BFM-decomp/docs/backlog.md

# Backlog — automation near-misses for hand-finishing

> Generated by `tools/backlog.py render` from `.run/backlog.jsonl`. These are functions the Phase-21 automation got **close** on but did NOT byte-match. The whole-binary byte-gate is the sole arbiter (G3/P9): **byte-matches bank and are NOT listed here** — only genuine near-misses/blockers are. Ranked by hand-session priority: **reach** (×N propagation leverage) → **closeness** (match_one mismatch count, lower = closer) → **size**. Each row's `best_draft` is the closest C the machine reached — resume from there.

**Open near-misses:** 17  ·  by status {'near': 15, 'failed': 2}  ·  by class {None: 17}

| # | addr | reach | class | nins | status | closeness | where it stuck | best draft |
|--:|------|------:|-------|-----:|--------|----------:|----------------|------------|
| 1 | func_80032A74 | None |  | None | near | 1 | 422/422 instructions, frame 0x78 exact, every immediate/stack offset/branch target exact, all 27 symbols audited against the target's own relocation lines (law 1c). Sole residual is idx 244 `lh` vs `lhu`. I proved WHY it is a wall rather than re-grinding it: `extendhisi2` is a force_not_mem EXPAND, so an orphan (the 8 bytes the 0x78 frame needs at sp+0x48) can only be minted by a 3-way movhi+ashl+ | `/home/musashi/bfm-decomp/.run/S79w/opus/func_80032A74.c` |
| 2 | func_80020DA4 | None |  | None | near | 2 | Q12 3x3 rotation-matrix build (twin shape of ov_SC02_011:func_8018B76C). Prior 51->20->14->8; NEW lever: an address-taken s32 frame_pad[3] local induces the target's phantom 16-byte frame -> 2. Residual: mflo destination $t0 vs target $a2 (REGALLOC-PERM); pinning regresses to 79. Handed to permuter_ils. | `.run/S79w/sonnet/func_80020DA4.c` |
| 3 | func_80039DEC | None |  | None | near | 2 | S80 permuter_ils best 2 (seed 9); 74/74 exact length match, OPCODE-MIXED. Key levers that moved the residual from the seed's 74-vs-72-length structural failure down to 9: (1) K&R old-style definition for a2 (s16 a2 in the identifier-declaration form) reproduces the target's in-place sll/sra-16 arg-register cast + its addu $a3,$a2,zero raw-preserve, which no ANSI (s16)-cast or s32-typed spelling ever produced; (2) forward-goto bloc | `/home/musashi/bfm-decomp/.run/S79w/sonnet/func_80039DEC.c` |
| 4 | func_8017DF28 | None |  | None | near | 2 | S80 permuter_ils 8x150s: waypoint '1' replaced the addiu $s2,$sp,0x10 with sw zero,48(sp) (semantically divergent, R14) -> closeness stays 2; 119/119; single SCHEDULE residual: addiu $s2,sp,0x10 sits in the jal's delay slot vs the target's bnez slot — expand_block_move's copy_addr_to_reg pseudo for mtx=D_800AE620 is cse-reused for both later &mtx args (gcc-2.7.2-map cse_expr.md [A23-2]/§H). Field-wise copy regresses to 117 (a real loop); the §H diamond cse-reset is a byte-identical no-op (no 2-predecessor merge to exploit). Fifth RTL-ve | `.run/S79w/sonnet/func_8017DF28.c` |
| 5 | func_800391D4 | None |  | None | near | 3 | 75/75 instructions (exact length), only residual is a 3-insn SCHEDULE-REORDER (off=0 vs arg1's sll/sra pair rotated) classified bucket=permuter. Cracked the 4-prior-attempt wall (best prior closeness 64, LENGTH-DRIFT+1) via register-pin i=$7 to kill combine_givs on D_80073140[i], a 2D-array decl D_80073140[][1] (cookbook SS164-26) to stop move_movables hoisting the address instead of folding it in | `/home/musashi/bfm-decomp/.run/S79w/sonnet/func_800391D4.c` |
| 6 | func_80039B20 | None |  | None | near | 7 | S80 permuter_ils best 7 (seed 7); 79/79; the 7-entry rotation around the redundant D_80073140[i] re-read (target schedules it right after the D_800C7D20 load, cc1 at its use). Four new restructurings inert or worse (plain pointer -> 10; naming the first read no change; volatile second read no change; &=//= swap -> 30). §461 plateau: list-scheduler tie-break (LUID/priority). | `.run/S79w/sonnet/func_80039B20.c` |
| 7 | func_80023BF0 | None |  | None | near | 11 | S80 permuter_ils 8x150s: 18 -> 11 (ADDRESSING: the 0xFFFFFF/0xFF000000 lui/ori materialisation moved across the sll/addu and the bne, .run/S79w/permuter/func_80023BF0.c — verify semantics before seeding); 90 -> 18 (rtu_match on src/800.c agrees: 18, so it is not TU plumbing). The whole residual was ONE register permutation; I read it with cc1 -dg plus gdb-on-cc1 breakpoints that dump allocno_n_refs/live_length and local-alloc's find_free_reg/post_mark_life grants, so every step was arithmetic on global.c:594 rather than guesswork. Four levers: (1) the 194-A fence in BOTH arms - a LOCAL REGRESSION ( | `/home/musashi/bfm-decomp/.run/S79w/opus/func_80023BF0.c` |
| 8 | func_80038698 | None |  | None | near | 11 | S80 permuter_ils best 11 (seed 11); Plateau 11 reconfirmed with fresh levers: operand-order swap and block-scoping of the two-byte-BE combine temps INERT; §197-C statement split reproduces 11 (LO-first) or regresses to 17 (HI-first); a zero-byte re-tie on hi fixes the a3[7]/a3[8] load order but costs an andi 0xffff (nonzero-bits proof lost) -> 33-39. A sched1 DAG-priority / local-alloc self-coalesce residual recurring at three byte- | `.run/S79w/sonnet/func_80038698.c` |
| 9 | func_8001BC6C | None |  | None | near | 28 | Reproduced the documented best (28, two prior attempts): head cluster = sched1 birthing-boost hoisting the a1<<16/0x64000000 colour partial ahead of four lhu's regardless of statement order (prior RTL dumps: two mutually exclusive schedules); tail = val-load/tbl-read/D_800A5E60-store swap + FF000000 mask in $v1 vs reused $a1; reorders byte-identical; naming the mask made no difference; pinning it  | `.run/S79w/sonnet/func_8001BC6C.c` |
| 10 | func_80039308 | None |  | None | near | 34 | 115 -> 34 at exact length 518. The dominant defect in the prior draft was one local shared between both arms of `if (b3)` (tb/tmp/off/i/p/idx): each merge made one long live range, a tiny allocno priority and a late hard reg, where the target clearly has separate pseudos — splitting them in the right direction (arm-1 `tbl`/`tmp2`, else-arm `j` plus REUSING arm-1's `r`/`idx1` for the identical inli | `/home/musashi/bfm-decomp/.run/S79w/opus/func_80039308.c` |
| 11 | func_8002FDE8 | None |  | None | near | 35 | 73/73, OPCODE-MIXED only; reproduced the prior ceiling 35 by fresh reconstruction (two §194-A AFTER-fences + D_800A46B0=1 reordered). Falsified: un-chaining the D_800A46D2[0] assign (-1 len), volatile on the final read (+2 len), a ref-boost asm on data (spills to $s3). Residual: gcc caches &D_800A46D2 in a callee-saved reg across the func_800419B0 call where the target rematerialises lui/lo at bot | `.run/S79w/sonnet/func_8002FDE8.c` |
| 12 | func_80185810 | None |  | None | near | 37 | C-vs-hand-asm decided first: this is compiler-emitted C, not hand assembly — regular gcc-2.7.2 -O2 prologue/epilogue (frame 0x80, $s0-$s4+$ra at 0x68..0x7C), if/else diamonds with `j` over the else arm, jal+delay-slot calls, load-delay nops, and every COP2 op arriving through the same PsyQ gte_* inline-asm macros the matched neighbours in this TU already use; splat's 'Handwritten function' banner  | `/home/musashi/bfm-decomp/.run/S79w/opus/func_80185810.c` |
| 13 | func_80015B6C | None |  | None | near | 44 | 120/120; prologue + most of block1 exact. Residual = two documented walls (6 prior attempts): a 6-ins v0/v1 swap in the D_800B9A02*20 index calc (pinning the load to $2 inert) + sched1 hoisting the xa=x corner copy one slot across the block1/block2 boundary (memory clobber does not stop a pure-register move). Per-block pins (m24=$5, mFF=$7, one=$8, tag/tag2/tag3) + opaque-copy barriers on xa/ya: 8 | `.run/S79w/sonnet/func_80015B6C.c` |
| 14 | func_800CF3E8 | None |  | None | near | 54 | Recovered the S74 vW body (closeness 256) and drove it to 54 at the exact length 469/469, with all four block sizes exact (19/113/114/223), segment 0 byte-perfect, and all 20 symbols plus their relocation counts identical to the target; rtu_match in the real TU reproduces 54 with no declaration conflict, so this is a real-TU-clean NEAR, not a standalone artefact. The decisive new lever is that zer | `/home/musashi/bfm-decomp/.run/S79w/opus/func_800CF3E8.c` |
| 15 | func_8017DC80 | None |  | None | near | 84 | The splat "Handwritten function" tag is wrong — this is ordinary gcc-2.7.2 -O2 C, and the TU's "~20 drafts plateaued at LENGTH-DRIFT/-33" wall was simply the GTE macros being undefined and compiling to implicit `jal`s (the card's prior body has that exact defect). Draft is now 346/346 instructions with the exact 0x70 frame, exact stack offsets, and the 9 callee-saved allocations (r=$s4 c=$s2 va=$s | `/home/musashi/bfm-decomp/.run/S79w/opus/func_8017DC80.c` |
| 16 | func_800D06E8 | None |  | None | failed |  | resolver CC1 (real-TU rtu_match, 20260825-233820): .run/resolver/work/resident__func_800D06E8/c0/rtu/func_800D06E8/t.c:1770: conflicting types for `Struct80078E78' | `.run/wave_ch/shard62/func_800D06E8.c` |
| 17 | func_80062144 | None |  | None | failed |  | won't compile standalone (loose-typing / missing decl) |  |