# CURRENT_PHASE — Phase 35: Gen3 opens — the dedup phase, "one source per unique function" (v2.0.0 → v2.1.0)

> **Gate 1 approved 2026-09-08 (Drew, plan mode, Max, Fable 5.1; session S94).** Rules **R96–R99 ratified at gate 1** (the Phase-34
> candidates (a)–(d); binding; full text in `phase-ends/DIGEST.md` §3). The approved plan is reproduced VERBATIM at the end of this file
> (§"Approved plan") — its `~/.claude/plans/` copy is not part of the repo. **Gen3 order (Drew, S94): dedup → pins → structs → names,
> one phase each, planned one at a time; this phase is dedup only.** Gen3's charter: `docs/gen3-handoff.md` + `docs/gen3-standards.md`.
> **Baseline HEAD at open: `48170fd7f`** (Drew's Phase-34 CLOSE commit = v2.0.0; tree clean; `origin/main == main`).
> **Build inputs change in this phase (every shared body moves): R22 is owed after every batch that touches `src/`** — the clean fleet run
> `make clean && make extract-all JOBS=16 && make check-all JOBS=16` → `check-all: 218 passed, 0 failed of 218`, read by exit code (R97).
> **The 2026-09-02 "leave the dedup backlog" decision is REVERSED at this gate** on evidence read from sotn-decomp's tree (X2): sotn shares
> stage code once as plain C in `src/st/<name>.h`, instantiated per stage by a `.c` stub that `#include`s it; it does not write duplicates.

## Milestone (gate 2 — what Drew confirms, each with its literal output)
1. `git grep -c '^#define DEFINE_func_' -- src` empty; no `DEFINE_func_X()` site; `src/shared/engine_core.h` absent; every registered body a
   plain-C header under `src/shared/<space>/`.
2. `tools/share_census.py --check` exit 0: same-vram duplicate copies 0 (or each ledgered with a reason in `config/dedup_exceptions.tsv`); the
   five twin overlays built from one source directory each; cross-vram classes published as a deferred count.
3. `make tools-health` OK with the S1 invariant strict and the macro-form guard; every consumer updated, frozen or retired per its dictionary row.
4. `make clean && make extract-all && make check-all` → `218 passed, 0 failed of 218` (R22).
5. README/wiki/kit regenerated (R75), decision log (R31), SETUP rows (R21), `PhaseEnd_Phase35.md` + DIGEST written; v2.1.0.

## Effort / model (R7/R26/R27 — every transition is PROMPTED, never assumed)
- **Max** for T0's probe, T1, T2's design, T3's probe pair, T4's and T5's tool, T9 (Tier 1 — prompt Drew before starting the close);
  **xHigh** for the mechanical runs (T3's other pairs, T4's batches, T5's batches, T6, T7, T8); **Low** for T0's bookkeeping.
  Max is session-only — ask Drew to re-apply `/effort max` at each session start. **No Ultracode anywhere** (nothing is agent-breadth; the
  parallelism is machine parallelism: L0 at JOBS=16 ≈ 13 min fleet-wide, the clean fleet run 3–5 min).
- **Drew-only (R6):** every `git push`; the gate-2 confirmation; the close commit + tag. Claude commits per task (R42 for banks: the moment a
  batch is green, before the next command that can touch `src/`).

## Tasks (plan order; one commit each; ☐ → ☑ with the verify line quoted in the log)
- ☑ **T0** — Open + ground (S94): this file; DIGEST §0/§3 (R96–R99); `.gitignore` `.run/P35/`; the R22 baseline from clean
  `check-all: 218 passed, 0 failed of 218` in **157 s wall**; `make tools-health` **OK** (exit 0, 474 s — after two red runs fixed at
  their cause: the kit's record copies regenerated by `make kit-corpus`, and R96–R99 dispositioned in `config/kit_coverage_map.tsv`);
  the probe on ov_SC06_033: **34/34 objects byte-identical** in the include form, the binary `BYTE-IDENTICAL` both ways, build 1.12 s →
  0.52 s wall (CPU 12.7 s → 5.7 s), warnings 801 → 663 (all 137 macro-redefinition warnings gone), `.d` 11.6 KB → 182 KB
  (`.run/P35/probe/probe_ledger.txt`).
- ☑ **T1** (S94) — `tools/share_census.py` + `config/dedup_exceptions.tsv`: `selftest: 7/7 verdicts correct`; `362,389 sig instances ·
  362,389 classified · 0 UNACCOUNTED · 10,180 h_exact classes`; the four controls as measured (see the log); SETUP + dictionary rows.
- ☑ **T2** (S94) — the health chain learns the header + twin forms while the macro form still builds (16 tools; the source-dir
  oracle; `share_census.header_defs` the one reader). Negative control on the unchanged tree: the chain's substantive rungs
  green (audit-binaries OK · dedup-check 2220/0 · cdecl · report + `progress.py --check` fresh · doc_links · wiki_render · kit_lint ·
  cookbook-index · gccmap_cites · ghidra_roster), one red rung — the kit's verbatim copies of the edited tools — fixed by
  `make kit-corpus` (17 copies) with the rungs after it re-run individually by exit code. The +7 count correction published.
- ☑ **T3** (S94) — twin binaries → one source directory: the five pairs collapsed (probe SC01_005/006 with the race test; SC03_118/119 +
  SC02_000/003 equal carves; SC04_018/019 + SC03_014/015 with the primary's carve, interleave + pads regenerated, R60 checks), each
  twin and primary BYTE-IDENTICAL, 166 source files deleted; the census: same-vram backlog 4,667 → 1,099 classes; the clean fleet
  run after the last pair (see the log).
- ☑ **T4** (S94) — `tools/macro_to_header.py`: 246,347 sites in 3,818 TUs → 2,215 per-function headers under `src/shared/<space>/`
  (213/213 binaries and 4,121/4,121 objects byte-identical), the legacy headers converted (clearTbl40 = the parameterized control),
  the whale moved, 7 alias bodies bound, the registry text-edited, `engine_core.h` deleted; `--verify OK`; R22 `check-all: 218
  passed, 0 failed of 218` in 145 s.
- ☑ **T5** (S94–S96) — `tools/share_body.py` (+ `--repair-registry`, `--reexemplar`, `share_body_cycle.sh`): bucket 0 183 classes → 135 shared / 48 ledgered; bucket `new` 915 → 914 shared / 3 ledgered; S1 10,180/10,180 satisfied, 0 violations; registry 2,220 → 3,135 groups; same-vram backlog 1,099 → 51 classes (= the ledger); R22 218/218. Recovery history (S94 died mid-task): `tools/share_body.py`
  built + probed (commit `0bccef901`); bucket 0 (`--bucket extend`, the registered-incomplete classes: 183 at the start) run twice —
  the first pass committed (`571374b97`: 788 members added to the registry, 141/141 + 146/146 binaries green per binary), the second
  run finished after the session died and its output (170 sites → include in 38 TUs of 8 overlays, 55 TU-CONFLICT ledger rows) is
  UNCOMMITTED on disk. Residue: 55 classes / 325 (class, binary) pairs stay private, 317 of them still LISTED as registry members
  (the first pass extended wholesale); three tool defects found by S95 (the cause extractor, the cross-batch edit loss, the ledger
  reason). NEXT inside T5: commit the run-2 bank → fix the tool → repair the registry → replay the suspect rejections → decide the
  E_func_80168B70 exemplar → bucket `new` (915 classes / 3,567 private sites) in bands, one batch per run, R22 after each.
  Plan text (unchanged): bucket 0 `--extend`, then the same-vram buckets largest reach first (no trivial exception); cross-vram
  classes untouched; `share_census --check` same-vram unregistered = 0 or ledgered.
- ☑ **T6** (S96) — consumers: **14** macro-era tools FROZEN (`tools/frozen.py`, main()-time refusal; the plan's 7 + 7 the guard census
  found), **4** retired to `tools/sunset/` (dedup_propagate, dedup_extend → share_body.py; macro_draft; test_reconcile_ledger), 12 live
  tools' dead macro branches dropped, the `ast` macro-form guard in `tool_census --check` (0 LIVE hits; the pre-T4 tree flags 15 —
  the negative control), `progress.py`'s empty-shared fold corrected (+459 denominator, REAL −10,211 → EMPTY), kit corpus, SETUP;
  `tools-health: OK`.
- ☑ **T7** (S96) — S1 strict (`--strict-macros --strict-text`) + `--selftest` in `make tools-health`; C2c/C2d in `dedup_integrate --check`;
  `progress.py` fields (105,007 bodies written once; 160 / 51 duplicate copies, all ledgered) + the dated corrections (+7, +459, REAL
  −10,211) + the README sentence; the gate negative-controlled in place (exit 1 naming the class; C2d naming the member); the second
  oracle's finding published: 380 texts deferred inside cross-address classes, 38 texts / 2,030 sites byte-variant — PENDING Drew.
- ☑ **T5b** (added S96, Claude's delegated decision; done S96 — 38 groups / 2,030 sites, 138/138 green, R22 218/218) — the text tier: registry `tier: h_text` (text hash; per-member `h_exact` in the
  verbose member form), `dedup_integrate` C1 per member; `share_census` text classes at one address (same text, ≥2 distinct TUs, outside
  the deferred/ledgered sets) → the S1 text half a violation, not PENDING; `share_body --bucket text` (header named by the text hash) over
  the 38 classes / 2,030 sites, gated per binary, one batch per run + R22; the two counts (deferred 380/1,668; text-tier shares) in the
  digest + README sentence. Effort: high (Drew's default).
- ☑ **T8** (S96; doc_links strict 0 broken, wiki 32/32, cookbook §453 + index, decision log, accelerators, DIGEST §4, the memory) — the record: wiki (4 pages), how-to ch.10, README:117, the charter rows as dated snapshots, the cookbook section, decision log
  (R31), accelerators, DIGEST §4, sunset rows, the memory rewritten; doc_links/wiki_render/cookbook_index/kit_coverage green.
- ☑ **T9** (S96, xHigh by Drew's choice) — close (Tier 1): R22 → 218/218; tools-health OK; the metrics table; the reviewer sequence; PhaseEnd + DIGEST + log archived; v2.1.0.
- Rules check (P6): after T3 and after T7.

## Decisions (owner's words, in order)
- S94 gate 1 (AskUserQuestion): twin binaries → "One source directory per payload"; cross-address classes → "Census + defer to the names
  phase"; the 62 macro-era tools → "Freeze with a loud refusal"; the four rule candidates → "Ratify all four as R96–R99".
- S94 (plan): no "trivial" exception — a duplicated 3-instruction accessor is still one function (this project already shares 5-instruction
  bodies).
- S94 (Drew, mid-planning): "we will need to update our tooling to be aware that we aren't duplicating funcs across overlays anymore and
  that there is only one source for a unique func" → the S1 invariant + the consumer tasks (T2, T6, T7).
- S95 (Drew, 2026-09-08 evening — the recovery session): "this is a recovery session. last session context filled up and didn't write a
  checkpoint … read last session since the last checkpoint and write an updated checkpoint"; "dont run anything like gates/builds, your
  job is only to capture the info from the session and create an updated checkpoint." → S95 ran no gate, build, census or tool; it read
  the S94 transcript (`~/.claude/projects/-home-musashi-bfm-decomp/e902c34e-e4b3-41a6-b1e4-7d2ef019a371.jsonl`), the two T5 commits,
  `.run/P35/share/` and the dirty tree, and wrote the log entries + the 🛑 block below.
- S96 (Drew, 2026-09-08, after the E_func_80168B70 question): "I am not sure the best answer to this question. I have toggled Max effort.
  now decide the best answer to the question. and then pause so I can switch back to high effort" → **Claude decided at Max: RE-EXEMPLAR
  the header from the majority text** (the tool's own exemplar rule; T4 inherited the 7 late overlays' minority text because the registry
  group had been created for them; the majority's cast-at-call form compiles under BOTH declaration environments, so 141/141 is expected
  with no TU edit, and 7 private copies would beat 134 if not). The offered alternative "fix the 7 TUs' declarations" was mis-stated —
  the header passes one argument, so the TU-side repair would be the 134 units + every other caller of func_80146C3C = Phase 37's
  canonical-declaration work; rejected. **Policy for the other 48 rejected classes:** their headers already carry the majority text and
  their causes are genuine declaration conflicts in the late overlays' units → they stay ledgered TU-CONFLICT with the real diagnostic
  until the types phase (R95); ≈190 private copies of ≈3,900 collapsible, inside the plan's 2–5 % budget (exact count at T5's close).
- S96 (Drew, after the T7 report): "Max effort set for this decision call. you review the information and decide what is best, make the
  decision, and then pause" → **Claude decided at Max: T5b NOW for the 38 byte-variant same-address texts (a text tier), DEFER the 380
  inside the cross-address classes.** The normalizer masks only the function's own name, so the 38 are the same C; their bytes differ per
  overlay because the ORIGINAL builds compiled that source under per-overlay declaration environments (our TUs carry that environment) —
  the types phase cannot collapse them and the names phase cannot remove them; the include-at-site form already fits (body in the header,
  declarations in the TU, bytes proven per binary) and only the registry's single-hash group blocks it. The 380 are identical bytes at
  thousands of addresses (empty bodies, tiny accessors): one header per address would be undone by the names phase's parameterized form —
  gate 1's deferral stands; both counts are published. A plan change (P5d) under Drew's delegation: **T5b inserted before T8.**

## Log (append-only; one entry per step, with the literal verify line)
- **S94 2026-09-08 — session start.** Load order read; Phase 34 closed at `48170fd7f`; no CURRENT_PHASE.md → new phase. Drew: order
  dedup → pins → structs → names; plan mode at Max. Exploration (two Explore agents, one Plan agent, ~680k agent tokens) + this
  session's own measurements; sotn's sharing model verified from its tree (`src/st/e_red_door.h` + the ~90-byte per-stage stubs).
- **S94 — T0 in progress.** DIGEST §0 (the opening paragraph) + §3 (R96–R99 in full) written; `.gitignore` `.run/P35/` allowlist added;
  the R22 baseline from clean launched in the background (`.run/P35/baseline/r22_open.log`, `/usr/bin/time` wall clock recorded);
  the harness task list built (10 tasks, R28).
- **S94 — T0 baseline.** `.run/P35/baseline/r22_open.log`: `extract-all: 217 extracted, 0 failed of 217 (+ main, serial)` ·
  `check-all: 218 passed, 0 failed of 218` · `wall=157.09 s user=2231.42 s sys=542.99 s` · `exit=0`. The fleet's build-time baseline
  for the phase (the 8.8 MB header is preprocessed by every overlay TU today).
- **S94 — T0 tools-health, run 1 RED (464 s):** `tool_census --check: FAIL` — 2 GAPs, both "corpus copy differs from its source"
  (`decomp-architect/corpus/record/phase-ends/DIGEST.md`, `…/PhaseEnd_Phase34.md`). Cause: the gate-1 DIGEST edit (and a pre-existing
  drift of the P34 record copy behind Drew's close commit); the instrument was right (R40). Fix: `make kit-corpus` (360 copies + 28
  pointers materialised) → `tool_census --check: OK` (`.run/P35/baseline/kit_corpus_open.log`, `tool_census_open.log`).
- **S94 — T0 probe** (`.run/P35/probe/probe_convert.py`, in-tree then restored by `git checkout -- src/ov_SC06_033`): `engine_core.h: 5147
  define lines, 3516 distinct, 1631 defined twice` · `ov_SC06_033: 34 TUs, 1813 sites, 1813 distinct shared bodies` · `applied: 1813
  headers under src/shared/ov, prelude written, 34 TUs rewritten` · A rebuild (macro form) `wall=1.12 s user=12.72 s`, 801 warnings
  (137 "redefined") · B build (include form) `wall=0.52 s user=5.70 s`, 663 warnings (5 "redefined" — none of them `DEFINE_func_`) ·
  `sha1 1e91d46e… == config/check.ov_SC06_033.sha (BYTE-IDENTICAL)` both ways · **`obj A/B: 34/34 byte-identical, 0 differing`** ·
  `.d` bytes 11,632 → 182,252 (1,813 header dependencies; harmless) · restore verified (`git status` shows only T0's files). The L0
  object oracle is proven on a whole overlay; the plan's D6/L0 stands.
- **S94 — T0 tools-health, run 2 RED (460 s):** `kit_coverage: FAIL (4 gap(s))` — `rule R96…R99 is neither cited by a registry provenance
  line nor dispositioned in config/kit_coverage_map.tsv` (R92, the same class P34 hit at its close). Fix: four map rows — R96/R98/R99 →
  DK-81 (its facts 4/1/2 ARE those rules), R97 → G29 (provenance R49 + R53). `kit_coverage: OK`; the rungs after it (xsig 8 OK,
  work_evidence selftest OK, split_indicator SELF-TEST PASS + 218 OK) individually green.
- **S94 — T0 tools-health, run 3 GREEN:** `tools-health: OK — sigs fresh; corpus(+resident) + cdecl + binaries + report(lint+dedup) +
  cookbook-index all green.` `exit=0`, `wall=474.23 s` (`.run/P35/baseline/tools_health_open3.log`). `docs/story-timeline.md/.svg`
  regenerated by the chain (74 rows; the v2.0.0 tag row). **T0 ☑.**
- **S94 — T1 `tools/share_census.py` + `config/dedup_exceptions.tsv`.** Built as designed (one pass per TU with comments, dead
  `#if 0`/`NON_MATCHING` halves and macro-continuation text masked; forms macro / macro-param / include / param-include / def / stub /
  asm-verbatim; addresses from each binary's symbol stack, never names; the fleet, the source dirs, the contracts (`<alias>_CHECK_SHA`,
  main = `check.us.sha`), the address spaces (`_VRAM_BASE`) and the twin sets derived from the Makefile and the contracts; classes
  through `dedup_integrate.group_members`). Five scanner defects found by its own self-test and coverage line, each fixed at the cause:
  string contents were blanked before include paths and asm labels were read; K&R definitions (a blank tail after the last `;`,
  and the one-line `void f(a, b) void *a; s16 b; {` form); a second definition head on the same line after an `extern …;`; the
  alias regex spanning a previous macro site's parentheses; `asm(` as well as `__asm__(`; implicit-return-type heads with no type
  line; `static inline` helpers (no address) excluded from the unresolved list. **Result: `--selftest` → `selftest: 7/7 verdicts
  correct`; the census → `218 binaries · 362,389 sig instances · 362,389 classified · 0 UNACCOUNTED · 10,180 h_exact classes with >=2
  instances`; verdicts A 1,712 · B 282 · C 6,107 · D 1,861 · M 218 (instances 214,478 / 45,226 / 14,839 / 5,796 / 462); flags ALIAS 44 ·
  E 3,826 · F 54 · PINS 687 · TWIN-PENDING 3,748 · TYPEDEF 96; SAME-VRAM UNREGISTERED 4,667 classes · 35,976 instances · 11,767 private
  copies · 31,309 collapsible · 1,710,469 ins (twin-pending 3,568 classes / 7,136 instances); CROSS-ADDRESS/SPACE deferred 3,801 classes ·
  30,347 instances · 12,938 private copies; macro sites 255,947; duplicate-text classes 6,845 (23,269 sites); 43 s uncached, 41 s cached
  (the cache is not the cost — profile at T7); exit 0.** Controls (R39): `func_80144B9C` = B/141/{'include': 141}/missing 7 (the registry
  lists 134 — never extended to the 7 later overlays; T5 bucket 0), `clearTbl40` = A+E/2, the three setters = B/282(E), B/145(E), B/141
  (the same 2-instruction bodies also sit at other vrams), twin symmetry SC01_005/006 = 653/653. **Instrument findings for the record:**
  the B class is 282 registered-but-incomplete groups (204 never extended, 74 with a private-copy site — demacroized escapes —, 2 with a
  member the sigs do not show); a 2-instruction empty-body class (`jr ra; nop`) has 11,852 instances across every space (E,F → deferred
  with the cross-address set; the names phase decides how an empty function is written). Outputs `.run/P35/census/{share_census.json,
  share_census.txt, coverage_notes.txt}` (tracked), `classes.jsonl` + `cache/` (ignored). SETUP + dictionary rows (R21/R87). **T1 ☑.**
- **S94 — T1 slip, named (R97/R66):** commit `1dbffee87` says "kit corpus regenerated" while `make kit-corpus` had exited 2 and
  `tool_census --check` had refused the new row (`phase=P35` — the column is the KIT LADDER phase, P1–P10, not the project phase);
  the chain had `&&` on an echo, not on the checks. Fixed in `72a77e7d3` (row → P10, the readability tools' rung; corpus 361 copies;
  `tool_census --check: OK`; `kit_coverage: OK`), chained on the checks' own exit codes; `docs/tool-index.md` (generated) committed after.
- **S94 — T2 the health chain learns the header + twin forms (both forms accepted).** ONE source-dir oracle: `corpus.src_dirs()` /
  `src_dir()` / `twin_of()` from `<alias>_SRC_DIR` / `<alias>_TWIN_OF` in the Makefile and `config/*.mk`; `corpus.src_files` and
  `o0_subseg` go through it; `compile_only.src_dirs` delegates to it; `progress.set_binary` takes its dir from it (the table's `src`
  is only a cross-check); `dedup_integrate._src_paths` uses `corpus.src_files`. The include form: `share_census.header_defs()` is the
  one reader (`[(name, empty)]`, masked — a macro-only header defines nothing); `progress.classify` counts an include site as the
  function's definition (REAL/EMPTY by the header body) with the `#define SHARED_FN` / `#undef` state for the parameterized form, and
  the dedup fold keeps included members in the shared count (`(members − real − stubs) ∪ (included ∩ members)` → the README's
  255,632 unchanged); `overlay_src_split` gains the `include` item kind (anchor by the header's defined name, `#undef SHARED_FN`
  travels with the item; `split_header` no longer swallows a leading body include; `macro_externs`/`macro_proto` read the header's
  parts; a macro invocation with no table entry is a loud refusal, R43) and `jr_isolate_all` admits the kind; `dedup_integrate`
  C2a′ requires a plain-C source to DEFINE `func`; `audit_binaries` accepts `engine_prelude.h`, resolves the main TU through the
  oracle, and gains CHECK 3b (twin citizenship: primary onboarded and not a twin, same src dir, no `src/<twin>/`, equal contracts,
  equal carves); `cdecl.audit_differential` reports "not applicable" when the macro header is gone instead of crashing;
  `lint_symbol_refs` / `family_remap` / `fix_arity_callers` glob `src/shared/**/*.h`; `blocker_probe.macro_scope` and
  `demacroize.macro_bodies` tolerate the header's absence; `shared_lock` docstring; `harvest_verify` comment.
  **Verify:** `py_compile` 16 tools OK; `share_census --selftest` 7/7; `audit-binaries: OK`; `dedup-check: 2220 validated, 0 failed`;
  the split tool on `src/ov_SC06_033/ov_SC06_033_o0b.c` (a real include-form TU) → the whale's include is an item.
  **A count correction surfaced (R14):** `FLEET matchable 363,214 → 363,221` — the 7 overlays whose `_o0b.c` includes the whale
  header but were never registry members (`ov_MAIN_012`, `ov_SC02_037`, `ov_SC03_107`, `ov_SC07_006/007/010/011`) were counted by
  NEITHER classify (include lines skipped) NOR the registry fold; the source now decides (ov_MAIN_012: matchable 2,401 → 2,402, the
  known row). `docs/progress.json` + the README block regenerated by `make report BINARY=main` (`progress.py --check: … fresh`);
  the generated timeline follows the COMMITTED digest, so it is regenerated after the commit that carries the new digest.
- **S94 — T2 close.** The chain's only red rung was the kit's verbatim copies of the 16 edited tools (`tool_census --check` 17 gaps) —
  `make kit-corpus` belongs in EVERY commit that edits a tool; the rungs after it re-run individually by exit code; the chain also
  regenerates the timeline's commits-per-day cell (it moves with every commit — committed with each task). Commits `6cb056c93`
  (the tools + the +7 numbers), `4ec752e68` (the timeline), `24e8ff72d` (the close). **T2 ☑.**
- **S94 — T3 probe pair SC01_005/006 (Max).** The mechanism: `config/overlays.mk` `ov_SC01_006_TWIN_OF := ov_SC01_005` +
  `ov_SC01_006_SRC_DIR := src/ov_SC01_005`; the Makefile's twin block (static pattern rules `build/src/<twin>/<twin>%.o ←
  src/<primary>/<primary>%.c` + the bare-name rule, the same recipe; `TWIN_O0_OBJS` keep `-O0`; the twin's own `OBJS`/`C_DEPS`);
  `config/splat.ov_SC01_006.yaml` `create_c_files: False` (src_path stays the twin's name → the .ld's 120 object paths under
  `build/src/ov_SC01_006/`); `git rm -r src/ov_SC01_006` (30 files). **Verify:** `make extract BINARY=ov_SC01_006` exit 0, no
  `src/ov_SC01_006/` recreated; `make check BINARY=ov_SC01_006 -j16` → `sha1 56760dbe… == config/check.ov_SC01_006.sha (BYTE-IDENTICAL)`
  (the CC lines read `(twin of ov_SC01_005: src/ov_SC01_005/…c)`); the primary still BYTE-IDENTICAL; **the race test** — both objects
  trees deleted, `make check` for 005 and 006 run CONCURRENTLY → both BYTE-IDENTICAL; consumers: `progress.py --binary ov_SC01_006`
  2503/2503 (of which dedup-shared 1838, unchanged), `dedup-check --binary ov_SC01_006` 1838 validated / 0 failed, `audit-binaries: OK`
  (CHECK 3b passes: primary onboarded, same dir, no src/<twin>, equal contracts, equal carves), `compile_only --list ov_SC01_006`
  → 30 TUs from `src/ov_SC01_005/` (2 at -O0). One instrument slip caught by the census's R32 gate: my Makefile variable
  `TWIN_SRC_DIR` matched the `_SRC_DIR` oracle regex as a binary named `TWIN` → renamed `TWIN_SRCDIR`; after it the census shows
  **TWIN-COVERED 575 classes** for the pair (twin-pending 3,748 → 3,173), twin symmetry 653/653 unchanged. The census's `copies` now
  counts DISTINCT private sites (a twin's instance resolves to its primary's TU — one source), `collapsible` = copies − 1.
  Commit `9b0816e74`.
- **S94 — T3 pairs 2–3 (equal carves, mechanical):** `ov_SC03_119` TWIN_OF `ov_SC03_118` (31 files removed; both `77ee78dd…`
  BYTE-IDENTICAL), `ov_SC02_003` TWIN_OF `ov_SC02_000` (37 files; both `5ece4bca…`); `audit-binaries: OK`; dedup-check per twin
  0 failed. Commit `e79cfcc06`.
- **S94 — T3 pairs 4–5 (carve alignment, R60):** the twin's yaml := the primary's with the alias and `FILE_nnn` substituted (+ the
  twin note + `create_c_files: False`), its `_JTBL_INTERLEAVE` := the primary's substituted — and, found by the first build's
  failure (`missing .end at end of assembly` on `ov_SC04_019_jr_8017AE2C.o`): the per-object **`JTBL_PADS` lines are keyed by
  OBJECT PATH** (`build/src/<twin>/…`), which my alias-normalized block diff (lines starting with the alias) never compared, so the
  twin still carried its retired carve's pads (4 differing lines for SC04, 2 for SC03; the three committed pairs re-checked: 0, 0, 0).
  Regenerated from the primaries by substitution → 0 differing. `pads_audit.py` built `src/<b>/<tu>.c` by hand and raised
  IndexError on a twin — now reads the source through the oracle (`corpus.src_dir` + `twin_of`). **Verify:** `ov_SC04_019` +
  `ov_SC04_018` BYTE-IDENTICAL (`fe9b413f…`), `ov_SC03_015` + `ov_SC03_014` (`d84b01a2…`); `interleave_check` ALIGNED (n=51, n=46);
  `pads_audit` ok on every carve object; dedup-check 0 failed; `audit-binaries: OK` (CHECK 3b incl. equal carves). Commits
  `2648aa5a9`, `6ebb3dac3`.
- **S94 — T3 census after the five collapses:** TWIN-COVERED 3,748 classes (3,580 non-A, 7,186 instances); **same-vram unregistered
  4,667 → 1,099 classes · 4,755 private sites · 3,658 collapsible · 28,840 instances** (twin-pending 0); `S1: … 10,180 classes, 9,081
  satisfied (3,580 twin-covered, 0 excepted, 3,801 deferred cross-address), 1,099 VIOLATION(S)` — the backlog T5 shares. The controls
  unchanged (twin symmetry 653/653). `make kit-corpus` for `pads_audit` + `share_census`; `tool_census --check: OK`.
- **S94 — Rules check (P6, after T3 = four tasks): re-read complete (CLAUDE.md's eight mandatory behaviours; PROJECT_CONTEXT's 23
  P/G/H/X rules). Continuing with T4.**
- **S94 — T3 close, R22:** `make clean && make extract-all JOBS=16 && make check-all JOBS=16` → `extract-all: 217 extracted, 0 failed of
  217 (+ main, serial)` · **`check-all: 218 passed, 0 failed of 218`** · `wall=308.78 s` (the census and the kit corpus ran beside it) ·
  `exit=0` (`.run/P35/baseline/r22_t3.log`). Twins: 5 pairs / 10 aliases / 166 source files deleted; every twin builds from
  its primary's directory. **T3 ☑.**
- **S94 — T4 `tools/macro_to_header.py` (Max) + the fleet conversion.** `--plan` on the post-twin tree: `engine_core.h: 5147 define lines,
  3516 distinct, 1631 twice (4 divergent asserted); 8 directives — the prelude is complete` · `sites 246,347 in 148 binaries · TUs
  including engine_core.h 3,818 · macros: shared 1,959 · single-site→header 257 · single-site→inline 0 · dead 1,300` · naming
  `{'suffixed': 86, 'plain': 1873}`. **`--apply` over all 213 non-twin binaries** (`.run/P35/convert/batch2.sh`: snapshot objects → one
  apply → per binary `make check` + every object compared): **213/213 BYTE-IDENTICAL, `objects byte-identical: 4121/4121`**, apply
  ledger `{"sites":246347,"tus":3818,"headers_written":2215,"dead":1300}`, 224 s wall (commit `c53a9e1a9`, 6,036 files). **`--finalize`:**
  the three legacy sites (`SETTER`/`RETCONST` ×3 in SC01_005 → `ov/func_8012AD64.h` etc.; `CLEAR_TBL40` ×2 in `src/800_c.c` → the
  `#define SHARED_FN` / `#include "shared/main/func_80037004.h"` / `#undef` form — the cross-address control), the whale moved to
  `ov/func_80144B9C.h` (guard removed) with every `-O0` includer rewritten, **7 alias-form bodies given their own binding** (`s32
  aF80131CA8(int a0) __asm__("func_80131CA8");` derived from the head; the K&R head gets the unprototyped form), the registry's 2,224
  `source:`/`func:` lines text-edited by id, the 3 non-shared headers that included a macro header rewritten (`src/800_shared.h`,
  two per-overlay `_shared.h`), `engine_core.h` + `ov_setters.h` + `clearTbl40.h` deleted; `--verify: OK — 0 macro sites, no macro
  header, the prelude present`. **Gates:** main `143dbb89…`, ov_SC01_005, ov_SC01_084, ov_SC02_005, ov_SC06_033, ov_SC02_027,
  ov_SC02_011, ov_SC02_026 and the 7 late whale includers all BYTE-IDENTICAL; `dedup-check: 2220 validated, 0 failed`;
  `audit-binaries: OK`; the census `362,389 classified · 0 UNACCOUNTED · macro sites 0`, verdicts A 1,712 · B 282 · C 6,640 · D 1,545 ·
  M 1, same-vram backlog 1,099 classes (unchanged — T4 shares nothing new); **R22: `check-all: 218 passed, 0 failed of 218`, wall
  145.10 s** (157 s at the open; user CPU 2,230 s vs 2,231 s — the per-overlay cpp saving the probe measured is small against extract,
  assemble and link fleet-wide). **Instrument findings, each caught by a gate and fixed at the cause:** (1) the first apply of "main"
  swapped the include line in all 3,818 TUs (main's dir is `src/`, a prefix test matched the fleet) — restored with `git checkout --
  src`, the test made exact; (2) the per-binary driver paid the 218-file sig load per binary (36 binaries > 10 min) → the batch form
  pays it once (224 s for 213); (3) five mid-file `match_one-only` includes with trailing comments and (4) seven whale includers in
  `_o0c.c`/`_o0d.c` (a `*_o0b.c` glob) were missed — the census's coverage line (7 unaccounted) and `--verify` found them; (5) `verify`
  listed 3 of N offenders (a `[:3]` slice) — it now lists every include LINE and ignores prose; (6) `.run/P35/convert/` was not
  allowlisted — added. `docs/SETUP.md` P35 T3–T4 section + the dictionary row (P10, PROJECT-ONLY). **T4 ☑.**
- **S94 — T5 `tools/share_body.py` (Max) + the R37 probe (commit `0bccef901`, 18:12 local).** Built as designed (411 lines): `census(jobs)` =
  `share_census.classify(…, keep_instances=True)` (the census now exports per-instance `line`/`end`/`nlines` and the class's `groups`; a
  census with unaccounted or multi-form instances is a refusal, R32); `candidates()` → `extend` = verdict-B classes (registered, some
  instance still a private `def`), `new` = unregistered same-vram classes with ≥1 private def — both skip A, E/F flags, TWIN-COVERED and
  EXCEPTED classes, sorted by (−instances, −nins); `choose_exemplar` = majority normalized text → pin-free → fewest lines (printed);
  `Batch.add_class` (B: the registry's header must define `func` or the class is refused; the extension list = instances not yet
  listed; new: header `func_<VRAM>[__h8].h` via `macro_to_header.Oracles.header_rel`, banner + `bind_alias_header`; every private site →
  `include_line(tu, hdr)` at `[line, end]`; every instance's binary is "touched", twins with their primary); `gate()` = `make check
  BINARY=<b> -j16` by exit code + every object compared with the pre-batch snapshot (`.run/P35/share/check_<b>.log`); a red binary is
  BISECTED (restore its TUs, re-apply classes one at a time, the culprit REJECTED and ledgered, the survivors kept); `registry_append`
  (shorthand, by text — never `yaml.safe_dump`), `dedup_extend.add_members_surgical` for extensions; `batch_<label>.json` per batch
  (`classes`, `refused`, `results` per binary, `registered`, `extended`, `rejected`, `exemplars`). `--plan` on the post-T4 tree: `census
  28 s · extend (registered-incomplete) 183 classes · new (unregistered same-vram) 916 classes / 3,569 private sites · new by band {'32+':
  446, '16-31': 255, '8-15': 204, '1-7': 11}; differing-text classes 27; with pins 139; alias-form 6` (183 + 916 = the census's 1,099
  same-vram backlog; the plan's "206 never-extended" counted the B census before the twins). First probe run: `KeyError: 'line'` (the
  census's per-instance records lacked the line range) → fixed in `share_census.classify`. **The probe (R37):** class
  `c1c085b28d16c2417f2d9ce46553d16fe45b4508` = `func_801681FC` (2 instances, ov_SC04_008 + ov_SC05_009, 22 ins): `[new1] 1 classes ·
  2 sites in 2 TUs · 1 new headers · gating 2 binaries` → `gated 2/2 binaries green · registered 1 groups · extended 0 members · rejected
  classes 0`; header `src/shared/ov/func_801681FC__c1c085b2.h` (suffixed: the vram hosts >1 class fleet-wide), group `S_func_801681FC`,
  ledger rows 0. `bind_alias_header` factored out of `macro_to_header` (shared by both tools). SETUP §"P35 T3–T5" + the dictionary row
  (`tools/share_body.py P10 ADAPT LIVE`); `make kit-corpus` (363 copies) + `tool_census --check: OK`. 18 files, +1,198/−81.
- **S94 — T5 bucket 0, FIRST PASS (commit `571374b97`, 18:30 local; `.run/P35/share/run_extend.log`, 617 s, exit 0).** `share_body --apply
  --bucket extend --batch 120`: `census 24 s · extend 183 classes · new 915 classes / 3,567 private sites` · `[extend1] 120 classes · 774
  sites in 190 TUs · 0 new headers · gating 141 binaries` → `gated 141/141 binaries green · registered 0 groups · extended 754 members ·
  rejected classes 88` · `[extend2] 63 classes · 486 sites in 406 TUs · gating 146 binaries` → `gated 146/146 binaries green · extended 34
  members · rejected classes 37`; 482 REJECTED lines; the registry +788 members (13,062 → 13,850 member entries in 102 `binaries:` lines);
  539 src files changed; 690 files in the commit. **Diagnosis before committing (the replay method: apply ONE class's edit from the census's
  instance record, look at the text/compile):** (1) the failure "detail" was the FIRST line containing `error`/`conflicting` — the
  fleet-wide benign `warning: conflicting types for built-in function 'memcpy'` labelled 233 of the rejections; (2) the bisect re-applied
  the kept classes SEQUENTIALLY with the census's ORIGINAL line numbers — every earlier class's edit shifted the later sites, so the later
  classes landed on the wrong lines (duplicate definitions → `{standard input}: Error: symbol 'func_80168B70' is already defined`, 123
  lines; `parse error before 'extern'` at a header's line 3, 14 lines; `parse error before '}'`) — **125 of the 183 classes were rejected
  on the tool's own artifacts**; (3) no ledger row was written for a rejected EXTEND class; (4) `add_members_surgical` extended every
  group with ALL planned members, rejected or not. **Fixes in the same commit** (`tools/share_body.py`, 60 lines): the detail from
  error lines only (`warning:`/`note:` lines excluded); the bisect's `apply_selected()` restores the TU and applies the selected classes
  in ONE bottom-up pass from the original text; rejected extend classes ledgered `TU-CONFLICT` with the rejecting binaries; a group
  extended only with members whose sharing survived the gate. **What the commit therefore holds:** the sites the (artifact-prone) first
  bisect kept, every binary gated green in its final state (per-binary `make check` + object A/B — NO clean fleet run), and a registry
  that lists 788 new members regardless of whether their site shares (the wholesale extension ran BEFORE fix 4 existed).
- **S94 — T5 bucket 0, SECOND RUN (`.run/P35/share/run_extend2.log`; started 18:30:35 local, 511 s, exit 0 — finished at ~18:39 AFTER the
  session's context filled: the session hit 91% context at 18:32, Drew asked for a hook and then for a checkpoint, both answers were
  "Prompt is too long", the run's completion notification arrived to a dead session; Drew let the script finish before exiting).**
  `census 37 s · extend (registered-incomplete) 150 classes` (33 classes completed by the first pass) `· new 915 classes / 3,567 private
  sites` · `[extend1] 120 classes · 503 sites in 182 TUs · 0 new headers · gating 141 binaries` → `gated 141/141 binaries green · registered
  0 groups · extended 0 members · rejected classes 48` · `[extend2] 30 classes · 53 sites in 23 TUs · gating 141 binaries` → `141/141 green ·
  extended 0 members · rejected classes 7` · `share_body: done — 150 classes in 2 batch(es); see the ledger`. 303 REJECTED lines, 129 of
  them one class (`93d5fccdcc` = `E_func_80168B70`, rejected in 134 binaries — so 136 of 141 binaries went through the bisect in extend1;
  9 in extend2). "extended 0 members" is CORRECT for this run: the first pass had already listed every planned member. **Left on disk,
  uncommitted (`git status`): 38 `src/` files in 8 overlays (ov_MAIN_012 5 sites, ov_SC01_077 19, ov_SC02_037 6, ov_SC03_107 5, ov_SC07_006
  49, ov_SC07_007 29, ov_SC07_010 28, ov_SC07_011 29 = 170 private definitions → `#include "../shared/ov/func_X[__h8].h"`; every added line
  is such an include, verified by S95), `config/dedup_exceptions.tsv` +55 rows (all `TU-CONFLICT`, "share_body extend1/extend2: extend of
  E_func_X rejected in [binaries]"), `.run/P35/share/batch_extend1.json` + `batch_extend2.json` (overwritten with this run's records), 139
  of the 146 `check_*.log` (each ends `BYTE-IDENTICAL` — the final gate of each binary), untracked `run_extend2.log` and
  `.run/P35/baseline/kit_corpus_t5a.log`.**
- **S95 — RECOVERY (2026-09-08 evening; Fable 5.1 at Max; no gate, build, census or tool run — Drew's instruction).** Reconstructed the
  above from the S94 transcript (dumped to text with a 60-line script: user text / assistant text / tool_use / tool_result per record),
  the two commits, the batch records and the tree. **Findings, each read from an artifact:**
  1. **The dirty tree is run 2's net output and is bankable as-is (R42/R66):** 170 include lines, 0 other added lines; every one of the 8
     overlays' final `check_<b>.log` reads `[ OK ] … (BYTE-IDENTICAL)`; the run's exit was 0. It has NOT had the clean fleet run — **R22 is
     owed for all of T5 so far** (the first pass too: its gates were per-binary incremental builds).
  2. **The registry runs ahead of the source (the first pass's wholesale extension):** the 55 ledger rows name 325 (class, binary)
     rejections; **317 of those binaries are LISTED as members of the class's group** in `config/dedup.us.yaml` (computed by S95 from the
     ledger notes × the registry's `binaries:` lines). `E_func_80168B70` alone: 7 members before the first pass (the 7 late overlays), 141
     after, 134 of them private copies. `share_census --check` will count these classes as EXCEPTED (the ledger), so S1 stays green — but
     T7's planned C2d ("every member's site includes the source") fails on all 317 until the members are removed or the classes crack.
  3. **The cause extractor still misses gcc-2.7.2's error lines** (`tools/share_body.py:204-206` requires `\berror\b|Error\b|undefined
     reference|already defined|multiple definition|parse error|\[FAIL\]`): cc1 prints errors as `file:line: message` with NO "error" token
     (`too many arguments to function`, `conflicting types for`, `redeclaration of`, …), so 254 of the 303 rejection lines read only `make:
     *** [Makefile:1033: build/src/<b>/<tu>.o] Error 33` (33 = cc1's fatal exit status). **The real cause of the dominant class**, read
     from the dead session's own replay residue (`/tmp/claude-1000/-home-musashi-bfm-decomp/e902c34e-…/scratchpad/cc1.err`, the single edit
     of `func_80168B70` in ov_SC01_074 through cpp → cc1): **`src/ov_SC01_074/../shared/ov/func_80168B70.h:13: too many arguments to
     function 'func_80146C3C'`**. The header's text is the 7 late overlays' spelling (`func_80146C3C((u8 *)a0)` against THEIR `extern void
     func_80146C3C(u8 *a0)`); the 134 main overlays declare `extern void func_80146C3C(void)` and their private copies call `((void
     (*)(s32))func_80146C3C)(a0)` — same bytes (h_exact `93d5fccdcc…`), incompatible source environments. The header carries the MINORITY
     spelling because the group was created for the 7. (The first pass's `symbol 'func_80168B70' is already defined` for this class WAS
     the bisect artifact; the second run's rejection is real.) First-pass lines already showed the same family in ov_MAIN_012:
     `func_80168BDC.h:5: conflicting types for 'ApplyMatrixSV'`, `func_80168070.h:7: conflicting types for 'ApplyMatrixSV'`.
  4. **A cross-batch edit-loss defect (R42 class — a gate destroying banks):** `restore()` (`share_body.py:221-223`) is `git checkout --
     <tus>`, and `Batch.apply_edits` uses the census's line numbers from the START of the run. Within one run, batch N+1's edits land on
     TUs batch N already changed (uncommitted) → stale lines → the initial gate fails → the bisect `git checkout`s those TUs, WIPING batch
     N's kept includes, then re-applies only batch N+1's classes (which pass) → the binary ends green with FEWER shares than reported.
     Evidence: run 2's extend2 bisected ov_SC07_006/007/011 (007 and 011 "3 classes kept, 0 rejected" — a batch that fails whole yet
     passes class by class is the stale-line signature) and their `_jr_801457A4.c` lost extend1's six kept sites `func_80149374,
     func_801493D0, func_80149450, func_801494CC, func_80149544, func_8014964C` (present in no diff); ov_MAIN_012 / ov_SC02_037 /
     ov_SC03_107 lost `func_80146128, func_80146FC4, func_80153800, func_801539F8` the same way; ov_SC01_077 ~11 sites. S95's estimate:
     ≈50–63 kept sites lost in run 2 (the same happened inside the first pass). They stay private and reappear as verdict-B classes in the
     next census (NOT ledgered → retried automatically). Fix: snapshot each touched TU's text in memory before `apply_edits` and restore
     from the snapshot; re-derive the edit positions per batch (re-census, ~30 s) or run ONE batch per invocation and commit between.
  5. **The residue's causes, as recorded (to be confirmed by replay — the ledger says TU-CONFLICT for all 55):** (a) prototype/type conflicts
     between a header's preamble or calls and the TU's declarations — the late overlays ov_MAIN_012, ov_SC02_037, ov_SC03_107, ov_SC07_006/
     007/010/011, ov_SC01_077 (+ ov_SC01_000, ov_SC06_018 for 2 classes), and the 134-binary `E_func_80168B70` case; (b) **suspected census
     definition-range defects** — `parse error before 'if'` at `<b>_jr_8015C32C.c:3388-3390` (`d743c21bd9` = `E_func_8016163C`) and
     `before 'not'` at `:3438` (`3576d059c2` = `E_func_80161774`) in exactly the five twin-pair primaries (SC01_005, SC02_000, SC03_014,
     SC03_118, SC04_018 — one shared source text), `<b>_jr_801380E0.c:1050 before 'if'` (`9bda7673e9` = `E_func_80138C30`, SC03_014/118);
     (c) **symbol-name conflicts at link** — `undefined reference to func_80161A90` (`3576d059c2`, the five primaries' `_after.c`),
     `func_8012A68C` (`6f62feba35` = `E_func_8012A328`, SC04_018), `func_80161B18` (`7604e5daf1` = `E_func_80161A90`, SC04_018),
     `func_8012A598` (`bdb48359cd` = `E_func_8012A568`, SC03_014/118): the header names a callee those binaries' symbol stacks do not carry
     under that name; (d) **GATE-REJECT (bytes differ)** — `[FAIL] build/ov_SC07_00x` for `7529ad8f17` = `E_func_801376E8` (an alias-form
     header, `aF801376E8`) in SC07_006/007/010/011; (e) `c9866fcb86` = `E_func_8012F49C` in SC07_006, cc1 error, cause uncaptured. The
     reason column should say which (TU-CONFLICT / RANGE-DEFECT / SYMBOL-NAME / GATE-REJECT), not one word for all.
  6. **T6 recon the session had done (read-only, reproduced by S95):** 30 live-tree tools carry a non-docstring string constant naming
     `DEFINE_func_` or `engine_core.h` (the plan's negative control said "exactly the 22 parsers" — the measured set is 30 and includes the
     three Phase-35 tools, which are LEGITIMATE mentions the guard must whitelist): aprop_autodraft 2 · audit_binaries 1 · auto_driver 1 ·
     blocker_probe 3 · build_engine_types 1 · bulk_harvest 1 (STILL-NEEDED) · canon_sig_reconcile 1 · cdecl 7 · conform_decls 1 ·
     dedup_extend 1 · dedup_integrate 1 · dedup_propagate 3 · demacroize 2 · export_pairs 1 (STILL-NEEDED) · family_cousins 1 ·
     family_remap 1 · family_sweep 6 · fix_arity_callers 2 · gccmap_cites 1 · gen_harvest_targets 3 · jr_isolate_all 1 · macro_draft 1
     (STILL-NEEDED) · macro_to_header 19 · normalize_self_decls 2 · overlay_src_split 3 · p16_improve 4 · recover_giant 1 ·
     recover_integration 2 · share_census 4 · sig_unify 1. The 7 freeze tools' entry points: `family_sweep` main:878/1060,
     `gen_harvest_targets` 154/294, `p16_improve` 68/136, `recover_giant` 71/81, `restore_dropped_decls` 73/129, `normalize_self_decls`
     193/210, `o0_subsplit` 64/197; dictionary status today: all LIVE except restore_dropped_decls + macro_draft STILL-NEEDED.
  Nothing else changed on disk in S95 except this file.
- **S96 (2026-09-08 evening, same terminal as S95; Drew: `/effort high` — testing Fable 5.1's default; the plan's Max for T5's tool work is
  waived by that choice) — T5 step 1: run 2 BANKED** as the checkpoint's §2 step 1 specifies: 37 `src/` files (170 shared includes in
  8 overlays), `config/dedup_exceptions.tsv` (+55 rows), the batch records, 139 gate logs, `run_extend2.log`, `kit_corpus_t5a.log` —
  181 files. No gate re-run (each binary's final `check_<b>.log` is the tool's success line, R66); R22 still owed for T5.
- **S96 — T5 step 2: `tools/share_body.py` fixed** (the three S95 defects): `failure_cause()` = the first `file:line: message` (or
  `file:(.text+0x..): message`) diagnostic that is not a warning/note/banner, then the assembler/linker phrases, then the make line;
  `reason_for()` → SYMBOL-NAME / GATE-REJECT / PARSE-ERROR / TU-CONFLICT (the two new codes documented in the ledger's header); the
  bisect restores from `tu_snapshot()` (the pre-edit text of every touched TU, in memory) — `git checkout` is gone; `--batches` (default
  1) stops after one batch with a "COMMIT, then re-run" line; the per-class cause is kept (`causes` in the batch JSON, in every ledger
  note); the docstring carries the run-on-a-committed-tree rule. **Controls (R39):** on the dead session's real red `cc1.err` (64 warning
  lines) the cause is `func_80168B70.h:13: too many arguments to function 'func_80146C3C'` → TU-CONFLICT; six synthetic logs (linker,
  assembler, `[FAIL]`, parse error, conflicting types, a warning-only log) each give the expected code and never a warning line.
  `make kit-corpus` + `tool_census --check: OK`.
- **S96 — T5 step 3: the registry repaired** — `share_body.py --repair-registry` (new: every listed member whose site is still a private
  definition, derived from the census and matched on (binary, vram) — the first cut matched the binary NAME alone and removed 9,269
  members from 214 groups because h_exact is position-independent and a listed binary can hold the same bytes privately at ANOTHER
  address; caught by `dedup-check: 14 failed` + a known-true control (ov_SC01_004's include of func_80146E90), reverted, fixed):
  `repair-registry: 378 listed-but-private members removed from 79 groups; groups left with <2 members: 0; verbose groups … 0` —
  317 of them the ledger's rejected pairs (325 minus 8 never listed), 61 the sites the S94 bisects wiped plus older escapes;
  `E_func_80168B70` back to its 7 late-overlay members. `dedup-check: 2221 validated, 0 failed | C1 coverage 256120/256120`;
  census `362,389 classified · 0 UNACCOUNTED`, verdicts A 1,812 · B 183 · C 6,639 · D 1,545 · M 1 (A 1,712 → 1,812 = the 100 classes
  bucket 0 completed), same-vram backlog **1,099 → 999 classes · 3,883 private copies · 2,887 collapsible**; the whale control
  `A/141/missing 0`. `.run/P35/share/repair_registry.json` is the record. kit corpus + `tool_census --check: OK`.
- **S96 — T5 step 4: the suspect rejections replayed; a FOURTH tool defect found and fixed; the extend bucket re-run (`run_extend3.log`).**
  The census's definition ranges for the three parse-error sites are CORRECT (e.g. `ov_SC01_005_jr_8015C32C.c:3389-3426` covers all of
  `func_8016163C`) and each single edit compiles clean (cc1 rc 0) — so the failures were not the class's edit. Cause: **a twin's instance
  resolves to its PRIMARY's TU, so a twin pair queued the SAME (tu, line) edit twice; the second replacement swallowed the NEXT function**
  → `parse error before 'if'` (the orphaned body) or `undefined reference to <the following function>` at link — in exactly the five twin
  primaries; 7 classes (`d743c21bd9`, `3576d059c2`, `6f62feba35`, `7604e5daf1`, `9bda7673e9`, `bdb48359cd` + one) were the tool's artifact.
  Fix: `Batch.add_class` dedupes edits by (tu, line). `E_func_801376E8` (`7529ad8f17`, SC07_006/007/010/011) IS a real GATE-REJECT:
  the SC07 private copies read `((void (*)(s32))func_80139BE0)(obj)` where the header calls `func_80139BE0(obj)`, and those TUs declare
  the callee `s32 (s32)` — the header text allocates registers differently there (replayed: `[FAIL]`, the one object differs inside
  `func_801376E8`). The ledger's 54 S94 rows were dropped for re-judging (7 artifacts, the rest without a captured cause);
  `E_func_80168B70`'s row kept with its real cause (step 5 pending). **Run 3** (`--bucket extend --batch 400 --batches 1`, 165 s):
  `extend (registered-incomplete) 83 classes` · `[extend1] 83 classes · 235 sites in 55 TUs · gating 141 binaries` → `gated 141/141
  binaries green · registered 0 groups · extended 87 members · rejected classes 48`; 157 REJECTED lines (303 before), every cause now a
  real diagnostic (`conflicting types for 'ApplyMatrixSV'` ×6 classes, `too few arguments to function 'func_8014A51C'`, `conflicting
  types for 'D_80126CC4'`, `… 'D_800A651C'`, `… 'func_801497A8'`, `too few arguments to function 'func_80146C3C'` — the late overlays'
  declaration environments vs the headers' text); 78 more sites shared in 24 TUs; 49 ledger rows. A fifth extractor wart (a chained
  `a.h:65: b.h:15: warning: …` line picked for 3 classes) fixed in this commit — those 3 rows carry a warning as cause and are
  re-judged with the step-5 run. `dedup-check` 0 failed; kit corpus + `tool_census --check: OK`. Effort: high (Drew's choice).
- **S96 — T5 step 5 DECIDED (Max, delegated by Drew): re-exemplar `E_func_80168B70` from the majority text; the 48 late-overlay conflicts
  stay ledgered for the types phase** (the decision and its reasoning are in §Decisions). NEXT: `share_body.py --reexemplar <h_exact>` —
  header ← the majority private text (`choose_exemplar` over the private copies, the current header's text counted once per includer),
  `bind_alias_header` if needed, gate every current includer's binary FIRST (roll the header back on any red), then the class as a normal
  extend batch (`--only`), the registry extended with the members that passed; its ledger row removed just before the run. Effort: high.
- **S96 — T5 step 5 DONE: `share_body.py --reexemplar 93d5fccdcc`** (`.run/P35/share/run_reex_93d5fccd.log`, 84 s): `header
  src/shared/ov/func_80168B70.h ← src/ov_SC01_000/ov_SC01_000_jr_8015C32C.c:5792 (majority text; texts 1); 134 private copies, 7 includers
  to re-gate first` → `7/7 includer binaries green under the majority text` → `[reex_93d5fccd] 1 classes · 129 sites in 129 TUs · gating
  141 binaries` → **`gated 141/141 binaries green · registered 0 groups · extended 134 members · rejected classes 0`**; the previous
  ledger row dropped (48 rows remain, all late-overlay declaration conflicts for the types phase). The old header text is
  `.run/P35/share/reexemplar_93d5fccd.old.h`. `dedup-check` 0 failed; SETUP paragraph extended (`--batches`, the snapshot restore, the
  cause rule, `--repair-registry`, `--reexemplar`; R21); kit corpus + `tool_census --check: OK`. **Bucket 0 is CLOSED:** 183 classes at
  the start → 135 fully shared, 48 ledgered TU-CONFLICT with real diagnostics.
- **S96 — R22 after bucket 0** (`.run/P35/baseline/r22_t5_bucket0.log`): `make clean && make extract-all JOBS=16 && make check-all JOBS=16`
  → `extract-all: 217 extracted, 0 failed of 217 (+ main, serial)` · **`check-all: 218 passed, 0 failed of 218`** · `wall=84.02 s
  user=1334.73 s sys=185.72 s` · `exit=0` — every T5 bank so far (five commits) proven from clean; fleet CPU 2,230 s (T4) → 1,335 s.
- **S96 — T5 bucket `new`, batch 1** (`.run/P35/share/run_new1.log`, 99 s; `--apply --bucket new --batch 120 --batches 1`): `census 29 s ·
  extend (registered-incomplete) 5 classes · new (unregistered same-vram) 915 classes / 3,567 private sites` · `[new1] 120 classes · 1482
  sites in 535 TUs · 120 new headers · gating 165 binaries` → **`gated 165/165 binaries green · registered 120 groups · extended 0 members ·
  rejected classes 1`** ([new1] ov_SC07_010: class 2e822a8f62 REJECTED — src/ov_SC07_010/../shared/ov/func_80140D68.h:41: 'D_800B9A02' undeclared (first use this function) — an exemplar body relying on a
  file-scope extern outside its definition; ledgered TU-CONFLICT, 49 rows). 795 classes of the bucket remain; the 5 unexcepted B classes
  get an `--bucket extend` run at the end.
- **S96 — T5 bucket `new`, batch 2** (`run_new2.log`; record copied to `batch_new2.json`): `120 classes · 360 sites in
  69 TUs · 120 new headers · gating 9 binaries` → **`gated 9/9 binaries green · registered 120 groups ·
  extended 0 members · rejected classes 0`**.

- **S96 — T5 bucket `new`, batch 3** (`run_new3.log`, 107.16 s; `batch_new3.json`): `120 classes · 358 sites in
  59 TUs · 120 new headers · gating 12 binaries` → **`gated 12/12 binaries green · registered
  120 groups · extended 0 members · rejected classes 0`**.

- **S96 — T5 bucket `new`, batch 4** (`run_new4.log`, 109.92 s; `batch_new4.json`): `120 classes · 360 sites in
  69 TUs · 120 new headers · gating 15 binaries` → **`gated 15/15 binaries green · registered
  120 groups · extended 0 members · rejected classes 0`**.

- **S96 — R22 after bucket `new` batch 4** (`.run/P35/baseline/r22_t5_new4.log`): `check-all: 218 passed, 0 failed of 218` · `wall=221.86 s` · `exit=0`.

- **S96 — T5 bucket `new`, batch 5** (`run_new5.log`, 79.54 s; `batch_new5.json`): `120 classes · 329 sites in
  75 TUs · 120 new headers · gating 15 binaries` → **`gated 15/15 binaries green · registered
  120 groups · extended 0 members · rejected classes 1`**; rejected: [new5] ov_SC03_126: class 60be554c70 REJECTED — src/ov_SC03_126/../shared/ov/func_8017EF6C__60be554c.h:4: 'D_80126942' undeclared (first use this func.

- **S96 — T5 bucket `new`, batch 6** (`run_new6.log`, 28.66 s; `batch_new6.json`): `120 classes · 240 sites in
  40 TUs · 120 new headers · gating 14 binaries` → **`gated 14/14 binaries green · registered
  119 groups · extended 0 members · rejected classes 1`**; rejected: [new6] ov_SC04_006: class 250070c4bf REJECTED — src/ov_SC04_006/../shared/ov/func_8017D0FC__250070c4.h:4: 'D_80126954' undeclared (first use this func.

- **S96 — R22 after bucket `new` batch 6** (`.run/P35/baseline/r22_t5_new6.log`): `check-all: 218 passed, 0 failed of 218` · `wall=84.30 s` · `exit=0`.

- **S96 — T5 bucket `new`, batch 7** (`run_new7.log`, 32.90 s; `batch_new7.json`): `120 classes · 240 sites in
  63 TUs · 120 new headers · gating 34 binaries` → **`gated 34/34 binaries green · registered
  120 groups · extended 0 members · rejected classes 0`**.

- **S96 — T5 bucket `new`, batch 8** (`run_new8.log`, 26.95 s; `batch_new8.json`): `75 classes · 150 sites in
  30 TUs · 75 new headers · gating 4 binaries` → **`gated 4/4 binaries green · registered
  75 groups · extended 0 members · rejected classes 0`**.

- **S96 — R22 after bucket `new` batch 8** (`.run/P35/baseline/r22_t5_new8.log`): `check-all: 218 passed, 0 failed of 218` · `wall=88.98 s` · `exit=0`.

- **S96 — T5 CLOSE.** Bucket `new` done in 8 batches (`share_body_cycle.sh` 3–5 and 6–8 unattended; batches 1–2 by hand): 3,519 sites in
  980 TUs → 914 groups registered, 3 classes rejected (new1, new5, new6 — each a body relying on a declaration outside its definition,
  ledgered TU-CONFLICT); R22 green after batches 4, 6 and 8 (`r22_t5_new{4,6,8}.log`, `check-all: 218 passed, 0 failed of 218`). The
  tail run (`run_extend_tail.log`): `new (unregistered same-vram) 0 classes / 0 private sites`; the 5 leftover B classes had NO private
  copy — every one of their 141 instances already includes the header while the registry listed 16 (or 2): the eight VERBOSE `members:`
  groups, which `dedup_extend.add_members_surgical` skipped silently (no `binaries:` line) — the inverse defect, the registry BEHIND the
  source. Fixes: `add_members_surgical` refuses a verbose group loudly (R43); `--repair-registry` gained the second half (an
  including-but-unlisted member is added; a verbose group is converted to shorthand): `639 including-but-unlisted members added to 5
  groups (5 converted to shorthand: D1_ov_dup_8012AD64, E_func_80128EA8, E_func_8012A568, E_func_80132EC4, E_func_80138C30)`; 3 verbose
  groups remain (I0_clearTbl40 + the two SC01_005 setters, cross-address controls). **Verify (T5's milestone items, literal):**
  `share_census --check` → **`S1: one source per unique function — 10,180 classes, 10,180 satisfied (3,580 twin-covered, 51 excepted,
  3,801 deferred cross-address), 0 VIOLATION(S) — OK`**, exit 0 (`.run/P35/census/check_t5.txt`); verdicts A 2,760 · B 149 · C 5,751 ·
  D 1,518 · M 2; **same-vram unregistered 51 classes · 160 copies · 109 collapsible — exactly the ledger (50 TU-CONFLICT + 1
  GATE-REJECT, every row with its diagnostic)**; `dedup-check: 3135 validated, 0 failed | C1 coverage 260543/260543`;
  `audit-binaries: OK`; kit corpus + `tool_census --check: OK`; the last R22 (`4ba4b2080`) stands — no build input changed after it
  (the tail run shared 0 sites; the registry is not a build input). **Before → after (T4 close → T5 close):** registry groups 2,220 →
  3,135; shared headers 2,215 → 3,137; same-vram backlog 1,099 classes / 4,755 private copies / 3,658 collapsible → 51 / 160 / 109
  (all ledgered); verdict A 1,712 → 2,760; fleet clean-run wall 145 s → 84 s (CPU 2,230 s → 1,335 s); 23 commits in T5. **T5 ☑.**

- **S96 — T6 part 1: freeze + retire.** `tools/frozen.py` (the one refusal, printed from main() — never at import: cdecl imports
  gen_harvest_targets, 18 tools import family_remap). **FROZEN (14, status FROZEN + successor in the dictionary):** the plan's 7
  (family_sweep, gen_harvest_targets, p16_improve, recover_giant, restore_dropped_decls, normalize_self_decls, o0_subsplit) + 7 the
  guard census found reading or writing the macro form (inject_capped_externs, aprop_autodraft, canon_sig_reconcile, conform_decls,
  blocker_probe, demacroize, and family_remap's command line — it writes a `#define DEFINE_func_` head; its library stays). Deviation
  from the plan's "7": the S95 ast census measured 30 hits, not 22; twin_sweep/recover_integration (which exec frozen CLIs) stay LIVE
  and would print the refusal; family_cousins stays LIVE (`make atlas` runs it) and loses its dead branch in part 2. **RETIRED (4, git mv
  to tools/sunset/, README rows):** dedup_propagate + dedup_extend → share_body.py (add_members_surgical and the library surface
  onboarded_overlays / load_sig / registered_addrs / sym moved verbatim; validate_targets imports share_body; inject_capped_externs
  frozen), macro_draft (product: the headers), test_reconcile_ledger (retired with its subject). Six lane callers repointed to
  `share_body.py --apply --bucket new --batches 1` (gate_stage, gate_lane, grinder's message, lora_grind, auto_driver, bulk_harvest);
  audit_binaries' hint reworded. `tool_census` accepts FROZEN. Verify: every touched file compiles; `family_sweep.py --source x` →
  `FROZEN since Phase 35 … Successor: tools/share_body.py` rc 1; `import share_body, family_remap, gen_harvest_targets,
  validate_targets` OK; no live tool names a retired file; `tool_census --check: OK` after `make kit-corpus` (the first chain checked
  BEFORE regenerating and a `;` let a partial commit through — R97 again; amended into one commit).

- **S96 — T6 part 2: the dead macro branches dropped + the guard.** Twelve live tools lost their macro-form code: audit_binaries
  (`SHARED_INCLUDES` = the prelude only), auto_driver + bulk_harvest (`git add src/shared`), build_engine_types (the generated comment),
  cdecl (`MACRO_STMT` = INCLUDE_ASM only; the fifteen-incumbent differential reduced to its honest statement — the macro header is gone —
  and its dead body deleted, the gen_harvest_targets import with it), dedup_integrate (`PARAM_FUNC_RE` = SHARED_FN), export_pairs (mines
  the shared headers under src/shared/ instead of macro bodies), family_cousins (`seed_body_ref` finds the shared header), fix_arity_callers
  (the shared-header glob only), jr_isolate_all (the prelude include maps to engine_types.h + common.h), recover_integration (message +
  snapshot list), sig_unify (help text). **The guard** (`tool_census.py --check`, `macro_form_guard`): every LIVE `.py` parsed with `ast`;
  a non-docstring string constant carrying `DEFINE_func_` or `engine_core.h` is a gap; FROZEN, retired and six whitelisted detectors
  (share_census, macro_to_header, share_body, overlay_src_split, gccmap_cites, tool_census) excluded; `--guard-root DIR` runs it against
  another tree. **Verify:** `macro-form guard: 0 LIVE tools reference the retired form (217 scanned, 14 frozen, 6 whitelisted detectors, 38
  retired)` · `tool_census --check: OK`. **Negative control (R39):** a worktree of the pre-T4 commit `0e38b51a3` → `15 LIVE tools reference
  the retired form (197 scanned, 14 frozen, 4 whitelisted)` — exactly the twelve fixed here + the three retired, none frozen or whitelisted.
  **`make tools-health` went red twice, both instrument findings fixed at the cause:** (1) `progress.py`'s R32 bucket assertion —
  `func_801EF790`/`func_801EF85C` (md_SC03_073/074/075/078, empty-bodied shared headers) in BOTH `real` and `empty`: the include rule
  classifies an empty header body as EMPTY while `report()`'s fold `real ∪= shared` re-added every included member; under the macro
  form an empty shared body had been invisible to the classifier and counted as REAL through that fold. Fix: the fold excludes `empty`.
  **Two published-number corrections follow (R14/R75; stated here, carried to T7/T8):** the fleet denominator **363,221 → 363,680
  (+459)** = ov_SC03_015 +219 (its single-site macros, the plan's expected correction) + ov_SC03_118 +3 + 2 in each of ~118 overlays
  (the never-extended members of the five under-listed groups — macro sites invisible until T4 made them includes); and **FLEET REAL
  substantive 360,744 → 350,533 (−10,211)** with EMPTY up by the same — empty-bodied shared functions were REAL under the macro form's
  fold and are EMPTY now, honestly; the instruction-weighted metrics (13,492,113 / 5,820,205 / 45,150) are unchanged. (2) `timeline.py`'s
  self-check: its last row follows the COMMITTED digest (T2's lesson) — this commit carries the corrected `docs/progress.json` + README
  block + `progress.fleet.md`; the timeline is regenerated in the next commit and the chain re-run for T6's verify line.

- **S96 — T6 CLOSE.** `make tools-health` red three times, each an instrument finding fixed at its cause, green on the fourth: (1) the
  `progress.py` fold (above); (2) `doc_links`: `docs/wiki/The-dedup-engine.md` linked the retired `tools/dedup_propagate.py` — repointed to
  `share_body.py` with a note (T8 rewrites the page); (3) `kit_lint` LEAK: my dictionary row for `share_body_cycle.sh` carried rule ids
  (`R42`, `R22`) — project-specific text the kit's manifest must not inherit — reworded. **Verify (T6's line):** `tools-health: OK — sigs
  fresh; corpus(+resident) + cdecl + binaries + report(lint+dedup) + cookbook-index all green.` (`.run/P35/baseline/tools_health_t6d.log`,
  484 s, exit 0) with `macro-form guard: 0 LIVE tools reference the retired form (217 scanned, 14 frozen, 6 whitelisted detectors, 38
  retired)`; the timeline regenerated by the chain against the committed digest (74 rows, self-check OK). **T6 ☑.**

- **S96 — T7: the invariants wired + every published number regenerated.** Makefile `tools-health`: after `audit-text-sources`, before
  `report BINARY=main`, two rungs — `share_census.py --selftest` (7/7) and `share_census.py --check --strict-macros --strict-text --quiet`
  (exit code, R97) — so `progress.py` reads a fresh census json. `dedup_integrate --check` gained **C2c** (one source under `src/shared/`
  defining exactly one function) and **C2d** (every member's site is an include of THIS group's source — from the census's per-instance
  forms, one cached scan; a `def` site = the registry ahead of the source). `progress.py`: `counts.unique_function_bodies` (REAL + EMPTY −
  shared instances + their one header each = **105,007** bodies written once in C), `duplicate_source_copies` / `_classes` (**160 / 51**,
  from the census json, all ledgered), a dated `corrections` list (T2 +7; T6 +459; T6 REAL −10,211) and the README sentence "One source
  per unique function (Phase 35): …". **The second oracle (R34) disagreed with the byte oracle and the disagreement is measured:** of
  4,312 same-address definition texts duplicated across TUs, 3,495 were a twin and its primary (one TU — the oracle now counts distinct
  TUs), 28 are ledgered, **380 texts (1,668 sites) sit inside the E/F-deferred cross-address classes** (an empty body's hash spans every
  address, so gate 1's deferral took its same-address pairs along — published as the names phase's inheritance), and **38 texts (2,030
  sites) are the same C at the same address compiling to DIFFERENT bytes per binary** (singleton h_exact classes — e.g. `func_8012AAAC`,
  138 copies, 133 byte patterns, h_norm differs in 5 ways): one source the byte tier cannot register — published as PENDING, a decision
  for Drew (an `h_text` tier now, or the names phase); 0 texts a shared byte class holds across two TUs — the first oracle has no hole.
  **Negative control (R39), in place on the probe class `S_func_801681FC` (2 members):** ov_SC05_009's include reverted to the 19-line
  private copy → `S1 … 10,179 satisfied … 1 VIOLATION(S) — FAIL` naming `B - h=c1c085b28d … ['ov_SC04_008', 'ov_SC05_009']`, exit 1;
  `[FAIL] S_func_801681FC: ov_SC05_009:0x801681fc … its site is a def in … (C2d)`, `dedup-check: 3134 validated, 1 failed`; restored →
  `0 VIOLATION(S) — OK`, exit 0. Instrument slips on the way, each caught by the run: a missing `os` import (C2d's first run), the
  `--check` path not keeping per-instance records, twin pairs counted as two TUs, "classed" mis-defined as any classed site (fixed to
  "one class across two TUs"). **Verify:** `make tools-health` → `tools-health: OK — …` (`.run/P35/baseline/tools_health_t7.log`, 551 s,
  exit 0) with `S1: … 10,180 satisfied … 0 VIOLATION(S) — OK`, `dedup-check: 3135 validated, 0 failed | C1 coverage 260543/260543`,
  `macro-form guard: 0 LIVE …`, `progress.py --check: … fresh`, `timeline --check: fresh (74 rows)`. **T7 ☑.**

- **S96 — the second oracle's finding DECIDED (Max, delegated by Drew): T5b (a text tier) for the 38 byte-variant same-address texts;
  the 380 inside the deferred classes stay deferred** — the reasoning is in §Decisions; T5b's design in its task row. NEXT: T5b at high.

- **S96 — T5b: the text tier.** `config/dedup.us.yaml` gains `tier: h_text` (the group hash = the normalized text; verbose members each with
  their own `h_exact`); `dedup_integrate` C1 checks an h_text member against ITS recorded byte hash (TIERS += h_text); `share_census`
  indexes h_text groups by site (a byte class whose sites they list is registered by TEXT — no `extra`), exports `text_classes()` (same
  normalized text, same address, ≥2 distinct TUs, outside the deferred/ledgered sets) and makes the S1 text half a VIOLATION (was PENDING);
  `share_body --bucket text` shares them (header `func_<VRAM>__t<hash8>.h`, banner `h_text`, the body from any site — identical by
  construction — declarations stay in each TU; registration in the verbose form with per-member h_exact). **Run (`run_text1.log`, 1,489 s):**
  `text tier — 38 same-address text classes / 2,030 private sites` · `[text1] 38 classes · 1957 sites in 1540 TUs · 38 new headers · gating
  138 binaries` → **`gated 138/138 binaries green · registered 38 groups · extended 0 members · rejected classes 0`** (e.g. `T_func_8012AAAC`:
  138 members, 133 byte patterns, one header). **Verify:** `dedup-check: 3173 validated, 0 failed | C1 coverage 262573/262573`; the strict
  census `S1 … 10,180 satisfied … 0 VIOLATION(S) — OK` (twin-covered 3,580 → 3,507: the twin pairs' sites are text-tier includes now) with
  the second oracle `0 same-address definition texts duplicated` and `381 … inside the deferred cross-address classes (1,668 sites)`;
  **R22 `check-all: 218 passed, 0 failed of 218`, 90 s** (`r22_t5b.log`); `progress.py --check … fresh` — the digest now says 103,015
  bodies written once (3,173 headers instantiated 262,573 times), 160 duplicate copies in 51 ledgered classes, 38 text-tier functions
  (2,030 sites), 1,668 same-address copies of 381 tiny bodies deferred to the names phase (the README sentence carries all of it). The
  census json is rewritten after the strict-text keys are set (progress.py read empty counts before). SETUP §T7/T5b (R21). **Verify
  (the chain):** `tools-health: OK — …` (`.run/P35/baseline/tools_health_t5b.log`, 439 s, exit 0) with `S1 … 10,180 satisfied … 0
  VIOLATION(S) — OK`, `dedup-check: 3173 validated, 0 failed | C1 coverage 262573/262573`, `macro-form guard: 0 LIVE …`; the timeline
  regenerated (74 rows). **T5b ☑.**

- **S96 — T8: the record.** `docs/wiki/The-dedup-engine.md` rewritten for the shared-source model (the shape, the three tiers incl.
  `h_text`, the tool and its four first-day defects, the S1 gate with the second oracle, the numbers as a dated derivation, the honesty
  rules); `Repository-layout.md` (`src/shared/`), `Where-the-project-goes-next.md` (item 3 done; the macro row 5,147 → 0),
  `Verification-and-progress.md` (the S1 rungs in the reviewer table); how-to ch.10 (dedup in both eras; the old "leave the backlog" rule
  scoped to matching); README prose ("shared engine code lives as one plain-C header per function"); `gen3-standards.md` (§4 row
  struck through with the Phase-35 measurement, the DoD's "0 macro bodies" marked met); `gen3-handoff.md` (§2.2 and §3 rows as dated
  snapshots); cookbook **§453** (the include-at-site share, the exemplar rule, the gate, the four defects, S1, the second oracle, the two
  corrections) + a retirement banner on §14; `docs/decision-log.md` P35 (R31: the reversal with the sotn evidence, the session death and
  recovery, the six decisions, the measurements, four hindsights); `docs/accelerators.md` P35 (five); DIGEST §4 (the Phase-35 doc map);
  the memory `dedup-backlog-leave-it` rewritten as REVERSED with its index line. **Verify:** `doc_links: 56 documents, 455 relative links
  checked, 0 pending, 0 broken` (strict) · `wiki_render --selftest: 12 cases, 0 failed; reachability: 32 pages, 0 unlisted` · the cookbook
  index regenerated (`1170 sections, 14 symptom buckets`) and `cookbook-index OK` · `kit_coverage: OK` · kit corpus + `tool_census
  --check: OK`. **T8 ☑.** (`tools/sunset/README.md` rows were written at T6.)

- **S96 — T9, the close (run in S96 at xHigh by Drew's choice; the plan said Max in a fresh session).** R22 from clean:
  `extract-all: 217 extracted, 0 failed of 217 (+ main, serial)` · **`check-all: 218 passed, 0 failed of 218`** · `wall=87.62 s` · exit 0
  (`.run/P35/baseline/r22_t9.log`). `make tools-health` run 1 (467 s) was green through S1 / dedup-check / the guard and red only at
  `tool_census --check` — the kit's record copies of `DIGEST.md` and the new `PhaseEnd_Phase35.md` (both written while the chain ran);
  `make kit-corpus` regenerated them and the chain was re-run (its line is appended below). The headless Ghidra MCP stopped via the
  sentinel: `Save succeeded for processed file: /SLUS_007.26` (R23; unused all phase). `PhaseEnd_Phase35.md` written (the metrics table,
  the milestone items with literal output, the reviewer sequence, seven rule candidates, the recap); DIGEST §0 refreshed + §2's P35
  synopsis appended (step 3b). **The chain, run 2:** `tools-health: OK — sigs fresh; corpus(+resident) + cdecl + binaries +
  report(lint+dedup) + cookbook-index all green.` (`.run/P35/baseline/tools_health_t9.log`, 431 s, exit 0, 0 gaps) with `S1 … 10,180
  satisfied … 0 VIOLATION(S) — OK`, `dedup-check: 3173 validated, 0 failed`, `macro-form guard: 0 LIVE …`. The log archived to
  `phase-ends/logs/Phase35.md` (R19); `make kit-corpus` + `tool_census --check` after the PhaseEnd's last edit; everything left
  uncommitted for Drew's close commit (R6). **T9 ☑ — Phase 35 milestone met; v2.1.0.**

## Approved plan (verbatim, gate 1 — 2026-09-08)

# Phase 35 — Gen3 opens: the dedup phase, "one source per unique function" (v2.0.0 → v2.1.0)

> Plan mode, Max, S94, 2026-09-08. Gen3 order set by Drew this session: **dedup → pins → structs → names**, one phase each,
> planned one at a time; this plan is Phase 35 only. Gate 1 also ratifies **R96–R99** (Drew: "ratify all four").

## Context

Gen2 closed at v2.0.0 (218 binaries byte-identical, the repository public). Gen3's charter is readability on a byte-exact
floor. The first readability defect is that the same function exists many times in the tree, in two forms:

1. **Shared bodies as macros.** The dedup engine instantiates one body in every location overlay as a `DEFINE_func_XXXXXXXX()`
   macro from `src/shared/engine_core.h` (8.8 MB, 227,730 lines, backslash-continued, `#include`d whole by 3,981 TUs; measured
   cost 0.35 s + 94 MB RSS of cpp per TU ≈ 19 CPU-minutes per fleet build). `docs/gen3-standards.md` §2 rule 3 requires shared
   engine functions to live as C, not macros.
2. **Literal duplicate copies.** The July-2026 family sweeps banked proven bodies as a private copy per overlay and registered no
   group. On 2026-09-02 that backlog was deferred on the belief "sotn writes duplicate funcs explicitly" (memory
   `dedup-backlog-leave-it`); the decision log caveated that the claim rested on one cookbook parenthetical — which is about a
   cross-jump barrier idiom (`docs/matching-cookbook.md:253`), not about sharing.

**Verified this session, as data (X2), from sotn-decomp's tree:** sotn does NOT duplicate. Shared stage code lives once as plain C
in `src/st/<name>.h` (full definitions, `static` tables, `#ifdef STAGE_IS_…` where one stage differs), and each stage overlay
carries a ~90-byte `.c` stub (`#include "nz0.h"` + `#include "../e_red_door.h"`) that instantiates it at that stage's link
position; per-stage parameters are `static` data in the stub before the include. "Written once, instantiated per overlay by an
include at the site" is the community shape — structurally what our macros do, minus the macro form. The 2026-09-02 decision is
reversed on this evidence (recorded in the decision log at task 8).

**Drew's requirement (this session):** after the phase the tooling knows that functions are no longer duplicated across overlays
and that there is exactly one source for a unique function — an invariant asserted by a gate (R36), not remembered.

**Decisions at gate 1 (Drew, AskUserQuestion):** twin binaries share one source directory · cross-address classes are censused
and deferred to the names phase · macro-era tools are frozen with a loud refusal (the direct predecessors retire) · R96–R99 ratified.
Added by the plan: **no "trivial" exception** — a duplicated 3-instruction accessor is still one function (this project already
shares 5-instruction bodies; 341 tiny classes / 42,744 instances are in scope).

## Measured shape (this session; every number carries its rule; task 1 makes them an instrument)

- **Registry** (`config/dedup.us.yaml` via `dedup_integrate.group_members`): 2,220 groups / 255,708 members, all `h_exact`; 2,212
  shorthand (one vram + name for every member), 8 verbose; median 141 members; spans 2,207 ov / 12 md / 1 main; one group with
  differing member names (main's `clearTbl40` pair). Sources: `engine_core.h` 2,215 · `ov_setters.h` 3 (name-parameterized
  SETTER/RETCONST, the SC01_005≡006 pair) · `clearTbl40.h` 1 · `func_80144B9C.h` 1 (a 319-line ordinary-C header included by
  141 `<ov>_o0b.c` — already the target form; "a header-share is as valid as a macro-share", cookbook §38).
- **The header:** 5,147 `#define DEFINE_func_` lines = **3,516 distinct macros**; 1,631 defined twice (copy 1 inside the `#ifndef
  ENGINE_SHB` block ending at line 99,164, copy 2 after; 1,627 identical, 4 differ in one extern's `(void)` vs `()`; cpp keeps the
  LAST); **2,215 shared (all registered) · 218 single-site (217 of them in ov_SC03_015, 1 in ov_SC03_118) · 1,083 dead.** 4,600
  carry `extern` preambles, 451 asm-label aliases, 357 register pins (Phase 36's; kept verbatim), 0 `#if`, 0 `__LINE__`/`__FILE__`;
  exactly 8 non-`DEFINE_` directives (the prelude is provably complete). All macros zero-argument. Invocation sites: 255,947 lines
  in 3,153 files across 153 binaries; the site is always one line `DEFINE_func_X()  /* dedup: … */`; max 539 sites in one TU (p50 31).
  The charter's "5,147 macro bodies" counted define lines (R14/R41 correction, published at task 8).
- **Why include-at-site is byte-neutral and a separate object is not:** a macro expands AT THE SITE to `[externs + definition]`,
  so its `extern`s become file-scope declarations at that line and later functions rely on them (cookbook §112; decision-log
  :441-457). An include reproduces the text at the same point. **Probe P1 (run): three real bodies compiled both ways through
  cpp → cc1 → maspsx → as give byte-identical `.o` files (1,632 B, identical relocations); cc1 adds only a `.file` directive that
  `as` consumes.** A separate `.c` object would delete ~4,000 declaration lines from ~3,153 TUs and cannot place interleaved
  functions (shared and local bodies interleave in address order, `src/ov_SC06_033/ov_SC06_033.c:1-31`). `src/shared/` is not
  pruned from main's source find (Makefile:841-847) → shared bodies are `.h`. `-MMD` tracking (:849-855) recompiles on header edits.
- **Backlog, from the 218 fleet sig files (362,389 instances; 255,937 macro sites · 105,262 inline definitions · 1,190 alias-form
  unaccounted):** h_exact classes with ≥2 instances fleet-wide: **10,180 (280,801 instances)**; registered 1,994 hashes / 2,220
  groups; **206 registered classes have 3,996 instances not listed as members** (never extended); unregistered classes with ≥2
  inline copies: **7,956 classes / 20,038 copies / 12,082 collapsible copies / 478,773 ins** — 4,259 same-vram (9,698 copies),
  **3,697 cross-vram (10,340 copies; the member's own name differs per site → deferred)**, 54 cross-space. Under the old propagate
  rule alone: 11,289 copies / 1,932 addresses / 5,083 bodies. Source text across copies: **91% identical, 8.3% (403 bodies) differ**
  (`uniquify_type` suffixes, extern scoping, 9 with pins) → one chosen text re-gated per member; type-carrying bodies via
  `tools/lift_types.py` first.
- **Twin binaries:** five overlay pairs have IDENTICAL payloads (equal `config/check.*.sha`): SC04_018/019, SC03_118/119,
  SC03_014/015, SC02_000/003, SC01_005/006 (10 of 141 aliases; 136 distinct payloads); their piles ≈ 7,900 of the 11,289
  same-vram copies (~70%). Each twin's yaml differs from its primary's only in `target_path` (+ a carve delta: SC04_019 has one extra
  `_jr_80181804` split, SC03_015 two extra); `overlays.mk` blocks differ only by alias; the linker script names objects by alias.
- **Header-name collisions:** 6,346 of 13,355 overlay-slot vrams host >1 h_exact class fleet-wide (max 134) → a shared header
  cannot be keyed by address alone; of today's 2,220 groups, 1,961 get a clean name and 259 need a stable suffix.
- **Consumers:** 55 live tools reference the architecture; 22 text-parse the macro form; the rest ask cpp (form-independent) or only
  read the registry. Two would CRASH `make tools-health` on the header's deletion: `cdecl.audit_differential` (`tools/cdecl.py:1292-1323`
  opens `engine_core.h` unconditionally; `make audit-cdecl` is in the chain) and `overlay_src_split` (:667 degrades to a silently
  EMPTY macro table). 51 tools build `src/<binary>` paths themselves; only `compile_only.py` reads the Makefile's `<alias>_SRC_DIR`;
  `corpus.py:312` maps link objects to `src/{binary}/{subseg}.c`. `progress.py` undercounts ov_SC03_015 by 219 (single-site macro
  sites invisible to `classify()`) — a real undercount the phase corrects and publishes.

## Target architecture (decided)

```
src/shared/
  engine_prelude.h           # engine_types.h + ENGINE_SHB — every overlay/module TU includes this at line 2 (was engine_core.h)
  engine_types.h             # unchanged (tools/build_engine_types.py owns it)
  ov/            func_80128EA8.h · func_80150000__2905b55f.h     # the overlay slot 0x80128158
  slot_800CAE08/ … slot_801EF468/                                  # the 11 module slot bases, derived from <b>_VRAM_BASE (R33)
  main/          func_80037004__a0744d60.h                        # the clearTbl40 pair (the one intra-binary, name-parameterized share)
```
- **One plain-C header per shared body**, keyed by the h_exact class: directory = address space, filename = `func_<CANON_VRAM>` +
  `__<h8>` iff (space, vram) hosts >1 class fleet-wide or the class spans >1 vram/space — both predicates on immutable ROM data, so
  names are stable under later additions (R48: never a bare name). Flat per space (address-named files list in assembly order).
- **Body text** = the live macro's LAST definition, continuations stripped, re-indented; every `extern`, alias, comment and pin
  verbatim (asserted to round-trip to the same token stream). **Pure fragment** (no includes of its own; the prelude comes from
  the TU, sotn's contract). **No include guard** (a second include of a fixed-name header is the loud duplicate-definition error
  we want; the parameterized form legitimately includes twice). Banner: h_exact, canonical vram, "one source — instantiated by
  #include at each member's site; members: config/dedup.us.yaml" (no member count stored — derived, R51).
- **Two site forms, only two:** `#include "../shared/ov/func_80128EA8.h"` for same-vram classes; for the cross-vram control
  (clearTbl40 only in this phase) `#define SHARED_FN func_80037334` / `#include …` / `#undef SHARED_FN`, the header defining
  `void SHARED_FN(void) {…}`. More than two parameters → refuse (R43). The parameterized form is what the names phase will
  apply to the deferred cross-vram classes — clearTbl40 is its worked example and permanent negative control.
- **Single-site bodies** with no fleet-wide twin → inlined at their site as plain C; **dead macros** dropped (listed by name in the
  run log — counted, never silent); `engine_core.h`, `ov_setters.h`, `clearTbl40.h` deleted; `func_80144B9C.h` moved to `ov/`,
  its guard removed (one shape). End state: `src/shared/` = the prelude, `engine_types.h`, the per-function tree. Nothing else.
- **Twin binaries:** `config/overlays.mk` gets `ov_B_TWIN_OF := ov_A` and `ov_B_SRC_DIR := src/ov_A`; the Makefile maps a twin's
  objects to its OWN `build/src/ov_B/` from the primary's sources (`-O0` object lists and `.d` paths twin-aware; `check-all`'s
  per-binary parallelism never races); the twin's yaml = the primary's carve with its own `target_path`/`sha1`; its `check.sha`
  still proves it; `src/ov_B/` deleted. **One oracle "binary → source dir"** (Makefile-derived, R33) replaces the hardcoded
  `src/<binary>` shapes in the Gen3-live tools. The registry keeps twins as members (their site resolves through the oracle to
  the primary's TU); no per-function groups for twins.
- **Registry v2:** same file, same `group_members` oracle, shorthand kept; `source:` = the header path; `func:` = the defined
  token (`SHARED_FN` for the parameterized form, as `CLEAR_TBL40` is today); optional `form:`; **text-edited only, never
  `yaml.safe_dump`** (the H5 precedent that decimalized every vram and deleted 47 comment lines while every gate stayed green,
  `tools/dedup_extend.py:78-89`). `dedup_integrate --check` gains C2c (the source is under `src/shared/`, defines exactly one
  function, and `func` is the token it uses — via `cdecl`) and C2d (every member's site file includes the source and no inline
  definition of that member survives in the binary).
- **The S1 invariant** (permanent, in `make tools-health`): every same-(vram, h_exact) class with ≥2 instances is a registry group
  with the include at every member, or twin-covered, or a ledgered exception (`config/dedup_exceptions.tsv`: class hash · nins ·
  instances · reason code {JTBL-CARVE, O0-LOCAL, TU-CONFLICT, GATE-REJECT, PINNED, CROSS-VRAM-DEFERRED, CROSS-SPACE} · evidence);
  no `DEFINE_func_` token in `src/`; and a second, sig-blind oracle: no name-blind normalized definition text appears in >1 file
  under `src/` outside `src/shared/` (R34 — it cannot fail the way the sig join fails).

## The three tools

**`tools/share_census.py`** (permanent; T1) — inputs: the 218 sigs enumerated from `dup_report.BINARIES` (refuse on a missing
sig; never a glob — `.run/` holds 223 sig files incl. two non-fleet ones), the registry, `src/` through the source-dir oracle.
Source-form index: every sig instance resolves to exactly one of def / include / param-include / stub / asm-verbatim / linked /
blob — 0 or ≥2 forms is a coverage DEFECT (R32; strictly stronger than `progress.py`'s `unplaced`, which is vacuous where
`asm/<bin>/nonmatchings/` does not exist). Verdicts per class: A registered-complete · B registered-but-site-missing · C
unregistered-identical-text · D unregistered-differing-text · flags E cross-vram · F cross-space; `--json`, a human table,
`--check` (S1 + the text oracle, exit code), `--selftest` (an in-memory fixture of 2 binaries × 7 classes covering every
verdict, R39). Negative controls on the real tree: `func_80144B9C` = A/141; clearTbl40 = A+E; the 3 ov_setters = A;
`ov_SC01_005` = 657 unregistered items (S75 said 557 at 174 binaries; printed with its denominator, R41).

**`tools/macro_to_header.py`** (ONE-OFF; T3) — `--plan` / `--dry-run [--diff]` / `--apply --binaries …` / `--verify`
(idempotence: a second apply changes 0 files). `macro_index()` keeps the LAST definition (reusing `macro_draft.extract`'s
dedent/continuation strip, `tools/macro_draft.py:31-43`; the 4 divergent names cross-checked against `blocker_probe.py:83-90`'s
independent list); `directive_audit()` asserts the 5,147 + 8 directive inventory before touching anything; `site_index()` refuses
any site not of the one known shape; `header_path()` per the naming rule; `emit_header()` asserts token-stream round-trip;
`rewrite_tu()` (line 2 → the prelude; each site → its include, relative to the TU's own directory); `inline_single_site()`;
`drop_dead()`; registry `source:`/`func:` rewritten surgically. Asserts no emitted header carries a stray trailing `\`.

**`tools/share_body.py`** (permanent; T5 — the successor of `dedup_propagate` + `dedup_extend`) — `--plan [--bucket] [--limit]`,
`--apply --plan-file`, `--extend --binaries` (the never-extended 206 classes). Per class: exemplar = the registry's source if
registered; else the majority name-blind text; tie → pin-free; tie → shortest (the rule printed with every share). Guards reused
(R33): `family_hseq.has_mid_jr` → JTBL-CARVE; the `-O0` split guard (`dedup_propagate.py:676-687`, extended to `_o0b/_o0c`) →
O0-LOCAL; the inline-type guard (:750) → `lift_types` first. Sites replaced at the same position with the function's own
preamble (the `overlay_src_split` Item model). Then **L0 per TU** (build that one object before/after the batch's edits in that TU;
byte-equal, the Probe-P1 oracle; the exact per-TU recipe asked of the Makefile via `parallel_gate.generated_paths`' `--eval`
trick, never re-derived) → on failure bisect within the TU, drop the member, ledger the compiler's message class → **L1**
`make check BINARY=` per touched binary → register (shorthand) → **commit (R42)** → **L2** clean fleet per batch. "shared" is
printed only from the gate's success line (R66). Library surface: `onboarded_overlays`, `load_sig`, `sym`, `find_site`,
`registered_addrs` moved verbatim so the three importers of `dedup_propagate` change one line.

## Tasks (in order; one commit each; effort per `docs/effort-map.md`; every verify line read by exit code, R53/R97)

**T0 — Open + ground (Low, then Max for the probe).** `CURRENT_PHASE.md` with this plan verbatim; DIGEST §3 gets R96–R99 in full;
`.gitignore` allowlists `.run/P35/`; harness task list (R28). The R22 baseline from clean: `make clean && make extract-all JOBS=16 &&
make check-all JOBS=16` → `check-all: 218 passed, 0 failed of 218`, wall time recorded; `make tools-health` OK. **The probe (R37):**
in a scratch worktree, convert ov_SC06_033's 34 TUs by hand-driven script and run the L0 object A/B on all 34 (+ `make check
BINARY=ov_SC06_033`), measuring the `.d` growth and the per-TU cpp saving. Verify: `34/34 objects byte-identical`; `[ OK ] … (BYTE-IDENTICAL)`.

**T1 — `tools/share_census.py` + `config/dedup_exceptions.tsv` (Max; new instrument).** Built BEFORE anything moves so every claim has
a before/after. SETUP + dictionary rows (R21/R87). Verify: `--selftest` → `7/7 verdicts correct`; `--json` on the unchanged tree prints
the class counts above with their denominators, and the four negative controls; coverage line `classified == instances`.

**T2 — Teach the health chain the new forms while the old tree is still green (Max design, xHigh apply).** The source-dir oracle
(`corpus.src_dir(binary)` from the Makefile's `<alias>_SRC_DIR` — one function; `compile_only.src_dirs` folded in); `corpus.py` (definitions
may live under `src/shared/**.h`; :312 through the oracle); `cdecl.py` (`audit_differential` includes `src/shared/**/*.h` when
`engine_core.h` is absent; `MACRO_STMT` :109); `overlay_src_split.py` (+ `jr_isolate_all`: an include-site anchor kind; header-resident
bodies; :667 becomes a loud refusal); `progress.py` (`classify()` recognizes an include of a `src/shared/` path as the definition the
registry names for that site; the fold at :773 becomes `shared = real ∩ dedup_members` — derived from source, R33); `dedup_integrate.py`
(C2c/C2d; the oracle for `_src_paths`); `audit_binaries.py` (the prelude include; twin citizenship: equal `check.sha`, `SRC_DIR` = the
primary's, primary not a twin, carve equal — R36); `lint_symbol_refs.py` (:89 recursive glob); `shared_lock.py`; `fix_arity_callers.py`
(:41); `family_remap._unit_from_macro` → read the header; `blocker_probe.py`; `demacroize.py` (`macro_bodies()` reads headers);
`export_pairs.py`; `harvest_verify.py:167`. Both forms accepted during the transition. Verify: `make tools-health` OK on the UNCHANGED
tree (the negative control) and `share_census --selftest` still 7/7.

**T3 — Twin binaries → one source directory (Max for the mechanism on the probe pair; xHigh for the other four).** Probe SC01_005/006
(carves already equal): the `TWIN_OF` declaration, the Makefile mapping, the twin's yaml = the primary's carve with its own
`target_path`; delete `src/ov_SC01_006/`; `make extract BINARY=ov_SC01_006 && make check BINARY=ov_SC01_006` → `56760dbe…`;
`ov_setters.h`'s three groups become twin-covered (the header goes at T4). Then SC03_118/119 and SC02_000/003 (carves equal), then
SC04_018/019 and SC03_014/015 (adopt the primary's carve for the twin; R60: `interleave_check` + `pads_audit` on the twin). One commit
per pair; the clean fleet run after the last. Verify per pair: the twin's `make check` sha line; after all: `share_census` twin-covered
copies ≈ 7,900, same-vram backlog copies fall by that count, ov_SC03_015's 217 single-site macros become dead.

**T4 — The conversion: `tools/macro_to_header.py` applied fleet-wide; `engine_core.h` deleted (Max for the tool; xHigh to run).**
Order: `--plan`, `--dry-run` reviewed; `--apply --binaries ov_SC06_033` + L0 + `make check`, commit; the remaining binaries in ~8
batches of ~27, each L0-gated (`obj A/B: N/N byte-identical`); then delete `engine_core.h` / `ov_setters.h` / `clearTbl40.h`
(clearTbl40 rewritten as the parameterized control), move `func_80144B9C.h`, rewrite the 141 `<ov>_o0b.c` includes; the registry's
`source:`/`func:` rewritten surgically; L2. Verify, in order: `--verify` → `idempotent: 0 files would change`; L0 fleet `N/N`;
`check-all: 218 passed, 0 failed of 218`; `git grep -c '^#define DEFINE_func_' -- src` and `git grep -cP '^\s*DEFINE_func_' -- src`
empty; `tools/audit_text_sources.py` OK (every new include resolves in-repo); the fleet build wall time vs T0's baseline (the 8.8 MB
header no longer preprocessed per TU); `share_census`: 2,215 registered classes intact, the 1,083 dead listed, the fleet function
count +219 (ov_SC03_015's correction — published at T8 as a corrected undercount, never buried).

**T5 — `tools/share_body.py` + the same-vram backlog (Max for the tool; xHigh for the runs; batched largest reach first).** Bucket 0:
`--extend` the 206 never-extended classes (3,996 instances). Then the same-vram buckets: 32+ members same-text (1,899 classes / 4,234
copies / 249,554 ins) → 32+ differing-text (168 / 760 / 55,820) → 16–31 (1,033 / 2,231) → 8–15 (986 / 2,106) → the tiny classes
(no trivial exception). Per batch: `share_body --apply` → `banked N/M classes, K copies collapsed; J gate rejects` → `check-all: 218
passed` → commit. Differing-text bodies: one chosen text per the rule; type-carrying bodies: `lift_types` first, retry; what still
fails is ledgered with its message class (budget ~2–5% of sites). **Cross-vram classes are not touched** (listed by T1; published at
T8 as CROSS-VRAM-DEFERRED with their count and copies). Verify at task end: `share_census --check` → same-vram unregistered copies 0
(or = the ledger's count, each with a reason).

**T6 — Consumers, second half: freeze / retire / the guard (xHigh).** Drop macro-form support from the T2 set; FREEZE the 7
matching-era parsers (`family_sweep`, `gen_harvest_targets`, `p16_improve`, `recover_giant`, `restore_dropped_decls`,
`normalize_self_decls`, `o0_subsplit`) with one shared refusal in `main()` — never at import (`cdecl.audit_differential` imports
`gen_harvest_targets`; an import-time exit would take the health chain down) — dictionary status `FROZEN`, successor named; RETIRE
the 3 direct predecessors to `tools/sunset/` (`dedup_propagate`, `dedup_extend` → `share_body.py`; `macro_draft` → product: the
headers) after repointing their 9 callers (`gate_stage.py:522`, `bulk_harvest.py:267`, `auto_driver.py:140`, `lora_grind.py:230`,
`gate_lane.py:86`, `grinder.py:351`, the 3 importers); the guard in `tool_census.py --check`: every LIVE, non-FROZEN tool parsed
with `ast` — no non-docstring string constant contains `DEFINE_func_` or `engine_core.h` (prose mentions in comments/docstrings are
historical record and survive; 4,570 `DEFINE_func_` mentions in `src/` comments are deliberately not rewritten). Negative control
(R39): on the pre-T4 tree the guard flags exactly the 22 parsers and none of the comment-only tools; flipping one row to FROZEN
un-flags it. `make kit-corpus`, SETUP rows (R21). Verify: `tool_census --check` → `macro-form guard: 0 LIVE tools reference the
retired form (7 frozen, 3 retired)`; `make tools-health` OK.

**T7 — Wire the invariants + regenerate every published number (xHigh).** In `make tools-health` after `report BINARY=main`:
`share_census.py --check` (strict) + `--selftest`; `dedup_integrate --check` C2c/C2d. `progress.py`: two generated fields
(`unique_function_bodies`, `duplicate_source_copies`) in `docs/progress.json` and the README block (:1146-1166) sourced from the
census; `progress.py --readme --check`, `timeline.py`, `make audit-digest` (the +219 correction stated with its cause). Negative-
control the new gate: in a worktree revert one member's site to an inline copy → `share_census --check` exits 1 naming that class.
Verify: `make tools-health` OK; `progress.py --readme --check` fresh.

**T8 — The record (xHigh).** Wiki: `The-dedup-engine.md` rewritten as the shared-source model (headers, twins, the census, the
sotn fact as read), `Repository-layout.md`, `Where-the-project-goes-next.md`, `Verification-and-progress.md`; how-to ch.10 (the
Gen3 outcome; history kept); README:117 prose; `gen3-standards.md` §4 row + DoD line and `gen3-handoff.md` §2.2/§3 as dated
snapshots with the derivation; a cookbook section replacing §14/§38's macro narrative; `docs/decision-log.md` P35 (R31: the
2026-09-02 reversal with the sotn evidence, the 5,147-vs-3,516 miscount, the twin discovery, the +219 undercount);
`docs/accelerators.md`; DIGEST §4; `tools/sunset/README.md` rows; the memory `dedup-backlog-leave-it` rewritten; `doc_links --strict`,
`wiki_render --selftest`, `cookbook_index --check`, `kit_coverage`. Verify: doc_links 0 broken / 0 pending; the checks green.

**T9 — Close (Max, Tier 1).** R22 clean fleet run → 218/218; `make tools-health` OK (S1 strict + the guard); the metrics table
before/after (macro lines 5,147 → 0; `engine_core.h` 8.8 MB → deleted; same-vram duplicate copies → 0 + ledger N; twins 5 pairs /
10 aliases; cross-vram classes deferred N / copies M; registry groups 2,220 → ~6,500; fleet build wall time; the +219); the
reviewer sequence documented; `PhaseEnd_Phase35.md` + DIGEST §0/§2/§3 + the log archived (R19), left for Drew's close commit; v2.1.0.
Rules check (P6) after T3 and T7.

**Effort:** Max for T0's probe, T1, T2's design, T3's probe pair, T4's and T5's tool, T9; xHigh elsewhere; **no Ultracode** (the
parallelism is machine parallelism: L0 at JOBS=16 ≈ 13 min fleet-wide; the clean fleet run 3–5 min). **Sessions (R41, summed from the
task sizes above): T0–T1 ≈ 1 · T2 ≈ 1 · T3 ≈ 1 · T4 ≈ 1 · T5 ≈ 1–2 · T6–T7 ≈ 1 · T8–T9 ≈ 1 → ≈ 7–8 sessions;** the tail is the
differing-text and type-carrying bodies and the consumer edits, not the gates.

## Which gate proves which step
| step | gate | the line that banks it |
|---|---|---|
| one TU converted/shared | L0 object A/B (Probe P1) | `obj A/B: N/N byte-identical` |
| one binary | `make check BINARY=<b>` | `[ OK ] build/<b>/<b> … (BYTE-IDENTICAL)` |
| a batch / the phase | `make clean && make extract-all JOBS=16 && make check-all JOBS=16` (R22) | `check-all: 218 passed, 0 failed of 218` |
| the registry is honest | `tools/dedup_integrate.py --check` | `dedup-check: N validated, 0 failed` |
| the invariant holds | `tools/share_census.py --check` | `S1: one source per unique function — …, 0 unregistered, N excepted` |
| no live tool assumes the macro form | `tools/tool_census.py --check` | `macro-form guard: 0 LIVE tools reference the retired form` |
| everything | `make tools-health` | `tools-health: OK — …` |

## Milestone (gate 2 — what Drew confirms, each with its literal output)
1. `git grep -c '^#define DEFINE_func_' -- src` empty; no `DEFINE_func_X()` site; `src/shared/engine_core.h` absent; every registered
   body a plain-C header under `src/shared/<space>/`.
2. `tools/share_census.py --check` exit 0: same-vram duplicate copies 0 (or each ledgered with a reason); the five twins built from one
   source directory each; cross-vram classes published as a deferred count.
3. `make tools-health` OK with S1 strict and the macro-form guard; every consumer updated, frozen or retired per its dictionary row.
4. `make clean && make extract-all && make check-all` → `218 passed, 0 failed of 218` (R22).
5. README/wiki/kit regenerated (R75), decision log (R31), SETUP rows (R21), PhaseEnd + DIGEST written.

## Verification (the reviewer's sequence from a fresh clone, documented at T9)
```
make bootstrap
make clean && make extract-all JOBS=16 && make check-all JOBS=16   # 218 passed, 0 failed of 218
make tools-health                                                   # tools-health: OK — …
tools/share_census.py --selftest && tools/share_census.py --check    # S1 … 0 unregistered, N excepted
tools/tool_census.py --check                                         # macro-form guard: 0 LIVE …
tools/progress.py --readme --check                                   # docs/progress.json + README block are fresh
git grep -c '^#define DEFINE_func_' -- src                           # (no output)
```

## Risks — settled by probe, or carried with its probe
Settled: include-vs-macro byte identity (P1, `.o`-level); the 4 divergent twins (last wins, uniform: copy 1 < 99,164 < copy 2);
`__LINE__`/`__FILE__` absent and no `-g`; the prelude's completeness (the 5,147 + 8 directive inventory); header-name collisions
(the stable suffix rule); `ld_interleave` never reads C. Carried: `.d`/file-count growth (measured at T0; fallback a `vram>>12` fan-out,
mechanical since paths are generated); a backlog site's TU rejecting the exemplar text (L0 localizes; ledgered); the registry text
edits (never `yaml.safe_dump`); the health-chain crash on deletion (T2 lands before T4); pins spread by a share (the exemplar rule
prefers pin-free; PINNED is a ledger class, never a spread).

## Rules at gate 1
**R96** (a) a scratch prune is an instrument change — re-run every tool that writes under it before calling the prune done.
**R97** (b) "green" is read from a check's EXIT CODE, never its last line; every chain sets `pipefail`.
**R98** (c) a step that hands a file to a third party is proven through that party's own toolchain on the file itself before the
owner's browser session, and the proving tool writes the paste.
**R99** (d) what a public tree carries is decided before the flip; a retired document gets its Archive-index row and is deleted in the
same commit — history keeps it.
Candidate for the PhaseEnd: "a shared body has exactly one source; a duplicate copy is a defect the health chain asserts, and a
count of them is published with its rule" (this phase's invariant).
**Candidates from S95 (the recovery):** (b) "every commit that advances a task — an intra-task bank included — carries its log line and
the 🛑 headline; a checkpoint older than the last commit is a dead session's checkpoint" (S94 refreshed the block at every TASK close but
made two T5 bank commits with no log line, then filled its context during a background wait; the successor rebuilt 35 minutes of state
from the transcript). (c) "a tool that restores files never uses `git checkout` on a tree it did not commit — it restores from its own
snapshot" (share_body's bisect wiped the previous batch's uncommitted shares; R42 for tools). (d) "a failure-cause extractor is
negative-controlled against the compiler's real message forms, not against the word error" (gcc 2.7.2 prints errors without it;
254 of 303 rejection lines read `Error 33`).

## 🛑 SESSION CHECKPOINT — S96 close (2026-09-08): Phase 35 COMPLETE — T0–T9 ☑ (+ T5b); PhaseEnd_Phase35.md written, this log archived; NEXT = Drew's close commit, then Phase 36 (pins) in a fresh session at Max, plan mode

### 0. How to use this block
A fresh session (S97) reads CLAUDE.md's load order, replays THIS block verbatim, asks Drew for `/effort max` (T9 is Tier 1: the PhaseEnd
synthesis), and executes §2. Every task's literal verify lines are in the log above (append-only, one entry per step); the numbers below
are copied from those entries — re-derive any you publish (R75). The tree is CLEAN at **HEAD `ce837b1e4`** ("T8 — the record"); Drew
pushes (R6). The context guard (`~/.claude/ctx_guard.sh`, PostToolUse, user settings) fired at 90 % and this block was written at once.

### 1. Where things stand
- **Done, committed, gated:** T0 open/probe · T1 `share_census` · T2 the health chain learns the include + twin forms · T3 five twin pairs
  → one source dir · T4 every macro body a header, `engine_core.h` deleted · T5 `share_body` (bucket 0: 183 classes → 135 shared / 48
  ledgered; bucket new: 915 → 914 shared / 3 ledgered; the E_func_80168B70 re-exemplar) · T5b the `h_text` tier (38 classes / 2,030
  sites) · T6 14 tools FROZEN, 4 retired, the macro-form guard · T7 S1 strict + C2c/C2d in tools-health, the digest fields and
  corrections · T8 the record. Sessions: S94 (T0–T4 and the start of T5; died at 91 % without a checkpoint), S95 (the recovery, no runs),
  S96 (T5 → T8). Commits since the open `48170fd7f`: `git log --oneline 48170fd7f..HEAD` (≈50).
- **The last gates on this tree:** R22 `check-all: 218 passed, 0 failed of 218` from clean at `ac8c29edb` (`.run/P35/baseline/r22_t5b.log`,
  90 s; T6–T8 after it changed tools and docs only — T9 re-runs it anyway); `make tools-health: OK` at `ac8c29edb`
  (`tools_health_t5b.log`, 439 s) with `S1: one source per unique function — 10,180 classes, 10,180 satisfied (3,507 twin-covered, 51
  excepted, 3,801 deferred cross-address), 0 VIOLATION(S) — OK`, `dedup-check: 3173 validated, 0 failed | C1 coverage 262573/262573`,
  `macro-form guard: 0 LIVE tools reference the retired form (217 scanned, 14 frozen, 6 whitelisted detectors, 38 retired)`; after T8,
  `doc_links` strict 0 broken, `wiki_render` 32/32, cookbook index 1,170 sections OK, `kit_coverage: OK`, `tool_census --check: OK`.
- **Open by design (recorded, not owed):** 51 ledgered classes / 160 copies in `config/dedup_exceptions.tsv` (50 TU-CONFLICT — the late
  overlays' declaration conflicts, the types phase's; 1 GATE-REJECT `E_func_801376E8`); 3,801 cross-address classes deferred to the names
  phase (E flag 3,826), including 381 same-address tiny-body texts / 1,668 copies inside them (the parameterized `SHARED_FN` form is
  their shape). The Ghidra MCP: launched by the hook, unused all phase — stop it via `tools/ghidra_mcp_stop.sh` before the close commit
  (R23). Disk ≈ 30 GB free.

### 2. T9 — the close (Max; one session; leave the deliverables UNCOMMITTED for Drew's milestone-close commit, R6)
1. `/effort max` confirmed. `make clean && make extract-all JOBS=16 && make check-all JOBS=16` → `check-all: 218 passed, 0 failed of 218`
   by exit code (`.run/P35/baseline/r22_t9.log`); `make tools-health` in the FOREGROUND (≤ 600 s; ~440–550 s) → `tools-health: OK` with the
   S1 line, dedup-check 3173/0, the guard line (`tools_health_t9.log`).
2. **The metrics table (before → after)** for the PhaseEnd, each cell from its command: macro define lines 5,147 → 0 (`git grep -c
   '^#define DEFINE_func_' -- src` empty; `git grep -cP '^\s*DEFINE_func_' -- src` empty); `src/shared/engine_core.h` 8.8 MB / 227,730 lines
   → deleted; shared headers 2,215 (T4) → 3,175 (`find src/shared -name 'func_*.h' | wc -l`); registry groups 2,220 → 3,173 (38 `h_text`),
   instances 255,708 → 262,573; same-address backlog 1,099 classes / 4,755 private copies / 3,658 collapsible → 51 / 160 / 109, all
   ledgered; S1 10,180 / 10,180, 0 violations; twins 5 pairs / 10 aliases / 166 files deleted; cross-address deferred 3,801 classes;
   `unique_function_bodies` 103,015; the fleet denominator 363,221 → 363,680 (+459, cause in the T6 part-2 entry) and REAL 360,744 →
   350,533 (empty-bodied shared functions now EMPTY); instruction-weighted metrics unchanged (13,492,113 / 5,820,205 / 45,150); fleet
   clean-run wall 157 s (T0) → 84–90 s; 14 tools FROZEN, 4 retired; `docs/progress.json` `corrections` (3 entries).
3. **The milestone (gate 2), item by item with literal output:** (1) `git grep -c '^#define DEFINE_func_' -- src` empty, no
   `DEFINE_func_X()` site, `engine_core.h` absent, every registered body a header under `src/shared/<space>/` (`dedup_integrate --check`
   C2c); (2) `tools/share_census.py --check --strict-macros --strict-text` exit 0 — same-vram copies 0 or ledgered, the five twins from one
   directory (`make audit-binaries` CHECK 3b), the cross-vram count published; (3) `make tools-health` OK with S1 strict and the guard;
   every consumer updated/frozen/retired per its dictionary row (`config/tool_dictionary.tsv`); (4) R22 218/218; (5) README/wiki/kit
   regenerated (T7/T8), decision log (T8), SETUP rows (T1–T7), PhaseEnd + DIGEST written (this task); v2.1.0.
4. **The reviewer sequence** (document it in the PhaseEnd's Build Log): `make bootstrap` · `make clean && make extract-all JOBS=16 && make
   check-all JOBS=16` · `make tools-health` · `tools/share_census.py --selftest && tools/share_census.py --check --strict-macros
   --strict-text` · `tools/tool_census.py --check` · `tools/progress.py --readme --check` · `git grep -c '^#define DEFINE_func_' -- src`.
5. **Write `phase-ends/PhaseEnd_Phase35.md`** (the format in PROJECT_CONTEXT.md; the P33/P34 files are the exemplars; R25 plain-English
   recap; "what we believed / what failed / what we'd do sooner"; the sessions' cost in agents: none — no subagents this phase; the
   S94 death and the S95 recovery as a Deviation; the plan's "7 frozen" → 14 and "3 retired" → 4; T5b added; the E_func_80168B70 and
   the 38-text decisions delegated to Claude at Max). **Rule candidates for Phase 36 gate 1 (P10), from §"Rules at gate 1" + the log:**
   (a) a shared body has exactly one source; a duplicate copy is a defect the health chain asserts and its count is published with its
   rule (the phase's invariant); (b) every commit that advances a task carries its log line and the 🛑 headline; a checkpoint older than
   HEAD is a dead session's checkpoint; (c) a tool that restores files restores from its own snapshot, never `git checkout` on a tree it
   did not commit; (d) a failure-cause extractor is negative-controlled against the compiler's real message forms, not the word "error";
   (e) build the disagreeing oracle (R34) BEFORE the batch runs and measure its disagreement before believing either side — the text
   oracle found in one run what the byte join could never class; (f) a registry lists a member only after the gate has spoken for it
   (never ahead of the source); (g) a policy taken on a remembered precedent is a belief — read the target project's tree.
6. **DIGEST:** append the P35 synopsis to §2, the ratified R96–R99 are already in §3 (T0), refresh §0's "where the project stands" (Phase 35
   closed, v2.1.0, Gen3's next = Phase 36 pins per Drew's order dedup → pins → structs → names), §4 already has the P35 map (T8).
7. `git mv phase-ends/CURRENT_PHASE.md phase-ends/logs/Phase35.md` (R19); `make kit-corpus` so the kit's record copies (the DIGEST, the new
   PhaseEnd, the log) stay equal; leave PhaseEnd + DIGEST + the moved log + the kit corpus UNCOMMITTED with the commit message written in
   the PhaseEnd; stop the Ghidra MCP; final message per P8; HARD STOP — no Phase 36 preview.

### 3. Numbers to re-derive, never trust
Every figure in §2 step 2 has its command there; the S1 line and the registry counts come from `share_census --check` /
`dedup_integrate --check`; the digest from `tools/progress.py --fleet`; the header count from `find`; the frozen/retired counts from
`config/tool_dictionary.tsv` (`grep -cP '\tFROZEN\t'`, the sunset README rows).

### 4. Gotchas that cost something this phase (the log has each with its verify line)
1. `share_body.py` runs on a COMMITTED tree, one batch per invocation; its bisect restores from an in-memory snapshot (never `git checkout`).
2. gcc 2.7.2 error lines carry no "error" token; `Error 33` is cc1's fatal exit — read the `file:line: message` form.
3. A twin's instance resolves to its primary's TU — dedupe edits by (tu, line); the census counts distinct TUs.
4. `add_members_surgical` refuses the verbose `members:` form; `--repair-registry` converts and completes; matches on (binary, vram).
5. `make kit-corpus` belongs in every commit that edits a tool, the DIGEST, a PhaseEnd, the cookbook or the how-to; the kit's lint refuses
   rule ids (`R42`) and project names in authored kit text.
6. The timeline's last row follows the COMMITTED digest: commit `docs/progress.json` first, regenerate the timeline in the next commit.
7. `make tools-health` in the foreground (~440–550 s); `share_census` cache is keyed by mtime/size — `--no-cache` after a scanner edit.
8. A `grep` guard in a `&&` chain exits 1 on zero matches (twice this session); `;` before `git commit` let a partial commit through once (R97).