BFM-decomp/docs/phase26-triage.md

Phase 26 — substantial-family crack triage (Task 6)

Generated by the .run/wf_triage_full.js Ultracode Workflow (119 agents, 0 errors, 5.3M tok): per-family m2c draft (+§8 jtbl) → match_one reloc-masked closeness → class + §31/§45 lever + seed to .run/phase26-seeds/. match_one is an ISOLATION indicator (prepends common.h); the whole-binary byte-gate is the sole arbiter (G3/P9).

119 draftable substantial uncracked families triaged (2.38M templatable ins):

• cheap: 29 families / 324,878 ins — small §31/§42/§43 fixes; 23 reached closeness-0 isolation-MATCH.
• permuter: 29 families / 341,416 ins — 26–100 regalloc/schedule band.
• fable5: 61 families / 1,714,957 ins — giants / >100-diff / hard §31 classes; the Fable5 curriculum (below); seeds in .run/phase26-seeds/.

⚠ Banking caveat (verified 2026-07-11): the closeness-0 seeds do NOT bank as-is. Gating all 23 into ov077 → 0/23 — each is a genuine function-level match but carries standalone type defs (struct Obj, scalar typedefs) + a Ghidra-typed signature that conflict with ov077's real TU (redefinition of struct Obj, conflicting types for func_…) = the §41 def-side wall. Banking them needs the Task-8 reconcile pass (family_sweep --reconcile / canon_sig_reconcile v3.2 — strip the ambient types, rewrite to the canonical sig, cast at uses). The isolation-MATCH is the crack; the reconcile is the plumbing. Paused before Task 8 per Drew.

Closeness-0 cracked seeds (isolation-MATCH — Task-8 reconcile+gate+template ×members)

func	nins	×members	tw ins	note
func_80160534	161	134	21,574	MATCH(161 ins) on first try; state-dispatcher calling fn-ptr table D_801891B8[arg0->unk0] acros
func_8013C0F8	154	134	20,636	MATCH 154/154 (reloc-masked) at -O0; O0 stack-machine pointer-relocation loop with a switch/jtb
func_80155800	145	134	19,430	m2c draft matched byte-for-byte after two tweaks: widen the sp+0x10 local buffer to force frame
func_8014F4C0	141	134	18,894	MATCH (141/141 ins, closeness 0): CSE-held temps + union u16/u8 flags field + char[8] blob for
func_8015C128	129	134	17,286	MATCH (129 ins) — m2c draft in project int-cast idiom; only fix was making the two 3-int stack
func_8015CD20	129	134	17,286	MATCH(0) — clean m2c draft; only levers were inverting the unk234 branch to ==0, sharing the un
func_80140608	123	134	16,482	Full MATCH (123 ins, 0 mismatch): 5-case jump-table dispatch; m2c-drafted then fixed idx=(arg0&
func_8016C998	123	134	16,482	Full MATCH (123/123 ins). Fixed via struct-copy grouping (§42a, 0x38-0x54 as two 16-byte nested
func_80167540	117	134	15,678	Full MATCH (117 ins) confirmed by match_one; cheap crack via shared-store goto + operand-order
func_8014CD80	97	134	12,998	MATCH (97 ins, masked). m2c-clean structure; needed 2 block-layout reorders (return block hoist
func_801506A4	95	134	12,730	m2c one-shot; MATCH(95 ins) after typing the switch variable int instead of unsigned short so
func_8014D12C	93	134	12,462	MATCH (93/93 ins, reloc-masked). m2c semantics correct; crack was pure early-return block-place
func_8015CA28	91	134	12,194	MATCH (91/91 ins). m2c draft cleaned up; only lever was placing func_80161240 as a cold tail bl
func_8015C7E4	88	134	11,792	Clean control-flow dispatcher; m2c draft with typed struct + fn-ptr table D_801891B8[unk0] MATC
func_80158638	87	134	11,658	m2c one-shot; restructured the short-circuit else-tail (three &&-chained checks fall through to
func_8016A73C	85	134	11,390	MATCH(0) byte-exact: m2c draft + §42a struct-assign for D_800AE620 block-copy + signed short
func_80156670	83	134	11,122	Full byte MATCH (83/83 ins). m2c seed refined by: rewriting the D_80126AF6 guard as (char*)&D_8
func_8014CF04	82	134	10,988	MATCH(0): straight for-loop scan over 96 elem[0x10C] array; only levers were exact array count
func_8012E138	81	134	10,854	Clean m2c draft; full MATCH (81/81) after making the 3 global-snapshot shorts a u16[3] stack ar
func_801824D0	181	3	543	MATCH(0) in isolation — 3-case compare-chain switch (no jtbl); two levers: hold a0->unkC2 in on
func_8017FAAC	154	1	154	MATCH (154 ins, reloc-masked). Cracked via 6 cheap C levers: unk70 byte/halfword union, CSE-def
func_80184D50	98	1	98	MATCH 98/98 ins. m2c draft + cast-based offsets; two unaligned 8-byte copies modeled via packed
func_8017F290	86	1	86	MATCH (86 ins): m2c switch draft + pointer-local (int *p=&D_801270CC) to force $s0 saved-reg ad

Fable5 crack curriculum (top 30 by templatable byte-weight — Task 7 window)

#	func	nins	jr	tag	×m	tw ins	lever hypothesis
1	func_80178D40	890	Y	per-location	134	119,260	giant jtbl switch dispatch (§8) + overlay struct t
2	func_8015AE2C	562	Y	per-location	134	75,308	giant + struct-typing (needs overlay Actor* struct
3	func_8017A4AC	536	Y	per-location	134	71,824	switch-prologue scheduling + branch-vs-ternary str
4	func_8015A3C8	493	Y	per-location	134	66,062	giant §45 struct-typed fn-ptr-table dispatch (*(&D
5	func_8013F350	490	Y	per-location	134	65,660	giant §45 + struct-field typing §42a + s16/u8 narr
6	func_801380E0	438	Y	per-location	134	58,692	regalloc ($sN saved-reg alloc of var_s3/var_s0/var
7	func_80131340	424	Y	per-location	134	56,816	struct-typing + giant; §42a unaligned lwl/lwr stru
8	func_80176734	371	.	per-location	134	49,714	regalloc ($s0-$s6 seven saved-reg pins) + §43 s16-
9	func_8015444C	363	Y	per-location	134	48,642	regalloc: saved-reg $sN swap ($s2=arg1/$s3=arg2/$s
10	func_80159C84	337	Y	per-location	134	45,158	block/case-order layout (schedule) + repeated fn-p
11	func_8013C414	329	Y	per-location	134	44,086	O0 stack-slot layout + byte-offset pointer-cast ac
12	func_80176218	327	.	per-location	134	43,818	§45-A merged-accumulator (repeated (arg0<<16)>>14
13	func_8013FAF8	312	.	per-location	134	41,808	§43 s16-param sll/sra + §45-A merged-accumulator m
14	func_8014D820	304	.	per-location	134	40,736	§42a struct-assign (lwl/lwr/swl/swr 4-byte unalign
15	func_80135EB0	289	Y	per-location	134	38,726	regalloc/CSE — original reloads global pointer D_8
16	func_801670E4	279	.	per-location	134	37,386	giant(279): 3 templatable byte-table loops (s8->s1
17	func_8013B83C	272	Y	per-location	134	36,448	O0 struct-field address materialization (§42a) — +
18	func_8015B950	271	Y	per-location	134	36,314	regalloc: callee-saved promotion — 0xFFF50000 hois
19	func_80140958	260	.	per-location	134	34,840	§43 s16 narrow-param (sll/sra) + §45-A merged-accu
20	func_8013CB84	249	.	per-location	134	33,366	overlay-table absolute-indexed access + §42a packe
21	func_8013D53C	240	.	per-location	134	32,160	regalloc: un-merge accumulator to force 3rd saved-
22	func_80175DA8	231	.	per-location	134	30,954	giant §45 + §43 narrow-param sll/sra (arg0<<16>>16
23	func_8012956C	226	.	per-location	134	30,284	regalloc: saved-reg-pinned scratchpad ptrs ($s5=0x
24	func_8015C32C	222	Y	per-location	134	29,748	regalloc saved-register swap (§31): arg0 must land
25	func_8013FFD8	213	Y	per-location	134	28,542	merged-accumulator return (a2, §45-A) + branch-pol
26	func_8016CBC0	209	.	per-location	134	28,006	§42a struct-assign (D_800AE620 ptr struct-copy) +
27	func_8015EA3C	204	.	per-location	134	27,336	§31 regalloc saved-reg swap ($s0↔$s1: entity must
28	func_8015D738	201	.	per-location	134	26,934	s8 narrow-param sign-extend (sll24/sra24, §43) + f
29	func_8013BD74	198	Y	per-location	134	26,532	o0-stack-slot-layout + field-address-materializati
30	func_801412A8	198	.	per-location	134	26,532	saved-reg $s0 spill/frame-elimination (regalloc) —

Permuter/cheap-Opus band (26–100 diff)

func	nins	close	tw ins	lever
func_8015F448	188	47	25,192	regalloc (arg-reg assignment of CSE'd unkE + loa
func_80169BBC	162	84	21,708	schedule (reorder) — structural body matches; re
func_801299C8	158	135	21,172	schedule+frame-elim: suppress spurious 8-byte fr
func_8014ADE0	139	60	18,626	regalloc: register asm pins ($17=p base, $18
func_801555F4	131	98	17,554	regalloc: merged var_v0 (the 5-or-7 flag written
func_8012AAAC	125	77	16,750	regalloc $v0/$v1 swap + schedule (store reorder
func_8015D1B8	114	63	15,276	regalloc ($s0 holds unmasked sum, andi reads $v1
func_801594E8	108	34	14,472	schedule/delay-slot (dbr) — target packs %hi add
func_8012CC88	105	64	14,070	regalloc (pervasive $sN/temp-reg rename cascade
func_80169228	105	35	14,070	regalloc: $v0<->$v1 saved-swap on n=-0x40-(unk1C
func_80167714	104	76	13,936	regalloc/copy-prop: target stores const to u1C t
func_801463A0	101	65	13,534	schedule (load-delay-slot hoisting in the sequen
func_80177940	101	98	13,534	regalloc ($sN alloc-order swap) + cse (defeat (x
func_801387B8	100	55	13,400	regalloc: $v0/$v1 value-reg swap on var_v1 + $a0
func_801379FC	97	75	12,998	schedule/delay-slot (dbr) — increment-order swap
func_8016B6BC	94	77	12,596	regalloc+schedule
func_8014C6F4	91	56	12,194	regalloc: search-loop walker $a0-vs-$a1 (perm_re
func_80173CB4	90	70	12,060	schedule+regalloc: save-order ($ra before $s0) +
func_8016EC0C	88	74	11,792	regalloc (saved-reg $sN swap: target $s1=const8,
func_8016AE5C	85	33	11,390	schedule/block-reorder + §5a cross-jump tail-mer
func_8012B4B8	84	82	11,256	regalloc: saved-reg $sN swap + gcc CSE of &stack
func_8014D4C0	84	44	11,256	reorder=schedule (block_6 tail arrangement + ext
func_8014D2A0	80	73	10,720	regalloc — saved-reg $sN swap (arg0 vs loop-ptr
func_8018308C	166	40	498	regalloc ($s1 null-path merge — resists, moves D
func_80183834	135	35	405	schedule (first-block const-load hoist) + regall
func_80181F08	117	87	351	struct/variadic arg-homing at top (§42a struct-a
func_80182E7C	85	27	255	schedule/block-layout (§31 reorder): gcc places
func_801865EC	125	65	250	regalloc ($a1-vs-$a2 for nx=-unkE cascades whole
func_80183FB8	101	82	101	schedule + regalloc: top-of-fn %hi/%lo global lo