Files
BFM-decomp/docs
Drew T 9f5b221766 phase-36: T7 agent a7 — func_801287B8 closed lever-free: a truncated local extern was faking a $4 pin (127 bodies)
A new class, and the cheapest one found so far. ov_SC04_011.c:197 declares extern void func_8013BC7C(void); while that
function's real byte-verified definition, src/shared/ov/func_8013BC7C__8042ae05.h:3, is void func_8013BC7C(void *arg0).
The $a0 instruction the pin was forcing is the argument the TU's own declaration denies.

- the move: a block-local s32 *p = &D_801F1640; tested and passed through a function-pointer cast,
  ((void (*)(void *))func_8013BC7C)(p); — the idiom this TU already uses for two other calls. Score 0 on the first
  spelling tried, where seven mechanical runs and 4,000+ compiles had sat at 3, because every generator rewrites
  statements already present and this move adds an argument.
- mechanism, both halves proven on bytes: update_equiv_regs (local-alloc.c:947, the referenced-exactly-twice test at
  :1066, substitution at :1085-1112) — the second reference keeps the address in a register, which is what the volatile
  was faking; and combine_regs (local-alloc.c:1722, hard-reg path :1797-1818) records $4 in qty_phys_copy_sugg so
  find_free_reg (:2073, restricted at :2145-2150) colours the quantity $4, which is what the pin was faking.
  Controls: reading the global directly scores 9; declaring the pointer at function top scores 4.
- unlike agent a2's case this truncation is a LOCAL extern, so the cast keeps the bank body-only.
  delever --apply-body: ... IDENTICAL on 1 object(s) — KEPT, ledgered (rung E, a7)
  delever --propagate: 126 of 126 sibling(s) banked, 0 refused
  lever_census --check: 29,013 pin/asm sites, 29,013 marked !FAKE, 0 UNMARKED — OK
- the R22 fleet gate is deferred until the burst of 20 agents drains: make clean deletes the build/ baseline object that
  every live --try scores against. Banking and propagation only read build/, so the writing lane runs beside the agents.
- snapshot row 18.
2026-09-10 10:26:45 -06:00
..