Banked: func_80136334 (126, all four levers), func_8016B234 (129), func_8015FBE0 (125), func_80143D28 (131), func_8014D820 (126 of 128). 27,984 -> 26,714 sites. lever_census --check: 26,714 pin/asm sites, 26,714 marked !FAKE, 0 UNMARKED — OK THE MISSING CALL ARGUMENT CLASS IS NOW CONFIRMED SIX TIMES, independently, by six agents that never saw each other's work: a7, a8, a11, a12, a13, a25. In every case the source declares a call with fewer arguments than the callee really takes — m2c drops arguments at unprototyped and indirect call sites — and the register pin was hired to fake the instruction the missing argument would have produced. Mechanisms differ and were each proven on bytes: combine.c:1458's added_sets_2 gate; set_preference (global.c:1535/1589) applied ahead of first-fit at :997-1030, the argument copy degenerating to a self-move deleted at toplev.c:3142 / jump.c:424-443 so it costs zero instructions; and reorg.c:3374's liveness half, where restoring the argument adds a use to CALL_INSN_FUNCTION_USAGE (reorg.c:428) so a delay-slot steal is refused. No generator can reach any of it: every family rewrites statements and declarations, none edits a call's argument list. Two concurrency defects, both found by agents rather than by me: - the includers cache wrote through a FIXED temp name, so concurrent processes clobbered each other's os.replace and the loser saw FileNotFoundError, which reads like a compiler crash on the candidate. Now a unique tempfile per process. - the agent brief now mandates PACK/scratch/ for helper scripts and dumps, and says to retry once when a --try failure names something that is not your own text. Three agents had scripts overwritten mid-run by another agent. One valuable negative: func_80178970 does not close, and the agent proved why by construction rather than by exhaustion — only a call or a return writes $v0 in plain C, and a return's hard write is always emitted after its guarding branch, so combine deletes the call-result copy (combine.c:914-917, use_crosses_set_p at :10127-10130; the SMALL_REGISTER_CLASSES arm at :944-957 is not defined for MIPS). Its early-return rewrite still improves the source from 6 to 2 and reads better than the pinned original.
tools/
Everything under tools/ that this project wrote — the extractor, the byte gate, the matching harness, the campaign
machinery, the audits, the Ghidra scripts, the public-flip rewrite package — is licensed under the GNU Affero General
Public License v3.0 (the repository's LICENSE). There are no per-file license headers; this statement covers them.
Third-party pieces under tools/ keep their own licenses and are listed in the top-level THIRD_PARTY.md:
tools/brave-CUE/ (GPL-3.0, vendored source), the pinned submodules tools/maspsx (MIT), tools/decomp-permuter
(MIT), tools/asm-differ (Unlicense) and tools/m2c (GPL-3.0), and the gcc-2.7.2 compiler tarballs under tools/bin/
(GCC, GPL). The Sony SDK directory tools/psyq/ is never part of the repository — it is user-supplied and gitignored.
Where each tool fits and how to run it: docs/SETUP.md ("Tooling inventory"), docs/wave-playbook.md (the matching
procedure) and docs/public-flip-runbook.md (the publication procedure).