BFM-decomp/docs/phase26-triage.md

# Phase 26 — substantial-family crack triage (Task 6)

> Generated by the `.run/wf_triage_full.js` Ultracode Workflow (119 agents, 0 errors, 5.3M tok): per-family m2c draft (+§8 jtbl) → `match_one` reloc-masked closeness → class + §31/§45 lever + seed to `.run/phase26-seeds/`. **`match_one` is an ISOLATION indicator** (prepends common.h); the whole-binary byte-gate is the sole arbiter (G3/P9).

**119 draftable substantial uncracked families triaged** (2.38M templatable ins):

- **cheap: 29 families / 324,878 ins** — small §31/§42/§43 fixes; 23 reached closeness-0 isolation-MATCH.
- **permuter: 29 families / 341,416 ins** — 26–100 regalloc/schedule band.
- **fable5: 61 families / 1,714,957 ins** — giants / >100-diff / hard §31 classes; the Fable5 curriculum (below); seeds in `.run/phase26-seeds/`.

> **⚠ Banking caveat (verified 2026-07-11): the closeness-0 seeds do NOT bank as-is.** Gating all 23 into ov077 → **0/23** — each is a genuine function-level match but carries standalone type defs (`struct Obj`, scalar typedefs) + a Ghidra-typed signature that conflict with ov077's real TU (`redefinition of struct Obj`, `conflicting types for func_…`) = the §41 def-side wall. **Banking them needs the Task-8 reconcile pass** (`family_sweep --reconcile` / `canon_sig_reconcile` v3.2 — strip the ambient types, rewrite to the canonical sig, cast at uses). The isolation-MATCH is the crack; the reconcile is the plumbing. Paused before Task 8 per Drew.

## Closeness-0 cracked seeds (isolation-MATCH — Task-8 reconcile+gate+template ×members)

| func | nins | ×members | tw ins | note |
|--|--:|--:|--:|--|
| func_80160534 | 161 | 134 | 21,574 | MATCH(161 ins) on first try; state-dispatcher calling fn-ptr table D_801891B8[arg0->unk0] acros |
| func_8013C0F8 | 154 | 134 | 20,636 | MATCH 154/154 (reloc-masked) at -O0; O0 stack-machine pointer-relocation loop with a switch/jtb |
| func_80155800 | 145 | 134 | 19,430 | m2c draft matched byte-for-byte after two tweaks: widen the sp+0x10 local buffer to force frame |
| func_8014F4C0 | 141 | 134 | 18,894 | MATCH (141/141 ins, closeness 0): CSE-held temps + union u16/u8 flags field + char[8] blob for  |
| func_8015C128 | 129 | 134 | 17,286 | MATCH (129 ins) — m2c draft in project int-cast idiom; only fix was making the two 3-int stack  |
| func_8015CD20 | 129 | 134 | 17,286 | MATCH(0) — clean m2c draft; only levers were inverting the unk234 branch to ==0, sharing the un |
| func_80140608 | 123 | 134 | 16,482 | Full MATCH (123 ins, 0 mismatch): 5-case jump-table dispatch; m2c-drafted then fixed idx=(arg0& |
| func_8016C998 | 123 | 134 | 16,482 | Full MATCH (123/123 ins). Fixed via struct-copy grouping (§42a, 0x38-0x54 as two 16-byte nested |
| func_80167540 | 117 | 134 | 15,678 | Full MATCH (117 ins) confirmed by match_one; cheap crack via shared-store goto + operand-order  |
| func_8014CD80 | 97 | 134 | 12,998 | MATCH (97 ins, masked). m2c-clean structure; needed 2 block-layout reorders (return block hoist |
| func_801506A4 | 95 | 134 | 12,730 | m2c one-shot; MATCH(95 ins) after typing the switch variable `int` instead of unsigned short so |
| func_8014D12C | 93 | 134 | 12,462 | MATCH (93/93 ins, reloc-masked). m2c semantics correct; crack was pure early-return block-place |
| func_8015CA28 | 91 | 134 | 12,194 | MATCH (91/91 ins). m2c draft cleaned up; only lever was placing func_80161240 as a cold tail bl |
| func_8015C7E4 | 88 | 134 | 11,792 | Clean control-flow dispatcher; m2c draft with typed struct + fn-ptr table D_801891B8[unk0] MATC |
| func_80158638 | 87 | 134 | 11,658 | m2c one-shot; restructured the short-circuit else-tail (three &&-chained checks fall through to |
| func_8016A73C | 85 | 134 | 11,390 | MATCH(0) byte-exact: m2c draft + §42a struct-assign for D_800AE620 block-copy + signed `short`  |
| func_80156670 | 83 | 134 | 11,122 | Full byte MATCH (83/83 ins). m2c seed refined by: rewriting the D_80126AF6 guard as (char*)&D_8 |
| func_8014CF04 | 82 | 134 | 10,988 | MATCH(0): straight for-loop scan over 96 elem[0x10C] array; only levers were exact array count  |
| func_8012E138 | 81 | 134 | 10,854 | Clean m2c draft; full MATCH (81/81) after making the 3 global-snapshot shorts a u16[3] stack ar |
| func_801824D0 | 181 | 3 | 543 | MATCH(0) in isolation — 3-case compare-chain switch (no jtbl); two levers: hold a0->unkC2 in on |
| func_8017FAAC | 154 | 1 | 154 | MATCH (154 ins, reloc-masked). Cracked via 6 cheap C levers: unk70 byte/halfword union, CSE-def |
| func_80184D50 | 98 | 1 | 98 | MATCH 98/98 ins. m2c draft + cast-based offsets; two unaligned 8-byte copies modeled via packed |
| func_8017F290 | 86 | 1 | 86 | MATCH (86 ins): m2c switch draft + pointer-local (int *p=&D_801270CC) to force $s0 saved-reg ad |

## Fable5 crack curriculum (top 30 by templatable byte-weight — Task 7 window)

| # | func | nins | jr | tag | ×m | tw ins | lever hypothesis |
|--:|--|--:|:-:|--|--:|--:|--|
| 1 | func_80178D40 | 890 | Y | per-location | 134 | 119,260 | giant jtbl switch dispatch (§8) + overlay struct t |
| 2 | func_8015AE2C | 562 | Y | per-location | 134 | 75,308 | giant + struct-typing (needs overlay Actor* struct |
| 3 | func_8017A4AC | 536 | Y | per-location | 134 | 71,824 | switch-prologue scheduling + branch-vs-ternary str |
| 4 | func_8015A3C8 | 493 | Y | per-location | 134 | 66,062 | giant §45 struct-typed fn-ptr-table dispatch (*(&D |
| 5 | func_8013F350 | 490 | Y | per-location | 134 | 65,660 | giant §45 + struct-field typing §42a + s16/u8 narr |
| 6 | func_801380E0 | 438 | Y | per-location | 134 | 58,692 | regalloc ($sN saved-reg alloc of var_s3/var_s0/var |
| 7 | func_80131340 | 424 | Y | per-location | 134 | 56,816 | struct-typing + giant; §42a unaligned lwl/lwr stru |
| 8 | func_80176734 | 371 | . | per-location | 134 | 49,714 | regalloc ($s0-$s6 seven saved-reg pins) + §43 s16- |
| 9 | func_8015444C | 363 | Y | per-location | 134 | 48,642 | regalloc: saved-reg $sN swap ($s2=arg1/$s3=arg2/$s |
| 10 | func_80159C84 | 337 | Y | per-location | 134 | 45,158 | block/case-order layout (schedule) + repeated fn-p |
| 11 | func_8013C414 | 329 | Y | per-location | 134 | 44,086 | O0 stack-slot layout + byte-offset pointer-cast ac |
| 12 | func_80176218 | 327 | . | per-location | 134 | 43,818 | §45-A merged-accumulator (repeated (arg0<<16)>>14  |
| 13 | func_8013FAF8 | 312 | . | per-location | 134 | 41,808 | §43 s16-param sll/sra + §45-A merged-accumulator m |
| 14 | func_8014D820 | 304 | . | per-location | 134 | 40,736 | §42a struct-assign (lwl/lwr/swl/swr 4-byte unalign |
| 15 | func_80135EB0 | 289 | Y | per-location | 134 | 38,726 | regalloc/CSE — original reloads global pointer D_8 |
| 16 | func_801670E4 | 279 | . | per-location | 134 | 37,386 | giant(279): 3 templatable byte-table loops (s8->s1 |
| 17 | func_8013B83C | 272 | Y | per-location | 134 | 36,448 | O0 struct-field address materialization (§42a) — + |
| 18 | func_8015B950 | 271 | Y | per-location | 134 | 36,314 | regalloc: callee-saved promotion — 0xFFF50000 hois |
| 19 | func_80140958 | 260 | . | per-location | 134 | 34,840 | §43 s16 narrow-param (sll/sra) + §45-A merged-accu |
| 20 | func_8013CB84 | 249 | . | per-location | 134 | 33,366 | overlay-table absolute-indexed access + §42a packe |
| 21 | func_8013D53C | 240 | . | per-location | 134 | 32,160 | regalloc: un-merge accumulator to force 3rd saved- |
| 22 | func_80175DA8 | 231 | . | per-location | 134 | 30,954 | giant §45 + §43 narrow-param sll/sra (arg0<<16>>16 |
| 23 | func_8012956C | 226 | . | per-location | 134 | 30,284 | regalloc: saved-reg-pinned scratchpad ptrs ($s5=0x |
| 24 | func_8015C32C | 222 | Y | per-location | 134 | 29,748 | regalloc saved-register swap (§31): arg0 must land |
| 25 | func_8013FFD8 | 213 | Y | per-location | 134 | 28,542 | merged-accumulator return (a2, §45-A) + branch-pol |
| 26 | func_8016CBC0 | 209 | . | per-location | 134 | 28,006 | §42a struct-assign (D_800AE620 ptr struct-copy) +  |
| 27 | func_8015EA3C | 204 | . | per-location | 134 | 27,336 | §31 regalloc saved-reg swap ($s0↔$s1: entity must  |
| 28 | func_8015D738 | 201 | . | per-location | 134 | 26,934 | s8 narrow-param sign-extend (sll24/sra24, §43) + f |
| 29 | func_8013BD74 | 198 | Y | per-location | 134 | 26,532 | o0-stack-slot-layout + field-address-materializati |
| 30 | func_801412A8 | 198 | . | per-location | 134 | 26,532 | saved-reg $s0 spill/frame-elimination (regalloc) — |

## Permuter/cheap-Opus band (26–100 diff)

| func | nins | close | tw ins | lever |
|--|--:|--:|--:|--|
| func_8015F448 | 188 | 47 | 25,192 | regalloc (arg-reg assignment of CSE'd unkE + loa |
| func_80169BBC | 162 | 84 | 21,708 | schedule (reorder) — structural body matches; re |
| func_801299C8 | 158 | 135 | 21,172 | schedule+frame-elim: suppress spurious 8-byte fr |
| func_8014ADE0 | 139 | 60 | 18,626 | regalloc: register __asm__ pins ($17=p base, $18 |
| func_801555F4 | 131 | 98 | 17,554 | regalloc: merged var_v0 (the 5-or-7 flag written |
| func_8012AAAC | 125 | 77 | 16,750 | regalloc $v0/$v1 swap + schedule (store reorder  |
| func_8015D1B8 | 114 | 63 | 15,276 | regalloc ($s0 holds unmasked sum, andi reads $v1 |
| func_801594E8 | 108 | 34 | 14,472 | schedule/delay-slot (dbr) — target packs %hi add |
| func_8012CC88 | 105 | 64 | 14,070 | regalloc (pervasive $sN/temp-reg rename cascade  |
| func_80169228 | 105 | 35 | 14,070 | regalloc: $v0<->$v1 saved-swap on n=-0x40-(unk1C |
| func_80167714 | 104 | 76 | 13,936 | regalloc/copy-prop: target stores const to u1C t |
| func_801463A0 | 101 | 65 | 13,534 | schedule (load-delay-slot hoisting in the sequen |
| func_80177940 | 101 | 98 | 13,534 | regalloc ($sN alloc-order swap) + cse (defeat (x |
| func_801387B8 | 100 | 55 | 13,400 | regalloc: $v0/$v1 value-reg swap on var_v1 + $a0 |
| func_801379FC | 97 | 75 | 12,998 | schedule/delay-slot (dbr) — increment-order swap |
| func_8016B6BC | 94 | 77 | 12,596 | regalloc+schedule |
| func_8014C6F4 | 91 | 56 | 12,194 | regalloc: search-loop walker $a0-vs-$a1 (perm_re |
| func_80173CB4 | 90 | 70 | 12,060 | schedule+regalloc: save-order ($ra before $s0) + |
| func_8016EC0C | 88 | 74 | 11,792 | regalloc (saved-reg $sN swap: target $s1=const8, |
| func_8016AE5C | 85 | 33 | 11,390 | schedule/block-reorder + §5a cross-jump tail-mer |
| func_8012B4B8 | 84 | 82 | 11,256 | regalloc: saved-reg $sN swap + gcc CSE of &stack |
| func_8014D4C0 | 84 | 44 | 11,256 | reorder=schedule (block_6 tail arrangement + ext |
| func_8014D2A0 | 80 | 73 | 10,720 | regalloc — saved-reg $sN swap (arg0 vs loop-ptr  |
| func_8018308C | 166 | 40 | 498 | regalloc ($s1 null-path merge — resists, moves D |
| func_80183834 | 135 | 35 | 405 | schedule (first-block const-load hoist) + regall |
| func_80181F08 | 117 | 87 | 351 | struct/variadic arg-homing at top (§42a struct-a |
| func_80182E7C | 85 | 27 | 255 | schedule/block-layout (§31 reorder): gcc places  |
| func_801865EC | 125 | 65 | 250 | regalloc ($a1-vs-$a2 for nx=-unkE cascades whole |
| func_80183FB8 | 101 | 82 | 101 | schedule + regalloc: top-of-fn %hi/%lo global lo |