BFM-decomp/decomp-architect/corpus/decomp-kernels.md

Decomp kernels — what a matching decompilation learns late, distilled for day one

Growing it (ProjectArchitect's corpus rule, restated): when a decompilation run under this kit matures, fold its genuinely transferable, project-agnostic lessons back into this file — never a project-specific body — and keep the id scheme and the coverage line at the bottom current. A kernel that recurs across more projects is stronger evidence that it is general. Entries carry no game name, no address, no rule number of the source project outside the provenance: line; the source project's measurements live only inside ```calibration fences, so a reader calibrates rather than copies.

How to read a kernel. Kernel is the takeaway; when it applies names the moment on the phase ladder; cost is what the source project paid for learning it late, or saved once it existed. The intake document's phase ladder cites kernels by id (DK-n) as the reason each phase sits where it does; the registry seed's rules (G-n) are the conduct these kernels produced. The test for a kernel, from the source project's own how-to: if it would still be true for another console and another compiler, it belongs here; if it is a fact about one compiler or one game, it does not.

---

1. Order — what to build before the first crack

DK-1 — Keep the game's bytes out of git from the first commit, private or not

• Kernel: decide the public/private boundary on day one and enforce the ROM firewall from commit one. A private repository is not an exemption: the bytes end up in every clone, every worktree, every host-side cache, and the only way out is a full-history rewrite.
• When it applies: Phase 0, before the first extraction.
• Cost: a few weeks of convenience against a rewrite of the whole history, two rehearsals, an archive repository, a force-push, a host-support ticket and a daily probe of the host's object store.

source project: relaxation lasted 2026-06-10 → 2026-09-06; 4,031 commits rewritten, verified pair by pair; the host
still served the old tips after the force-push (157 activity rows).

provenance: BFM retrospective §4 item 1; R74; P33 blocks C1–C9

DK-2 — A committed extraction manifest and an all-assembly byte-identical baseline before any C

• Kernel: extract deterministically with a committed manifest of hashes (the manifest is also the audit's source of forbidden hashes), then reassemble the disassembly to the original hash with the check inside the build. Only then write C. The baseline proves the split, the linker script and the toolchain end to end while there is nothing to reconcile.
• When it applies: Phases 1 and 3.
• Cost: near zero when done first; every later structural change is priced by what has been matched since.

source project: baseline on day 5; the link was clean and the assembler was byte-clean at the first try.

provenance: BFM PhaseEnd 2 / PhaseEnd 5; how-to chapter 03 Phase 0

DK-3 — Pin the compiler by evidence from the binary, down a candidate ladder

• Kernel: read the library version stamps in the image, pick idiom-revealing probe functions, and run the candidate ladder (compiler builds × assembler versions × flags) until one reproduces the bytes. Never inherit a sibling project's triple; pass the assembler's compatibility version explicitly; expect per-module variation.
• When it applies: Phase 4, the day after the baseline.
• Cost: a wrong era produces systematic near-miss diffs on every function; one silent flag default can do the same.

source project: the sibling project's compiler was one generation older; one division-expansion flag was mandatory
and found only by the ladder; the assembler's default emulated the wrong version.

provenance: BFM G8; PhaseEnd 6; the constitution's "wrong compiler era" risk

DK-4 — Build the whole-binary byte gate before the drafting harness

• Kernel: the pattern that scales is many cheap drafters plus an incorruptible whole-binary gate that accepts only byte-identical output. The gate is what makes model quality a throughput question instead of a correctness risk, and it is what makes cheap models usable at all. Build it the day the baseline is green.
• When it applies: Phase 5 (before any wave).
• Cost: every function matched before the gate existed was matched by hand.

source project: gate built at phase 12 of 33; the first harness run took one binary 1.4% → 85.6% in a session.

provenance: BFM accelerators A2

DK-5 — Build propagation the moment a second binary exists

• Kernel: the moment two binaries are onboarded, ask how much identical code they share and build the match-once-stamp-everywhere path (a shared header instantiated at every member site, byte-gated per member, a fail-closed registry). Every crack compounds from match #1 with it; without it every match is worth ×1.
• When it applies: Phase 6, before harvesting.
• Cost: the largest leverage the source project left on the table through ordering alone.

source project: ~138 position-locked copies of one shared engine; one match banks up to 138 members; 2,220 dedup
groups / 255,708 instances at the end; the overlay structure was known at phase 3, propagation matured at phase 15.

provenance: BFM accelerators A3; how-to chapter 03 Phase 2

DK-6 — Read the compiler's source once, into a codegen map, right after the pin

• Kernel: spend one deliberate session reading the compiler's allocator, scheduler, loop and CSE passes into a catalogue of pass → residual pattern → C-level lever, with a triage table keyed by the tell in the diff. It converts per-function reverse-engineering into cheap lookup usable by mid-tier models. Its highest-value entries need no matched function; they can be mined in week one. If the source does not exist, build the same catalogue from systematic probes.
• When it applies: Phase 7, before the first "unsteerable" verdict.
• Cost: phases of re-deriving the same allocator behaviour per function and calling classes unsteerable that the map later dissolved.

source project: the map arrived at phase 23 and was available from phase 6; a frontier agent reading four files
produced it for what one hand-cracked giant used to cost (375–475k tokens); giants of 400–770 instructions then matched.

provenance: BFM accelerators A4; how-to chapter 07; retrospective §4 item 2

DK-7 — Build the integration layer before the drafting layer

• Kernel: once cracking is systematic, every bank failure is translation-unit plumbing: declaration conflicts, def-side signatures, symbol spellings, file placement, table carves, vendor objects. Build the reconcile ladder (declaration sync, callee casts, canonical signatures, the carve chain, a real-TU probe) before the waves, and budget for banking rather than cracking.
• When it applies: Phase 6.
• Cost: the dominant token spend of the campaign phases went to re-drafting bodies that were already byte-correct.

source project: ≈92% of drafts byte-correct, ≈27% banked at one measurement; with the codegen map, 11 of 12 first-pass
drafts matched and every failure was plumbing.

provenance: BFM decision-log 2026-07-24 (S15); how-to chapter 10; retrospective §4 item 3

DK-8 — Census the corpus SHAPE with fixed instruments before choosing a strategy

• Kernel: before picking an approach, measure duplication, structural families, the reach × size distribution and the unique tail — with scanners that assert their coverage, a second oracle on anything that steers strategy, and a known-true case checked first. A wrong shape measurement costs phases, not hours.
• When it applies: Phase 5.
• Cost: a "families cannot be automated" doctrine that steered two phases was a broken tool's 0% next to a fixed tool's high yield on the same measurement.

source project: 0% vs 89% on the same family, broken vs fixed probe; seven silent-skip defects found by the first
coverage audit (phase 26).

provenance: BFM how-to chapter 03 Phase 1; accelerators A1; R32/R34/R35

DK-9 — The differential-oracle harness at 0%

• Kernel: run the same question down two independent paths on a schedule and fail loudly on disagreement: matched? (source scanner vs built binary); compiles? (standalone vs real translation unit); fleet green? (incremental vs clean); scanner coverage? (its count vs an over-approximating set); agent produced work? (its verdict vs its scratch directory); bankable? (the draw filter vs the wall oracle). It is the only accelerator that works before a single function is matched, and its value grows with every tool added.
• When it applies: Phase 5, and every close thereafter.
• Cost: each one-off diagnosis of a harness defect is a large agent investigation; a nightly disagreement report is minutes of compute.

source project: ten-plus blockers in one session, every one a true number about a narrower world, every one caught by
a disagreement; 90k–290k tokens per one-off diagnosis; about half of a late session went to harness defects wearing
model-failure costumes.

provenance: BFM accelerators #15 (P31 S68); how-to chapter 04

DK-10 — The similarity join is a band, not a point — and every hash is audited for both error directions

• Kernel: dedup wants under-matching (a wrong merge is a visible duplicate bank); a frontier join wants over-matching (a missed neighbour is an invisible singleton). One hash cannot serve both. Build the near tier (relocations normalised out, a sound prefilter on length and opcode histogram, edit distance on the survivors) at the same time as the exact tier; verify it reproduces every exact pair; control against random pairs for the base rate; rank candidates by work (a deletion is free, a substitution is thought) and filter lookalikes.
• When it applies: Phase 6, with the first banks.
• Cost: invisible-singleton debt that accumulates from the first bank and looks exactly like "this function is unique".

source project: exact hash 22 of 352 reachable open stubs; the band 75 of 352 — 3.4× — on a corpus believed fully
mined after 60+ sessions; 31 pure relocation-only twins; base rate 1.17%; lookalike filter at ratio ≥ ~0.3 removed
17 of 30 "cousins".

provenance: BFM accelerators #17; generic-decomp-package 2b

DK-11 — Regroup the residue by structure before calling it unique

• Kernel: when the remaining work looks like a wall of unique functions, try a looser fingerprint (an instruction skeleton with relocations and immediates masked). Structural families are TEMPLATES, not free dedup: cracking one makes the rest fast, not free, and the ceiling is translation-unit type collisions.
• When it applies: as soon as a fleet of similar binaries exists.
• Cost: an endgame estimate off by an order of magnitude.

source project: a "36,000 unique hand-decompiles" frontier regrouped into ~986 families (90% collapse); remaps later
measured at 88% (exact hash) and 80% (normalised) — a "families are SPENT" verdict had been true of one tier only.

provenance: BFM accelerators A6; how-to chapter 10

DK-12 — Set translation-unit boundaries at the build's forced boundaries, at segmentation time

• Kernel: a compiled object contributes one contiguous read-only-data run, so a code unit whose switch tables sit in two non-adjacent spans can never bank its other switch functions. Before writing the first subsegment list, dump the data island, mark every jump table, group the contiguous spans, map each span to the functions that reference it, and put the initial unit boundaries there — and at the other forced boundaries (per-file optimisation levels, interleaved library objects). Split where the BUILD forces it and nowhere else; never on archaeology about the original file layout. The general principle: a structural decision that is evidenced from raw data, cheap now and strictly more expensive later is made early even though its payoff is unproven — the opposite of "probe before investing".
• When it applies: Phase 2–3, at 0% matched.
• Cost: the price of a split grows monotonically with the declarations that will cross the new boundary.

source project: the split was free at phase 6 (13 externs) and cost 57 crossing declarations, 19 moved typedefs and a
compile-error loop at 94% matched; eleven functions had been recorded as "proven gate-rejects" that banked the moment
the carve existed; the fleet check then flagged 4 more binaries holding 16 open functions / 3,613 instructions.

provenance: BFM accelerators #20 (P31 S72); split_indicator

DK-13 — The load map as a controlled, regenerable table, the day the loader is understood

• Kernel: once the per-binary loader wrapper is named, build payload → owning binary → load address as a table regenerated from the bytes and gated by byte-proven control rows. Onboarding a binary then needs one lookup instead of sessions of hand derivation. Absence from the map is not evidence that a payload is dead — several load routes exist.
• When it applies: Phase 2 (prerequisite: the loader wrapper + at least two proven control rows).
• Cost: multiple sessions per binary deriving a load address by hand; five payloads parked for months.

source project: the map arrived at phase 30; the five parked payloads onboarded on their first static candidates once
a base-evidence tool existed (controls 7/7).

provenance: BFM accelerators A7; PhaseEnd 32 T2a

DK-14 — Seed the knowledge base before the first match

• Kernel: two sources exist before any function is matched: the compiler's own source and sibling projects on the same compiler family. Carry a cookbook across as the starting corpus and adapt it rather than rebuild it. Do the first distillation by hand — its vocabulary decides whether anyone finds it later — and key the index by symptom, because that is what the worker has in front of it.
• When it applies: Phase 7.
• Cost: every idiom re-bought by a later wave that could not find the earlier lesson.

source project: the highest-value late idioms came from four files of the compiler's source, none needing a matched
function; the mature harvest found ~85% of agents' "gap reports" already covered — the base knew, the agents could not
find it.

provenance: BFM generic-decomp-package 1; how-to chapter 06

DK-15 — The permuter runs from the first close draft, and its failures are mined

• Kernel: an LLM-free, CPU-bound search over a close draft closes register-allocation and scheduling residuals on a different budget from everything else; it should be grinding the near-miss backlog from the first close draft. Verify it actually runs on your drafts (a loop that reports "unchanged" must prove it iterated). Then mine its failures: classify each plateau deterministically from the bytes into missing-transform (extend the mutation set — a permanent offline win), mis-classified (fix the routing), seed-structural (redraft) or genuine wall.
• When it applies: Phase 7; the classifier before the backlog is large.
• Cost: a month of "permuter-class plateau" verdicts that measured nothing.

source project: the permuter had silently never run on pinned or K&R seeds (436 stored drafts refused for four
phases); 91% of the open backlog carried no class label when the classifier was written.

provenance: BFM how-to chapter 03 Phase 2b; accelerators S80 (1)

DK-16 — The widening review at every close

• Kernel: tooling is correct when written and goes stale as new idioms reveal populations it cannot see. At every session and phase close ask which scanner's denominator just got wider? — new idioms retroactively convert already-open functions into free banks, but only if a tool is widened to see them. Harvest → widen → bank the free functions → checkpoint, in that order, as a pipeline step and not as hygiene.
• When it applies: every close from the first wave on.
• Cost: free banks left invisible; an in-flight escalation paid for a class the base already knew.

source project: one idiom review reclassified ten functions / 1,027 instructions in an afternoon and stopped one
escalation mid-spend.

provenance: BFM generic-decomp-package 4; accelerators #15 (the scheduling half); memory "harvest + toolify before the next wave"

---

2. Instruments — a true number about a narrower world

DK-17 — Instrument integrity before measurement, as a standing habit

• Kernel: any number about to scope real work — a coverage percentage, a "wall", a "cheap win", a zero-hit scan — gets its instrument verified before the number is believed. Cheapest form: every scanner asserts its coverage against an over-approximating candidate set, and every oracle structurally blind to an error class gets a second, disagreeing oracle.
• When it applies: always; formalised at Phase 5.
• Cost: strategic reversals.

source project: four reversals — a families-at-0% verdict (a missing build step), a ~3% ceiling (a compile-flag
artifact), four hidden overlays and ~39 modules (a glob at one payload layer), a class of "compiler beat us" walls
(the scanners).

provenance: BFM accelerators A1

DK-18 — A scanner must model the producer's addressing forms; exactly-zero is a decoder gap

• Kernel: before trusting a scanner's negative, hand-disassemble one known-good case and confirm the scanner sees it; keep that control in the tool and fail the tool if it cannot reproduce it. A register-tracked reference scan is blind to forms where the address is split across an upper-half load and the memory access with an index add between; an exactly-zero result is more often a decoder gap than a discovery.
• When it applies: the first time you scan for cross-references.
• Cost: an evening lost to a phantom hunt and a written, wrong structural conclusion in the address ledger. provenance: BFM accelerators A5 (S46)

DK-19 — Make the tool state its own denominator

• Kernel: three shapes of the same defect. (a) A tool that derives a byte-exact fact from a pretty-printer inherits its liberties — assert the parsed count against the underlying size. (b) A refusal-check is measured against what the real pipeline does to the input, over work that already succeeded, not against a model of it. (c) An exclusion reason is a claim about the tooling on the day it was written — re-derive its premise from the bytes before accepting its conclusion.
• When it applies: every tool that parses a rendering, every refusal, every exclude list.
• Cost: invisible library objects, refused correct work, library code sitting as verbatim assembly for twenty phases.

source project: 25 objects / 3,877 instructions invisible to a parser that read 520 words of a 526-word object; a clash
pre-check refused 566 instructions of correct work; a Phase-8 "no single base" comment held three objects for
twenty-three phases.

provenance: BFM accelerators S77 (1)–(3)

DK-20 — A claim names the compilation it survived

• Kernel: stream or hash containment proves the bytes relate; a standalone compile proves the BODY; the real translation unit proves the body in context; the whole-binary gate proves this binary; the clean fleet run proves the fleet now. A report that says "verified" without naming its tier invites the reader to assume the strongest one; a claim derived from bytes is a prediction, not a bank.
• When it applies: every ledger row, every agent report.
• Cost: a "free banks waiting" list that gated zero; a "resid 0" that had compiled nothing.

source project: 10 of 32 "verified at closeness 0" gated 0 of 28 — every failure a declaration conflict in the real
unit; 8 of the 28 banked the moment the missing integration lever existed, for zero agent tokens.

provenance: BFM accelerators #16 and #18 (P31 S69)

DK-21 — A verdict from an isolated environment describes the environment

• Kernel: isolation (worktrees, sandboxes) makes the worker see LESS; every gitignored input, generated file or symlink is a difference between "works here" and "works there", and the worker cannot tell a genuine rejection from its own missing input. Negative-control the environment with a known-good item; enumerate and assert the worker's inputs; report a missing input as MISSING, never as a verdict.
• When it applies: the first parallel gate.
• Cost: a third of a frontier classified as blocked by an artifact.

source project: a gitignored signature registry absent from every worktree turned every table-carve draft into a
"carve refused" verdict; 21 of them had banked twins and banked in ~25 seconds each.

provenance: BFM accelerators #19 (P31 S69)

DK-22 — Prefer positively-affirmative checks; verify from the process, not the file

• Kernel: the checks that could not tell "working" from "not running": a comment between backslash-continued argument lines silently drops every argument below it (only a startup banner echoing the parsed values catches it); a process-name pattern matches the shell that issued it (anchor the pattern or kill by pid); a pipe through a tail-style tool buffers everything until exit (write to a file you can tail); telemetry that exists only in a log line is not telemetry (append-only ledgers); a running shell has already parsed its loop body, so editing the script changes nothing until a fresh shell starts. Know, for your runtime, which of code, arguments and per-invocation defaults takes effect when.
• When it applies: every long-running driver and lane.
• Cost: hours of lanes running on default arguments and old argument lists. provenance: BFM accelerators "harness self-inflicted wounds" 1–5 (P31 S58/S59)

DK-23 — Wire the null-input control into the failure path; one writer, one committer per shared file

• Kernel: a 0% gate yield is a statement about the instrument until a no-input control says otherwise. On the first batch failure, gate an EMPTY slate (build the committed tree with nothing substituted) before judging a single draft, and refuse loudly when the baseline itself is red. A shared mutable file needs one writer and one committer; any "commit whatever is dirty" adopter over a file another process substitutes into will eventually commit an unverified intermediate.
• When it applies: every gated pipeline.
• Cost: a day's lane output read as a model failure.

source project: ~737 drafts, 160 slated, ~50 clean whole-binary rebuilds burned while HEAD itself built red; the
40-second control would have named it.

provenance: BFM accelerators harness wound 6 (P31 S59)

DK-24 — All verdict layers wired before a remap lane ships

• Kernel: a lane that mass-produces candidates from a template needs its verdict ladder built FIRST — cheapest oracle to most expensive, every verdict consumed, every drop named. "An oracle exists but the lane does not consume it" is a defect with a per-pass machine cost.
• When it applies: Phase 6, before the first mechanical lane.
• Cost: consecutive zero-yield passes on a population that later banked for free.

source project: three consecutive 0-of-117 passes at ~25 minutes of gate machine each; after decomposition the same
population banked 64+ in one session at zero tokens.

provenance: BFM accelerators harness wound 7 (P31 S59)

DK-25 — Byte-locate the residual before blaming the draft; a green baseline per binary first

• Kernel: a byte comparison of the built and retail images, mapped through the link map, names the first misplaced symbol, its delta, section and object in minutes; address-named symbols carry the retail address in the name. And a per-draft verdict means nothing until that binary's baseline builds green on its own.
• When it applies: the first red gate.
• Cost: days of "cause not determined" ledger rows.

source project: one derivation turned 15 mystery walls into three named configuration repairs.

provenance: BFM accelerators #12 (P31 S61)

DK-26 — The cheap probe must call the real planner

• Kernel: when a lane is scoped by a cheap feasibility probe, check whether the expensive applier's DECISION half is separable from its MUTATION half and make the probe call the planner. An optimistic probe does not merely lose opportunities; it manufactures work plans, the expensive direction of the error.
• When it applies: every "can this be done?" probe.
• Cost: work priced as free that was plan-refused.

source project: 96 of 159 open table-carve functions were plan-refused; a previous session had priced 32 of them as
free work on the blind probe; the fix was eight lines.

provenance: BFM accelerators #14 (P31 S67)

DK-27 — Validate the target list; an empty tier terminates the pipeline

• Kernel: every target passes a validity gate before a wave (a real function boundary, assembly on disk, inside the binary's range, not already banked), and in any cascade a tier with nothing to work on ends the chain instead of passing its emptiness downstream — otherwise a phantom costs one agent per tier, the last at the most expensive model.
• When it applies: the first multi-tier wave.
• Cost: most of a wave spent proving phantoms absent.

source project: a 47-target wave burned 9.7M tokens for 20 matches; ~29 targets were not real; 87 of 119 agents proved
phantoms absent; the coverage assertion had refused the list and was routed around.

provenance: BFM accelerators A9 (S46)

DK-28 — "Produced but not consumed" gets an assertion

• Kernel: every X-produced / Y-consumed pair in a pipeline gets an assertion (produced − adopted − refused = 0), a non-zero exit on violation, and per-run evidence files that are not overwritten by the next run.
• When it applies: every pipeline hand-off.
• Cost: a bank that died with its worktree while the summary printed success. provenance: BFM accelerators S80 (4)

DK-29 — A byte gate is a null oracle for "is this C?"

• Kernel: a function's assembly spliced in as a file-scope inline-assembly body matches by construction, builds green by construction, and is counted by the progress tool. Run a strict verbatim check in the per-bank close, and never let a ledger's best draft be an assembly body.
• When it applies: from the first bank.
• Cost: a fake bank and a census one function off. provenance: BFM accelerators S80 (2); R62

DK-30 — A headline percentage ships its remainder

• Kernel: every headline % is published with its remainder, and the remainder is reconciled against an independently derived list of what is actually open. One subtraction catches a denominator carrying the wrong population.
• When it applies: every progress report.
• Cost: a wrong headline standing for weeks.

source project: "59.8%" stood six weeks with ~32,000 instructions remaining against a frontier that summed to ~4,000 —
the denominator carried 31,000 linked-library instructions.

provenance: BFM accelerators S78 (2)

---

3. The campaign

DK-31 — Census what is already drafted before drawing anything

• Kernel: join the wave manifests, the filesystem and the corpus oracle to answer "is there already a draft for this open function?" for zero tokens, and classify each draft in its real translation unit at the optimisation level the target shipped with (a verdict at the wrong level is pure artifact). The classes route themselves: match → gate; compile failure → the recovery ladder; near → the permuter; far → redraft.
• When it applies: before every draw.
• Cost: agents re-deriving work already on disk or already banked.

source project: 193 of 530 open functions already had a draft, 37 byte-correct in their real unit; ~109 of 240 agents in
two waves re-derived existing work; wiring the shipped optimisation level turned 8 "near" verdicts into 6 matches.

provenance: BFM accelerators #13 (P31 S67)

DK-32 — Wire the read side of agent journals with the write side

• Kernel: if agents produce a per-item report, the next agent on that item must be handed it. An archive of your own verified outcomes is training data for your own tooling, and the write side feels complete on its own because the notes are being saved.
• When it applies: the day agents first write structured notes.
• Cost: the hardest functions re-attacked with the same levers wave after wave.

source project: 400 journals / 6,658 records / 896 distinct index-gap reports unread for thirty phases; with the notes on
the card, 38 of 39 matched on the hardest frontier and 4 of 39 recovered a body that had already matched.

provenance: BFM accelerators "the agent journals" (P31 S71); memory "journal notes are pack fuel"

DK-33 — Parallelism defaults for fleet-wide tools

• Kernel: return every verdict a sweep already computed (not the first failure); processes for CPU-bound work and threads only for subprocess waits; longest-first scheduling with results re-sorted into the caller's order; per-item search when independence is argued, not assumed; a fixed temp path is a correctness bug the day two workers run; seed a pool with one in-process result before fanning out. The acceptance test is a regression — revert, re-run the identical command, require the same output and a byte-verified fleet — not a stopwatch.
• When it applies: the first tool that iterates the fleet.
• Cost: a slow gate is a bug, and a serial one hides over-exclusion.

source project: propagation 24 → 11.4 minutes with +62 member instances (the faster path was also more correct);
threads kept 0–4 builds alive at load 3 on 32 cores, processes 14–29 at load 34.75; `-j` on a single build 7.18 → 1.18 s.

provenance: BFM accelerators A8; memories "gating speed playbook", "pass -j to every build", "fleet-tool parallelism defaults"

DK-34 — Agents write deliverables early; one JSON line last; harvest a dead session by tool

• Kernel: the draft file first, the verdict last, the final message exactly one JSON line with prose in a report file. Agents outlive the session that spawned them; a coordinator that reads prose results dies mid-wave; the recovery path is the transcripts, by tool, never memory.
• When it applies: the first agent wave.
• Cost: verdicts stranded in a dead session; re-drafting functions whose match sat in a transcript.

source project: 22 verdicts (two matches worth 724 instructions) unprocessed until a successor replayed the transcripts;
two of eleven harvested agents were matches worth 765 instructions.

provenance: BFM R67; accelerators S80 (5), P32 T3 (1)

DK-35 — Per-item work directories; a deliverable directory no agent cleans

• Kernel: each agent works in its own directory keyed by binary and address, may clean only that, and never runs find, remove or move outside it; deliverables go to a directory no agent owns.
• When it applies: the first parallel wave.
• Cost: sibling deliverables swept away by one agent's tidy-up. provenance: BFM P32 T3 (2); R48

DK-36 — The build is the batch verdict

• Kernel: a per-draft oracle is blind to cross-draft integration (two drafts spelling one global differently, a data block only the stub defined, a prototype a sibling bank added between verification and splice). Bank per translation unit: verbatim grep → the real-TU probe for every draft in the CURRENT unit → splice all → ONE build → hash → commit only on green, leaving the tree for diagnosis on red. Two sentences in the drafter's brief (define any data block your stub owns; spell shared symbols exactly as the unit does) make the next agents self-serve it.
• When it applies: the first batched bank.
• Cost: a batch that failed twice with eleven of twelve drafts individually correct. provenance: BFM accelerators P32 T3 (5)

DK-37 — A live probe file in the source tree is build input

• Kernel: a tool's temporary file under the source directory is picked up by the build's file discovery; guard at the consumer (exclude dotfiles in the build's find) so every probing tool is covered at once, and list any probe that must live there.
• When it applies: the first concurrent probe.
• Cost: a false batch failure and a wasted rebuild. provenance: BFM accelerators P32 T3 (7)

DK-38 — A pointer-only callee's declaration is a guess; re-probe in a sandbox unit

• Kernel: a declaration that exists only because the unit takes the function's address carries no signature information; read the unit's own declaration of the function before touching the body, and treat a block-scope declaration of a struct pointer as a block-local tag no file-scope definition can match. Re-probe a compile failure in a COPY of the unit under scratch (symlink the headers beside it) rather than by editing the source tree.
• When it applies: the first "conflicting types" refusal.
• Cost: dozens of drafts against a declaration that constrained nothing.

source project: 37 drafts died on a 45-instruction function that was byte-correct on its first try; three of seven
"pinned walls" failed only for declaration reasons, reproduced in a sandbox with zero commits.

provenance: BFM accelerators S80 (3), P32 T4 (8)

DK-39 — The card is fuel, not a ticket

• Kernel: the unit of work handed to a model carries everything the project already knows that bears on it, assembled deterministically at zero token cost: the target and its destination file; an already-matched sibling with the same skeleton (the banked twin, found over the WHOLE world, ahead of the open one); what the destination file already declares; the project-wide declaration consensus per callee; the function's own past-attempt history; the lever the atlas believes applies plus where to read about it; the same-unit neighbours' declarations of shared globals. And the pack must be where the agent is told to read it.
• When it applies: the first wave.
• Cost: the twin field alone moved a wave from zero banked to fifty-one; a misplaced laws file silently degraded every wave's brief for weeks.

source project: banked-twin-on-card 4 of 4 on a control draw and 15% fewer tokens at 64% of the wall-clock on the next
wave; one agent spent 102k tokens re-deriving a function banked verbatim in another binary.

provenance: BFM how-to chapter 05 "The card"; R44

DK-40 — Lanes with different clocks; free work before paid work

• Kernel: drafter, gater, maintenance, watchdog, distiller and each excluded population run as independent, restartable lanes with their own rates; the drafter is the clock-limited resource and is never stopped to ship a change. Mechanical zero-token work (twins, remaps, propagation) runs in its own lane whenever the paid lane is idle. Collapse same-skeleton members to one card and defer the siblings to the free remap.
• When it applies: the first campaign.
• Cost: idle time from stopping the wrong lane; an excluded population that got no attention while the fast loop starved for work items.

source project: 139 of 162 idle minutes from stopping the drafter to ship a change; drawn one-per-skeleton, 71 agent
slots carried 19,266 instructions of potential of which 4,954 sibling instructions banked mechanically the same session.

provenance: BFM how-to chapter 05 "Lanes" and "Free work before paid work"; memory "autonomous lane architecture"

DK-41 — Gate the directory, never the verdict list; reconcile before any rebuild; recover before re-drawing

• Kernel: score every draft file the wave produced and assert coverage (banked + failed + no-verdict == drafts) before recording a row. After a gate group's drafts land, one deterministic reconcile pass over that group's slate precedes the rebuild (two targets sharing a unit create each other's conflicts). After the gate, triage failures into body and plumbing, bank the plumbing ones through the ladder, and only then record the wave's yield — the gate number is not the close rate.
• When it applies: every wave.
• Cost: matches reported as nothing; walls hunted that were not there.

source project: a byte-identical 579-instruction match reported as nothing by a driver that grepped its child's output;
5 of 8 at the gate became 8 of 8 after deterministic recovery for ≈0 tokens; 26 of 27 rejections on one slate were
byte-perfect drafts.

provenance: BFM how-to chapter 05 steps 6, 6b and "Then recover"

DK-42 — Instruction weight, not head count; concentration is a draw-time choice; card supply binds

• Kernel: the metric to beat is pool realisation in instructions, not bank rate in heads — a wave banking every head of a small pool is worth less than one banking half the heads of a large one. The number of whole-binary rebuilds a wave needs is chosen at draw time by concentrating targets per binary, and it is the wall-clock lever. And for most of a campaign the binding constraint is work items, not model capacity: reach for more cards before more workers.
• When it applies: every draw.
• Cost: waves optimised for a flattering rate; workers added when work items were the shortage.

source project: 16 of 16 heads / ≈7,200 instructions against 7 of 16 heads / 10,616 instructions; gate groups 5 → 7 → 9
then 3 once the draw concentrated (drafts per rebuild 7.8 → 24.3); a whole "thinning frontier" was a default flag
excluding one lever lane (607 of 1,179 members).

provenance: BFM how-to chapter 09 "Instruction weight" and "The gate's cost"; chapter 08 "Budgets"

DK-43 — Budget per lane; measure the routing cliff; the strongest model for new wall classes only

• Kernel: run a small manual wave first and measure bank rate by instruction count — that is the routing cliff, and the first hand-waved boundary will be wrong. Cheap tiers are honest filters (every claimed match was real) but never the gate. Escalate sooner: a cheaper tier run into a wall costs the failures and then the escalation. The strongest model is for genuinely new wall classes — an unsolved tooling problem, an adversarial review, a residual no documented lever reaches — briefed with every measured number, the files to read first and the house rules; it is NOT for reviewing a corpus against an existing knowledge base, and its one outright win was reading the compiler's source.
• When it applies: Phase 8, the first waves.
• Cost: the wrong tier at both ends.

source project: the cheap tier's success fell from 86% to 20% across the size range; a 100-worker A/B put cheap
drafters at the same match rate as the strong tier under ~50 instructions at ≈4.8× lower cost per match; 63 claimed
matches were 63 real; a local 7B model saturated the ≤15-instruction population for $0; the most expensive single row
was a 655k-token frontier agent on a function whose answer was a grep.

provenance: BFM how-to chapter 08; memories "subagent model ladder", "cheap-tier A/B validated", "fable agents for lane tooling"

---

4. Compiler walls

DK-44 — Attribute the residual to a pass with a dump line before sweeping levers

• Kernel: a residual's first artifact is the compiler's own dump line that owns it — the scheduler's ready list, the loop optimiser's desirability line, the allocator's priorities and hard-register assignments, the reload pass's choices, the hazard walk. Dump from the REAL translation unit (a standalone compile is not faithful on units with many declarations). A wall verdict without a pass and a dump line is a hypothesis.
• When it applies: every compiler-internal residual.
• Cost: thousands of variants sweeping the wrong lever family.

source project: six of seven wall citations named the wrong pass; 22 hand spellings and ~4,000 agent sweeps measured
nothing; nine of twelve rows then banked from one dump line each.

provenance: BFM accelerators P32 T4b (10)/(11); R65

DK-45 — A producer census before a spelling sweep; the reproducer battery per ghost species

• Kernel: enumerate from the compiler source every site that can produce the artifact (a phantom stack slot, an extra callee-saved register), refute each on the bytes or a dump, and only then sweep spellings; "PROVED" is the table with every row refuted, and it names its list. Build the one-second battery of five-line reproducers for every species of the artifact — including species not yet in the cookbook — before probing the real function.
• When it applies: every "proved unmatchable" verdict.
• Cost: two sessions of real-function probes against an answer a five-line function gives in seconds.

source project: two formal proofs each one producer short; 18 reproducers found the first missing producer (a combine
pass's self-update bookkeeping gap) and an 8-variant sweep the second (the loop optimiser's user-variable rule with the
CSE pass's later-mention canonicalisation); the banks were a three-statement chain and a three-times-read invariant.

provenance: BFM accelerators P32 (12), (15); R69, R73

DK-46 — Port the banked sibling's spelling; grep the idiom's constants; objdump the hit's window

• Kernel: when a same-family sibling is banked, port its body with the target's constants before touching a dial — a residual-class name is the family's signature, not a lever list. Before any scheduling or allocation dial on a packet-building function, grep the source for the idiom's literal constants and objdump each hit's window against the target: a same-shape sibling with different base registers scores as a stranger in every similarity metric.
• When it applies: every hand pass, step zero.
• Cost: the most expensive rows of the endgame.

source project: one row matched first try after three agent passes, a 135-variant sweep and a hand pass on a
five-dial draft; another after an Opus pass, a 655k-token frontier pass with 3,360 variants, five pins and a fence —
the answer was a 0.55-scored "weak cousin" found by grepping one constant.

provenance: BFM accelerators P32 (13)/(14); R71/R72

DK-47 — Read the allocation order before any register lever; pins are symptoms

• Kernel: the callee-saved bank is the global allocator's priority order (references weighted by live length); print the allocation table from the real unit's dumps first. The number of uses the target's register order implies is a hard constraint on the C; a register pin only masks it, and every pin comes off once the source shape is right.
• When it applies: every callee-saved-register residual.
• Cost: forty variants steering a value into a register that its use count forbade. provenance: BFM accelerators P32 (16); memory "don't conclude unsteerable — try register pins" (superseded by the shape rule); R73

DK-48 — A lever that measures worse may be a cascade

• Kernel: on any regression of a mechanism-grounded lever, diff the pass dumps for a SECOND change before discarding it — the lever's saving may have flipped a hoist past a desirability threshold, paid back with a pad. Instruction-count pads are a dial re-counted after every in-loop change.
• When it applies: every "the right lever made it worse". provenance: BFM accelerators P32 (9)

DK-49 — Read a permuter waypoint's diff both ways

• Kernel: a waypoint with a semantic mutation (a wrong-width load) may still carry the sound levers that are the whole answer: diff it against the seed, drop the unsound hunk, re-measure the remainder; then re-spell any uninitialised-read trick as well-defined C that keeps the bytes.
• When it applies: every rejected or accepted waypoint. provenance: BFM accelerators P32 (6); R63

DK-50 — Provenance → archive → link → compiler; "no single base" means partition

• Kernel: before a wall verdict on a band of a mixed binary, score every vendor signature set you hold against it (the disassembler's loader often ships per-version signature files that name the library, the version and every function without the archive); fetch the archive the signatures name; link it. A vendor object refused for "scattered common data, no single base" is a partition problem: cut the section into per-base pieces along the producer's own symbol structure in the shared link-prepare path, and confirm every cut against an independent oracle.
• When it applies: the first "compiler wall" inside a library band.
• Cost: wall verdicts on code you were never going to compile.

source project: twelve walls with proofs attached were the vendor's controller library, a 383 KB archive away; the
signature files had sat on disk since phase 1; three objects held for twenty-three phases closed 3/3 in an afternoon
of ELF surgery, including one a probe had certified as a genuine wall.

provenance: BFM accelerators S78, S79, S79 (2)

DK-51 — A converged multi-agent plateau is not a mechanism proof

• Kernel: five agents agreeing on a residual with a "proven" mechanism is a claim; two same-unit neighbours may document the exact fix. The pack carries the neighbours' DECLARATIONS of the shared globals, not only their bodies, and a plateau verdict names the exemplar it was checked against. Route a row to the frontier tier when its blocker is an unread compiler pass, and to a mid tier once a sibling's recipe exists.
• When it applies: every multi-agent plateau.

source project: two functions closed in one pass each after eight agent attempts across two sessions; a frontier pass
banked 9 of 12 completed rows where every prior tier had 0, at ≈325k tokens per row.

provenance: BFM accelerators P32 (3), (10)

DK-52 — The source-version trap

• Kernel: the compiler source in community circulation may be a later version than the one that built the game — behavioural differences and line-number drift large enough to land inside a different function. Stage the vanilla source of the pinned version, and audit every citation line by line, each refutation challenged independently.
• When it applies: the day the codegen map starts.

source project: the circulating "2.7.2" tree was 2.8.1; the audit of 135 citations: 119 confirmed, 40 line-drift, 7
refuted of 21 raised.

provenance: BFM how-to chapter 07 "The source-version trap"; the gcc-map citation audit (P33 E3)

---

5. The repository and publishing

DK-53 — Rehearse every irreversible repository operation; positive assertions, pair by pair

• Kernel: a history rewrite is proven on a scratch copy by comparing every rewritten commit with its original: purged paths absent AND kept files identical AND the pruned set equal to the derived set. Absences alone pass on corrupted output.
• When it applies: any rewrite, purge, or mass move.

source project: the first rehearsal caught an empty-blob id in the strip list that silently undid every "file emptied"
change across 4,000 commits, and the unchanged-commit case; the real run had 0 failures.

provenance: BFM R76; P33 C1

DK-54 — Linked worktrees pin history

• Kernel: every linked worktree's HEAD is a ref that survives a garbage collection; audit and prune them before any gc or purge, and never create gate worktrees without a reaper.

source project: twelve forgotten gate worktrees (12 GB) pinned 3,729 old commits.

provenance: BFM R77; P33 C9

DK-55 — A "read-only" probe that fetches is a writer

• Kernel: a check that fetches, clones or builds does so in a throwaway and ends with a self-check that the guarded repository is unchanged.

source project: the purge probe re-imported 5.97 GiB of the purged history into the guarded repository on every run.

provenance: BFM R81/R57; P33 S89

DK-56 — The host publishes pre-force-push tips

• Kernel: enumerate the HOST's metadata surfaces (activity views, event feeds, pull-request refs, caches) in the rewrite design, not only the repository's content; gate a visibility flip on the old objects being gone, or recreate the repository. provenance: BFM R82; P33 S89

DK-57 — Numbers generated, never typed; commits cited by date and subject

• Kernel: every published figure is produced by a tool that asserts the published copy is fresh; a prose number is a dated snapshot with its command; long-lived documents cite commits by date and subject because a rewrite changes every hash.

source project: every hand-typed number in the old README was stale; 1,238 hash citations had to be resolved through a
commit map after the rewrite.

provenance: BFM R75; P33 D1/C8

DK-58 — Outward text is a person's; no automated traffic against community infrastructure

• Kernel: filtering AI tells out of model prose makes an upstream contribution worse, not acceptable — the dense code-span formatting and exhaustive structure are the giveaway. The maintainer writes every outward word from a facts list, short and plain, after reading the target's AI-contribution policy. Community services are used by a person in a browser; anything repetitive is replicated locally.
• When it applies: every issue, pull request, post and outreach note.

source project: a permuter pull request and its issue were closed the same day by a maintainer who read them as
machine-written and said why it cost him; a sibling project forbids autonomous-tool pull requests outright.

provenance: BFM R83; gen3-standards conduct; failure museum row 37

---

6. Governance and sessions

DK-59 — The checkpoint is written to be replayed, not summarised

• Kernel: the number-one failure mode of a long multi-session agent project is a fresh session misreading a compressed hand-off. The in-phase checkpoint carries paths, commands, hashes, tool invocations with their gotchas, a file inventory and the exact next step, and the next session replays it verbatim; every perishable artifact is already in a file before the block is written; a dead session's checkpoint is reconstructed by its successor from the transcripts.
• When it applies: every session boundary.

source project: the last thirty sessions resumed without a question; one earlier hand-off nearly closed an open phase.

provenance: BFM R64; memories "checkpoint CURRENT_PHASE before pausing", "checkpoint = everything already banked"

DK-60 — Measure the steady state; report every lane; quote the denominator

• Kernel: bucket a metric over time before calling it a ceiling; a status check covers every lane with its own metrics; every rate, cost and EFFORT estimate ships with what it is a fraction of — a count that is true of an unasserted scope nearly defers real work.

source project: half the false ceilings of one phase were launch bursts; "2,318 externs to fix" nearly deferred 39% of
the main executable — 57 crossed the line.

provenance: BFM R41; memories "measure the steady state", "report every lane", "quote the denominator"

DK-61 — A known-true case before reading any instrument's output

• Kernel: test every scan, join, census and verdict on one case whose answer is already known before reporting it.

source project: five of one session's biggest "findings" were artifacts of the instrument, each caught only this way.

provenance: BFM memory "check against a known-true case" (P31 S75)

DK-62 — The human gate

• Kernel: automation fills between the gates; it does not replace them. Nearly all of the work was the agent's, and every wrong DIRECTION was caught by a person at a plan or milestone gate — a re-charter, a "everything that is not vendor code or original hand-assembly must be C" directive, an in-place-flip decision. provenance: BFM retrospective §5; hindsight principle 7

DK-63 — Capture the why while it hurts

• Kernel: the terse "what changed" record survives a context boundary; the why evaporates. The decision log entry (context and belief → what failed → the pivot → the measured why → the hindsight path) is written during the session that learned it, and the PhaseEnd carries the narrative axis — what was believed, what failed and why it looked right, what it cost, what to do sooner — because the transcripts die and the retrospective is rebuilt from the files. provenance: BFM R31; memory "PhaseEnd verbosity serves the retrospective"; the retrospective's own method

---

7. Readability at day one

DK-64 — Readability is done at draft and bank time, not after 100%

• Kernel: the community's bar for a decompilation (a full naming scheme, typedefs, a formatter, decimal for counts and hex for masks, a marker on every match-forcing trick, "better unnamed than named wrongly") is met at the moment a body is banked, gated exactly like the match was. Six inversions of what the source project did after the fact: pins recorded at draft time and marked if kept; shared bodies as C files per system from the first propagation; types canonical at bank time; names with recorded evidence; formatting installed with the first C file; file layout by system with unit boundaries decided at segmentation time. A matching decomp that is bytes without understanding is the community's specific complaint about machine output; the inversions are the answer.
• When it applies: from the first bank (Phase 6); the intake's Part C.
• Cost: a whole generation of byte-neutral rework after 100%.

source project at 100%: 43,925 register-pin declarations; 5,147 shared bodies as macros in one 8.4 MB header; 1,232
struct definitions, many drafter-invented variants of one type; 16,335 address-named functions and 61,898 address-named
data symbols; 3,558 of 4,287 C files carve splits; no formatter configuration; almost no comments.

provenance: BFM gen3-standards (2026-09-07) + gen3-handoff §2.2; the sotn-decomp style guide read as data

DK-65 — Types are a banking lever and a width lever — and, in gcc 2.7.2, a struct MEMBER is a scheduling lever too

• Correction (source project, Phase 37 T2, 2026-09-12): the kernel below was written from Phase 17's measurement, which tested a decompiler's drafting with a struct in context — not the spelling of a matched body. On the bytes, *(T *)(p + k) and p->f are NOT the same code in gcc 2.7.2: a member/array access carries MEM_IN_STRUCT_P (expr.c:4568-4577, :4888), a cast on a sum does not, and the scheduler's alias escape (sched.c:837-865) and cse's kill table read that flag. A struct-spelling probe on 165 matched bodies was byte-neutral on 90.6 % and moved instructions on the rest; a per-site minimal kept-cast set closed every one. So: a canonical type layer still pays as a banking and width lever from the first bank — and it must be introduced under the byte gate, per access, never by a blanket rewrite that assumes neutrality. The name still moves nothing; the SPELLING can.
• Kernel (as first written): a type name never moves a byte — the compiler does not care what a field is called — and the source project measured exactly that early, correctly, and then drew the wrong second conclusion: that types could wait until after 100%. Read the other way, its record says types are the largest banking lever it underweighted. Banking, not cracking, was the bottleneck, and a large share of gate failures were declaration conflicts — a signed halfword against an unsigned one, one arity against another, a structure a drafting agent invented in isolation because there was no registry to draft against — so the tree filled with variants of a few shapes and a whole reconcile ladder was built to repair what a canonical type file would have prevented. And the one place a type does touch bytes is width and signedness: a halfword load's sign, a pointer arithmetic scale, a narrower accumulator that stops a value being re-read; the permuter cannot change a type, so every width near-miss was dial work until the declaration was right. The achievable early form is a discipline, not a census: a canonical type file from the first bank that grows one proven field at a time, the width and signedness fixed by the bytes at bank time, with no draft allowed to bank a duplicate definition of an existing shape or a raw address cast, and names only with evidence. It costs one duplicate-definition and raw-cast check per bank; it removes most of the declaration-conflict class before a ladder is needed, lowers the width class of near-misses on the first pass, and leaves nothing to unify after 100%. It would not have shortened one compiler-pass crack — do not expect it to.
• When it applies: from the first bank (Phase 6, the multipliers) — the type layer is part of what makes drafts bank; Phase 10 is short when it held.
• Cost: a reconcile ladder built reactively; a generation's struct unification and raw-cast removal after 100%.

source project: rich decompiler context (the recovered actor structure + the jump tables) scored 0 better / 10 same /
2 worse on a 12-function structural-miss sample, identical bytes (phase 17) — right for cracking; ≈92% of drafts
byte-correct and ≈27% banked at one measurement, declaration conflicts a large share of the gap; 1,232 struct
definitions in the tree at 100%, most of them variants of a few shapes; 143 raw address casts; the width class
(a u16 accumulator as a CSE firewall, an object-table symbol declared u8, the scaffold's ×4 pointer arithmetic) in
the last hand cracks (phase 32).

provenance: BFM decision-log "P33.5 S91-b" (the hindsight on types, 2026-09-07); struct-core-pivot.md (2026-06-19); cookbook §501-N/§501-R

---

8. Added by the coverage and log-mining passes — the record's residue

The kit's coverage check derives every rule and every hindsight entry of the source project and refuses one that is neither cited by a provenance line nor dispositioned; the three kernels after it are what that check found in the record and nowhere in the kit. The twelve after those come from a pass that read every phase worklog of the source project once more (some thirty thousand lines, one read-only agent per slice) for lessons banked in none of its distilled records — 777 candidates, 634 already banked, 143 new, clustered here by theme. Each provenance line names the worklog lines the lessons came from.

DK-66 — A ledger's tie-break, a checker's widening and a blanket commit are part of the instrument

• Kernel: three bookkeeping choices around an oracle that changed its verdicts without anyone reading them as part of it. A ledger that keeps the earliest record at equal closeness can never render a re-verdict — the tie-break IS the instrument. A link checker that widens its document set must classify a missing promised target as pending, never broken (a forward link registered with the task that will create it), and the pending list must be empty at a phase close — otherwise every new page is a false failure or the check is turned off. A blanket "commit the dirty tree rather than revert it" is right for the source tree, where a bank must never be lost, and wrong for configuration, where it adopts a collapsed file and takes a binary red with it.
• When it applies: any ledger with a best-of ordering; any checker whose input set grows during a phase; any committer that stages more than the paths it changed.
• Cost: a re-verdict that never appeared; a docs check that would have gone red on every planned page; a config collapse committed as a backup.

source project: the backlog ledger's earliest-record tie-break hid a re-verdict (one session); the link checker's pending list
carried 10 planned pages mid-phase with 0 false failures; one blanket commit adopted a collapsed overlay config.

provenance: BFM R70 (the ledger's tie-break), R80 (PENDING never BROKEN; doc_links + its pending list), R52 (a blanket committer must not adopt a collapsed file)

DK-67 — An ignore file's directory-form rule is a wall no later block can climb

• Kernel: git never descends into an excluded directory, so a directory-form rule (.run/) defeats every re-include written beneath it, however many blocks later. Write the by-contents form (/.run/*) and the ! re-includes under it, and write it FIRST — a later block cannot undo a directory rule, and an installer that may not edit above a marker cannot repair it. The source project's own governance package wrote the directory form; the kit's installer had to be given one named edit above a marker to fix that single line, found by the dry-run's negative probe.
• When it applies: the first commit's ignore file, and every ignore block appended by a package.
• Cost: one failed dry-run install and a special-cased installer step; on the source project, a tracked scratch tree that could only be shaped by narrowing re-excludes. provenance: BFM accelerators P33.5 S91 (1); the kit's dry-run run 1 (Step 3.7's negative probe); the source project's conventions page

DK-68 — A summarised signal is a claim, not ground truth

• Kernel: a count, a verdict or a "done" that reaches you through a summary — a sub-agent's report, a reconnaissance note, a compressed hand-off, a coordinator reading prose results — is a claim about the bytes, not the bytes. Verify it against the artefact before anything depends on it: the file on disk, the tool's printed success line, the hash, the diff. The source project wrote this rule in its fourth phase and re-learned it in most of the later ones: agents reported matches the gate had not proven, a prototype survey's counts did not survive a byte check, a fresh session read a hand-off's summary as a conclusion, and "banked" was written from intent twice in one session. The same rule, applied to the project's own instruments, is the whole of the instruments group above.
• When it applies: every time work crosses a context boundary — agent to coordinator, session to session, summary to plan.
• Cost: false banks, false walls, a plan built on a count nobody had checked. provenance: BFM R14 (verify recon/sub-agent summary counts against the bytes — a summarised signal is a claim), R66 (write "banked" only from the tool's printed line), the S82 coordinator that read prose results, the memory "verify blast radius, not just the defect"

DK-69 — An instrument's blind spots: the tests that pass by construction

• Kernel: a check that cannot fail is not a check, and several common shapes cannot. A round-trip selftest of a partition or rewrite tool is a serialisation check, not a coverage check — it passes by construction when a missed item is absorbed into its neighbour's span, so every such tool needs an independent detector of items it failed to anchor. A set that gates work must be reconstructible from committed artifacts; a roster kept in ignored scratch is an unversioned oracle, silently wrong for anything it was not named after and blind after a fresh clone. A guard allowed to sit red and uncalled does not exist: its value is zero until it is green on the head commit and invoked by the standing report, and a docstring claiming it is wired is not wiring. A verification flag that short-circuits the tool's write path leaves the stale artifact in place and still exits zero. A status line a script prints unconditionally is not a measurement — derive every conclusion the script emits from the command's own output. A coverage instrument that infers its denominator from open work inverts at 100% (a complete map read as everything missing): carry the scanned denominator in the artifact and test the instrument at both endpoints. A metric that re-parses source is blind to a body banked through an include; trust the metric derived from the stub oracle. A name grep is not a "defined here" oracle — a declaration carrying the name reads as a definition. An annotator that writes into the text it reads must never treat its own output as evidence, and regex-extracted evidence needs a structural marker or prose becomes data.
• When it applies: every selftest, health line, coverage figure and "is it banked" query — at the moment it is written.
• Cost: a parser defect that survived eight sessions under a green selftest; a rename-drift failure undetected across two phases beside a red detector; a decision document nine days stale under a green flag. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase26.md:764 (Phase26 C1); phase-ends/logs/Phase26.md:742 (Phase26 C2); phase-ends/logs/Phase26.md:101 (Phase26 C3); phase-ends/logs/Phase29.md:2762 (Phase29-2of4 C1); phase-ends/logs/Phase29.md:7496 (Phase29-3of4 C5); phase-ends/logs/Phase33.md:126 (Phase33 C4); phase-ends/logs/Phase30.md:2589 (Phase30-1of2 C12); phase-ends/logs/Phase29.md:8080 (Phase29-4of4 C4); phase-ends/logs/Phase33.md:499 (Phase33 C5); phase-ends/logs/Phase33.md:503 (Phase33 C6)

DK-70 — A verdict has three staleness axes, and the health suite asserts the work was done

• Kernel: a stored verdict can be stale because the DRAFT changed, because the BASELINE changed — or because the INSTRUMENT changed. When a tool is repaired, every verdict it produced becomes a hypothesis again; re-gate the drafts the repair's blast radius plausibly touched, scoped by that radius and never the whole ledger. A ledger row with no draft artifact is a rumour, not a result. Count agent completions from the run journal's result records, never from artifact existence — an agent writes its deliverable early and then iterates, so the file proves nothing. A clean-looking verdict that appears immediately after your own repair transform is a suspect, not a result: re-measure the artifact the transform produced before routing the residual. The aggregate check target is proven fail-closed before checks are added to it, and every audit oracle has a dependent that would notice its absence. The health suite asserts that a tool DID its work, not only that the data is intact: zero inputs, an impossible wall-clock and a missing persistent effect are each a defect. A health check that cannot finish is not a check — keep the health target sampled and fast, and put the exhaustive form behind its own name. Incremental gates never exercise the extraction step, so regeneration rot is undated and invisible for weeks — sweep it on a schedule. A validity stamp must be honoured by every downstream consumer, and a wrong write-side label cannot be repaired by a correct read key. Every status claim in an agent's context is expiry-checked against live state, or agents report it back as an observation.
• When it applies: after any tool repair; in every health target; in every ledger read by a fresh session.
• Cost: four byte-correct drafts banked unchanged a month late; a health target that had never completed; three agents reporting a red baseline that was a stale note in their pack. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase30.md:4660 (Phase30-2of2 C2); phase-ends/logs/Phase30.md:2481 (Phase30-1of2 C4); phase-ends/logs/Phase30.md:2352 (Phase30-1of2 C5); phase-ends/logs/Phase30.md:4001 (Phase30-2of2 C3); phase-ends/logs/Phase29.md:8207 (Phase29-4of4 C1); phase-ends/logs/Phase27.md:17 (Phase23-27 C6); phase-ends/logs/Phase31.md:5122 (Phase31-2of3 C1); phase-ends/logs/Phase31.md:5175 (Phase31-2of3 C2); phase-ends/logs/Phase31.md:6027 (Phase31-3of3 C6); phase-ends/logs/Phase31.md:2376 (Phase31-1of3 C10); phase-ends/logs/Phase31.md:5437 (Phase31-2of3 C9); phase-ends/logs/Phase31.md:5394 (Phase31-2of3 C8)

DK-71 — What earns belief: applicability, independence, prediction, and the refusal as a finding

• Kernel: an oracle that can always be RUN is not always APPLICABLE — state the applicability precondition beside the recipe, or a coarse run returns a large number that reads as a verdict. "Independent" names the instrument, not the input: two refusals of two separately-written drafts from one tool is one test repeated. A diagnosis earns belief when it predicts its own residual membership, not when it explains the failures already seen. A defect reasoned into a sibling tool is latent until a run shows its signature; do not patch on theory right after that tool produced a clean run. A failure that will not reproduce earns a negative-control-proven detector, not a speculative fix — and every abort path proves its revert by diffing the worktree against a baseline captured at the start of the run. A derived claim outranks a heuristic verdict; when two heuristics disagree, take the union and queue the disagreements — under-reporting hides work, over-reporting only costs review. An instrument's refusal is a finding, not an obstacle: overriding it means explaining why the instrument is wrong, never finding another route. Read the first ten results of a long run before trusting the other hundreds, and negative-control any new refusal against everything that already succeeded. A refusal names the branch the caller entered, not the subject — make the applier consult the classifier it already has. Classify a harness fix as a logic defect or a path-reachability gap and price it accordingly; only the logic defect generalises. Re-verify a task's premise in the code at execution time — roadmap lines, audit findings and even an audit's own correction footer go stale, and the document that named a defect is usually the first to. A toolchain-version detector's verdict is a hypothesis until a placement count backs it; when a version stamp and a byte probe disagree, the probe wins and the refuted stamp is un-banked.
• When it applies: every diagnosis, every disagreement between two instruments, every premise inherited from a document.
• Cost: a "genuine codegen" verdict that was a size mismatch; a classifier verdict that overrode a hash match and understated a whole bucket; a version stamp banked for a phase against the bytes. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase29.md:7359 (Phase29-3of4 C3); phase-ends/logs/Phase31.md:3589 (Phase31-2of3 C3); phase-ends/logs/Phase29.md:3690 (Phase29-2of4 C2); phase-ends/logs/Phase29.md:1191 (Phase29-1of4 C4); phase-ends/logs/Phase30.md:4064 (Phase30-2of2 C5); phase-ends/logs/Phase30.md:4657 (Phase30-2of2 C4); phase-ends/logs/Phase30.md:1369 (Phase30-1of2 C1); phase-ends/logs/Phase30.md:250 (Phase30-1of2 C3); phase-ends/logs/Phase31.md:3346 (Phase31-2of3 C7); phase-ends/logs/Phase29.md:9957 (Phase29-4of4 C2); phase-ends/logs/Phase28.md:143 (Phase28-32 C3); phase-ends/logs/Phase10.md:44 (Phase8-13 C1)

DK-72 — Denominators, units and labels — the number must say what it counts

• Kernel: a number that does not say what it counts will be read as the wrong thing. A stop/continue instrument aggregates at exactly the unit the decision is made in; one that averages a finer unit manufactures a false "we are at the floor". A reach-weighted gain (size × copies) is not a size — every figure says which of the two it is. Sibling count and never-drafted count are different denominators; conflating them overstates free leverage and hides that the remaining mass is singletons. A yield estimator that counts "unclaimed at the moment it runs" ranks correctly and over-projects absolutely; never plan off its absolute numbers. Do not cross-price two economies: a conversion rate measured on the residue queue does not price a fresh wave. When two blockers are orthogonal, a classifier's if-chain order silently becomes the label — cross-tabulate, never bucket. Measure what fraction of a cycle a parallelism knob can actually touch before adopting it. A milestone counted in matched functions excludes the splitter's auto-generated empty bodies, defined at the moment the bar is set. A duplicate census run before the vendor library is linked out is contaminated — the groups are library fragments and epilogues. The file a function lives in is not evidence of its class; read the recorded attribute, never the hosting split. Keep a glossary line for any term two documents use in opposite senses. Say which currency a wave buys — percentage or idioms — before launching it, and judge it in that currency; and a class-distribution assessor only sees the population already attempted, so "analyse all remaining work" is a cheap triage pass, not a static analysis.
• When it applies: every plan figure, every ledger column, every verdict of "at the floor".
• Cost: a phase nearly closed on an artifact of the wrong unit; a leverage estimate three times too high; a thirty-fold mis-scope risk from one term meaning two things. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase29.md:1283 (Phase29-1of4 C1); phase-ends/logs/Phase29.md:4775 (Phase29-2of4 C6); phase-ends/logs/Phase31.md:298 (Phase31-1of3 C6); phase-ends/logs/Phase29.md:9350 (Phase29-4of4 C5); phase-ends/logs/Phase30.md:899 (Phase30-1of2 C10); phase-ends/logs/Phase29.md:4958 (Phase29-2of4 C4); phase-ends/logs/Phase29.md:6115 (Phase29-3of4 C6); phase-ends/logs/Phase7.md:12 (Phase7 C2); phase-ends/logs/Phase7.md:26 (Phase7 C3); phase-ends/logs/Phase28.md:182 (Phase28-32 C2); phase-ends/logs/Phase30.md:1343 (Phase30-1of2 C13); phase-ends/logs/Phase21.md:475 (Phase21 C3); phase-ends/logs/Phase21.md:63 (Phase21 C2)

DK-73 — Leverage is not tractability; scope a campaign by verdicts, invariants and kill criteria

• Kernel: the most-duplicated functions are systematically the hardest — leverage and tractability are anti-correlated — so a leverage-first queue front-loads hand-tier work, and its early bank rate is not a harness fault. Carry a measured closeness read per target and never let reach × size stand in for "crackable"; the reach ranking finds the most-DONE work first, so derive the target pool from the build's own invariant. Yield clusters by binary, not across the fleet — draw per binary once two independent lanes concentrate in the same place. A cracked idiom transfers within its family and not across it: price a lane by families, not by class size. An open-ended grind phase's milestone is invariants held plus a clean checkpoint, never a percentage; a research phase is scoped by a per-class verdict (a validated lever or a falsifiable wall verdict per class), not by a percentage either. Write numeric kill criteria into the plan before the data exists, and let them fire. Measure a pipeline's yield on the residual, not on solved functions: a known-answer ladder (revert a match to a stub, make the pipeline re-derive it) sets the ceiling, and the gap to the unmatched tail is the real number. Declare a mechanical lever spent only on a positive, three-part measurement — every built lever applied and returning zero, the residue split by structure, and the decay curve priced against what remains. Sequence a phase so the cheapest thing that can invalidate everything below it runs first; when a foundation task hits a structural wall mid-phase, bank the tractable wins and re-scope the wall as its own sub-project. Inside one leverage class, schedule by measured remaining effort and pull the payoff-dominating outlier out for an immediate cheap triage. Choose the exemplar for cracking a codegen class by the size of its residual: the one-instruction mismatches are the cleanest real-function isolates.
• When it applies: the draw, the phase plan, the campaign's close.
• Cost: a phase priced by percentage that could only be closed by verdicts; a mega-leverage "freebie" that was a stack-switcher; a lane priced by class that cost forty turns of learning per family. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase17.md:247 (Phase17-18 C1); phase-ends/logs/Phase25.md:473 (Phase25 C1); phase-ends/logs/Phase30.md:1810 (Phase30-1of2 C11); phase-ends/logs/Phase31.md:5040 (Phase31-2of3 C10); phase-ends/logs/Phase31.md:1300 (Phase31-1of3 C5); phase-ends/logs/Phase19.md:24 (Phase19-20-22 C1); phase-ends/logs/Phase18.md:93 (Phase17-18 C6); phase-ends/logs/Phase16.md:24 (Phase15-16 C5); phase-ends/logs/Phase16.md:36 (Phase15-16 C1); phase-ends/logs/Phase29.md:10300 (Phase29-4of4 C6); phase-ends/logs/Phase29.md:4322 (Phase29-2of4 C5); phase-ends/logs/Phase7.md:3 (Phase7 C5); phase-ends/logs/Phase24.md:29 (Phase24 C2); phase-ends/logs/Phase20.md:14 (Phase19-20-22 C2)

DK-74 — Models and prompts: targeted context, named degenerate outputs, two-sided caps, tiers by what they can learn

• Kernel: give a drafting model a targeted slice of the knowledge base, never the whole — full context measurably made a model worse. Name the degenerate output in the prompt: an empty body compiles, so "translate every instruction, never an empty body" is a required instruction. The output-token cap is a two-sided knob and both failure modes read as "the model is bad"; more budget is not more quality — measure it as a paired A/B and treat truncation as recoverable, not as a defect signal. When A/B-ing any harness knob, ship a positive control that the knob actually moved. Mine new idioms from fresh cracks, never from the failed backlog — the failure pile re-teaches what you already know — while the harvest SELECTOR must still be able to see failed attempts, or it learns from the easy half. Escalations to the expensive tier run strictly serial with idiom-banking between them; only the tier that cannot learn is run in parallel. The wall-breaker tier is a match tier, not a plumbing tier: work a deterministic arbiter can judge does not need the expensive model. Accelerate the stage that is the bottleneck — a byte-exact search loop costs a compile plus a whole-binary gate per candidate, so hardware brute force buys nothing. Make the drafter run the pre-gate guard and return the NAMED banking prerequisite; a batch of diagnosed candidates is worth more than a batch of opaque matches. Before concluding a pipeline is weak, histogram the compiler's error text: most failures were one missing declaration, fixed once. Keep prompt and law text in data, never inside the launcher's source template.
• When it applies: the pack builder, the routing table, every model experiment.
• Cost: a local model made worse by more context; eight diagnosed matches revealing one lever the opaque batch had hidden; a wave killed at launch by a quote character inside a template. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase23.md:24 (Phase23-27 C2); phase-ends/logs/Phase23.md:91 (Phase23-27 C3); phase-ends/logs/Phase23.md:54 (Phase23-27 C4); phase-ends/logs/Phase31.md:2292 (Phase31-1of3 C1); phase-ends/logs/Phase30.md:1541 (Phase30-1of2 C8); phase-ends/logs/Phase23.md:93 (Phase23-27 C1); phase-ends/logs/Phase31.md:3236 (Phase31-2of3 C6); phase-ends/logs/Phase24.md:57 (Phase24 C1); phase-ends/logs/Phase24.md:61 (Phase24 C3); phase-ends/logs/Phase17.md:96 (Phase17-18 C4); phase-ends/logs/Phase29.md:5093 (Phase29-2of4 C3); phase-ends/logs/Phase16.md:40 (Phase15-16 C3); phase-ends/logs/Phase31.md:1702 (Phase31-1of3 C12)

DK-75 — The unattended run: a crash is a pause, a stop is a file, a limit is an epoch

• Kernel: build the unattended campaign so a crash is a pause — probe the dependency at the top of each cycle, commit per cycle, persist the tried-set and each confirmed result the moment it is confirmed; a long stateless batch that writes only at the end loses everything to a kill. Design it for a human with no agent session: a STOP file honoured at a safe boundary, a supervisor that tells a clean exit from a crash, a status one-liner, and crash-resume proven by a deliberate kill before the first real run. Never wrap a project tool in a timeout shorter than its own budget — you pre-empt its recovery handler and lose its buffered output. Sweep for orphaned worker processes at every session boundary: a dead-pipe compiler holds a core forever and nothing reports it, and a harness's low-memory guard silently kills long background jobs. A run that looks throttled is usually blocked on an interactive approval prompt — check the pending prompt before diagnosing the provider. Batch size is a risk lever, not a token lever: isolated agents cost about N times one agent whether concurrent or serial, so size a batch by the unverified spend you are willing to lose before the next measurement. A repair mode whose cost is exceptions × population is gated on a measured exception count; for a broadly divergent set, drop rather than recover. A free or preview model tier can be withdrawn mid-campaign without notice — a fleet-wide 404 is an epoch event, not N model failures — and a metered key's own cap is a separate limit from the account's credit. In a pipelined drafter/gater, "still open" is not "not yet attempted": consecutive waves re-drafted the wave still in flight. A fan-out script generated by an orchestrator runs sandboxed without the repository: it is self-contained, so target selection belongs to the generator, not the workers.
• When it applies: every lane that runs while nobody watches.
• Cost: a thirteen-hour orphaned compiler; three gates with no verdict and half-applied propagations from one timeout; a six-hour "throttle" that was a permission prompt. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase23.md:92 (Phase23-27 C5); phase-ends/logs/Phase16.md:89 (Phase15-16 C6); phase-ends/logs/Phase31.md:7121 (Phase31-3of3 C4); phase-ends/logs/Phase31.md:7024 (Phase31-3of3 C1); phase-ends/logs/Phase29.md:1029 (Phase29-1of4 C5); phase-ends/logs/Phase33.md:508 (Phase33 C15); phase-ends/logs/Phase21.md:731 (Phase21 C1); phase-ends/logs/Phase29.md:2387 (Phase29-1of4 C2); phase-ends/logs/Phase29.md:1635 (Phase29-1of4 C3); phase-ends/logs/Phase31.md:2319 (Phase31-1of3 C8); phase-ends/logs/Phase31.md:2380 (Phase31-1of3 C9); phase-ends/logs/Phase31.md:258 (Phase31-1of3 C2); phase-ends/logs/Phase25.md:487 (Phase25 C2)

DK-76 — Agents and the tree: write-isolation is architecture, never a sentence in a prompt

• Kernel: drafting agents must never be ABLE to write the build tree; every agent artifact lands in a scratch directory, so a killed or racing campaign costs build cycles and zero paid work. "Never modify the source tree" in a prompt is a request, not an enforcement — snapshot the tree status around every agent and name the offender. Never adopt a subagent's worktree wholesale: it is a snapshot of an older tree and may predate a bank; re-gate its artifacts against the head. The generated disassembly tree is shared mutable state — a fleet verify/clean chain and the per-function instruments cannot run at the same time. A probe that splices the tree in order to measure it must restore it, or the progress oracle counts the splices as banks. Snapshot every target's disassembly before gating: a successful bank prunes it, and harvest and recovery need both sides. Never let model-authored prose reach the shell inside double quotes — a backticked command in a commit message executed; use a quoted heredoc. Keep the wave harness in the repository with its contracts; a harness rebuilt from memory each run silently goes stale. A cd in one agent shell call persists into the next. Never test a helper by importing its module: a tool with no main guard runs its whole pipeline on import.
• When it applies: the day the first agent is launched, as architecture; then every wave.
• Cost: two tree corruptions recovered with one checkout only because the drafts lived outside the tree; a real extract run by a commit message; a download landing inside a submodule. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase30.md:4017 (Phase30-2of2 C1); phase-ends/logs/Phase31.md:2879 (Phase31-1of3 C7); phase-ends/logs/Phase31.md:2879 (Phase31-2of3 C4); phase-ends/logs/Phase30.md:449 (Phase30-1of2 C2); phase-ends/logs/Phase31.md:6808 (Phase31-3of3 C7); phase-ends/logs/Phase32.md:255 (Phase28-32 C6); phase-ends/logs/Phase31.md:2598 (Phase31-1of3 C11); phase-ends/logs/Phase31.md:1612 (Phase31-1of3 C3); phase-ends/logs/Phase30.md:2893 (Phase30-2of2 C6); phase-ends/logs/Phase30.md:688 (Phase30-1of2 C9); phase-ends/logs/Phase33.md:660 (Phase33 C16); phase-ends/logs/Phase30.md:2163 (Phase30-1of2 C7)

DK-77 — Edits that keep their proofs: repair the caller, land changes separately, draft before you carve

• Kernel: when a byte-proven body will not integrate, the repair moves the CALLER's declaration to the definition's signature — never the definition to the caller's — and only where the change is width-compatible. A repair ladder probes whether each stage is needed before applying it, or it silently escalates a binary-local bank into a fleet-shared edit. Land a pure rename and a semantic or layout change as separate gated edits, so a gate failure attributes itself. Draft first, then carve: a build-unit split is safe only when the new unit is immediately populated with proven bodies. A proven transform that is not a rung of the ladder the drafts actually pass through does not exist for those drafts. Re-run the deterministic declaration canonicaliser over old quarantined drafts after every large bank — recovery odds rise as the banked corpus grows and the pile costs nothing to keep. An idempotency guard keyed on presence freezes every record created before the system matured; key it on completeness, and make regenerated artifacts idempotent by replacement, never by skipping. A hard-coded assumption fixed in one tool survives in its siblings: grep the tree for the literal and fix every twin in the same change. Before a fleet-wide mechanical edit, census the whole population for the exact preconditions the edit assumes — uniformity is the licence, non-uniformity the design input. A batch gate that bisects on failure re-runs the singleton against an unchanged baseline: special-case one, or pay a duplicate build on the hot path. A byte-identical baseline is proven only when the whole gate is green from clean across several independent sessions. A build-system conditional that expands at parse time makes its own negative control vacuous. Never round-trip a curated configuration through a serializer: every oracle you own measures bytes, so a formatting-destructive write is invisible to all of them.
• When it applies: every integration repair, every carve, every fleet-wide edit.
• Cost: a registry's forty-seven comment lines destroyed under green gates; a fleet edit taken by a bank that needed a local one; a duplicate build on every single-draft gate. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase24.md:119 (Phase24 C4); phase-ends/logs/Phase29.md:3377 (Phase29-2of4 C7); phase-ends/logs/Phase29.md:1959 (Phase29-1of4 C6); phase-ends/logs/Phase31.md:922 (Phase31-1of3 C4); phase-ends/logs/Phase31.md:3810 (Phase31-2of3 C5); phase-ends/logs/Phase15.md:57 (Phase15-16 C4); phase-ends/logs/Phase15.md:51 (Phase15-16 C8); phase-ends/logs/Phase31.md:6171 (Phase31-3of3 C5); phase-ends/logs/Phase28.md:36 (Phase28-32 C4); phase-ends/logs/Phase29.md:7520 (Phase29-3of4 C4); phase-ends/logs/Phase28.md:58 (Phase28-32 C5); phase-ends/logs/Phase7.md:75 (Phase7 C4); phase-ends/logs/Phase31.md:5155 (Phase31-2of3 C11); phase-ends/logs/Phase28.md:181 (Phase28-32 C1)

DK-78 — The search harness and the compiler as evidence: same context, own corpus, a sibling's silence proves nothing

• Kernel: a search harness must compile in the SAME declaration context as the real build; an isolated context does not merely fail to verify, it makes the search converge on the wrong answer. The search unit is the C expression — it cannot freeze the instructions already right, because register allocation couples them. A decompiler's "unaffected register" output means it decompiled one entry path of a multi-entry function and handed you a fragment: an instrument limit, never evidence the function is hard. Check group identity from the signature files before probing a family — if the members are structurally identical, a zero result is a compile-error certainty, not evidence about codegen. Vendor compiler sources carry form-feed page separators, which a scripting language's line splitter honours and grep does not, so a line-number checker over the source drifts and blames the wrong line. Your own corpus of byte matches is an experiment already run on the toolchain: settle "is my rebuilt compiler faithful?" from it before installing the original vendor tools. Another project's unmatched stubs are a record of what they did not crack, never proof that a class is uncrackable — cross-project corroboration multiplies confidence in a wrong verdict as readily as a right one. Histogram a secondary binary's call targets by address range before assuming it carries its own copy of anything; a raw blob's load address is a hypothesis whose free confirmation is arithmetic against the next known segment's base. A relocation-interleaved disassembly is produced only for object files; a linked image lists relocations separately with a shifted address column.
• When it applies: the permuter's base file, the first probe of any family, every cross-project citation.
• Cost: an overnight run that "closed" forty per cent of its near-misses and gated zero; a class written off on a neighbour's silence. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase16.md:71 (Phase15-16 C2); phase-ends/logs/Phase16.md:43 (Phase15-16 C7); phase-ends/logs/Phase7.md:109 (Phase7 C1); phase-ends/logs/Phase30.md:168 (Phase30-1of2 C6); phase-ends/logs/Phase29.md:6915 (Phase29-3of4 C1); phase-ends/logs/Phase18.md:64 (Phase17-18 C3); phase-ends/logs/Phase18.md:52 (Phase17-18 C2); phase-ends/logs/Phase12.md:45 (Phase8-13 C2); phase-ends/logs/Phase10.md:13 (Phase8-13 C3); phase-ends/logs/Phase33.md:526 (Phase33 C7)

DK-79 — Maintaining the knowledge base and the record: contradictions are work items, edits are verified by section

• Kernel: a contradiction between two entries of your own knowledge base is a work item, not noise — replay the levers already written down, under the correct oracle, before commissioning new research. A wrong prescription left in the base is worse than no entry: when evidence refutes an entry, correct that entry in place, in the same session, carrying the refutation. A document that cites a repository path is an untested claim about the repository — lint it. A programmatic edit to a long-lived knowledge document silently truncates or duplicates it; verify the sections, never the commit. The live hand-off block is strictly appended at the end of its file — file order is the only recency signal a fresh session has. Never restructure a proven tool with blind string replaces at the end of a long session; specify it as the next session's first task. A miner over your own records finds only what its pattern anticipates — measure the widened pattern's yield. Assert that the work ledger partitions the live work, and treat a row the invariant refutes as a lie a fresh session will act on. Write the phase synthesis in a fresh session that re-reads the committed state cold; the cold read is what catches stale artifacts. A derive-then-apply pipeline over a live repository needs a freshness guard and a stated sequencing law.
• When it applies: every harvest, every close, every programmatic edit of a document that outlives the session.
• Cost: a cookbook section silently deleted for a session; a day-older hand-off read as the live one; a class re-researched because two entries disagreed and nobody replayed either. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase18.md:26 (Phase17-18 C5); phase-ends/logs/Phase29.md:9029 (Phase29-4of4 C3); phase-ends/logs/Phase27.md:71 (Phase23-27 C7); phase-ends/logs/Phase31.md:6529 (Phase31-3of3 C2); phase-ends/logs/Phase31.md:6126 (Phase31-3of3 C3); phase-ends/logs/Phase29.md:6134 (Phase29-3of4 C2); phase-ends/logs/Phase33.md:429 (Phase33 C14); phase-ends/logs/Phase27.md:45 (Phase23-27 C8); phase-ends/logs/Phase28.md:86 (Phase28-32 C7); phase-ends/logs/Phase33.md:285 (Phase33 C8)

DK-80 — Hosts and services: the small facts that each cost an hour

• Kernel: small facts about hosts and services, each learned at the cost of an hour. git check-ignore is silent for tracked paths, so an ignore-coverage audit run before the untracking passes vacuously — use its no-index form. A content-hash "no forbidden bytes" audit collides on zero-length files. A mirror push does not push the stash ref. Route a host purge request through the flow that actually exists; the obvious form is a trap. A host feature can be gated on the very flip it was meant to precede — read the settings page, do not infer. A public scratch service's compiler image is not your pinned toolchain; rebuild it locally and prove byte-identity before asking for a preset. A disassembler's script directory compiles as one bundle, so a single non-compiling script disables every script in it and the error names a working one. The same tool refuses a project path containing a component that starts with a dot, so a scratch project cannot live under a dot-directory. Run reference-compiler dump passes from a scratch working directory, or the dumps land in the repository root and later read as committed artifacts.
• When it applies: the first time each host or service is touched.
• Cost: an hour each, and one flip-gate misread. provenance: BFM phase-log mining pass (P33.5 task 14.5, S92; the accelerators entry "P33.5 S92"): phase-ends/logs/Phase33.md:236 (Phase33 C3); phase-ends/logs/Phase33.md:205 (Phase33 C9); phase-ends/logs/Phase33.md:295 (Phase33 C10); phase-ends/logs/Phase33.md:635 (Phase33 C11); phase-ends/logs/Phase33.md:692 (Phase33 C12); phase-ends/logs/Phase33.md:645 (Phase33 C13); phase-ends/logs/Phase33.md:186 (Phase33 C1); phase-ends/logs/Phase33.md:185 (Phase33 C2); phase-ends/logs/Phase25.md:337 (Phase25 C3)

DK-81 — The flip day: a third-party step is proven through the third party's toolchain, and the public tree is decided before the flip

• Kernel: four small facts from the day a private decomp went public. (1) A step that hands a file to a third party — a scratch on a public diff service, a preset request — is proven through that party's OWN toolchain, on the file itself, before the owner's browser session, and the proving tool writes the paste: a listing that exists only as a comparison oracle (bare register names resolved by a local include, absolute branch targets) will not assemble anywhere else. (2) Decide what a public tree carries before the flip: sent outreach drafts and a reviewed document archive were always going to leave, and deciding after cost two untrack commits on a public history; an archive index that names files as paths, never links, is what made the removal harmless. (3) A calendar gate — a host's purge ticket — is read the morning after it is filed, not "daily for a week"; it passed in one day. (4) A scratch prune is an instrument change: every tool that writes under a pruned tree is re-run before the prune is called done — one audit's probe directory went with the prune and its bare except turned a refusal into a verdict, which read as four parser defects.
• When it applies: the flip and the outward actions around it; any prune of scratch a health check writes under.
• Cost: one failed browser step, two extra commits on a public history, one red health chain diagnosed twice. provenance: BFM Phase 34 (S93, 2026-09-08; the accelerators entry "P34 S93"): docs/decision-log.md "P34 S93 — the flip"; the Phase-34 worklog (phase-ends/logs/Phase34.md after the close: task 2 part 1, task 7 parts 1–2, task 8 part 1).

---

9. The failure museum, condensed — what looked right at the time

The exhibits below are the source project's, stripped of names and numbers; the column that matters is why it looked right. A failure that looks wrong gets fixed the same day; these did not.

What it looked like	What it was	Why it looked right	Kernel / rule
A recompilation first would force the memory map into the open	A matching decomp needs no recompiler	The one precedent had done it that way	decomp-first (intake item 2)
Structural families template at ≈0%	A probe silently omitted a required carve; run correctly the family matched high	The probe exited zero with a number	DK-8, DK-17
The engine holds a bytecode script VM to match	Compiled dispatch tables; no VM	Every game has a script VM	G1
The remaining engine core is blocked by loose typing	The wall was the compiler's own code generation	Types are the usual suspect	DK-6
Residuals that resist every rewrite are unsteerable	Reading the compiler's passes explained them one by one	Dozens of rewrites had failed	DK-6, DK-44
A small "swing number" is a wall class	A compile-flag artifact of the tooling	It was consistent across probes — the probe was consistently wrong	G23
The endgame plan's numbers describe the remaining work	Broken scanners had been measuring the frontier	Nothing had ever checked the scanners	DK-9, G19, G21
A corpus scanner reports the decomp complete	It could not answer and returned an empty set	An empty "remaining" list is what done looks like	G28
Every draft of one binary reads "near" for a month	The shared gate compared it against another binary's hash	The gate was green — for the wrong reason	G42
That binary cannot be gated ("a linker defect")	Incremental builds re-ran a linker-script rewrite	Byte-correct drafts gated red reproducibly	G9
The waves are limited by idioms the drafters lack	Most drafts were byte-correct; integration was the bottleneck	Failures arrived as "no match" verdicts	DK-7
The medium has been fully counted	Dozens more code-bearing payloads	The fleet was 100% green on what it built	G21
A band of the executable is a compiler wall, proofs attached	The vendor's library; the archive was online	Each proof named a real pass behaviour	DK-50
A function is a wall	Its body was byte-identical; the wall was a split boundary	The diff was real	DK-12, DK-25
The permuter has exhausted the near-misses	It had never run on that class	It reported "unchanged" every cycle	G35
A function is finished	Its "C" was the assembly pasted into an inline-assembly body	The byte gate is a null oracle for "is this C?"	DK-29
Two functions are PROVED unmatchable by producer censuses	Each census was one producer short	Every refutation on the list was real	DK-45
The register pins are the levers	Symptoms; every pin came off once the shape was right	Pins moved the diff	DK-47
A low-scored "weak cousin" is unrelated	The exact same-shape sibling	The similarity score was a number	DK-46
The exclude list is current	Most entries stale the day after it was written	Every entry had been true once	G38
The agents have the laws file	It sat one directory below where they were told to read	Two agents said so; the rest never mentioned it	DK-39
"No banked twin — derive from the assembly"	Banked verbatim at the same address in another binary	True of the card, false of the world	G44
A whole wave was a drafting collapse	The gater had accepted a class it could not gate	The rest of the wave banked normally	G28
Several functions failed the gate wave after wave	Drawn at a different optimisation level than their object	Each failure looked like a model failure	G38
"12 banked of 12"	Names compared against a set keyed by address — always true	It printed a fraction	G27, G20
Healthy lane activity in the logs	The draw refused every wave during any gate and fell back to old ones	The logs showed work	scope a refusal to what is actually unsafe
The executable's denominator is settled	The disassembler's boundaries under-counted it	It had been stable for a month	G20
The history rewrite is a mechanical filter run	An empty blob in the strip list undid every "file emptied" change	The filter exited zero and the paths were gone	DK-53
The local gc dropped the old history	Forgotten worktrees pinned it	The ref list had been read before the worktrees were	DK-54
The purge probe is read-only	Every fetch imported the purged closure	The probe only reads the host	DK-55
A fresh session read a hand-off as done	The summary said so	A compressed summary looks like a conclusion	DK-59
A wall class's effort estimate	A count that was true of an unasserted scope	The number was real	DK-60
Two ledger messages say "banked"	A helper that did nothing on an empty list; a wrong directory	The intent was there	G28, G37
The permuter plateaued; its logs are quiet	Empty logs: never started	Quiet looks like working	G30
The rate limit is low	A launch burst; the steady state was far higher	The first measurement was a real number	DK-60
An agent's "no draft" after a rate limit	It sat a few instructions from a match with its history on disk	The verdict said no draft	G26
A model-drafted upstream contribution with the tells removed	Read as machine-written anyway, closed	The content was proven and the style pass looked like courtesy	DK-58

The pattern, stated once. Almost every wall was an instrument: correct when written, stale as the population under it widened, returning a true number about a narrower world, with nobody comparing what it found to what it should have found. The cure is not vigilance — the author of one of the rules above rebuilt the exact defect it warns about an hour later in a different file. The cure is structural: two paths per question on a schedule, a known-true case before any reading, the denominator on every number, and a decision log that records each of these while it still hurts.

---

Coverage

• Order (before the first crack): DK-1 … DK-16 — 16 kernels.
• Instruments: DK-17 … DK-30 — 14 kernels.
• The campaign: DK-31 … DK-43 — 13 kernels.
• Compiler walls: DK-44 … DK-52 — 9 kernels.
• The repository and publishing: DK-53 … DK-58 — 6 kernels.
• Governance and sessions: DK-59 … DK-63 — 5 kernels.
• Readability at day one: DK-64 … DK-65 — 2 kernels.
• Added by the coverage pass: DK-66 … DK-68 — 3 kernels.
• Added by the log-mining pass: DK-69 … DK-80 — 12 kernels (143 worklog lessons, clustered).
• In all: DK-1 … DK-80 — 80 kernels (the installer's check compares grep -c '^### DK-' against this figure).
• The failure museum: 37 exhibits, condensed.
• Conduct rules are not duplicated here; they are the registry seed's E.7 group. The generic engineering kernels of ProjectArchitect's own corpus apply unchanged and are not repeated.