PhaseEnd).
- Models: T1c one **Sonnet** agent (123 ins); T3 **Opus** for all 11 targets (escalation tier — Sonnet plateaued on
  the ≤120-ins rows in S79); **Fable only if an agent names a wall class the codegen map lacks** — STOP and prompt
  Drew first. **No Ultracode / Workflow:** one-page census → the S80 one-agent-per-function shape
  (`docs/wave-playbook.md` §S80 addendum, Agent-tool subagents; `tools/agent_verdicts.py` for any that outlive a
  session).

## Adjustments vs `frontier-p32.md` §4 (approved)
1. The parked 5 (T2) run BEFORE the crack pass (T3): the static header probe (2026-09-05) gave every payload a
   deterministic candidate base, so T2 is a set of ~0-token `new_binary.sh` byte-gate probes, and any stubs they
   add ride the same single bounded agent pass.
2. Tooling-first split into three tasks, one commit each (P4/R42/R60).
3. No MCP dependency for the parked 5 (static evidence + our own matched C); MCP only as a fallback (R29 prompt).
4. Walls get a ledger task (T4), not drafting — incl. fixing two dangling best-draft paths (R62).

## Tasks (strict order; one commit per task after this file is updated; count banks from the SOURCE)

- [x] **T0 — Phase open** (Max) — DONE 2026-09-05: verbatim 5==5 · exclude 8/8 fresh · census 21 (B-CARVE 4 / D-NEAR 10 / F-FAR 7, `.run/P32/frontier_p32_open.json`) · tools-health OK · check-all 213/213 rc 0 (`.run/P32/t0_baseline.log`): this file; harness task list (R28); baseline reads — `verbatim_check --strict`
      (5==5), `exclude_audit --assert-fresh`, `frontier_classify --json .run/P32/frontier_p32_open.json` (21),
      `make tools-health` OK, `make check-all` 213/213 (read of the on-disk S80 artifacts); commit.
- [x] **T1a — resident: split the code subseg, bank `func_800D128C` (243)** — DONE 2026-09-05: BANKED byte-identical `8e17e02f…` (commits `380ccdc84` split + `c513e1fbb` bank); **R22 after the bank: check-all 213 passed / 0 failed, rc 0** (`.run/P32/t1a/r22.log`); resident stubs 2 → 1; THREE instrument fixes on the way (cookbook §496 carrier provided-types, §498 carve `--pre` drop + gate ignoring the extract rc + interleave_check false DRIFT); twin_rescan: 20 open, nothing newly free. Original brief:
      `jr_isolate_all resident --only func_800D128C` (dry-run CLEAN 2026-09-05: 3 region files, carve repoint
      `resident → resident_jr_800D00E4`, `--order` + `JTBL_PADS`) → `make extract BINARY=resident && make build
      BINARY=resident -j8` (EXIT CODE, R53; byte-neutral split) → commit carve state alone (R60) → `rtu_match` the
      closeness-0 draft `.run/S71_gate14/resident/func_800D128C.c` in the new region TU → `parallel_gate --r22`
      (carves `jtbl_80113FB8` + `jtbl_80114198`; `pads_audit` after) → in-tree build exit code → commit →
      `twin_rescan`. TU refusal → §376/§378 chain as a byte-neutral plumbing commit BEFORE re-gating.
- [x] **T1b — ov_SC02_017: split + remap the twin, bank `func_80186C64` (209)** — DONE 2026-09-05: BANKED byte-identical `c0253499…` (`c52190ca8` carrier §497 fix — NO source rename needed · `599dba3ba` split · `c7f5b498a` bank); 0 drafting tokens; four §376 TU spellings + one TU-provided typedef stripped. Original brief (Max/xHigh): byte-neutral tag rename in `src/ov_SC02_017/ov_SC02_017_jr_8017DF34.c` (:4314/:4319; keep the
      typedef name) → build sha-unchanged → commit → `jr_isolate_all ov_SC02_017 --only func_80186C64` (dry-run
      REFUSED on the conflict 2026-09-05; expect CLEAN after the rename) → extract/build byte-neutral → commit carve
      state → `family_remap --addr 0x801810C8 --from ov_SC02_016 --to ov_SC02_017 --to-addr 0x80186C64` (d=2
      RELOC-ONLY twin; source `src/ov_SC02_016/ov_SC02_016_jr_801810C8.c:2839`) → strip typedefs the TU already
      defines (§491 gap 2) → `rtu_match` → `parallel_gate --r22` → commit → `twin_rescan`.
- [x] **T1c — md_MAIN_034: bank `func_800CB00C` (123)** — DONE 2026-09-05: BANKED byte-identical `46153c06…` (`059266afc`) from the STORED S72 body `.run/O21/opus/func_800CB00C.c` (rtu MATCH 123/123; the census's best_draft was a name-collided WRONG file, R48/R38) — NO agent; WALL pin dropped (exclude 8→7); backlog 18→17. **R22 after the T1b+T1c batch: check-all 213 passed / 0 failed, rc 0** (`.run/P32/t1b/r22.log`). Original brief: pack via
      `claude_wave_packs` (the stored 174-ins draft is WRONG, not a seed; §494 jtbl idioms) → verbatim grep →
      `rtu_match --split md_MAIN_034 --source md_MAIN_034` → `parallel_gate` (island pads derive at build, §303)
      → commit → `twin_rescan`; drop the `md_MAIN_034:func_800CB00C` pin (`exclude_audit --write`).
      **Progress report to Drew after T1c.**
- [x] **T2 — the parked 5** (Max) — DONE 2026-09-05 (T2a–T2c; T2d not needed):
  - [x] **T2a** — DONE 2026-09-05 (`848c7c50a`): controls 7/7 (5 STRONG, 2 CONSISTENT; TEXT_LO estimates == yaml); the five: MAIN/7 STRONG 0x800CEDF8 · MAIN/9 STRONG 0x800CD348 · SC03/53, /54 CONSISTENT top 0x801EF468 (12-way tie) · SC03/56 SPLIT (jal vote 0x80178C8C vs ptrs/lui ~0x801CBB50); memory-map §S45 p7; SETUP row. Brief: `tools/payload_base_evidence.py` (id word, first prologue → TEXT_LO, abs-pointer window, lui
        hi-half histogram, `jal` self-consistency per candidate base, DESTPTR lookup in the window from
        `.run/idxtab_map.json`) — R39 controls: must re-derive md_MAIN_008/011 (0x800CEDF8), md_MAIN_042
        (0x800CCB1C), md_MAIN_013 (0x800CAE08), md_SC03_073 (0x801EF468) from their payloads alone; refuses a
        payload with no self-reference (base-independent bytes — say so, never guess). SETUP row (R21);
        evidence rows → `docs/memory-map.md` §S45 p7 (G5 `static-derived`, US). Commit.
  - [x] **T2b** — DONE 2026-09-05: **ALL FIVE onboarded on their first candidate**, byte-identical first builds — md_MAIN_007 @0x800CEDF8 (`1a696a851`, 19 stubs, A4 applied) · md_MAIN_009 @0x800CD348 (`10aaf5c29`, 11) · md_SC03_053 + md_SC03_054 @0x801EF468 (`b52d67be0`, 15 + 7) · md_SC03_056 @0x801CBB50 (`1e843c607`, 4). Fleet 213 → **218**; +56 stubs (~2,600 ins). **Instrument findings (R34/R35):** the all-INCLUDE_ASM first build is a NULL oracle for FINE base errors (+8 builds byte-identical; +0x1000 fails the link) — bases are static-derived STRONG, byte-proven by the first internal-call C bank; a jal-vote base whose targets are shared-engine function starts is OUTWARD-EXPLAINED (SC03/56's false 0x80178C8C). Close chain (sig-modules → tools-health → audit-disc → R22 of 218) running: `.run/P32/t2b/close.log`. Original brief: onboard probes, one payload per commit, top candidate first (the module-class law: the FIRST
        build's byte-identity is the arbiter; a miss → next candidate; none → stays parked with the evidence):
        `md_MAIN_007 extracted/retail/MAIN.CD.dir/FILE_007 0x800CEDF8 0x34` (9/9 internal jals on its own
        prologues at that base; omit `symbols.resident.txt`, A4 law) ·
        `md_MAIN_009 …/FILE_009.dir/0.1 0x800CD348 0x3C` (the unique base fitting both in-region jals; then
        0x800CAE08, 0x800CCB1C) · `md_SC03_053 …/SC03.CD.dir/FILE_053.dir/0.1 0x801EF468 0x4` ·
        `md_SC03_054 …/FILE_054.dir/0.1 0x801EF468 0xF0` · `md_SC03_056 …/FILE_056.dir/0.1 0x801CBB50 0x4`
        (then 0x801CBD90, 0x801CC6E0). After each success: `make sig-modules`, `make tools-health` (R36),
        `make audit-disc` (UNCLAIMED 5 → 5−N), commit.
  - [x] **T2c** — DONE 2026-09-05: **20 free banks** in the five new modules for 0 drafting tokens (`89d177aa3` 8 · `9ffd0b7ee` 5 · `a2d28df18` 7): 7 d=0 hash twins + 3 RELOC-ONLY via `family_remap`, 9 constant-only NEAR-COUSINs (each constant named by the real-TU diff), 2 hand pass-throughs (main's `func_80014128` shape); `dedup_extend` 0 (no macro-group members); `split_indicator` population fix (`8b2bbff83`, was a stale 213 list — R51). **R22 after the batch: check-all 218 passed / 0 failed, rc 0** (`.run/P32/t2c/r22.log`). Census: **54 stubs / 6,376 ins** (`.run/P32/frontier_t2c_close.json`: main 12 · md_MAIN_007 15 · md_MAIN_009 10 · md_SC03_053 6 · md_SC03_054 4 · md_SC03_056 1 · ov_SC03_105 2 · resident 1 · md_MAIN_003 1 · ov_SC06_022 1 · ov_SC07_002 1). `make audit-disc` UNCLAIMED 0 of 220; disc-completeness.md P32 section written; cookbook §499 + decision-log S81 (R31). Brief: free banks + census: `twin_rescan` / `dedup_extend` for h_exact twins of the new stubs; regenerate
        the census; leftovers join T3. Update `docs/disc-completeness.md` (+ ledger regen), decision log (R31).
  - [x] **T2d** — NOT NEEDED (both MAIN/7 and MAIN/9 onboarded on their first candidate). Brief: (only if MAIN/7 or MAIN/9 refuse every candidate): one bounded static-RE pass over our own C
        (`src/800.c`, `src/boot.c`, `src/resident/resident.c`: `loadDestPtrTable`, `D_800D3764`/`D_800D384C`,
        the `resourceIdMap` sites) for a route producing global index 7 or 9; MCP (R29) only if the C is
        insufficient. Outcome: a base, or the strengthened exclusion evidence. **Progress report after T2.**
- [x] **T3 — one bounded crack pass, Opus agents, one per function** (xHigh orchestration — prompt R27):
      **DONE 2026-09-05 (S83): 47/47 drafted, 39 BANKED (10 in the launching session + 29 in S83: the 11 S82 MATCH rows, the 17 queued Haiku rows 17/17 MATCH, and func_8001BC6C cracked 6 -> 0 by permuter_ils + an R63 read), 8 NEAR ledgered in the backlog with cost, 0 FAIL, 0 walls found. Census 15 stubs / 3,758 ins = 7 pinned walls + 8 NEAR (`.run/P32/frontier_t3_close.json`); md_SC03_053/054/056 100% C; resident 145/145; main 6 open (5 walls + func_80039308 NEAR 17). Fleet (make report): instr 13,484,739 / 13,488,497 = 100.0% · distinct 5,812,831 / 5,816,589 = 99.9% (90,975 / 90,984 unique) · fn-count 363,199 / 363,214 = 100.00% · INCLUDE_ASM 15. Step 8 (bounded tail): func_8001BC6C BANKED; func_800CD674 permuter plateau at the same $a3<->$t1 pair; func_800CF3E8 Opus second look NO GAIN at 27 but the §500-D1 mechanism corrected (cse find_best_addr) and its lever refuted (§500-H). Harvest: cookbook §500-F/G/H, BRIEF.md, jtbl_carve probe text, Makefile C_SRCS dotfile guard (a masked_diff probe broke a gate_main rebuild). Fleet R22 218/218 at 10:46, 11:09 and **217+main extracted, 218 passed / 0 failed, exits 0/0/0 at 12:00 MDT** (S83).** Original brief:
      targets = `main:func_80023BF0` 11 · `func_80038698` 11 · `func_80039B20` 7 · `func_80039308` 34 ·
      `func_80015B6C` 40 · `func_8002FDE8` 35 · `func_8001BC6C` 28 · `ov_SC03_105:func_80185810` 37 ·
      `md_MAIN_003:func_800CF3E8` 54 · `ov_SC07_002:func_8017DC80` 84 · `resident:func_800D06E8` 344 (after a
      byte-neutral fix of the `Struct80078E78` typedef clash) + any T2c leftovers. Cheap second looks first:
      `func_80023BF0` (VERIFY the S80 permuter waypoint's semantics before seeding) and `func_80039B20`.
      Packs: `claude_wave_packs` (S79 verdict incl. INERT list, exact-length best draft, matched same-TU neighbour,
      §494/§495 laws, the fixed permuter recipe `permuter_ils … --cycles 8 --secs 150 --j 3`); brief =
      `.run/S79w/SYS.md`. Per result, never in bulk: verbatim grep → `rtu_match` (main: `--tu src/<TU>.c`) → gate
      (`parallel_gate --r22` / main: `gate_main <slate> --apply`, read the BODY/TABLE/PLUMBING/MIXED line) →
      commit per bank (R42) → `twin_rescan`; plateaus → `backlog.py log` with attempt + cost (R41).
      Expected 1–4 banks (S79: 3/11 on the Opus F/G tier), ~0.6–1.4M tokens. **Progress report after T3.**
- [x] **T4 — the walls' FINAL verdicts** — DONE 2026-09-05 (S83, xHigh, no drafting): all 7 pinned rows re-probed IN TU CONTEXT (`rtu_match` in the real TU; the three CC1-FAIL rows via a sandbox TU copy under `.run/P32/t4/tu/` — every CC1 FAIL was plumbing, R40) and every one reproduced its recorded residual: **1 PROVED** (`main:func_80011380` §474, DIFF 6) · **6 CANDIDATE** with current citations (`func_80032A74` 1 · `func_80020DA4` 2 · `func_80039DEC` 2 · `func_800391D4` 3 · `ov_SC06_022:func_8017DF28` 2 · `ov_SC03_105:func_801834A4` 6). No verdict changed. Deliverables: the wall table below; `config/wave_exclude.txt` annotated per row, `exclude_audit --assert-fresh` 7/7; backlog rows for all 7 (the two path-less rows given existing drafts, R62; `func_80032A74` got a TU-clean synced draft `.run/P32/t4/drafts/func_80032A74_tuclean.c`); cookbook **§500-I**; `docs/accelerators.md` (8); decision-log (the final wall doctrine, R31). Original brief: the 8 pinned rows — confirm each citation current
      + instrument exonerated (R40), PROVED vs CANDIDATE, ledger best-draft → an existing real-TU-clean C file (R62:
      `func_80011380` → `.run/m3/opus/func_80011380.c`; `func_801834A4` → `.run/S71_gate14/ov_SC03_105*/`),
      `exclude_audit --write`, `backlog.py render`; a T3 idiom naming a wall's mechanism re-opens that row
      (bounded: one attempt, permuter first). Wall table into this file; cookbook §496+; decision log; accelerators.
- [x] **T4b — crack and bank the final 15 (ADDED 2026-09-05 by Drew's directive; supersedes the kill gate: "anything that isn't the original hand-written asm or the PsyQ libs needs to be cracked and banked before we finish")** — **FIRST PASS COMPLETE 2026-09-05 (S83): 11 of 15 BANKED byte-identical, 4 carried to the NEXT session's HAND pass (Drew: no second agent round; hand-crack the remaining ones).** Hand pass first (22 spellings, 0 banks, every blocker refined to a mechanism in `.run/P32/t4b/<fn>/NOTES.md`), then one Fable agent per row (permission, not requirement — Drew), resumed 3-at-a-time through three usage-limit outages. Banked (each: coordinator `rtu_match` in the CURRENT real TU → `gate_main` / `bank.sh` byte-identical → one commit; pins dropped by `exclude_audit --write`; mechanism in cookbook §501–§501-L): `main:func_800391D4` `1e54e88a8` · `main:func_80039DEC` `e8c2b6baa` · `md_MAIN_009:func_800CD674` `b13e824f7` · `ov_SC06_022:func_8017DF28` `b31084300` · `main:func_80020DA4` `b47bc2ea0` · `ov_SC03_105:func_801834A4` `ff86e2572` · `md_MAIN_003:func_800CF3E8` `cb871087e` · `md_MAIN_009:func_800CD92C` `4a9a67c59` · `ov_SC07_002:func_8017DC80` `825da37bc` · `main:func_80011380` `35fa11674` (the §474 "PROVED" wall) · `md_MAIN_007:func_800CF6D0` `228928dbe`. Ten of the eleven were T4 "walls" or long-standing NEARs. **HAND PASS S84 (2026-09-06, Fable Max, no agents): row (a) `main:func_80032A74` → PROVED at 1 (§501-M producer census: the 0x48 slot can only be a combine-minted ghost, which needs an `lh`/`lb`; the pin stays with its final verdict; ledger + `tools/ghost_census.py` + `cc1_dumps.sh` repair; row (b) `md_MAIN_007:func_800CF408` → **BANKED byte-identical `8fa12bc22`** (the banked sibling func_800CD92C's spelling ported with a u32 array alias of the OT symbol, §501-N; zero pins/asm); row (c) `main:func_80039308` → PLATEAU at 4 (S84 verdict, §501-O: the phantom slot's producer census refutes every route; Y4 is register-exact); **row (d) `ov_SC03_105:func_80185810` → BANKED byte-identical `cdd9a2cb8` (S85, 2026-09-06): the banked same-shape cousin `ov_SC02_027:func_80180B3C`'s packet-window spelling ported — ZERO pins, zero fences, zero asm dials (§501-P); ov_SC03_105 100% C).** T4b hand pass COMPLETE: 13 of 15 banked, 2 verdicts (PROVED 1 · PLATEAU 4), both in main. Carried (4, all exact length, in `docs/backlog.md` with next levers): `main:func_80032A74` 1 (the last pin; ghost pseudo — near-proved) · `md_MAIN_007:func_800CF408` 3 · `main:func_80039308` 4 · `ov_SC03_105:func_80185810` 13. Close: fleet R22 **218 passed / 0 failed, exits 0/0/0** (23:33–23:36 MDT, `.run/P32/t4b/r22_full.log`); `make report`: instr 13,486,890 / 13,488,497 = 100.0% · distinct 5,814,982 / 5,816,589 = 100.0% (90,982 / 90,984 unique) · fn-count 363,210 / 363,214 = 100.00% · **INCLUDE_ASM 4**; main REAL 787 · LINKED 1,256 · VERBATIM 3 · stubs 2 · 2,089 / 2,091 = 99.90% · `143dbb89…`; census `.run/P32/frontier_t4b_close.json` 4 stubs / 1,607 ins; decision-log P32 S83 T4b (R31); accelerators (10)–(11); tools-health OK (`.run/P32/t4b/tools_health.log`).
- [x] **T4c — crack the last 2 main rows before closing (ADDED 2026-09-06 by Drew: "do that now, lets crack these before closing the phase")** — DONE 2026-09-06 (S85, Max, Fable 5.1, no agents): **BOTH BANKED byte-identical via `gate_main` ("BANKED 1 main functions -- 143dbb89f34491258bbc27810d0a12ec8b43a8dd BYTE-IDENTICAL" ×2): `main:func_80032A74` `f9a90affb` (the S84 "PROVED wall" — a combine self-update ghost mints the 8-byte slot, §501-Q) · `main:func_80039308` `ffb1949a1` (ZERO pins: the ghost chain + three inline `(b2 * 0x100)` temps merged by loop.c with a `u16 vol` accumulator + the s17/s18 reuse, §501-R).** Census `.run/P32/frontier_t4c_final.json`: **0 stubs / 0 ins**. `config/wave_exclude.txt` → 0 entries (`exclude_audit --write`); backlog 1 open (the legacy `func_80062144` row, not a stub); twin_rescan 0 open; verbatim 5 == 5. Tools: `tools/cc1_dumps_tu.sh` + `tools/alloc_table.py` (promoted), `tools/cc1_dumps.sh -dL`; SETUP rows. Route + 56 variants: `.run/P32/t4e/NOTES.md`.
- [ ] **T5 — PhaseEnd** (Max, Tier 1 — prompt R27): P7 checkbox walk; milestone demo (R22 fleet N/N, tools-health,
      `verbatim_check --strict`, final census, wall ledger, parked-5 dispositions via `make audit-disc`,
      `make report` all three metrics + main `143dbb89…` with/without SDK dirs, corrected denominators); **WAIT
      for gate 2**; `PhaseEnd_Phase32.md` (+ Roadmap delta + Plain-English Recap); `git mv` this file →
      `phase-ends/logs/Phase32.md` (R19); R23 MCP stop if it ran; leave both uncommitted for Drew (R6); 🛑 (P8).

## T4 — the walls' FINAL ledger (S83, 2026-09-05; every row re-probed in TU context; `config/wave_exclude.txt` carries the same lines)
| row | ins | class | closeness leaf / real-TU (S83) | mechanism · citation | bounded attempt record | verdict | best draft |
|---|---|---|---|---|---|---|---|
| main:func_80011380 (boot, −O0) | 192 | C-level floor | 6 / 6 (`rtu --o0`) | fold-const.c:882 `split_tree` merges MULT(MULT(i,2),2); the two escapes each cost one insn (stupid.c:497 adjacency / expand_decl use-brackets) — cookbook §474, §388 −O0 colouring oracle | 20 spellings + statement-expression + `(t=i*2)*2` register form (S76 proof); pinned S79 #8 | **PROVED** | `.run/m3/opus/func_80011380.c` |
| main:func_80032A74 (800_b_2) | 422 | FRAME/WIDTH | 1 / 1 (synced draft) | sole residual idx 244 `lh` vs `lhu`: extendhisi2 is a force_not_mem EXPAND (an orphan frame slot is minted only at an `lh`); the target's +8 frame bytes = §172 producer 3 (caller-save area, reload1.c:1445) | ~200 byte-probes + 100-variant retyping sweep (S79 Opus) + permuter_ils 8×150 s null (S80); S83: CC1 FAIL was 7 header typedefs + 4 decl spellings → synced copy DIFF 1 | CANDIDATE | `.run/P32/t4/drafts/func_80032A74_tuclean.c` |
| main:func_80020DA4 (800) | 100 | REGALLOC-PERM | 2 / 2 | phantom 16-byte frame reproduced (address-taken `frame_pad[3]`); residual = `mflo` destination `$t0` vs `$a2`; pinning regresses to 79 | 5 attempts 51→20→14→8→2 (S7x/S79) + permuter_ils null (S80); S83 rtu DIFF 2 | CANDIDATE | `.run/S79w/sonnet/func_80020DA4.c` |
| main:func_80039DEC (800_c) | 74 | REGALLOC (K&R) | 2 / 2 (sandbox TU, no-proto decl) | the `$a3↔$t0` swap of the two K&R raw-preserve parameter copies is fixed by ARGUMENT POSITION in gcc-2.7.2 narrow-parameter promotion (2nd → `$a3`, 3rd → `$t0`) before global-alloc; every pin regresses to 60–75 (cookbook §376/§495 K&R laws, lines ~1320/1508) | 3 attempts (S7x/S79 Sonnet 9) + permuter_ils 9→2 (S80); S83: CC1 FAIL = the TU's narrow prototype at 800_c.c:3496 vs the K&R def | CANDIDATE | `.run/S79w/permuter/func_80039DEC.c` |
| main:func_800391D4 (800_c) | 75 | SCHED (loop) | 3 / 3 (sandbox TU, `[][1]` externs) | 3-insn SCHEDULE-REORDER (`off` init vs arg1's `sll/sra`): `move_movables` splices hoisted invariants after any pre-existing preheader flow code (loop.c 2.7.2:1529; map loop.md L4) | 4 prior + S79 Sonnet 64→3 (`i=$7` pin kills combine_givs, `D_80073140[][1]` decl, 7 `asm("")` pads) + permuter_ils null (S80); S83: the `[][1]` spelling is load-bearing (TU-compatible forms → 65 @ 76) | CANDIDATE | `.run/S79w/sonnet/func_800391D4.c` |
| ov_SC06_022:func_8017DF28 (jr_8017BEBC) | 119 | SCHED (slot) | 2 / 2 | `expand_block_move` `copy_addr_to_reg` pseudo cse-reused for both later `&mtx` args (map cse_expr.md [A23-2]/§H); `addiu $s2,sp,0x10` in the jal delay slot vs the target's bnez slot | five RTL-verified attempts (S71/S79); permuter_ils "1" was a divergent rewrite (S80, R63); S83 rtu DIFF 2 | CANDIDATE | `.run/S79w/sonnet/func_8017DF28.c` |
| ov_SC03_105:func_801834A4 (jr_80181C84) | 106 | SCHED (loop) | 6 / 6 (×3 variants) | loop.c movable ordering (S71) | S71 gate14 resolver variants cn-cast / -rc / -rc-sd all DIFF 6; S83 rtu DIFF 6 ×3 | CANDIDATE | `.run/S71_gate14/ov_SC03_105-cn-cast-rc-sd/func_801834A4.c` |
| *(unpinned)* md_MAIN_003:func_800CF3E8 | 469 | ALIAS-BASIN | 27 / 27 | cse.c `find_best_addr` (fold_rtx MEM; COST pseudo 0 vs hard reg 1) swaps the bare-REG tag-load address to a pseudo; the alias lever refuted 5/5; the pinned-pointer launder frees the load but lands it 4 slots late (79 @ 470) — §500-H | S79/S82 Opus + S83 Opus second look (245k tokens, ~16k compiles) | CANDIDATE (backlog, not pinned) | `.run/P32/t3/opus/func_800CF3E8.c` |

The other 7 NEAR rows (`func_80039308` 17, `func_800CD674` 2, `func_800CD92C` 15, `func_800CF408` 49, `func_800CF6D0` 137, `func_80185810` 35, `func_8017DC80` 46) are DEFERRED WITH COST in `docs/backlog.md` (class · closeness · best draft · agent/permuter cost), per the milestone's third disposition.

## Standing procedure (every task)
Fix the TU by a byte-neutral plumbing commit BEFORE any gate (S77 law) · commit banked work before the next
command that can touch `src/` (R42) · after any bank: `twin_rescan`, `verbatim_check --strict` (R62) · after a
carve/merge touching a yaml/`.mk`: `make extract BINARY=<b>` before building; `pads_audit`/`interleave_check` on
every touched carve binary (R60) · fleet verify after every banked batch: `make clean && make extract-all && make
check-all` — read EXIT CODES (R53), quote the green count at every close (R58); `make tools-health` · log each
task here + refresh the 🛑 checkpoint before any pause · rules check every 4 tasks (P6) · harvest idioms into the
cookbook before the next drafting step (R16/R30) · no `Co-Authored-By` trailer (R5); keep the `Claude-Session:` line.

## Blockers
- 2026-09-05 09:xx: the successor session's SessionStart hook launched a headless Ghidra MCP server (`.run/ghidra-mcp.log`); T3/T4 do not use it; no RE writes → never stage the `ghidra/` churn (R23).
- Ghidra MCP not running at open (clean stop in the log; the SessionStart hook's server did not persist). Not
  needed for T0–T2b; if T2d needs it: `tools/ghidra_mcp_start.sh` → pause → Drew runs `/mcp` (R29) → G2 ping.

## Log
- 2026-09-06 (S85, T4c CLOSE — the chain's logs read; gate 2 CONFIRMED by Drew) — **Fleet R22 after the two main banks: `make clean` EXIT=0 · extract-all 217 extracted, 0 failed of 217 (+ main, serial) EXIT=0 · check-all 218 passed, 0 failed of 218 EXIT=0 (16:13:17 MDT)** (`.run/P32/t4e/r22_*.log`). `make report`: **fn-count 363,214 / 363,214 = 100.00% · instr 13,488,497 / 13,488,497 = 100.0% · distinct 5,816,589 / 5,816,589 = 100.0% (90,984 / 90,984 unique) · MAIN game-code 41,534 / 41,534 = 100.0% · INCLUDE_ASM 0 · NON_MATCHING 0 · LINKED 1,256 · REAL substantive 360,737 (dedup 2,220 groups / 255,708 instances)** (`report_close.log`). `make report BINARY=main`: **REAL 789 · LINKED 1,256 · VERBATIM 3 · INCLUDE_ASM 0 · matchable 2,091 · byte-identical 2,091 / 2,091 = 100.00% · SHA1 143dbb89f34491258bbc27810d0a12ec8b43a8dd** (`report_main_close.log`). `make tools-health` (`tools_health.log`): see the PhaseEnd (read at the close). Milestone confirmed by Drew (gate 2): "milestone confirmed, gate 2 approved. write the PhaseEnd". NEXT = T5 executed in this session.
- 2026-09-06 14:00–19:30 MDT (S85, continued) — **T4c DONE: the last two functions banked; the frontier is EMPTY.** (a) `func_80032A74`: step 0 shape-grep (`0x6009F`, `0x5301`) → cousins `func_8003388C`/`func_800336A8` (800_b_2) and `func_8003A0E4` (800_c); the crack was a NEW frame-slot producer — combine.c:2306 skips the ref decrement for a deleted self-update (`i2dest_in_i2src`), so `gx = dd->unk07; gx -= 0x100; flag = (u32)sub < (u32)(u8)gx;` compiles to the same `lbu` and reload mints the orphan slot at 0x48; 18 reproducers (`.run/P32/t4e/ghost/`, k4/k5/k7/k14/k16/k17 mint, byte-store hosts don't); rtu MATCH on the first probe (a1); `gate_main` BANKED `f9a90affb`. (b) `func_80039308`: Y4 + the ghost chain fixed the frame (DIFF 6), reusing arm 1's `s17`/`s18` as the else pointer/temp fixed the else head (b11 DIFF 2), then 40 variants on the hoisted `sll $s2` (`tools/cc1_dumps_tu.sh` real-TU dumps + `tools/alloc_table.py`): a named `vbase` after the inner loop is never a movable (loop.c:695), a 1-use temp is "not desirable", copy-first folds the arms onto `vol` (cse.c make_regs_eqv), copy-last births `vol` after the tests ($a0); the reproducer sweep (s1–s8) found `u16 vol` keeps the arms on the hoisted register; b52 = `u16 vol` + `vol = b2 * 0x100` copy-first + arms `(b2 * 0x100) ± X` (three temps merged by combine_movables, refs 7 → $s2) → **MATCH**; b54–b56 dropped every pin → **b56 zero pins**; `gate_main` BANKED `ffb1949a1`. Post-bank: verbatim 5==5, twin_rescan 0 open, backlog 1 open (legacy row), `exclude_audit --write` → 0 entries, census **0 / 0**. Harvest: cookbook **§501-Q, §501-R** (+index OK), accelerators (15)(16), decision-log P32 S85 T4c, SETUP rows, `.run/P32/t4e/NOTES.md`, `.gitignore` allowlist. **Fleet R22 + `make report` ×2 + `make tools-health` launched as one background chain at ~19:20 MDT** (`.run/P32/t4e/r22_{clean,extract,check}.log`, `report_close.log`, `report_main_close.log`, `tools_health.log`) — read them first next session. Session paused at Drew's request (90% context). NEXT = record the chain's numbers → T5.
- 2026-09-06 13:00–13:50 MDT (S85, continued) — **T4b CLOSE (task #13 done): fleet R22 after the bank `make clean && make extract-all && make check-all` → clean EXIT=0 · extract-all 217 extracted, 0 failed of 217 (+ main, serial) EXIT=0 · check-all 218 passed, 0 failed of 218 EXIT=0 at 13:21:49 MDT** (`.run/P32/t4d/r22_{clean,extract,check}.log`). `make report` (fleet, `.run/P32/t4d/report_close.log`): instr **13,487,557 / 13,488,497 = 100.0%** · distinct **5,815,649 / 5,816,589 = 100.0%** (90,984 / 90,984 unique fns) · fn-count **363,212 / 363,214 = 100.00%** · INCLUDE_ASM **2** · NON_MATCHING 0 · LINKED 1,256 · REAL substantive 360,735 · dedup 2,220 groups / 255,708 instances. `make report BINARY=main` (`report_main_close.log`): REAL **787** · LINKED **1,256** · VERBATIM 3 · INCLUDE_ASM **2** · matchable 2,091 · byte-identical **2,089 / 2,091 = 99.90%** · build SHA1 `143dbb89f34491258bbc27810d0a12ec8b43a8dd` byte-identical · MAIN game-code weighted 40,594 / 41,534 = 97.7% (digest denominator; the corrected one is 41,556). `make tools-health` → **OK** (sigs fresh; corpus(+resident) + cdecl + binaries + report(lint+dedup) + cookbook-index green; split_indicator 218 OK). Census `.run/P32/frontier_t4b_final.json` **2 stubs / 940 ins** (main `func_80039308` PLATEAU 4 · `func_80032A74` PROVED 1); `twin_rescan` 2 open / 0 newly free; `verbatim_check --strict` 5 == 5; `docs/backlog.md` 3 open (the two verdict rows + the legacy `func_80062144` "won't compile standalone" row). 🛑 block refreshed for T5 (below). NEXT = **T5 — the PhaseEnd (Tier 1, Max; present the milestone demo and WAIT for gate 2)**.
- 2026-09-06 (S85, session 3a7e207c, Max, Fable 5.1, no agents) — **T4b hand pass, row (d) `ov_SC03_105:func_80185810` BANKED byte-identical (`cdd9a2cb8`: bank.sh — rtu MATCH 489/489 in the real TU, splice, `make build BINARY=ov_SC03_105 -j8` rc 0, sha `d305ff6d…` == `config/check.ov_SC03_105.sha`).** Preflight: tree clean, `verbatim_check --strict` 5==5, `make check-all` 218 passed / 0 failed EXIT=0 (`.run/P32/t4d/check_all_preflight.log`); the Fable draft re-verified DIFF 13 (rows 363–380). §501-N step 0: twin oracle 0, atlas knn nothing (only a REVERSE 0.55 "weak cousin" entry), symbol grep = this overlay only; the SHAPE grep (`'0x200) << 2'`, the getTPage chain) surfaced `ov_SC02_027:func_80180B3C` — the same billboard drawer, banked — whose objdump window (0x34f8–0x3560) is the target's rows 362–386 verbatim. Its window spelling ported onto the draft (`.run/P32/t4d/d1_sibport.c`) → MATCH first try; the pin census (d2–d12, all real-TU): mode/cl/c40/uu pins individually and jointly removable, `ot16` pin load-bearing ONLY next to 2-set neighbours (DIFF 4), **d9 with NO pins = MATCH → banked**; F2's polarity re-rolls 42 rows, a 2-set `uu` 63 rows (the S83 "combine folds the fresh andi via nonzero_bits / a hard reg hides it" reading refuted — the andi survives as a lone single-set insn). Post-bank: `twin_rescan` 2 open / 0 newly free; `verbatim_check --strict` 5==5; `backlog.py render` 3 open (row pruned); census `.run/P32/frontier_t4b_final.json` **2 stubs / 940 ins** (main `func_80039308` 4 · `func_80032A74` 1). Harvest: cookbook **§501-P** (+ index regen), accelerators (14), decision-log P32 S85 (R31), `.run/P32/t4d/NOTES.md` (the 12-variant census). Fleet R22 launched after the bank (`.run/P32/t4d/r22_*.log`) — see the T4b close entry. **T4b hand pass COMPLETE: 13/15 banked + 2 final verdicts. NEXT = the T4b close, then T5.**
- 2026-09-06 (S84, continued) — **T4b hand pass, row (c) `main:func_80039308` → PLATEAU at 4 (verdict).** Producer census for the target's phantom slot `[arg1 @0][8 @8][cnt @0x10]` (§501-O): cnt's slot is `spill_stack_slot[23]` (cnt evicted from `$s7`, `.greg` "Register 95 now on stack"), so the phantom is an initial-loop slot with no traffic; every producer refuted on dump facts (leaf → no save area; LO spilled after GR; products alternate to GR_REGS — C3 measured `mflo $a1/$v1`; no unallocated single-block equiv pseudo; expand-time locals precede; all 13 `lh` single-use, no `lb`). Rows 49/50 = two `move_movables` hoists in body order (open: steer the hoisted `b2 * 0x100` into `$s2` without the pin). Ledger row updated (closeness 4, FRAME+SCHED), NOTES `.run/P32/t4c/func_80039308/NOTES.md`, probe `c3_twoprod.c`. **Row (d) `ov_SC03_105:func_80185810` (13) read (report + rtu DIFF 13 re-verified) — NOT started; per §501-N its step 0 is a banked-sibling search on its symbol set (`D_800A5E60`, `D_801BC9B4/BC`, `D_801BA6B0`, `D_800AF630`, `D_800A6610`).** Session paused here at Drew's request (87% context).
- 2026-09-06 (S84, continued) — **T4b hand pass, row (b) `md_MAIN_007:func_800CF408` BANKED byte-identical (`8fa12bc22`: bank.sh — rtu MATCH 178/178 in the real TU, splice, `make build BINARY=md_MAIN_007 -j8` rc 0, sha `2ff702b6…` == `config/check.md_MAIN_007.sha`).** The Fable draft's 3-row prologue-weave residual (§501-L) was a shape symptom: the same-family banked sibling `md_MAIN_009:func_800CD92C` (§501-H) had matched with the plain libgpu addPrim shape; porting it with this function's constants matched first try (`b0d_sibport_alias.c`). The TU declares `extern u8 D_800AA60C[]`, which kills the sibling's `u32` ARRAY_REF (the form whose address `memory_address → force_reg` lets cse bind the OT base into `$t2`; every `u8` respelling emits the `$at` macro form ×8) — solved with the fleet's asm-label alias `extern u32 wD_800AA60C[] __asm__("D_800AA60C");` (1,438 banked files carry the pattern; a declaration, not an asm body). Measured and refuted on the way: the sibling's lever-7 trailing volatile asm 2-set dial (flips `$t1/$t0`), the struct-view and P_TAG-on-`u8` forms. Post-bank: `twin_rescan` 3 open / 0 newly free; `verbatim_check --strict` 5==5; backlog rendered 4 open (the row pruned). Harvest: cookbook **§501-N**, accelerators (13), NOTES `.run/P32/t4c/func_800CF408/NOTES.md` (7 variants). bank.sh's `Claude-Session` trailer now comes from `$CLAUDE_SESSION` (was S83's id hard-coded). NEXT = row (c) `main:func_80039308` (4).
- 2026-09-06 (S84, session 72d8b4b1, Max, Fable 5.1) — **T4b hand pass, row (a) `main:func_80032A74` CLOSED: PROVED at 1 (verdict, not a bank).** Preflight: tree clean, `verbatim_check --strict` 5==5, `make check-all` 218 passed / 0 failed rc 0 (`.run/P32/t4c/check_all_preflight.log`). Re-verified in the real TU (`rtu_match … --tu src/800_b_2.c --asm-subdir asm/nonmatchings/800_b_2`): the `s16 u18` draft DIFF 1 (idx 244 `lh` vs `lhu`, frame exact); the `u16 u18` TU-clean variant DIFF 22 = the 22 frame rows only (422/422 code). The residual is ONE reload-time slot at sp+0x48. Instead of a spelling sweep, enumerated every post-parameter stack-slot producer from the 2.7.2 source (reload1.c:658 ghost `alter_reg` · caller-save.c:249 area · reload1.c:879 invalid-equiv address · reload1.c:3499 `spill_stack_slot`) and refuted each on the bytes/dumps: combine's `newi2pat` ghosts re-derive a narrow load (`lh`/`lb`) and the site is `lhu` with no `lb`/double load; a save area without `sw/lw` needs sched.c:4962 staleness and no register-only insn shares a block with any of the 7 calls; unallocated single-block equiv pseudos cannot exist; `$t0` holds no pseudo (`order_regs_for_reload`) and LO mult results retry into `GR_REGS`. Found and measured a NEW ghost producer — `local-alloc.c optimize_reg_copy_2` on `tmp = x; tmp op= c; x = tmp;` (P13 refs 5, P14 refs 1) — which cannot slot because it is minted after regclass (class `GR_REGS`, no conflicts → allocated, vars=0). 18 isolated reproducers, 0 draft variants. Deliverables: cookbook **§501-M**, `tools/ghost_census.py` (new) + `tools/cc1_dumps.sh` (repaired: frame line + census, the under-counting `(use)` grep gone) + SETUP rows (R21), accelerators (12), backlog row (WALL-PROVED) + `tools/backlog.py` tie-break repair (kept the EARLIEST record at equal closeness — the S84 row never rendered), `config/wave_exclude.txt` annotated (`exclude_audit --assert-fresh` 1/1), notes `.run/P32/t4c/func_80032A74/NOTES.md`. NEXT = row (b) `md_MAIN_007:func_800CF408` (3).
- 2026-09-05 13:05–23:40 MDT (S83, continued) — **T4b first pass COMPLETE: 11 of 15 banked, 4 carried.** Fifteen Fable agents launched from `.run/P32/t5x/` (BRIEF + packs + the hand-pass NOTES); three usage-limit outages killed every run (resumed each time via SendMessage with context intact; "write deliverables early" saved one crack from a dead run); from the second outage on, resumed 3 at a time (Drew). Verdicts: 11 MATCH (each re-verified by the coordinator in the CURRENT real TU and banked byte-identical — main rows via `gate_main` slates, overlays/modules via `SPLIT=… DRAFT_DIR=.run/P32/t5x/fable bank.sh`), 4 NEAR at exact length (1 / 3 / 4 / 13) with pass-attributed residuals and next levers ledgered. Every crack came from READING a pass dump against the 2.7.2 source; cookbook §501–§501-L (12 new laws: cascades, cross-jump-after-alloc, dying-input vs birthing boost, hard-reg sets count, pins forbid retry regs, CSE-quantity split, three-passes-three-dials, constants as floaters, manufactured orphans, a proved tree wall is not an RTL wall, sched2's /s exemption, coupled dials); decision-log P32 S83 T4b; accelerators (10)–(11). Instrument defects: bank.sh (empty fn list → built the unchanged tree, exit 0; `_jr_` TU split; draft dir) hardened, and two premature "banked" ledger messages corrected in the next commit (memory: write the message from the tool's output). Pins 7 → 1. Fleet R22 218/218 at the close; `make report` fleet 100.0/100.0/100.00, 4 stubs. **Drew: no second agent round; hand-crack the remaining four next session.** NEXT = the hand pass on the four (see the 🛑 block), then T5.
- 2026-09-05 12:05–12:40 MDT (S83, continued) — **T4 DONE.** Preflight: tree clean, verbatim 5==5, R22 218/218 (12:00), `exclude_audit --assert-fresh` 7/7. Every pinned wall's best draft re-run with `rtu_match` in its CURRENT real TU: `func_80011380` DIFF 6 (`--o0`), `func_80020DA4` DIFF 2, `func_8017DF28` DIFF 2, `func_801834A4` DIFF 6 ×3 variants; the three CC1-FAIL rows re-probed after their plumbing was understood — `func_80032A74` (7 TU-provided typedefs + 4 decl spellings → `cdecl.strip_provided_typedefs` + the TU's lines → DIFF 1 in the real TU), `func_80039DEC` and `func_800391D4` (a sandbox TU copy under `.run/P32/t4/tu/` with the declaration edited THERE → DIFF 2 / DIFF 3) — no `src/` edit, no byte-neutral commit spent on rows that will not bank. Leaf `match_one` re-measured all three (1 / 2 (permuter) / 3). **No verdict changed: 1 PROVED (§474) + 6 CANDIDATE**, citations current (§474, §172 reload1.c:1445, loop.md L4 2.7.2:1529, cse_expr.md [A23-2], the K&R promotion laws). Deliverables: the wall table (above), `config/wave_exclude.txt` per-row S83 lines, backlog rows for all 7 (+ the two path-less rows fixed, R62; `docs/backlog.md` 16 open), cookbook §500-I, accelerators (8), decision-log. NEXT = **T5 (Max, Tier 1 — prompt R27, WAIT for gate 2)**.
- 2026-09-05 11:30–12:30 MDT (S83, continued) — **T3 steps 8–9 DONE → T3 CLOSED.** Step 8: `permuter_ils` 8×150 s -j3 on the two REGALLOC-PERM seeds — `func_800CD674` plateau (best waypoint = the same 2-row `$a3↔$t1` pair; ledgered with cost), `func_8001BC6C` reached masked 1; the R63 read showed three mutations, one of them a WRONG-WIDTH `& 0xFF` (lhu→lbu); the two sound ones (idx after color; an early `tag`/`k` birth) = leaf MATCH, re-spelled well-defined as `k = 0; tag = (a1 << 8) | k;` (11 spellings measured), rtu MATCH in src/800.c, **gate_main BANKED 143dbb89** (`836181a6c`) — main 7 → 6 open. gate_main's first rebuild died on a concurrent agent's `src/.masked_diff_probe.<pid>.c` (present at parse, gone at compile) → **Makefile `C_SRCS` find now `-not -name '.*'`** (`563a21144`, byte-neutral, control on `make -pn`). One bounded Opus second look at `func_800CF3E8` (245k tokens, 29 min): 27 holds; §500-D1's mechanism corrected to `cse.c find_best_addr` (fold_rtx MEM; COST pseudo 0 vs hard reg 1), the alias lever refuted 5/5, a new zero-byte pinned-pointer launder found (79 @ 470, structurally closer) — cookbook **§500-H**, backlog row updated. Step 9: `make report` (fleet instr 100.0% · distinct 99.9% · fn 100.00% · 15 stubs), `make report BINARY=main`, census `.run/P32/frontier_t3_close.json` (15 / 3,758), twin_rescan 0 free, cookbook §500-G/H + index, this file; R22 → see the 🛑 block. **Kill gate:** the session banked 29 and produced 3 new verdicts; the tail's three bounded attempts are spent — T3 closes on the evidence. NEXT = T4.
- 2026-09-05 10:10–11:25 MDT (S83, session 491895ad, xHigh, Fable 5.1) — **T3 steps 0–7 DONE: 28 banks, fleet R22 218/218 twice.** Preflight R22 218/218 rc 0 (`.run/P32/t3s3/r22_check.log`) → the 11 S82 MATCH rows banked: md_SC03_053 ×2 (`d3f05998d` `9887e6987`, 100% C) · main ×2 via gate_main (`e2aee8e27`: "slate 2 -> 2 compatible … BANKED 2 … 143dbb89 BYTE-IDENTICAL") · md_SC03_054 func_801EF6D8 604+7 jtbls (`aa773c8fb`; `jtbl_carve --probe` refused the tail carve → §303 derive stage reproduced the island pads `0,0t1,0t1,0t1,0t1,0t1,0` with NO carve state change) · md_MAIN_007 ×6 after the byte-neutral func_800CF3B0 no-proto decl commit (`9e84ce2cd`, `8ca9d53ca`) — two integration classes on the way (same-TU s16/u16 spelling of D_800B99E8; §304 self-defining rodata D_800CEDFC). twin_rescan 33 open / 0 free; verbatim 5==5; **R22 `make clean && make extract-all && make check-all` → 217+main extracted, 218 passed / 0 failed, exits 0/0/0** (`.run/P32/t3s3/r22_full.log`, 10:41–10:46); tools-health OK. The 9 NEAR rows ledgered (`backlog_near.sh`; docs/backlog.md 15 open). **17 Haiku agents launched 10:57 from staged prompts (`.run/P32/t3s3/prompts/`), 17/17 MATCH by 11:15**, each re-verified with rtu_match in the CURRENT TU and banked by `bank.sh` (verbatim grep → rtu → splice → one build → sha → commit-on-green): md_MAIN_007 ×6 (`5aab66b2d` `5160775a1`), md_MAIN_009 ×8 (`f20e42259` `fc922a4cc` — func_800CD520 needed a §376 re-spell after a sibling bank added the file-scope prototype), md_SC03_054 ×2 (`582bcab70`, 100% C), md_SC03_056 ×1 (`f461715d0`, 100% C). twin_rescan 16 open / 0 free. Harvest: cookbook **§500-F** (the four integration classes), BRIEF.md §304 sentence, `jtbl_carve --probe` text, harvest_notes. Post-batch R22 (after all 28 banks): 217+main extracted, **218 passed / 0 failed, exits 0/0/0** (`.run/P32/t3s3/r22b_full.log`, 11:04–11:09).
- 2026-09-05 (successor session, later) — **Session-start protocol rewritten at Drew's direction (R64 candidate):** `phase-ends/DIGEST.md` created (every phase synopsis + every rule in full + the PROJECT_CONTEXT corrections + the doc map); CLAUDE.md load order = PROJECT_CONTEXT → DIGEST → the three most recent PhaseEnds → CURRENT_PHASE, ≈100k tokens, the 🛑 block replayed VERBATIM; Phase Boundary step 3b maintains the digest (P7); `phase-ends/README.md` + SETUP §7 updated; the two memories (`checkpoint-current-phase-before-pause`, `session-start-list-rules-in-full`) + MEMORY.md updated; `.run/P32/t3/PROMPT_TEMPLATE.md` saved (verbatim agent prompts). The 🛑 block below was REFRESHED to the verbatim-replay standard and SUPERSEDES the 09:30 block. Ratify R64 at PhaseEnd_Phase32.
- 2026-09-05 09:30 MDT — **T3 CHECKPOINT by the successor session (Max, Fable 5.1) after the launching session died.** The T3 coordinator (session c6a5fb71) banked 10 functions in 9 commits (T3 (1)–(9), 01:01–01:07 MDT) and then hit "Prompt is too long" at 01:07 MDT; 22 agent completions (07:07Z–08:04Z) arrived into a dead session. Recovered via the recorded route: `agent_verdicts.py` over the 31 task transcripts → `.run/P32/t3/verdicts.jsonl` (20 MATCH / 9 NEAR / 2 FAIL); every unbanked draft re-verified with `rtu_match` in its real TU (10 MATCH confirmed). **Instrument incident (R48 class):** one agent's tidy-up (`find .run/P32/t3/opus -maxdepth 1 -type f ! -name func_800CD674.c -exec mv {} _scratch/`, 07:52Z) had swept 11 sibling Opus deliverables — found in `_scratch/`, moved back, byte-verified at the reported closeness; `tools/agent_drafts_restore.py` (NEW — transcript replay) written as the fallback; `.gitignore` allowlist for `.run/P32/**` so the drafts/ledger/census are committed (R20). Harvest written IN-SESSION (R16/R30): cookbook **§500** (10 banked closers, 10 MATCH closers, 9 NEAR classes, two NEW mechanisms — the pinned-base alias basin and `#line`-equalised ASM_OPERANDS — and the process defects); `docs/wave-playbook.md` §S80 addendum-2 (per-function work dirs, JSON-only final message, the 20-agent cap, the recovery tools); `docs/accelerators.md` P32 T3; `docs/decision-log.md` P32 S82 (R31); SETUP row (R21). Read-only T4 pre-check results from the dead session preserved in the 🛑 block. Effort: this checkpoint at Max; **T3 resumes at xHigh** (R27).
- 2026-09-05 — gate 1 approved; T0 opened at HEAD `77df1092e`.
- 2026-09-05 — **T3 LAUNCHED** (xHigh): 47 targets = census 54 − 7 pinned walls (`.run/P32/t3/targets.json`, 5,288 ins); packs built (`claude_wave_packs`, 47/47 neighbours, 10 journals); brief `.run/P32/t3/BRIEF.md`. **20 Agent-tool drafters running** (16 Opus: the 11 old near/far rows + resident func_800D06E8 + the 4 largest new bodies · 3 Sonnet · 1 Haiku); **27 Haiku queued** behind the harness's 20-concurrent cap (`.run/P32/t3/pending_launch.txt`, launched one per freed slot). Recovery + per-result route: `.run/P32/t3/LAUNCHED.md`.
- 2026-09-05 — **T2c DONE (R22 218/218 rc 0) · T2d not needed.** Twenty of the 56 new stubs fell to twin remaps and constant flips (0 tokens); the rest (36, all ≤50 ins but one, never drafted) join T3 on the model ladder. Session limit reset here (Drew); effort now xHigh via `/model` (the T3 orchestration level, R27 satisfied). Settings-file JSON defect fixed (a trailing comma).
- 2026-09-05 — **T2b DONE — the parked ledger is EMPTY: all five payloads onboarded byte-identical (MAIN/7 → md_MAIN_007 @0x800CEDF8; MAIN/9 → md_MAIN_009 @0x800CD348; SC03/53, /54 → md_SC03_053/054 @0x801EF468; SC03/56 → md_SC03_056 @0x801CBB50).** Every base came from T2a's static alignment (self-calls / fn-ptr-table entries on the module's own function starts; controls 7/7), NOT from the byte check — two negative controls showed the first build is base-lenient (fine offsets) and only catches gross errors. Two tool refinements en route (combined STRONG rule; outward-explained vote bases). The 100% claim loses its last asterisk once the new stubs are banked or ledgered (T2c/T3).
- 2026-09-05 — **T1b + T1c DONE (R22 213/213 rc 0 for the batch) · T2a DONE.** Both banks were ZERO-token: T1b's body came from `family_remap` of the d=2 twin (+ four TU spellings), T1c's from a stored S72 body the census had mis-keyed (R48) — the journals (R38) named both. Census 21 → **18 stubs** (resident 1 · main 12 · md_MAIN_003 1 · ov_SC03_105 2 · ov_SC06_022 1 · ov_SC07_002 1). T2a's instrument gives every parked payload a bounded probe list; two are STRONG.
- 2026-09-05 — **T1a DONE — `resident:func_800D128C` BANKED (243 ins, byte-identical 8e17e02f, R22 213/213).** The stored S71 closeness-0 draft was byte-correct all along; the whole task was three instrument defects the resident (the fleet's one `common.h`-only, `--pre`-sandwich binary) exposed in overlay-only assumptions: (1) `jr_isolate_all` dropped a file-local typedef whose name engine_types.h also defines (§496 — fixed: provided types derived from the TU's own includes); (2) `jtbl_carve` regenerated `JTBL_INTERLEAVE` without the `--pre hdr.rodata.o` clause → extract refused → the gate linked a stale script and booked the byte-correct draft as DIFF; `harvest_verify` ignored that extract's rc (§498 — both fixed, R49/R61); (3) `interleave_check` read a `--pre` line as n=0 (false DRIFT; fixed). R38 then found two more stored MATCH bodies for T1b/T1c (see their rows). Effort stayed Max.
- 2026-09-05 — **T0 DONE.** Baseline reads all green (`.run/P32/t0_baseline.log`): `verbatim_check --strict` 5 bodies == 5 rows; `exclude_audit --assert-fresh` 8 entries, 8 WALL, 0 stale; `frontier_classify` → 21 rows = the S80 census exactly; `make tools-health` OK (sigs fresh, corpus(+resident), cdecl, audit-binaries 213/213, report lint+dedup, cookbook-index, split_indicator 213 OK); `make check-all` 213 passed / 0 failed, rc 0. Harness task list #1–#11 built (R28). NEXT = T1a.

## 🛑 SESSION CHECKPOINT — T4c COMPLETE: THE FRONTIER IS EMPTY (0 stubs); NEXT = record the R22/report chain, then T5 the PhaseEnd (2026-09-06 ~19:30 MDT; written by session 3a7e207c "S85" at Drew's 90%-context pause; SUPERSEDES every earlier block)

### 0. How to use this block
You are a FRESH SESSION that has read `PROJECT_CONTEXT.md`, `phase-ends/DIGEST.md`, `PhaseEnd_Phase29/30/31.md` and this file, and
nothing else (CLAUDE.md protocol, R64 candidate). Replay this block verbatim, state phase / done / NEXT / effort, list the rules from
the digest, then WAIT for Drew. **NEXT = (1) read the background chain's logs (§3 step 0) and write their numbers into this file
(the T4c close), commit; (2) T5 — the PhaseEnd, a Tier 1 task at effort Max (R7/R27: prompt `/effort max` and WAIT), which has
TWO waits: present the milestone demo and WAIT for gate 2; only then write `PhaseEnd_Phase32.md`, append the digest, archive this
file, HARD STOP (P8).** No Agent tool, no Workflow, no drafting — there is nothing left to draft.

### 1. Where we are
**Phase 32 — the last 21 + the parked 5 — extended by Drew's T4b directive (every function that is not original hand-asm or a
PsyQ object must be cracked and banked before the phase closes) and closed out by T4c (Drew, 2026-09-06: "let's crack these
before closing the phase").** Gate 1 approved 2026-09-05; R44–R63 ratified then; R64 candidate (ratify at this PhaseEnd). Tasks:
**T0 ✓ T1a ✓ T1b ✓ T1c ✓ T2a–c ✓ (T2d not needed) T3 ✓ T4 ✓ T4b ✓ T4c ✓ · T5 pending.** (The parent `T2` checkbox in the task
list is still `[ ]` although its four sub-items are `[x]` — tick it when archiving.) Harness tasks this session: #1 row (d) done ·
#2 T4b close done · #3 T5 in progress · #4 T4c done.
**The census is EMPTY: `.run/P32/frontier_t4c_final.json` → 0 stubs / 0 instructions.** Every game-code function of all 218
binaries is C; the 5 PERMANENT verbatim `__asm__` bodies (`config/verbatim_manifest.json`, `verbatim_check --strict` 5 == 5) and
main's 1,256 LINKED PsyQ objects are the only non-C code. `config/wave_exclude.txt`: **0 entries**. `docs/backlog.md`: 1 open row —
`func_80062144` "won't compile standalone", a stale pre-atlas ledger row, NOT a stub (say so in the PhaseEnd). `twin_rescan`
0 open. Banks this session (all `gate_main` "BANKED … 143dbb89f34491258bbc27810d0a12ec8b43a8dd BYTE-IDENTICAL" / `bank.sh` sha ==
config): `ov_SC03_105:func_80185810` `cdd9a2cb8` · `main:func_80032A74` `f9a90affb` · `main:func_80039308` `ffb1949a1`. Main:
REAL 789 · LINKED 1,256 · VERBATIM 3 · **stubs 0** (was 2,089 / 2,091 = 99.90% byte-identical at the T4b close; now 2,091 / 2,091).
**Last fleet R22 (after the row (d) bank, BEFORE the two main banks): 217+main extracted, 218 passed / 0 failed, exits 0/0/0 at
13:21:49 MDT** (`.run/P32/t4d/r22_*.log`); the two main banks were each verified by `gate_main`'s clean main rebuild. **A fleet
R22 + `make report` + `make report BINARY=main` + `make tools-health` chain was launched in the background at ~19:20 MDT and is
NOT yet recorded** — logs in `.run/P32/t4e/`: `r22_clean.log`, `r22_extract.log`, `r22_check.log` (expect "218 passed, 0 failed of
218" + EXIT=0), `report_close.log` (expect INCLUDE_ASM 0, instr 13,488,497 / 13,488,497 = 100.0%, distinct 100.0%, fn-count 100.00%),
`report_main_close.log` (expect REAL 789 · LINKED 1,256 · VERBATIM 3 · stubs 0 · 2,091 / 2,091 · sha 143dbb89…), `tools_health.log`
(expect OK). If any log is missing or red, re-run that step yourself (`make check-all` is ~2 min; the reports ~10 min). Non-ghidra
tree clean at HEAD after this session's commits; the `ghidra/` churn is R23 restart-noise — never stage it. Claude commits, Drew
pushes (R6; ~113 unpushed).

### 2. What S85 did (session 3a7e207c, 2026-09-06, Max, Fable 5.1, no agents; commits `cdd9a2cb8` `0ab474ed5` `fe2f34b9f` `f9a90affb` `ffb1949a1` + the harvest commit)
* Row (d) `ov_SC03_105:func_80185810` BANKED by porting the banked cousin `ov_SC02_027:func_80180B3C`'s spelling (§501-P; the
  atlas had scored it 0.55) with zero pins; T4b closed (fleet R22 218/218, reports, tools-health, checkpoint `fe2f34b9f`).
* T4c (Drew's directive): `func_80032A74` (the "PROVED wall") banked on the first probe once the missing frame-slot producer was
  found — combine.c:2306 skips the ref decrement for a deleted self-update, so `gx = <load>; gx -= 0x100; (u8)gx` leaves a ghost
  pseudo that reload slots (§501-Q; 18 reproducers in `.run/P32/t4e/ghost/`). `func_80039308` banked with ZERO pins after 56
  measured variants: the ghost chain (frame), the s17/s18 variable reuse (else head), and the hoisted base as three inline
  `(b2 * 0x100)` temps merged by loop.c's `combine_movables` with `u16 vol` keeping cse off the copy (§501-R; the loop.c/cse.c/
  global.c rules are quoted there with line numbers).
* Instruments: `tools/cc1_dumps_tu.sh` (real-TU pass dumps from an `rtu_match --work` dir — the standalone `cc1_dumps.sh`
  compile is NOT faithful on main TUs), `tools/alloc_table.py` (global allocation order/priorities from the dumps),
  `tools/cc1_dumps.sh -dL`; SETUP rows (R21). Harvest: cookbook §501-P/Q/R (index OK), accelerators (14)(15)(16), decision-log
  P32 S85 ×2, `.run/P32/t4d/NOTES.md`, `.run/P32/t4e/NOTES.md`, `.gitignore` allowlists for `.run/P32/t4d/` and `.run/P32/t4e/`.

### 3. NEXT — in order
0. **Preflight + the T4c close:** `git status --short | grep -v ghidra/` (empty) · `verbatim_check --strict` (5 == 5) · read the six
   logs in §1 and copy their result lines into this file's Log (a "T4c close" entry: the R22 line with exit codes and time, the
   three `make report` metrics, main's REAL/LINKED/VERBATIM/stubs/sha, tools-health OK) · `git add phase-ends/CURRENT_PHASE.md
   .run/P32/t4e/*.log docs/progress.fleet.md .run/backlog.jsonl` (whatever the reports regenerated) · commit "docs(phase-32): T4c
   close — …" · harness task #4 already done. If the chain had not finished (an `EXIT=` line missing), wait for it or re-run the
   missing step; never write a number you did not read from a log (R14/R58).
1. **T5 (Max, Tier 1 — prompt R27; WAIT for gate 2):** P7 walk (T0–T4c; tick the parent T2 box) → the milestone demo as observable
   proofs (P9): the fleet R22 line (218/218, exits) · `make tools-health` OK · `verbatim_check --strict` 5 == 5 · the census 0 / 0 ·
   the wall ledger — EMPTY (state that the milestone's "FINAL verdict" clause was not needed: every row banked) · `make audit-disc`
   (residue 0, UNCLAIMED 0 of 220 at the T4b close — re-run) · `exclude_audit --assert-fresh config/wave_exclude.txt` (0 entries)
   · `make report` ×3 metrics + main `143dbb89…` (the WITH/WITHOUT-SDK-object-dirs dual was proven S79; re-run `make report
   BINARY=main` only unless Drew asks for the dual) · the denominators (main game-code: the digest prints 41,534; the corrected
   denominator is 41,556, the 22-ins Ghidra-boundary gap; at 0 stubs both read 100%). Then **"🟡 PhaseEnd creation is a Tier 1
   task. Confirm when ready." → WAIT for gate 2.**
2. On confirmation: **`phase-ends/PhaseEnd_Phase32.md`** (the PROJECT_CONTEXT format, every section): Build Log (the five onboarded
   modules T2b; the banks by commit — T1a `c513e1fbb`, T1b `c7f5b498a`, T1c `059266afc`, T2c ×20, T3 ×39, T4b ×11 (S83) + `8fa12bc22`
   + `cdd9a2cb8` (S84/S85), T4c `f9a90affb` `ffb1949a1`; tools: `payload_base_evidence.py`, `ghost_census.py`, `agent_drafts_restore.py`,
   `cc1_dumps.sh` repair + `-dL`, `cc1_dumps_tu.sh`, `alloc_table.py`, `bank.sh`; verification results verbatim from the logs;
   milestone achieved: **0 stubs across 218 binaries, every remaining non-C byte is a PsyQ object or one of the 5 PERMANENT hand-asm
   bodies**; Next = P33 verify + public flip) · **Deviations** (the T4b directive superseding the kill gate; T4c added by Drew after
   the T4b close; T2d not needed; the Opus pass banking 39 not 1–4; Fable used for the T4b first pass; two "final verdicts"
   (PROVED/PLATEAU) overturned by new producer knowledge — say so plainly) · **Commit Message** for Drew's milestone-close commit ·
   **Rules Added** — **R64 to RATIFY** + candidates: (i) a wall verdict is pass-attributed with a dump line; (ii) write "banked" only
   from the tool's printed success line; (iii) agents write deliverables early; (iv) a helper refuses an empty work list; (v) a
   residual gets a PRODUCER CENSUS before a spelling sweep and "PROVED" names the list it was proved against (S85: two PROVED/
   PLATEAU verdicts fell to producers missing from the list — §501-Q/R); (vi) a ledger's tie-break is part of the instrument; (vii)
   port a banked sibling's SPELLING before any dial (§501-N/P); (viii) a similarity score is not a shape oracle — grep the idiom's
   constants (§501-P); (ix) S85: build the 1-second reproducer battery for a mechanism BEFORE probing the 500-instruction function
   (accelerators (15)/(16)) · **PhaseEnd Changelog** v1.30.0 → v1.31.0 · **Roadmap delta** (P32 fully consumed; the frontier is
   empty; P33 = verify + public flip per roadmap v2 §3 P33, ≈2–4 sessions; the flip-timing checkpoint) · **believed / failed /
   sooner** (the walls were our censuses; every pin came off) · **Plain-English Recap** (R18/R25) · 🛑. Then **`phase-ends/DIGEST.md`
   §0 (state), §2 (the P32 synopsis), §3 (R64 ratified + accepted candidates)** — step 3b · `git mv phase-ends/CURRENT_PHASE.md
   phase-ends/logs/Phase32.md` (R19) · R23 (the SessionStart hook's headless Ghidra MCP: stop it cleanly if a stop script exists;
   no RE writes this phase → never stage `ghidra/`) · leave the PhaseEnd + the archived log UNCOMMITTED for Drew (R6) → "PhaseEnd
   file created. Commit the file and start a new Claude Code session for the next phase." → **HARD STOP (P8)**.

### 4. Files, tools, exact invocations, gotchas
- **`.run/P32/t4e/`** (S85, tracked): `NOTES.md` (the whole T4c route), `a1_ghost_unk07.c`, `b1…b56*.c` + `rtu_*.log`, `bank/func_80032A74.c`
  + `bank/func_80039308.c` (the banked bodies), `slate_*.json`, `gate_main_*.log`, `ghost/{g,h,k,r,s}*.c` (the reproducers),
  the chain logs; ignored: `rtu/`, `dumps_*/`. **`.run/P32/t4d/`** (row (d)), `t4c/`, `t4b/`, `t5x/`, `t3s3/` (`bank.sh`), `t3/`, `t4/`.
- **Instruments:** `tools/rtu_match.py <fn> --split <sub> --tu src/<sub>.c --asm-subdir asm/nonmatchings/<sub> --c <draft> --work <dir>`
  (main) · `tools/gate_main.py <slate.json> --apply` (main banks; slate = `[{"fn":…,"draft":<abs path>}]`; prints the BANKED line —
  "banked" is written ONLY from it) · `.run/P32/t3s3/bank.sh` (overlays) · `tools/cc1_dumps_tu.sh <rtu work dir> <tag>` +
  `tools/alloc_table.py <tag> [fn] [root]` · `tools/cc1_dumps.sh <draft> <tag>` + `tools/ghost_census.py` · `tools/twin_rescan.py` ·
  `tools/verbatim_check.py --strict` · `tools/frontier_classify.py --json <out>` · `tools/exclude_audit.py [--write OUT] [--assert-fresh]
  config/wave_exclude.txt` · `tools/backlog.py render`.
- **Gotchas (live):** `make clean` deletes `asm/` — never run rtu_match/twin_rescan/frontier_classify while an R22 chain runs · `gate_main`
  rewrites main's `asm/` too · the standalone `cc1_dumps.sh` is not faithful on main TUs (use `cc1_dumps_tu.sh`) · the cookbook index
  does not index bold `§501-x` sub-entries (`--check` still passes) · a `u16` local can be a HImode pseudo in these TUs (not promoted)
  — that is the §501-R firewall · `.run/P32/**` allowlists are per-subdir · backticks inside a double-quoted `--where` are command
  substitution · `grep "\$t2\b"` anchors on `$` — use `'[$]t2[^0-9]'`.

### 5. Environment
Fleet 218; shas: main `143dbb89f34491258bbc27810d0a12ec8b43a8dd` · ov_SC03_105 `d305ff6da199b52d0d44023766643a8b661ed524`
(`config/check.<b>.sha` is authoritative). Toolchain unchanged (SETUP §5.4). The SessionStart hook launches a headless Ghidra MCP
(`.run/ghidra-mcp.log`); nothing in T5 uses it (R23). Claude commits, Drew pushes.

### 6. Standing reminders
Every bank commits before the next command that can touch `src/` (R42) · quote the fleet's green count at every close (R58) · verify a
build from its exit code (R53) · a masked/permuter score is not a closeness until its diff is read (R63) · an `__asm__` body that
reproduces instructions is a verbatim, not a bank (R62) · port a banked sibling before dialing (§501-N/P) · census the PRODUCERS
(§501-M/O/Q) and read the allocation ORDER (§501-R) before any spelling or pin · write "banked" only from the tool's printed success
line · rules check every 4 tasks (P6) · harvest before the next step (R16/R30) · no `Co-Authored-By` (R5) · never stage `ghidra/`
(R23) · the PhaseEnd + archived log stay uncommitted for Drew (R6).

**Plain-English recap (R18).** This session finished the game's code: the last overlay function fell to a cousin's wording, and
the last two main-program functions — one "proved" impossible and one stuck at four instructions for weeks — fell once two missing
compiler behaviours were found and reproduced in five-line test programs: a bookkeeping gap that leaves an unused stack slot, and
the exact source shape (an expression written three times, and a 16-bit accumulator) that makes the 1995 compiler hoist a value
into the right register. Every register trick the earlier drafts carried turned out to be unnecessary. Not a single hand-translated
function remains untranslated; what is left is the fleet-wide verification (already running in the background) and the phase's
closing report, which needs Drew's sign-off.