BFM-decomp/phase-ends/DIGEST.md

phase-ends/DIGEST.md — the session-start digest (every PhaseEnd in one page + every rule in full)

Purpose (R64 candidate, Drew 2026-09-05). The Session Start Protocol used to read all 32 PhaseEnd files (~510 KB, ~150k tokens) before any work. This digest replaces that read: it carries every rule's full text (the rules acknowledgment is transcribed from here) and a synopsis of every phase, so a session reads PROJECT_CONTEXT.md → this file → the three most recent PhaseEnd_*.md in full → CURRENT_PHASE.md (and replays its 🛑 block verbatim into the chat). Budget: the whole protocol ≈ 100k tokens + the verbatim checkpoint. The PhaseEnd files are still the durable record (never deleted, R19) — read an older one on demand when a synopsis is not enough. Maintenance: at every PhaseEnd, append that phase's synopsis and its ratified rules here (a P7 checkbox). This file is DERIVED from the PhaseEnds and may be corrected; PROJECT_CONTEXT.md is never edited (P1).

0. Where the project stands (at the latest PhaseEnd — the live state is in CURRENT_PHASE.md)

Brave Fencer Musashi (SLUS-00726) matching decomp. Phase 33 closed 2026-09-07 (v1.32.0) on a RE-CHARTERED milestone: everything before the public flip is done. The 100% contract was re-proven as one recorded run (218/218 from a clean rebuild; sdk-dual both legs; every oracle green; fleet 363,214 / 13,492,113 / 5,820,205 all 100%; main game-code 45,150 / 45,150 — the build-derived denominator, 3,616 words above Ghidra's) on a tree a stranger can build (make disc-extract, make bootstrap, the fresh-clone proof, the Ghidra database regenerable from config/ghidra/). The whole history was rewritten with git-filter-repo (4,031 commits verified pair by pair, docs/commit-map.tsv), force-pushed IN PLACE, .git 93 MB; the publishing surface (README with generated numbers, AGPL for tools/docs, no license asserted over src/, NOTICE, THIRD_PARTY, badges, ROM-free CI), the releases (gcc-2.7.2 map, xsig, the permuter driver — offered upstream and declined, the drafter write-up, the decomp.me preset proven through decomp.me's own toolchain), the outreach notes, story, retrospective, wiki (13 pages) + how-to (13 chapters), and the Gen3 charter (docs/gen3-handoff.md, docs/gen3-standards.md) are written. The repository is still PRIVATE: GitHub Support must purge the old objects first (ticket #4736982; the Activity view publishes every pre-force-push tip, so a clean tree is not enough). Phase 33.5 is OPEN (gate 1 2026-09-07, v1.32.0 → v1.32.1; phase-ends/CURRENT_PHASE.md): a docs sub-phase before the flip — the wiki becomes the single source of truth (five new pages, six documents folded in, ~61 files sunset into docs/sunset/ with an archive index), the tracked .run/ is pruned to flip-ready, the memory store is reconciled, and the day-one decomp kit decomp-architect/ (a Phase-0.5 overlay on ProjectArchitect 2.0) is built and dry-run installed; R74–R83 ratified at its gate 1. Then Phase 34 = the flip + the outward actions + C11 + the v2.0.0 PhaseEnd = Gen2 EXIT (docs/phase34-seed.md; plan it fresh in plan mode at Max). Gen3 opens at Phase 35.

1. Corrections and supersessions of PROJECT_CONTEXT.md recorded in PhaseEnds (P1: the constitution is never edited)

• Session start reads this digest + the last three PhaseEnds, not every PhaseEnd (R64 candidate, Drew 2026-09-05).
• P8 "absorb and delete CURRENT_PHASE.md" → R19: git mv it to phase-ends/logs/Phase<N>.md, out of the load order; consult a log only when researching a past mechanism.
• Commit cadence: P4 per-task → R8 one-commit-at-phase-end (P2) → per-session checkpoint commits (P7) and R20 backups → today: one commit per completed task after CURRENT_PHASE.md is updated; a bank commits the moment it exists (R42). Claude commits; Drew pushes (R6); the PhaseEnd + archived log are left uncommitted for Drew's milestone-close commit; no Co-Authored-By (R5).
• H1 was relaxed while private (R1, 2026-06-10 → 2026-09-06) and is IN FORCE again since Phase 33 C3 (2026-09-06): the ROM-derived and proprietary paths left the index and were purged from the whole history before the public flip (docs/public-flip-runbook.md); R1 is historical. R20's backup home is now the text export config/ghidra/ (+ tools/ghidra_rebuild.sh --proof), dumps/CHECKSUMS.sha1, tools/psyq_CHECKSUMS.sha256, and the private archive repo Druthulu/BFM-decomp-archive (the pre-rewrite history); never git clean -x (CLAUDE.md fail-safe).
• Environment: all-in-WSL (R2); Ghidra runs headless (MCP server via tools/ghidra_mcp_start.sh / the SessionStart hook; symbols persist only via tools/ghidra_apply_symbols.sh, MCP renames do not); PCSX-Redux is Windows-native bridged over the web API (R11); no /tmp, scratch under .run/ (R12).
• Roadmap: the constitution's Gen1 roadmap ended at Phase 7 (Gen1 EXIT confirmed 2026-06-15); Gen2 phases 8–32 are governed by docs/gen2-roadmap.md → docs/roadmap-to-100.md v2; Phase 14 (public flip) became P33 — executed as an IN-PLACE flip with the full rewritten history (not gen2-roadmap's two-repo mirror; decision log P33 S86), 2026-09-06/07.
• Effort doctrine (Drew 2026-07-04, docs/effort-map.md governs): xHigh for most tasks, Max for deep tasks (phase plans, PhaseEnds, non-obvious debugging), Ultracode for breadth; plan mode always Max; every transition is prompted (R27). Model ladder for drafters: Haiku ≤~50 ins → Sonnet ~50–120 → Opus ≥120 → Fable only for a NEW wall class.
• Compiler triple pinned (P6, SETUP §5.4): gcc-2.7.2-psx cc1 -O2 -G0 -mips1 -mcpu=3000 -mgas -msoft-float -fgnu-linker → maspsx --aspsx-version=2.56 --expand-div → mipsel-as -march=r3000 -mtune=r3000 -no-pad-sections -O1 -G0; per-file -O0 modules exist (boot, the _o0 splits).

2. Phase synopses (what each phase delivered, its key finding, the rules it added)

P1 (2026-06-13, v1.1.0) Repo governance + WSL RE stack. Ghidra 12.1 + GhidrAssistMCP + ghidra_psx_ldr installed headless; SLUS_007.26 imported (1,726 fns, PsyQ 4.0.0), PsyQ types imported; the LZSS decompressor at 0x80018730 decompiled via MCP. Rules R1–R6. P2 (2026-06-13, v1.2.0) Deterministic extraction. tools/bfm_extract walks the disc/.CD/PAC/LZSS into 1,801 manifest-tracked artifacts, byte-validated against CUE's brave (138/138 type-4). docs/effort-map.md. Rules R7, R8. P3 (2026-06-14, v1.3.0) File-loader & overlay map. The loader is a hand-rolled CdControl reader driven by cdFileLocTable (LIST.CD) + resourceIdMap; LZSS staging 0x80079A70; PCSX-Redux runtime oracle; resident blob @0x800CEDF8 and location overlays @0x80128158 byte-proven against live RAM; 13 area-states; player state verified. Rules R9–R12. P3.5 (2026-06-14, v1.3.1) Prototype spike — NO-GO. Neither US prototype carries symbols; Sep-8 = retail minus 3 functions; protos kept only as assets. Rules R13, R14. P4 (2026-06-14, v1.4.0) Build toolchain. binutils-mipsel 2.42, splat64 0.41.0, pinned submodules (maspsx/asm-differ/m2c/decomp-permuter), gcc-2.7.2-psx/cdk cc1 (i386 static); make check-env. No rules. P5 (2026-06-14, v1.5.0) All-asm byte-identical EXE (143dbb89…) from the splat config; -G0; binutils 2.42 byte-clean. Rule R15. P6 (2026-06-14, v1.6.0) Compiler pinned + first matches. The triple above (--expand-div required); 14 matches; docs/matching-cookbook.md and the permuter harness created. Rule R16. P7 (2026-06-15, v1.7.0) Gen1 EXIT. Reports (progress/difficulty/dup); the -O0 boot module; real PsyQ library objects linked byte-identical (libcd + libgs); LZSS matched; 43 REAL. Rules R17–R19. P8 (2026-06-15, v1.8.0) Eight more PsyQ libraries linked; EXE 50.24% byte-identical-from-source. Rule R22. P9 (2026-06-15, v1.9.0) Binary-agnostic toolchain (make build BINARY=<alias>, required --vram-base/--exe). Rule R23. P10 (2026-06-15, v1.10.0) The resident engine blob is the 2nd byte-identical binary (8e17e02f…, flat-blob recipe); it detects PsyQ 4.7. Rules R24, R25. P11 (2026-06-16, v1.11.0) Cross-binary dedup pipeline (sig_image.py, dup_report --cross, config/dedup.us.yaml, src/shared/); all 134 overlays signed — 9,366 cross-binary groups. No rules. P12 (2026-06-16, v1.12.0) Resident harvest 1.4% → 85.6% via the Ultracode parallel-draft + whole-binary byte-gate (harvest_verify.py, match_one.py); the "script VM" is compiled-MIPS dispatch tables; save format documented. Rule R26. P13 (2026-06-16, v1.13.0) Representative overlays; 6 binaries; tools/new_overlay.sh; non-4-aligned overlay handling; dup-pair collapse. Rules R27–R29. P15 (2026-06-18, v1.14.0) All 134 overlays onboarded (136 binaries); dedup_propagate + engine_core.h (match once → ×134); fleet 3.82% → 54.48%; sig_unify. No rules. (P14 public flip deferred.) P16 (2026-06-19, v1.15.0) PIVOT. m2c + permuter cannot crack the loose-typed engine core (~3%); docs/struct-core-pivot.md. P17 (2026-06-20, v1.16.0) Canonical-sig layer; the wall is the compiler's codegen, not signatures/types; 55.51%. P18 (2026-06-20, v1.17.0) Compiler-quirk research → the register-pin toolkit (cookbook §17); waves 33% → 56% → 90% close-rate; 56.64%. P19 (2026-06-20, v1.18.0) Scaled waves (88/92% match_one); canon_resident_calls, fix_arity_callers; propagation is the cap; 58.00%. P20 (2026-06-21, v1.19.0) cast_call_sites cap tool; typedef type-lift; the %lo-fold class cracked; 58.82%. Rule R30. P21 (2026-06-26, v1.20.0) The automation manager (gate_stage, worker_wave, grinder, orchestrator, backlog ledger, idiom_loop); 63.18%; automated ceiling byte-proven; a 5-scout sweep found no external shortcut. P22 (2026-06-29, v1.21.0) Tractable giants banked ×134; 63.66%; pivot to the local LLM tier. P23 (2026-07-02, v1.22.0) THE BREAKTHROUGH. Local 7B tier saturates ≤15-ins ($0); Fable reading the gcc-2.7.2 source cracks "unsteerable" classes → the §31 codegen map (docs/gcc-2.7.2-map/); 64.86%; gcc-papermario is gcc 2.8.1 — vanilla 2.7.2 staged under tools/reference/. P24 (2026-07-08, v1.23.0) Permuter overhaul (masked scorer, §31 class weights, ILS); integration-recovery tools; every matched giant ×134 (incl. the 770-ins whale, the 400-ins flagship); 66.02%; the h_norm structural-family reframe. P25 (2026-07-11, v1.24.0) Family engine (family_remap/family_sweep, canon_sig_reconcile v3.2, rtu_match); giant endgame complete; 74.6% fn / 58.2% instr / 30.3% distinct; the h_seq reframe → family-endgame-megaplan.md. Rule R31. P26 (2026-07-15, v1.25.0) Family engine + the 26-A tooling-integrity audit (corpus.py, cdecl.py, audit-corpus — the tools WERE several walls) + the §52 discovery flywheel; 68.9% instr / 49.2% distinct; mechanical harvest exhausted. Rules R32–R34. P27 (2026-07-15, v1.26.0) Instruments fixed (fail-closed Makefile, one typedef-strip primitive, second oracle on resident); disc audit 136 → 140 + 39 type-1 modules found; the pin-crash "wall" was a tool bug; 67.0% (denominator correction). Rule R35. P28 (2026-07-16, v1.27.0) Instrument repair; B2 LIVES (its 0/8 was a missing carve); SC07 pool wired via dedup_extend (6,174 members); resident 90%; 68.9%. Rule R36. P29 (2026-07-30, v1.28.0) THE FAMILY CAMPAIGN. 25 sessions / 552 commits; 68.9 → 87.5% instr, 49.5 → 78.0% distinct; diff_regions.py resolved the swing number (tooling); integration, not idioms, is the wave bottleneck; roadmap v2. Rule R37 proposed. P30 (2026-08-14, v1.29.0) Recovery & concentration; 87.5 → 95.3% instr; fleet 140 → 213 (disc audit + module onboarding); the zero-token mechanical pipeline (aprop_autodraft, symfix, prechecks, gate_lane); the §172 wall model. R37 operated as binding; R38–R39 proposed. P31 (2026-09-05, v1.30.0) THE FRONTIER ATLAS & WIDE-TOLERANCE CAMPAIGN. 30 sessions / ~1,660 commits; the atlas (atlas.py), 6,000-ins waves, autonomous lanes, a completion sprint; stubs 12,059 → 21; fleet 95.3 → 100.0% instr; main 1,041 → 12 open; libpad 4.2.1 + RTL 4.2 archive linked (twelve "walls" were Sony objects); the verbatim __asm__ class censused to 5 PERMANENT rows; gate_main (main gates only by clean rebuild). R37–R39 ratified; R40–R43 + R61 accepted; R44–R60, R62–R63 proposed → all ratified at P32 gate 1 (2026-09-05). P32 (2026-09-06, v1.31.0) THE FRONTIER EMPTIED. 5 sessions (S81–S85) / 111 commits. The five parked disc payloads onboarded on their first static-derived bases (fleet 213 → 218, UNCLAIMED 0 of 220); 77 functions banked — 3 tooling-first, 20 free, 39 by a one-agent-per-function pass, 13 in T4b (Drew's directive: everything short of Sony's objects and the original hand-asm must be C — 11 by a Fable pass reading pass dumps, 2 by hand), 2 in T4c (the "PROVED"/"PLATEAU" main rows) — every final bank pin-free. Two written verdicts fell to producers missing from their censuses: combine's self-update bookkeeping gap that mints a no-traffic frame slot (§501-Q) and loop.c's user-variable rule + cse's later-mention canonicalization (§501-R: three inline temps merged by combine_movables, u16 as a cse firewall, the allocation order IS the callee-saved bank). Census 0 stubs; fleet 100.00 / 100.0 / 100.0; main 2,091 / 2,091. phase-ends/DIGEST.md created (R64). Rules: R44–R63 ratified at gate 1; R64 ratified; candidates (i)–(ix) recorded. Instruments: payload_base_evidence.py, ghost_census.py, agent_drafts_restore.py, cc1_dumps_tu.sh, alloc_table.py, bank.sh. P33 (2026-09-07, v1.32.0) VERIFIED, REWRITTEN, PUBLISHED-READY (re-chartered close). 4 sessions (S86–S89) / 59 commits. Block A: instruments fixed (build-derived sig-main: main game-code 45,150 not 41,534; NO_SDK + make sdk-dual) and THE RECORDED RUN (tools/verify_contract.sh, docs/verification.md, 218/218). Block B: the public build path (make disc-extract, portable includes, tools/bootstrap.sh + the fresh-clone proof 218/218 in 4 m 18 s, tools/fetch_psyq.sh, Ghidra export/import/rebuild --proof, dumps/CHECKSUMS.sha1, the ROM-free CI with audit_public.py + compile_only.py). Block C: tools/public_rewrite/ — two trial rewrites caught two corrupting defects; the real rewrite 4,032 → 4,031 commits / 0 old hashes / 4,031 pairs verified; adoption, commit-map.tsv, C8 R22, Drew's force-push, gc (12 stale worktrees pinned 12 GB), .git 1.5 GB → 93 MB. Block D: README/LICENSE/NOTICE/THIRD_PARTY, badges + objdiff + frogress, SETUP public-clean, doc_links. Block E: gcc-map README + gccmap_cites, tools/xsig/ + Druthulu/xsig (public), the permuter PR (#213/#214 closed unmerged — the maintainer keeps the wildcard, prefers symbol renames in the asm, and read the model-drafted text as LLM-written → Drew's rule: outward text in a developer's voice, no AI acknowledgement), the drafter write-up, decompme-preset.md + tools/decompme_replica.sh (decomp.me = old-gcc 0.13 + maspsx 86ccd7d8, rebuilt locally, 26/26 words), outreach/archipelago.md (+ four memory-map corrections from reading their addresses against our source). Block F: timeline.py + story, mine_hindsight.py + retrospective, the wiki + how-to + wiki_render/wiki_sync. Block G: gen3-handoff.md, gen3-standards.md, phase34-seed.md. Findings: GitHub's Activity view publishes every pre-force-push tip (the flip must wait for the purge); the probe was a writer (R57). Rules: R65–R73 ratified at gate 1; candidates (a)–(j) proposed for P34 gate 1.

3. Every rule, in full (transcribe these at session start; P/G/H/X are in PROJECT_CONTEXT.md)

• R1 — H1 relaxed while private. ROM-derived content (asm/, assets/, extracted/, decompressed .CD) MAY be committed while the repo is private; accidental inclusion is not a violation. The raw multi-GB disc dump stays ignored regardless. Compliance before going public = history scrub + a rom→decoder regeneration tool.
• R2 — All-in-WSL (H2 restatement). One ext4 clone at ~/bfm-decomp; no Windows/WSL split, no second clone, no /mnt builds; MCP is loopback 127.0.0.1:8080.
• R3 — All tooling under tools/. Including tools/bin (compilers), tools/psyq*, tools/ghidra_scripts.
• R4 — Plan mode every phase. Present the task-by-task plan and get approval before executing (the Phase Start gate).
• R5 — No Co-Authored-By trailer on commits.
• R6 — Git workflow = Claude commits in WSL, Drew pushes. Never git push from the WSL CLI. Phase-boundary exception: Claude writes PhaseEnd_PhaseN.md and archives CURRENT_PHASE.md but leaves them uncommitted; Drew commits AND pushes the milestone close.
• R7 — Effort-map check. Before each Phase Start, state the recommended effort for planning that phase per docs/effort-map.md and confirm the developer has it set; annotate every task in the plan with its effort; restate the recommended effort whenever presenting the NEXT task. docs/effort-map.md is the evolvable source of truth.
• R8 — One commit at phase end (P2; since superseded in practice by per-task commits, R20 checkpoints and R42 — the binding form today is one commit per completed task after CURRENT_PHASE.md is updated, banks committed immediately).
• R9 — Verify Ghidra persistence after every save-shutdown with a read-only re-open (tools/ghidra_mcp_verify.sh); never trust "Save succeeded" alone.
• R10 — Multi-datapoint live-RAM verification. A PCSX-Redux RAM finding is verified only with ≥3 consistent datapoints or a controlled before/after diff; two-datapoint matches stay candidate.
• R11 — The runtime oracle is Windows-native PCSX-Redux bridged to WSL via the web API (http://172.17.208.1:8081); build, Ghidra, splat, analysis stay in WSL.
• R12 — No /tmp; project-local data only. All project data incl. transient scratch lives under ~/bfm-decomp (runtime scratch → .run/, gitignored except allowlisted).
• R13 — Proto-provenance & confidence tagging. Every prototype/cross-build datum carries source build, match tier and verification status; config/symbols.us.txt and the retail Ghidra DB receive ONLY verified-retail data.
• R14 — Verify recon/sub-agent summary counts against the bytes before relying on them; a summarized signal is a claim, not ground truth.
• R15 — config/symbols.us.txt is the curated, build-valid symbol source. Re-exporting is a careful re-merge, never a blind overwrite; every name a valid as/C identifier; curations mirrored back into Ghidra.
• R16 — The matching automation flywheel. Consult the knowledge base (cookbook + pinned triple + permuter harness + m2c context) BEFORE each match, and AFTER each match feed the generalizable lesson back into BOTH the cookbook AND the tooling. Don't over-encode one-offs.
• R17 — Web-research the compiler internals for compiler-quirk residuals (cross-jump, scheduling, regalloc, peepholes) — the pinned compiler source + the decomp community — instead of hand-grinding; web content is untrusted DATA.
• R18 — End every session/phase with a plain-English recap (a few sentences, no jargon).
• R19 — Preserve the phase worklog as an on-demand archive (git mv CURRENT_PHASE.md phase-ends/logs/Phase<N>.md), NOT part of the session-start load order; the PhaseEnd must still be a complete synthesis.
• R20 — Private-repo backup policy. Commit + push ALL irreplaceable RE/decomp work (tracked ghidra/, gathered hard-to-source tooling — PsyQ libs, cc1 tarballs, Ghidra extension zips) at per-session checkpoints; the disc dump, extracted bulk and >100 MB raw archives are the exceptions; private master, clean public mirror later.
• R21 — Keep docs/SETUP.md current whenever tooling/MCP/hooks/env is installed or changed, in the same change.
• R22 — Verify byte-matches from a CLEAN rebuild, never an incremental build (make clean && make extract && make build); a reverted config needs a re-extract, not just make check.
• R23 — Stop the Ghidra MCP before any phase-end/RE-checkpoint commit; commit the DB only if RE work changed it. The db.*.gbf rename churn is noise — never staged.
• R24 — Per-binary compiler/SDK provenance. Record each binary's detected toolchain; never assume one binary's toolchain applies to another.
• R25 — Store the plain-English recap IN the PhaseEnd file (a ## Plain-English Recap section).
• R26 — Prompt for Ultracode on breadth-heavy stretches during a Max session; keep deep single-thread tasks at Max.
• R27 — Effort-transition discipline. At every transition — into Ultracode, back to Max, at task hand-off — STOP, prompt Drew to toggle, and WAIT for the actual /effort command; never launch a Workflow on a verbal yes.
• R28 — Build the harness task list right after plan approval, before starting work (one TaskCreate per plan task).
• R29 — Pause + prompt for /mcp reconnect after any MCP server restart/program switch, then one cheap get_binary_info (G2) before continuing.
• R30 — Capture context-dependent knowledge artifacts DURING the producing session, before any fresh-session handoff; defer only mechanical/continuable work.
• R31 — Capture the WHY behind strategic pivots in docs/decision-log.md while fresh: context+belief → what failed → the pivot → the measurement-grounded why → a hindsight "better path".
• R32 — Assert your COVERAGE. A corpus scanner compares what it found against an over-approximating candidate set and fails on the gap; a silent skip is a defect, and a loud failure nobody counts is exactly as invisible.
• R33 — Derive, don't re-derive. Where a proven invariant answers the question, derive from it rather than re-parse the source; the best outcome is a DELETED scanner.
• R34 — A second, DISAGREEING oracle — not a better assertion — when an oracle is structurally blind to an error class.
• R35 — Fix the measuring instrument before trusting its measurement; a probe from a broken tool is not evidence. Tool-integrity is a precondition of a measurement, not a parallel concern.
• R36 — A newly-discovered binary is not real until every consumer knows it (sig set, family map, dedup registry, shared-header include, reports) — asserted by a gate (make audit-binaries), not remembered.
• R37 — Probe before costing. Ground every estimate/attribution on ONE instance; derive counts from corpus.stubs; diff the artifact to prove an edit actually ran before judging the lever it carried.
• R38 — Read the recorded failure verdicts before designing an experiment (.run/harvest_failed.*.classified.txt, gate results, journals) — the answer is frequently already recorded.
• R39 — Negative-control every new refusal-check against the already-succeeded population; zero false positives before it ships.
• R40 — Exonerate the instrument before attributing a failure to its subject (truncation, fences, rate limits, tool faults first; ~a third of P31's "walls" were tooling).
• R41 — Every cost/rate/yield/effort number ships with its denominator.
• R42 — Commit banked work the moment it exists, before the next command that can touch src/ (a gate IS one); never blind-revert a dirty src/; count banks from the SOURCE.
• R43 — A tool must refuse an input it cannot handle, never process it wrongly.
• R44 — A card may not name a lever the knowledge base does not contain.
• R45 — Draw-time bankability: never draw a card the pipeline cannot bank.
• R46 — A budget is part of the harness, not a constant.
• R47 — Consume every verdict layer (a stage reading one bit of one oracle staged garbage forever).
• R48 — Never key by bare function name (scratch dirs, ledgers, drafts — collisions destroy work).
• R49 — A soft error inside a success envelope is still that error (a 200 carrying code 429; rc≠0 read as "no binary").
• R50 — Periodic whole-fleet verification (a byte gate is silent about every binary it did not build).
• R51 — A derived property stored as config will go stale and take a binary with it; derive it or give it a byte-proven self-repair.
• R52 — A blanket committer must not adopt a collapsed file (right for src/, wrong for config).
• R53 — Verify a build from its exit code, not its output file (a failed build leaves the previous binary in place).
• R54 — A guard downstream of the failure is not a guard, and a guard that is not running is not a guard.
• R55 — A lane that runs unattended must leave evidence (progress logs; empty log + no ps hits = never started).
• R56 — A gate verdict measures the draft only while the binary's baseline is green; check the baseline first.
• R57 — An instrument's own write path is part of the instrument.
• R58 — A session-close "clean" must quote the fleet's green count (tree-clean ≠ fleet-green).
• R59 — A blanket commit of another lane's mid-gate tree is a race, not a backup.
• R60 — config/overlays.mk and the splat yamls are CARVE STATE: a gate commit carries only its own binary's lines; any blanket restore/commit is followed by interleave_check + pads_audit on every touched binary.
• R61 — A tool must distinguish "judged and failed" from "not judged", and a judging tool must model what the gate does to the draft (a loop tool that reports "unchanged" for N cycles must prove it iterated).
• R62 — A ledger's best draft may never be an __asm__ body, and a bank whose body is __asm__ is a verbatim, not a bank (verbatim_check --strict in the per-bank close).
• R63 — A permuter/waypoint score is not a closeness until its diff is read.
• R64 (RATIFIED at PhaseEnd_Phase32, 2026-09-06; Drew-directed 2026-09-05) — Session start reads PROJECT_CONTEXT.md → phase-ends/DIGEST.md → the three most recent PhaseEnds → CURRENT_PHASE.md, then replays the 🛑 SESSION CHECKPOINT block VERBATIM into the chat; the protocol costs ≈100k tokens + the checkpoint. Every PhaseEnd appends its synopsis and rules to the digest (P7). A checkpoint is written to be replayed: self-sufficient, verbose, every path/command/hash explicit (see checkpoint-current-phase-before-pause memory). (R40–R43 and R61 were accepted mid-P31; their long forms are in phase-ends/logs/Phase31.md — the one-liners above are the binding text. R44–R63 one-liners are the P31 table, ratified at P32 gate 1.) R65–R73 — RATIFIED at Phase 33 gate 1 (Drew, 2026-09-06; the PhaseEnd_Phase32 candidates (i)–(ix), operated all of P32):
• R65 — A wall verdict must be PASS-attributed with a dump line (R40 extended: exonerate the instrument, then NAME the compiler pass, quoting the dump line that shows it). Six of the seven P32 T4 wall citations named the wrong pass; each crack came from one dump line (§501).
• R66 — Write "banked" only from the tool's printed success line (gate_main's BANKED line, bank.sh's sha == config line); never from the intent to bank. Two S83 ledger messages claimed banks that had not happened (a helper no-op on an empty list; a wrong draft dir).
• R67 — Agents write their deliverables early (draft file first, verdict JSON last); every agent lost to a usage limit had to be resumed, and the one that had written its draft first banked from the dead run.
• R68 — A helper must refuse an empty work list (R43 restated for helpers): bank.sh built the unchanged tree and exited 0 on an empty function list.
• R69 — A residual gets a PRODUCER CENSUS from the compiler source before any spelling sweep, and "PROVED" means every producer on a NAMED list was refuted on the bytes — a verdict says what it was proved against. §501-M/O were right about their lists; §501-Q/R were the producers missing from them.
• R70 — A ledger's tie-break is part of the instrument. backlog.py kept the earliest record at equal closeness, so a re-verdict could never render (S84).
• R71 — When a same-family sibling is banked, port its SPELLING before touching a dial on the draft (§501-N first try; §501-P first try after 3,360 sweep variants).
• R72 — A similarity score is not a shape oracle: a hand pass opens with a grep for the idiom's literal constants across src/ and an objdump of each hit's window against the target (the atlas scored the exact sibling 0.55, §501-P).
• R73 — Build the 1-second reproducer battery for a mechanism BEFORE probing the real function, and read the allocation ORDER (tools/alloc_table.py) before any register lever (§501-Q from 18 five-line reproducers after two sessions of real-function probes; §501-R from an 8-variant reproducer sweep; every pin then came off — accelerators (15)/(16)). R74–R83 — RATIFIED at Phase 33.5 gate 1 (Drew, 2026-09-07; the PhaseEnd_Phase33 candidates (a)–(j), operated through P33):
• R74 — No ROM-derived bytes in ANY published artifact — test fixtures, JSON, badges, reports, wiki pages and tracked scratch included. The xsig fixture was built from our own C at two link addresses for exactly this reason; the regenerated target .s stays under the ignored .run/. (Phase 33.5 found one tracked residue — two fable_cd4 disassembly listings — and untracks it.)
• R75 — Published numbers are generated, never typed (R51 applied to documents). docs/progress.json, the README block, the badges, the timeline: every hand-typed number in the old README was stale. A number that must appear in prose is a dated snapshot that carries the command that produced it.
• R76 — Rehearse every irreversible repository operation on a scratch copy and prove it pair by pair with POSITIVE assertions. Trial rewrite #1 exposed the empty-blob strip-list defect and the unchanged-commit case; the real run had 0 failures.
• R77 — A linked worktree's HEAD is a ref — audit git worktree list before any gc or purge. 12 stale worktrees (12 GB) pinned 3,729 old commits through the gc.
• R78 — R20 amendment: the text export + checksums + the archive repository are the backup; never git clean -x. The purged paths are ignored-but-present; a -x clean deletes the RE database (CLAUDE.md fail-safe since C3).
• R79 — pkill -f never with a literal the calling shell's own command line contains. S87 killed its own shell twice (exit 144).
• R80 — A checker that widens its document set must classify a missing promised page as PENDING, never BROKEN. doc_links + doc_links_pending.txt: 10 planned pages mid-F3, 0 false failures; the pending list must be EMPTY at a PhaseEnd (--strict).
• R81 — A probe or guard must never write into the repository it guards — a "read-only" check that fetches, clones or builds does so in a throwaway (R57 exemplar). The purge probe re-imported 5.97 GiB of the purged history on every run.
• R82 — A rewritten history is not private until the objects are gone from the HOST — its Activity view publishes every pre-force-push tip; gate a flip on the probe (or recreate the repository), never on a clean tree. 157 activity rows to 2026-06-11; the old tip still served the EXE, the dumps and the archive.
• R83 — Outward text to third parties is written by Drew the way a developer writes — short, plain, few or no code spans, no bullet walls, no evidence scaffolding — rewritten from the facts, never a model draft with the tells removed; no AI acknowledgement; the target project's AI-contribution policy is read first. The permuter maintainer closed #213/#214 and named the LLM-looking text as the reason he minded; sotn-decomp forbids autonomous-tool PRs outright.

4. Where things live (the doc map a session needs)

docs/SETUP.md (environment, every tool's row, commands) · docs/matching-cookbook.md §1–§500 (idioms; 3.5 MB — grep by §, never read whole) + docs/cookbook-index.md (symptom-keyed, derived, 566 KB — grep) · docs/gcc-2.7.2-map/ (the compiler map) · docs/wave-playbook.md (THE wave procedure; docs/automation-runbook.md is retired) · docs/effort-map.md · docs/roadmap-to-100.md v2 · docs/frontier-p32.md · docs/decision-log.md (R31) · docs/accelerators.md · docs/memory-map.md (addresses, provenance) · docs/formats.md · docs/disc-completeness.md + docs/disc-ledger.md · docs/backlog.md (near-miss ledger) · config/wave_exclude.txt (pinned walls) · config/verbatim_manifest.json · phase-ends/logs/ (on demand only, R19) · .run/ (scratch; allowlisted subtrees are tracked — e.g. .run/P32/t3/ drafts/ledger).