EAC ELF Reconstruction Notes

Target: eac.elf

SHA-256: 0b44ad59697129534189efdb75cde2b96245f831438e9f6a53cb7725f190d739

Current Artifacts

• driver.c: dlopen/dlsym harness for exported x, now also dumps the EAC memory maps, the output buffer, and the global sidecar context. Optional EAC_DISPATCH_TRACE=1 patches selected dispatcher jumps to int3; EAC_DISPATCH_EXTRA_SITES, EAC_DISPATCH_FOCUS_SITES, and EAC_DISPATCH_STOP_AFTER_MATCHES add arbitrary computed-jump sites, log only the focused subset, and stop bounded probes once the desired dispatch hits are captured. EAC_VMTAIL_TRACE=1 patches direct VM tail sites, including focused synthetic-gap and native final-tail probe sites. Both trace modes log frame state plus sixteen 16-bit ip_w* lookahead words when detail data is available; EAC_VMTAIL_REGS=1 logs all GPRs at VM tail sites, EAC_VMTAIL_SCRATCH=1 logs default and configured frame scratch qwords, and EAC_VMTAIL_MEM=1 logs qwords at selected live GPR pointer values from EAC_VMTAIL_MEM_REGS. EAC_VMTAIL_FOCUS_IPS, EAC_VMTAIL_FOCUS_SITES, and EAC_VMTAIL_STOP_AFTER_MATCHES bound focused probes by VM IP and/or native tail site so targeted memory runs can stop after the relevant gap events instead of broad multi-minute traces.
• trace_preload.c: libc/network/process tracer with EAC-relative caller offsets. Network and process spawning are denied by default unless EAC_TRACE_ALLOW_NETWORK=1 or EAC_TRACE_ALLOW_SPAWN=1. EAC_TRACE_FAKE_NETWORK=1 now drives DNS/socket/connect/send/recv through a local fake socket path so network-dependent control can be probed without real outbound traffic.
• recon_summary.py: summarizes a dump directory, trace call sites, dispatcher edges, executable pointer fixups, memory-vs-file mutations, and context pointers.
• vm_tail_scan.py: ranks observed dispatch-table targets and suggests extra EAC_VMTAIL_SITES=0xsite:reg,... hooks using Capstone.
• vm_trace_log.py: shared raw-log helper that trims driver/output-buffer prefixes before [VMTAIL]/[DISPATCH] markers; instruction-trace, GPR-seed, tail-role, live-in, all-static, branch-predicate, and coverage parsers use it so embedded trace records are not missed.
• vm_trace_graph.py: converts a traced run into VM edge TSV form; default output is site-based, and --sequential emits dynamic per-frame transitions from ordered trace events. It parses arbitrary ip_wN fields; legacy TSVs still print w0..w5, but exact byte reconstruction uses the full logged lookahead window. It also normalizes driver-prefixed log lines by trimming to embedded [VMTAIL]/[DISPATCH] markers before parsing, so output-buffer echo text no longer hides valid tail events.
• vm_handler_table.py: merges dispatch-table metadata, dynamic trace profiles, and static Capstone handler features into one TSV.
• vm_bytecode_blocks.py: legacy Python reducer for direct executed VM instruction rows into contiguous bytecode coverage blocks. Default mode uses exact consumed bytes; --include-sampled adds logged prefix/backedge byte windows as partial coverage only. Routine Makefile refreshes now use the native vm_bytecode_blocks_fast reducer.
• vm_bytecode_recover.py: reconstructs VM byte values from instruction rows, verifies byte consistency, and emits segment hashes plus a unique instruction table. Default mode is exact-only; --include-sampled also inserts logged prefix/backedge byte windows without claiming the full instruction length is known.
• vm_bytecode_cfg.py: builds a bytecode block graph from instruction rows and recovered exact bytecode segments.
• vm_bytecode_control_edges.py: turns decoded long-branch and sampled-operand sidecars into explicit non-exact VM control-flow edges between recovered bytecode segments, with operand footprints and lifted target/IP-update pseudo-IR.
• vm_bytecode_ir.py: merges exact instruction lifts and decoded non-exact sidecars into a VM-IP sorted recovered bytecode IR table with source/target blocks, operand footprints, compact state/dispatch/IP expressions, validation provenance, and pseudo-IR.
• vm_bytecode_basic_blocks.py: splits the unified bytecode IR into recovered VM basic blocks, terminal edges with final-trace synthetic coverage status, Markdown block listings, and loop/backedge catalogs.
• vm_static_coverage_audit.py: reports static/global handler coverage next to dynamic/path bytecode coverage, including blocked/allowed network provenance, so no-network trace limits are explicit.
• vm_synthetic_span_catalog.py: catalogs byte-covered synthetic VM spans that still lack direct semantic IR rows, separating known handler/operand prefixes, unresolved tails, target-only spans, and footprint-only coverage.
• vm_synthetic_tail_catalog.py: aggregates unresolved suffix bytes from synthetic VM spans into exact tail variants, target-entry offsets, marker schemas, and recurring motifs.
• vm_synthetic_tail_lift.py: lifts unresolved synthetic suffix bytes back to VM-IP rows, tagging embedded target-entry mini-forms and feeding those comments into the C-like program sketches.
• vm_gap_report.py: ranks bytecode and handler coverage gaps from instruction rows, recovered segments, ISA missing-exact rows, decoded long-branch sidecars, adjacent hidden-transition sidecars, and per-handler semantic observations.
• vm_isa_summary.py: clusters exact recovered VM instruction signatures by source handler, fixed byte length, target distribution, and operand byte/word layout.
• vm_semantic_templates.py: merges ISA schemas with static handler features into per-handler rows and ranked semantic templates.
• vm_handler_skeleton.py: extracts normalized frame/IP/table access skeletons from handler disassembly and groups full, dispatch-tail, or canonical decode signatures.
• vm_state_effects.py: summarizes observed frame+0x170, frame+0x23, and frame+0x194 changes per handler or per (handler, delta, bytes) signature from state-aware traces.
• vm_state_affine.py: fits and cross-validates affine formulas for the frame+0x170 post-state from pre-state, instruction bytes, and optional traced flag/byte fields.
• vm_state_static_slice.py: statically tracks frame/IP pointers through handler code and emits symbolic update chains for frame+0x170 and frame+0x23.
• vm_state_static_validate.py: concretely executes the static state slice over state-aware trace rows and validates predicted frame+0x170 post-state.
• vm_static_dispatch_validate.py: concretely executes handler slices through the final table jump and validates predicted dispatch target plus VM IP advance.
• vm_static_transfer_expr.py: legacy Python version of the path-sensitive transfer-expression sampler. Routine refreshes now use vm_fast_path_profile --transfer-expr, which follows concrete state-aware trace paths while carrying symbolic expressions for the dispatch-table slot and VM IP advance; --by-path emits path-conditioned formula rows, and --gpr-run seeds handler-entry registers plus hot fs0x... scratch-frame fields.
• vm_static_path_profile.py: profiles concrete branch/path variants through static handler slices over the state-aware trace; --gpr-run seeds handler-entry registers and, when present, hot fs0x... scratch-frame fields from the previous VMTAIL snapshot to resolve live-in branch predicates.
• vm_fast_path_profile.c: native Capstone/OpenSSL reimplementation of the concrete replay core. It emits the same summary/by-path TSV schemas as vm_static_path_profile.py, native state/static-dispatch validation schemas, a --branch-sites full-trace branch-outcome TSV, SHA-256 path hashes, an --emit-dir batch mode that regenerates all _fast.tsv replay artifacts through make fast-replay, a --branch-predicates sampler, and a --transfer-expr sampler that replace the slow Python predicate/transfer replays for routine refreshes. The native model now preserves restore-trampoline push/pop register values, reads safe image-backed frame/IP values, normalizes frame/table/IP/stack pointers, and uses low-bit inequality proofs; make fast-replay fast-predicates fast-transfer refreshes replay, predicate, and transfer artifacts in elapsed=0:31.69 on this host.
• vm_instruction_unique_fast.c: native reducer for vm_bytecode_recover.py --instructions. It streams the existing 110 MiB instruction trace, groups exact instruction signatures with Python-compatible Counter tie ordering, and now backs the make instruction-unique target; make instruction-unique-fast-check byte-compares it against the Python output without forcing a raw trace rebuild. On the current trace it emitted the same 71365-line TSV in about 0.30s versus 4.04s for the Python reducer.
• vm_bytecode_segments_fast.c: native reducer for vm_bytecode_recover.py segment mode. It reproduces exact and --include-sampled bytecode segment TSVs, including dominant-byte selection, conflict accounting, SHA-256 segment hashes, prefix/suffix hex, and Python-compatible top source/target/delta counters; make bytecode-segments-fast-check compares raw exact, raw sampled, and final footprint-filled sampled outputs against Python. On the current trace it emits exact/sampled segment TSVs in about 0.63-0.68s versus about 4.9s per Python pass.
• vm_bytecode_blocks_fast.c: native reducer for vm_bytecode_blocks.py. It preserves exact and --include-sampled block TSVs, including interval merge semantics, stable row ordering for equal starts, and Python-compatible top source/target/delta/status counters; make bytecode-blocks-fast-check compares raw exact, raw sampled, and final footprint-filled sampled outputs against Python. On the current trace it emits raw exact/sampled block TSVs in about 0.56-0.65s and final augmented blocks in about 1.07s versus about 4.2s for Python.
• vm_branch_predicates.py: catalogs each static-replay branch predicate, including observed outcomes, unresolved predicate classes, and top concrete/symbolic condition expressions; for normal refreshes it is now only needed to render Markdown from the native TSVs.
• vm_dispatch_model_combine.py: combines the static dispatch validator with affine fallback formulas for static-dispatch misses.
• vm_tail_registers.py: infers per-tail-site register roles from EAC_VMTAIL_REGS=1 traces, including target value, dispatch-slot pointer, byte index, table pointer, and frame pointer. It can also join those roles back onto an instruction trace by source handler and tail site.
• vm_tail_static_slots.py: statically recovers consumed dispatch-slot temporaries for tail sites where the target is loaded from table + byte_index and the slot pointer is clobbered before the final jump.
• vm_instruction_lift.py: joins exact recovered VM instructions with per-signature state effects, compact state-affine tags, dynamic tail-register roles, static dispatch-slot provenance, and compact scalar/affine dispatch-formula tags.
• vm_transition_model.py: joins handler skeletons, static state chains, validation coverage, combined dispatch-model evidence, transfer expressions, long-control and sampled-operand bytecode lifts, state-only and GPR+scratch-seeded branch-predicate provenance, and tail operand provenance into a one-row-per-dispatch-entry transition model.
• vm_microcode_catalog.py: renders the joined handler reconstruction into a compact pseudo-IR catalog and a Markdown digest for high-volume handlers, now including source-level long-branch lifts, sampled-operand lifts, and state-only plus GPR+scratch-seeded branch-predicate summaries.
• vm_path_microcode_catalog.py: joins full concrete branch-path profiles with sampled path-conditioned transfer expressions into path-specialized pseudo-IR rows, carrying source branch-predicate context into each path row.
• vm_path_pseudocode_dump.py: renders path-specialized microcode rows into C-like concrete branch-path handler functions, using native GPR+scratch-seeded path rows by default; --unvalidated-only emits the weak frontier rows separately so they remain visible without mixing them into validated path coverage.
• vm_path_frontier_slot_audit.py: evaluates the weak path frontier slot expressions against bounded state-trace rows and emits C/TSV/Markdown evidence showing whether any unvalidated path can be promoted by a direct dispatch-table match.
• vm_c_reconstruction_manifest.py: emits a reproducible manifest of C-shaped reconstruction artifacts, function/block/call counts, coverage highlights, and mechanical gate commands.
• vm_synthetic_successor_gap_report.py: reports synthetic terminal successors that still do not land on recovered block starts, with source entries, footprint bytes, atlas context, and sampled-operand variant context.
• vm_synthetic_gap_transfer_probe.py: replays the remaining synthetic-successor gap bytes through the static transfer executor, classifying which gaps reduce to symbolic dispatch slots and which still require live central-dispatch registers.
• vm_synthetic_gap_dynamic_stitch.py: stitches remaining synthetic-successor gaps against the raw VMTAIL event order, inferring the next hooked source start when the next tail site has a fixed byte-matching handler shape.
• vm_synthetic_gap_chain_probe.py: attacks ambiguous dynamic stitches by replaying candidate next-source handlers at short offsets after the synthetic gap, promoting only candidates whose static transfer matches both the next hooked target entry and the next hooked VM IP.
• vm_synthetic_gap_symbolic_successors.py: audits symbolic-slot synthetic gap candidates against recovered IR rows and the next hooked dynamic event, without promoting conflicting evidence into hard CFG edges.
• vm_synthetic_gap_table_read_diagnostic.py: replays residual synthetic starts with concrete state plus live GPR/frame-scratch seeds and records the final dispatch-table access that still blocks hard target recovery.
• vm_synthetic_gap_table_memory_probe.py: maps those residual table-relative offsets back to file bytes, ELF sections, and dispatch-table boundaries to distinguish real table slots from code-byte/non-pointer reads.
• vm_synthetic_gap_runtime_table_memory_probe.py: compares those same residual table-relative offsets against postcall mapped EAC memory, so runtime relocation or patching is checked before rejecting a residual table read.
• vm_synthetic_gap_sampled_control_correlation.py: joins the residual starts with sampled-operand target/delta sidecars, table-memory rejection, and the next hooked source to separate sampled-target support from sequence-only evidence.
• vm_synthetic_gap_focused_direct_trace_audit.py: joins the residual starts against focused live/state residual traces, verifies direct rows whose start VM IP equals the residual start, and marks recovered-block bridge candidates.
• vm_synthetic_gap_focused_sequence_audit.py: reads raw focused live/state VMTAIL order around residual starts, records indirect tail-site hops, and groups residual-to-residual chains that are sequence evidence but not hard CFG.
• vm_synthetic_gap_observed_chain_bridge.py: joins focused raw residual chains to terminal focused direct bridges or the 0x122e3c -> 0x2c0468 context reentry, separating hard focused-direct promotions from observed-chain bridge evidence.
• vm_synthetic_gap_observed_chain_replay.py: expands observed-chain bridge candidates into exact replay steps as standalone audit data; current generated C keeps these as comments because the sampled ret-patch exits now own those sites.
• vm_synthetic_gap_chain_slot_reconciliation.py: reconciles each observed-chain replay step with its symbolic transfer slot, table-read/table-memory diagnostics, runtime table-memory probe, sampled-control sidecars, and focused first-hop target entry.
• vm_synthetic_gap_unresolved_family_audit.py: clusters the 15 native ret-patch / non-hard-CFG synthetic successor sites by transfer path, slot expression, table rejection, sampled sidecar, and observed terminal class.
• vm_synthetic_gap_source299_context_probe.py: resolves source-299 unresolved-family branch paths from live VMTAIL register snapshots, computes the concrete slot/table rejection, and records the next focused raw event.
• vm_synthetic_gap_source299_ret_patch_probe.py: decodes source-299 residual rows as native return-patch thunks, including the frame+0xbb base, rsp+u16_4 stack write, patched native .text offset, and full-GPR versus frame-only provenance.
• vm_synthetic_gap_sampled_ret_patch_probe.py: generalizes the native return-patch evidence across sampled unresolved-control sources 175, 195, 278, and 299, preserving source/run provenance for the generated C comments.
• vm_synthetic_gap_ret_patch_native_target_atlas.py: disassembles bounded native .text windows for each unique return-patch target, including source-278's second stacked return target.
• vm_native_ret_patch_targets_pseudocode.py: turns the native ret-patch target atlas into syntax-checkable C helper functions and a vm_native_ret_patch_tail dispatcher artifact.
• vm_native_ret_patch_epilogues_retdec.py: runs targeted RetDec over the 14 single-stack return-patch native epilogues and emits a syntax-checkable C evidence artifact.
• vm_native_ret_patch_source278_retdec.py: runs targeted RetDec over source-278's two native return-patch trampoline branches and their downstream native targets, then emits a syntax-checkable C evidence artifact.
• vm_native_ret_patch_followups_dump.c: native C classifier/generator for direct call/jump follow-up targets reached inside the bounded native return-patch windows.
• vm_native_ret_patch_followup_retdec_dump.c: native C RetDec wrapper/postprocessor for the bounded high-value follow-up helper queue selected from the follow-up classifier.
• vm_native_obfuscated_islands_dump.c: native C classifier/generator for the first-stage obfuscated native islands reached from return-patch follow-up control, including their collapsed downstream targets and remaining second-stage queue.
• vm_native_obfuscated_second_stage_dump.c: native C classifier/generator for the five second-stage obfuscated computed thunks, recording exact internal loop sites and computed jmp [rax] sites for the next symbolic/instrumented target solve.
• vm_native_obfuscated_second_stage_dynamic_dump.c: native C trace-index generator for the five second-stage computed jmp [rax] sites; it joins focused dispatch logs to handler-table entries and emits observed target mixes as C/TSV/Markdown without a slow Python pass.
• vm_native_obfuscated_second_stage_slot_proof_dump.c: native Capstone-backed proof generator for the same computed jumps; it validates the static rax_final = rax_initial + (rbx << 3) formula and joins the result to dynamic slot/base checks.
• vm_native_obfuscated_second_stage_stack_source_dump.c: native Capstone-backed proof generator for the second-stage stack source; it validates that each narrowed thunk statically pushes qword [rsp+0x88], loads it into rbx, and shifts it before dispatch.
• vm_native_obfuscated_second_stage_rbx_provenance_dump.c: native C parser for generic single-step probe logs at the pre-shift RBX load sites; it proves the handler entry is carried at rsp+0x88, loaded into rbx, and then shifted into the dispatch-table byte index.
• vm_native_obfuscated_second_stage_model_dump.c: native C combiner/generator that joins the second-stage thunk map, dynamic targets, slot proof, and RBX provenance into one syntax-checkable C model of target = dispatch_table[stack_qword(rsp+0x88)].
• vm_native_obfuscated_control_model_dump.c: native C combiner/generator that joins ret-patch follow-up obfuscated islands, source278 RetDec-covered downstream targets, and the second-stage dispatch model into one syntax-checkable hidden-control dispatcher.
• vm_native_ret_patch_hidden_bridge_dump.c: native C bridge generator that joins the ret-patch target atlas back to the hidden-control dispatcher, so vm_native_ret_patch_tail(...) exits can be mapped to recovered obfuscated-control C helpers.
• vm_native_handler_environment_coverage_dump.c: native C cross-trace scanner that turns the coverage matrix plus every listed instruction trace into a handler-level environment provenance map, split by primary/concrete/blocked-network/fake-network/synthetic evidence.
• vm_config_coverage_frontier_dump.c: native C generator that carries the trace/static coverage boundary into C as metric rows plus explicit frontier rows for static-only handlers, target-only handlers, weak path-specialized rows, synthetic-fill-only coverage, and the no-real-network trace gap.
• vm_native_executable_coverage_audit.py: compares allocatable executable ELF sections against native ranges already represented by RetDec/native C sidecars, emitting C/TSV/Markdown section coverage and uncovered executable gap rows.
• vm_native_function_inventory.py: runs one cached radare2 function-boundary pass and renders all executable-section function boundaries as weak C skeleton stubs plus TSV/Markdown metadata.
• vm_native_retdec_gap_queue.py: ranks .text native function skeletons whose byte ranges are not yet covered by semantic RetDec/native C sidecars, with TSV as the cached source and C/Markdown renderers for the next targeted decompilation queue.
• vm_native_gap_retdec_batch.py: emits fixed targeted RetDec batches for ranked native gap-queue functions without creating a coverage-audit/queue Make dependency cycle.
• vm_target_only_handlers_retdec.py: runs targeted RetDec over the 3 target-only VM handler native ranges reached as dispatch targets but not source-executed in concrete traces.
• vm_unobserved_handlers_retdec_batch.py: runs targeted RetDec over bounded batches of statically inventoried but dynamically unhit VM handler native ranges, sorted by native span size.
• vm_weak_handlers_retdec.py: runs targeted RetDec over observed handler ranges whose reconstruction class is weaker than fully static-validated (affine_dispatch_fallback, partial, sampled_only, and sampled_operand_lifted).
• vm_validated_handlers_retdec_batch.py: runs targeted RetDec over bounded batches of fully static-validated VM handler native ranges, sorted by native span size.
• vm_handler_retdec_index.c: native C indexer that maps all handler RetDec sidecar ranges back to dispatch entries and emitted native C functions.
• vm_static_only_handler_queue_dump.c: native C queue generator that joins static-only environment coverage, handler RetDec sidecars, and handler semantics to rank the 155 static-only dispatch entries for static replay/inlining.
• vm_static_only_tier0_models_dump.c: native C generator that translates the 11 ranked tier-0 static-only single-function RetDec handlers into frame-level C models with slot/IP/state/memory effects.
• vm_static_only_tier1_models_dump.c: native C generator that promotes the 43 ranked tier-1 static-only single-function RetDec handlers into named C model functions, separating clean dispatch-table slot recoveries from masked/noisy/comment-only candidates.
• vm_static_only_tier2_split_dump.c: native C generator that splits the 15 tier-2 small shared-range static-only rows into primary RetDec handler models, promoting clean dispatch-table slot tails into syntax-checkable C and handler-layer VMState updates.
• vm_static_only_tier3_shared_dump.c: native C generator that turns the 40 tier-3 multi-function shared-range static-only rows into syntax-checkable C model functions, promoting only clean RetDec dispatch-table tails and keeping masked/noisy shared returns comment-only.
• vm_static_only_tier4_callret_dump.c: native C generator that turns the 37 static-only call/ret side-effect rows into syntax-checkable C model functions, preserving RetDec tail summaries and keeping unproven slot candidates comment-only.
• vm_static_only_tier5_large_dump.c: native C generator that turns the final 9 large static-only rows into conservative syntax-checkable C model functions, linking each dispatch entry to its RetDec sidecar, IP/read/write surface, and tail classification.
• vm_binary_data_sections_dump.c: native C ELF scanner/generator that carries allocatable non-executable runtime sections, BSS metadata, full string-reference rows with backing pointers, and the raw VM dispatch-table offsets into C source form.
• vm_unresolved_family_chains_dump.c: native C renderer for the residual native-ret-patch / observed-chain families, producing a syntax-checkable C evidence view of the remaining non-hard-CFG successor layer.
• vm_synthetic_gap_live_snapshot_transfer_probe.py: replays all unresolved synthetic-gap source handlers from selected live VMTAIL snapshots, separating full GPR snapshots from weaker alternate/config frame-only rows.
• vm_synthetic_gap_live_table_evidence.py: maps those per-live-row table offsets to file/runtime bytes, nearest dispatch slots, and evidence classes while preserving full-GPR versus frame-only provenance.
• vm_synthetic_gap_live_in_roles.py: fallback join for synthetic gap target expressions that still depend on live-in GPRs. The current transfer probe leaves no live-in rows, so this artifact is header-only unless a future replay regresses or exposes a new live-in class.
• vm_live_in_final_tail_site_probe.py: follow-up exact native-tail-site memory summary for live-in source classes; currently header-only because there are no active live-in synthetic gap rows.
• vm_synthetic_gap_live_in_reentry_probe.py: follow-up join of live-in synthetic starts, dynamic next-hooked-source stitch rows, and exact final-tail source proof; currently header-only because there are no active live-in synthetic gap rows.
• vm_synthetic_gap_allstatic_reentry_probe.py: follow-up correlation of live-in reentry rows against the dumps/vmtail-allstatic/run.stderr VMTAIL sequence; currently header-only because there are no active live-in synthetic gap rows.
• vm_bytecode_file_atlas.py: verifies recovered exact VM bytes against eac.elf and builds conservative file-backed bytecode atlas regions from observed segments plus small inferred gaps.
• vm_trace_file_fill.py: promotes bounded positive prefix_32_of_N rows to file_span_of_N rows by reading bytes from eac.elf, preserving them as sampled/file-backed coverage rather than exact consumed instructions.
• vm_long_branch_catalog.py: decodes sampled/backedge long-control bytecode rows whose first u32 is the target dispatch-table entry and whose second u32 is a signed VM-IP delta, verifies byte prefixes and static operand footprints against eac.elf, and emits TSV/Markdown lift summaries.
• vm_hidden_transition_catalog.py: catalogs adjacent trace pairs where the previous target handler is not the next hooked source, yielding file-backed hidden VM spans for unhooked or central-dispatch paths.
• vm_trace_hidden_fill.py: inserts those adjacent hidden spans as synthetic hidden_span_of_N rows so bytecode recovery can cover them as sampled/file-backed bytes.
• vm_trace_frontier_fill.py: inserts small file-backed frontier_span_of_N rows when an exact instruction lands at a recovered segment end and the next recovered segment starts within a conservative gap threshold.
• vm_trace_target_footprint_fill.py: inserts file-backed target-handler read footprints at exact destinations whose target handler has a known exact shape, sampled operand footprint, or decoded long-branch operand footprint.
• vm_sampled_operand_catalog.py: catalogs the remaining sampled non-long-branch rows with static operand footprints, verifies those operand bytes against eac.elf, and turns the last sparse prefix/backedge samples into explicit target/delta rows.
• vm_instruction_compare.py: compares exact unique VM instruction catalogs by stable instruction key.
• vm_dispatch_formula.py: fits simple expressions for the final dispatch byte index target_entry * 8 from VM bytes plus rolling state.
• vm_dispatch_formula_validate.py: validates byte-only dispatch formulas against the long exact unique-instruction catalog.
• vm_dispatch_affine.py: fits exact GF(2) affine dispatch-index bit formulas from byte, state, and post-state features in a state-aware trace.
• vm_dispatch_affine_cv.py: cross-validates affine dispatch-index formulas by training on held-out folds of the state-aware trace.
• dumps/local-blocked-log/run.stderr: blocked-network trace from the harness.
• dumps/local-blocked-log/postcall_* and postsleep_*: in-memory EAC map/context/output dumps.
• dumps/dispatch-trap/run.stderr: targeted dispatcher trace with fast harness exit.
• dumps/vmtail-allstatic/run.stderr: dispatcher trace plus all statically found dispatch-table tail sites.
• dumps/vmtail-allstatic/vm_table.tsv: one row per dispatch-table entry with static tail candidate and observed hit counts.
• dumps/vmtail-allstatic/vm_edges.tsv: recovered VM edge list from the all-static trace.
• dumps/vmtail-allstatic/vm_seq_edges.tsv: dynamic sequential VM edge list from the same trace.
• dumps/vmtail-allstatic/vm_source_profile.tsv: per-source handler profile of outgoing sites, targets, VM IP deltas, and the first six logged ip_w* words.
• dumps/vmtail-allstatic/vm_handler_table.tsv: combined static/dynamic handler table for all 360 dispatch entries.
• dumps/vmtail-wide/*: repeat of the all-static trace using a wider 0x1200 static tail-site scan, covering long-tail handlers that the earlier 0x800 scan missed.
• dumps/vmtail-wide/vm_instruction_trace.tsv: direct executed VM instruction rows with source handler, start/end VM IP, target handler, logged words, consumed bytes, and byte exactness.
• dumps/vmtail-wide/vm_bytecode_blocks.tsv: contiguous exact bytecode coverage ranges derived from vm_instruction_trace.tsv.
• dumps/vmtail-wide/vm_bytecode_segments.tsv: conflict-checked exact byte segments with SHA-256 hashes and byte previews.
• dumps/vmtail-wide/vm_instruction_unique.tsv: deduplicated exact instruction rows collapsed by (start_vm_ip, source_entry, delta, bytes).
• dumps/vmtail-wide/vm_bytecode_block_edges.tsv: aggregate control-flow edges between recovered bytecode segments.
• dumps/vmtail-wide-1m/*: earlier longer 0x1200 wide-tail run using the old shorter lookahead. The harness reached about 767k VM tail events before fast exit and expanded exact bytecode recovery from 0x24948 to 0x41d31 bytes with no byte conflicts.
• dumps/vmtail-wide-w16/*: current 250k comparison run with sixteen ip_w* words. It keeps the same direct graph shape as dumps/vmtail-wide but improves exact byte recovery to 0x24c51 bytes and reduces prefix-only instruction rows from 697 to 90.
• dumps/vmtail-fakenet-w16/*: 250k all-table fake-network run. trace_preload returned local fake DNS/socket results for api.epicgames.dev and datarouter.ol.epicgames.com, captured TLS ClientHello sends and TLS-error closes, and produced the same VM instruction coverage as the blocked 250k vmtail-wide-w16 run (249764 instruction rows, 191 sources, 195 targets, 39725 VM-IP starts). This is useful provenance, but it did not add bytecode coverage at the 250k tail cap.
• dumps/vmtail-wide-1m-w16/*: current long 0x1200 wide-tail run with sixteen ip_w* words. It improves long-run exact recovery from 0x41d31 to 0x421f3 bytes, raises exact-covered handlers from 171 to 190, and leaves no byte conflicts.
• dumps/vmtail-wide-1m-w16/vm_isa_handlers.tsv: exact-covered handler schema summary.
• dumps/vmtail-wide-1m-w16/vm_isa_patterns.tsv: exact-covered (source handler, byte length) operand-layout summary.
• dumps/vmtail-wide-1m-w16/vm_isa_families.tsv: operand-layout families grouped by byte length, shape, and constant byte positions.
• dumps/vmtail-wide-1m-w16/vm_isa_missing_exact.tsv: dynamic source handlers that still have no exact positive byte schema.
• dumps/vmtail-wide-1m-w16/vm_handler_semantics.tsv: one semantic row per dispatch-table entry, combining observation class, ISA shape, frame/IP/table access patterns, and dynamic target profile.
• dumps/vmtail-wide-1m-w16/vm_semantic_templates.tsv: ranked semantic templates grouped by observation class, byte shape, constant positions, static IP reads, frame writes, and dispatch-table access.
• dumps/vmtail-wide-1m-w16/vm_handler_skeletons.tsv: one row per dispatch-table entry with full normalized frame/IP/table skeleton, final dispatch suffix, and canonical decode signature.
• dumps/vmtail-wide-1m-w16/vm_handler_decode_groups.tsv: observed handlers grouped by canonical decode signature.
• dumps/vmtail-wide-1m-w16/vm_handler_dispatch_groups.tsv: observed handlers grouped by final dispatch-tail skeleton.
• dumps/vmtail-wide-1m-w16/vm_handler_skeleton_groups.tsv: observed handlers grouped by full normalized handler skeleton.
• dumps/vmtail-wide-1m-w16/vm_bytecode_segments_sampled.tsv: exact plus sampled byte-window recovery; conflict-checked but not full-instruction exactness for sampled rows.
• dumps/vmtail-wide-1m-w16/vm_bytecode_blocks_sampled.tsv: contiguous coverage blocks for exact plus sampled byte windows.
• dumps/vmtail-wide-1m-w16/vm_instruction_trace_filefill.tsv: bounded file-backed span trace with 466 promoted file_span_of_N rows.
• dumps/vmtail-wide-1m-w16/vm_bytecode_segments_filefill_sampled.tsv: sampled/file-backed byte recovery from vm_instruction_trace_filefill.tsv.
• dumps/vmtail-wide-1m-w16/vm_bytecode_blocks_filefill_sampled.tsv: contiguous coverage blocks for sampled/file-backed recovery.
• dumps/vmtail-wide-1m-w16/vm_gap_report_filefill.tsv: gap report after bounded file-span coverage.
• dumps/vmtail-wide-1m-w16/vm_long_branch_catalog.tsv: decoded long-control bytecode variants from sampled/backedge rows.
• dumps/vmtail-wide-1m-w16/vm_long_branch_top.md: Markdown summary of the highest-volume long-control bytecode lifts.
• dumps/vmtail-wide-1m-w16/vm_hidden_transition_catalog.tsv: adjacent unhooked-span catalog for previous-target-to-next-hooked-source gaps.
• dumps/vmtail-wide-1m-w16/vm_hidden_transition_top.md: Markdown summary of the highest-volume hidden transition spans.
• dumps/vmtail-wide-1m-w16/vm_sampled_operand_catalog.tsv: byte-verified sampled operand variants for the remaining non-long sparse prefix/backedge rows.
• dumps/vmtail-wide-1m-w16/vm_sampled_operand_top.md: Markdown summary of those sampled operand variants.
• dumps/vmtail-wide-1m-w16/vm_instruction_trace_filefill_hiddenfill.tsv: bounded prefix file-fill trace plus synthetic adjacent hidden-span rows.
• dumps/vmtail-wide-1m-w16/vm_bytecode_segments_filefill_hiddenfill_sampled.tsv: sampled/file-backed byte recovery combining exact, sampled, bounded prefix file-fill, and adjacent hidden spans.
• dumps/vmtail-wide-1m-w16/vm_bytecode_blocks_filefill_hiddenfill_sampled.tsv: contiguous blocks for the combined file-fill/hidden-fill trace.
• dumps/vmtail-wide-1m-w16/vm_gap_report_filefill_hiddenfill.tsv: gap report after combined file-fill and hidden-span coverage.
• dumps/vmtail-wide-1m-w16/vm_instruction_trace_filefill_hiddenfill_frontierfill.tsv: combined file-fill/hidden-fill trace plus small exact-destination frontier spans.
• dumps/vmtail-wide-1m-w16/vm_bytecode_segments_filefill_hiddenfill_frontierfill_sampled.tsv: sampled/file-backed byte recovery after small frontier fill.
• dumps/vmtail-wide-1m-w16/vm_bytecode_blocks_filefill_hiddenfill_frontierfill_sampled.tsv: contiguous blocks for the combined file-fill/hidden-fill/frontier-fill trace.
• dumps/vmtail-wide-1m-w16/vm_gap_report_filefill_hiddenfill_frontierfill.tsv: gap report after combined file-fill, hidden-span, and frontier-span coverage.
• dumps/vmtail-wide-1m-w16/vm_instruction_trace_filefill_hiddenfill_frontierfill_footprintfill.tsv: combined trace plus target-handler footprint spans for exact-destination starts.
• dumps/vmtail-wide-1m-w16/vm_bytecode_segments_filefill_hiddenfill_frontierfill_footprintfill_sampled.tsv: best current sampled/file-backed byte recovery after target-footprint fill.
• dumps/vmtail-wide-1m-w16/vm_bytecode_blocks_filefill_hiddenfill_frontierfill_footprintfill_sampled.tsv: contiguous blocks for the combined file-fill/hidden-fill/frontier-fill/footprint-fill trace.
• dumps/vmtail-wide-1m-w16/vm_gap_report_filefill_hiddenfill_frontierfill_footprintfill.tsv: best current gap report after all conservative file-backed fill passes.
• dumps/vmtail-wide-1m-w16/vm_bytecode_control_edges.tsv: decoded long-branch plus sampled-operand VM control-flow edges mapped onto the best recovered bytecode segments.
• dumps/vmtail-wide-1m-w16/vm_bytecode_control_edges_top.md: Markdown digest of the highest-volume decoded non-exact VM control-flow edges.
• dumps/vmtail-wide-1m-w16/vm_bytecode_ir.tsv: unified VM-IP sorted recovered bytecode IR rows combining exact instruction lifts with decoded long-branch and sampled-operand sidecars, including compact symbolic state/dispatch/IP expression columns.
• dumps/vmtail-wide-1m-w16/vm_bytecode_ir_top.md: Markdown digest of the highest-volume recovered bytecode IR rows.
• dumps/vmtail-wide-1m-w16/vm_bytecode_basic_blocks.tsv: recovered VM basic blocks split from the unified bytecode IR.
• dumps/vmtail-wide-1m-w16/vm_bytecode_basic_block_edges.tsv: terminal VM block edges, including decoded-control, exact fallthrough, and covered synthetic fallthrough terminals with target coverage statuses.
• dumps/vmtail-wide-1m-w16/vm_bytecode_basic_blocks_top.md: Markdown digest and short listings for the hottest recovered VM basic blocks.
• dumps/vmtail-wide-1m-w16/vm_bytecode_loops.tsv: block-level backedge and loop-body catalog derived from recovered bytecode blocks.
• dumps/vmtail-wide-1m-w16/vm_bytecode_loops_top.md: Markdown loop digest ranked by latch-event count and body-event count.
• dumps/vmtail-wide-1m-w16/vm_synthetic_span_catalog.tsv: semantic-gap catalog for file-backed synthetic spans from hidden, frontier, and target-footprint fill, including static target-only IP-advance splits and unresolved tail bytes.
• dumps/vmtail-wide-1m-w16/vm_synthetic_span_top.md: Markdown digest of the highest-volume synthetic span semantic gaps with tail u16 target-entry candidates.
• dumps/vmtail-wide-1m-w16/vm_synthetic_tail_catalog.tsv: aggregate catalog of unresolved synthetic suffix bytes after known-prefix splitting, grouped by exact tail variant, target offsets, and recurring motifs.
• dumps/vmtail-wide-1m-w16/vm_synthetic_tail_top.md: Markdown digest of the hottest unresolved synthetic tail variants.
• dumps/vmtail-wide-1m-w16/vm_synthetic_tail_lift.tsv: row-level lift of unresolved synthetic suffix bytes by VM IP, including embedded target-entry schemas and lift classes.
• dumps/vmtail-wide-1m-w16/vm_synthetic_tail_lift_top.md: Markdown digest of the highest-volume synthetic VM IP suffix lifts.
• dumps/vmtail-wide-1m-w16/vm_handlers_pseudocode.c: C-like static handler/operator reconstruction for all 360 dispatch entries.
• dumps/vmtail-wide-1m-w16/vm_handlers_hot_pseudocode.c: C-like handler/operator reconstruction for the 80 hottest observed dispatch entries.
• dumps/vmtail-wide-1m-w16/vm_pseudocode_top.c: C-like decompiler sketch for the hottest recovered VM basic blocks, with VMState, U8/U16/U32 accessors, state assignments, dispatch/IP updates, terminal edges, and recovered synthetic terminal spans.
• dumps/vmtail-wide-1m-w16/vm_program_pseudocode_top.c: compact C-like bytecode program sketch where recovered VM basic blocks call op_entry_NNN(vm) handler functions.
• dumps/vmtail-wide-1m-w16/vm_program_pseudocode_full.c: full C-like bytecode program sketch for all recovered VM basic blocks and all recovered VM IR rows, with synthetic terminal spans lifted into explicit transitions.
• dumps/vmtail-wide-1m-w16/vm_recovered_source_bundle.c: single C-like reconstruction bundle combining the all-entry handler/operator layer with the full recovered VM bytecode program.
• dumps/vmtail-wide-1m-w16/vm_recovered_source_all_evidence_bundle.c: larger single C evidence bundle that preserves vm_recovered_source_bundle.c and appends renamed native RetDec/control sidecars so the handler/program/native evidence can coexist in one translation unit.
• vm_recovered_source_harness.c: minimal C harness that defines the bundle's external dispatch-table and unresolved-tail hooks, links against vm_recovered_source_bundle.c, and smoke-invokes vm_program_sketch through the default unresolved path.
• dumps/vmtail-wide-1m-w16/vm_trace_coverage_matrix.tsv: auto-discovered cross-run coverage/config matrix comparing source handlers, target handlers, VM-IP starts, byte ranges, driver mode, tail limits, register/scratch/memory flags, network/spawn policy, attempted hosts/callers, and run-only evidence directories.
• dumps/vmtail-wide-1m-w16/vm_trace_coverage_matrix.md: Markdown coverage summary that makes the scenario/path limitation explicit.
• dumps/vmtail-wide-1m-w16/vm_static_coverage_audit.tsv: static/global versus dynamic/path coverage audit.
• dumps/vmtail-wide-1m-w16/vm_static_coverage_audit.md: Markdown audit separating the all-entry handler layer from the scenario-specific bytecode program layer.
• dumps/vmtail-wide-1m-w16/vm_c_reconstruction_manifest.tsv: reproducible C reconstruction manifest with artifact sizes, C-shape counts, coverage highlights, and gate commands.
• dumps/vmtail-wide-1m-w16/vm_c_reconstruction_manifest.md: Markdown view of the C reconstruction manifest.
• dumps/vmtail-wide-1m-w16/vm_synthetic_successor_gaps.tsv: exact remaining synthetic-successor gap list.
• dumps/vmtail-wide-1m-w16/vm_synthetic_successor_gaps.md: Markdown digest of the remaining synthetic-successor gaps.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_transfer_probe.tsv: static transfer probe over the remaining synthetic-successor gap bytes.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_transfer_probe.md: Markdown digest of the synthetic gap transfer probe; current rows are all symbolic-slot expressions.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_dynamic_stitch.tsv: raw-VMTAIL sequence stitch for the remaining synthetic-successor gaps.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_dynamic_stitch.md: Markdown digest of the dynamic stitch, including next-hooked-source and ambiguous rows.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_chain_probe.tsv: hidden-handler/next-hook replay probe with 22 rows: 20 dynamic next-hook handlers independently validated by static transfer replay, 1 target-only hidden-chain hint, and the exact 0x293689 -> entry_308@0x293696 -> 0x2bec2e reentry match.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_chain_probe.md: Markdown digest of the hidden-chain/next-hook probe, distinguishing exact next-event matches, target-only hints, and dynamic next-hook validations that are not hard CFG promotions.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_residual_audit.tsv: central audit for the 20 residual synthetic successor starts after hard hidden-chain promotions and before later focused-direct / native ret-patch exit classification.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_residual_audit.md: Markdown digest of residual reasons, promotion states, chain status mix, next-hook blocks, and sampled-operand context.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_concrete_state_audit.tsv: concrete-state replay audit for the residual starts, seeded from the state-aware predecessor edge where available.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_concrete_state_audit.md: Markdown digest of concrete-state availability, table-oob/table-read/branch-unknown classifications, and starts still missing state trace coverage.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_state_trace_targets.tsv: focused VMTAIL state-capture target list for the residual starts whose predecessor state row is still missing.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_state_trace_targets.md: Markdown digest of the exact predecessor/synthetic-start VM IP and tail-site pairs to capture next.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_context_audit.tsv: residual replay audit seeded with concrete state plus focused live GPR/frame-scratch snapshots.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_context_audit.md: Markdown digest showing that live context removes branch uncertainty but still leaves final table reads or table-oob cases.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_table_read_diagnostic.tsv: final residual dispatch-table access diagnostic for the 20 still-unresolved synthetic starts.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_table_read_diagnostic.md: Markdown digest of residual table-read diagnoses, table offsets, entry indexes, and native tail sites.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_table_memory_probe.tsv: file-backed map from residual table-relative offsets to .text/dispatch-table regions and qword classifications.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_table_memory_probe.md: Markdown digest showing whether residual table offsets are normal slots, unaligned table bytes, or post-table code bytes.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_runtime_table_memory_probe.tsv: postcall mapped-memory comparison for the residual table-relative offsets, including runtime/file byte match status and runtime qword target classification.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_runtime_table_memory_probe.md: Markdown digest showing that runtime relocation changes only the two unaligned in-table reads and does not create any valid dispatch-target qword for the residuals.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_sampled_control_correlation.tsv: per-residual join of sampled-operand target/delta candidates, dynamic next-hook source, and table-memory region.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_sampled_control_correlation.md: Markdown digest of sampled-target matches, delta mismatches, and sequence-only residuals.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_focused_direct_trace_audit.tsv: per-residual focused trace audit showing which synthetic starts have exact focused rows to recovered block starts.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_focused_direct_trace_audit.md: Markdown digest of focused direct-trace classes and hard bridge candidates.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_focused_sequence_audit.tsv: per-residual raw focused VMTAIL sequence audit, including indirect tail-site hops and residual-to-residual chain paths.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_focused_sequence_audit.md: Markdown digest of focused sequence classes, residual links, and chain terminals.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_observed_chain_bridge.tsv: per-residual join of focused raw chain paths, terminal recovered destinations, primary dynamic next-hook evidence, and bridge action.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_observed_chain_bridge.md: Markdown digest showing 5 hard focused-direct bridges, 7 disabled chains to focused direct bridges, and 8 disabled chains to the recovered 0x122e3c -> 0x2c0468 context reentry.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_observed_chain_replay.tsv: expanded replay rows for the 15 observed-chain bridge candidates, including per-step source handler, first-hop tail/dispatch event, following residual, and terminal block.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_observed_chain_replay.md: Markdown digest of the 57 replay steps, unique replay VM starts, terminal blocks, and step-role mix.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_chain_slot_reconciliation.tsv: per-replay-step reconciliation of focused first-hop target entry versus symbolic transfer slot, table offset, table bytes, runtime bytes, sampled sidecars, and dynamic next-hook evidence.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_chain_slot_reconciliation.md: Markdown digest of slot/table/first-hop relation classes for the observed-chain replay layer.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_unresolved_family_audit.tsv: per-start clustering of the 15 native ret-patch / non-hard-CFG synthetic successor sites by shared transfer/table/sample/focused-chain evidence family.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_unresolved_family_audit.md: Markdown digest of unresolved family mixes and next reconstruction targets.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_source299_context_probe.tsv: live-register branch-resolution probe for the source-299 unresolved starts, including concrete slot/table class and the next focused raw event relation.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_source299_context_probe.md: Markdown digest of source-299 context-reentry branch paths, slot rejection classes, and sequence-only next-event evidence.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_source299_ret_patch_probe.tsv: per-live-row source-299 native return-patch evidence, including operand-derived patched .text offsets, stack write slots, base-source provenance, and next-event relation.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_source299_ret_patch_probe.md: Markdown digest of source-299 return-patch targets, seed quality, and native-ret-patch-versus-VM-IP relation.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_sampled_ret_patch_probe.tsv: generic sampled native return-patch evidence for sources 175, 195, 278, and 299, including patched .text offsets, stack write slots, seed quality, and next-event relation.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_sampled_ret_patch_probe.md: Markdown digest of sampled return-patch source mix, start mix, seed quality, patched native targets, and interpretation.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_ret_patch_native_target_atlas.tsv: unique native return-patch target windows with source/start/slot provenance, first instructions, branch/call summaries, and ret-seen classification.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_ret_patch_native_target_atlas.md: Markdown digest of the 16 patched native target disassembly windows.
• dumps/vmtail-wide-1m-w16/vm_native_ret_patch_targets.c: C-shaped helper/dispatcher artifact for the 16 native ret-patch target windows; 13 are classified as bounded native epilogues, and source 278's two stacked returns are labeled as native trampolines to 0x2d2cf4 and 0xcdc60.
• dumps/vmtail-wide-1m-w16/vm_native_ret_patch_epilogues_retdec.c: targeted RetDec C artifact for the 14 single-stack return-patch native epilogues, preserving their stack-check guards and native return-value shape.
• dumps/vmtail-wide-1m-w16/vm_native_ret_patch_source278_retdec.c: targeted RetDec C artifact for source 278's double return-patch chain; 5 native functions cover 0x6c010, 0x15b5b2, 0x2d2cf4, 0xcf3c7, and 0xcdc60.
• dumps/vmtail-wide-1m-w16/vm_native_ret_patch_followups.c, .tsv, and .md: native C-generated follow-up target index for 39 direct call/jump targets reached from return-patch windows, separating local epilogue branches, PLT stack-check calls, allocator wrappers, internal helpers, source278-covered targets, and obfuscated native islands.
• dumps/vmtail-wide-1m-w16/vm_native_ret_patch_followup_retdec.c: targeted RetDec C artifact for the high-value non-obfuscated follow-up helpers; 6 native C functions cover 0x21a50, 0x2508e, 0x72588, 0x7260a, 0x72bbc, and 0x48eb2b.
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_islands.c, .tsv, and .md: native C-generated obfuscated-island map for the 8 helper/island rows reached from return-patch follow-up control; it collapses 0x23122 -> 0xe0017, records 2 downstreams already covered by source278 RetDec (0xcdc60, 0xcf3c7), and leaves 5 second-stage stack/call thunk targets (0xc9849, 0xc6d58, 0xc4258, 0xcaf2a, 0xc57b8).
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_second_stage.c, .tsv, and .md: native C-generated map for those 5 second-stage thunks; each has a call +0 setup, two internal loop edges, and an exact computed jmp [rax] site (0xcad88, 0xcc3f5, 0xc559d, 0xc6bce, 0xc80b9) that now forms the narrowed symbolic/instrumentation queue.
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_second_stage_dynamic.c, .tsv, and .md: native C-generated dynamic dispatch index for the same 5 computed jump sites, backed by focused bounded driver traces. The observed target mixes are 0xcad88 -> {323@0xbb6e6,169@0x9af18,310@0xb8556}, 0xcc3f5 -> {86@0x8a37f,310@0xb8556,169@0x9af18}, 0xc559d -> {323@0xbb6e6,169@0x9af18,310@0xb8556}, 0xc6bce -> {86@0x8a37f,169@0x9af18,310@0xb8556}, and 0xc80b9 -> {86@0x8a37f,310@0xb8556,169@0x9af18}. All 28 observed idx / 8 slot entries match the handler-table target read by jmp [rax]. This is bounded runtime evidence under fake-launcher/fast-exit conditions, not a claim of exhaustive environment/config coverage.
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_second_stage_slot_proof.c, .tsv, and .md: native C-generated static/dynamic proof for the five computed jump sites. Capstone validates rax_final = rax_initial + (rbx << 3) at all five sites, every immediate add/sub ladder has net_rax_delta=0, all 28 dynamic rows satisfy slot_off - idx == 0xc3718, and all 28 observed slots match the handler-table target they jump to.
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_second_stage_stack_source.c, .tsv, and .md: native C-generated static stack-source proof for the same five sites. Capstone validates push qword [rsp+0x88], the duplicate top-of-stack push chain, the rbx load (mov rbx,[rsp] or pop rbx), and the shl rbx,3 handoff before dispatch; all five rows are marked static_stack_source_to_rbx_shift_proven.
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_second_stage_rbx_provenance.c, .tsv, and .md: native C-generated RBX provenance proof for 10 single-step probe observations across the five computed jump sites. Each observed row proves push_sp88 == load_stack_top == rbx_before_shift, rbx_before_shift << 3 == dispatch idx, and the rsp+0x90 value at the push site matches the dispatch VM IP for that hit.
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_second_stage_model.c, .tsv, and .md: native C-generated combined model for the same five sites. It emits five helper functions and a dispatcher modeling handler_entry = stack_qword(rsp+0x88), observed_vm_ip = stack_qword(rsp+0x90), dispatch_index = handler_entry << 3, and target = dispatch_table[handler_entry], with all rows marked static_stack_handler_entry_dispatch_model_for_observed_hits.
• dumps/vmtail-wide-1m-w16/vm_native_obfuscated_control_model.c, .tsv, and .md: native C-generated joined hidden-control model for all eight obfuscated island/helper rows reached from ret-patch follow-up control. Five rows now flow into dispatch_table[stack_qword(rsp+0x88)], two rows join to source278 RetDec-covered native targets (0xcdc60, 0xcf3c7), and the 0x23122 helper joins through 0xe0017 -> 0xcdc60.
• dumps/vmtail-wide-1m-w16/vm_native_ret_patch_hidden_bridge.c, .tsv, and .md: native C-generated bridge from sampled vm_native_ret_patch_tail(...) exits to the hidden-control model. It emits 8 bridge helpers across 7 ret-patch sites: 5 second-stage dispatch-table rows, 2 source278 RetDec-covered rows, and the 0x23122 -> 0xe0017 -> 0xcdc60 helper row.
• dumps/vmtail-wide-1m-w16/vm_native_handler_environment_coverage.c, .tsv, and .md: native C-generated handler environment coverage map for all 360 dispatch entries. It currently records 202 concrete source+target handlers, 3 concrete-target-only handlers, 205 blocked-network target handlers, 195 fake-network target handlers, and 155 static-only handlers that are in the dispatch table/RetDec sidecars but not observed in the current trace matrix.
• dumps/vmtail-wide-1m-w16/vm_config_coverage_frontier.c, .tsv, and .md: native C-generated configuration/path coverage frontier. It carries 71 audit metric rows and 173 explicit frontier rows: 155 static-only handlers, 3 concrete target-only handlers, 10 path-specialized rows with 0% target/IP validation, 1 no-real-network-allowed trace row, and 4 synthetic-fill-only coverage rows.
• dumps/vmtail-wide-1m-w16/vm_native_executable_coverage_audit.c, .tsv, and .md: executable ELF coverage audit comparing native C sidecar ranges against .init, .plt, .plt.got, .text, and .fini. It records 5 executable sections, 4194 recovered native range rows, 928 uncovered executable gaps, 573810 recovered executable bytes, and 5077230 uncovered executable bytes.
• dumps/vmtail-wide-1m-w16/vm_native_function_inventory.c, .tsv, and .md: radare2 native function-boundary inventory rendered as weak C skeleton stubs. It records 3309 executable-section functions, 3063 .text functions, 3309 C stub functions, 3309 metadata rows, and 806070 merged .text bytes covered by identified function ranges; these are boundaries/skeletons, not decompiled semantics.
• dumps/vmtail-wide-1m-w16/vm_native_retdec_gap_queue.c, .tsv, and .md: ranked native function backlog for semantic C recovery. It records 2063 queued .text functions, 606573 function-boundary uncovered bytes, and a tier mix of 1735 small, 247 medium, 77 large, and 4 huge/noisy targets; the C sidecar keeps all 2063 rows in the all-evidence file.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch00.c: targeted RetDec C artifact for the first 16 fixed top-ranked native gap-queue ranges. It emits 24 RetDec native C function bodies / 24 address-range comments and is retained in the all-evidence file with prefixed symbols.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch01.c: targeted RetDec C artifact for the second fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments, skips the two currently unstable RetDec ranges 0x62b92-0x62d6d and 0x4b1ca0-0x4b1e79 instead of hand-editing fake structure, and leaves those ranges queued for a split/model pass.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch02.c: targeted RetDec C artifact for the third fixed native gap-queue batch. It emits 19 RetDec native C function bodies / 19 address-range comments from 16 selected ranges, skips the structurally invalid 0x4bfaf0-0x4bfcc3 RetDec output, and keeps the file syntax-checkable under both GCC and the local clang.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch03.c: targeted RetDec C artifact for the fourth fixed native gap-queue batch. It emits 37 RetDec native C function bodies / 37 address-range comments from 16 selected ranges, after adding generator normalization for RetDec forward calls and stack-address evidence returns.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch04.c: targeted RetDec C artifact for the fifth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges, after adding loose multibyte/wide-memory libc prototypes and all-evidence prelude declarations for the new libc call surface.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch05.c: targeted RetDec C artifact for the sixth fixed native gap-queue batch. It emits 38 RetDec native C function bodies / 38 address-range comments from 16 selected ranges, replaces the structurally invalid 0x4ad2a0-0x4ad440 RetDec output with the next viable queued range, and adds the needed gettext, textdomain, memset2, movdqu, stdio, and string prototypes for the merged all-evidence translation unit.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch06.c: targeted RetDec C artifact for the seventh fixed native gap-queue batch. It emits 23 RetDec native C function bodies / 23 address-range comments from 16 selected ranges, replaces the structurally invalid 0x57c4c0-0x57c64f RetDec output with the next viable queued range, and adds loose helper prototypes for hlt, mfence, rep movsq, and pthread mutex calls.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch07.c: targeted RetDec C artifact for the eighth fixed native gap-queue batch. It emits 42 RetDec native C function bodies / 46 address-range comments from 16 selected ranges, after adding loose helper/libc prototypes for movss, rep movsd, uname, TLS lookup, and strcmp in the merged all-evidence prelude.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch08.c: targeted RetDec C artifact for the ninth fixed native gap-queue batch. It emits 36 RetDec native C function bodies / 36 address-range comments from 16 selected ranges, after adding loose helper prototypes for RetDec's int1, port I/O, movups, and movdqa call variants.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch09.c: targeted RetDec C artifact for the tenth fixed native gap-queue batch. It emits 19 RetDec native C function bodies / 19 address-range comments from 16 selected ranges, after adding loose helper/libc prototypes for rcl, int3, divsd, byte-copy, and wcslen call variants.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch10.c: targeted RetDec C artifact for the eleventh fixed native gap-queue batch. It emits 25 RetDec native C function bodies / 26 address-range comments from 16 selected ranges, after adding loose helper/libc prototypes for carry-less multiply/SSE shifts, por, movdqu, filesystem path helpers, and snprintf in the merged all-evidence prelude.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch11.c: targeted RetDec C artifact for the twelfth fixed native gap-queue batch. It skips the five known RetDec structural blockers and emits 23 RetDec native C function bodies / 23 address-range comments from the next 16 ranked viable ranges.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch12.c: targeted RetDec C artifact for the thirteenth fixed native gap-queue batch. It skips the five known RetDec structural blockers and emits 19 RetDec native C function bodies / 19 address-range comments from the next 16 ranked viable ranges, after adding fwrite to the merged all-evidence prelude.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch13.c: targeted RetDec C artifact for the fourteenth fixed native gap-queue batch. It skips the five known RetDec structural blockers and emits 20 RetDec native C function bodies / 20 address-range comments from the next 16 ranked viable ranges, after adding llvm_bswap_i16 to the wrapper prototypes.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch14.c: targeted RetDec C artifact for the fifteenth fixed native gap-queue batch. It skips the five known RetDec structural blockers and emits 15 RetDec native C function bodies / 16 address-range comments from the next 16 ranked viable ranges, after adding the movaps helper prototype used by BLAKE3 setup code.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch15.c: targeted RetDec C artifact for the sixteenth fixed native gap-queue batch. It emits 20 RetDec native C function bodies / 20 address-range comments from 16 selected ranges, replacing the newly observed structural blocker 0x4b16c0-0x4b17fb with the next queued viable range and adding loose socket/iconv/locale helper prototypes.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch16.c: targeted RetDec C artifact for the seventeenth fixed native gap-queue batch. It emits 18 RetDec native C function bodies / 18 address-range comments from 16 selected ranges, replacing the newly observed structural blocker 0x570310-0x57043a with the next queued viable range and normalizing RetDec varargs/stack-address evidence so the sidecar stays syntax-checkable under GCC and Clang.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch17.c: targeted RetDec C artifact for the eighteenth fixed native gap-queue batch. It emits 17 RetDec native C function bodies / 17 address-range comments from 16 selected ranges after the seven known RetDec structural blockers, and the merged all-evidence prelude now carries loose getenv, fseek, ftell, SEEK_SET, and SEEK_END declarations for this libc call surface.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch18.c: targeted RetDec C artifact for the nineteenth fixed native gap-queue batch. It emits 18 RetDec native C function bodies / 18 address-range comments from 16 selected ranges, replacing the newly observed structural blockers 0x54ea90-0x54ebb0, 0x54ebd0-0x54ecf0, and 0x6b7a0-0x6b8bb with the next queued viable ranges.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch19.c: targeted RetDec C artifact for the twentieth fixed native gap-queue batch. It emits 21 RetDec native C function bodies / 21 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding generator normalization for RetDec pointer initializers sourced from synthetic globals.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch20.c: targeted RetDec C artifact for the twenty-first fixed native gap-queue batch. It emits 19 RetDec native C function bodies / 19 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, with no new wrapper normalization or split/model blocker needed.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch21.c: targeted RetDec C artifact for the twenty-second fixed native gap-queue batch. It emits 31 RetDec native C function bodies / 32 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after loosening the RetDec int1 helper prototype and adding __sprintf_chk to the wrapper call surface.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch22.c: targeted RetDec C artifact for the twenty-third fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding loose page-size, pthread condition-wait, time, and memory-protection prototypes plus scoped pointer-local address normalization.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch23.c: targeted RetDec C artifact for the twenty-fourth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after loosening RetDec's mfence helper prototype and adding wmemmove to the wrapper call surface.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch24.c: targeted RetDec C artifact for the twenty-fifth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding loose syscall, unwind-region, ioctl, poll, stat64, and lseek64 call-surface declarations.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch25.c: targeted RetDec C artifact for the twenty-sixth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, with no additional wrapper normalization needed.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch26.c: targeted RetDec C artifact for the twenty-seventh fixed native gap-queue batch. It emits 19 RetDec native C function bodies / 19 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, with no additional wrapper normalization needed.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch27.c: targeted RetDec C artifact for the twenty-eighth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding a loose wctob declaration for the wide-character classification slice.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch28.c: targeted RetDec C artifact for the twenty-ninth fixed native gap-queue batch. It emits 18 RetDec native C function bodies / 18 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding loose towlower, writev, and struct iovec declarations.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch29.c: targeted RetDec C artifact for the thirtieth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding loose xorps, epoll, and close declarations.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch30.c: targeted RetDec C artifact for the thirty-first fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding loose outsd, mbstowcs, and 128-bit movdqa immediate normalization.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch31.c: targeted RetDec C artifact for the thirty-second fixed native gap-queue batch. It emits 20 RetDec native C function bodies / 20 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, after adding integer-address memset destination normalization and a loose btowc declaration.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch32.c: targeted RetDec C artifact for the thirty-third fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers, replacing the invalid-break 0x54e240-0x54e308 RetDec split with the next queued viable range and adding guarded loose cpuid/xgetbv helper declarations.
• dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch33.c: targeted RetDec C artifact for the thirty-fourth fixed native gap-queue batch. It emits 17 RetDec native C function bodies / 17 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 split, replacing the invalid-break 0x53fce0-0x53fda4 split with the next queued viable range and adding a loose vswprintf declaration.
• native_gap_retdec_batch34.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch34.c: range-file-driven targeted RetDec C artifact for the thirty-fifth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits. The generator now accepts --ranges-file, so future native gap batches can add range files without changing the shared generator and forcing all previous RetDec batches to regenerate.
• native_gap_retdec_batch35.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch35.c: range-file-driven targeted RetDec C artifact for the thirty-sixth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, without changing the shared generator or regenerating legacy RetDec batches.
• native_gap_retdec_batch36.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch36.c: range-file-driven targeted RetDec C artifact for the thirty-seventh fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, after adding loose getaddrinfo / freeaddrinfo declarations for the resolver slice.
• native_gap_retdec_batch37.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch37.c: range-file-driven targeted RetDec C artifact for the thirty-eighth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, without changing the shared generator or regenerating legacy RetDec batches.
• native_gap_retdec_batch38.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch38.c: range-file-driven targeted RetDec C artifact for the thirty-ninth fixed native gap-queue batch. It emits 20 RetDec native C function bodies / 20 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, after adding loose wcscmp and rewind declarations for the wide locale/file slice.
• native_gap_retdec_batch39.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch39.c: range-file-driven targeted RetDec C artifact for the fortieth fixed native gap-queue batch. It emits 19 RetDec native C function bodies / 19 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, after adding a loose setsockopt declaration for the socket-option slice.
• native_gap_retdec_batch40.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch40.c: range-file-driven targeted RetDec C artifact for the forty-first fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, after adding a loose wmemchr declaration for the wide-memory slice.
• native_gap_retdec_batch41.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch41.c: range-file-driven targeted RetDec C artifact for the forty-second fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the ten known RetDec structural blockers plus the invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, with no additional wrapper normalization needed.
• native_gap_retdec_batch42.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch42.c: range-file-driven targeted RetDec C artifact for the forty-third fixed native gap-queue batch. It emits 18 RetDec native C function bodies / 18 address-range comments from 16 selected ranges after the known RetDec structural blockers, after adding a loose strtold_l declaration for the locale numeric-conversion slice.
• native_gap_retdec_batch43.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch43.c: range-file-driven targeted RetDec C artifact for the forty-fourth fixed native gap-queue batch. It emits 18 RetDec native C function bodies / 18 address-range comments from 16 selected ranges after the known RetDec structural blockers, after adding loose __strtof_l and __asm_ucomiss declarations for the float conversion slice.
• native_gap_retdec_batch44.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch44.c: range-file-driven targeted RetDec C artifact for the forty-fifth fixed native gap-queue batch. It emits 32 RetDec native C function bodies / 32 address-range comments from 16 selected ranges after the known RetDec structural blockers, after adding a loose __iswctype_l declaration and exact intra-batch prototypes for definitions with narrow integer parameters.
• native_gap_retdec_batch45.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch45.c: range-file-driven targeted RetDec C artifact for the forty-sixth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known RetDec structural blockers, after adding time-format helper surface (<time.h> plus a loose gmtime_r declaration) for the timestamp formatting slice.
• native_gap_retdec_batch46.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch46.c: range-file-driven targeted RetDec C artifact for the forty-seventh fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known RetDec structural blockers, after adding loose __strtod_l and __asm_movsd_133 declarations for the locale floating-conversion slice.
• native_gap_retdec_batch47.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch47.c: range-file-driven targeted RetDec C artifact for the forty-eighth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known RetDec structural blockers, after adding a loose pthread_once declaration for the once-initialization slice.
• native_gap_retdec_batch48.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch48.c: range-file-driven targeted RetDec C artifact for the forty-ninth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known RetDec structural blockers, with no additional wrapper surface needed.
• native_gap_retdec_batch49.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch49.c: range-file-driven targeted RetDec C artifact for the fiftieth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known RetDec structural blockers, with no additional wrapper surface needed.
• native_gap_retdec_batch50.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch50.c: range-file-driven targeted RetDec C artifact for the fifty-first fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known RetDec structural blockers, after adding a loose sem_init declaration for the semaphore initialization slice.
• native_gap_retdec_batch51.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch51.c: range-file-driven targeted RetDec C artifact for the fifty-second fixed native gap-queue batch. It emits 17 RetDec native C function bodies / 17 address-range comments from 16 selected ranges after the known RetDec structural blockers, replacing the newly observed invalid-break 0x4c3770-0x4c37fa split with the next queued viable range and adding loose declarations for RetDec synthetic unknown_* helpers.
• native_gap_retdec_batch52.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch52.c: range-file-driven targeted RetDec C artifact for the fifty-third fixed native gap-queue batch. It skips the known invalid-break 0x4c3770-0x4c37fa split, emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges, and adds a loose pthread_create declaration for the thread-launch slice.
• native_gap_retdec_batch53.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch53.c: range-file-driven targeted RetDec C artifact for the fifty-fourth fixed native gap-queue batch. It skips the known invalid-break 0x4c3770-0x4c37fa split, emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges, and adds loose declarations for additional RetDec synthetic unknown_* helpers.
• native_gap_retdec_batch54.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch54.c: range-file-driven targeted RetDec C artifact for the fifty-fifth fixed native gap-queue batch. It replaces the newly observed invalid-break 0x492814-0x492897 split with the next queued viable range, emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges, and adds loose fseeko64 / ftello64 declarations for the file-buffer slice.
• native_gap_retdec_batch55.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch55.c: range-file-driven targeted RetDec C artifact for the fifty-sixth fixed native gap-queue batch. It replaces the newly observed invalid-break 0x4aa540-0x4aa5bf split with the next queued viable range, and emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges.
• native_gap_retdec_batch56.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch56.c: range-file-driven targeted RetDec C artifact for the fifty-seventh fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers, with no additional wrapper surface needed.
• native_gap_retdec_batch57.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch57.c: range-file-driven targeted RetDec C artifact for the fifty-eighth fixed native gap-queue batch. It emits 23 RetDec native C function bodies / 23 address-range comments from 16 selected ranges after adding loose AES inverse-mix-column / vector move helper declarations.
• native_gap_retdec_batch58.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch58.c: range-file-driven targeted RetDec C artifact for the fifty-ninth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers, with no additional wrapper surface needed.
• native_gap_retdec_batch59.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch59.c: range-file-driven targeted RetDec C artifact for the sixtieth fixed native gap-queue batch. It replaces the newly observed invalid-break 0x59c58-0x59cd1 and 0x773b0-0x77429 splits with the next queued viable ranges, emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges, and adds loose declarations for RetDec synthetic helpers plus _Unwind_DeleteException.
• native_gap_retdec_batch60.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch60.c: range-file-driven targeted RetDec C artifact for the sixty-first fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers, with no additional wrapper surface needed.
• native_gap_retdec_batch61.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch61.c: range-file-driven targeted RetDec C artifact for the sixty-second fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers, with no additional wrapper surface needed.
• native_gap_retdec_batch62.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch62.c: range-file-driven targeted RetDec C artifact for the sixty-third fixed native gap-queue batch. RetDec splits this slice into 19 native C function bodies / 19 address-range comments from 16 selected ranges after the known split/model blockers; the all-evidence prelude now also declares malloc because this batch exposes an allocator call in the init slice.
• native_gap_retdec_batch63.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch63.c: range-file-driven targeted RetDec C artifact for the sixty-fourth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers, with no additional wrapper surface needed.
• native_gap_retdec_batch64.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch64.c: range-file-driven targeted RetDec C artifact for the sixty-fifth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers; the RetDec prelude now declares pthread_once with a callback pointer so the partially covered 0x4f2ce0-0x4f2d65 slice remains syntax-checkable.
• native_gap_retdec_batch65.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch65.c: range-file-driven targeted RetDec C artifact for the sixty-sixth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers; the RetDec prelude now declares loose _ITM_RU1, _ZGTtnam, and _ITM_memcpyRtWn helper surfaces for the transactional-memory/string slice.
• native_gap_retdec_batch66.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch66.c: range-file-driven targeted RetDec C artifact for the sixty-seventh fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers; the RetDec prelude now declares fdopen, and the all-evidence prelude declares fflush / setvbuf for the file-wrapper slice.
• native_gap_retdec_batch67.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch67.c: range-file-driven targeted RetDec C artifact for the sixty-eighth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after replacing the newly observed invalid-break 0x52586-0x525ef and 0x4aa5d0-0x4aa639 splits with the next queued viable ranges; the RetDec prelude now declares munmap, getwc, and _Unwind_Resume_or_Rethrow for this slice.
• native_gap_retdec_batch68.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch68.c: range-file-driven targeted RetDec C artifact for the sixty-ninth fixed native gap-queue batch. RetDec splits this slice into 17 native C function bodies / 17 address-range comments from 16 selected ranges after the known split/model blockers; the RetDec prelude now declares sem_destroy, clock_gettime, and additional synthetic unknown_* helper surfaces for this slice.
• native_gap_retdec_batch69.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch69.c: range-file-driven targeted RetDec C artifact for the seventieth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers and the two batch67 invalid-break rows, with no additional wrapper surface needed.
• native_gap_retdec_batch70.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch70.c: range-file-driven targeted RetDec C artifact for the seventy-first fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers and the two invalid-break rows; the RetDec prelude now declares another synthetic unknown_* helper, and the all-evidence prelude declares abort for the merged artifact.
• native_gap_retdec_batch71.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch71.c: range-file-driven targeted RetDec C artifact for the seventy-second fixed native gap-queue batch. RetDec collapses this slice into 15 native C function bodies / 15 address-range comments from 16 selected ranges after the known split/model blockers and the two invalid-break rows; the RetDec wrapper now normalizes synthetic struct tm field access and declares the newly surfaced AES/SSE helper intrinsics for this slice.
• native_gap_retdec_batch72.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch72.c: range-file-driven targeted RetDec C artifact for the seventy-third fixed native gap-queue batch. RetDec splits this slice into 17 native C function bodies / 17 address-range comments from 16 selected ranges after the known split/model blockers and the two invalid-break rows, with no additional wrapper surface needed.
• native_gap_retdec_batch73.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch73.c: range-file-driven targeted RetDec C artifact for the seventy-fourth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers and the two invalid-break rows; the RetDec prelude now declares pthread mutex-attribute, write, and low-level instruction helper surfaces for this slice.
• native_gap_retdec_batch74.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch74.c: range-file-driven targeted RetDec C artifact for the seventy-fifth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers and the two invalid-break rows; the RetDec prelude now declares sem_wait and pthread_cond_broadcast for this synchronization slice.
• native_gap_retdec_batch75.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch75.c: range-file-driven targeted RetDec C artifact for the seventy-sixth fixed native gap-queue batch. It emits 16 RetDec native C function bodies / 16 address-range comments from 16 selected ranges after the known split/model blockers, the two batch67 invalid-break rows, and the newly observed invalid-break 0x4c3060-0x4c30b5 row; no additional wrapper surface was needed after replacing that row with the next queued viable range.
• native_gap_retdec_batch76.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch76.c: range-file-driven targeted RetDec C artifact for the seventy-seventh fixed native gap-queue batch. RetDec splits this slice into 18 native C function bodies / 18 address-range comments from 16 selected ranges after the known split/model blockers and invalid-break rows; the RetDec prelude now declares __towupper_l / __towlower_l for the wide-character locale slice.
• native_gap_retdec_batch77.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch77.c: range-file-driven targeted RetDec C artifact for the seventy-eighth fixed native gap-queue batch. RetDec splits this slice into 17 native C function bodies / 17 address-range comments from 16 selected ranges after the known split/model blockers and invalid-break rows; the RetDec prelude now declares synthetic helper unknown_166c28d.
• native_gap_retdec_batch78.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch78.c: range-file-driven targeted RetDec C artifact for the seventy-ninth fixed native gap-queue batch. RetDec emits 14 native C function bodies / 14 address-range comments from 16 selected ranges after the known split/model blockers and invalid-break rows, with no additional wrapper surface needed.
• native_gap_retdec_batch79.ranges and dumps/vmtail-wide-1m-w16/vm_native_gap_retdec_batch79.c: range-file-driven targeted RetDec C artifact for the eightieth fixed native gap-queue batch. RetDec emits 17 native C function bodies / 17 address-range comments from 16 selected ranges, with no additional wrapper surface needed.
• native_gap_retdec_batch80.ranges through native_gap_retdec_batch87.ranges and their vm_native_gap_retdec_batch80.c through vm_native_gap_retdec_batch87.c sidecars: range-file-driven targeted RetDec C artifacts for the next eight fixed native gap-queue batches. The batch planner now creates future range files from the current gap queue, Make discovers range files dynamically, and the all-evidence bundle/manifest discover native gap sidecars dynamically. These eight batches cover 128 selected ranges and emit 133 native C function bodies / 133 address-range comments after adding wrapper declarations for fopen64, read, putwc, __asm_movq, and _Unwind_RaiseException.
• native_gap_retdec_batch88.ranges through native_gap_retdec_batch95.ranges and their vm_native_gap_retdec_batch88.c through vm_native_gap_retdec_batch95.c sidecars: automated range-file-driven targeted RetDec C artifacts for the next eight native gap-queue batches. The planner replaced newly observed invalid-break ranges 0x4a95d0-0x4a9612, 0x4b03a0-0x4b03de, 0x4883d8-0x488414, and 0x4b4e10-0x4b4e4c with later queue rows, and RetDec emits 133 native C function bodies / 133 address-range comments after adding wrapper declarations for _Unwind_GetDataRelBase, additional synthetic unknown_* helpers, mmap, __readgsdword, _ZN9__gnu_cxxL27__exchange_and_add_dispatchEPii_constprop_31, and __asm_fbstp.
• native_gap_retdec_batch96.ranges through native_gap_retdec_batch103.ranges and their vm_native_gap_retdec_batch96.c through vm_native_gap_retdec_batch103.c sidecars: automated range-file-driven targeted RetDec C artifacts for the next eight native gap-queue batches. RetDec emits 135 native C function bodies / 135 address-range comments from 128 selected ranges after adding shared declarations for unknown_ffffffffa83be585, ungetwc, _ZGTtdlPv, __asm_wait, __asm_in_133, sem_post, plus aggregate-prelude declarations for ungetc and __ctype_get_mb_cur_max.
• native_gap_retdec_batch104.ranges through native_gap_retdec_batch111.ranges and their vm_native_gap_retdec_batch104.c through vm_native_gap_retdec_batch111.c sidecars: automated range-file-driven targeted RetDec C artifacts for the next eight native gap-queue batches. RetDec emits 131 native C function bodies / 131 address-range comments from 128 selected ranges after adding declarations for new synthetic helpers, __newlocale, blake3_hasher_init_derive_key_raw, the CRC32C table symbol, locale collation helpers, signal/alarm, aggregate putc, and a RetDec symbol-normalization rule for _ZN9__gnu_cxxL27__exchange_and_add_dispatchEPii.constprop.31.
• vm_native_gap_retdec_ranges_from_queue.py: automated native gap batch planner. It reads the current gap queue, skips already-used range files and known RetDec structural blockers, and writes the next numbered native_gap_retdec_batchNN.ranges files so future RetDec expansion no longer requires hand-patching the Makefile, all-evidence bundle, or manifest for every batch.
• dumps/vmtail-wide-1m-w16/vm_target_only_handlers_retdec.c: targeted RetDec C artifact for the 3 target-only VM handler ranges; RetDec splits them into 8 native C functions, including shared internal chunks.
• dumps/vmtail-wide-1m-w16/vm_unobserved_handlers_retdec_batch00.c through vm_unobserved_handlers_retdec_batch06.c: targeted RetDec C artifacts for all 155 unobserved VM handler native ranges; RetDec splits them into 272 native C functions plus 14 external helper prototypes.
• dumps/vmtail-wide-1m-w16/vm_weak_handlers_retdec.c: targeted RetDec C artifact for 36 observed weak-recovery handler ranges; RetDec splits them into 60 native C functions plus 3 external helper prototypes.
• dumps/vmtail-wide-1m-w16/vm_validated_handlers_retdec_batch00.c through vm_validated_handlers_retdec_batch06.c: targeted RetDec C artifacts for all 166 static-validated VM handler native ranges; RetDec splits them into 259 native C functions plus 18 external helper prototypes.
• dumps/vmtail-wide-1m-w16/vm_handler_retdec_index.tsv and .md: native C-generated index tying all 360 dispatch entries to their handler RetDec sidecar file, selected native range, and overlapping emitted native C functions.
• dumps/vmtail-wide-1m-w16/vm_static_only_handler_queue.c, .tsv, and .md: native C-generated ranked closure queue for the 155 static-only dispatch entries. It currently identifies 11 tier-0 small single-function handlers, 43 tier-1 medium single-function handlers, 15 tier-2 small shared-range rows, 40 tier-3 multi-function shared rows, 37 rows with native call/ret side effects, and 9 large rows now carried by the tier5 model layer; the top ranked entries are 57,255,96,71,73,339,324,38,67,138.
• dumps/vmtail-wide-1m-w16/vm_static_only_tier0_handler_models.c, .tsv, and .md: native C-generated frame-level models for the 11 tier-0 static-only single-function handlers (57,255,96,71,73,339,324,38,67,138,47). The C file emits 11 vm_tier0_entry_NNN functions plus a dispatcher, preserving RetDec frame offsets for IP, flags, dispatch-table base, state, and predicate scratch while surfacing concrete or candidate slot expressions.
• dumps/vmtail-wide-1m-w16/vm_static_only_tier1_handler_models.c, .tsv, and .md: native C-generated model layer for the 43 tier-1 static-only single-function handlers. The C file emits 43 vm_tier1_entry_NNN functions plus a dispatcher, with 9 known/candidate slot expressions and 3 clean dispatch-table slot recoveries promoted into the primary handler layer; masked g3/g5 and noisy/native-tail candidates stay comment-only.
• dumps/vmtail-wide-1m-w16/vm_static_only_tier2_split_models.c, .tsv, and .md: native C-generated split/model layer for the 15 tier-2 small shared-range static-only rows. The C file emits 15 vm_tier2_entry_NNN functions plus a dispatcher, with 5 clean RetDec dispatch-table slot recoveries promoted into the primary handler layer and the remaining split rows preserved as state/effect evidence.
• dumps/vmtail-wide-1m-w16/vm_static_only_tier3_shared_models.c, .tsv, and .md: native C-generated model layer for the 40 tier-3 multi-function shared static-only rows. The C file emits 40 vm_tier3_entry_NNN functions plus a dispatcher, with 5 RetDec slot candidates, 2 clean dispatch-table slot recoveries promoted into the primary handler layer, and the masked/noisy/base-mangled returns kept comment-only.
• dumps/vmtail-wide-1m-w16/vm_static_only_tier4_callret_models.c, .tsv, and .md: native C-generated model layer for the 37 tier-4 static-only rows with native call/ret side effects. The C file emits 37 vm_tier4_entry_NNN functions plus a dispatcher, with 1 native-call row, 3 multi-ret rows, 3 comment-only slot candidates, and 0 executable dispatch-table slot recoveries.
• dumps/vmtail-wide-1m-w16/vm_static_only_tier5_large_models.c, .tsv, and .md: native C-generated model layer for the final 9 tier-5 large static-only rows. The C file emits 9 vm_tier5_entry_NNN functions plus a dispatcher, covering 12514 selected native span bytes / 2704 native instructions with conservative non-dispatch/noisy-tail classifications and 0 executable dispatch-table slot recoveries.
• dumps/vmtail-wide-1m-w16/vm_binary_data_sections.c, .tsv, and .md: native C-generated data carrier for program strings/data. It emits exact byte arrays for 22 allocatable non-executable ELF runtime data sections (0xe63f7 bytes), metadata rows for all 29 allocatable ELF sections including executable-section and BSS/NOBITS metadata, 2917 full string-reference rows / 0x10b64 printable bytes from emitted string-bearing sections, backing pointers into the exact byte arrays, C11 count assertions, and the raw 360-entry VM dispatch table bytes/offsets from file offset 0xc3718.
• dumps/vmtail-wide-1m-w16/vm_unresolved_family_chains.c: native C-generated evidence artifact for the 15 residual native-ret-patch / observed-chain successor families; it renders 16 native return-patch records and 57 observed-chain reconciliation steps as syntax-checkable C evidence functions.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_snapshot_transfer_probe.tsv: generic live-snapshot transfer replay for all 15 unresolved starts, including focused full-GPR rows and fakenet/config frame-only rows.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_snapshot_transfer_probe.md: Markdown digest of live snapshot strength, branch-resolution, next-event relation, and remaining table-rejected/sequence-only classes.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_table_evidence.tsv: per-live-row file/runtime evidence for the concrete rejected table offsets, including qword classes and next-event relation.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_table_evidence.md: Markdown digest of rejected table-offset evidence classes, runtime/file byte agreement, and dispatch-target absence.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_symbolic_successors.tsv: audit of the source-246 symbolic-slot successor candidates.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_symbolic_successors.md: Markdown digest of the symbolic successor audit, including recovered/mid-block/uncovered status.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_in_roles.tsv: current header-only live-register role join; it will carry role columns if any future gap transfer remains live-in-dependent.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_in_roles.md: Markdown digest of the current zero live-in rows.
• dumps/vmtail-wide-1m-w16/vm_live_in_final_tail_site_probe.tsv: current header-only exact final-tail site memory probe summary for active live-in rows.
• dumps/vmtail-wide-1m-w16/vm_live_in_final_tail_site_probe.md: Markdown digest of the current zero final-tail proof rows.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_in_reentry_probe.tsv: current header-only join of live-in register-role evidence, source-level exact final-tail proof, and dynamic next-hooked reentry.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_live_in_reentry_probe.md: Markdown digest of the current zero live-in reentry rows.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_allstatic_reentry_probe.tsv: current header-only all-static VMTAIL immediate-next correlation for active live-in reentry rows.
• dumps/vmtail-wide-1m-w16/vm_synthetic_gap_allstatic_reentry_probe.md: Markdown digest of the current zero all-static live-in reentry rows.
• dumps/vmtail-mem-smoke/run.stderr: bounded EAC_VMTAIL_MEM=1 smoke run proving the driver emits mem_<reg> qword fields at the added final-tail sites; it is run-only evidence, not a bytecode instruction-trace coverage run.
• dumps/vmtail-mem-focus-starts/run.stderr: focused EAC_VMTAIL_MEM=1 run over the former live-in synthetic start set, stopped after 42 focused VMTAIL hits. It remains memory-context evidence, not an instruction-trace coverage run.
• dumps/vmtail-mem-focus-start-final-sites/run.stderr: focused intersection run over the former live-in synthetic starts and native final-tail sites; retained as archived memory-context evidence.
• dumps/vmtail-mem-focus-final-sites/run.stderr: focused exact-site memory run over former live-in final native tail hooks; retained as archived memory-context evidence.
• dumps/vmtail-mem-focus-final-site-b265e/run.stderr: single-site exact-tail run for the rarer source-278 final site 0xb265e.
• dumps/vmtail-mem-focus-final-site-c2d35/run.stderr: single-site exact-tail run for the rarer source-356 final site 0xc2d35.
• dumps/vmtail-wide-1m-w16/vm_state_static_slice.tsv: static symbolic state/flag update chains for all dispatch entries.
• dumps/vmtail-wide-1m-w16/vm_state_static_slice_entry258.tsv: focused static state slice for the high-volume nonlinear entry 258.
• dumps/vmtail-wide-1m-w16/vm_handler_tail_roles.tsv: long-run source-handler/tail-site rows joined with register roles inferred from the 50k GPR smoke trace.
• dumps/vmtail-wide-1m-w16/vm_handler_tail_roles_wide_regs.tsv: same join using the 250k GPR trace for better low-frequency site coverage.
• dumps/vmtail-wide-1m-w16/vm_tail_static_slots.tsv: static dispatch-slot provenance joined to each long-run source-handler/tail-site row.
• dumps/vmtail-wide-1m-w16/vm_instruction_lift.tsv: one enriched row per exact recovered unique VM instruction.
• dumps/vmtail-wide-1m-w16/vm_transition_model.tsv: one consolidated transition-model row per dispatch entry.
• dumps/vmtail-wide-1m-w16/vm_microcode_catalog.tsv: compact pseudo-IR row per dispatch entry.
• dumps/vmtail-wide-1m-w16/vm_microcode_top.md: Markdown digest for the top observed dispatch entries by long-run event count.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog.tsv: compact pseudo-IR row per concrete source-handler branch path.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_top.md: Markdown digest for the top concrete branch paths by state-trace event count.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog_fast.tsv: compact pseudo-IR row per native state-only concrete source-handler branch path.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_fast_top.md: Markdown digest for the top native state-only concrete branch paths.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog_gpr_seeded.tsv: compact pseudo-IR row per GPR+scratch-seeded concrete source-handler branch path.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_gpr_seeded_top.md: Markdown digest for the top GPR+scratch-seeded concrete branch paths.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog_gpr_seeded_fast.tsv: compact pseudo-IR row per native GPR+scratch-seeded concrete source-handler branch path.
• dumps/vmtail-wide-1m-w16/vm_path_microcode_gpr_seeded_fast_top.md: Markdown digest for the top native GPR+scratch-seeded concrete branch paths.
• dumps/vmtail-wide-1m-w16/vm_path_handlers_pseudocode.c: C-like path-specialized handler functions for all 560 fully target/IP-validated native GPR+scratch-seeded concrete branch paths; the all-evidence bundle now also retains these functions as a renamed sidecar in the single C file.
• dumps/vmtail-wide-1m-w16/vm_path_handlers_frontier_pseudocode.c: C-like frontier artifact for the 10 native GPR+scratch-seeded path rows that still have 0% target/IP validation; it keeps the weak rows in syntax-checkable C with metadata and dispatcher cases, but labels them as frontier evidence rather than validated path coverage.
• dumps/vmtail-wide-1m-w16/vm_path_frontier_slot_audit.c/.tsv/.md: slot-expression audit for those 10 weak path rows; all 10 are not_promotable, with 0 direct dispatch-table matches and 0 rows having any table match.
• dumps/vmtail-wide-1m-w16/vm_path_handlers_hot_pseudocode.c: C-like path-specialized handler functions for the 80 hottest validated concrete branch paths.
• dumps/vmtail-wide-1m-w16/vm_bytecode_file_atlas.tsv: file-backed VM bytecode atlas built from sampled bytecode segments with --max-gap 0x20.
• dumps/vmtail-wide-1m-w16/vm_dispatch_formula_validate.tsv: validation of byte-only dispatch formulas against long exact unique instructions.
• dumps/vmtail-wide-1m-w16/vm_gap_report.tsv: exact-segment coverage gap ranking.
• dumps/vmtail-wide-1m-w16/vm_gap_report_sampled.tsv: gap ranking after adding sampled byte-window coverage.
• dumps/vmtail-mode0-w16/* and dumps/vmtail-mode2-w16/*: 250k wide-tail traces for accepted alternate x modes 0 and 2.
• dumps/vmtail-mode-compare.tsv: exact unique-instruction comparison for mode 0, mode 1 250k, mode 1 long, and mode 2.
• dumps/vmtail-state-wide-w16/run.stderr: 250k state-aware VMTAIL trace. VMTAIL rows include vm_flags, vm_state, and vm_byte after each handler.
• dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv: state-aware instruction rows with appended pre_*, post_*, and state_delta columns.
• dumps/vmtail-state-residual-targets/run.stderr: focused residual-state run stopped after 18 predecessor/synthetic-start VMTAIL hits for the 9 baseline-missing residual starts.
• dumps/vmtail-state-residual-targets/vm_instruction_trace.tsv: supplemental state trace rows consumed by the concrete-state residual audit alongside the baseline state-wide trace.
• dumps/vmtail-live-residual-targets/run.stderr: focused all-residual live-context run stopped after 40 predecessor/synthetic-start VMTAIL hits, with GPR and frame-scratch snapshots.
• dumps/vmtail-live-residual-targets/vm_instruction_trace.tsv: parsed instruction rows from the all-residual live-context run.
• dumps/vmtail-residual-122e3c-context/run.stderr: dedicated context trace for the former 0x122e3c chain terminal. It stopped after four focused VMTAIL hits and captured 0x122e38 -> 0x122e3c -> 0x2c0468 -> 0x2c046a with GPR/frame-scratch state, proving the next hooked event after 0x122e3c without relying only on the broad trace.
• dumps/vmtail-residual-122e3c-context/vm_instruction_trace.tsv: parsed instruction rows for that focused context run. It carries sequence provenance; the exact 0x2c0468 -> 0x2c046a row was already present in the primary trace.
• dumps/vmtail-residual-122e3c-context-postcall/postcall_map_*.bin and postcall_maps.txt: postcall EAC mapped-memory dump used by the runtime residual table-memory probe.
• dumps/vmtail-state-wide-w16/vm_state_effects.tsv: per-handler frame-state effect summary.
• dumps/vmtail-state-wide-w16/vm_state_signatures.tsv: per-signature frame-state effect summary keyed by source handler, byte delta, byte status, and byte sequence.
• dumps/vmtail-state-wide-w16/vm_state_affine.tsv: affine frame+0x170 post-state formulas using pre-state and instruction bytes, with 5-fold validation.
• dumps/vmtail-state-wide-w16/vm_state_affine_fullfields.tsv: affine frame+0x170 post-state formulas using all traced state fields, with 5-fold validation.
• dumps/vmtail-state-wide-w16/vm_state_static_validate.tsv: concrete validation of static state slices against the state-aware instruction trace.
• dumps/vmtail-state-wide-w16/vm_static_dispatch_validate.tsv: concrete validation of static dispatch target and VM IP advance against the state-aware instruction trace.
• dumps/vmtail-state-wide-w16/vm_state_static_validate_fast.tsv: native concrete validation of static state slices against the state-aware instruction trace.
• dumps/vmtail-state-wide-w16/vm_static_dispatch_validate_fast.tsv: native concrete validation of static dispatch target and VM IP advance against the state-aware instruction trace.
• dumps/vmtail-state-wide-w16/vm_static_transfer_expr.tsv: sampled path-sensitive symbolic dispatch-slot and VM IP-advance expressions, generated from up to 128 state-aware rows per source.
• dumps/vmtail-state-wide-w16/vm_static_transfer_expr_gpr_seeded.tsv: same native source-level transfer-expression sample, seeded with previous-tail GPRs and hot scratch-frame fields.
• dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr.tsv: native path-conditioned symbolic dispatch-slot and IP-advance expressions over the same bounded transfer-expression sample.
• dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr_gpr_seeded.tsv: native GPR+scratch-seeded path-conditioned symbolic dispatch-slot and IP-advance expressions.
• dumps/vmtail-state-wide-w16/vm_static_path_profile.tsv: per-source branch-path profile from concrete static handler replay over the full state-aware trace.
• dumps/vmtail-state-wide-w16/vm_static_path_variants.tsv: one row per distinct source-handler branch path, with per-path target distributions.
• dumps/vmtail-state-wide-w16/vm_static_path_profile_gpr_seeded.tsv: same path profile, but seeded with entry GPRs and hot scratch-frame fields from the previous dumps/vmtail-scratch-wide-w16-fs337all-fs128/run.stderr VMTAIL event.
• dumps/vmtail-state-wide-w16/vm_static_path_variants_gpr_seeded.tsv: one row per GPR+scratch-seeded source-handler branch path.
• dumps/vmtail-state-wide-w16/vm_static_path_profile_fast.tsv and vm_static_path_variants_fast.tsv: native path-profiler outputs for the state-only replay.
• dumps/vmtail-state-wide-w16/vm_static_path_profile_gpr_seeded_fast.tsv and vm_static_path_variants_gpr_seeded_fast.tsv: native path-profiler outputs for the GPR+scratch-seeded replay.
• dumps/vmtail-state-wide-w16/vm_branch_sites_fast.tsv: native full-trace branch-site outcome counts for the state-only replay.
• dumps/vmtail-state-wide-w16/vm_branch_sites_gpr_seeded_fast.tsv: native full-trace branch-site outcome counts for the GPR+scratch-seeded replay.
• dumps/vmtail-state-wide-w16/vm_branch_predicates.tsv: native bounded sampler row per source-handler branch site with outcome counts, unresolved predicate classes, and top condition expressions.
• dumps/vmtail-state-wide-w16/vm_branch_predicates_top.md: Markdown digest of the highest-volume unresolved branch predicates.
• dumps/vmtail-state-wide-w16/vm_branch_predicates_gpr_seeded.tsv: same native branch predicate catalog, seeded with previous-tail GPR snapshots and hot scratch-frame fields.
• dumps/vmtail-state-wide-w16/vm_branch_predicates_gpr_seeded_top.md: Markdown digest of the highest-volume unresolved GPR+scratch-seeded predicates.
• dumps/vmtail-state-wide-w16/vm_branch_predicates_gpr_seeded_full.tsv: unbounded GPR+scratch-seeded predicate provenance over all 1007971 dynamic branch evaluations; current unresolved count is zero.
• dumps/vmtail-state-wide-w16/vm_dispatch_model_combined.tsv: combined static-plus-affine dispatch model coverage for the state-aware instruction trace.
• dumps/vmtail-state-wide-w16/vm_dispatch_formulas.tsv: fitted dispatch-index formulas from the state-aware instruction trace.
• dumps/vmtail-state-wide-w16/vm_dispatch_affine.tsv: exact affine dispatch-index fits from the state-aware instruction trace.
• dumps/vmtail-state-wide-w16/vm_dispatch_affine_cv.tsv: 5-fold held-out validation of affine dispatch-index fits.
• dumps/vmtail-regs-smoke-w16/run.stderr: 50k VMTAIL trace with full GPR snapshots at each tail site.
• dumps/vmtail-regs-smoke-w16/vm_tail_registers.tsv: per-site/per-register role evidence from the GPR trace.
• dumps/vmtail-regs-smoke-w16/vm_tail_register_summary.tsv: compact one-row-per-site register-role summary for lifting dispatch tails.
• dumps/vmtail-regs-wide-w16/run.stderr: 250k VMTAIL trace with full GPR snapshots at each tail site.
• dumps/vmtail-scratch-wide-w16-fs337all-fs128/run.stderr: 250k VMTAIL trace with full GPR snapshots plus the default hot scratch-frame fields (fs0x0, fs0x12, fs0x60, fs0x68, fs0x71, fs0x81, fs0xe1, fs0x13d, fs0x16f, fs0x1e8), the entry-337 pointer-predicate offsets (fs0x13, fs0x28, fs0x38, fs0x79, fs0x89, fs0x91, fs0x99, fs0xab, fs0xb3, fs0xcb, fs0xd3, fs0x107, fs0x123, fs0x147, fs0x19d), and fs0x128 for entry 95's final frame-bit predicate.
• dumps/vmtail-regs-wide-w16/vm_tail_registers.tsv: per-site/per-register role evidence from the 250k GPR trace.
• dumps/vmtail-regs-wide-w16/vm_tail_register_summary.tsv: compact one-row-per-site register-role summary from the 250k GPR trace.

Reproduction:

make
mkdir -p dumps/local-blocked-log
env EAC_DUMP_DIR=dumps/local-blocked-log \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 1 \
  >dumps/local-blocked-log/run.stdout \
  2>dumps/local-blocked-log/run.stderr
python3 recon_summary.py dumps/local-blocked-log --eac eac.elf

Dispatcher trace:

make
mkdir -p dumps/dispatch-trap
timeout 30s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/dispatch-trap/run.stdout \
  2>dumps/dispatch-trap/run.stderr
python3 recon_summary.py dumps/dispatch-trap --eac eac.elf

Dispatcher plus recursive direct VM tail trace:

make
mkdir -p dumps/vmtail-recursive
timeout 30s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_DETAIL=1 \
  EAC_VMTAIL_TRACE=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_VMTAIL_LIMIT=30000 \
  EAC_DUMP_DIR=dumps/vmtail-recursive \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/vmtail-recursive/run.stdout \
  2>dumps/vmtail-recursive/run.stderr
python3 recon_summary.py dumps/vmtail-recursive --eac eac.elf
python3 vm_tail_scan.py dumps/vmtail-recursive --eac eac.elf --limit 24

Extra tail hooks can be supplied without recompiling:

EAC_VMTAIL_SITES='0xb0458:r15,0xbf126:rbx,0xbf886:r15' ...

All-table static tail trace:

make
mkdir -p dumps/vmtail-allstatic
SPEC=$(python3 vm_tail_scan.py --all-table --eac eac.elf --window 0x800 --limit 0 \
  | sed -n 's/^EAC_VMTAIL_SITES=//p')
timeout 30s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_DETAIL=1 \
  EAC_VMTAIL_TRACE=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_VMTAIL_LIMIT=250000 \
  EAC_VMTAIL_SITES="$SPEC" \
  EAC_DUMP_DIR=dumps/vmtail-allstatic \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/vmtail-allstatic/run.stdout \
  2>dumps/vmtail-allstatic/run.stderr
python3 recon_summary.py dumps/vmtail-allstatic --eac eac.elf
python3 vm_tail_scan.py dumps/vmtail-allstatic --eac eac.elf --window 0x800 --table-report \
  >dumps/vmtail-allstatic/vm_table.tsv
python3 vm_trace_graph.py dumps/vmtail-allstatic --eac eac.elf \
  >dumps/vmtail-allstatic/vm_edges.tsv
python3 vm_trace_graph.py dumps/vmtail-allstatic --eac eac.elf --sequential \
  >dumps/vmtail-allstatic/vm_seq_edges.tsv
python3 vm_trace_graph.py dumps/vmtail-allstatic --eac eac.elf --source-profile \
  >dumps/vmtail-allstatic/vm_source_profile.tsv
python3 vm_handler_table.py dumps/vmtail-allstatic --eac eac.elf \
  >dumps/vmtail-allstatic/vm_handler_table.tsv

Wide-tail rerun with the current 16-word tracer:

make
mkdir -p dumps/vmtail-wide-w16
SPEC=$(python3 vm_tail_scan.py --all-table --eac eac.elf --window 0x1200 --limit 0 \
  | sed -n 's/^EAC_VMTAIL_SITES=//p')
timeout 30s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_DETAIL=1 \
  EAC_VMTAIL_TRACE=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_VMTAIL_LIMIT=250000 \
  EAC_VMTAIL_SITES="$SPEC" \
  EAC_DUMP_DIR=dumps/vmtail-wide-w16 \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/vmtail-wide-w16/run.stdout \
  2>dumps/vmtail-wide-w16/run.stderr
python3 vm_tail_scan.py dumps/vmtail-wide-w16 --eac eac.elf --window 0x1200 --table-report \
  >dumps/vmtail-wide-w16/vm_table.tsv
python3 vm_trace_graph.py dumps/vmtail-wide-w16 --eac eac.elf --window 0x1200 --sequential \
  >dumps/vmtail-wide-w16/vm_seq_edges.tsv
python3 vm_trace_graph.py dumps/vmtail-wide-w16 --eac eac.elf --window 0x1200 --source-profile \
  >dumps/vmtail-wide-w16/vm_source_profile.tsv
python3 vm_trace_graph.py dumps/vmtail-wide-w16 --eac eac.elf --window 0x1200 --instruction-trace \
  >dumps/vmtail-wide-w16/vm_instruction_trace.tsv
python3 vm_handler_table.py dumps/vmtail-wide-w16 --eac eac.elf --window 0x1200 \
  >dumps/vmtail-wide-w16/vm_handler_table.tsv
./vm_bytecode_blocks_fast dumps/vmtail-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-wide-w16/vm_bytecode_blocks.tsv
./vm_bytecode_segments_fast dumps/vmtail-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-wide-w16/vm_bytecode_segments.tsv
./vm_instruction_unique_fast dumps/vmtail-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-wide-w16/vm_instruction_unique.tsv
python3 vm_bytecode_cfg.py dumps/vmtail-wide-w16/vm_instruction_trace.tsv \
  --segments dumps/vmtail-wide-w16/vm_bytecode_segments.tsv \
  >dumps/vmtail-wide-w16/vm_bytecode_block_edges.tsv

Long wide-tail rerun with the current 16-word tracer:

make
mkdir -p dumps/vmtail-wide-1m-w16
SPEC=$(python3 vm_tail_scan.py --all-table --eac eac.elf --window 0x1200 --limit 0 \
  | sed -n 's/^EAC_VMTAIL_SITES=//p')
timeout 75s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_DETAIL=1 \
  EAC_VMTAIL_TRACE=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_VMTAIL_LIMIT=1000000 \
  EAC_VMTAIL_SITES="$SPEC" \
  EAC_DUMP_DIR=dumps/vmtail-wide-1m-w16 \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/vmtail-wide-1m-w16/run.stdout \
  2>dumps/vmtail-wide-1m-w16/run.stderr
python3 recon_summary.py dumps/vmtail-wide-1m-w16 --eac eac.elf \
  >dumps/vmtail-wide-1m-w16/recon_summary.txt
python3 vm_tail_scan.py dumps/vmtail-wide-1m-w16 --eac eac.elf --window 0x1200 --table-report \
  >dumps/vmtail-wide-1m-w16/vm_table.tsv
python3 vm_trace_graph.py dumps/vmtail-wide-1m-w16 --eac eac.elf --window 0x1200 \
  >dumps/vmtail-wide-1m-w16/vm_edges.tsv
python3 vm_trace_graph.py dumps/vmtail-wide-1m-w16 --eac eac.elf --window 0x1200 --sequential \
  >dumps/vmtail-wide-1m-w16/vm_seq_edges.tsv
python3 vm_trace_graph.py dumps/vmtail-wide-1m-w16 --eac eac.elf --window 0x1200 --source-profile \
  >dumps/vmtail-wide-1m-w16/vm_source_profile.tsv
python3 vm_trace_graph.py dumps/vmtail-wide-1m-w16 --eac eac.elf --window 0x1200 --instruction-trace \
  >dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv
python3 vm_handler_table.py dumps/vmtail-wide-1m-w16 --eac eac.elf --window 0x1200 \
  >dumps/vmtail-wide-1m-w16/vm_handler_table.tsv
./vm_bytecode_blocks_fast dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_blocks.tsv
./vm_bytecode_segments_fast dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_segments.tsv
./vm_instruction_unique_fast dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-wide-1m-w16/vm_instruction_unique.tsv
python3 vm_bytecode_cfg.py dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv \
  --segments dumps/vmtail-wide-1m-w16/vm_bytecode_segments.tsv \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_block_edges.tsv
./vm_bytecode_blocks_fast dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv --include-sampled \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_blocks_sampled.tsv
./vm_bytecode_segments_fast dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv --include-sampled \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_segments_sampled.tsv
make long-branches
make hidden-transitions
make sampled-operands
python3 vm_gap_report.py dumps/vmtail-wide-1m-w16 \
  >dumps/vmtail-wide-1m-w16/vm_gap_report.tsv
python3 vm_gap_report.py dumps/vmtail-wide-1m-w16 \
  --segments dumps/vmtail-wide-1m-w16/vm_bytecode_segments_sampled.tsv \
  >dumps/vmtail-wide-1m-w16/vm_gap_report_sampled.tsv
python3 vm_isa_summary.py dumps/vmtail-wide-1m-w16/vm_instruction_unique.tsv \
  >dumps/vmtail-wide-1m-w16/vm_isa_handlers.tsv
python3 vm_isa_summary.py dumps/vmtail-wide-1m-w16/vm_instruction_unique.tsv --patterns \
  >dumps/vmtail-wide-1m-w16/vm_isa_patterns.tsv
python3 vm_isa_summary.py dumps/vmtail-wide-1m-w16/vm_instruction_unique.tsv --families \
  >dumps/vmtail-wide-1m-w16/vm_isa_families.tsv
python3 vm_isa_summary.py dumps/vmtail-wide-1m-w16/vm_instruction_unique.tsv \
  --source-profile dumps/vmtail-wide-1m-w16/vm_source_profile.tsv \
  --missing-exact \
  >dumps/vmtail-wide-1m-w16/vm_isa_missing_exact.tsv
python3 vm_semantic_templates.py dumps/vmtail-wide-1m-w16 \
  >dumps/vmtail-wide-1m-w16/vm_semantic_templates.tsv
python3 vm_semantic_templates.py dumps/vmtail-wide-1m-w16 --per-handler \
  >dumps/vmtail-wide-1m-w16/vm_handler_semantics.tsv
python3 vm_handler_skeleton.py dumps/vmtail-wide-1m-w16 \
  >dumps/vmtail-wide-1m-w16/vm_handler_skeletons.tsv
python3 vm_handler_skeleton.py dumps/vmtail-wide-1m-w16 --groups --group-key decode \
  >dumps/vmtail-wide-1m-w16/vm_handler_decode_groups.tsv
python3 vm_handler_skeleton.py dumps/vmtail-wide-1m-w16 --groups --group-key dispatch \
  >dumps/vmtail-wide-1m-w16/vm_handler_dispatch_groups.tsv
python3 vm_handler_skeleton.py dumps/vmtail-wide-1m-w16 --groups --group-key skeleton \
  >dumps/vmtail-wide-1m-w16/vm_handler_skeleton_groups.tsv

State-aware wide-tail rerun:

make
mkdir -p dumps/vmtail-state-wide-w16
SPEC=$(python3 vm_tail_scan.py --all-table --eac eac.elf --window 0x1200 --limit 0 \
  | sed -n 's/^EAC_VMTAIL_SITES=//p')
timeout 45s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_DETAIL=1 \
  EAC_VMTAIL_TRACE=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_VMTAIL_LIMIT=250000 \
  EAC_VMTAIL_SITES="$SPEC" \
  EAC_DUMP_DIR=dumps/vmtail-state-wide-w16 \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/vmtail-state-wide-w16/run.stdout \
  2>dumps/vmtail-state-wide-w16/run.stderr
python3 vm_trace_graph.py dumps/vmtail-state-wide-w16 --eac eac.elf --window 0x1200 --instruction-trace \
  >dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv
python3 vm_state_effects.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-state-wide-w16/vm_state_effects.tsv
python3 vm_state_effects.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv --by-signature \
  >dumps/vmtail-state-wide-w16/vm_state_signatures.tsv
python3 vm_state_affine.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv --cv-folds 5 \
  >dumps/vmtail-state-wide-w16/vm_state_affine.tsv
python3 vm_state_affine.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv \
  --include-flags --include-vm-byte --cv-folds 5 \
  >dumps/vmtail-state-wide-w16/vm_state_affine_fullfields.tsv
make fast-state
make fast-state-transfer
make fast-state-predicates
python3 vm_dispatch_model_combine.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-state-wide-w16/vm_dispatch_model_combined.tsv
python3 vm_dispatch_formula.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-state-wide-w16/vm_dispatch_formulas.tsv
python3 vm_dispatch_affine.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-state-wide-w16/vm_dispatch_affine.tsv
python3 vm_dispatch_affine_cv.py dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-state-wide-w16/vm_dispatch_affine_cv.tsv

Register-role VM tail wide trace:

make
mkdir -p dumps/vmtail-regs-wide-w16
SPEC=$(python3 vm_tail_scan.py --all-table --eac eac.elf --window 0x1200 --limit 0 \
  | sed -n 's/^EAC_VMTAIL_SITES=//p')
timeout 45s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_DETAIL=1 \
  EAC_VMTAIL_TRACE=1 \
  EAC_VMTAIL_REGS=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_VMTAIL_LIMIT=250000 \
  EAC_VMTAIL_SITES="$SPEC" \
  EAC_DUMP_DIR=dumps/vmtail-regs-wide-w16 \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/vmtail-regs-wide-w16/run.stdout \
  2>dumps/vmtail-regs-wide-w16/run.stderr
mkdir -p dumps/vmtail-scratch-wide-w16-fs337all-fs128
timeout 60s env EAC_FAST_EXIT=1 \
  EAC_DISPATCH_TRACE=1 \
  EAC_DISPATCH_DETAIL=1 \
  EAC_VMTAIL_TRACE=1 \
  EAC_VMTAIL_REGS=1 \
  EAC_VMTAIL_SCRATCH=1 \
  EAC_DISPATCH_LIMIT=4096 \
  EAC_VMTAIL_LIMIT=250000 \
  EAC_VMTAIL_SITES="$SPEC" \
  EAC_DUMP_DIR=dumps/vmtail-scratch-wide-w16-fs337all-fs128 \
  EAC_LAUNCHERDIR=/tmp/fake_launcher \
  LD_PRELOAD=./trace_preload.so \
  ./driver ./eac.elf 1 x 0x800 0 \
  >dumps/vmtail-scratch-wide-w16-fs337all-fs128/run.stdout \
  2>dumps/vmtail-scratch-wide-w16-fs337all-fs128/run.stderr
python3 vm_tail_registers.py dumps/vmtail-regs-wide-w16 --eac eac.elf \
  >dumps/vmtail-regs-wide-w16/vm_tail_registers.tsv
python3 vm_tail_registers.py dumps/vmtail-regs-wide-w16 --eac eac.elf --site-summary \
  >dumps/vmtail-regs-wide-w16/vm_tail_register_summary.tsv
python3 vm_tail_registers.py dumps/vmtail-regs-wide-w16 --eac eac.elf \
  --instruction-trace dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv \
  >dumps/vmtail-wide-1m-w16/vm_handler_tail_roles_wide_regs.tsv
python3 vm_tail_static_slots.py dumps/vmtail-wide-1m-w16/vm_handler_tail_roles_wide_regs.tsv \
  --eac eac.elf \
  >dumps/vmtail-wide-1m-w16/vm_tail_static_slots.tsv
make fast-gpr-paths
make fast-gpr-transfer
make fast-gpr-predicates
python3 vm_instruction_lift.py \
  >dumps/vmtail-wide-1m-w16/vm_instruction_lift.tsv
python3 vm_transition_model.py \
  >dumps/vmtail-wide-1m-w16/vm_transition_model.tsv
python3 vm_microcode_catalog.py \
  >dumps/vmtail-wide-1m-w16/vm_microcode_catalog.tsv
python3 vm_microcode_catalog.py --markdown --limit 30 \
  >dumps/vmtail-wide-1m-w16/vm_microcode_top.md
python3 vm_path_microcode_catalog.py \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog.tsv
python3 vm_path_microcode_catalog.py --markdown --limit 30 \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_top.md
python3 vm_path_microcode_catalog.py \
  --path-variants dumps/vmtail-state-wide-w16/vm_static_path_variants_fast.tsv \
  --path-transfer-expr dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr.tsv \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog_fast.tsv
python3 vm_path_microcode_catalog.py \
  --path-variants dumps/vmtail-state-wide-w16/vm_static_path_variants_fast.tsv \
  --path-transfer-expr dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr.tsv \
  --markdown --limit 30 \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_fast_top.md
python3 vm_path_microcode_catalog.py \
  --path-variants dumps/vmtail-state-wide-w16/vm_static_path_variants_gpr_seeded.tsv \
  --path-transfer-expr dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr_gpr_seeded.tsv \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog_gpr_seeded.tsv
python3 vm_path_microcode_catalog.py \
  --path-variants dumps/vmtail-state-wide-w16/vm_static_path_variants_gpr_seeded.tsv \
  --path-transfer-expr dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr_gpr_seeded.tsv \
  --markdown --limit 30 \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_gpr_seeded_top.md
python3 vm_path_microcode_catalog.py \
  --path-variants dumps/vmtail-state-wide-w16/vm_static_path_variants_gpr_seeded_fast.tsv \
  --path-transfer-expr dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr_gpr_seeded.tsv \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_catalog_gpr_seeded_fast.tsv
python3 vm_path_microcode_catalog.py \
  --path-variants dumps/vmtail-state-wide-w16/vm_static_path_variants_gpr_seeded_fast.tsv \
  --path-transfer-expr dumps/vmtail-state-wide-w16/vm_static_path_transfer_expr_gpr_seeded.tsv \
  --markdown --limit 30 \
  >dumps/vmtail-wide-1m-w16/vm_path_microcode_gpr_seeded_fast_top.md
make path-pseudocode
python3 vm_dispatch_formula_validate.py \
  >dumps/vmtail-wide-1m-w16/vm_dispatch_formula_validate.tsv
python3 vm_bytecode_file_atlas.py --max-gap 0x20 \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_file_atlas.tsv
python3 vm_trace_file_fill.py dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv \
  --eac eac.elf \
  --max-delta 0x400 \
  >dumps/vmtail-wide-1m-w16/vm_instruction_trace_filefill.tsv
python3 vm_state_static_slice.py \
  >dumps/vmtail-wide-1m-w16/vm_state_static_slice.tsv
python3 vm_state_static_slice.py --entries 258 \
  >dumps/vmtail-wide-1m-w16/vm_state_static_slice_entry258.tsv
./vm_bytecode_segments_fast dumps/vmtail-wide-1m-w16/vm_instruction_trace_filefill.tsv \
  --include-sampled \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_segments_filefill_sampled.tsv
./vm_bytecode_blocks_fast dumps/vmtail-wide-1m-w16/vm_instruction_trace_filefill.tsv \
  --include-sampled \
  >dumps/vmtail-wide-1m-w16/vm_bytecode_blocks_filefill_sampled.tsv
make footprint-fill
make control-edges
make bytecode-ir
make bytecode-basic-blocks
make synthetic-tail-lift
mkdir -p dumps/vmtail-wide-1m-w16-filefill
ln -sf ../vmtail-wide-1m-w16/vm_instruction_trace_filefill.tsv \
  dumps/vmtail-wide-1m-w16-filefill/vm_instruction_trace.tsv
ln -sf ../vmtail-wide-1m-w16/vm_bytecode_segments_filefill_sampled.tsv \
  dumps/vmtail-wide-1m-w16-filefill/vm_bytecode_segments.tsv
ln -sf ../vmtail-wide-1m-w16/vm_isa_missing_exact.tsv \
  dumps/vmtail-wide-1m-w16-filefill/vm_isa_missing_exact.tsv
ln -sf ../vmtail-wide-1m-w16/vm_handler_semantics.tsv \
  dumps/vmtail-wide-1m-w16-filefill/vm_handler_semantics.tsv
python3 vm_gap_report.py dumps/vmtail-wide-1m-w16-filefill \
  >dumps/vmtail-wide-1m-w16/vm_gap_report_filefill.tsv

Mode-variation checks:

make
SPEC=$(python3 vm_tail_scan.py --all-table --eac eac.elf --window 0x1200 --limit 0 \
  | sed -n 's/^EAC_VMTAIL_SITES=//p')
for MODE in 0 2; do
  DIR=dumps/vmtail-mode${MODE}-w16
  mkdir -p "$DIR"
  timeout 45s env EAC_FAST_EXIT=1 \
    EAC_DISPATCH_TRACE=1 \
    EAC_DISPATCH_DETAIL=1 \
    EAC_VMTAIL_TRACE=1 \
    EAC_DISPATCH_LIMIT=4096 \
    EAC_VMTAIL_LIMIT=250000 \
    EAC_VMTAIL_SITES="$SPEC" \
    EAC_DUMP_DIR="$DIR" \
    EAC_LAUNCHERDIR=/tmp/fake_launcher \
    LD_PRELOAD=./trace_preload.so \
    ./driver ./eac.elf "$MODE" x 0x800 0 \
    >"$DIR/run.stdout" \
    2>"$DIR/run.stderr"
  python3 vm_trace_graph.py "$DIR" --eac eac.elf --window 0x1200 --instruction-trace \
    >"$DIR/vm_instruction_trace.tsv"
  ./vm_bytecode_segments_fast "$DIR/vm_instruction_trace.tsv" \
    >"$DIR/vm_bytecode_segments.tsv"
  ./vm_instruction_unique_fast "$DIR/vm_instruction_trace.tsv" \
    >"$DIR/vm_instruction_unique.tsv"
  ./vm_bytecode_segments_fast "$DIR/vm_instruction_trace.tsv" --include-sampled \
    >"$DIR/vm_bytecode_segments_sampled.tsv"
done
python3 vm_instruction_compare.py \
  dumps/vmtail-wide-1m-w16/vm_instruction_unique.tsv \
  dumps/vmtail-wide-w16/vm_instruction_unique.tsv \
  dumps/vmtail-mode0-w16/vm_instruction_unique.tsv \
  dumps/vmtail-mode2-w16/vm_instruction_unique.tsv \
  >dumps/vmtail-mode-compare.tsv

ELF Overview

• ELF64 x86-64 shared object, stripped, PIE, NX stack, partial RELRO.
• Entry point: 0x20c00.
• Only meaningful product export: x at 0x380dc, size 234.
• Embedded libraries/symbol surfaces include Zydis, BLAKE3, mbedTLS/PolarSSL strings, and libstdc++ support code.
• .text is large (0x562a50) and the first load segment is mapped RWE by the ELF headers. At runtime the loader maps the main code page range as rwxp.
• .init_array has 22 constructors from 0x21700, 0x20dca, ... 0x215b0.

Exported Entry x

x(void *buf, uint32_t len) is a small ABI gate and bootstrap:

• rejects len <= 0x13;
• requires *(u32 *)(buf+0) <= 2;
• requires *(u32 *)(buf+4) == len;
• requires *(u32 *)(buf+8) == 1;
• one-shot guards on global byte base+0x84cdd0;
• rejects *(u32 *)(buf+0x14) > 2;
• allocates 0x23f0;
• calls constructor 0x2cafa;
• stores the allocated context at global base+0x84cdd8 and base+0x84cd20;
• chooses output pointer from *(u64 *)(buf+0x0c), else fallback base+0x84cde0;
• calls main setup 0x2ceb0(ctx, mode2, game, product, sandbox, launcher, extra, out).

Synthetic input fields used by the harness:

• buf+0x1c: game name
• buf+0x5c: product name
• buf+0x9c: sandbox name
• buf+0xdc: launcher path/name
• buf+0x2dc: extra string

Observed return: 0; out[0] = 1.

Context Object

The primary sidecar object is 0x23f0 bytes.

Important offsets from postcall_ctx:

• ctx+0x0000 = eac+0x842bb0: primary vtable
• ctx+0x0008 = eac+0x83c430
• ctx+0x0020 = eac+0x83c918
• ctx+0x09e0 = eac+0x842d48
• ctx+0x1648 = eac+0x842f60
• ctx+0x1a78 = eac+0x842f60
• ctx+0x1c30 = eac+0x842f60
• ctx+0x1dd0 = eac+0x842f60
• ctx+0x2080 = eac+0x83c4c0
• ctx+0x2090 = eac+0x842f60
• ctx+0x2238 points to an inline/small heap vector area near ctx+0x2268
• ctx+0x2388 and ctx+0x2390 point near ctx+0x2378

Vtable eac+0x842bb0 relocates to:

• 0x2ccd6: destructor body
• 0x2ce82: destructor plus free
• 0x2d520
• 0x3331c

Constructor 0x2cafa initializes subobjects at:

• ctx+0x1a50
• ctx+0x1a78
• ctx+0x1c30
• ctx+0x1dd0
• ctx+0x1f78
• ctx+0x2080
• ctx+0x22a8
• ctx+0x2330

Runtime Behavior From Blocked Trace

Call-site catalog from dumps/local-blocked-log/run.stderr:

• 0x72b70: creates three worker threads.
• Thread start is 0x729fe, a thunk that invokes arg->vtable[4](arg).
• 0x6b74f: DNS via getaddrinfo.
• 0x6b7f7: fallback host -4 ... via popen.
• 0x1a689b and 0x1a6a09: mprotect page 0 RW then R.
• 0x4c000b: reads /dev/urandom.
• 0x3376ac, 0x334271, 0x33ae27, 0x33d5f1: self process comm/cmdline/status/maps.
• 0x58b24: /proc/mounts, /proc/modules, and later /proc/self/maps.
• 0x36a519, 0x36e0cf: DMI board/product.
• 0x3722d8: /proc/bus/pci/devices.
• 0x30d25c: hardware and OS identity files under /sys/class/dmi, /sys/class/block, /proc/cpuinfo, /etc/machine-id, /etc/hostname.
• 0x2ef009, 0x2efed1, 0x2f0707: enumerate /dev/disk/by-id, readlink, realpath.
• 0x2cb09b: lshw -C display.
• 0x2f9551: /proc/net/route.
• 0x305069, 0x305d88, 0x306735: enumerate /sys/class/net.
• 0x350c8d, 0x161ea8: checks LD_PRELOAD.
• 0x35284b, 0x161468: checks LD_AUDIT.
• 0x162bce: checks _EAC_DEV.
• 0x3909b, 0x2042b6: locates and hashes/reads /proc/self/exe (driver in this harness).
• 0x208abf, 0x220c4d, 0x221670, 0x22d2ca: process enumeration over /proc/<pid>/{exe,comm,cmdline}.

Network endpoints attempted with network denied:

• api.epicgames.dev:443
• datarouter.ol.epicgames.com:443

Runtime Mutation / Anti-Dump

postcall memory differs from the file in ways that are not only dynamic relocations:

• page 0 (off 0x0) differs at bytes 0x1-0x4 and 0x19-0x1e;
• after mprotect(base, 0x1000, RW) and mprotect(base, 0x1000, R), the ELF magic is corrupted from 7f 45 4c 46 to 7f c5 ac e6;
• ELF header entry bytes at 0x19-0x1e are rewritten to a loaded pointer-like value;
• executable map off 0x1000 has 1573 byte differences postcall;
• an executable-section zero slab starting around file offset 0x7836c is filled with live pointers/state. Dispatch tracing shows the active obfuscation/VM frame is base+0x7836d, exactly inside this slab. There are no matching ELF relocation entries for those offsets;
• executable file range 0xc3718-0xc4258 is a 360-entry pointer table. The file stores raw offsets, while runtime memory stores base + offset. No ELF relocation entries exist for the sampled slots, so this is a custom/runtime fixup region inside .text;
• postcall to postsleep changes continue in the same slab and in writable data, indicating worker-thread state updates.

This is a practical anti-dump indicator: dumpers relying on loaded ELF headers will see a deliberately damaged header, while static .text also contains runtime-filled data islands.

Obfuscation Shape

Many call sites are not normal compiler output. They use:

• pushf prologues;
• redundant pushes/pops and xchg [rsp], reg;
• stack-pointer arithmetic through memory;
• immediate arithmetic to synthesize small constants or target offsets;
• jumps into shared dispatcher-like blocks, especially 0xc823b, 0xcdc60, and related ranges;
• inline high-entropy byte spans that break linear disassembly between real basic blocks.

Dynamic dispatcher recovery from EAC_DISPATCH_TRACE=1:

• both dispatcher sites currently sampled, 0xc80b9 and 0xcdac7, use the same fixed-up table base 0xc3718;
• table byte index is held in rbx after the dispatcher's shl rbx, 3, so entry index is idx / 8;
• detailed tracing confirms *(u64 *)(frame+0x10f) == base+0xc3718 on every sampled central dispatch and VM tail;
• all 3385 sampled dispatches used frame base+0x7836d;
• the frame field at +0x0a behaves like an encoded instruction pointer. It points into jump-over bytecode/data islands inside .text; top observed offsets include 0x310ca5, 0x310ef0, 0x311163, 0x3113a5, 0x3115e7, and 0x311829;
• observed edges in the synthetic blocked-network path:

Count	Site	Table Entry	Slot	Target
1747	0xcdac7	169	0xc3c60	0x9af18
1562	0xcdac7	310	0xc40c8	0xb8556
36	0xc80b9	310	0xc40c8	0xb8556
31	0xc80b9	169	0xc3c60	0x9af18
5	0xc80b9	86	0xc39c8	0x8a37f
2	0xc80b9	42	0xc3868	0x815ea
1	0xcdac7	323	0xc4130	0xbb6e6
1	0xcdac7	42	0xc3868	0x815ea

The dispatch table at file offset 0xc3718 has 360 unique raw file-offset targets. The loader/custom runtime fixes all 360 qwords to base + target. Initial high-frequency entries from the central dispatcher and first tail layer:

Entry	Slot	Target
42	0xc3868	0x815ea
86	0xc39c8	0x8a37f
165	0xc3c40	0x9a24c
169	0xc3c60	0x9af18
171	0xc3c70	0x9b4b3
310	0xc40c8	0xb8556
323	0xc4130	0xbb6e6
354	0xc4228	0xc2241

EAC_VMTAIL_TRACE=1 additionally patches selected register tail jumps in the observed handler blocks:

• 0x8173b: jmp rax
• 0x8a49b: jmp r8
• 0x9a46b: jmp r9
• 0x9b0c5: jmp r10
• 0x9b687: jmp r14
• 0xb86f5: jmp r13
• 0xbb8a8: jmp rax
• 0xbba0c: jmp r12
• 0xc240d: jmp rdx

Additional sites can be injected with EAC_VMTAIL_SITES=0xsite:reg,...; the driver patches those sites and emulates the original register jump from the signal context. vm_tail_scan.py generates these strings from prior traces.

Static table scanning found 348 of the 360 dispatch-table entries have an apparent jmp reg tail within 0x800 bytes of the table target. These collapse to 300 unique candidate tail sites. The 12 table entries without a candidate under that window are:

32, 69, 75, 85, 101, 102, 210, 241, 246, 284, 316, 334.

The first tail pass showed entries 165, 171, and 354 as hot second-layer handlers. Adding their tail sites expanded the current synthetic run to 10834 direct VM tail jumps, all using frame base+0x7836d and table base+0xc3718. Tail targets were concentrated on:

Count	Tail Target Entry	Target
1689	171	0x9b4b3
1345	354	0xc2241
1309	165	0x9a24c
528	268	0xb0007
469	337	0xbec0e
449	340	0xbf435
415	114	0x90319
413	157	0x98a9a
412	333	0xbd8af

The auto-expanded pass in dumps/vmtail-auto3 used three waves of scanner-suggested sites. It hit the configured EAC_VMTAIL_LIMIT=160000, observed 172 of the 360 dispatch-table entries, and expanded VM instruction-pointer coverage to 31149 unique offsets. Current bands include 0xd0ac0-0xdaf35, 0x11ac5e-0x11db08, 0x18b66f-0x18c463, 0x22fe2d-0x231210, 0x249468-0x24bd26, 0x26cd75-0x26f073, 0x30e876-0x31f2ad, and 0x33170b-0x34355b.

The all-static pass in dumps/vmtail-allstatic hit EAC_VMTAIL_LIMIT=250000, observed 192 table entries through tail targets and 195 table entries including central dispatch, and expanded VM instruction-pointer coverage to 39738 unique offsets. All 250000 tail targets resolved to known dispatch-table entries, so the static candidate tail hooks are coherent for this path.

The recovered static-site VM graph from that run has 4263 distinct edge rows in vm_edges.tsv over the synthetic blocked-network path.

The sequential VM graph in vm_seq_edges.tsv is built from consecutive trace events per VM frame and stops at the tail logging cap by default. A tail event is treated as a direct edge only when its tail site statically belongs to the previous target handler; central-dispatch events are kept as central-dispatch edges. This avoids falsely treating helper returns or uninstrumented intermediate paths as direct VM branches.

The older dumps/vmtail-allstatic graph skipped 842 unhooked-source candidates and 588 indirect-site candidates. It kept 4274 direct transition rows over 249120 observed branch events: 4241 tail rows, 33 central-dispatch rows, 181 source entries, 195 target entries, and 4262 distinct source-target entry pairs.

The wider dumps/vmtail-wide rerun used an all-table 0x1200 tail scan. It removed the unhooked-source gap and skipped only 782 indirect-site candidates. Its direct graph has 4296 transition rows over 249764 observed branch events: 4263 tail rows, 33 central-dispatch rows, 191 source entries, 195 target entries, and 4284 distinct source-target entry pairs.

The current dumps/vmtail-wide-w16 comparison run repeats that 250k trace with sixteen ip_w* lookahead words. The direct graph stayed the same size, but instruction recovery improved from 248299 to 248906 exact rows, prefix-only rows dropped from 697 to 90, and exact byte recovery grew from 0x24948 to 0x24c51 bytes with no conflicts.

The current long dumps/vmtail-wide-1m-w16 run used the same 0x1200 all-table scan with EAC_VMTAIL_LIMIT=1000000. The trace parser now accepts [VMTAIL]/[DISPATCH] records embedded after driver output bytes, recovering 9 additional exact tail rows that the older anchored parser skipped. The regenerated instruction trace has 769225 data rows (769226 with header), still reports skipped_indirect_sites=1605, and covers 202 source entries / 205 target entries. The recovered embedded island starts at 0x2c0468 and is now represented as prog_bb_0214 in the C-like program sketch.

Top sequential VM transitions in the long run:

Count	Source Entry	Site	Target Entry	Target	VM IP Delta
2147	28	0x7e7ca	347	0xc088d	+0x3
2091	64	0x8536e	18	0x7be9b	+0x4
2041	114	0x90893	66	0x855ff	+0x4
1928	347	0xc0d7b	18	0x7be9b	+0x4
1894	189	0x9eac9	18	0x7be9b	+0x4
1787	337	0xbf126	297	0xb64d7	+0x4
1754	307	0xb837a	114	0x90319	+0x3
1748	340	0xbf886	307	0xb8064	+0x4
1729	18	0x7c308	114	0x90319	+0x3
1702	340	0xbf886	28	0x7e390	+0x4

The source profile in vm_source_profile.tsv covers 191 source handlers in the 250k wide run. The current long W16 profile covers 202 source handlers. The hottest long-run sources are strongly site-stable:

Events	Source Entry	Source Target	Outgoing Site	VM IP Delta
28058	258	0xadf2c	0xae32f	+0x4
26610	28	0x7e390	0x7e7ca	+0x3
26534	337	0xbec0e	0xbf126	+0x4
26112	340	0xbf435	0xbf886	+0x4
25448	18	0x7be9b	0x7c308	+0x3
25300	114	0x90319	0x90893	+0x4
25112	189	0x9e7af	0x9eac9	+0x4
24299	347	0xc088d	0xc0d7b	+0x4
24095	307	0xb8064	0xb837a	+0x3
23678	64	0x85059	0x8536e	+0x4

The combined handler table in vm_handler_table.tsv now provides one row for every dispatch-table entry. It includes static span length, conditional-branch/jump/call/return counts, frame-relative reads/writes, inferred bytecode-pointer reads, inferred dispatch-table reads, and the dynamic source profile where available. The static dataflow is intentionally lightweight: it tracks registers derived from rbp, the VM bytecode pointer loaded from frame+0x0a, and the dispatch table loaded from frame+0x10f.

Current handler-table facts:

• 360 dispatch entries are present.
• The 0x800/0x900 scan missed 12 long-tail entries; the 0x1200 wide scan finds a candidate for every dispatch entry.
• 11 of those previously missed entries were observed as targets in the wide runs; entry 32 (0x7efa8) remains unobserved even in vmtail-wide-1m-w16.
• Entry 69 (0x85f24) is still special. The wide linear scan associates it with entry 70's tail site after a ret, so its dynamic edges should be treated as helper-return/continuation behavior rather than a normal direct tail. In vmtail-wide-1m-w16 it was reached 23 times as a target but only contributes 2 direct source events after filtering; it reads richer bytecode operands through frame+0x0a and writes frame+0x1dc.
• All 360 wide handler-table rows now have an inferred dispatch-table read, but entry 69's read belongs to the post-ret linear span and should not be interpreted as its own direct tail path.
• Only entries 264 (0xaf4cf) and 265 (0xaf57f) contain direct call instructions in the scanned span. Entry 264 was observed and fans into central-dispatch targets 169, 171, 310, 354, and 165.

Weighted by source events in the long run, dominant VM IP deltas are:

Events	VM IP Delta
463848	+0x4
182878	+0x3
51707	+0x5
45212	+0x2
20476	+0x6
3275	+0xa
255	-0x6d
255	-0x3c4
230	-0x40
182	+0x2d

The executed-instruction listing in vm_instruction_trace.tsv has 769225 direct rows from the current long W16 trace. Each row attributes a branch to the previous direct source handler and records the bytecode pointer before and after that handler. The bytes column is exact when the positive delta fits in the logged ip_w* window, otherwise it is marked as a prefix or backedge sample. The current driver logs 32 bytes of VM bytecode lookahead, so prefix statuses are now prefix_32_of_N.

Instruction-trace coverage:

• 202 source handlers.
• 71522 unique start VM IP offsets.
• 64477 distinct (source_entry, delta, bytes) signatures.
• 767575 rows have exact consumed bytes.
• 1157 rows are backedge samples.
• 493 rows are positive jumps longer than the logged byte window and keep only a 32-byte prefix sample.

The exact bytecode block reducer in vm_bytecode_blocks.tsv merges exact positive instruction intervals. It produced 445 contiguous blocks covering 0x421f3 bytes of VM bytecode and 767575 exact instruction events. The largest event bands are:

Events	Band	Blocks	Exact Bytes
488367	0x310000	41	0x9a78
87614	0x230000	7	0x1300
47699	0x370000	21	0x1bdb
27989	0x220000	2	0x2d3
27184	0x360000	75	0xb52e
24595	0x330000	64	0xa9df
19619	0x300000	6	0x2500
10358	0x340000	26	0x527a
6192	0x260000	2	0x171a
5859	0x170000	39	0x561e

The bytecode recovery pass in vm_bytecode_segments.tsv inserts every exact byte slice into a sparse VM byte map and checks that repeated observations agree byte-for-byte. Current result:

• 767575 exact rows inserted.
• 445 recovered byte segments.
• 0x421f3 total exact bytes.
• 0 conflicting byte offsets.
• 0 conflicting byte observations.

The sampled recovery pass in vm_bytecode_segments_sampled.tsv additionally inserts the logged byte windows from prefix-only long jumps and backedge samples. These bytes are valid observed lookahead bytes, but the full VM instruction length remains unknown for sampled rows. Current sampled result:

• 769225 trace rows inserted as exact or sampled byte windows.
• 337 recovered byte segments after sampled windows merge nearby exact segments.
• 0x42ddd total observed bytes, adding 0xbea bytes over exact-only recovery.
• 0 conflicting byte offsets.
• 0 conflicting byte observations.

vm_instruction_unique.tsv collapses the exact trace to 71364 unique executed instruction signatures. The current make instruction-unique path uses vm_instruction_unique_fast, whose instruction-unique-fast-check gate byte-compares against vm_bytecode_recover.py --instructions; the latest local timing was about 0.30s for the native reducer versus 4.04s for Python on the same 110 MiB trace. The most repeated signatures are still the loop body beginning at 0x22ff44, where many adjacent rows execute exactly 256 times. Example rows:

Count	Start VM IP	Source Entry	Delta	Bytes	Target Entry
256	0x22ff44	171	+0x2	4201	322
256	0x22ff46	322	+0x4	13005796	157
256	0x22ff4a	157	+0x4	7b8b6800	258
256	0x22ff4e	258	+0x4	f3d5ce87	215
256	0x22ff52	215	+0x3	6809c8	301

vm_isa_summary.py clusters those exact signatures into handler-level schemas. Because it only accepts exact positive byte slices, it deliberately excludes backedges and prefix-only long jumps. Current exact-covered result:

• 190 source handlers have exact positive byte schemas.
• 190 (source handler, byte length) patterns are present, so every exact-covered source handler is fixed-width in this run.
• 12 dynamic source handlers, accounting for 1398 direct events, remain outside the exact schema set because they only appeared through backedges, long positive jumps with prefix samples, or other non-exact rows.

Exact fixed-width distribution:

Events	Source Handlers	VM IP Delta
463848	56	+0x4
182878	13	+0x3
51707	79	+0x5
45212	11	+0x2
20476	12	+0x6
3275	10	+0xa
169	8	+0xd
1	1	+0x20

The family view groups those 190 exact handler schemas into 75 operand-layout families covering all 767575 exact events. The shape alphabet is event-weighted per byte position: C = constant, E = small enum, V = high-cardinality variable.

Top exact ISA families:

Events	Entries	Delta	Shape	Constant Bytes
259824	30	+0x4	VVVV	none
160347	7	+0x3	VVV	none
97037	11	+0x4	VVCC	b2=0xe8,b3=0x01
52999	3	+0x4	VVVE	none
50549	6	+0x4	CCVV	b0=0xe8,b1=0x01
38982	8	+0x2	VV	none
21759	2	+0x3	VVE	none
11883	6	+0x6	VVVVVV	none
10568	3	+0x5	CCCVV	b0=0x00,b1=0x3d,b2=0x01
6648	7	+0x5	VVVCC	b3=0x3d,b4=0x01

High-weight operand-layout patterns show repeated constants inside otherwise encoded operands:

Events	Entry	Target	Delta	Shape	Stable Bytes
12094	184	0x9d694	+0x4	VVCC	b2=0xe8,b3=0x01
11742	174	0x9bd8f	+0x4	VVCC	b2=0xe8,b3=0x01
10874	305	0xb78b0	+0x4	VVCC	b2=0xe8,b3=0x01
10598	123	0x91a59	+0x4	VVCC	b2=0xe8,b3=0x01
10138	176	0x9c10b	+0x4	CCVV	b0=0xe8,b1=0x01
9921	315	0xb9451	+0x4	CCVV	b0=0xe8,b1=0x01
4380	301	0xb708d	+0x5	CCCVV	b0=0x00,b1=0x3d,b2=0x01
3576	220	0xa522e	+0x5	CCCVV	b0=0x00,b1=0x3d,b2=0x01
2509	167	0x9a8d2	+0x6	CCCCVV	b0=0xe8,b1=0x01,b2=0x3d,b3=0x01

Two central-dispatch targets now have compact enum/constant schemas in exact coverage:

Events	Entry	Target	Delta	Shape	Operand Layout
1796	169	0x9af18	+0x4	EECC	b0={0xab,0x62,0xa5}; b1={0x00,0x01}; b2=0xe8; b3=0x01
1614	310	0xb8556	+0x4	CCEE	b0=0xe8; b1=0x01; b2={0xa5,0x62,0xab}; b3={0x00,0x01}

vm_semantic_templates.tsv adds static handler behavior to the ISA families. Its template key is:

observation class + VM IP delta + byte shape + constant byte positions + static IP reads + frame writes + dispatch-table reads + call/return counts.

Current semantic-template coverage:

• 360 per-handler semantic rows.
• 150 ranked semantic templates.
• 139 exact templates covering 190 source handlers and 767575 exact events.
• 1 central_or_long template covering 1 non-exact event.
• 6 sampled_backedge templates covering 1159 non-exact events.
• 4 sampled_long_or_sparse templates covering 238 non-exact events.
• 155 dispatch entries remain unobserved on this synthetic path.

Top exact semantic templates:

Events	Entries	Delta	Shape	Constants	IP Reads	Frame Writes
77036	3	+0x4	VVVV	none	+0x2/2,+0x0/2	0x23,0x170,0x0,0x16f,0xa
71699	3	+0x3	VVV	none	+0x2/1,+0x0/2	0x23,0x170,0x194,0xa
63478	8	+0x4	VVCC	b2=0xe8,b3=0x01	+0x2/2,+0x0/2	0x23,0x170,0xa
50833	2	+0x4	VVVV	none	+0x2/2,+0x0/2	0x170,0x23,0x0,0x16f,0xa
44735	2	+0x3	VVV	none	+0x0/1,+0x1/2	0x170,0x23,0x194,0xa
43913	2	+0x3	VVV	none	+0x2/1,+0x0/2	0x170,0x23,0x194,0xa
41302	5	+0x4	CCVV	b0=0xe8,b1=0x01	+0x0/2,+0x2/2	0x170,0x23,0xa
39922	5	+0x4	VVVV	none	+0x0/2,+0x2/2	0x170,0x23,0x81,0xa

vm_handler_skeleton.py keeps ordered access skeletons instead of just sets. The full skeleton is still intentionally noisy, so the most useful grouping is the canonical decode signature, which keeps only:

IPADV*, RIP*, RF/WF+0x170, TDYN, RTdyn, and the final WF+0xa VM-IP write.

Current decode-signature coverage:

• 360 per-handler skeleton rows.
• 186 observed decode groups covering 202 observed source handlers in the classified source profile.
• 175 exact decode groups covering 190 exact handlers and 767575 exact events.
• 1 central_or_long decode group covering 1 event.
• 6 sampled_backedge decode groups covering 1159 events.
• 4 sampled_long_or_sparse decode groups covering 238 events.

Top exact decode groups:

Events	Entries	Delta	Shape	Decode Signature
43048	4	+0x4	VVVV	IPADV+0x0;RIP+0x0/2;RF+0x170:xor;TDYN;RTdyn;WF+0xa
28649	2	+0x4	VVVV	IPADV+0x0;RIP+0x0/2;RF+0x170:add;WF+0x170:or;TDYN;RTdyn;WF+0xa
28058	1	+0x4	VVVV	IPADV+0x0;RIP+0x0/2;RF+0x170:sub;WF+0x170:and;TDYN;RTdyn;WF+0xa
26610	1	+0x3	VVV	IPADV+0x0;RIP+0x0/2;WF+0x170:or;TDYN;RTdyn;WF+0xa
26112	1	+0x4	VVVE	IPADV+0x0;RIP+0x0/2;RF+0x170:add;WF+0x170:sub;TDYN;RTdyn;WF+0xa
25448	1	+0x3	VVV	IPADV+0x0;RIP+0x0/2;RF+0x170:sub;WF+0x170:sub;TDYN;RTdyn;WF+0xa
25300	1	+0x4	VVVV	IPADV+0x0;RIP+0x0/2;RF+0x170:add;WF+0x170:sub;TDYN;RTdyn;WF+0xa
25112	1	+0x4	VVVV	IPADV+0x2;RIP+0x2/2;RF+0x170:add;WF+0x170:add;TDYN;RTdyn;WF+0xa

The bytecode block graph in vm_bytecode_block_edges.tsv aggregates instruction rows by recovered bytecode segment. It has 890 aggregate edges. By event weight:

Events	Edge Rows	Class
764312	445	intra_block
3254	445	out_of_recovered

The out_of_recovered edges are exact positive steps whose destination offset has not yet been recovered as an exact byte segment start; these are useful targets for varied-input traces.

Alternate accepted x modes do not currently expand the VM path. Mode 0 and mode 2 both returned success (out[0] = 1) and produced 250000 VMTAIL rows plus 3385 DISPATCH rows, but their exact unique instruction catalogs are identical to the existing 250k mode-1 trace:

Catalog	Rows	Events	New Rows vs Long Mode 1	New Events
dumps/vmtail-wide-w16/vm_instruction_unique.tsv	39636	248906	0	0
dumps/vmtail-mode0-w16/vm_instruction_unique.tsv	39636	248906	0	0
dumps/vmtail-mode2-w16/vm_instruction_unique.tsv	39636	248906	0	0

This means the next coverage gains are more likely to come from deeper state/path exploration or targeted VM IP gaps than from the public mode field alone.

Every exact recovered VM instruction byte sequence in vm_instruction_unique.tsv matches eac.elf at the same VM IP file offset: 71364 exact instruction byte checks, 0 mismatches. This proves the observed VM bytecode is file-backed on this path rather than dynamically decrypted into unrelated memory.

vm_bytecode_file_atlas.tsv uses that fact conservatively. With sampled segments and --max-gap 0x20, it builds 66 file-backed VM bytecode atlas regions:

Metric	Value
atlas regions	66
file-backed atlas size	0x43d62
observed sampled bytes	0x42ddd
inferred small-gap bytes	0xf85
observed events represented by atlas segments	769225
summed unique start IPs	71522

The inferred gap bytes are not claimed as executed instructions. They are byte-accurate ELF contents between nearby observed VM bytecode spans and are useful for static decode experiments, especially around exact-destination gaps such as 0x230111, 0x230b1b, 0x230e07, and 0x3703d8.

vm_trace_file_fill.py applies the same file-backed fact to bounded positive prefix rows. It promotes only positive prefix_32_of_N rows with N <= 0x400 to file_span_of_N, preserving the distinction from exact consumed instructions. On the long trace:

• 767575 exact trace rows verified against eac.elf.
• 0 exact byte mismatches.
• 466 prefix rows promoted to bounded file-backed spans.

The resulting sampled/file-backed recovery has 300 segments and 0x44769 bytes, up from 0x42ddd in sampled-only recovery. Gap deltas after bounded file-fill:

Gap Class	Rows	Events
decoded_long_branch_sample	58	1171
decoded_long_branch_source	9	1392
hidden_transition_destination	217	874
sampled_operand_known	12	13
sampled_operand_source	3	6
uncovered_exact_destination	67	68
target_only_entry	3	0
unobserved_entry	155	0

vm_hidden_transition_catalog.py attacks the remaining exact-destination holes from the dynamic sequence itself. When row N targets handler X but row N+1 is the next hooked source Y in the same frame, the bytes from row N's end VM IP to row N+1's start VM IP are a file-backed adjacent hidden span. The catalog has 121 grouped rows, 1529 hidden-span events, and 272 unique hidden starts. The top row is target-only entry 50 to next hooked entry 171, +0x11, 320 events over starts 0x230111 and 0x230b1b.

vm_trace_hidden_fill.py inserts those spans as synthetic hidden_span_of_N rows. On the raw trace it adds 1529 rows / 0x6577 event-bytes and raises sampled recovery to 117 segments / 0x43a91 bytes with 0 conflicts. Composed after bounded prefix file-fill, it gives 83 segments / 0x453ee bytes with 0 conflicts. In vm_gap_report_filefill_hiddenfill.tsv, the hidden_transition_destination class disappears because those spans are now covered; remaining uncovered exact destinations are only 67 rows / 68 events.

vm_sampled_operand_catalog.py covers the final non-long sampled rows. It matches 13 events across 12 source/target/delta variants with 0 operand byte mismatches. Entries 175, 195, and 299 use 6-byte static operand footprints, while entries 95, 278, and 311 use 10-byte footprints. With that sidecar loaded, the best gap report has no generic backedge_sample, prefix_long_jump, or missing_exact_source buckets; those rows become sampled_operand_known and the remaining source-level sparse rows become sampled_operand_source.

vm_trace_frontier_fill.py then handles the exact-destination boundary frontiers conservatively. It only inserts a file-backed span when an exact positive instruction lands at the end of a recovered segment and the next recovered segment starts within 0x20 bytes. On the combined file-fill/hidden-fill trace this inserts 45 rows / 0x269 event-bytes (frontier_span_of_10: 4, frontier_span_of_14: 40, frontier_span_of_17: 1), raises sampled/file-backed byte recovery to 38 segments / 0x45657 bytes, and still has 0 byte conflicts. The remaining uncovered exact destinations drop to 22 rows / 23 events.

vm_trace_target_footprint_fill.py covers those remaining exact-destination starts as target-handler read footprints instead of full instructions. Every remaining exact frontier lands on a handler with a known footprint: sampled operands for entries 175, 195, and 299; exact 10-byte shapes for entries 278 and 356; and a decoded long-branch operand footprint for entry 246. This inserts 23 rows / 0x97 event-bytes (sampled_operand: 20 rows, exact_shape: 2 rows, long_branch_operand: 1 row), raises sampled/file-backed recovery to 38 segments / 0x456e8 bytes, keeps 0 conflicts, and removes the uncovered_exact_destination class from the best gap report.

vm_gap_report.py prioritizes the remaining coverage holes. Against exact-only segments it reports:

Gap Class	Rows	Events
decoded_long_branch_sample	127	1637
decoded_long_branch_source	9	1392
hidden_transition_destination	272	2117
sampled_operand_known	12	13
sampled_operand_source	3	6
target_only_entry	3	0
uncovered_exact_destination	173	1137
uncovered_source_start	158	1650
unobserved_entry	155	0

Against the combined file-fill/hidden-fill/frontier-fill/footprint-fill segments, uncovered_source_start, hidden_transition_destination, generic backedge/prefix samples, generic missing exact sources, and uncovered exact destinations disappear. The current best gap classes are:

Gap Class	Rows	Events
decoded_long_branch_sample	58	1171
decoded_long_branch_source	9	1392
sampled_operand_known	12	13
sampled_operand_source	3	6
target_only_entry	3	0
unobserved_entry	155	0

The highest-priority remaining dynamic gaps are:

Events	Gap	Detail
447	decoded long-branch source entry 316 (0xb987b)	aggregate of 13 decoded target/delta variants; top variants go to entries 165, 171, and 354
276	decoded long-branch source entry 75 (0x873fc)	aggregate of 12 decoded target/delta variants; top variant goes to entry 171
200	decoded long-branch source entry 266 (0xaf8af)	aggregate of 13 decoded target/delta variants; top variants go to entries 354 and 171
142	decoded long-branch source entry 145 (0x95b5c)	aggregate of 11 decoded target/delta variants; top variant goes to entry 354
122	decoded long-branch source entry 117 (0x90acd)	aggregate of 14 decoded target/delta variants; top variants go to entries 354 and 165
109	decoded long-branch source entry 302 (0xb7586)	aggregate of 9 decoded target/delta variants; top variant goes to entry 171
255	decoded long-branch sample entry 316 -> 165	next = table[165], ip -= 0x3c4; exact consumed bytes still unavailable
255	decoded long-branch sample entry 75 -> 171	next = table[171], ip -= 0x6d; exact consumed bytes still unavailable

vm_long_branch_catalog.py now decodes the repeated sampled/backedge long-control format behind most of those source gaps. The format is file-backed and byte-verified: u32 target dispatch entry followed by a u32 signed VM-IP delta, where the high bit marks a negative/backedge delta. The catalog has 128 variants, 1638 events, 10 source handlers, 1151 backedge events, 487 forward events, 0 file-byte mismatches, and 0 operand-byte mismatches; vm_gap_report.py uses it to recategorize 9 missing-exact source rows / 1392 events as decoded long-branch sources.

That directly lifts the top missing-source rows into pseudo-IR instead of opaque sampled-only control flow: entry 75 has 255=next = table[171], ip -= 0x6d; entry 316 has 255=next = table[165], ip -= 0x3c4 plus 91=next = table[171], ip += 0x2d and 91=next = table[354], ip += 0x2d; entry 145 has 125=next = table[354], ip += 0x139; entry 266 has 125=next = table[354], ip -= 0x2e8. These rows still need exact consumed-byte boundaries, but their dispatch target and VM-IP update are no longer unknown.

vm_bytecode_control_edges.py maps those decoded non-exact control variants onto the best recovered bytecode segments. It emits 140 decoded control-edge rows covering 1651 events with 0 missing source IPs and 0 missing target IPs. The split is 43 long-branch backedge rows / 1151 events, 85 long-branch forward rows / 487 events, 6 sampled-operand backedge rows / 6 events, and 6 sampled-operand forward rows / 7 events. Operand footprint coverage is 677 events at 8 bytes and 961 at 11 bytes for long branches, plus 6 events at 6 bytes and 7 events at 10 bytes for sampled operands. This makes the remaining non-exact control flow visible as segment-to-segment VM CFG edges rather than only per-handler gap rows.

vm_bytecode_ir.py merges the exact instruction lifts and decoded sidecars into one VM-IP sorted behavior table. It emits 71522 rows: 71364 exact instruction rows / 767575 events, 53 non-exact long-branch backedge rows / 1151 events, 93 non-exact long-branch forward rows / 486 events, 6 sampled-operand backedge rows / 6 events, and 6 sampled-operand forward rows / 7 events. The remaining long-branch forward event is already exact at VM IP 0x122aaa, so it stays in the exact row count but is annotated with vm_instruction_lift+long_branch, target_u32@+0,delta_u32@+4, and next = table[171], ip += 0x20. Exact rows also join the transition model into compact state_effect_ir, dispatch_expr_ir, and ip_advance_expr_ir columns, so the table carries handler behavior rather than only handler IDs and byte advances. Decoded sidecar rows now join the transition model as well: all 12 sampled-operand rows carry source-handler state_effect_ir plus file_backed_operand;source_state=transition_model validation while retaining their observed/file-backed target/delta sidecar. This gives a single per-VM-IP listing for the recovered bytecode behavior rather than separate exact-lift and decoded-gap views.

vm_bytecode_basic_blocks.py compresses that IR into 499 recovered VM basic blocks while preserving all 769225 IR events. Terminal split: 341 exact-instruction terminals, 53 long-branch backedge terminals, 93 long-branch forward terminals, 6 sampled-operand backedge terminals, and 6 sampled-operand forward terminals. Edge split: 158 decoded-control terminals, 54 known fallthrough terminals, and 287 covered synthetic fallthrough terminals where the exact instruction lands on a byte-covered but nonsemantic hidden_span, frontier_span, or target_footprint row from the final file-backed trace. The block builder now also promotes recovered synthetic-successor destinations that land inside an existing block into block leaders; this splits the source-246 hidden span at 0x370249 so its recovered +0xf successor can call the exact-row block at 0x370258 instead of falling back to an unresolved tail. The embedded 0x2c0468..0x2c0488 records also make 0x2c0468 a recovered block leader (prog_bb_0214) rather than an unavailable bridge destination. Those 287 terminals account for 996 terminal events and are mostly covered by hidden_span_of_17 (488 events), hidden_span_of_14 (349), hidden_span_of_16 (61), frontier_span_of_14 (40), and target_footprint_of_6 (20); no terminal target is now completely uncovered in the best trace. The loop catalog has 59 block-level backedges: 53 long-branch and 6 sampled-operand. The hottest latch-count loops are 0x22ffb1 -> 0x22ff44 / 255 events, 0x2303ae -> 0x22ffea / 255 events, 0x371714 -> 0x37142c / 125 events, and 0x315cc0 -> 0x310b1c / 91 events; by loop-body event count the largest recovered regions are the sampled-operand loop 0x34355f -> 0x30e872 with 541190 body events / 27744 IR rows and the long-branch loop 0x315cc0 -> 0x310b1c with 498494 body events / 5477 IR rows.

vm_synthetic_span_catalog.py turns those byte-covered synthetic rows into an explicit semantic-gap catalog. The final file-backed trace has 1597 synthetic rows grouped into 147 source/target/status classes, with 996 terminal events linked back to covered synthetic block terminals. All groups are now typed: 134 groups are known_prefix_plus_tail, 5 groups are operand_footprint_only, 5 groups are target_only_prefix_plus_tail, and 3 groups are single_known_footprint. By known-prefix source, most groups have decoded long-branch operands or exact handler-shape prefixes, with static target-only IP advances and sampled-operand prefixes covering the remaining small classes. The biggest former target-only island is entry 50: its hidden 0x11 spans now split at the native tail-site IP update tail_ip_add@0x833be, giving an 0xb handler prefix plus a 6-byte unresolved tail. The hot target-171 tails are 8000e801ab00 / 256 events and 8000ab00e801 / 64 events, with the observed target entry 171 appearing as a little-endian u16 at tail offset +0x4 or +0x2 respectively; the target-165 variant has 8000e801a500 / 4 events with entry 165 at tail offset +0x4. Entry 80 similarly splits 0x5 + 0xc, and entry 5 splits 0x9 + 0x3. The remaining high-volume synthetic spans are therefore not raw unknowns but known 5/9/10/11/13-byte prefixes plus compact unresolved tails.

vm_synthetic_tail_catalog.py aggregates those compact tails across all synthetic groups. There are 116 exact unresolved tail variants covering 1571 events. By tail length: 0x6 has 66 variants, 0x5 has 21 variants, 0xb has 14 variants, 0x4 has 7 variants, 0xc has 5 variants, 0x8 has 2 variants, and 0x3 has 1 variant. The hottest target-bearing forms are small endian target words plus the recurring e801 marker: a500e801 -> target 165 / 154 events, e801ab00 -> target 171 / 105 events, ab00e801 -> target 171 / 87 events, e801a500 -> target 165 / 64 events, e8016201 -> target 354 / 50 events, and 6201e801 -> target 354 / 40 events. The longer 11-byte tail family is dominated by sampled long-control leftovers with paired 3d01/9d01 motifs, while the target-only entry 50 tails remain the special 8000... forms above.

vm_synthetic_tail_lift.py maps those suffix variants back to individual synthetic VM IPs. The current lift covers 314 VM IPs / 1571 suffix events: 844 events have the observed target entry encoded directly in the suffix, 1 more event encodes the target across the known-prefix/tail boundary, 1074 events have a recognized tail schema, 603 events overlap a known decoded long-control branch at the same VM IP, another 123 events decode directly from an inline long-control prefix (target_u32@+0,delta_u32@+4) even when no catalog row covers that hidden/file-fill site, and 0 events remain observed-target-only. The generated program/source sketches now include synthetic tail lift: comments on the synthetic edges they contain, so the C-like view shows schemas such as 8000+e801+target_u16@4, target_u16@0+e801, and e801+target_u16@2 next to the recovered transition. Fully encoded single-offset target tails are promoted to executable C-like target loads: direct block sketches use next_entry = (int)U16(vm->ip + prefix + tail_offset), while handler-call sketches emit the post-prefix U16(vm->ip + tail_offset) after op_entry_NNN(vm). The lone boundary case is entry 5 at VM IP 0x11f1b9: bytes ...6201e801 encode target 354 as 0x0162 split across the 9-byte handler prefix and 3-byte marker tail, so the full program emits next_entry = (int)U16(vm->ip - 0x1) after op_entry_005(vm). The remaining long-tail family is no longer only a dangling schema: block comments now point at either the overlapping long-control branch, for example 316->171/+0x30 or 334->354/+0x2a5, or the decoded inline long-control prefix, without pretending the shorter hidden edge is the whole branch.

vm_pseudocode_dump.py is the first direct C-like reconstruction artifact. It renders the recovered VM IR as block functions over a VMState { ip, state, flags, byte }, translating state0, flags0, u16_N, u32_N, and byte operands into C-like expressions and emitting next_entry = ...; vm->ip += ...; for each recovered VM instruction. make pseudocode writes dumps/vmtail-wide-1m-w16/vm_pseudocode_top.c; the current file contains 60 hottest VM basic blocks / 12612 lines, with long blocks truncated to 32 recovered IR statements each. Its 21 selected synthetic terminal spans are now lifted into explicit source/target/delta comments plus next_entry = ... and vm->ip += ... statements; 19 selected synthetic terminal spans carry row-level synthetic-tail schemas, 15 emit direct U16(vm->ip + offset) target loads, 17 internal synthetic rows now carry overlapping long-control comments, and 4 terminal synthetic edges carry decoded inline long-control-prefix comments. Decoded long-control rows in this view now use operand-driven C-like loads, next_entry = (int)U32(vm->ip + 0x0) and signed_vm_delta_u32(U32(vm->ip + 0x4)), instead of only hardcoded sidecar comments; the compact top view contains 3 of those decoded long-control load sites. The renderer emits clipped state expressions as comments rather than invalid C assignments, emits unsigned hex constants for wraparound-style arithmetic, emits forward declarations for selected block functions, and emits 92 concrete block calls, including 16 synthetic-successor calls recovered by applying lifted synthetic-span deltas. Self-loops and targets outside the selected compact block set stay as comments. The only remaining vm_unresolved_synthetic_tail use is the default switch fallback. This is not polished source yet, but it is now a concrete syntax-checkable C-shaped view of recovered behavior instead of only TSVs, and the C preamble now points readers back to the run/network provenance matrix.

vm_handler_pseudocode_dump.py factors the VM ISA/operator layer out of the bytecode path. make handler-pseudocode emits vm_handlers_pseudocode.c for all 360 dispatch entries and vm_handlers_hot_pseudocode.c for the 80 hottest observed entries. The full file is 7778 lines and covers 166 static_validated, 155 unobserved_static, 13 affine_dispatch_fallback, 11 partial, 9 sampled_only, 3 target_only, and 3 sampled_operand_lifted handlers. Each op_entry_NNN(VMState *vm) carries native handler address, operand layout, native IP reads, state/flag expressions where safe, slot/IP updates where single-valued, observed top targets, validation status, and explicit comments for handlers not directly executed as source rows. When a single normal VM dispatch slot expression is recovered, the dump now treats it as an 8-byte dispatch-table offset; 139 handlers currently emit vm_entry_from_table_offset(r.slot). The 10 decoded long-control handlers remain the direct-entry exception and emit vm_entry_from_slot_index(r.slot) after loading r.slot = U32(vm->ip + 0x0), followed by vm->ip += signed_vm_delta_u32(U32(vm->ip + 0x4)). This matters for handlers such as entry 43, where the recovered expression value 0x90 means table byte offset 0x90 / entry 18, not direct entry 144. The return-patch handlers, sources 175, 195, 278, and 299, are now rendered as native return-patch thunks: 175/195/299 load u32_0 and u16_4, while 278 writes two stacked returns from u32_6 and u32_0; each records a native text/file offset in r.slot as analysis evidence instead of inheriting the following native handler's normal dispatch decode. When a handler has no source-row execution but the native tail site contains a constant VM-IP update, the dump emits that static vm->ip += ... fallback; the current full file contains 157 such native-tail IP advances, including target-only entries 5, 50, and 80. Static-only RetDec model evidence is now integrated into the primary handler layer: 11 tier0 annotations / 10 executable tier0 slot recoveries, 43 tier1 annotations / 3 executable tier1 dispatch-table slot recoveries / 6 masked or noisy tier1 slot candidates kept comment-only, 15 tier2 split annotations / 5 executable tier2 dispatch-table slot recoveries, 40 tier3 shared annotations / 2 executable tier3 dispatch-table slot recoveries / 3 tier3 candidates kept comment-only, and 37 tier4 call/ret annotations / 0 executable tier4 slot recoveries / 3 tier4 candidates kept comment-only. Recovered handler expressions now emit unsigned hex constants, so vm_handlers_pseudocode.c passes a strict C syntax check with -Wall -Wextra and no diagnostic output. This is the static/global C-like layer; the block pseudocode remains the dynamic bytecode path layer.

vm_program_pseudocode_dump.py then renders the recovered bytecode program in terms of that handler layer. make pseudocode emits vm_program_pseudocode_top.c, currently 26393 lines: 80 hottest VM basic blocks, 80 forward block declarations, 39 concrete block-to-block calls, and explicit handler-call/next_entry/vm_ip statements for selected recovered rows and synthetic terminals. make pseudocode-full emits vm_program_pseudocode_full.c, currently 296822 lines / 20 MiB: all 499 recovered VM basic blocks, 499 forward block declarations, 71637 rendered op_entry_NNN(vm) call occurrences, 71369 next_entry fallback assignments, 483 concrete block-to-block calls, 267 synthetic-successor calls, 214 executable synthetic-tail target loads, 21 transfer-probe evidence sites, 21 dynamic-stitch evidence sites / 22 event comments, 1 symbolic-successor audit site, 21 hidden-chain/next-hook probe sites / 22 comments, 20 residual/concrete/live/table/runtime-table/sample audit sites, 15 live table evidence sites / 31 per-run comments, 15 sampled ret-patch evidence sites / 31 per-run comments, 15 sampled native ret-patch exit calls, 15 optional hidden bridge hooks guarded by VM_ENABLE_NATIVE_RET_PATCH_HIDDEN_BRIDGE, 20 focused direct-trace audit comments, 20 focused sequence comments, 20 observed-chain bridge comments, and 5 focused direct bridges promoted to concrete handler/block calls. The current full sketch has 0 explicit vm_unresolved_synthetic_tail(vm, 0x...) calls for known constant residual starts; only the default unknown-vm_ip switch fallback remains. The 5 former residual starts (0x18c467, 0x24bd2a, 0x31f2b1, 0x33a6cc, 0x34556c) still execute the focused source handler and call the recovered destination block. The other 15 former residual starts now emit vm_native_ret_patch_tail(vm, ...) with sampled native text offsets while preserving transfer/dynamic/table/sample/focused/observed-chain evidence comments; those exits are explicit native-control models, not hard VM CFG block promotions.

make source-bundle writes vm_recovered_source_bundle.c, currently 304448 lines / 20 MiB, combining all 360 op_entry_NNN handler bodies with the full 499-block bytecode program, 287 recovered synthetic transitions, 12 sampled-operand source-state sidecars, 4 return-patch handler caveats, 483 block-to-block calls, 0 explicit unresolved synthetic-successor calls for known constant residual starts, 15 sampled native ret-patch exit calls, 15 optional hidden bridge hooks guarded by VM_ENABLE_NATIVE_RET_PATCH_HIDDEN_BRIDGE, 214 synthetic-tail target-load expressions, 21 transfer-probe evidence sites, 21 dynamic-stitch evidence sites / 22 event comments, 1 symbolic-successor audit site / 1 candidate comment, 21 hidden-chain/next-hook probe sites / 22 comments, 20 residual/concrete/live/table/runtime-table/sample/focused audit sites, 15 live table evidence sites / 31 per-run comments, 15 sampled ret-patch evidence sites / 31 per-run comments, 4 handler-layer native return-patch thunk summaries, 11 tier0 static-only RetDec model annotations, 10 executable tier0 static slot recoveries, 43 tier1 static-only RetDec model annotations, 3 executable tier1 static slot recoveries, 15 tier2 static-only RetDec split annotations, 5 executable tier2 static slot recoveries, 40 tier3 static-only RetDec shared annotations, 2 executable tier3 static slot recoveries, 20 bundled focused sequence comments, 20 observed-chain bridge comments, 1 exact hidden-chain reentry, 5 focused direct bridges, 37 tier4 call/ret model annotations / 3 comment-only tier4 slot candidates, and 9 tier5 large model annotations / 0 executable tier5 slot recoveries. make all-evidence-bundle writes vm_recovered_source_all_evidence_bundle.c, currently 685922 lines / 43 MiB, preserving that smoke-linked bundle and appending 241 renamed native RetDec/control/queue/model/path/data/config-frontier/native-exec-audit/function-inventory/gap-queue/native-gap-RetDec sidecar sections with 4590 prefixed RetDec functions, 560 prefixed validated path-specialized handler functions, 560 validated path metadata rows, 560 validated path dispatcher cases, 1 validated path dispatcher, 10 weak frontier path-specialized functions, 10 weak frontier metadata rows, 10 weak frontier dispatcher cases, 10 path-frontier slot-audit rows / 10 not-promotable rows / 0 direct table matches, 5 native executable section rows / 9090 native range rows / 2369 executable gap rows, 3309 weak native function stubs / 3309 native function metadata rows, 22 native RetDec gap-queue rows, 71 config coverage metric rows, 173 config/path frontier rows, 4005 native gap RetDec functions / 4027 native gap RetDec address ranges, and 125353 prefixed evidence symbols, 22 exact runtime data section arrays (0xe63f7 bytes), 29 allocatable-section metadata rows, 2917 full string-reference rows, and the raw 360-entry VM dispatch table bytes/offsets in one syntax-checkable translation unit. make native-ret-patch-target-pseudocode writes vm_native_ret_patch_targets.c, currently 778 lines, with 16 native target helper functions, 16 dispatcher cases, 13 bounded native epilogue models, source278 trampoline labels to 0x2d2cf4 / 0xcdc60, and a syntax-checkable vm_native_ret_patch_tail implementation for inspecting the ret-patch exits outside the main bundle. make native-ret-patch-hidden-bridge writes vm_native_ret_patch_hidden_bridge.c, currently mapping 8 recovered hidden-control bridge rows across 7 ret-patch sites back to source278-covered targets or the second-stage dispatch-table model. make native-ret-patch-epilogues-retdec writes vm_native_ret_patch_epilogues_retdec.c, currently 206 lines, with 14 targeted RetDec C functions for the single-stack native epilogue returns. make native-ret-patch-source278-retdec writes vm_native_ret_patch_source278_retdec.c, currently 116 lines, with 5 targeted RetDec C functions and 3 recovered C-shaped tail calls for source278's native trampoline chain (0x6c010 -> 0x2d2cf4 -> 0xcf3c7 and 0x15b5b2 -> 0xcdc60). make target-only-handlers-retdec writes vm_target_only_handlers_retdec.c, currently 317 lines, with 3 selected target-only native handler ranges split by RetDec into 8 C functions. make unobserved-handlers-retdec writes vm_unobserved_handlers_retdec_batch00.c through vm_unobserved_handlers_retdec_batch06.c, currently 9718 total lines, with all 155 unobserved native handler ranges split by RetDec into 272 C functions plus 14 external helper prototypes. make weak-handlers-retdec writes vm_weak_handlers_retdec.c, currently 4905 lines, with 36 observed weak-recovery handler ranges split by RetDec into 60 C functions plus 3 external helper prototypes. make validated-handlers-retdec writes vm_validated_handlers_retdec_batch00.c through vm_validated_handlers_retdec_batch06.c, currently 9436 total lines, with all 166 static-validated handler native ranges split by RetDec into 259 C functions plus 18 external helper prototypes. These handler RetDec outputs are now normal file targets, so make skips current C sidecars instead of rerunning the slow decompiler path on every syntax/manifest refresh. make handler-retdec-index builds the native vm_handler_retdec_index tool and writes a 360-row TSV/Markdown index tying every dispatch entry to its sidecar, selected native range, and overlapping emitted native C functions. make static-only-handler-queue builds a native-ranked closure queue for the 155 static-only entries, currently with 11 tier-0 small single-function handlers and top entries 57,255,96,71,73,339,324,38,67,138. make static-only-tier0-models emits 11 frame-level C model functions for those tier-0 entries, covering 57,255,96,71,73,339,324,38,67,138,47 with concrete or candidate slot expressions and RetDec-preserved frame memory effects. make static-only-tier1-models emits 43 frame-level C model functions for the tier-1 medium single-function rows, with 9 known/candidate slot expressions, 3 clean dispatch-table slot recoveries, and masked/noisy slot candidates deliberately kept comment-only in VMState. make static-only-tier2-split emits 15 split C model functions for tier-2 small shared-range rows, with 5 clean RetDec dispatch-table slot recoveries promoted into primary handlers. make static-only-tier3-shared emits 40 shared-range C model functions for tier-3 rows, with 5 RetDec slot candidates, 2 clean dispatch-table slot recoveries promoted into primary handlers, and masked/noisy returns kept comment-only. make static-only-tier4-callret emits 37 call/ret side-effect model functions for tier-4 rows, with 1 native-call row, 3 multi-ret rows, 3 comment-only slot candidates, and 0 executable dispatch-table slot recoveries. make static-only-tier5-large emits 9 conservative large-handler model functions for the final 9 tier-5 large static-only rows, covering 12514 selected native span bytes / 2704 native instructions with 0 candidate or executable dispatch-table slot recoveries. make c-reconstruction-manifest now uses a file-backed primary instruction trace dependency: ordinary refreshes reuse dumps/vmtail-wide-1m-w16/vm_instruction_trace.tsv unless run.stderr, vm_trace_graph.py, or eac.elf is newer, while make instruction-trace-refresh remains the explicit force-rebuild path. The manifest path still regenerates the derived unique-instruction table, instruction lift, sampled recovery, file atlas, file-fill sidecars, IR, basic blocks, C sketches, syntax/object/link gates, coverage audit, synthetic-gap residual audit, concrete-state residual audit, live-context residual audit, table-read diagnostic, table-memory probe, runtime table-memory probe, sampled-control correlation, focused direct-trace audit, focused sequence audit, observed-chain bridge audit, unresolved-family audit, source-299 context probe, source-299 ret-patch probe, sampled ret-patch probe, ret-patch native target atlas, native ret-patch target pseudocode, ret-patch epilogue RetDec C, source278 targeted RetDec C, target-only handler RetDec C, all unobserved handler RetDec C batches, weak observed-handler RetDec C, static-validated handler RetDec C batches, handler RetDec index, static-only handler queue, static-only tier0 models, static-only tier1 models, static-only tier2 split models, static-only tier3 shared models, static-only tier4 call/ret models, static-only tier5 large models, binary data sections, config coverage frontier, path frontier slot audit, native executable coverage audit, native function inventory, native RetDec gap queue, native gap RetDec batch00, native gap RetDec batch01, native gap RetDec batch02, native gap RetDec batch03, native gap RetDec batch04, native gap RetDec batch05, native gap RetDec batch06, native gap RetDec batch07, native gap RetDec batch08, native gap RetDec batch09, native gap RetDec batch10, native gap RetDec batch11, native gap RetDec batch12, native gap RetDec batch13, native gap RetDec batch14, native gap RetDec batch15, native gap RetDec batch16, native gap RetDec batch17, native gap RetDec batch18, native gap RetDec batch19, native gap RetDec batch20, native gap RetDec batch21, native gap RetDec batch22, native gap RetDec batch23, native gap RetDec batch24, native gap RetDec batch25, native gap RetDec batch26, native gap RetDec batch27, native gap RetDec batch28, native gap RetDec batch29, native gap RetDec batch30, native gap RetDec batch31, native gap RetDec batch32, native gap RetDec batch33, native gap RetDec batch34, native gap RetDec batch35, native gap RetDec batch36, native gap RetDec batch37, native gap RetDec batch38, native gap RetDec batch39, native gap RetDec batch40, native gap RetDec batch41, native gap RetDec batch42, native gap RetDec batch43, native gap RetDec batch44, native gap RetDec batch45, native gap RetDec batch46, native gap RetDec batch47, native gap RetDec batch48, native gap RetDec batch49, native gap RetDec batch50, native gap RetDec batch51, native gap RetDec batch52, native gap RetDec batch53, native gap RetDec batch54, native gap RetDec batch55, native gap RetDec batch56, native gap RetDec batch57, native gap RetDec batch58, native gap RetDec batch59, native gap RetDec batch60, native gap RetDec batch61, native gap RetDec batch62, native gap RetDec batch63, native gap RetDec batch64, native gap RetDec batch65, native gap RetDec batch66, native gap RetDec batch67, native gap RetDec batch68, native gap RetDec batch69, native gap RetDec batch70, native gap RetDec batch71, native gap RetDec batch72, native gap RetDec batch73, native gap RetDec batch74, native gap RetDec batch75, native gap RetDec batch76, native gap RetDec batch77, native gap RetDec batch78, native gap RetDec batch79, native gap RetDec batch80, native gap RetDec batch81, native gap RetDec batch82, native gap RetDec batch83, native gap RetDec batch84, native gap RetDec batch85, native gap RetDec batch86, native gap RetDec batch87, native gap RetDec batch88, native gap RetDec batch89, native gap RetDec batch90, native gap RetDec batch91, native gap RetDec batch92, native gap RetDec batch93, native gap RetDec batch94, native gap RetDec batch95, native gap RetDec batch96, native gap RetDec batch97, native gap RetDec batch98, native gap RetDec batch99, native gap RetDec batch100, native gap RetDec batch101, native gap RetDec batch102, native gap RetDec batch103, native gap RetDec batch104, native gap RetDec batch105, native gap RetDec batch106, native gap RetDec batch107, native gap RetDec batch108, native gap RetDec batch109, native gap RetDec batch110, native gap RetDec batch111, native gap RetDec batch112, native gap RetDec batch113, native gap RetDec batch114, native gap RetDec batch115, native gap RetDec batch116, native gap RetDec batch117, native gap RetDec batch118, native gap RetDec batch119, native gap RetDec batch120, native gap RetDec batch121, native gap RetDec batch122, native gap RetDec batch123, native gap RetDec batch124, native gap RetDec batch125, native gap RetDec batch126, native gap RetDec batch127, native gap RetDec batch128, native gap RetDec batch129, native gap RetDec batch130, native gap RetDec batch131, native gap RetDec batch132, native gap RetDec batch133, native gap RetDec batch134, native gap RetDec batch135, native gap RetDec batch136, native gap RetDec batch137, native gap RetDec batch138, native gap RetDec batch139, native gap RetDec batch140, native gap RetDec batch141, native gap RetDec batch142, native gap RetDec batch143, native gap RetDec batch144, native gap RetDec batch145, native gap RetDec batch146, native gap RetDec batch147, native gap RetDec batch148, native gap RetDec batch149, native gap RetDec batch150, native gap RetDec batch151, native gap RetDec batch152, native gap RetDec batch153, native gap RetDec batch154, native gap RetDec batch155, native gap RetDec batch156, native gap RetDec batch157, native gap RetDec batch158, native gap RetDec batch159, native gap RetDec batch160, native gap RetDec batch161, native gap RetDec batch162, native gap RetDec batch163, native gap RetDec batch164, native gap RetDec batch165, native gap RetDec batch166, native gap RetDec batch167, native gap RetDec batch168, native gap RetDec batch169, native gap RetDec batch170, native gap RetDec batch171, native gap RetDec batch172, native gap RetDec batch173, native gap RetDec batch174, native gap RetDec batch175, native gap RetDec batch176, native gap RetDec batch177, native gap RetDec batch178, native gap RetDec batch179, native gap RetDec batch180, native gap RetDec batch181, native gap RetDec batch182, native gap RetDec batch183, native gap RetDec batch184, native gap RetDec batch185, native gap RetDec batch186, native gap RetDec batch187, native gap RetDec batch188, native gap RetDec batch189, native gap RetDec batch190, native gap RetDec batch191, native gap RetDec batch192, native gap RetDec batch193, live snapshot transfer probe, live table evidence, all-evidence bundle, and manifest in dependency order, so stale trace-derived rows no longer stop at the TSV boundary and normal refreshes no longer pay the raw trace parse every time. The current manifest records 360 handler functions, 139 table-offset handler next-entry normalizations, 10 direct-slot handler normalizations, 4 handler-layer sampled ret-patch functions/evidence comments, 11 tier0 static-only handler annotations / 10 executable tier0 slot recoveries, 43 tier1 static-only handler annotations / 3 executable tier1 slot recoveries / 6 comment-only tier1 slot candidates, 15 tier2 static-only split annotations / 5 executable tier2 slot recoveries, 40 tier3 static-only shared annotations / 2 executable tier3 slot recoveries / 3 comment-only tier3 slot candidates, 37 tier4 static-only call/ret annotations / 0 executable tier4 slot recoveries / 3 comment-only tier4 slot candidates, 9 tier5 static-only large annotations / 0 executable tier5 slot recoveries, 16 native ret-patch target helper functions, 14 ret-patch epilogue RetDec functions, 5 source278 targeted RetDec functions, 3 target-only handler RetDec input ranges / 8 emitted native C functions, 7 unobserved handler RetDec batches covering 155 ranges / 272 emitted native C functions, 36 weak observed handler RetDec ranges / 60 emitted native C functions, 7 static-validated handler RetDec batches covering 166 ranges / 259 emitted native C functions, 16 handler RetDec sidecar files covering all 360 dispatch entries / 599 emitted native C functions, 4005 native gap RetDec functions / 4027 native gap RetDec address ranges, a 360-row handler RetDec index with 0 functionless rows, 560 path-specialized functions, 499 full program block functions, 241 all-evidence sidecar sections / 4590 prefixed RetDec functions / 560 prefixed validated path-specialized handler functions / 560 validated path metadata rows / 560 validated path dispatcher cases / 1 validated path dispatcher / 10 weak frontier path-specialized functions / 10 weak frontier metadata rows / 10 weak frontier dispatcher cases / 10 path-frontier slot-audit rows / 10 not-promotable rows / 0 direct table matches / 5 native executable section rows / 9090 native range rows / 2369 executable gap rows / 3309 weak native function stubs / 3309 native function metadata rows / 22 native RetDec gap-queue rows / 71 config coverage metric rows / 173 config/path frontier rows / 125353 prefixed evidence symbols, 155 static-only queue rows, 155/155 static-only queue rows covered by tier0-5 model artifacts, 11 tier0 static-only frame-level model functions, 43 tier1 static-only frame-level model functions, 15 tier2 static-only split model functions, 40 tier3 static-only shared model functions, 37 tier4 static-only call/ret model functions, 9 tier5 static-only large model functions, 22 binary data section arrays / 29 allocatable-section metadata rows / 2917 full string-reference rows / raw 360-entry dispatch-table bytes and offsets, 0 explicit unresolved synthetic successor calls, 1 default unknown-dispatch fallback, 15 live table evidence sites / 31 per-run comments in both the full program and bundle, 15 sampled ret-patch evidence sites / 31 per-run comments in both the full program and bundle, 15 sampled ret-patch exit calls in both the full program and bundle, 16 native return-patch target disassembly windows, 20 focused direct-trace audit rows, 5 focused direct bridge candidates/promotions, 20 focused sequence audit rows, 14 raw residual-to-residual links, 20 observed-chain bridge rows, 11 concrete instruction traces with denied network calls, 1 concrete fake-network instruction trace, 0 concrete real-network-allowed instruction traces, and completion_status=not_complete. This is the most readable and mechanically C-shaped program artifact so far: native handler arithmetic, bytecode block order, bytes, VM IPs, expected next entries, decoded control edges, recovered per-instruction vm_ip progress, recovered synthetic edges, synthetic suffix schemas, direct/boundary suffix target loads, operand-driven long-control loads, sampled-operand source effects, long-control overlap/prefix annotations, transfer-probe gap classifications, symbolic-slot successor audits, hidden-handler-chain reentry proof, dynamic next-hook validation, residual promotion-state audit, concrete-state replay audit, live-context replay audit, final table-read diagnostics, file-backed table-offset probes, runtime mapped-memory table-offset probes, live table evidence with full-GPR versus frame-only provenance, sampled native return-patch evidence, native ret-patch target windows, native ret-patch target helper C, ret-patch hidden-control bridge C, ret-patch epilogue RetDec C, source278 targeted RetDec C, target-only handler RetDec C, all unobserved handler RetDec C batches, weak observed-handler RetDec C, static-validated handler RetDec C batches, handler RetDec index, static-only closure queue, tier0 static-only frame-level models, tier0 static slot recovery in the primary handlers, tier1 static-only frame-level models, tier1 static slot recovery in the primary handlers, tier2 static-only split models, tier2 static slot recovery in the primary handlers, tier3 static-only shared models, tier3 static slot recovery in the primary handlers, tier4 static-only call/ret models, tier5 static-only large models, all-evidence validated and frontier path-specialized handler sidecars, path frontier slot-audit evidence, native executable coverage audit, native function-boundary skeletons, native RetDec gap queue, native gap RetDec batch00/01/02/03/04/05/06/07/08/09/10/11/12/13/14/15/16/17/18/19/20/21/22/23/24/25/26/27/28/29/30/31/32/33/34/35/36/37/38/39/40/41/42/43/44/45/46/47/48/49/50/51/52/53/54/55/56/57/58/59/60/61/62/63/64/65/66/67/68/69/70/71/72/73/74/75/76/77/78/79/80/81/82/83/84/85/86/87/88/89/90/91/92/93/94/95/96/97/98/99/100/101/102/103/104/105/106/107/108/109/110/111/112/113/114/115/116/117/118/119/120/121/122/123/124/125/126/127/128/129/130/131/132/133/134/135/136/137/138/139/140/141/142/143/144/145/146/147/148/149/150/151/152/153/154/155/156/157/158/159/160/161/162/163/164/165/166/167/168/169/170/171/172/173/174/175/176/177/178/179/180/181/182/183/184/185/186/187/188/189/190/191/192/193, config coverage frontier, binary strings/data arrays and raw dispatch-table bytes/offsets, sampled-control correlation, focused direct-trace bridges, focused raw-sequence chains, and observed-chain bridge classification/comments are available together in source bundles that parse, codegen, link/smoke for the runnable bundle, and have a reproducible manifest and remaining-gap report, with the separate smaller views still kept for focused inspection.

The manifest now also regenerates, records, and counts the runtime table-memory probe comments, per-live-row table evidence comments, sampled ret-patch comments, and handler-level environment coverage map. This is negative/shape evidence in the C source itself: loader relocation/runtime patching does not turn the remaining residual table reads into valid dispatch entries, sampled sources 175, 195, 278, and 299 are labeled as native return-patch control rather than normal slot lookups, and alternate/fake-network rows stay labeled by seed quality instead of being silently promoted to hard CFG.

The all-evidence bundle also carries vm_config_coverage_frontier.c as a renamed sidecar, so the current coverage boundary is visible in C rather than only in prose. The frontier rows explicitly enumerate 155 static-only handlers, 3 concrete target-only handlers, 10 path-specialized rows with 0% target/IP validation, 1 no-real-network-allowed trace gap, and 4 synthetic-fill-only coverage rows; these are work queues, not completion claims.

The all-evidence bundle also carries vm_path_frontier_slot_audit.c as a renamed sidecar. The audit keeps the 10 weak path slot expressions in C form and records that all 10 are not_promotable: 0 direct dispatch-table matches, 0 rows with any table match. This narrows the next target to missing native return/long-control semantics or forced traces, not a simple direct table-offset promotion.

The all-evidence bundle also carries vm_native_executable_coverage_audit.c as a renamed sidecar. This compares every allocatable executable ELF section against native ranges represented by the current RetDec/native C sidecars: 5 executable sections, 5651040 executable bytes, 573810 recovered executable bytes (10.15%), 5077230 uncovered executable bytes (89.85%), 4194 recovered range rows, and 928 uncovered gap rows. This is a completion-audit guardrail: the VM handler/program reconstruction is substantial, but the full native ELF is not reconstructed.

The all-evidence bundle also carries vm_native_function_inventory.c as a renamed sidecar. This is a weak but broad native skeleton layer from radare2: 3309 executable-section function stubs, 3309 metadata rows, 3063 .text functions, and 806070 merged .text bytes covered by identified function ranges. These stubs are not decompiled semantics; they are a fast function-boundary scaffold for deciding which large native regions to decompile or model next.

The all-evidence bundle also carries vm_native_retdec_gap_queue.c as a renamed sidecar. This is the current strategic backlog for native semantic C recovery: 2304 .text functions still have bytes not covered by semantic RetDec/native C sidecars, totaling 640154 function-boundary uncovered bytes. The queue is deliberately tiered for fast targeted work: 1976 small single-function targets, 247 medium targets, 77 large targets, and 4 huge/noisy targets that should be split or modeled before broad RetDec.

The all-evidence bundle also carries vm_native_gap_retdec_batch00.c as a renamed sidecar. This is the first fixed batch from that native gap queue: 16 selected top-ranked ranges decompiled in 2.02 seconds into 24 RetDec C functions with 24 address-range comments. The coverage audit counts those ranges as part of the native range surface; batch00 remains a fast 2-second fixed decompiler slice rather than a broad RetDec rerun.

The all-evidence bundle also carries vm_native_gap_retdec_batch01.c as a renamed sidecar. This second fixed batch covers 16 more queued native ranges and emits 16 RetDec C functions with 16 address-range comments in about 1.99 seconds. The two top remaining ranges, 0x62b92-0x62d6d and 0x4b1ca0-0x4b1e79, are deliberately left queued because RetDec emitted invalid control structure there; they need a split/model pass, not hand-edited fake C.

The all-evidence bundle also carries vm_native_gap_retdec_batch02.c as a renamed sidecar. This third fixed batch covers 16 more selected native ranges, emits 19 RetDec C functions with 19 address-range comments in about 1.85 seconds, and increases the recovered executable byte surface to 361754 bytes. The trial run found 0x4bfaf0-0x4bfcc3 also emits invalid RetDec control structure, so the top split/model backlog is now 0x62b92-0x62d6d, 0x4b1ca0-0x4b1e79, and 0x4bfaf0-0x4bfcc3.

The all-evidence bundle also carries vm_native_gap_retdec_batch03.c as a renamed sidecar. This fourth fixed batch covers 16 more selected native ranges and emits 37 RetDec C functions with 37 address-range comments in about 1.87 seconds. The wrapper now emits forward declarations for all RetDec functions in a selected batch and normalizes return &vN stack-address evidence to integer form, which keeps this broader batch syntax-checkable without editing the RetDec control flow.

The all-evidence bundle also carries vm_native_gap_retdec_batch04.c as a renamed sidecar. This fifth fixed batch covers 16 more selected native ranges and emits 16 RetDec C functions with 16 address-range comments in about 1.90 seconds. It required loose prototypes for RetDec's multibyte/wide-character helpers and all-evidence prelude declarations for calloc, memchr, and strstr, preserving the emitted C evidence while keeping the merged translation unit syntax-checkable.

The all-evidence bundle also carries vm_native_gap_retdec_batch05.c as a renamed sidecar. This sixth fixed batch covers 16 more selected native ranges and emits 38 RetDec C functions with 38 address-range comments in about 1.87 seconds. The trial run replaced 0x4ad2a0-0x4ad440 because RetDec emitted invalid control structure there, leaving it in the split/model backlog with 0x62b92-0x62d6d, 0x4b1ca0-0x4b1e79, and 0x4bfaf0-0x4bfcc3.

The all-evidence bundle also carries vm_native_gap_retdec_batch06.c as a renamed sidecar. This seventh fixed batch covers 16 more selected native ranges and emits 23 RetDec C functions with 23 address-range comments in about 1.89 seconds. The trial run replaced 0x57c4c0-0x57c64f because RetDec emitted invalid control structure there, so the current split/model backlog is 0x62b92-0x62d6d, 0x4b1ca0-0x4b1e79, 0x4bfaf0-0x4bfcc3, 0x4ad2a0-0x4ad440, and 0x57c4c0-0x57c64f.

The all-evidence bundle also carries vm_native_gap_retdec_batch07.c as a renamed sidecar. This eighth fixed batch covers 16 more selected native ranges and emits 42 RetDec C functions with 46 address-range comments in about 1.86 seconds. It did not add a new split/model blocker; the wrapper only needed additional loose prototypes for RetDec's SSE, TLS, system-info, and string call surface.

The all-evidence bundle also carries vm_native_gap_retdec_batch08.c as a renamed sidecar. This ninth fixed batch covers 16 more selected native ranges and emits 36 RetDec C functions with 36 address-range comments in about 1.85 seconds. It did not add a new split/model blocker; the wrapper only needed additional loose prototypes for RetDec's synthetic interrupt, port I/O, vector move, and movdqa helper variants.

The all-evidence bundle also carries vm_native_gap_retdec_batch09.c as a renamed sidecar. This tenth fixed batch covers 16 more selected native ranges and emits 19 RetDec C functions with 19 address-range comments in about 1.91 seconds. It did not add a new split/model blocker; the wrapper only needed additional loose prototypes for RetDec's rotate, interrupt, scalar divide, byte-copy, and wide-string helper variants.

The all-evidence bundle also carries vm_native_gap_retdec_batch10.c as a renamed sidecar. This eleventh fixed batch covers 16 more selected native ranges and emits 25 RetDec C functions with 26 address-range comments in about 1.83 seconds. It did not add a new split/model blocker; the wrapper needed additional loose prototypes for carry-less multiply/SSE shifts, por, movdqu, filesystem path helpers, integer-return memset2, and snprintf in the merged all-evidence prelude.

The all-evidence bundle also carries vm_native_gap_retdec_batch11.c as a renamed sidecar. This twelfth fixed batch covers the next 16 viable ranked native ranges after the five known split/model blockers and emits 23 RetDec C functions with 23 address-range comments in about 1.84 seconds. It did not need new wrapper prototypes and passed standalone GCC/Clang syntax checks before being merged.

The all-evidence bundle also carries vm_native_gap_retdec_batch12.c as a renamed sidecar. This thirteenth fixed batch covers the next 16 viable ranked native ranges after the five known split/model blockers and emits 19 RetDec C functions with 19 address-range comments in about 1.82 seconds. Standalone GCC/Clang syntax checks passed; the merged all-evidence prelude needed an explicit fwrite declaration because sidecar includes are stripped during prefixing.

The all-evidence bundle also carries vm_native_gap_retdec_batch13.c as a renamed sidecar. This fourteenth fixed batch covers the next 16 viable ranked native ranges after the five known split/model blockers and emits 20 RetDec C functions with 20 address-range comments in about 1.83 seconds. The standalone syntax trial required an llvm_bswap_i16 wrapper prototype, then passed both GCC and Clang before being merged.

The all-evidence bundle also carries vm_native_gap_retdec_batch14.c as a renamed sidecar. This fifteenth fixed batch covers the next 16 viable ranked native ranges after the five known split/model blockers and emits 15 RetDec C functions with 16 address-range comments in about 1.79 seconds. The standalone syntax trial required a loose __asm_movaps prototype for BLAKE3 setup code, then passed both GCC and Clang before being merged.

The all-evidence bundle also carries vm_native_gap_retdec_batch15.c as a renamed sidecar. This sixteenth fixed batch covers 16 selected native ranges and emits 20 RetDec C functions with 20 address-range comments in about 1.81 seconds. The trial replaced 0x4b16c0-0x4b17fb because RetDec emitted invalid break structure there; the wrapper then needed loose fcntl/socket/iconv/locale helper prototypes before GCC and Clang accepted the sidecar.

The all-evidence bundle also carries vm_native_gap_retdec_batch16.c as a renamed sidecar. This seventeenth fixed batch covers 16 selected native ranges and emits 18 RetDec C functions with 18 address-range comments in about 1.84 seconds. The trial replaced 0x570310-0x57043a because RetDec emitted a duplicate label there; the wrapper then normalized RetDec's synthetic vsnprintf call surface and stack-address returns before GCC and Clang accepted the sidecar.

The all-evidence bundle also carries vm_native_gap_retdec_batch17.c as a renamed sidecar. This eighteenth fixed batch covers 16 selected native ranges after the seven known split/model blockers and emits 17 RetDec C functions with 17 address-range comments in about 1.78 seconds. Standalone GCC/Clang syntax checks passed; the merged all-evidence prelude needed loose getenv, fseek, ftell, SEEK_SET, and SEEK_END declarations because sidecar includes are stripped during prefixing.

The all-evidence bundle also carries vm_native_gap_retdec_batch18.c as a renamed sidecar. This nineteenth fixed batch covers 16 selected native ranges and emits 18 RetDec C functions with 18 address-range comments in about 1.81 seconds. The trial replaced 0x54ea90-0x54ebb0, 0x54ebd0-0x54ecf0, and 0x6b7a0-0x6b8bb because RetDec emitted invalid break/label structure there; those ranges remain in the split/model backlog with the earlier seven blockers.

The all-evidence bundle also carries vm_native_gap_retdec_batch19.c as a renamed sidecar. This twentieth fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 21 RetDec C functions with 21 address-range comments in about 1.77 seconds. The wrapper now normalizes RetDec pointer initializers sourced from synthetic globals, preserving the evidence in C form while keeping both GCC and Clang syntax checks clean.

The all-evidence bundle also carries vm_native_gap_retdec_batch20.c as a renamed sidecar. This twenty-first fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 19 RetDec C functions with 19 address-range comments in about 1.83 seconds. Standalone GCC/Clang syntax checks passed without adding a new wrapper normalization or split/model blocker.

The all-evidence bundle also carries vm_native_gap_retdec_batch21.c as a renamed sidecar. This twenty-second fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 31 RetDec C functions with 32 address-range comments in about 1.75 seconds. The wrapper now accepts RetDec's zero-argument int1 helper form and declares __sprintf_chk, keeping the emitted evidence syntax-checkable under both GCC and Clang.

The all-evidence bundle also carries vm_native_gap_retdec_batch22.c as a renamed sidecar. This twenty-third fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.82 seconds. The wrapper now carries loose declarations for page-size, pthread condition-wait, time, and memory-protection call surfaces, and its stack-address normalization is scoped per emitted function so older batches keep integer address evidence intact.

The all-evidence bundle also carries vm_native_gap_retdec_batch23.c as a renamed sidecar. This twenty-fourth fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.71 seconds. The wrapper now accepts RetDec's argument-bearing mfence helper form and declares wmemmove, keeping the batch syntax-checkable under both GCC and Clang.

The all-evidence bundle also carries vm_native_gap_retdec_batch24.c as a renamed sidecar. This twenty-fifth fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.84 seconds. The wrapper now declares syscall, unwind-region, ioctl, poll, stat64, and lseek64 call surfaces for this libc/libgcc/native runtime slice.

The all-evidence bundle also carries vm_native_gap_retdec_batch25.c as a renamed sidecar. This twenty-sixth fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.80 seconds. Standalone GCC/Clang syntax checks passed without adding a new wrapper normalization or split/model blocker.

The all-evidence bundle also carries vm_native_gap_retdec_batch26.c as a renamed sidecar. This twenty-seventh fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 19 RetDec C functions with 19 address-range comments in about 1.77 seconds. Standalone GCC/Clang syntax checks passed without adding a new wrapper normalization or split/model blocker.

The all-evidence bundle also carries vm_native_gap_retdec_batch27.c as a renamed sidecar. This twenty-eighth fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.75 seconds. The wrapper now declares wctob for the wide-character classification helper, and standalone GCC/Clang syntax checks pass.

The all-evidence bundle also carries vm_native_gap_retdec_batch28.c as a renamed sidecar. This twenty-ninth fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 18 RetDec C functions with 18 address-range comments in about 1.72 seconds. The wrapper now declares towlower, writev, and struct iovec, and standalone GCC/Clang syntax checks pass.

The all-evidence bundle also carries vm_native_gap_retdec_batch29.c as a renamed sidecar. This thirtieth fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.78 seconds. The wrapper now declares xorps, epoll, and close call surfaces, and standalone GCC/Clang syntax checks pass.

The all-evidence bundle also carries vm_native_gap_retdec_batch30.c as a renamed sidecar. This thirty-first fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.72 seconds. The wrapper now declares outsd and mbstowcs, and the postprocessor lowers oversized 128-bit movdqa immediates into high/low 64-bit construction so both GCC and Clang accept the preserved byte evidence.

The all-evidence bundle also carries vm_native_gap_retdec_batch31.c as a renamed sidecar. This thirty-second fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 20 RetDec C functions with 20 address-range comments in about 1.76 seconds. The wrapper/postprocessor now normalizes integer-address memset destinations and declares btowc, and standalone GCC/Clang syntax checks pass.

The all-evidence bundle also carries vm_native_gap_retdec_batch32.c as a renamed sidecar. This thirty-third fixed batch covers 16 selected native ranges after the ten known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.74 seconds. The selected invalid-break 0x54e240-0x54e308 split stayed out of the bundle and remains in the queue; the replacement range plus guarded cpuid/xgetbv helpers pass standalone and all-evidence syntax gates.

The all-evidence bundle also carries vm_native_gap_retdec_batch33.c as a renamed sidecar. This thirty-fourth fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 split and emits 17 RetDec C functions with 17 address-range comments in about 1.74 seconds. The selected invalid-break 0x53fce0-0x53fda4 split stayed out of the bundle and remains in the queue; the replacement range plus loose vswprintf declaration pass standalone and all-evidence syntax gates.

The all-evidence bundle also carries vm_native_gap_retdec_batch34.c as a renamed sidecar. This thirty-fifth fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 16 RetDec C functions with 16 address-range comments in about 1.72 seconds. The batch selection now lives in native_gap_retdec_batch34.ranges; after adding --ranges-file, unchanged legacy RetDec batches can stay materialized while new batches are added from range files.

The all-evidence bundle also carries vm_native_gap_retdec_batch35.c as a renamed sidecar. This thirty-sixth fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 16 RetDec C functions with 16 address-range comments in about 1.77 seconds. The batch selection lives in native_gap_retdec_batch35.ranges; the native refresh completed in under half a second because no legacy RetDec batches were regenerated.

The all-evidence bundle also carries vm_native_gap_retdec_batch36.c as a renamed sidecar. This thirty-seventh fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 16 RetDec C functions with 16 address-range comments in about 1.74 seconds. The wrapper now declares loose addrinfo, getaddrinfo, and freeaddrinfo surfaces for the resolver slice; after touching unchanged legacy batches, native refresh still completed in under half a second.

The all-evidence bundle also carries vm_native_gap_retdec_batch37.c as a renamed sidecar. This thirty-eighth fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 16 RetDec C functions with 16 address-range comments in about 1.76 seconds. The batch selection lives in native_gap_retdec_batch37.ranges; native refresh remained under half a second because the shared generator was not changed.

The all-evidence bundle also carries vm_native_gap_retdec_batch38.c as a renamed sidecar. This thirty-ninth fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 20 RetDec C functions with 20 address-range comments in about 1.75 seconds. The batch selection lives in native_gap_retdec_batch38.ranges; after adding loose wcscmp and rewind surfaces and touching unchanged legacy batches, native refresh still completed in 0:00.39.

The all-evidence bundle also carries vm_native_gap_retdec_batch39.c as a renamed sidecar. This fortieth fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 19 RetDec C functions with 19 address-range comments in about 1.72 seconds. The batch selection lives in native_gap_retdec_batch39.ranges; after adding a loose setsockopt surface and touching unchanged legacy batches, native refresh still completed in 0:00.38.

The all-evidence bundle also carries vm_native_gap_retdec_batch40.c as a renamed sidecar. This forty-first fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 16 RetDec C functions with 16 address-range comments in about 1.79 seconds. The batch selection lives in native_gap_retdec_batch40.ranges; after adding a loose wmemchr surface and touching unchanged legacy batches, native refresh still completed in 0:00.38.

The all-evidence bundle also carries vm_native_gap_retdec_batch41.c as a renamed sidecar. This forty-second fixed batch covers 16 selected native ranges after the ten known split/model blockers plus the known invalid-break 0x54e240-0x54e308 and 0x53fce0-0x53fda4 splits, and emits 16 RetDec C functions with 16 address-range comments in about 1.73 seconds. The batch selection lives in native_gap_retdec_batch41.ranges; no wrapper normalization was needed and native refresh still completed in 0:00.38.

The all-evidence bundle also carries vm_native_gap_retdec_batch42.c as a renamed sidecar. This forty-third fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 18 RetDec C functions with 18 address-range comments in about 1.79 seconds. The batch selection lives in native_gap_retdec_batch42.ranges; after adding a loose strtold_l declaration and touching unchanged legacy batches, native refresh still completed in 0:00.38.

The all-evidence bundle also carries vm_native_gap_retdec_batch43.c as a renamed sidecar. This forty-fourth fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 18 RetDec C functions with 18 address-range comments in about 1.73 seconds. The batch selection lives in native_gap_retdec_batch43.ranges; after adding loose __strtof_l and __asm_ucomiss surfaces and touching unchanged legacy batches, native refresh still completed in 0:00.38.

The all-evidence bundle also carries vm_native_gap_retdec_batch44.c as a renamed sidecar. This forty-fifth fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 32 RetDec C functions with 32 address-range comments in about 1.77 seconds. The batch selection lives in native_gap_retdec_batch44.ranges; after adding a loose __iswctype_l surface and exact intra-batch prototypes for narrow-argument definitions, native refresh still completed in 0:00.40.

The all-evidence bundle also carries vm_native_gap_retdec_batch45.c as a renamed sidecar. This forty-sixth fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 16 RetDec C functions with 16 address-range comments in about 1.69 seconds. The batch selection lives in native_gap_retdec_batch45.ranges; after adding time-format helper surface and the all-evidence <time.h> prelude include, native refresh still completed in 0:00.39.

The all-evidence bundle also carries vm_native_gap_retdec_batch46.c as a renamed sidecar. This forty-seventh fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 16 RetDec C functions with 16 address-range comments in about 1.77 seconds. The batch selection lives in native_gap_retdec_batch46.ranges; after adding loose __strtod_l and __asm_movsd_133 surfaces and touching unchanged legacy batches, native refresh still completed in 0:00.45.

The all-evidence bundle also carries vm_native_gap_retdec_batch47.c as a renamed sidecar. This forty-eighth fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 16 RetDec C functions with 16 address-range comments in about 1.71 seconds. The batch selection lives in native_gap_retdec_batch47.ranges; after adding a loose pthread_once surface and touching unchanged legacy batches, native refresh still completed in 0:00.45.

The all-evidence bundle also carries vm_native_gap_retdec_batch48.c as a renamed sidecar. This forty-ninth fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 16 RetDec C functions with 16 address-range comments in about 1.63 seconds. The batch selection lives in native_gap_retdec_batch48.ranges; no wrapper normalization was needed and native refresh still completed in 0:00.45.

The all-evidence bundle also carries vm_native_gap_retdec_batch49.c as a renamed sidecar. This fiftieth fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 16 RetDec C functions with 16 address-range comments in about 1.79 seconds. The batch selection lives in native_gap_retdec_batch49.ranges; no wrapper normalization was needed and native refresh still completed in 0:00.45.

The all-evidence bundle also carries vm_native_gap_retdec_batch50.c as a renamed sidecar. This fifty-first fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 16 RetDec C functions with 16 address-range comments in about 1.80 seconds. The batch selection lives in native_gap_retdec_batch50.ranges; after adding a loose sem_init surface and touching unchanged legacy batches, native refresh still completed in 0:00.43.

The all-evidence bundle also carries vm_native_gap_retdec_batch51.c as a renamed sidecar. This fifty-second fixed batch covers 16 selected native ranges after the known split/model blockers, and emits 17 RetDec C functions with 17 address-range comments in about 1.72 seconds. The selected invalid-break 0x4c3770-0x4c37fa split stayed out of the bundle and remains in the split/model backlog; the replacement range plus loose RetDec synthetic unknown_* helper declarations pass standalone and all-evidence syntax gates.

The all-evidence bundle also carries vm_native_gap_retdec_batch52.c as a renamed sidecar. This fifty-third fixed batch covers 16 selected native ranges after the known split/model blockers plus the invalid-break 0x4c3770-0x4c37fa split, and emits 16 RetDec C functions with 16 address-range comments in about 1.71 seconds. The wrapper now declares a loose pthread_create surface for the thread-launch slice; after touching unchanged legacy batches, native refresh still completed in 0:00.43.

The all-evidence bundle also carries vm_native_gap_retdec_batch53.c as a renamed sidecar. This fifty-fourth fixed batch covers 16 selected native ranges after the known split/model blockers plus the invalid-break 0x4c3770-0x4c37fa split, and emits 16 RetDec C functions with 16 address-range comments in about 1.72 seconds. The wrapper now declares loose RetDec synthetic unknown_* helpers for this slice; after touching unchanged legacy batches, native refresh still completed in 0:00.40.

The all-evidence bundle also carries vm_native_gap_retdec_batch54.c as a renamed sidecar. This fifty-fifth fixed batch replaces the invalid-break 0x492814-0x492897 split with the next queued viable range (0x5826b-0x582eb), emits 16 RetDec C functions with 16 address-range comments in about 1.70 seconds, and adds loose fseeko64 / ftello64 declarations plus an all-evidence realloc declaration so the merged single translation unit stays syntax-checkable while preserving the referenced data/string carrier.

The all-evidence bundle also carries vm_native_gap_retdec_batch55.c as a renamed sidecar. This fifty-sixth fixed batch replaces the invalid-break 0x4aa540-0x4aa5bf split with the next queued viable range (0x4b4e60-0x4b4edf), emits 16 RetDec C functions with 16 address-range comments in about 1.71 seconds, and keeps the merged single C artifact syntax-checkable with the existing wrapper surface.

The all-evidence bundle also carries vm_native_gap_retdec_batch56.c as a renamed sidecar. This fifty-seventh fixed batch covers 16 selected native ranges after the known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.68 seconds, with no additional wrapper normalization needed.

The all-evidence bundle also carries vm_native_gap_retdec_batch57.c as a renamed sidecar. This fifty-eighth fixed batch covers 16 selected native ranges after the known split/model blockers, emits 23 RetDec C functions with 23 address-range comments in about 1.73 seconds, and adds loose __asm_aesimc / __asm_movdqu_133 declarations for the AES/vector helper slice while keeping the single merged C artifact syntax-checkable.

The all-evidence bundle also carries vm_native_gap_retdec_batch58.c as a renamed sidecar. This fifty-ninth fixed batch covers 16 selected native ranges after the known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.73 seconds, with no additional wrapper normalization needed.

The all-evidence bundle also carries vm_native_gap_retdec_batch59.c as a renamed sidecar. This sixtieth fixed batch replaces the invalid-break 0x59c58-0x59cd1 and 0x773b0-0x77429 splits with the next queued viable ranges (0x48e641-0x48e6b8 and 0x49eff0-0x49f067), emits 16 RetDec C functions with 16 address-range comments in about 1.71 seconds, and adds loose RetDec synthetic-helper plus _Unwind_DeleteException declarations for this slice.

The all-evidence bundle also carries vm_native_gap_retdec_batch60.c as a renamed sidecar. This sixty-first fixed batch covers 16 selected native ranges after the known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.67 seconds, with no additional wrapper normalization needed.

The all-evidence bundle also carries vm_native_gap_retdec_batch61.c as a renamed sidecar. This sixty-second fixed batch covers the next 16 viable native ranges after the 17 known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.67 seconds, with no additional wrapper normalization needed.

The all-evidence bundle also carries vm_native_gap_retdec_batch62.c as a renamed sidecar. This sixty-third fixed batch covers the next 16 viable native ranges after the 17 known split/model blockers and emits 19 RetDec C functions with 19 address-range comments in about 1.79 seconds. The all-evidence prelude now declares malloc, preserving the syntax gate while retaining batch62's allocator evidence.

The all-evidence bundle also carries vm_native_gap_retdec_batch63.c as a renamed sidecar. This sixty-fourth fixed batch covers the next 16 viable native ranges after the 17 known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.71 seconds, with no additional wrapper normalization needed.

The all-evidence bundle also carries vm_native_gap_retdec_batch64.c as a renamed sidecar. This sixty-fifth fixed batch covers the next 16 viable native ranges after the 17 known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.76 seconds. The RetDec wrapper now types pthread_once as a callback pointer, preserving the allocator/init slice without weakening the C syntax gate.

The all-evidence bundle also carries vm_native_gap_retdec_batch65.c as a renamed sidecar. This sixty-sixth fixed batch covers the next 16 viable native ranges after the 17 known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.75 seconds. The RetDec wrapper now declares _ITM_RU1, _ZGTtnam, and _ITM_memcpyRtWn, preserving the transactional-memory/string helper evidence while keeping the standalone batch and merged all-evidence C syntax-checkable. Crediting this batch lowers uncovered executable bytes to 5068064 and native gap-queue rows to 1982; executable gap rows are 994 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch66.c as a renamed sidecar. This sixty-seventh fixed batch covers the next 16 viable native ranges after the 17 known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.73 seconds. The RetDec wrapper now declares fdopen, and the all-evidence prelude declares fflush / setvbuf, preserving the file-wrapper slice while keeping the standalone batch and merged all-evidence C syntax-checkable. Crediting this batch lowers uncovered executable bytes to 5066336 and native gap-queue rows to 1966; executable gap rows are 1006 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch67.c as a renamed sidecar. This sixty-eighth fixed batch covers the next 16 viable native ranges after the 17 known split/model blockers and emits 16 RetDec C functions with 16 address-range comments in about 1.68 seconds. The invalid-break ranges 0x52586-0x525ef and 0x4aa5d0-0x4aa639 stayed out of this batch and remain structural backlog items; the replacement ranges plus munmap, getwc, and _Unwind_Resume_or_Rethrow wrapper declarations keep the standalone batch and merged all-evidence C syntax-checkable. Crediting this batch lowers uncovered executable bytes to 5064647 and native gap-queue rows to 1950; executable gap rows are 1021 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch68.c as a renamed sidecar. This sixty-ninth fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two batch67 invalid-break rows, and emits 17 RetDec C functions with 17 address-range comments in about 1.70 seconds. The RetDec wrapper now declares sem_destroy, clock_gettime, and the newly surfaced synthetic unknown_* helpers for this slice. Crediting this batch lowers uncovered executable bytes to 5063001 and native gap-queue rows to 1934; executable gap rows are 1033 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch69.c as a renamed sidecar. This seventieth fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two batch67 invalid-break rows, and emits 16 RetDec C functions with 16 address-range comments in about 1.70 seconds. No additional wrapper normalization was needed. Crediting this batch lowers uncovered executable bytes to 5061398 and native gap-queue rows to 1918; executable gap rows are 1046 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch70.c as a renamed sidecar. This seventy-first fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two invalid-break rows, and emits 16 RetDec C functions with 16 address-range comments in about 1.69 seconds. The RetDec wrapper now declares unknown_ffffffffc304842d, and the all-evidence prelude declares abort, preserving the standalone batch and merged all-evidence syntax gates. Crediting this batch lowers uncovered executable bytes to 5059844 and native gap-queue rows to 1902; executable gap rows are 1060 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch71.c as a renamed sidecar. This seventy-second fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two invalid-break rows, and RetDec emits 15 C functions with 15 address-range comments in about 1.74 seconds after collapsing one selected range into existing emitted coverage. The RetDec wrapper now normalizes synthetic struct tm field access and declares __asm_pshufd / __asm_aeskeygenassist, preserving the standalone batch and merged all-evidence syntax gates. Crediting this batch lowers uncovered executable bytes to 5058336 and native gap-queue rows to 1886; executable gap rows are 1072 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch72.c as a renamed sidecar. This seventy-third fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two invalid-break rows, and RetDec emits 17 C functions with 17 address-range comments in about 1.69 seconds. No additional wrapper normalization was needed. Crediting this batch lowers uncovered executable bytes to 5056869 and native gap-queue rows to 1870; executable gap rows are 1087 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch73.c as a renamed sidecar. This seventy-fourth fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two invalid-break rows, and emits 16 RetDec C functions with 16 address-range comments in about 1.71 seconds. The RetDec wrapper now declares pthread mutex-attribute helpers, write, __asm_insb, and __asm_sti, preserving the standalone batch and merged all-evidence syntax gates. Crediting this batch lowers uncovered executable bytes to 5055434 and native gap-queue rows to 1854; executable gap rows are 1096 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch74.c as a renamed sidecar. This seventy-fifth fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two invalid-break rows, and emits 16 RetDec C functions with 16 address-range comments in about 1.66 seconds. The RetDec wrapper now declares sem_wait and pthread_cond_broadcast, preserving the standalone batch and merged all-evidence syntax gates. Crediting this batch lowers uncovered executable bytes to 5054028 and native gap-queue rows to 1838; executable gap rows are 1107 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch75.c as a renamed sidecar. This seventy-sixth fixed batch covers the next 16 viable native ranges after the known split/model blockers and the two batch67 invalid-break rows, and emits 16 RetDec C functions with 16 address-range comments in about 1.75 seconds. The first attempted slice exposed a new invalid-break row at 0x4c3060-0x4c30b5, so batch75 replaces it with 0x568730-0x568784 and keeps 0x4c3060-0x4c30b5 in the remaining queue as a decompiler-structure blocker. Crediting this batch lowers uncovered executable bytes to 5052660 and native gap-queue rows to 1822; executable gap rows are 1119 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch76.c as a renamed sidecar. This seventy-seventh fixed batch covers the next 16 viable native ranges after the known split/model blockers and invalid-break rows, and RetDec emits 18 C functions with 18 address-range comments in about 1.75 seconds. The RetDec wrapper now declares __towupper_l / __towlower_l, preserving the standalone batch and merged all-evidence syntax gates. Crediting this batch lowers uncovered executable bytes to 5051332 and native gap-queue rows to 1806; executable gap rows are 1130 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch77.c as a renamed sidecar. This seventy-eighth fixed batch covers the next 16 viable native ranges after the known split/model blockers and invalid-break rows, and RetDec emits 17 C functions with 17 address-range comments in about 1.72 seconds. The RetDec wrapper now declares synthetic helper unknown_166c28d, preserving the standalone batch and merged all-evidence syntax gates. Crediting this batch lowers uncovered executable bytes to 5050034 and native gap-queue rows to 1790; executable gap rows are 1145 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch78.c as a renamed sidecar. This seventy-ninth fixed batch covers the next 16 viable native ranges after the known split/model blockers and invalid-break rows, and RetDec emits 14 C functions with 14 address-range comments in about 1.73 seconds. No additional wrapper declarations were needed. Crediting this batch lowers uncovered executable bytes to 5048764 and native gap-queue rows to 1774; executable gap rows are 1155 because adding covered intervals split some remaining uncovered ranges.

The all-evidence bundle also carries vm_native_gap_retdec_batch79.c through vm_native_gap_retdec_batch87.c as renamed sidecars. Batch79 was the last single-batch checkpoint; batches80-87 were generated in two four-way RetDec runs and merged in one combined all-evidence/manifest checkpoint, amortizing the slow aggregate path across 128 selected ranges. Together these nine batches add 150 RetDec C functions / 150 address-range comments. Crediting them lowers uncovered executable bytes to 5038371, native gap-queue rows to 1630, and native gap-queue uncovered bytes to 566027; executable gap rows are 1276 because adding covered intervals split some remaining uncovered ranges. The automated planner's next dry run starts native_gap_retdec_batch88.ranges at 0x6a670-0x6a6b3, showing future batches can be selected from the queue without manual Makefile/generator edits.

The all-evidence bundle also carries vm_native_gap_retdec_batch88.c through vm_native_gap_retdec_batch95.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint; four RetDec invalid-break ranges were added to the planner's blocked set and replaced automatically from later queue rows. Together these eight batches add 133 RetDec C functions / 133 address-range comments. Crediting them lowers uncovered executable bytes to 5030524, native gap-queue rows to 1502, and native gap-queue uncovered bytes to 558001; executable gap rows are 1371 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch96.ranges at 0x1300d5-0x13010e.

The all-evidence bundle also carries vm_native_gap_retdec_batch96.c through vm_native_gap_retdec_batch103.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint with no new invalid-break exclusions. Together these eight batches add 135 RetDec C functions / 135 address-range comments. Crediting them lowers uncovered executable bytes to 5023800, native gap-queue rows to 1374, and native gap-queue uncovered bytes to 550849; executable gap rows are 1465 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch104.ranges at 0x2e2fee-0x2e301e.

The all-evidence bundle also carries vm_native_gap_retdec_batch104.c through vm_native_gap_retdec_batch111.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 131 RetDec C functions / 131 address-range comments. Crediting them lowers uncovered executable bytes to 5018267, native gap-queue rows to 1246, and native gap-queue uncovered bytes to 544894; executable gap rows are 1565 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch112.ranges at 0x20d90-0x20db7.

The all-evidence bundle also carries vm_native_gap_retdec_batch112.c through vm_native_gap_retdec_batch119.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 129 RetDec C functions / 129 address-range comments from 128 selected ranges; the wrapper/preamble surface now also covers __wcsftime_l, __readgsqword, __asm_out_133, __readgsbyte, __strftime_l, __freelocale, and the synthetic helpers unknown_ffffffffe026915f, unknown_ffffffffa337f4e6, unknown_ffffffffb8c4d43e, and unknown_ffffffffffa50add. Crediting them lowers uncovered executable bytes to 5013756, native gap-queue rows to 1118, and native gap-queue uncovered bytes to 540061; executable gap rows are 1633 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch120.ranges at 0x518e40-0x518e60.

The all-evidence bundle also carries vm_native_gap_retdec_batch120.c through vm_native_gap_retdec_batch127.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 118 actual prefixed RetDec C function bodies and 122 address-range comments from 128 selected ranges; RetDec collapsed or overlapped several selected ranges into existing emitted coverage. The wrapper surface now also covers pthread_cond_init, pthread_join, and synthetic helpers unknown_ffffffffb38ec0a9 and unknown_b6ccb9. Crediting this checkpoint lowers uncovered executable bytes to 5010036, native gap-queue rows to 990, and native gap-queue uncovered bytes to 536067; executable gap rows are 1720 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch128.ranges at 0x35ea08-0x35ea21.

The all-evidence bundle also carries vm_native_gap_retdec_batch128.c through vm_native_gap_retdec_batch135.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 129 actual prefixed RetDec C function bodies and 130 address-range comments from 128 selected ranges. The wrapper/preamble surface now also covers __strxfrm_l, __wcsxfrm_l, getc, and synthetic helpers unknown_ffffffffc23c8777, unknown_ffffffffd296219c, and unknown_fffffffff537c295. Crediting this checkpoint lowers uncovered executable bytes to 5007250, native gap-queue rows to 862, and native gap-queue uncovered bytes to 533126; executable gap rows are 1812 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch136.ranges at 0x507cd0-0x507ce3.

The all-evidence bundle also carries vm_native_gap_retdec_batch136.c through vm_native_gap_retdec_batch143.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 128 prefixed RetDec C function bodies and 128 address-range comments from 128 selected ranges. The wrapper surface now also covers dlsym and synthetic helper unknown_ffffffffb1f005c0. Crediting this checkpoint lowers uncovered executable bytes to 5004881, native gap-queue rows to 734, and native gap-queue uncovered bytes to 530587; executable gap rows are 1927 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch144.ranges at 0x4daba-0x4dacb.

The all-evidence bundle also carries vm_native_gap_retdec_batch144.c through vm_native_gap_retdec_batch151.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 125 actual prefixed RetDec C function bodies and 128 address-range comments from 128 selected ranges; RetDec collapsed several selected ranges into neighboring emitted functions. The wrapper/postprocessor surface now also covers pthread_mutex_trylock, __xstat, wmemcmp, __asm_rdtsc, dlclose, blake3_hasher_finalize_seek, synthetic helpers unknown_4a2eb0c7, unknown_4c300d9d, unknown_ffffffff920a593a, and unknown_ffffffffa845fcb4, plus two-argument RetDec memset normalization to memset2(..., 0). Crediting this checkpoint lowers uncovered executable bytes to 5003220, native gap-queue rows to 606, and native gap-queue uncovered bytes to 528900; executable gap rows are 2017 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch152.ranges at 0x5a254-0x5a25d.

The all-evidence bundle also carries vm_native_gap_retdec_batch152.c through vm_native_gap_retdec_batch159.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 129 actual prefixed RetDec C function bodies and 129 address-range comments from 128 selected ranges. The wrapper surface now also covers __asm_insd, fileno, __duplocale, int224_t as a RetDec syntax carrier, __asm_fnstenv, and synthetic helpers unknown_3a9782b0 and unknown_1c9eef14. Crediting this checkpoint lowers uncovered executable bytes to 5002260, native gap-queue rows to 478, and native gap-queue uncovered bytes to 527832; executable gap rows are 2123 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch160.ranges at 0x4e9fe-0x4ea03.

The all-evidence bundle also carries vm_native_gap_retdec_batch160.c through vm_native_gap_retdec_batch167.c as renamed sidecars. These eight batches were created by the queue planner, generated in one eight-way RetDec run, and merged in one aggregate checkpoint. Together these eight batches add 127 actual prefixed RetDec C function bodies and 128 address-range comments from 128 selected ranges; RetDec collapsed one selected range into neighboring emitted coverage. The wrapper surface now also covers pthread_mutex_destroy, _ITM_RU8, one-argument __asm_sti, and loose-arity __asm_iretd. Crediting this checkpoint lowers uncovered executable bytes to 4997943, native gap-queue rows to 350, and native gap-queue uncovered bytes to 523487; executable gap rows are 2223 because adding covered intervals split some remaining uncovered ranges. The planner's next dry run now starts native_gap_retdec_batch168.ranges at 0x49120a-0x491976.

The all-evidence bundle also carries vm_native_gap_retdec_batch168.c through vm_native_gap_retdec_batch175.c as renamed sidecars. These eight batches were created by the queue planner, generated in larger-range RetDec runs, and merged in one aggregate checkpoint. Together these eight batches add 212 actual prefixed RetDec C function bodies and 215 address-range comments after moving five structurally invalid RetDec ranges into the split/model backlog: 0x57cf40-0x57d4d7, 0x4d1510-0x4d19b5, 0x4b3910-0x4b3cce, 0x4aa830-0x4aab60, and 0x415ae-0x418c6. The wrapper/preamble surface now also covers entry_point, __udivti3, extra _Unwind_* helpers, mbsrtowcs, SHA/DES/LZX data table externs, memfd_create, ftruncate, opendir/readdir/closedir, stdio print helpers in the all-evidence prelude, and synthetic helper unknown_74517502. At that point the planner handed off to native_gap_retdec_batch176.ranges; the current live counters are recorded in the batch176-183 checkpoint paragraph below.

The all-evidence bundle also carries vm_native_gap_retdec_batch176.c through vm_native_gap_retdec_batch183.c as renamed sidecars. These eight batches were planned from the queue, regenerated only where RetDec emitted non-C control flow, and merged in one aggregate checkpoint. Together these eight batches add 542 actual prefixed RetDec C function bodies and 542 address-range comments after moving seven structurally invalid or over-broad RetDec ranges into the split/model backlog: 0x554b00-0x554de0, 0x5790b0-0x5792c3, 0x57c770-0x57c987, 0x5bb9c-0x5bda0, 0x3e19c-0x3f89f, 0x4926da-0x49295c, and 0x4a4be0-0x4a6a5e. The wrapper/preamble surface now also normalizes scalar locals assigned stack-buffer addresses, emits dynamic unknown_* prototypes, routes loose RetDec memset shapes through a syntax-only helper, covers additional x86/SSE helpers, adds wide-char conversion helpers, and adds strerror to the all-evidence prelude. At that point the planner handed off to native_gap_retdec_batch184.ranges; the current live counters are recorded in the batch184-187 checkpoint paragraph below.

The all-evidence bundle also carries vm_native_gap_retdec_batch184.c through vm_native_gap_retdec_batch187.c as renamed sidecars. These four batches were planned from the now-small queue with 14 selected ranges per batch and merged in one aggregate checkpoint. Together these four batches add 288 actual prefixed RetDec C function bodies and 291 address-range comments from 56 selected ranges. The wrapper/preamble surface now also covers llvm_ctlz_i64, additional packed-SIMD helpers, a return-valued __asm_movq, return-valued __asm_movups_133, a SHA256 constants table carrier, and a narrow scalar-global byte-read normalizer for RetDec output such as *g87. At that point only one usable queued native range remained; the final queued range is recorded in the batch188 checkpoint paragraph below.

The all-evidence bundle also carries vm_native_gap_retdec_batch188.c as a renamed sidecar. This final currently usable native gap queue range adds 1 prefixed RetDec C function body and 1 address-range comment for 0x4d5a50-0x4d7e3c. The wrapper surface now also covers __memcpy_chk and __popcountdi2. At that point the ordinary queue planner reported queue only supplied 0 usable ranges; the current live split/model counters are recorded in the batch189 paragraph below.

The all-evidence bundle also carries split-salvaged vm_native_gap_retdec_batch189.c as a renamed sidecar. This batch uses vm_native_gap_retdec_split_blocked.py to recursively try smaller pieces of blocked RetDec ranges, syntax-check candidates independently, and emit only non-adjacent subranges that remain valid when combined. Batch189 adds 4 prefixed RetDec C function bodies and 4 address-range comments from blocked tier0 fragments: 0x4883d8-0x488400, 0x4b4e10-0x4b4e30, 0x4b03a0-0x4b03c0, and 0x4a95d0-0x4a9600. At that point split salvage had reduced uncovered bytes inside the blocked rows; the current live split-salvage counters are recorded in the batch190-191 paragraph below.

The all-evidence bundle also carries split-salvaged vm_native_gap_retdec_batch190.c and vm_native_gap_retdec_batch191.c as renamed sidecars. Batch190 adds 8 prefixed RetDec C function bodies / 8 address-range comments from 0x4a9600-0x4a9612, 0x488400-0x488414, 0x4b4e30-0x4b4e4c, 0x4b03c0-0x4b03de, 0x4c3060-0x4c3090, 0x525b0-0x525c0, 0x4aa5d0-0x4aa610, and 0x59c58-0x59ca0. Batch191 adds 14 prefixed RetDec C function bodies / 14 address-range comments from 8 selected split ranges: 0x4c3090-0x4c30b5, 0x525c0-0x525ef, 0x4aa610-0x4aa639, 0x59ca0-0x59cd1, 0x773b0-0x773f0, 0x4aa540-0x4aa580, 0x492814-0x492860, and 0x4c3770-0x4c37c0. At that point split salvage had reduced the blocked queue to 29 rows; the current live split-salvage counters are recorded in the batch192-193 paragraph below.

The all-evidence bundle also carries split-salvaged vm_native_gap_retdec_batch192.c and vm_native_gap_retdec_batch193.c as renamed sidecars. Batch192 adds 12 prefixed RetDec C function bodies / 12 address-range comments from 8 selected split ranges: 0x492860-0x492897, 0x773f0-0x77429, 0x4c37c0-0x4c37fa, 0x4aa580-0x4aa5bf, 0x53fce0-0x53fd50, 0x54e240-0x54e2b0, 0x6b7a0-0x6b7f0, and 0x54ea90-0x54eb20. Batch193 adds 12 prefixed RetDec C function bodies / 12 address-range comments from 0x53fd50-0x53fda4, 0x54e2b0-0x54e308, 0x6b810-0x6b830, 0x54eb20-0x54ebb0, 0x54ebd0-0x54ec60, 0x570310-0x5703b0, 0x4b16c0-0x4b1760, and 0x57c4c0-0x57c530. Crediting these split batches raises native executable recovered bytes to 1118527, lowers uncovered executable bytes to 4532513, lowers native gap-queue rows to 22, and lowers native gap-queue uncovered bytes to 23975; executable gap rows are 2369 because partial recovered intervals split some remaining uncovered rows.

The split-salvage loop is now automated by vm_native_gap_retdec_autopilot.py and reachable through make native-gap-retdec-autopilot. The driver repeatedly plans blocked-range split batches, builds their RetDec sidecars, syntax-checks each sidecar, refreshes native coverage/queue metrics, and can defer the expensive all-evidence bundle, manifest, and aggregate GCC syntax pass to the final round. Its first automated passes added batches194-198: batch194 contributes 15 functions/ranges, batch195 contributes 17, batch196 contributes 21, batch197 contributes 10, and batch198 contributes 13. After batch198 the manifest recorded 690142 all-evidence lines / 45358437 bytes, 246 sidecar sections, 4666 prefixed RetDec functions, 9206 native executable coverage range rows / 2374 executable gap rows, 1126692 recovered executable bytes, 4524348 uncovered executable bytes, 7 native RetDec gap-queue rows, 15810 queue uncovered bytes, 128209 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete.

The second automated split-salvage wave adds vm_native_gap_retdec_batch199.c through vm_native_gap_retdec_batch207.c and drains the native RetDec gap queue to its TSV header only. Batch199 contributes 15 functions/ranges; batch200 contributes 10; batch201 contributes 5; batch202 contributes 1; batch203 contributes 1; batch204 contributes 3; batch205 contributes 3; batch206 contributes 2; and batch207 contributes the final manual C lift for the RetDec-hostile residual 0x6b7f0-0x6b7f8, which starts inside mov %rbx,%rdi, contains the popen@plt call, and ends at the first byte of the following test %rax,%rax. The current all-evidence bundle syntax-checks as one C translation unit and records 697848 lines / 45866779 bytes, 255 sidecar sections, 4707 prefixed RetDec/manual native functions, 9273 native executable coverage range rows / 2372 executable gap rows, 1142502 recovered executable bytes, 4508538 uncovered executable bytes, 0 native RetDec gap-queue rows, 0 native RetDec gap-queue uncovered bytes, 133069 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete.

After the native function-boundary queue drained, vm_executable_gap_retdec_probe.py began probing the largest remaining raw executable coverage gaps directly. It chunks the biggest .text gaps from vm_native_executable_coverage_audit.tsv, runs the existing RetDec wrapper on each candidate, syntax-checks the generated C, and writes the next normal native_gap_retdec_batchNN.ranges file only for syntax-clean chunks. make executable-gap-retdec-probe exposes this path. The first executable-gap probe batches are vm_native_gap_retdec_batch208.c through vm_native_gap_retdec_batch211.c: batch208 contributes 33 functions/ranges from 4 chunks, batch209 contributes 53 from 8 chunks, batch210 contributes 53 from 8 chunks, and batch211 contributes 32 from 8 chunks. The current all-evidence bundle syntax-checks as one C translation unit and records 701803 lines / 46133816 bytes, 259 sidecar sections, 4878 prefixed RetDec/manual native functions, 9472 native executable coverage range rows / 2375 executable gap rows, 1156838 recovered executable bytes, 4494202 uncovered executable bytes, 0 native RetDec gap-queue rows, 0 native RetDec gap-queue uncovered bytes, 135591 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete. The largest remaining executable gaps now begin at 0x17d685-0x1a1fa3, 0x2e4a1e-0x307093, 0x141313-0x15b5b2, and 0x1620aa-0x17bf1f.

vm_executable_gap_retdec_autopilot.py now loops the executable-gap probe, sidecar build, standalone sidecar syntax check, and coverage refresh without rebuilding the all-evidence bundle on every round; make executable-gap-retdec-autopilot exposes that loop. Its first bounded run added vm_native_gap_retdec_batch212.c through vm_native_gap_retdec_batch215.c, each with 8 selected executable-gap chunks. Batch212 contributes 54 functions/ranges, batch213 contributes 48, batch214 contributes 34, and batch215 contributes 46. The current all-evidence bundle syntax-checks as one C translation unit and records 705620 lines / 46396880 bytes, 263 sidecar sections, 5060 prefixed RetDec/manual native functions, 9686 native executable coverage range rows / 2378 executable gap rows, 1173222 recovered executable bytes, 4477818 uncovered executable bytes, 0 native RetDec gap-queue rows, 0 native RetDec gap-queue uncovered bytes, 138103 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete. The largest remaining executable gaps now begin at 0x17f285-0x1a1fa3, 0x2e6a1e-0x307093, 0x1620aa-0x17bf1f, 0xe519c-0xfeebc, and 0x141d13-0x15b5b2.

The second executable-gap autopilot checkpoint adds vm_native_gap_retdec_batch216.c through vm_native_gap_retdec_batch222.c, again as syntax-clean sidecars from raw executable gaps. Batch216 contributes 39 functions/ranges, batch217 contributes 47, batch218 contributes 47, batch219 contributes 63, batch220 contributes 66, batch221 contributes 56, and batch222 contributes 74. This wave also extended the RetDec wrapper prelude for additional generated intrinsic variants (__asm_in_135, __asm_out_136, vararg __asm_wait, __pseudo_get_significand, and __pseudo_get_exponent) so these sidecars compile without local edits. The current all-evidence bundle syntax-checks as one C translation unit and records 713431 lines / 46908903 bytes, 270 sidecar sections, 5452 prefixed RetDec/manual native functions, 10134 native executable coverage range rows / 2391 executable gap rows, 1201894 recovered executable bytes, 4449146 uncovered executable bytes, 0 native RetDec gap-queue rows, 0 native RetDec gap-queue uncovered bytes, 142790 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete. The largest remaining executable gaps now begin at 0x183285-0x1a1fa3, 0x2eac1e-0x307093, 0x141f13-0x15b5b2, 0x1628aa-0x17bf1f, and 0x218066-0x231586.

The third executable-gap autopilot checkpoint adds vm_native_gap_retdec_batch223.c through vm_native_gap_retdec_batch226.c. Batch223 contributes 64 functions/ranges, batch224 contributes 71, batch225 contributes 72, and batch226 contributes 65. This wave extended the RetDec wrapper prelude again with __asm_pmaxsw for generated packed-SIMD fragments. The current all-evidence bundle syntax-checks as one C translation unit and records 718445 lines / 47229804 bytes, 274 sidecar sections, 5724 prefixed RetDec/manual native functions, 10438 native executable coverage range rows / 2399 executable gap rows, 1218278 recovered executable bytes, 4432762 uncovered executable bytes, 0 native RetDec gap-queue rows, 0 native RetDec gap-queue uncovered bytes, 145659 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete. The largest remaining executable gaps now begin at 0x185a85-0x1a1fa3, 0x2ed41e-0x307093, 0x1628aa-0x17bf1f, 0x218066-0x231586, and 0xe599c-0xfeebc.

The fourth executable-gap autopilot checkpoint adds vm_native_gap_retdec_batch227.c through vm_native_gap_retdec_batch232.c. Batch227 contributes 42 functions/ranges, batch228 contributes 27, batch229 contributes 17, batch230 contributes 17, batch231 contributes 16, and batch232 contributes 33. This run had no new wrapper failures and recovered a further 24576 executable bytes before the single-file checkpoint. The current all-evidence bundle syntax-checks as one C translation unit and records 722952 lines / 47563437 bytes, 280 sidecar sections, 5876 prefixed RetDec/manual native functions, 10638 native executable coverage range rows / 2400 executable gap rows, 1242854 recovered executable bytes, 4408186 uncovered executable bytes, 0 native RetDec gap-queue rows, 0 native RetDec gap-queue uncovered bytes, 149050 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete. The largest remaining executable gaps now begin at 0x162eaa-0x17bf1f, 0x2ee01e-0x307093, 0x218666-0x231586, 0xe5f9c-0xfeebc, and 0x189485-0x1a1fa3.

The fifth executable-gap autopilot checkpoint adds vm_native_gap_retdec_batch233.c through vm_native_gap_retdec_batch238.c. Batch233 contributes 35 functions/ranges, batch234 contributes 27, batch235 contributes 53, batch236 contributes 60, batch237 contributes 36, and batch238 contributes 77. This run recovered a further 24576 executable bytes before the single-file checkpoint. The current all-evidence bundle syntax-checks as one C translation unit and records 729002 lines / 47971947 bytes, 286 sidecar sections, 6164 prefixed RetDec/manual native functions, 10974 native executable coverage range rows / 2406 executable gap rows, 1267430 recovered executable bytes, 4383610 uncovered executable bytes, 0 native RetDec gap-queue rows, 0 native RetDec gap-queue uncovered bytes, 152918 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, and completion_status=not_complete. The largest remaining executable gaps now begin at 0xe6d9c-0xfeebc, 0x189e85-0x1a1fa3, 0x143513-0x15b5b2, 0x219866-0x231586, and 0x2ef41e-0x307093.

The executable-gap path now has a less manual fast lane. vm_executable_gap_retdec_probe.py accepts --probe-jobs and probes RetDec/syntax candidates concurrently instead of one at a time. vm_executable_gap_retdec_autopilot.py passes that through and can run periodic or final single-file checkpoints with --checkpoint-frequency, --final-checkpoint, and optional --aggregate-syntax. make reconstruction-autopilot runs a longer bounded pass with 8 RetDec probe workers, periodic all-evidence/manifest checkpoints, and deferred aggregate GCC syntax checking. The first concurrent run added vm_native_gap_retdec_batch239.c: 8 selected executable-gap chunks, 62 RetDec functions/ranges, standalone C syntax clean, and another 4096 recovered executable bytes. The regenerated all-evidence bundle now records 730186 lines / 48047106 bytes, 287 sidecar sections, 6226 prefixed RetDec/manual native functions, 11044 native executable coverage range rows / 2408 executable gap rows, 1271526 recovered executable bytes, 4379514 uncovered executable bytes, 153603 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete. The expensive aggregate single-translation-unit compiler pass is intentionally deferred for this checkpoint; the last full aggregate GCC pass remains the batch238 checkpoint.

The next concurrent executable-gap autopilot pass added vm_native_gap_retdec_batch240.c through vm_native_gap_retdec_batch247.c with 8 selected chunks per batch. Batch240 contributes 54 functions/ranges, batch241 contributes 51, batch242 contributes 42, batch243 contributes 57, batch244 contributes 70, batch245 contributes 57, batch246 contributes 52, and batch247 contributes 29. All eight sidecars passed standalone C syntax during the autopilot run and recovered another 32768 executable bytes before the single-file checkpoint. The regenerated all-evidence bundle now records 739066 lines / 48626987 bytes, 295 sidecar sections, 6638 prefixed RetDec/manual native functions, 11520 native executable coverage range rows / 2421 executable gap rows, 1304294 recovered executable bytes, 4346746 uncovered executable bytes, 158890 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete. The full aggregate GCC pass remains deferred after the batch238 checkpoint so the automated recovery loop can keep converting executable gaps without spending most of its wall time on the 48 MiB translation-unit compile.

The following executable-gap pass added vm_native_gap_retdec_batch248.c through vm_native_gap_retdec_batch255.c. Batch248 initially exposed one new RetDec intrinsic spelling, __asm_rcl_133; the generator prelude now declares it, and the batch was rebuilt from its range file rather than patched by hand. Batch248 contributes 75 functions/ranges, batch249 contributes 47, batch250 contributes 61, batch251 contributes 33, batch252 contributes 71, batch253 contributes 51, batch254 contributes 55, and batch255 contributes 43. All eight sidecars passed standalone C syntax after the wrapper update and recovered another 32768 executable bytes into the single-file checkpoint. The regenerated all-evidence bundle now records 747812 lines / 49208633 bytes, 303 sidecar sections, 7074 prefixed RetDec/manual native functions, 12020 native executable coverage range rows / 2434 executable gap rows, 1337062 recovered executable bytes, 4313978 uncovered executable bytes, 164258 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next bounded executable-gap autopilot checkpoint added vm_native_gap_retdec_batch256.c through vm_native_gap_retdec_batch263.c, again with 8 selected chunks per batch and standalone syntax checks during the run. Batch256 contributes 68 functions/ranges, batch257 contributes 69, batch258 contributes 64, batch259 contributes 52, batch260 contributes 67, batch261 contributes 76, batch262 contributes 73, and batch263 contributes 59. This pass recovered another 32768 executable bytes before regenerating the single-file evidence bundle. The all-evidence bundle now records 757695 lines / 49843375 bytes, 311 sidecar sections, 7602 prefixed RetDec/manual native functions, 12612 native executable coverage range rows / 2448 executable gap rows, 1369830 recovered executable bytes, 4281210 uncovered executable bytes, 169961 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch264.c through vm_native_gap_retdec_batch271.c. This wave exposed two more RetDec prelude variants: int864_t/__asm_fnsave for a 108-byte x87 FPU save image and __readfsdword for FS segment reads. The generator now emits an opaque 108-byte int864_t carrier plus the missing helper declarations, and the affected batches were rebuilt from their range files. Batch264 contributes 55 functions/ranges, batch265 contributes 57, batch266 contributes 78, batch267 contributes 58, batch268 contributes 64, batch269 contributes 57, batch270 contributes 50, and batch271 contributes 30. The checkpoint recovered another 32768 executable bytes. The all-evidence bundle now records 766833 lines / 50441356 bytes, 319 sidecar sections, 8051 prefixed RetDec/manual native functions, 13125 native executable coverage range rows / 2458 executable gap rows, 1402598 recovered executable bytes, 4248442 uncovered executable bytes, 175393 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap autopilot checkpoint added vm_native_gap_retdec_batch272.c through vm_native_gap_retdec_batch279.c, with each batch selected by the concurrent probe and verified by standalone C syntax before coverage refresh. Batch272 contributes 58 functions/ranges, batch273 contributes 39, batch274 contributes 65, batch275 contributes 39, batch276 contributes 63, batch277 contributes 36, batch278 contributes 33, and batch279 contributes 53. This pass had no new generator-prelude failures and recovered another 32768 executable bytes. The all-evidence bundle now records 774891 lines / 50984233 bytes, 327 sidecar sections, 8437 prefixed RetDec/manual native functions, 13575 native executable coverage range rows / 2471 executable gap rows, 1435366 recovered executable bytes, 4215674 uncovered executable bytes, 180518 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch280.c through vm_native_gap_retdec_batch287.c. Batch285 exposed one more rare RetDec helper spelling, __asm_rsm; the generator prelude now declares it and batch285 was rebuilt from its range file. Batch280 contributes 56 functions/ranges, batch281 contributes 63, batch282 contributes 30, batch283 contributes 74, batch284 contributes 57, batch285 contributes 47, batch286 contributes 42, and batch287 contributes 53. This pass recovered another 32768 executable bytes before checkpointing the single-file evidence bundle. The all-evidence bundle now records 783938 lines / 51573565 bytes, 335 sidecar sections, 8859 prefixed RetDec/manual native functions, 14061 native executable coverage range rows / 2483 executable gap rows, 1468134 recovered executable bytes, 4182906 uncovered executable bytes, 185866 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch288.c through vm_native_gap_retdec_batch295.c. Batch289 exposed the SIMD helper spelling __asm_maxps; the generator prelude now declares it and the batch was rebuilt from its range file. Batch288 contributes 60 functions/ranges, batch289 contributes 48, batch290 contributes 46, batch291 contributes 74, batch292 contributes 33, batch293 contributes 77, batch294 contributes 45, and batch295 contributes 75. This pass recovered another 32768 executable bytes before checkpointing. The all-evidence bundle now records 793197 lines / 52173984 bytes, 343 sidecar sections, 9317 prefixed RetDec/manual native functions, 14583 native executable coverage range rows / 2497 executable gap rows, 1500902 recovered executable bytes, 4150138 uncovered executable bytes, 191330 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch296.c through vm_native_gap_retdec_batch303.c, with no new generator-prelude failures. Batch296 contributes 17 functions/ranges, batch297 contributes 70, batch298 contributes 78, batch299 contributes 10, batch300 contributes 46, batch301 contributes 33, batch302 contributes 62, and batch303 contributes 38. This pass recovered another 32768 executable bytes before checkpointing. The all-evidence bundle now records 801057 lines / 52703927 bytes, 351 sidecar sections, 9671 prefixed RetDec/manual native functions, 15001 native executable coverage range rows / 2504 executable gap rows, 1533670 recovered executable bytes, 4117370 uncovered executable bytes, 196370 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch304.c through vm_native_gap_retdec_batch311.c, again with no new generator-prelude failures. Batch304 contributes 43 functions/ranges, batch305 contributes 54, batch306 contributes 51, batch307 contributes 30, batch308 contributes 56, batch309 contributes 29, batch310 contributes 86, and batch311 contributes 28. This pass recovered another 32768 executable bytes before checkpointing. The all-evidence bundle now records 809394 lines / 53258439 bytes, 359 sidecar sections, 10048 prefixed RetDec/manual native functions, 15442 native executable coverage range rows / 2510 executable gap rows, 1566438 recovered executable bytes, 4084602 uncovered executable bytes, 201542 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch312.c through vm_native_gap_retdec_batch319.c, with no new generator-prelude failures. Batch312 contributes 79 functions/ranges, batch313 contributes 60, batch314 contributes 59, batch315 contributes 53, batch316 contributes 13, batch317 contributes 61, batch318 contributes 71, and batch319 contributes 55. This pass recovered another 32768 executable bytes before checkpointing. The all-evidence bundle now records 818656 lines / 53859198 bytes, 367 sidecar sections, 10499 prefixed RetDec/manual native functions, 15957 native executable coverage range rows / 2530 executable gap rows, 1599206 recovered executable bytes, 4051834 uncovered executable bytes, 206956 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch320.c through vm_native_gap_retdec_batch327.c, with no new generator-prelude failures. Batch320 contributes 49 functions/ranges, batch321 contributes 25, batch322 contributes 44, batch323 contributes 54, batch324 contributes 58, batch325 contributes 73, batch326 contributes 54, and batch327 contributes 53. This pass recovered another 32768 executable bytes before checkpointing. The all-evidence bundle now records 827310 lines / 54432655 bytes, 375 sidecar sections, 10909 prefixed RetDec/manual native functions, 16431 native executable coverage range rows / 2540 executable gap rows, 1631974 recovered executable bytes, 4019066 uncovered executable bytes, 212264 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

vm_executable_gap_retdec_probe.py now keeps dumps/vmtail-wide-1m-w16/vm_executable_gap_retdec_reject_cache.tsv, keyed by a fingerprint of vm_native_gap_retdec_batch.py, so repeated RetDec/syntax-hostile chunks are skipped on later probe rounds while generator-prelude fixes still invalidate stale rejects. The first cached run added vm_native_gap_retdec_batch328.c through vm_native_gap_retdec_batch335.c. Batch328 contributes 46 functions/ranges, batch329 contributes 31, batch330 contributes 63, batch331 contributes 29, batch332 contributes 33, batch333 contributes 62, batch334 contributes 70, and batch335 contributes 42. This pass recovered another 32768 executable bytes before checkpointing, and the reject cache now has 23 rejected ranges plus its header. The all-evidence bundle now records 835620 lines / 54986171 bytes, 383 sidecar sections, 11285 prefixed RetDec/manual native functions, 16871 native executable coverage range rows / 2554 executable gap rows, 1664742 recovered executable bytes, 3986298 uncovered executable bytes, 217425 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The next executable-gap checkpoint added vm_native_gap_retdec_batch336.c through vm_native_gap_retdec_batch343.c. Batch341 exposed one more generated port-output helper, __asm_out_138; the generator prelude now declares it and batch341 was rebuilt from its range file. Batch336 contributes 31 functions/ranges, batch337 contributes 31, batch338 contributes 27, batch339 contributes 41, batch340 contributes 36, batch341 contributes 71, batch342 contributes 45, and batch343 contributes 32. This pass recovered another 32768 executable bytes before checkpointing. The all-evidence bundle now records 843068 lines / 55501553 bytes, 391 sidecar sections, 11599 prefixed RetDec/manual native functions, 17249 native executable coverage range rows / 2562 executable gap rows, 1697510 recovered executable bytes, 3953530 uncovered executable bytes, 222424 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete.

The executable-gap autopilot now has failure salvage instead of requiring manual babysitting when a combined RetDec batch breaks after candidate probing. With --salvage-failed-batches, the driver quarantines the failed multi-range file, removes the bad sidecar, retries the ranges as single-range batches, keeps every standalone syntax-clean result, caches true rejects in vm_executable_gap_retdec_reject_cache.tsv, refreshes executable coverage once, and continues the run. make reconstruction-autopilot routes through RECONSTRUCTION_AUTOPILOT_ARGS, defaults to that salvage mode, and can be retuned from the command line without editing the Makefile. Periodic checkpoints are no longer in the default target; the recovery loop now defers the expensive all-evidence/manifest scan to the final checkpoint unless an explicit --checkpoint-frequency is supplied. The driver also accepts --skip-manifest for pure sidecar/all-evidence advancement when the manifest scan should be deferred even further.

The next salvage-enabled executable-gap pass added vm_native_gap_retdec_batch344.c through vm_native_gap_retdec_batch351.c, with no new generator-prelude failures and no salvage split required. Batch344 contributes 44 functions/ranges, batch345 contributes 26, batch346 contributes 63, batch347 contributes 14, batch348 contributes 53, batch349 contributes 73, batch350 contributes 41, and batch351 contributes 70. This pass recovered another 32768 executable bytes before checkpointing. The all-evidence bundle now records 851421 lines / 56060352 bytes, 399 sidecar sections, 11983 prefixed RetDec/manual native functions, 17697 native executable coverage range rows / 2572 executable gap rows, 1730278 recovered executable bytes, 3920762 uncovered executable bytes, 227666 prefixed evidence symbols, all_evidence_bundle_static_referenced_data_included=yes, all_evidence_bundle_binary_data_surface_match=yes, and completion_status=not_complete. The reject cache now has 74 rejected ranges plus its header.

The next fast executable-gap pass ran with --skip-manifest, so the single all-evidence C file was refreshed but the expensive manifest scan was intentionally deferred. It added vm_native_gap_retdec_batch352.c, vm_native_gap_retdec_batch353.c, salvaged split sidecars vm_native_gap_retdec_batch354.c through vm_native_gap_retdec_batch361.c, vm_native_gap_retdec_batch362.c through vm_native_gap_retdec_batch364.c, salvaged split sidecars vm_native_gap_retdec_batch365.c through vm_native_gap_retdec_batch372.c, and vm_native_gap_retdec_batch373.c. The combined batch354 candidate exposed __asm_frstor, and the combined batch365 candidate exposed __writefsbyte; the generator prelude now declares both so future batches do not need to discover those names by failure. The split batches are retained as syntax-clean sidecars and the quarantined originals are stored as native_gap_retdec_batch354.ranges.failed and native_gap_retdec_batch365.ranges.failed, outside Make's active range glob. This pass recovered another 32768 executable bytes after batch351: current executable coverage is 18099 recovered range rows / 2581 executable gap rows, 1763046 recovered executable bytes, and 3887994 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 864091 lines / 57101341 bytes, 421 sidecar sections, 12321 prefixed RetDec/manual native functions, and 239584 prefixed evidence symbols. The static data carrier is still present in the bundle (22 emitted ELF section byte arrays, string-reference row assertion present, dispatch-table offsets and raw 2880-byte table present), but the manifest metrics remain at the batch351 checkpoint until the deferred manifest scan is run.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch374.c through vm_native_gap_retdec_batch379.c, salvaged split sidecars vm_native_gap_retdec_batch380.c through vm_native_gap_retdec_batch387.c, and salvaged split sidecars vm_native_gap_retdec_batch388.c through vm_native_gap_retdec_batch395.c. The combined batch380 candidate exposed one more SIMD helper, __asm_pavgw; the generator prelude now declares it. The combined batch388 candidate hit a RetDec malformed-label case (lab_0x460c48_2 used but not defined), but single-range salvage recovered all eight selected ranges without keeping the malformed aggregate. The quarantined originals are stored as native_gap_retdec_batch380.ranges.failed and native_gap_retdec_batch388.ranges.failed, again outside Make's active range glob. This pass recovered another 32768 executable bytes: current executable coverage is 18596 recovered range rows / 2587 executable gap rows, 1795814 recovered executable bytes, and 3855226 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 878022 lines / 58206138 bytes, 443 sidecar sections, 12754 prefixed RetDec/manual native functions, and 251916 prefixed evidence symbols. The reject cache now has 86 rejected ranges plus its header under the current generator-key history.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch396.c through vm_native_gap_retdec_batch403.c without needing salvage or new generator-prelude declarations. Batch396 contributes 70 functions/ranges, batch397 contributes 44, batch398 contributes 35, batch399 contributes 39, batch400 contributes 54, batch401 contributes 50, batch402 contributes 65, and batch403 contributes 63. This pass recovered another 32768 executable bytes: current executable coverage is 19080 recovered range rows / 2596 executable gap rows, 1828582 recovered executable bytes, and 3822458 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 886791 lines / 58787093 bytes, 451 sidecar sections, 13174 prefixed RetDec/manual native functions, and 257292 prefixed evidence symbols. The reject cache now has 95 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch403.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch404.c through vm_native_gap_retdec_batch411.c without needing salvage or new generator-prelude declarations. Batch404 contributes 53 functions/ranges, batch405 contributes 40, batch406 contributes 27, batch407 contributes 19, batch408 contributes 59, batch409 contributes 49, batch410 contributes 59, and batch411 contributes 60. This pass recovered another 32768 executable bytes: current executable coverage is 19510 recovered range rows / 2604 executable gap rows, 1861350 recovered executable bytes, and 3789690 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 894575 lines / 59321914 bytes, 459 sidecar sections, 13540 prefixed RetDec/manual native functions, and 262445 prefixed evidence symbols. The reject cache now has 103 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch411.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch412.c through vm_native_gap_retdec_batch419.c without needing salvage or new generator-prelude declarations. Batch412 contributes 61 functions/ranges, batch413 contributes 60, batch414 contributes 63, batch415 contributes 61, batch416 contributes 63, batch417 contributes 27, batch418 contributes 51, and batch419 contributes 75. This pass recovered another 32768 executable bytes: current executable coverage is 20035 recovered range rows / 2616 executable gap rows, 1894118 recovered executable bytes, and 3756922 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 903645 lines / 59915234 bytes, 467 sidecar sections, 14001 prefixed RetDec/manual native functions, and 267953 prefixed evidence symbols. The reject cache now has 112 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch419.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch420.c through vm_native_gap_retdec_batch424.c, salvaged split sidecars vm_native_gap_retdec_batch425.c through vm_native_gap_retdec_batch432.c, and added vm_native_gap_retdec_batch433.c through vm_native_gap_retdec_batch434.c. The combined batch425 candidate exposed one more SIMD helper, __asm_pcmpgtb; the generator prelude now declares it. Single-range salvage recovered all eight selected ranges and the quarantined aggregate is stored as native_gap_retdec_batch425.ranges.failed, outside Make's active range glob. Batch420 contributes 54 functions/ranges, batch421 contributes 62, batch422 contributes 66, batch423 contributes 51, batch424 contributes 28, split batch425 contributes 10, split batch426 contributes 7, split batch427 contributes 7, split batch428 contributes 7, split batch429 contributes 10, split batch430 contributes 12, split batch431 contributes 6, split batch432 contributes 6, batch433 contributes 42, and batch434 contributes 26. This pass recovered another 32768 executable bytes: current executable coverage is 20493 recovered range rows / 2629 executable gap rows, 1926886 recovered executable bytes, and 3724154 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 914584 lines / 60738197 bytes, 482 sidecar sections, 14395 prefixed RetDec/manual native functions, and 276735 prefixed evidence symbols. The reject cache now has 156 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch434.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch435.c through vm_native_gap_retdec_batch442.c without needing salvage or new generator-prelude declarations. Batch435 contributes 55 functions/ranges, batch436 contributes 38, batch437 contributes 74, batch438 contributes 35, batch439 contributes 43, batch440 contributes 60, batch441 contributes 65, and batch442 contributes 58. This pass recovered another 32768 executable bytes while probing through a dense reject band around the 0x4e**** executable region. Current executable coverage is 20985 recovered range rows / 2640 executable gap rows, 1959654 recovered executable bytes, and 3691386 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 923421 lines / 61326275 bytes, 490 sidecar sections, 14823 prefixed RetDec/manual native functions, and 282187 prefixed evidence symbols. The reject cache now has 204 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch442.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch443.c through vm_native_gap_retdec_batch450.c without needing salvage or new generator-prelude declarations. Batch443 contributes 76 functions/ranges, batch444 contributes 58, batch445 contributes 15, batch446 contributes 60, batch447 contributes 72, batch448 contributes 62, batch449 contributes 32, and batch450 contributes 53. This pass recovered another 32768 executable bytes while continuing to cache one-time rejects from the 0x4e**** band. Current executable coverage is 21477 recovered range rows / 2648 executable gap rows, 1992422 recovered executable bytes, and 3658618 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 932171 lines / 61903935 bytes, 498 sidecar sections, 15251 prefixed RetDec/manual native functions, and 287579 prefixed evidence symbols. The reject cache now has 216 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch450.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch451.c through vm_native_gap_retdec_batch458.c without needing salvage or new generator-prelude declarations. Batch451 contributes 58 functions/ranges, batch452 contributes 39, batch453 contributes 58, batch454 contributes 16, batch455 contributes 33, batch456 contributes 67, batch457 contributes 51, and batch458 contributes 56. This pass recovered another 32768 executable bytes. Current executable coverage is 21919 recovered range rows / 2662 executable gap rows, 2025190 recovered executable bytes, and 3625850 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 940597 lines / 62472172 bytes, 506 sidecar sections, 15629 prefixed RetDec/manual native functions, and 292895 prefixed evidence symbols. The reject cache now has 227 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch458.

The next --skip-manifest executable-gap pass added salvaged split sidecars vm_native_gap_retdec_batch459.c through vm_native_gap_retdec_batch466.c, then added vm_native_gap_retdec_batch467.c through vm_native_gap_retdec_batch473.c. The combined batch459 candidate exposed __writegsdword; the generator prelude now declares it, and single-range salvage recovered all eight selected ranges. The quarantined aggregate is stored as native_gap_retdec_batch459.ranges.failed, outside Make's active range glob. Split batch459 contributes 9 functions/ranges, split batch460 contributes 13, split batch461 contributes 9, split batch462 contributes 3, split batch463 contributes 9, split batch464 contributes 3, split batch465 contributes 7, split batch466 contributes 5, batch467 contributes 90, batch468 contributes 31, batch469 contributes 80, batch470 contributes 59, batch471 contributes 62, batch472 contributes 18, and batch473 contributes 67. This pass recovered another 32768 executable bytes. Current executable coverage is 22448 recovered range rows / 2669 executable gap rows, 2057958 recovered executable bytes, and 3593082 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 952279 lines / 63333206 bytes, 521 sidecar sections, 16094 prefixed RetDec/manual native functions, and 301935 prefixed evidence symbols. The reject cache now has 237 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch473.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch474.c through vm_native_gap_retdec_batch479.c, salvaged split sidecars vm_native_gap_retdec_batch480.c through vm_native_gap_retdec_batch487.c, and added vm_native_gap_retdec_batch488.c. The combined batch480 candidate hit a RetDec type mismatch around __asm_fnsave and the opaque int864_t carrier; single-range salvage recovered all eight selected ranges and the quarantined aggregate is stored as native_gap_retdec_batch480.ranges.failed. Batch474 contributes 70 functions/ranges, batch475 contributes 47, batch476 contributes 44, batch477 contributes 57, batch478 contributes 52, batch479 contributes 37, split batch480 contributes 5, split batch481 contributes 8, split batch482 contributes 7, split batch483 contributes 8, split batch484 contributes 5, split batch485 contributes 10, split batch486 contributes 9, split batch487 contributes 4, and batch488 contributes 43. This pass recovered another 32768 executable bytes. Current executable coverage is 22918 recovered range rows / 2677 executable gap rows, 2090726 recovered executable bytes, and 3560314 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 963924 lines / 64199224 bytes, 536 sidecar sections, 16500 prefixed RetDec/manual native functions, and 310996 prefixed evidence symbols. The reject cache now has 246 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch488.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch489.c through vm_native_gap_retdec_batch496.c without needing salvage or new generator-prelude declarations. Batch489 contributes 54 functions/ranges, batch490 contributes 60, batch491 contributes 54, batch492 contributes 33, batch493 contributes 47, batch494 contributes 68, batch495 contributes 36, and batch496 contributes 28. This pass recovered another 32768 executable bytes. Current executable coverage is 23362 recovered range rows / 2689 executable gap rows, 2123494 recovered executable bytes, and 3527546 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 972273 lines / 64763113 bytes, 544 sidecar sections, 16880 prefixed RetDec/manual native functions, and 316336 prefixed evidence symbols. The reject cache now has 255 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch496.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch497.c through vm_native_gap_retdec_batch504.c without needing salvage or new generator-prelude declarations. Batch497 contributes 46 functions/ranges, batch498 contributes 63, batch499 contributes 56, batch500 contributes 80, batch501 contributes 61, batch502 contributes 54, batch503 contributes 65, and batch504 contributes 73. This pass recovered another 32768 executable bytes. Current executable coverage is 23924 recovered range rows / 2703 executable gap rows, 2156262 recovered executable bytes, and 3494778 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 981701 lines / 65374717 bytes, 552 sidecar sections, 17378 prefixed RetDec/manual native functions, and 321971 prefixed evidence symbols. The reject cache now has 266 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch504.

The next --skip-manifest executable-gap pass added vm_native_gap_retdec_batch505.c through vm_native_gap_retdec_batch507.c, salvaged split sidecars vm_native_gap_retdec_batch508.c through vm_native_gap_retdec_batch515.c, and added vm_native_gap_retdec_batch516.c through vm_native_gap_retdec_batch519.c. The combined batch508 candidate exposed __asm_vdivpd; the generator prelude now declares it, and single-range salvage recovered all eight selected ranges. Batch505 contributes 44 functions/ranges, batch506 contributes 19, batch507 contributes 48, split batch508 contributes 4, split batch509 contributes 2, split batch510 contributes 2, split batch511 contributes 4, split batch512 contributes 12, split batch513 contributes 11, split batch514 contributes 7, split batch515 contributes 14, batch516 contributes 55, batch517 contributes 36, batch518 contributes 80, and batch519 contributes 47. This pass recovered another 32768 executable bytes. Current executable coverage is 24373 recovered range rows / 2716 executable gap rows, 2189030 recovered executable bytes, and 3457898 uncovered executable bytes. The refreshed all-evidence bundle directly scans as 992340 lines / 66186214 bytes, 567 sidecar sections, 17763 prefixed RetDec/manual native functions, and 330728 prefixed evidence symbols. The reject cache now has 274 rejected ranges plus its header. The manifest remains intentionally deferred after batch351; the all-evidence C file and coverage audit are current through batch519, and completion_status remains not_complete.

vm_uncovered_executable_gaps.py now emits a lossless C/TSV/Markdown carrier for every currently uncovered executable byte from the native executable coverage audit. The generated vm_uncovered_executable_gaps.c contains 2716 exact gap byte arrays totaling 3462010 bytes, with metadata rows keyed by original section and virtual address range; this exactly matches the audit's remaining executable gap rows, including .text, .init, .plt, .plt.got, and .fini. The all-evidence bundler includes this carrier as an already-namespaced sidecar, raising the single C artifact to 1293112 lines / 88586071 bytes and 568 sidecar sections while preserving 17763 prefixed RetDec/manual native functions and 330728 prefixed evidence symbols. The full aggregate vm_recovered_source_all_evidence_bundle.c now passes cc -std=c11 -fsyntax-only -w, after fixing the sidecar sanitizer to rewrite anonymous RetDec carrier typedefs such as int864_t per sidecar. This does not mean all bytes have decompiled semantics, but the single C evidence file now has exact C-resident bytes for every remaining uncovered executable range.

The executable-gap autopilot now refreshes vm_uncovered_executable_gaps.{c,tsv,md} after every coverage update and can run make reconstruction-completion-audit at its final checkpoint; make reconstruction-autopilot enables that audit by default. A bounded audited pass added vm_native_gap_retdec_batch520.c through vm_native_gap_retdec_batch523.c without salvage. Batch520 contributes 52 functions/ranges, batch521 contributes 46, batch522 contributes 67, and batch523 contributes 60. This pass recovered another 16384 executable bytes. Current .text semantic coverage is 24630 recovered range rows / 2716 .text gap rows, 2205414 recovered .text bytes, and 3441514 uncovered .text bytes (39.05%). The exact uncovered executable carrier now matches 2720 audit gap rows / 3445626 executable bytes. The refreshed all-evidence bundle directly scans as 1296449 lines / 88788427 bytes, 572 sidecar sections, 17988 prefixed RetDec/manual native functions, and 333477 prefixed evidence symbols. The reject cache now has 278 rejected ranges plus its header. make reconstruction-completion-audit passes its artifact checks and aggregate C syntax gate, but still reports completion_status=not_complete.

vm_executable_gap_retdec_probe.py and the autopilot now accept repeated --section filters, so targeted RetDec probing can address executable sections outside .text instead of only carrying them as bytes. A focused non-.text pass over .init, .plt, .plt.got, and .fini added vm_native_gap_retdec_batch524.c; RetDec recovered _fini for 0x583650-0x583659, while .init, .plt, and .plt.got rejected under the current generator and are cached to avoid repeated failed probes. This recovered another 9 executable bytes. Current status is latest batch 524, 573 sidecar sections, 17988 prefixed RetDec/manual native functions, 333983 prefixed evidence symbols, 2205414 recovered .text bytes, 3441514 uncovered .text bytes, and an exact uncovered carrier matching 2719 audit gap rows / 3445617 executable bytes. The full aggregate C syntax gate still passes and completion_status remains not_complete.

vm_native_linkage_stubs.py now mechanically reconstructs ELF linkage veneers from objdump/section metadata into vm_native_linkage_stubs.c, .tsv, and .md. The C sidecar emits one syntax-checkable function per _init, PLT, PLT.GOT, and _fini stub with exact // Address range comments, so the native executable coverage audit can credit deterministic linker stubs without relying on RetDec. This removes the remaining non-.text executable gaps from the audit. The all-evidence bundle now scans as 1299051 lines / 88937351 bytes, 574 sidecar sections, 17988 prefixed RetDec/manual native functions, and 334244 prefixed evidence symbols. make reconstruction-completion-audit verifies the uncovered carrier matches 2716 audit gap rows / 3441514 bytes, and those remaining gaps are all .text; aggregate C syntax still passes. completion_status remains not_complete because .text semantic coverage is still 2205414/5646928 bytes (39.05%).

vm_executable_gap_retdec_probe.py now adaptively splits rejected executable-gap candidates down to --min-chunk-bytes; the default reconstruction autopilot uses --chunk-bytes 0x200 --min-chunk-bytes 0x100. A bounded audited pass added vm_native_gap_retdec_batch525.c through vm_native_gap_retdec_batch528.c. Batch525 contributes 38 functions/ranges, batch526 contributes 61, batch527 contributes 22, and batch528 contributes 49. Batch528 demonstrates the split path: 0x42da93-0x42dc93 rejected as a 0x200 chunk, but the split probe recovered the clean 0x42da93-0x42db93 half instead of losing the entire parent range. This pass recovered another 16128 .text bytes. Current status is latest batch 528, 1301538 all-evidence lines / 89100815 bytes, 578 sidecar sections, 18158 prefixed RetDec/manual native functions, 336832 prefixed evidence symbols, 24832 recovered .text range rows, 2221542 recovered .text bytes, 3425386 uncovered .text bytes (39.34%), and an exact carrier matching 2717 gap rows / 3425386 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The executable-gap probe now also recursively expands old cached rejected parent ranges into untried children, so pre-split reject-cache rows no longer permanently hide recoverable subranges. The next audited pass added vm_native_gap_retdec_batch529.c through vm_native_gap_retdec_batch532.c. Batch529 contributes 51 functions/ranges, batch530 contributes 68, batch531 contributes 60, and batch532 contributes 43. Split recovery was active in this pass as well: rejected parents including 0x42141f-0x42161f, 0x47c430-0x47c630, 0x440467-0x440667, 0x440067-0x440267, 0x440667-0x440867, and 0x1123bf-0x1125bf were divided into 0x100 children, with clean halves accepted and hostile halves cached. This pass recovered another 15360 .text bytes. Current status is latest batch 532, 1304767 all-evidence lines / 89299032 bytes, 582 sidecar sections, 18380 prefixed RetDec/manual native functions, 339541 prefixed evidence symbols, 25086 recovered .text range rows, 2236902 recovered .text bytes, 3410026 uncovered .text bytes (39.61%), and an exact carrier matching 2724 gap rows / 3410026 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited split-aware pass added vm_native_gap_retdec_batch533.c through vm_native_gap_retdec_batch536.c. Batch533 contributes 59 functions/ranges, batch534 contributes 51, batch535 contributes 66, and batch536 contributes 36. The probe again split hostile parents such as 0x447925-0x447b25, 0x448125-0x448325, 0x2ffa1e-0x2ffc1e, and 0x465634-0x465834, caching true rejects while preserving surrounding clean chunks. This pass recovered another 16384 .text bytes. Current status is latest batch 536, 1307656 all-evidence lines / 89482388 bytes, 586 sidecar sections, 18592 prefixed RetDec/manual native functions, 342237 prefixed evidence symbols, 25330 recovered .text range rows, 2253286 recovered .text bytes, 3393642 uncovered .text bytes (39.90%), and an exact carrier matching 2726 gap rows / 3393642 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The default reconstruction autopilot now lowers adaptive split granularity to --min-chunk-bytes 0x80 after a diagnostic showed recoverable children below 0x100 in cached rejects. The next audited pass added vm_native_gap_retdec_batch537.c through vm_native_gap_retdec_batch540.c. Batch537 contributes 60 functions/ranges, batch538 contributes 79, batch539 contributes 56, and batch540 contributes 71. This pass recovered another 15872 .text bytes while splitting hostile parents such as 0x474eee-0x4750ee, 0x474cee-0x474eee, 0x2366b6-0x2368b6, 0x128edc-0x1290dc, and 0x2b3375-0x2b3575. Current status is latest batch 540, 1311169 all-evidence lines / 89694480 bytes, 590 sidecar sections, 18858 prefixed RetDec/manual native functions, 345091 prefixed evidence symbols, 25628 recovered .text range rows, 2269158 recovered .text bytes, 3377770 uncovered .text bytes (40.18%), and an exact carrier matching 2732 gap rows / 3377770 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added split-salvaged vm_native_gap_retdec_batch541.c through vm_native_gap_retdec_batch548.c, then added vm_native_gap_retdec_batch549.c through vm_native_gap_retdec_batch551.c. The combined batch541 exposed __asm_pmaxub; the generator prelude now declares it, and all eight selected ranges salvaged cleanly as single-range sidecars. Split batches541-548 contribute 6, 13, 9, 11, 5, 12, 17, and 15 functions/ranges respectively; batch549 contributes 43, batch550 contributes 38, and batch551 contributes 61. This pass recovered another 16128 .text bytes. During post-checks, a previously interrupted status rebuild had deleted vm_native_gap_retdec_batch149.c and regenerated some older sidecars; batch149 was restored, and the generator prelude now declares unknown_b6ccb9 as int64_t so regenerated batch127 and the aggregate bundle syntax-check cleanly. Current status is latest batch 551, 1321220 all-evidence lines / 90635353 bytes, 601 sidecar sections, 19088 prefixed RetDec/manual native functions, 358888 prefixed evidence symbols, 25890 recovered .text range rows, 2285286 recovered .text bytes, 3361642 uncovered .text bytes (40.46%), and an exact carrier matching 2734 gap rows / 3361642 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added vm_native_gap_retdec_batch552.c through vm_native_gap_retdec_batch555.c. Batch552 contributes 37 functions/ranges, batch553 contributes 72, batch554 contributes 55, and batch555 contributes 22. This pass recovered another 16384 .text bytes while caching split rejects around 0x448325-0x448525, 0x448125-0x448325, and 0x1754aa-0x1756aa. Current status is latest batch 555, 1323910 all-evidence lines / 90805729 bytes, 605 sidecar sections, 19274 prefixed RetDec/manual native functions, 361495 prefixed evidence symbols, 26108 recovered .text range rows, 2301670 recovered .text bytes, 3345258 uncovered .text bytes (40.75%), and an exact carrier matching 2737 gap rows / 3345258 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added vm_native_gap_retdec_batch556.c, vm_native_gap_retdec_batch557.c, split-salvaged vm_native_gap_retdec_batch558.c through vm_native_gap_retdec_batch565.c, and added vm_native_gap_retdec_batch566.c. Batch556 contributes 25 functions/ranges, batch557 contributes 36, split batches558-565 contribute 8, 9, 10, 4, 7, 6, 2, and 7, and batch566 contributes 75. The combined batch558 exposed a 256-bit SIMD prelude gap (int256_t, __asm_vpcmpeqw, and __asm_psadbw); the generator now declares those carriers/helpers, and single-range salvage recovered all eight selected ranges. This pass recovered another 15872 .text bytes. Current status is latest batch 566, 1329210 all-evidence lines / 91248313 bytes, 616 sidecar sections, 19463 prefixed RetDec/manual native functions, 367728 prefixed evidence symbols, 26329 recovered .text range rows, 2317542 recovered .text bytes, 3329386 uncovered .text bytes (41.04%), and an exact carrier matching 2744 gap rows / 3329386 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added vm_native_gap_retdec_batch567.c through vm_native_gap_retdec_batch570.c. Batch567 contributes 64 functions/ranges, batch568 contributes 28, batch569 contributes 44, and batch570 contributes 35. This pass recovered another 14848 .text bytes while splitting and caching additional true rejects around 0x37f930-0x37fb30, 0x465a34-0x465c34, 0x465c34-0x465e34, 0x24e0bc-0x24e2bc, 0x47d430-0x47d630, and 0x47d030-0x47d230. The aggregate syntax pass initially exposed that the all-evidence bundler also needed to treat int256_t as a fixed RetDec carrier typedef; vm_recovered_source_all_evidence_bundle.py now prefixes it per sidecar like int864_t. Current status is latest batch 570, 1331934 all-evidence lines / 91430550 bytes, 620 sidecar sections, 19634 prefixed RetDec/manual native functions, 370387 prefixed evidence symbols, 26532 recovered .text range rows, 2332390 recovered .text bytes, 3314538 uncovered .text bytes (41.30%), and an exact carrier matching 2750 gap rows / 3314538 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added vm_native_gap_retdec_batch571.c through vm_native_gap_retdec_batch573.c, then split-salvaged vm_native_gap_retdec_batch574.c through vm_native_gap_retdec_batch581.c. Batch571 contributes 65 functions/ranges, batch572 contributes 20, batch573 contributes 62, and split batches574-581 contribute 12, 13, 6, 6, 5, 2, 7, and 7. The combined batch574 exposed __asm_vpunpckhdq; the generator now declares it, and single-range salvage recovered all eight selected ranges. This pass recovered another 15872 .text bytes. Current status is latest batch 581, 1337469 all-evidence lines / 91888141 bytes, 631 sidecar sections, 19839 prefixed RetDec/manual native functions, 376730 prefixed evidence symbols, 26769 recovered .text range rows, 2348262 recovered .text bytes, 3298666 uncovered .text bytes (41.58%), and an exact carrier matching 2755 gap rows / 3298666 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added vm_native_gap_retdec_batch582.c through vm_native_gap_retdec_batch585.c. Batch582 contributes 53 functions/ranges, batch583 contributes 55, batch584 contributes 61, and batch585 contributes 62. This pass recovered another 16384 .text bytes while splitting and caching true rejects around 0x4000d1-0x4002d1, 0x1ef2e8-0x1ef4e8, 0x2370b6-0x2372b6, and 0x22ae66-0x22b066. Current status is latest batch 585, 1340931 all-evidence lines / 92101384 bytes, 635 sidecar sections, 20070 prefixed RetDec/manual native functions, 379621 prefixed evidence symbols, 27032 recovered .text range rows, 2364646 recovered .text bytes, 3282282 uncovered .text bytes (41.87%), and an exact carrier matching 2760 gap rows / 3282282 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added vm_native_gap_retdec_batch586.c through vm_native_gap_retdec_batch589.c. Batch586 contributes 62 functions/ranges, batch587 contributes 57, batch588 contributes 73, and batch589 contributes 37. This pass recovered another 15872 .text bytes while splitting and caching true rejects around 0x1c5955-0x1c5b55, 0x2642c2-0x2644c2, 0x242018-0x242218, and 0x2644c2-0x2646c2. Current status is latest batch 589, 1344224 all-evidence lines / 92309545 bytes, 639 sidecar sections, 20299 prefixed RetDec/manual native functions, 382509 prefixed evidence symbols, 27293 recovered .text range rows, 2380518 recovered .text bytes, 3266410 uncovered .text bytes (42.15%), and an exact carrier matching 2764 gap rows / 3266410 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The next audited 0x80 split pass added vm_native_gap_retdec_batch590.c through vm_native_gap_retdec_batch593.c. Batch590 contributes 51 functions/ranges, batch591 contributes 36, batch592 contributes 22, and batch593 contributes 14. This pass recovered another 16384 .text bytes while caching true rejects around 0x448b25-0x448d25, 0xf879c-0xf899c, 0x42281f-0x422a1f, 0x1c5955-0x1c5b55, 0x2642c2-0x2644c2, 0x242018-0x242218, and 0x2644c2-0x2646c2. Current status is latest batch 593, 1346172 all-evidence lines / 92447861 bytes, 643 sidecar sections, 20422 prefixed RetDec/manual native functions, 384967 prefixed evidence symbols, 27448 recovered .text range rows, 2396902 recovered .text bytes, 3250026 uncovered .text bytes (42.44%), and an exact carrier matching 2768 gap rows / 3250026 bytes. make reconstruction-completion-audit still passes artifact and aggregate syntax checks but reports completion_status=not_complete.

The all-evidence bundle now carries the program string/data surface in C form as exact emitted ELF runtime section byte arrays plus all allocatable-section metadata, full string-reference rows with backing pointers, C11 row-count assertions, and raw dispatch-table bytes/offsets. The manifest records binary_data_section_arrays_match_index=yes, binary_data_section_metadata_rows_match_index=yes, binary_data_string_rows_match_index=yes, all_evidence_bundle_binary_data_surface_match=yes, and all_evidence_bundle_static_referenced_data_included=yes, so the single C file is checked against the data carrier for section arrays, section metadata, full strings, and dispatch-table bytes. This satisfies the single-file evidence requirement for static program data referenced from the ELF image; it does not prove every dynamically generated, decrypted, or network-delivered runtime buffer unless that buffer is separately captured or statically decoded.

The normal C check and manifest refresh paths are no longer tied to phony pseudocode/reconstruction aggregate prerequisites. pseudocode-syntax-check, pseudocode-object-check, pseudocode-link-check, and c-reconstruction-manifest now depend on concrete generated C/artifact file targets where possible, so unchanged checks skip bytecode catalog, synthetic probe, coverage, and RetDec sidecar regeneration. Native gap batches are now range-file-discovered by Make, all-evidence sidecar discovery is globbed, and manifest metrics include future native gap batches dynamically. make native-gap-retdec-checkpoint runs the automated queue-driven checkpoint loop through vm_native_gap_retdec_checkpoint.py: it plans the next ranges, builds only the new native gap RetDec sidecars in parallel, syntax-checks them, refreshes native coverage/queue once, rebuilds the all-evidence bundle/manifest once, and syntax-checks the aggregate C file. The latest native gap salvage checkpoint added split batch189 through that automated path and passed standalone sidecar syntax, native coverage/queue refresh, all-evidence bundle regeneration, manifest regeneration, and aggregate all-evidence C syntax in one staged checkpoint.

make reconstruction-status is now the cheap progress query for token-efficient checkpoints. It reads the current all-evidence bundle, native executable coverage TSV, and reject cache, then prints latest batch, bundle line/byte size, sidecar/function/symbol counts, .text recovered/uncovered bytes, gap rows, reject count, and explicit completion_status=not_complete without refreshing the expensive manifest.

make reconstruction-completion-audit now maps the full reconstruction goal to concrete artifact checks. The current audit verifies that the all-evidence bundle exists, the native executable coverage audit exists, the uncovered executable carrier exists, the carrier exactly matches all 2716 executable gap rows / 3462010 gap bytes from the coverage audit, the bundle includes both the binary-data sidecar and uncovered-executable carrier, and the full aggregate C file passes cc -std=c11 -fsyntax-only -w. It still reports completion_status=not_complete because .text semantic coverage is only 2189030/5646928 bytes (38.76%) and 3457898 .text bytes remain without decompiled/manual semantics.

make unresolved-family-chains builds the native vm_unresolved_family_chains_dump renderer and writes vm_unresolved_family_chains.c, a syntax-checkable C evidence view for the 15 residual native-ret-patch / observed-chain families. The file currently has 15 residual_start_* functions, 16 native ret-patch records, 57 observed-chain reconciliation steps, and a dispatcher keyed by residual VM IP. This keeps the non-hard-CFG layer inspectable as C without pretending those observed chains are direct bytecode CFG promotions.

make native-ret-patch-followups builds the native vm_native_ret_patch_followups_dump classifier and writes vm_native_ret_patch_followups.c, .tsv, and .md. The current C artifact has 39 followup_target_* functions and 39 dispatcher cases: 16 local in-window branches, 6 post-window adjacent branches, 1 __stack_chk_fail@plt call target, 2 allocator/free wrapper targets, 1 source278 downstream target already covered by targeted RetDec, 3 recovered/bounded internal helpers, 2 targeted RetDec helper candidates, 1 targeted obfuscation helper, and 7 obfuscated native islands. make native-ret-patch-followup-retdec then runs a native wrapper/postprocessor around one bounded RetDec pass and writes vm_native_ret_patch_followup_retdec.c, currently 917 lines with 6 C functions for 0x21a50, 0x2508e, 0x72588, 0x7260a, 0x72bbc, and 0x48eb2b. make native-obfuscated-islands builds the native vm_native_obfuscated_islands_dump classifier and writes an 8-row C/TSV/Markdown island map: 0x23122 -> 0xe0017, 0xe0017 -> 0xcdc60, 0x17bf1f -> 0xc9849, 0x231586 -> 0xcf3c7, 0x337d35 -> 0xc6d58, 0x33b4b6 -> 0xc4258, 0x33f109 -> 0xcaf2a, and 0x36afd2 -> 0xc57b8. Two collapsed downstreams (0xcdc60, 0xcf3c7) are already in source278 RetDec. make native-obfuscated-second-stage then writes a 5-row C/TSV/Markdown computed-thunk map for 0xc9849, 0xc6d58, 0xc4258, 0xcaf2a, and 0xc57b8: all five reach exact jmp [rax] sites after two internal loop edges. make native-obfuscated-second-stage-dynamic writes a 5-row dynamic target index with 28 focused dispatch hits across those sites, resolving the observed computed jumps to handler entries 86, 169, 310, and 323; all 28 observed slot indices match the handler-table target they jump to. make native-obfuscated-second-stage-slot-proof then proves the shared static formula with Capstone: each site computes rax_final = rax_initial + (rbx << 3), all immediate-noise ladders cancel to net_rax_delta=0, and all 28 dynamic rows also satisfy slot_off - idx == 0xc3718. make native-obfuscated-second-stage-rbx-provenance adds single-step probe proof for the upstream index carrier: in 10 observed rows, rsp+0x88 at the push site becomes the pre-shift rbx, and that value shifted by 3 is the dispatch index. The remaining strategic queue is broader config coverage and static generalization of the stack-entry source, not another broad decompiler sweep.

vm_synthetic_gap_transfer_probe.py now probes the 21 remaining synthetic-successor holes instead of leaving them as an undifferentiated unresolved bucket. After the Python static transfer replayers learned the same restore-trampoline rule as the native fast model, simple register push/pop operands are preserved instead of clobbering seeded or symbolic registers. That changes the former 20 live-in tail rows into normal symbolic dispatch expressions: all 21 probe rows now classify as symbolic_slot_expr. One source-246 gap reduces to next = T[u16_0 << 0x3] with ip = u32_4, and the zero-seeded concrete path lands on entry 354 at +0x1870; the other 20 remain symbolic slot/IP formulas whose final target is not concretized under zero seed. The former source-246 gap at 0x370249 is no longer in this bucket because the recovered hidden span lands on the split block at 0x370258, and source 356's former row no longer appears after embedded VMTAIL parsing recovers the 0x2c0468 block island. The full C-like program sketch and combined source bundle carry transfer-probe comments at all 21 probe sites; after the hidden-chain and focused-direct promotions, 15 of those sites are emitted as sampled native ret-patch exits rather than unresolved synthetic-tail calls.

vm_synthetic_gap_live_in_roles.py now emits only its header row: there are 0 current live-in synthetic gap rows after the transfer replay preserves restore-trampoline stack-register operations. The focused GPR/scratch and EAC_VMTAIL_MEM=1 traces remain useful archived evidence for native tail mechanics, but they no longer feed active live-in comments into vm_program_pseudocode_full.c or vm_recovered_source_bundle.c. Consequently vm_live_in_final_tail_site_probe.py, vm_synthetic_gap_live_in_reentry_probe.py, and vm_synthetic_gap_allstatic_reentry_probe.py also emit 0 data rows in the current manifest. The remaining blocker is not live dispatch-slot GPR recovery; it is turning the symbolic slot expressions plus dynamic/native-ret-patch evidence for the 15 non-hard-CFG sites into recovered block starts, statically replayed hidden chains, or tighter native C-level control.

vm_synthetic_gap_symbolic_successors.py now audits the one remaining source-246 symbolic-slot candidate before promoting it into a CFG edge. It is still a zero-seeded static candidate, not dynamic proof. The 0x293689 zero-seed candidate is entry=354, delta=+0x1870, giving concrete destination 0x294ef9, which is outside the currently recovered bytecode rows and disagrees with the next hooked VMTAIL end 0x2bec2e. The full C-like program and bundle carry this audit next to the hidden-chain evidence, including the candidate destination, uncovered destination status, and dynamic next-end mismatch. The former 0x370249 source-246 case is resolved through the recovered synthetic span itself: target=340, delta=+0xf, a tail target load from U16(vm->ip + 0x2), and a split successor call to prog_bb_0477 @ 0x370258. For 0x293689, the current C follows the dynamically matched hidden chain, while the symbolic audit remains as a visible alternate/static-path warning rather than being silently promoted.

vm_synthetic_gap_dynamic_stitch.py adds a sequence-side view of the same holes. It scans the raw run.stderr VMTAIL stream from each synthetic start and infers where execution next reappears when the next hooked tail site has a fixed handler delta and the file bytes at next_end - delta match that handler's known exact byte form. The current stitch has 22 event-instance rows for 21 gap starts: 20 byte-matched rows stitch to a next hooked source start, and 2 rows remain ambiguous (0x24bd2a and 0x293689) at this stitch-only layer. The resolved rows show that many target_footprint_of_6/10 gaps are not just six or ten missing bytes; they jump across larger dynamic spans before the next hooked handler, for example source 175 at 0xd1445 reappears at entry 310 start 0xd4893 (+0x344e), source 299 at 0x122e3c reappears at entry 169 start 0x2c0464 (+0x19d628), and that next end 0x2c0468 is now a recovered block start. The full C-like program sketch and combined source bundle now carry these rows as comments next to each unresolved synthetic-tail call or hidden-chain promotion, with the same caveat: this stitch is dynamic sequence evidence, not proof that no unhooked handlers occurred in between.

vm_synthetic_gap_chain_probe.py follows up on the stitch layer by replaying either short-offset hidden-source candidates or dynamic-stitch inferred next-hook starts through the static transfer engine. It emits 22 rows: 20 dynamic_next_hook_matches_static_transfer rows validate that the inferred next hooked handler predicts the observed next target and end VM IP, source 299 at 0x24bd2a has a target-only hidden-chain hint through entry 323 at 0x24bd57 (pred_entry=169, but pred_end=0x24bd5b versus dynamic 0x249468), and source 246 at 0x293689 has the exact hidden-chain match through entry 308 at 0x293696. Only the source-246 exact hidden chain is promoted as hard CFG: static transfer predicts entry=171, delta=+0x2b598, and pred_end=0x2bec2e, exactly matching the next hooked VMTAIL event. The program C now emits op_entry_246(vm), advances to 0x293696, emits op_entry_308(vm), advances by 0x2b598, and calls prog_bb_0205 @ 0x2bec2e instead of leaving 0x293694 as an unresolved synthetic tail. The dynamic next-hook matches remain validation comments unless the focused direct-trace audit has a row starting exactly at the residual VM IP. The other non-promoted sites are now represented by vm_native_ret_patch_tail exits in the full program and source bundle while preserving the conflicting zero-seed symbolic candidate as an audit comment.

vm_synthetic_gap_residual_audit.py joins the successor-gap, transfer-probe, dynamic-stitch, chain-probe, span-catalog, and basic-block tables into one row per residual synthetic start after the hidden-chain promotion stage. The current audit emits 20 rows. All 20 have residual reason sequence_observed_skip_not_static_replayed: the next hooked handler is byte-matched and its static transfer predicts the observed next target/end, but the skipped span from the original synthetic tail to that next hook has not been statically replayed end to end. Nineteen rows are plain not_promoted_dynamic_next_hook_only; 0x24bd2a is not_promoted_dynamic_next_hook_with_target_only_hint because it also has the entry-323 target-only hidden-chain hint. The focused direct-trace audit is applied after this residual audit and promotes 5 of the 20 rows; the other 15 remain unresolved. The Markdown view lists the inferred next hook, recovered destination block, chain status mix, and sampled-operand context for each residual start.

vm_synthetic_gap_concrete_state_audit.py replays those 20 residual source handlers again, seeded from state-aware predecessor edges. It now reads both the baseline dumps/vmtail-state-wide-w16/vm_instruction_trace.tsv and the focused residual-target supplement in dumps/vmtail-state-residual-targets/vm_instruction_trace.tsv. All 20 residual starts have concrete predecessor state; none resolves to a known concrete dispatch target. The split is 12 concrete_unknown_target/table_read, 4 definite concrete_table_oob, and 4 concrete_branch_unknown rows. The full C-like program and source bundle carry these concrete-state audit comments next to every residual start, including the 5 now superseded by focused direct bridges.

vm_synthetic_gap_state_trace_targets.py records how the 9 baseline-missing predecessor-state rows were targeted. Each row names the primary-trace predecessor VM IP, the synthetic-start VM IP, both native tail sites, the current dynamic stitch next-hook, and two per-target environment strings: minimal_focus_env captures the predecessor/synthetic-start pair needed for a vm_trace_graph.py row with end_vm_ip == synthetic_start_vm_ip, while context_focus_env also retains the next hooked event for sequence sanity checks. The supplemental focused run captured all 9 targets; ranked by primary trace sequence, they start at 0x34556c and end at 0x122e3c, with source mix entry 175:3, 195:3, 299:2, and 278:1. This closes the concrete-state availability gap without making a broader dynamic-coverage claim.

vm_synthetic_gap_live_context_audit.py takes the next step by seeding residual replay with the live entry GPRs and frame-scratch qwords captured at each synthetic-start tail event. It mirrors the native pointer normalization used by vm_fast_path_profile: frame, stack, table, VM-IP, and image-relative values are normalized before replay. The all-residual focused run plus the earlier 9-target supplement provide live seeds for all 20 residual starts. Live context does not produce a hard dispatch target, but it removes the former branch-unknown class entirely: the resolution mix is 16 live_unknown_target and 4 live_table_oob, with unknown-reason mix table_read:24,table_oob:5 across replay variants. The four state-only branch-unknown starts (0x122e3c, 0x17452e, 0x24bd2a, and 0x33a6cc) now reach final table-read cases under live GPR/scratch seeding. The full C-like program and source bundle carry these live-context comments after the concrete-state comments, so the remaining residual blocker is the final table read/OOB semantics rather than missing live register state.

vm_synthetic_gap_table_read_diagnostic.py names that remaining blocker precisely. It replays the same 20 residual starts with concrete state plus live GPR/frame-scratch seeds and records the final dispatch-table memory operand, offset, size, native tail site, and table-entry interpretation. All 29 replay variants reach an 8-byte table access. Sixteen starts end in a concrete 8-byte read at a non-qword-aligned table offset, and four (0xd1445, 0x2304b8, 0x231b74, 0x33710f) compute a qword-aligned entry index outside the 360-entry dispatch-table model. The full program sketch and source bundle now carry these table-read diagnostic comments next to each of the 20 residual starts, making the residual unknown a table/index semantics issue rather than an untracked no-network path gap.

vm_synthetic_gap_table_memory_probe.py then maps those table-relative offsets back to eac.elf. The probe emits 20 rows / 29 offset observations: 27 observations land after the 360-entry dispatch table in .text, and the other 2 land inside the dispatch table at unaligned byte offsets. None is a normal dispatch slot; the file qword mix is 27 non_pointer_bytes and 2 low32-only text-offset coincidences. This means the failed table reads are not hidden valid table entries waiting to be divided by eight. They are evidence that replaying the original source handler over these sampled footprint bytes has left the normal dispatch-table model; the hard remaining problem is hidden sampled-control/span semantics between the residual start and the next observed hooked source.

vm_synthetic_gap_runtime_table_memory_probe.py checks the same 20 residual table offsets against the postcall mapped EAC image from dumps/vmtail-residual-122e3c-context-postcall. It emits 20 rows / 29 observations: 27 runtime byte windows match eac.elf exactly, and the 2 mismatches are precisely the unaligned reads inside the relocated dispatch table. Those two runtime qwords blend adjacent relocated pointers into non-pointer values; no residual runtime qword resolves to a dispatch-table target. Runtime patching is therefore not the missing explanation for the remaining table-read residuals.

vm_synthetic_gap_sampled_control_correlation.py cross-checks that hidden-control hypothesis against the sampled-operand catalog. All 20 residual rows have sampled-operand candidates for the same source and footprint length, but none has exact footprint bytes already observed in the sampled catalog and none has a dynamic next-source delta matching a sampled delta. Nine rows at least have the dynamically observed next hooked source entry among the sampled target entries; the other eleven remain sequence-only against the current sampled sidecars. This keeps the observed-chain bridges correctly labeled as evidence rather than hard CFG: sampled control supports the target class in some cases, but not enough by itself to prove exact byte-level hidden-span semantics for the residual starts.

vm_synthetic_gap_focused_direct_trace_audit.py adds a stronger check using focused residual live/state traces. It finds 5 residual starts where a focused trace row starts exactly at the residual VM IP and the observed end VM IP is already a recovered block start: 0x18c467 -> 0x334a3d, 0x24bd2a -> 0x26cd71, 0x31f2b1 -> 0x33f278, 0x33a6cc -> 0x33b647, and 0x34556c -> 0x3603af. These are promoted in the program C as direct handler/block bridges because they are not merely next-hook sequence evidence; the traced instruction starts at the residual IP itself. The other 15 residual starts still have no focused direct row, so they are represented as native ret-patch exits with their existing transfer/dynamic/table/sample comments instead of hard VM CFG calls.

vm_synthetic_gap_focused_sequence_audit.py explains the shape of those remaining residuals in raw focused VMTAIL order. All 20 residual starts appear in the focused live/state/context run stderr inputs, all 20 now have a following raw event, and fourteen have a following raw event that is immediately followed by another residual start. Twelve starts either are focused direct bridges or chain into one, for example 0x2304b8 -> 0xd1445 -> 0xd5ebc -> 0xdaf39 -> 0x18c467 and 0x33710f -> 0x333bc9 -> 0x33a6cc. The remaining eight chain toward 0x122e3c; the dedicated context run now captures 0x122e3c -> 0x2c0468 -> 0x2c046a, matching the dynamic stitch next-hook. These raw links are carried into the C as comments only because the first hop is an indirect tail-site sequence, not a direct dispatch row or statically replayed hidden chain.

vm_synthetic_gap_observed_chain_bridge.py turns those raw sequence rows into an explicit bridge audit. It emits 20 rows: 5 are already hard focused-direct promotions, 7 are observed-chain candidates that terminate in one of those focused direct bridges, and 8 are observed-chain candidates that terminate at recovered block prog_bb_0214 @ 0x2c0468 through the 0x122e3c context reentry. Nineteen focused first hops differ from the primary long-run dynamic next-hook bridge, while only 0x122e3c matches the primary next-hook end directly. The full C-like program and source bundle carry those observed-chain bridge rows as comments beside the residual sites, but do not currently embed replay snippets there because the sampled native ret-patch exits are the executable model for those paths. This makes the remaining ambiguity concrete: the binary exposes path variants across focused residual windows, so those chains are strong provenance but not yet hard static CFG.

vm_synthetic_gap_observed_chain_replay.py materializes that replay layer as data. It emits 57 rows for 15 observed-chain candidates and 18 unique replay VM starts. The step-role mix is 42 residual chain steps, 8 context-reentry terminal steps, and 7 focused-direct terminal steps; the terminal mix is 8 chains to prog_bb_0214 @ 0x2c0468, 4 chains to prog_bb_0293 @ 0x334a3d, 2 chains to prog_bb_0324 @ 0x33b647, and 1 chain to prog_bb_0340 @ 0x33f278. This gives future work a reproducible TSV/Markdown audit surface and lets it target individual replay steps rather than rediscovering the chain expansion from C comments.

vm_synthetic_gap_chain_slot_reconciliation.py checks whether those focused first-hop targets are directly explained by the symbolic/table slot evidence. It joins all 57 replay steps to the transfer probe, table-memory probe, runtime table-memory probe, and sampled-control sidecars. This audit is intentionally conservative: matching would require the final table offset to equal first_hop_target_entry * 8. Current results show no direct slot match. The relation mix is 50 table offsets that are misaligned versus the focused target slot and 7 table offsets that are outside the 360-entry dispatch table. The class mix is 57 rows where table-read evidence rejects the focused first-hop as a direct slot. This reinforces the current model: focused chains are observed control-flow provenance, while the residual table slot formulas are not yet statically reconciled into hard CFG.

vm_synthetic_gap_unresolved_family_audit.py clusters the 15 native ret-patch / non-hard-CFG synthetic successor sites into 13 evidence families, so the remaining non-hard CFG work is not just a flat list of missed dynamic path rows. The source mix is 195:8, 175:3, 299:3, and 278:1. The observed terminal class mix is 8 sequence chains to the recovered 0x122e3c -> 0x2c0468 context reentry and 7 sequence chains to focused direct bridges. The table diagnosis mix is 11 misaligned/non-qword table reads and 4 out-of-range table indices. The recommended next-target mix is 7 first-indirect-hop replays toward promoted terminals, 6 repeated central-dispatch family solves, 1 context-reentry first-hop isolation, and 1 unique transfer-family solve. Two families have more than one member: ufam_00 is source 299 with starts 0x122e3c and 0x17452e, both terminating at prog_bb_0214 @ 0x2c0468; ufam_01 is source 175 with starts 0x17a420 and 0x1a6041, also terminating at prog_bb_0214 @ 0x2c0468. The next best reconstruction target is ufam_00, because it contains the only focused-first-hop relation that matches the primary dynamic next end (0x122e3c -> 0x2c0468) plus another same-source/same-path family member.

vm_synthetic_gap_source299_context_probe.py removes one ambiguity from that source-299 family. It reads the live VMTAIL register snapshots for source 299 and resolves the formerly unknown 0xb6c57: je branch as not-taken in every captured residual row (r8b is nonzero: 0x70 for 0x122e3c and 0x17452e, 0xff for 0x33710f). The 0x122e3c row resolves to path hash 833b04476f7a3399, slot 0xd9cf; 0x17452e resolves to 745a7b95e00833b1, slot 0x8144; and 0x33710f resolves to 833b04476f7a3399, slot 0x8548. All five captured rows still read after the dispatch table and decode as non-pointer file bytes. Three rows nevertheless have the next focused raw event equal to the observed first hop or terminal reentry, while two stop at the focused limit. That narrows the blocker: source 299 is no longer blocked by an unknown branch predicate, but the observed context bridge is still sequence-only indirect-tail provenance rather than a direct table-slot CFG edge.

vm_synthetic_gap_source299_ret_patch_probe.py isolates the source-299 hidden-control mechanism instead of forcing it through the normal table-slot model. The native entry at 0xb6bba reads u32_0 from the current bytecode operand, adds the VM-frame qword at +0xbb, writes that as a return address to rsp + u16_4, restores registers, and returns. The probe emits 7 rows across 3 starts: 0x122e3c patches to .text offset 0x2d409, 0x17452e patches to 0x313eb, and 0x33710f patches to 0x74b3d. Six rows have full-GPR snapshots and one fakenet row is frame-only; the 0x122e3c postcall row directly reads frame+0xbb from the dumped mapped image, while the other rows use matching event image-base crosschecks. All 7 classify as native_ret_patch_text_offset_not_vm_ip, so source 299 is documented as native return-patch control into text bytes rather than a dispatch-table pointer or a VM-IP next-hook.

vm_synthetic_gap_sampled_ret_patch_probe.py generalizes that mechanism across sampled unresolved-control sources 175, 195, 278, and 299. It emits 31 rows across all 15 residual starts: entry 175 contributes 6 rows / 3 starts (0xd1445, 0x17a420, 0x1a6041), entry 195 contributes 16 rows / 8 starts (0xd5ebc, 0xdaf39, 0x1ed483, 0x2304b8, 0x231b74, 0x333bc9, 0x33d2d9, 0x3655e4), entry 278 contributes 2 rows / 1 start (0x12906f), and entry 299 contributes the 7 rows / 3 starts above. Source 278 is a double-stack return patch: u32_6 patches to .text offset 0x6c010 and u32_0 patches the next stack slot to .text offset 0x15b5b2. All 31 first patched returns classify as native_ret_patch_text_offset_not_vm_ip, and the two source-278 second patched returns classify the same way; 24 rows have full-GPR snapshots and 7 are frame-only alternate/fakenet evidence. The full C sketch and source bundle now carry 15 sampled ret-patch evidence sites / 31 per-run comments plus 15 executable vm_native_ret_patch_tail calls, and the handler layer renders op_entry_175, op_entry_195, op_entry_278, and op_entry_299 as native return-patch thunks.

vm_synthetic_gap_ret_patch_native_target_atlas.py expands those patched native offsets into bounded disassembly windows. It emits 16 unique target windows: 14 single-stack targets that reach a native ret within the first 0x80 bytes, plus source 278's two double-stack targets (0x6c010 and 0x15b5b2), which do not reach a ret in that bounded window. This makes the return-patch offsets inspectable as native code windows instead of opaque comments; source 278's first target starts a larger native function prologue and jumps to 0x2d2cf4, while the second target begins a stack/register shuffle sequence. vm_native_ret_patch_targets_pseudocode.py then emits those 16 windows as syntax-checkable C helper functions plus a dispatcher keyed by vm_ip, ret0, and ret1; 13 helpers are classified as bounded native epilogue models, and source 278 is now explicitly split into ret1 -> 0x6c010 -> 0x2d2cf4 and ret2 -> 0x15b5b2 -> 0xcdc60 native trampoline control rather than overclaimed VM CFG edges. vm_native_ret_patch_epilogues_retdec.py adds a targeted decompiler view for the 14 single-stack epilogue targets, preserving their stack-check guards and native return-value shape as C. vm_native_ret_patch_source278_retdec.py adds the matching targeted decompiler view for the exceptional source278 chain: function_6c010 tail-calls function_2d2cf4, which tail-calls function_cf3c7, while function_15b5b2 tail-calls function_cdc60; this is intentionally recorded as C-shaped native evidence instead of pretending those patched returns are VM bytecode successors.

vm_native_ret_patch_followups_dump.c follows the atlas one layer deeper without starting another broad RetDec run. It parses the 16 target windows, extracts all direct call/jump follow-ups, and emits a 39-row TSV/Markdown index plus a 512-line syntax-checkable C dispatcher. The class mix is 22 local/post-window branch targets already covered by source windows, 1 PLT stack-check target, 3 recovered native semantic helpers/wrappers, 5 bounded/targeted RetDec candidates, 1 source278 target already covered by targeted RetDec, and 7 obfuscated native islands. vm_native_ret_patch_followup_retdec_dump.c consumes that queue and emits a targeted RetDec sidecar for the non-obfuscated helper subset in a bounded 90-second wrapper, currently completing in about 2 seconds and producing 6 syntax-checkable C functions. vm_native_obfuscated_islands_dump.c consumes the obfuscated subset and emits an 8-row syntax-checkable C dispatcher that collapses the first-stage stack/flag islands to concrete downstream native targets. vm_native_obfuscated_second_stage_dump.c consumes the five unresolved downstreams and emits a syntax-checkable C dispatcher with exact computed jmp [rax] sites and loop edges. vm_native_obfuscated_second_stage_dynamic_dump.c consumes focused dispatch logs for those sites and emits the observed slot/target/handler mixes as syntax-checkable C. vm_native_obfuscated_second_stage_slot_proof_dump.c adds the static Capstone proof that the computed target is dispatch-table-base plus rbx << 3, joined to the dynamic base/slot checks. vm_native_obfuscated_second_stage_stack_source_dump.c adds the static proof that qword [rsp+0x88] feeds the rbx dispatch index before that shift, while vm_native_obfuscated_second_stage_rbx_provenance_dump.c preserves the upstream single-step runtime confirmation. vm_native_obfuscated_second_stage_model_dump.c combines those layers into a direct C model of the stack-carried handler entry feeding the dispatch table, vm_native_obfuscated_control_model_dump.c joins that model back to the ret-patch follow-up island layer, and vm_native_ret_patch_hidden_bridge_dump.c joins the sampled ret-patch exits themselves to those hidden-control rows. The next native-control solve is now broader config coverage and extending this static stack/dataflow treatment beyond the narrowed obfuscated island set.

vm_synthetic_gap_live_snapshot_transfer_probe.py generalizes that check to all 15 native ret-patch / non-hard-CFG starts. It replays each source handler from selected live VMTAIL rows, including the focused residual full-GPR runs and the vmtail-fakenet-w16 alternate/config run where matching rows exist but no GPR fields were logged. The current result emits 31 live rows covering all 15 starts: 24 rows have full_gpr_snapshot evidence and 7 are explicitly weaker frame_only_snapshot rows. All 31 normal table-transfer replays still end at unknown_target; the concrete final table access is 23 misaligned/non-qword table reads and 8 out-of-range table indices, so none is promoted into a hard VM CFG edge. The source-299 unknown branch is removed in 6 full-GPR rows, while the one fakenet source-299 row stays branch-unknown because that run lacks r8. Twenty rows have the next raw event equal to the observed first hop, two hit the terminal reentry, seven differ from the family chain, and two stop at the run limit. This makes the coverage answer sharper: the non-hard-CFG starts are not merely artifacts of the primary no-network trace, but the alternate/config evidence is weaker unless it carries registers.

vm_synthetic_gap_live_table_evidence.py keeps that per-run distinction and maps the 31 concrete live table offsets back to eac.elf and the postcall mapped image. The evidence-class mix is 21 post-table code-byte reads, 8 table indices outside the 360-entry dispatch range, and 2 unaligned in-dispatch-table reads. The region mix is 29 after-dispatch-table rows and 2 inside-dispatch-table-unaligned rows. File and runtime qword classes are identical at this level: 29 non-pointer byte windows and 2 low32 text-offset coincidences, with no row decoding to a dispatch-table target. Runtime bytes match the file for 29 rows; the 2 mismatches are the unaligned in-table reads where relocation blends adjacent relocated pointers, still not a valid dispatch target. The full program sketch and source bundle now carry all 15 live evidence sites / 31 per-run comments beside the unresolved residual starts, so the generated C shows which rows are full-GPR replay evidence and which are weaker frame-only/fake-network/config provenance. This closes the obvious “maybe the table bytes are patched or relocated into a real edge” explanation for these live unresolved rows.

Coverage caveat: the C-like bytecode/CFG artifacts are dynamic-path reconstructions, not proof that every VM program path has been executed. The raw strings/data carrier means referenced ELF runtime sections and dispatch-table bytes are present in C form; it is not proof of every dynamically generated, decrypted, or network-delivered runtime buffer unless separately captured or statically decoded. The blocked/fake-network provenance is now explicit in the coverage matrix; the scripts do not silently generalize it into network-dependent path coverage. vm_trace_coverage_matrix.py now auto-discovers 36 available run directories: 16 have vm_instruction_trace.tsv bytecode-path rows, 12 of those are concrete instruction-trace scenarios before synthetic fill sidecars, and 20 are run-only register/scratch/memory-context evidence with no instruction-trace rows. Six run-only rows are memory-context traces: the bounded EAC_VMTAIL_MEM=1 smoke, the focused live-in start probe, the start/final-site intersection probe, the all-final-sites exact-tail probe, and the two single-site rare-tail probes. Twelve concrete instruction traces reach preload-logged network calls: 11 are blocked_observed, 1 is fake_observed, and 0 are real network-allowed. The fake-network trace attempted api.epicgames.dev and datarouter.ol.epicgames.com, returned local fake DNS/socket results, observed TLS ClientHello sends plus error-alert closes, and matched the blocked 250k VM bytecode coverage exactly, so it is provenance rather than new bytecode coverage. The concrete instruction traces cover x() modes 0, 1, and 2 plus the focused 0x122e3c residual context, but none adds source handlers beyond the primary long vmtail-wide-1m-w16 run; the smaller concrete traces miss one or more primary sources. The primary run observes 202 source handlers, 205 target handlers, and 71522 unique VM-IP starts. make native-handler-environment-coverage now materializes that boundary as C/TSV/Markdown for every dispatch entry: 202 handlers have concrete source+target evidence, 3 have concrete target-only evidence, 205 are target-observed in blocked-network traces, 195 are target-observed in fake-network traces, and 155 remain static-only in the current trace matrix. Synthetic file/hidden/frontier/footprint fill sidecars raise the instruction-trace union to 205 source handlers and 71809 VM-IP starts, but those rows are derived coverage, not independent runtime configs. The static handler inventory is broader: the dispatch table, transition model, state slice, microcode catalog, handler pseudocode, and handler RetDec sidecars cover all 360 handler entries, including 155 entries not seen as primary-trace targets. So static handler semantics, handler pseudocode, operand-layout recovery, native sidecars, and dispatch-table inventory are not limited to one dynamic scenario. The recovered VM bytecode listing still is scenario/path coverage until we add traces from other configs, shape fake network responses deeper than TLS error, enable controlled real network, or force unexplored VM branches through static/symbolic exploration.

The static skeletons agree with that decode. All 10 long-control source handlers read a u16 at VM IP +0x0 for the table entry and u32 at +0x4 for the signed delta. The shorter form appears in entries 117, 266, 302, and 308, while entries 75, 145, 210, 246, 316, and 334 also read u16 at +0x8 and byte at +0xa. That gives 677 events with an 8-byte minimum operand footprint and 961 events with an 11-byte footprint without claiming the whole branch span is linear instruction bytes.

The best next trace targets are therefore exact byte-length and semantic-resolution holes rather than broad reruns: they isolate long-control VM IP bands (0x22ffb1, 0x370xxx, 0x371xxx, 0x310dba, 0x31297d, 0x3157e1, 0x315cc0) and sparse source handlers (316, 75, 266, 145, 117, 302, plus footprint-filled target starts for 175, 195, 299, 278, 356, and 246) that still block full bytecode/ISA recovery.

The state-aware trace in dumps/vmtail-state-wide-w16 adds vm_flags, vm_state, and vm_byte to every VMTAIL row. vm_trace_graph.py --instruction-trace uses consecutive events as pre/post snapshots for the source handler and appends:

pre_flags, post_flags, pre_state, post_state, state_delta, pre_byte, post_byte.

This gives the first direct dynamic semantics for the rolling state at frame+0x170. The 250k state trace has 250000 VMTAIL records, 3385 DISPATCH records, and 249764 direct instruction rows after filtering. Handler-level grouping is intentionally broad and mostly mixed because each handler covers many byte operands:

Events	Handlers	State Class
244984	138	state_mixed
2124	28	state_preserve
2035	3	state_const_post
621	22	state_add_const

Per-signature grouping is much more informative. Keying by (source handler, delta, byte_status, bytes) shows that most observed VM instructions have a deterministic state transform:

Events	Signatures	State Class
221807	35132	state_add_const
18749	1048	state_mixed
6902	362	state_const_post
2306	240	state_preserve

Top deterministic state-add signatures:

Events	Entry	Delta	Bytes	State Add	Target
256	17	+0x5	12ff6210a0	-0x7fff6076	300
256	18	+0x3	4804c6	+0x60c92c45	105
256	18	+0x3	580eaa	+0x1d32d080	258
256	18	+0x3	584f3c	-0x5b689fc	347
256	20	+0x4	e801874a	+0x5a0c98e5	181
256	26	+0x4	13cfe801	+0x6add1670	168
256	28	+0x3	00049a	-0x46223400	128
256	258	+0x4	f3d5ce87	+0x383d0514	215

Top state-preserving signatures are mostly loop/backedge or central-dispatch-adjacent rows:

Events	Entry	Delta	Bytes	Target
255	75	-0x6d	ab0000006d0000803d019a5ae9e544f6d9c39fb63a3668ff1418b4e9c6cf3d01	171
255	316	-0x3c4	a5000000c40300803d019a6cb3e80548381b90d9800d6d4dbe452b0a0126003d	165
113	310	+0x4	e801a500	165
91	310	+0x4	e8016201	354
86	283	+0x5	10e801c462	258

This strongly suggests the VM dispatch state is not opaque per handler: for most concrete bytecode signatures, frame+0x170 advances by a deterministic 32-bit addend, while target selection still depends on the rolling state and decoded bytes.

vm_state_affine.py fits reusable source-handler formulas for the post-handler frame+0x170 value. With only pre-state and instruction bytes, 92 of 179 state-trace source handlers fit exactly and 40 survive 5-fold held-out validation, covering 16163 state-trace events. Adding the traced frame+0x23 flags and frame+0x194 byte raises this to 105 exact-fit sources and 41 robust sources covering 18160 state-trace events. The one robust handler gained by the extra fields is entry 346, whose state update is affine over pre-state and flags.

Representative robust state-affine fits from vm_state_affine_fullfields.tsv:

Entry	Events	Unique Post States	Terms	Notes
43	5309	753	7 state + 9 byte + const	low post bits come from instruction bytes; bits 9-15 preserve state
333	3602	526	14 byte + const	post-state is a compact byte-derived value
161	2666	372	18 state + const	masks/sets fixed pre-state bits
346	1997	423	32 state + 42 flags + const	requires the traced flags field
171	1069	1	0	clears state to zero
91	546	193	7 state + 9 byte	combines preserved state bits with instruction bytes

In the lifted long catalog, robust state-affine sources cover 5413 exact rows and 60256 events. The intersection of robust state-affine and robust dispatch-affine evidence covers 35 source handlers, 1019 exact rows, and 10319 long-run events; this is the current strongest subset for direct devirtualized handler semantics. The high-volume mixed handlers still fail affine state modeling, so they likely use arithmetic carry/borrow or untraced intermediate state rather than a pure GF(2) update.

vm_state_static_slice.py statically slices the same state mechanism directly from handler code. It tracks frame pointers, VM IP reads, and writes to frame+0x170/frame+0x23. Across all 360 dispatch entries, 327 entries have at least one static state write, covering 764423 long-run events. The state update count distribution is:

State Writes	Entries	Long-Run Events
0	33	4541
1	109	67694
2	59	65512
3	36	100665
4	31	160304
5	32	146798
6	23	68838
7	15	131229
8+	22	23383

The static slice explains why the high-volume affine failures are hard: 123 entries have four or more state writes, covering 530552 long-run events. Entry 258 is the best current example. Its branch-linearized static state chain has four writes:

1. state ^= 0x11095fd5
2. state += flags'
3. state ^= u16_2 - flags'
4. state &= (u16_0 - state) ^ 0x5812e92c

Here flags' is itself conditionally transformed from frame+0x23 by subtract/or/xor constants. The final AND after subtracting the evolving state is non-affine and matches the dynamic failure mode.

The static state validator concretely executes the static state slice over the state-aware trace, following simple je/jne branches when the compare/test value is known. The native vm_fast_path_profile --state-validate mode now emits the same validation schema in about 7 seconds on this host, replacing the roughly 5-minute Python full-trace refresh for routine runs. It validates the static state model for 248903 of 248906 state-trace instruction rows, or 99.9988% of the trace. The only mismatches are one-event sources 101, 241, and 284 with long control-flow-like byte windows. In the lifted long catalog, 71339 exact rows and 767542 events come from sources with 100% static state validation. All 48 robust dispatch-affine sources are in that 100% static-state set, covering 9197 rows and 101596 events.

The static dispatch validator extends the same concrete slice through the final table lookup and VM IP write. The native vm_fast_path_profile --dispatch-validate mode now emits the same schema in about 7 seconds as well. It validates both dispatch target and frame+0x0a advance for 248300 of 248906 state-trace rows, or 99.7565%. The 606 misses are concentrated in 13 sources that use native ret/stack control-flow or long control-flow-like windows before the VM tail: entries 356, 216, 95, 278, 311, 102, 264, 321, 85, 78, 284, 241, and 101. In the lifted long catalog, 71237 exact rows and 764108 events come from sources with 100% static dispatch/IP validation. The validator covers 43 of the 48 robust dispatch-affine sources at 100%, covering 9139 exact rows and 99661 events.

vm_dispatch_model_combine.py closes that dynamic gap by preferring the static dispatch validator and falling back to affine dispatch bit formulas for static-target misses. On the state-aware trace, the combined model validates all 248906 exact instruction rows:

Dispatch Model	Sources	Events
static_100	166	248300
affine_robust_fallback	5	360
affine_partial_fallback	3	241
affine_single_fallback	5	5

The affine fallback uses formulas fitted over state/post-state/byte features, so it is a validated dynamic dispatch model rather than a purely static one. In the lifted long catalog, the combined model tags 71343 rows and 767546 events; 12 exact rows and 20 events remain untagged only because their source handlers were not present in the state-aware trace.

vm_transition_model.py consolidates the handler-level reconstruction into vm_transition_model.tsv, one row for each of the 360 dispatch entries. It joins the long-run handler skeleton, static state/flag update chain, state and dispatch validation percentages, affine CV status, sampled transfer expressions, decoded long-control bytecode lifts with operand footprints, sampled-operand lifts with operand footprints, branch-predicate provenance, combined dispatch model, and tail operand provenance. The observation mix is 190 exact-covered entries, 155 unobserved entries, 7 sampled backedge entries, 4 sampled long/sparse entries, 3 target-only entries, and 1 central/long-control-flow entry.

Handler-level coverage in the transition model:

Coverage	Entries	Long-Run Events
observed in skeleton profile	202	768964
with static state writes	327	764423
with static state validation	179	767546
with 100% static state validation	171	764177
with static dispatch/IP validation	179	767546
with 100% static dispatch/IP validation	171	764177
with pure static dispatch model	166	764108
with combined dispatch model	179	767546
with branch-predicate provenance	163	748543
with tail target register/operand	181	765570
with live/static slot temp	181	765570
with byte/static index register	156	704763

The long-control sidecar attaches decoded target/IP-update variants and static operand footprints to 10 transition-model entries, covering 1638 sampled/backedge catalog events across 128 variants. The sampled-operand sidecar attaches 13 additional sparse non-long sampled events across 12 variants to 6 entries: 95, 175, 195, 278, 299, and 311. These sidecars are tracked separately from the observed_events column because some sampled rows, notably source entry 308 and the central/sparse sampled operands, are underrepresented in exact source-profile event counts.

Combined dispatch-model distribution in the transition model:

Dispatch Model	Entries	Long-Run Events
static_100	166	764108
affine_robust_fallback	5	1935
affine_partial_fallback	3	1497
affine_single_fallback	5	6

The model is intentionally keyed by dispatch entry rather than bytecode instruction. Eleven exact-observed entries, covering 20 long-run events, still have no dispatch model tag because they were absent from the state-aware trace; the other blank rows are unobserved or sampled-only entry classes.

vm_fast_path_profile --transfer-expr adds a path-sensitive symbolic view of the same static dispatch mechanism. It follows concrete branches from the state-aware trace, but carries symbolic expressions for the table-slot byte offset and frame+0x0a IP advance. The current artifact is deliberately bounded to at most 128 rows per source, so its event counts are expression-sampling counts rather than full-trace coverage counts. The native sampler emits the four bounded source/path transfer TSVs in about 10 seconds total on this host. On that sample it covers all 179 state-aware source handlers and agrees with the concrete target/IP validator for the same 166 static-dispatch-clean handlers:

Transfer-Expression Coverage	Sources	Sample Events
sampled source handlers	179	16691
100% target/IP agreement	166	16085
with dispatch-slot expression	166	16085
single observed slot expression	127	11378
multiple observed slot expressions	39	4707
single observed IP-advance expression	179	16691

Representative recovered dispatch-slot expressions now appear directly in vm_transition_model.tsv. For example, entry 28 dispatches through table[u16_0 & 0xffff] with ip += 0x3, while entry 0 dispatches through table[((u16_0 + (state0 ^ 0x1966e0e7)) - 0x251a0141) & 0xffff] with ip += 0x5, modulo the 32-bit masks shown in the TSV.

The GPR+scratch-seeded source-level transfer sample preserves the same 171 source rows with 100% target/IP agreement while removing sampled branch uncertainty entirely. With the enriched fs0x128 trace and native pointer model, all 179 sampled source rows and all 16691 sampled events carry dispatch-slot expressions.

The native --transfer-expr --by-path view of the same bounded transfer-expression sample is vm_static_path_transfer_expr.tsv. It resolves the apparent multi-formula source handlers into concrete branch-path formulas. In the 128-row-per-source sample it observes 352 source-path rows across all 179 state-aware sources. All 341 source-path rows with 100% target/IP agreement have exactly one slot expression and one IP-advance expression:

Path-Conditioned Transfer Expressions	Source-Paths	Sample Events
sampled source-path rows	352	16691
100% target/IP agreement	341	16153
with dispatch-slot expression	352	16691
single slot expression per path	352	16691
multiple slot expressions per path	0	0

This is useful because source-level handlers such as entries 18, 20, 26, 64, 66, 114, 258, and 337 have multiple observed slot formulas, but each sampled concrete branch path has a single formula. That gives a clean route to path-specialized devirtualized blocks.

The seeded --by-path transfer-expression view observes 462 GPR+scratch-seeded source-path rows in the same 16691-row sample; 452 rows covering 16153 sample events have 100% target/IP agreement, and every sampled source-path row has a dispatch-slot expression plus an IP-advance expression. Joining those seeded expression rows back to the native seeded path table covers 462 of 570 concrete paths, covering 245646 state-trace events.

vm_static_path_profile.py explains why some handlers have multiple sampled transfer expressions. It replays the full state-aware trace through the static handler interpreter and records concrete branch outcomes as path hashes. The source-level profile exactly preserves the static dispatch validator's coverage: 248300 of 248906 state-trace rows validate target and IP, and the same 606 rows end in unresolved native/long-control-flow paths. Across 179 state-aware source handlers, the replay observes 400 distinct branch paths:

Path Profile	Sources/Paths	State-Trace Events
source handlers profiled	179	248906
sources with 100% target/IP validation	166	248300
sources with one observed path	74	39028
sources with multiple observed paths	105	209878
distinct source-path rows	400	248906

The most path-diverse source is entry 330 with 12 observed paths over 169 state-trace events. Other high-diversity handlers include entries 208 with 11 paths, 237 and 48 with 8 paths each, and entries 108, 257, 319, 292, and 105 with 7 paths each. The high-volume handlers are usually much simpler: entry 258 has two concrete paths, entry 28 has three, and entries 337, 340, 189, 347, 307, 64, and 66 have one or two dominant paths. These path counts are now joined into vm_transition_model.tsv and summarized in vm_microcode_catalog.tsv.

vm_fast_path_profile is the native version of this concrete replay loop. It uses Capstone C for handler decoding, OpenSSL SHA-256 for path hashes, and direct TSV streaming for trace rows. On the full GPR+scratch-seeded 248906-row trace it preserves the static target/IP coverage at 248368 validated events while eliminating all branch-unknown events. The --emit-dir batch mode regenerates all _fast.tsv replay artifacts in two passes, and make fast-replay fast-predicates fast-transfer refreshes replay, predicate, and transfer artifacts in elapsed=0:31.69. Its image-backed frame/IP reads, restore-trampoline push/pop preservation, biased frame and stack pointer normalization, low-bit pointer arithmetic, and fs0x128 scratch seeding produce 570 native seeded source-path rows, 560 fully target/IP-validated paths, 0 branch-unknown events, and 58252 unknown ops. The matched _fast.tsv path microcode catalogs now use those native path rows for the concrete devirtualized view.

vm_instruction_unique_fast is the native version of the exact instruction-signature reducer. It preserves the TSV schema and ordering of vm_bytecode_recover.py --instructions, including Counter tie order for top_end_ips, top_targets, and top_sites, but avoids Python CSV and object churn over the 110 MiB full trace. The current parity check is byte-for-byte clean, and the latest local timings are 0.30s native versus 4.04s Python. make instruction-unique now uses the native reducer over the existing trace, while make instruction-unique-fast-check keeps the Python parity gate available without forcing a raw trace rebuild.

vm_bytecode_segments_fast is the native version of the bytecode segment reducer. It preserves the exact TSV schema for both exact-only and sampled/file-backed segment recovery: dominant bytes, conflict offsets/events, SHA-256 segment hashes, 64-byte prefix/suffix hex, and top source/target/delta counters are byte-compatible with Python. The raw exact and sampled outputs match Python byte-for-byte, and the same check passes on the final file-fill/hidden-fill/frontier-fill/footprint-fill sampled trace. Current timings are about 0.63-0.68s native for raw exact/sampled versus about 4.9s per Python pass, and about 1.12s native versus 4.68s Python for the final augmented trace.

vm_bytecode_blocks_fast is the native version of the contiguous coverage-block reducer. It preserves the Python interval merge rule, the stable row order used for per-block counters, and the output schema for exact-only and sampled/file-backed coverage blocks. The raw exact, raw sampled, and final file-fill/hidden-fill/frontier-fill/footprint-fill sampled outputs all match Python byte-for-byte. Current timings are about 0.56s native for raw exact, 0.65s native for raw sampled, and 1.07s native for the final augmented trace, versus about 4.2s for the Python pass.

The native --branch-sites mode gives full-trace branch outcome counts without the slow Python provenance pass. It emits 855 branch-site rows and accounts for 1007971 dynamic branch evaluations. State-only replay leaves 207821 branch events unresolved, while GPR+scratch seeding now resolves every branch outcome:

Native Branch Sites	Rows	Dynamic Branch Events	Unknown Branch Events
state-only replay	855	1007971	207821
GPR+scratch-seeded replay	855	1007971	0

The static interpreter also resolves opaque pointer predicates by using the traced VM frame location (base+0x7836d). Since the image base is page-aligned, the low byte of rbp+off is stable; byte-sized comparisons such as cmp \$0, %r12b after r12 = rbp + 0x170 can be resolved without knowing the absolute ASLR base. The interpreter preserves commutative int + pointer arithmetic, propagates known low bits through mixed pointer arithmetic, compares same-base pointers by offset, proves inequality when known low bits differ, and clears ZF when unknown flag-clobbering arithmetic is encountered instead of accidentally reusing stale flags. It normalizes scratch seeds that become frame or stack pointers only after obfuscating biases (0x1a44e4ef, 0x61f749a7, 0xda3b7d9), carries stable low bits for dispatch-table and stack pointers, and treats restore-trampoline push/pop register operands as register-preserving. The enriched scratch traces add all 16 dynamic frame offsets used by entry 337's 0xbeee0 pointer predicate and fs0x128 for entry 95's final frame-bit predicate, removing both from the unresolved predicate catalog. Target/IP coverage remains unchanged, but path and branch records are now fully concrete under GPR+scratch seeding.

vm_fast_path_profile --branch-predicates explains branch predicates by replaying concrete values plus symbolic/provenance labels for the last compare/test or flag-producing arithmetic. The current TSV artifacts are bounded to 128 rows per source; the native sampler emits the state-only and GPR+scratch-seeded catalogs in a few seconds each. Use native --branch-sites for full-trace outcome counts. The bounded state-only sample emits 855 source-handler branch-site rows and accounts for 68949 dynamic branch events; 11176 remain unresolved without GPR seeding. The GPR+scratch-seeded bounded catalog has 0 unresolved events, and the unbounded vm_branch_predicates_gpr_seeded_full.tsv confirms 0 unresolved events across all 1007971 dynamic branch evaluations.

Sampled unresolved branch-predicate classes:

Class	Dynamic Branch Events	Interpretation
live_in_reg	6154	branch depends on a register value carried from a previous handler
unknown_frame_field	3547	frame field was neither one of the modeled VM fields nor a seeded scratch value
derived_live_in	1475	condition derives from live-in data through arithmetic before the compare

Top sampled unresolved branch sites:

Entry	Branch	Unknown / Events	Class	Top Condition
3	0x78c93:je	128 / 128	live_in_reg	branch depends on an unseeded live-in register
3	0x78cd4:je	128 / 128	live_in_reg	branch depends on an unseeded live-in register
17	0x7bafa:je	128 / 128	live_in_reg	branch depends on an unseeded live-in register
18	0x7bed4:je	128 / 128	live_in_reg	branch depends on an unseeded live-in register
20	0x7c649:je	128 / 128	live_in_reg	branch depends on an unseeded live-in register
26	0x7ddeb:jne	128 / 128	unknown_frame_field	compares VM bytecode-derived frame pointer against an unseeded frame scratch field
30	0x7e868:je	128 / 128	live_in_reg	branch depends on an unseeded live-in register
30	0x7e896:je	128 / 128	live_in_reg	branch depends on an unseeded live-in register

This is the state-only baseline. The GPR+scratch-seeded predicate catalog is now fully resolved, so it no longer has a top-unknown list.

That next pass is now implemented in the native path/predicate replay via vm_fast_path_profile --gpr-run. The GPR+scratch trace and state-aware trace start with the same VMTAIL sequence, so row N can seed handler-entry registers and hot fs0x... frame fields from VMTAIL event N-1. Register values are normalized back into the static interpreter's model: values near the VM frame become Ptr("frame", off), table-slot pointers become Ptr("table", off), VM-bytecode pointers become Ptr("ip", off), and other in-image code pointers become file offsets.

The full GPR+scratch-seeded replay slightly improves dispatch/IP validation coverage, and the latest native pointer normalization resolves the former branch uncertainty:

Path Replay	Source-Path Rows	Target/IP Validated Events	Unknown Branch Events	Unknown Ops
state-only static replay	400	248300 / 248906	209434	12896277
state-only native replay	403	248368 / 248906	207821	11007609
GPR+scratch-seeded replay	737	248363 / 248906	40939	4593720
GPR+scratch-seeded native replay	570	248368 / 248906	0	58252

The path-row count first increases because formerly unknown live-in predicates split into concrete taken/not-taken paths. The newest native seeded table then collapses formerly ? path fragments after biased scratch-frame, stack-pointer, image-backed, low-bit, restore-trampoline, and fs0x128 predicates resolve. It has 570 source-path rows over the same 248906 state-trace events; 560 of those paths, covering 248368 events, validate target and IP at 100%. Top branch-unknown reductions by source are:

Entry	Events	Unknown Branches Before	Unknown Branches After	Reduction
337	7502	15004	0	15004
297	6483	12966	0	12966
168	4535	9070	0	9070
347	8151	8151	0	8151
301	2037	8148	0	8148
346	1997	7988	0	7988
114	7722	7722	0	7722
340	7549	7549	0	7549
189	7459	7459	0	7459
268	3696	7392	0	7392
18	7392	7392	0	7392

This confirms that cross-handler register carry and hot scratch-frame fields are real VM control-flow state, not merely junk. With the current enriched trace and native model, no GPR+scratch-seeded branch predicates remain unresolved in the observed state trace.

The bounded GPR+scratch-seeded predicate catalog confirms the same reduction at branch-site level over the same 68949 sampled branch events:

Predicate Catalog	Unknown Branch Events	Top Remaining Classes
state-only predicates	11176	live_in_reg:6154, unknown_frame_field:3547, derived_live_in:1475
GPR+scratch-seeded predicates	0	resolved:68949
GPR+scratch-seeded full predicates	0	resolved:1007971

The largest full-path-profile reductions are direct proof that seeding resolves live-in and scratch-frame predicates, especially entries 337, 297, 168, 347, 301, 346, 114, 340, and 189. Full-trace native branch-site counts now show no remaining GPR+scratch-seeded unknown sites.

vm_microcode_catalog.py is the compact human-facing index over the reconstructed handlers. It joins the transition model, ISA operand layouts, static state/flag update chains, sampled/backedge long-control bytecode lifts with operand footprints, sampled-operand bytecode lifts with operand footprints, and source-level state-only plus GPR+scratch-seeded branch-predicate summaries into pseudo-IR rows. The TSV keeps one row per dispatch entry, while vm_microcode_top.md renders the top 30 observed entries by event count with clipped expression hashes that point back to the full lower-level TSVs.

Microcode catalog class distribution:

Class	Entries	Long-Run Events
static_validated	166	764108
affine_dispatch_fallback	13	3438
sampled_only	9	1392
sampled_operand_lifted	3	6
partial	11	20
unobserved_static	155	0
target_only	3	0

The catalog currently has state/flag pseudo-IR for 335 entries covering 766060 long-run events, dispatch-slot pseudo-IR or model tags for 179 entries covering 767546 events, long-control tail IR and 8/11-byte operand footprints for 10 sparse sampled/backedge source handlers, sampled-operand tail IR and 6/10-byte operand footprints for 6 sparse/exact source handlers covering 13 sampled events, state-only and GPR+scratch-seeded branch-predicate summaries for 163 entries covering 748543 events, and operand-layout summaries for the 190 exact-covered handlers covering 767575 events.

vm_path_microcode_catalog.py specializes that catalog by concrete handler branch path. It joins the full vm_static_path_variants.tsv state-trace path counts with the sampled vm_static_path_transfer_expr.tsv slot/IP formulas and the source-level microcode, including source branch-predicate and GPR+scratch-seeded predicate context. This is the closest current artifact to path-specialized devirtualized blocks:

Path Microcode Coverage	Paths	State-Trace Events
concrete source-handler paths	400	248906
100% target/IP validated paths	387	248300
paths with sampled expression rows	343	245901
paths with sampled slot expression	343	245901
paths from static-validated sources	387	248300
paths from affine-dispatch fallback sources	13	606

The native state-only path microcode variant is the better match for the refreshed low-bit path formulas: it has 403 concrete path rows, 392 fully target/IP-validated paths, sampled expression rows for 352 paths covering 246298 events, and sampled slot expressions for the same 352 paths. The top native path row is entry 307 path 594cbf6454cdfe82, with 7050 state-trace events and slot expression (u16_1 - 0x665a9b5) & 0xffff, followed by entry 258 path 4be73f077fec7fc7 with 6275 events and its non-affine state-derived slot expression. The Markdown digests vm_path_microcode_top.md and vm_path_microcode_fast_top.md are useful for quickly inspecting these high-volume specialized blocks.

The legacy GPR+scratch-seeded path microcode variant uses vm_static_path_variants_gpr_seeded.tsv and vm_static_path_transfer_expr_gpr_seeded.tsv. It has 737 concrete path rows; 724 paths covering 248363 state-trace events validate target and IP at 100%. The native seeded variant is the stronger concrete view after biased scratch-frame, stack-pointer, image-backed, low-bit, restore-trampoline, and fs0x128 normalization: 570 paths, 560 validated paths, and sampled expression/slot rows for 462 paths covering 245646 events.

vm_path_pseudocode_dump.py renders the native GPR+scratch-seeded path microcode into concrete C-like branch-path functions. make path-pseudocode writes vm_path_handlers_pseudocode.c, vm_path_handlers_hot_pseudocode.c, and the separate vm_path_handlers_frontier_pseudocode.c weak frontier file. The full validated file currently has 560 validated path_entry_NNN_hash(VMState *vm) functions, 560 metadata rows, 560 dispatcher cases keyed by entry and path hash, one vm_call_path_handler dispatcher, 383 executable next-entry assignments (373 direct entry-index formulas and 10 table-offset formulas), 452 concrete VM-IP updates, and 69 long or clipped slot formulas preserved as comments instead of emitted as invalid C. The frontier file adds 10 unvalidated path_entry_NNN_hash(VMState *vm) functions, 10 metadata rows, and 10 dispatcher cases, with explicit 0% target/IP validation comments. vm_path_frontier_slot_audit.c evaluates those 10 weak rows' slot expressions against bounded source trace rows and records 10 not_promotable verdicts, with 0 direct dispatch-table matches and 0 rows having any table match. These files share the unsigned-expression rendering used by the handler layer and are covered by make pseudocode-syntax-check, so the path-specialized outputs pass C11 -fsyntax-only parsing with warning-enabled handler checks. This splits multi-variant handlers into separate concrete branch paths; it is still path evidence from the state/GPR trace set, not proof that every runtime config branch has been exercised.

The register-role trace in dumps/vmtail-regs-wide-w16 logs all GPRs for 250000 VMTAIL events. vm_tail_registers.py compares each register to the current dispatch target, frame+0x10f table base, table + target_entry*8, and target_entry*8.

Per role-row totals:

Role	Rows	Events
frame_pointer	228	301059
target_value	201	276083
slot_pointer	170	250297
table_slot_match	170	250297
byte_index	183	212985
table_slot_other	37	19848
table_value	10	2541
entry_index	32	2336

The compact site summary has 187 tail/dispatcher sites. All 187 have a 100% target register or target memory operand and frame register. Of those, 162 have a 100% dispatch-slot pointer register, 146 have a 100% byte-index register, and 127 have both. This recovers the register allocation for the final dispatch calculation at most observed tail sites.

Top register-role sites:

Site	Events	Target	Slot Ptr	Byte Index	Frame	Top Targets
0xae32f	9696	r11	r10	rcx	rbp	215,43,307,297
0x7e7ca	8351	r11	rbx	r14	rbp	347,189,43,258
0xc0d7b	8166	rdi	r8	partial r11	r10	18,168,28,297
0x90893	7732	rdi	r11	rdx	rbp	66,185,199,158
0xbf886	7554	r15	r8	r14	r11	28,307,66,161
0xbf126	7506	rbx	r10	r11	rbp	66,174,297,196
0x9eac9	7466	rdx	r11	r13	rbp	43,307,297,18
0x7c308	7406	rcx	r13	partial r9	rbp	114,347,258,300
0x859f9	7189	r8	r11	rdx	rbp	337,340,64,123
0xa4a5e	7122	r14	r8	rcx	rbp	189,114,347,258

Joining the site-role table back onto the long instruction trace gives 208 source-handler/tail-site rows covering 769225 instruction events and 202 unique source handlers. The 250k register trace plus central-dispatch traps covers 199 rows and 769199 long-run instruction events. In the joined long trace:

• 175 source/site rows have a live dispatch-slot register, covering 747389 instruction events.
• 168 rows have a byte-index register, covering 705637 events.
• 150 rows have both live slot and byte-index registers, covering 686337 events.

Top joined handler-tail roles:

Entry	Handler	Site	Events	Target	Slot Ptr	Byte Index	Top Targets
258	0xadf2c	0xae32f	28058	r11	r10	rcx	307,199,297,215
28	0x7e390	0x7e7ca	26610	r11	rbx	r14	347,258,340,337
337	0xbec0e	0xbf126	26534	rbx	r10	r11	297,66,307,28
340	0xbf435	0xbf886	26112	r15	r8	r14	307,28,66,185
18	0x7be9b	0x7c308	25448	rcx	r13	none	114,189,347,258
114	0x90319	0x90893	25300	rdi	r11	rdx	66,185,215,18
189	0x9e7af	0x9eac9	25112	rdx	r11	r13	18,297,215,174
347	0xc088d	0xc0d7b	24299	rdi	r8	partial r11	18,307,297,28

The central dispatcher rows are not jmp reg tails: 0xc80b9 and 0xcdac7 both execute jmp *(%rax) after computing rax = table + rbx. The dispatch trap logs slot=RAX, idx=RBX, frame=RBP, and target=*(RAX), so vm_tail_registers.py now treats those DISPATCH rows as register-role evidence too.

vm_tail_static_slots.tsv then fills the high-frequency live-slot gaps by slicing backward from the final target load:

Static Kind	Rows	Events	Meaning
live_slot	157	744005	slot pointer still live at the tail snapshot
consumed_slot	24	21810	slot temp found statically, then clobbered before the jump
central_indirect	18	3384	central jmp *(%rax) dispatcher rows
no_static_load	9	17	only tiny low-count rows remain unresolved

Top consumed-slot recoveries:

Entry	Site	Events	Target	Byte Index	Static Slot Temp	Load Site	Index Add
20	0x7ca96	9485	rcx	rax	r14	0x7ca6a	0x7ca5d
256	0xadbfa	3880	r9	r14	r10	0xadbd0	0xadbae
273	0xb1545	2115	r9	rsi	r13	0xb1519	0xb1502
345	0xc0532	1883	r14	r11	r9	0xc050e	0xc050b
292	0xb593d	651	rbx	static r9	r14	0xb590a	0xb58f2
90	0x8b6db	567	r12	static r12	r15	0x8b6a1	0x8b695
281	0xb3125	555	r12	rcx	rdx	0xb30f5	0xb30eb
291	0xb540d	479	rdx	r10	r9	0xb53d1	0xb53bb
316	0xba0cc	447	rax	static rdi	r10	0xb9fb8	0xb9fa7

After central-dispatch integration and static consumed-slot recovery, only 17 long-run instruction events lack any register/static tail-slot evidence.

vm_instruction_lift.tsv is the current highest-level recovered instruction catalog. It joins exact unique bytecode instructions, per-signature state effects from the state-aware trace, compact state-affine tags, static state/dispatch validation tags, tail target registers, live/static slot provenance, and compact dispatch-formula tags.

Coverage in the lift catalog:

Coverage	Rows	Events
exact unique instructions	71364	767575
with state-effect signature	43156	684376
with tail target register/operand	71354	767558
with live/static slot temp	71364	767575
with byte/static index register	65876	706858
from source with state-affine fit	8077	86528
from source with robust state-affine CV	5413	60256
from source with static state validation	71343	767546
from source with 100% static state validation	71339	767542
from source with static dispatch/IP validation	71343	767546
from source with 100% static dispatch/IP validation	71237	764108
with combined dispatch model	71343	767546
with scalar dispatch formula tag	71343	767546
from source with affine dispatch fit	11753	126720
from source with robust affine CV	9197	101596
from source with robust state and dispatch CV	1019	10319

State classes in the lifted exact catalog:

State Class	Rows	Events
state_add_const	36946	601868
state_mixed	4315	55646
state_const_post	1576	19423
state_preserve	317	7437
not observed in state trace	28201	83192

The lift catalog also carries the best fitted dispatch-index formula per source handler where available. vm_dispatch_formula.py models the final dispatch byte index as target_entry * 8 and searches simple byte/state expressions. This is intentionally conservative; formulas that are only constant-majority are useful for triage but not treated as decoded semantics.

High-confidence byte-only dispatch formulas validated against the long exact catalog:

Entry	Formula	Events	Meaning
28	u16_0	26610	first instruction word is direct byte index
215	u16_0	21174	first instruction word is direct byte index
171	(u16_0&0x1ff)*8	2533	low 9 bits select dispatch entry
354	(u16_0&0x1ff)*8	1872	low 9 bits select dispatch entry
165	(u16_0&0x1ff)*8	1825	low 9 bits select dispatch entry
169	(u16_0&0x1ff)*8	1796	low 9 bits select dispatch entry
310	(u16_2&0x1ff)*8	1614	third byte-aligned word selects entry
200	u16_4	1511	word at byte offset 4 is direct byte index
105	u16_2	671	word at byte offset 2 is direct byte index
349	u16_2	503	word at byte offset 2 is direct byte index

Byte-only formulas fully validated for 16 source handlers and 60551 long-run exact events. Direct u16_* formulas account for 54436 matched events; masked u16_* formulas account for 9753 matched events. State-dependent formulas cannot be validated against the state-less long catalog, but the state-aware trace gives full fits for these handlers:

Entry	Formula	State-Trace Events	Unique Targets
305	(state+u16_0)&0x1fff	2662	25
91	(state^u16_0)&0x1fff	546	30
107	(state-u16_0)&0x7ff	256	1
217	(u16_1-post)&0x1fff	206	8
74	(u16_0-post)&0x1fff	25	6

vm_dispatch_affine.py adds a broader GF(2) affine solver over byte bits, pre-dispatch state bits, and post-state bits. It exactly fits 108 of 179 state-trace source handlers, covering 44812 of 248906 state-trace events; 71 high-volume handlers remain inconsistent under this model. The lifted long catalog carries the affine fit status by source handler, tagging 11753 exact rows and 126720 long-run events as belonging to state-trace-fitted sources.

vm_dispatch_affine_cv.py applies a 5-fold held-out check to the same feature family. It finds 48 robust source handlers covering 33784 state-trace events with 100% held-out prediction. Another 50 sources are partial, covering 11207 state-trace events, 70 sources have no train-fold fit, and 11 one-off sources have no usable held-out split. In the lifted long catalog, the robust affine subset covers 9197 exact rows and 101596 events. Non-robust affine rows are triage hypotheses unless they are simple byte-only forms or otherwise independently validated.

Representative robust affine fits from the state-aware trace:

Entry	Events	Unique Targets	Terms	Notes
28	8348	80	9 byte	equivalent to direct u16_0 index bits
215	7121	78	9 byte	equivalent to direct u16_0 index bits
172	4530	64	9 byte + constants	byte-offset 2/3 index bits with fixed inversions
315	3298	25	9 byte + constants	byte-offset 2/3 index bits with fixed inversions
203	3283	59	8 byte + 1 post	mostly direct u16_0, with bit 11 from post-state

Top auto3 tail targets:

Count	Entry	Target
6477	258	0xadf2c
6033	28	0x7e390
5986	347	0xc088d
5505	114	0x90319
5327	189	0x9e7af
5089	66	0x855ff
4900	340	0xbf435
4663	18	0x7be9b
4656	337	0xbec0e

New high-value next entries from vm_tail_scan.py dumps/vmtail-auto3 include 161 (0x9975a), 176 (0x9c10b), 301 (0xb708d), 144 (0x95887), 160 (0x994cf), 319 (0xba72f), 198 (0xa037e), 260 (0xae90b), 257 (0xadbfd), and 30 (0x7e849).

The observed handler blocks consistently read 16-bit words from the current frame+0x0a bytecode pointer, combine them with frame+0x170 state, index through frame+0x10f, advance frame+0x0a, then tail-jump to the resolved handler. The raw 16-bit words are not direct table indices; the selected target depends on the per-frame rolling state.

The most useful next deobfuscation path is broader dynamic basic-block recovery rather than linear disassembly:

1. Use EAC-relative hook call sites as anchors for side-effectful blocks.
2. Break or instrument dispatcher entries (0xc823b, 0xcdc60, and neighbors) to log logical next targets.
3. Normalize stack VM sequences into direct register assignments/jumps.
4. Re-run with throttled /proc tracing so long-running workers can complete without producing noisy logs.

Unattended reconstruction checkpoint 2026-05-06T15:24:53 added batches 594-595. Batch function counts: 594=41, 595=69. This pass changed semantic .text coverage by +8192 bytes and uncovered .text by -8192 bytes. Current status is latest batch 595, 1347820 all-evidence lines / 92548276 bytes, 645 sidecar sections, 20532 prefixed RetDec/manual native functions, 386390 prefixed evidence symbols, 27574 recovered .text range rows, 2405094 recovered .text bytes, 3241834 uncovered .text bytes (42.59%), and an exact carrier matching 2768 gap rows / 3241834 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-152301.log.

Unattended reconstruction checkpoint 2026-05-06T15:31:38 added batches 596-633. Batch function counts: 596=55, 597=55, 598=35, 599=62, 600=67, 601=50, 602=52, 603=50, 604=14, 605=62, 606=49, 607=63, 608=60, 609=56, 610=46, 611=24, 612=28, 613=75, 614=1, 615=1, 616=11, 617=5, 618=14, 619=10, 620=7, 621=6, 622=5, 623=11, 624=7, 625=3, 626=2, 627=5, 628=6, 629=12, 630=61, 631=41, 632=53, 633=58. This pass changed semantic .text coverage by +95360 bytes and uncovered .text by -95360 bytes. Current status is latest batch 633, 1371620 all-evidence lines / 94252276 bytes, 683 sidecar sections, 21754 prefixed RetDec/manual native functions, 410185 prefixed evidence symbols, 28988 recovered .text range rows, 2500454 recovered .text bytes, 3146474 uncovered .text bytes (44.27%), and an exact carrier matching 2798 gap rows / 3146474 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-152553.log.

Unattended reconstruction checkpoint 2026-05-06T15:45:12 added batches 634-664. Batch function counts: 634=36, 635=34, 636=84, 637=55, 638=20, 639=25, 640=60, 641=64, 642=14, 643=50, 644=12, 645=4, 646=5, 647=6, 648=10, 649=1, 650=2, 651=5, 652=62, 653=68, 654=25, 655=20, 656=71, 657=51, 658=59, 659=33, 660=63, 661=50, 662=53, 663=37, 664=18. This pass changed semantic .text coverage by +94976 bytes and uncovered .text by -94976 bytes. Current status is latest batch 664, 1390746 all-evidence lines / 95614979 bytes, 714 sidecar sections, 22851 prefixed RetDec/manual native functions, 430046 prefixed evidence symbols, 30277 recovered .text range rows, 2595430 recovered .text bytes, 3051498 uncovered .text bytes (45.96%), and an exact carrier matching 2829 gap rows / 3051498 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-153935.log.

Unattended reconstruction checkpoint 2026-05-06T15:52:45 added batches 665-730. Batch function counts: 665=33, 666=3, 667=3, 668=3, 669=5, 670=11, 671=8, 672=14, 673=7, 674=50, 675=65, 676=40, 677=53, 678=45, 679=57, 680=54, 681=8, 682=14, 683=11, 684=1, 685=2, 686=2, 687=4, 688=14, 689=53, 690=4, 691=9, 692=9, 693=11, 694=7, 695=1, 696=6, 697=4, 698=71, 699=48, 700=61, 701=38, 702=48, 703=11, 704=7, 705=8, 706=7, 707=8, 708=4, 709=8, 710=10, 711=57, 712=2, 713=2, 714=2, 715=3, 716=3, 717=1, 718=2, 719=2, 720=30, 721=10, 722=15, 723=6, 724=3, 725=2, 726=8, 727=12, 728=7, 729=21, 730=41. This pass changed semantic .text coverage by +93696 bytes and uncovered .text by -93696 bytes. Current status is latest batch 730, 1424019 all-evidence lines / 98375054 bytes, 780 sidecar sections, 24020 prefixed RetDec/manual native functions, 468286 prefixed evidence symbols, 31638 recovered .text range rows, 2689126 recovered .text bytes, 2957802 uncovered .text bytes (47.62%), and an exact carrier matching 2848 gap rows / 2957802 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-154557.log.

Unattended reconstruction checkpoint 2026-05-06T16:01:09 added batches 731-761. Batch function counts: 731=29, 732=77, 733=43, 734=68, 735=33, 736=45, 737=17, 738=72, 739=48, 740=68, 741=72, 742=36, 743=53, 744=43, 745=47, 746=14, 747=4, 748=9, 749=14, 750=6, 751=8, 752=8, 753=8, 754=30, 755=34, 756=68, 757=51, 758=19, 759=67, 760=39, 761=57. This pass changed semantic .text coverage by +96384 bytes and uncovered .text by -96384 bytes. Current status is latest batch 761, 1444424 all-evidence lines / 99806884 bytes, 811 sidecar sections, 25207 prefixed RetDec/manual native functions, 488737 prefixed evidence symbols, 33017 recovered .text range rows, 2785510 recovered .text bytes, 2861418 uncovered .text bytes (49.32%), and an exact carrier matching 2873 gap rows / 2861418 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-155528.log.

Unattended reconstruction checkpoint 2026-05-06T16:07:35 added batches 762-792. Batch function counts: 762=73, 763=39, 764=41, 765=53, 766=43, 767=11, 768=11, 769=8, 770=6, 771=2, 772=5, 773=1, 774=2, 775=49, 776=9, 777=23, 778=34, 779=61, 780=47, 781=58, 782=59, 783=34, 784=20, 785=61, 786=41, 787=55, 788=20, 789=54, 790=45, 791=43, 792=49. This pass changed semantic .text coverage by +93312 bytes and uncovered .text by -93312 bytes. Current status is latest batch 792, 1463584 all-evidence lines / 101190378 bytes, 842 sidecar sections, 26264 prefixed RetDec/manual native functions, 508878 prefixed evidence symbols, 34266 recovered .text range rows, 2878822 recovered .text bytes, 2768106 uncovered .text bytes (50.98%), and an exact carrier matching 2892 gap rows / 2768106 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-160132.log.

Unattended reconstruction checkpoint 2026-05-06T16:13:57 added batches 793-816. Batch function counts: 793=33, 794=56, 795=68, 796=40, 797=36, 798=66, 799=62, 800=50, 801=18, 802=42, 803=50, 804=66, 805=35, 806=52, 807=16, 808=26, 809=62, 810=40, 811=31, 812=49, 813=50, 814=16, 815=58, 816=47. This pass changed semantic .text coverage by +92800 bytes and uncovered .text by -92800 bytes. Current status is latest batch 816, 1480170 all-evidence lines / 102291242 bytes, 866 sidecar sections, 27333 prefixed RetDec/manual native functions, 525213 prefixed evidence symbols, 35527 recovered .text range rows, 2971622 recovered .text bytes, 2675306 uncovered .text bytes (52.62%), and an exact carrier matching 2919 gap rows / 2675306 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-160810.log.

Unattended reconstruction checkpoint 2026-05-06T16:20:08 added batches 817-847. Batch function counts: 817=32, 818=63, 819=54, 820=49, 821=61, 822=20, 823=72, 824=4, 825=1, 826=3, 827=8, 828=5, 829=6, 830=11, 831=7, 832=59, 833=31, 834=66, 835=43, 836=42, 837=79, 838=34, 839=34, 840=21, 841=72, 842=62, 843=13, 844=42, 845=62, 846=39, 847=13. This pass changed semantic .text coverage by +96256 bytes and uncovered .text by -96256 bytes. Current status is latest batch 847, 1499697 all-evidence lines / 103671036 bytes, 897 sidecar sections, 28441 prefixed RetDec/manual native functions, 545352 prefixed evidence symbols, 36827 recovered .text range rows, 3067878 recovered .text bytes, 2579050 uncovered .text bytes (54.32%), and an exact carrier matching 2944 gap rows / 2579050 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-161419.log.

Unattended reconstruction checkpoint 2026-05-06T16:28:38 added batches 848-871. Batch function counts: 848=45, 849=56, 850=53, 851=35, 852=64, 853=18, 854=49, 855=50, 856=45, 857=25, 858=26, 859=68, 860=74, 861=70, 862=40, 863=51, 864=53, 865=60, 866=50, 867=75, 868=58, 869=56, 870=29, 871=17. This pass changed semantic .text coverage by +93568 bytes and uncovered .text by -93568 bytes. Current status is latest batch 871, 1517472 all-evidence lines / 104838261 bytes, 921 sidecar sections, 29608 prefixed RetDec/manual native functions, 562138 prefixed evidence symbols, 38186 recovered .text range rows, 3161446 recovered .text bytes, 2485482 uncovered .text bytes (55.98%), and an exact carrier matching 2972 gap rows / 2485482 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-162249.log.

Unattended reconstruction checkpoint 2026-05-06T16:35:21 added batches 872-909. Batch function counts: 872=46, 873=49, 874=17, 875=55, 876=26, 877=10, 878=6, 879=11, 880=5, 881=2, 882=6, 883=12, 884=8, 885=36, 886=56, 887=45, 888=40, 889=58, 890=57, 891=3, 892=2, 893=7, 894=11, 895=4, 896=8, 897=1, 898=3, 899=24, 900=15, 901=69, 902=66, 903=91, 904=58, 905=62, 906=69, 907=68, 908=33, 909=60. This pass changed semantic .text coverage by +96640 bytes and uncovered .text by -96640 bytes. Current status is latest batch 909, 1539778 all-evidence lines / 106521591 bytes, 959 sidecar sections, 30807 prefixed RetDec/manual native functions, 586370 prefixed evidence symbols, 39577 recovered .text range rows, 3258086 recovered .text bytes, 2388842 uncovered .text bytes (57.69%), and an exact carrier matching 2987 gap rows / 2388842 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-162907.log.

Unattended reconstruction checkpoint 2026-05-06T17:24:04 added batches 1647-1775. Batch function counts: 1647=12, 1648=9, 1649=8, 1650=8, 1651=10, 1652=8, 1653=9, 1654=1, 1655=5, 1656=13, 1657=8, 1658=9, 1659=9, 1660=9, 1661=3, 1662=9, 1663=2, 1664=8, 1665=8, 1666=3, 1667=1, 1668=3, 1669=13, 1670=7, 1671=3, 1672=10, 1673=2, 1674=3, 1675=8, 1676=2, 1677=5, 1678=2, 1679=70, 1680=1, 1681=1, 1682=9, 1683=6, 1684=7, 1685=2, 1686=3, 1687=9, 1688=13, 1689=5, 1690=13, 1691=13, 1692=8, 1693=15, 1694=1, 1695=1, 1696=5, 1697=4, 1698=4, 1699=6, 1700=9, 1701=6, 1702=3, 1703=9, 1704=12, 1705=6, 1706=11, 1707=1, 1708=2, 1709=2, 1710=3, 1711=3, 1712=6, 1713=1, 1714=2, 1715=1, 1716=10, 1717=3, 1718=1, 1719=12, 1720=12, 1721=7, 1722=14, 1723=1, 1724=2, 1725=2, 1726=5, 1727=3, 1728=100, 1729=71, 1730=70, 1731=48, 1732=77, 1733=54, 1734=88, 1735=6, 1736=6, 1737=6, 1738=1, 1739=10, 1740=10, 1741=4, 1742=13, 1743=8, 1744=4, 1745=6, 1746=2, 1747=1, 1748=4, 1749=1, 1750=1, 1751=88, 1752=102, 1753=14, 1754=15, 1755=4, 1756=12, 1757=9, 1758=9, 1759=5, 1760=7, 1761=8, 1762=6, 1763=2, 1764=9, 1765=8, 1766=10, 1767=7, 1768=13, 1769=104, 1770=97, 1771=85, 1772=75, 1773=58, 1774=113, 1775=54. This pass changed semantic .text coverage by +172154 bytes and uncovered .text by -172154 bytes. Current status is latest batch 1775, 2029153 all-evidence lines / 145609572 bytes, 1825 sidecar sections, 50131 prefixed RetDec/manual native functions, 1121414 prefixed evidence symbols, 62221 recovered .text range rows, 4862122 recovered .text bytes, 784806 uncovered .text bytes (86.10%), and an exact carrier matching 3190 gap rows / 784806 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass008-20260506-171558.log.

Unattended reconstruction checkpoint 2026-05-06T17:59:52 added batches 3801-3948. Batch function counts: 3801=132, 3802=2, 3803=3, 3804=2, 3805=1, 3806=1, 3807=2, 3808=3, 3809=1, 3810=1, 3811=3, 3812=1, 3813=1, 3814=1, 3815=2, 3816=3, 3817=1, 3818=5, 3819=5, 3820=9, 3821=2, 3822=2, 3823=2, 3824=1, 3825=1, 3826=2, 3827=3, 3828=1, 3829=9, 3830=5, 3831=1, 3832=3, 3833=5, 3834=3, 3835=5, 3836=2, 3837=2, 3838=1, 3839=7, 3840=1, 3841=1, 3842=2, 3843=1, 3844=1, 3845=2, 3846=1, 3847=1, 3848=1, 3849=1, 3850=4, 3851=2, 3852=2, 3853=2, 3854=2, 3855=1, 3856=8, 3857=3, 3858=1, 3859=4, 3860=2, 3861=2, 3862=5, 3863=4, 3864=8, 3865=3, 3866=102, 3867=2, 3868=1, 3869=2, 3870=1, 3871=5, 3872=5, 3873=3, 3874=1, 3875=4, 3876=1, 3877=3, 3878=3, 3879=2, 3880=2, 3881=3, 3882=1, 3883=1, 3884=2, 3885=1, 3886=5, 3887=3, 3888=5, 3889=2, 3890=3, 3891=1, 3892=6, 3893=4, 3894=2, 3895=5, 3896=2, 3897=1, 3898=1, 3899=96, 3900=71, 3901=78, 3902=76, 3903=86, 3904=93, 3905=80, 3906=65, 3907=53, 3908=61, 3909=1, 3910=2, 3911=1, 3912=1, 3913=1, 3914=1, 3915=1, 3916=2, 3917=2, 3918=3, 3919=1, 3920=2, 3921=2, 3922=1, 3923=2, 3924=2, 3925=3, 3926=2, 3927=1, 3928=2, 3929=2, 3930=2, 3931=2, 3932=2, 3933=2, 3934=3, 3935=1, 3936=1, 3937=1, 3938=3, 3939=1, 3940=3, 3941=47, 3942=58, 3943=46, 3944=44, 3945=54, 3946=40, 3947=35, 3948=41. This pass changed semantic .text coverage by +52411 bytes and uncovered .text by -52411 bytes. Current status is latest batch 3948, 2941148 all-evidence lines / 236836760 bytes, 3998 sidecar sections, 61320 prefixed RetDec/manual native functions, 2326446 prefixed evidence symbols, 76482 recovered .text range rows, 5529879 recovered .text bytes, 117049 uncovered .text bytes (97.92%), and an exact carrier matching 1743 gap rows / 117049 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass004-20260506-174914.log.

Unattended reconstruction checkpoint 2026-05-06T18:42:52 added batches 5997-6653. Batch function counts: 5997=1, 5998=1, 5999=1, 6000=5, 6001=1, 6002=1, 6003=1, 6004=2, 6005=1, 6006=1, 6007=1, 6008=1, 6009=1, 6010=1, 6011=1, 6012=1, 6013=1, 6014=1, 6015=2, 6016=2, 6017=1, 6018=1, 6019=1, 6020=1, 6021=1, 6022=1, 6023=1, 6024=1, 6025=1, 6026=1, 6027=1, 6028=1, 6029=1, 6030=2, 6031=1, 6032=1, 6033=1, 6034=1, 6035=1, 6036=1, 6037=1, 6038=1, 6039=2, 6040=2, 6041=1, 6042=1, 6043=1, 6044=3, 6045=1, 6046=1, 6047=1, 6048=3, 6049=2, 6050=1, 6051=3, 6052=1, 6053=1, 6054=1, 6055=1, 6056=1, 6057=1, 6058=1, 6059=2, 6060=1, 6061=2, 6062=1, 6063=1, 6064=3, 6065=1, 6066=1, 6067=1, 6068=1, 6069=1, 6070=3, 6071=1, 6072=1, 6073=1, 6074=1, 6075=2, 6076=1, 6077=1, 6078=1, 6079=1, 6080=1, 6081=1, 6082=1, 6083=1, 6084=1, 6085=1, 6086=2, 6087=1, 6088=1, 6089=1, 6090=2, 6091=1, 6092=1, 6093=2, 6094=2, 6095=1, 6096=3, 6097=1, 6098=1, 6099=1, 6100=3, 6101=1, 6102=1, 6103=3, 6104=3, 6105=4, 6106=3, 6107=1, 6108=2, 6109=1, 6110=3, 6111=1, 6112=1, 6113=1, 6114=1, 6115=1, 6116=2, 6117=1, 6118=1, 6119=3, 6120=1, 6121=1, 6122=1, 6123=1, 6124=1, 6125=1, 6126=2, 6127=1, 6128=1, 6129=1, 6130=1, 6131=1, 6132=1, 6133=2, 6134=1, 6135=1, 6136=1, 6137=2, 6138=1, 6139=1, 6140=1, 6141=1, 6142=2, 6143=1, 6144=2, 6145=1, 6146=2, 6147=1, 6148=1, 6149=1, 6150=1, 6151=1, 6152=2, 6153=2, 6154=1, 6155=1, 6156=1, 6157=1, 6158=1, 6159=1, 6160=1, 6161=1, 6162=2, 6163=2, 6164=1, 6165=1, 6166=3, 6167=1, 6168=1, 6169=1, 6170=1, 6171=1, 6172=1, 6173=1, 6174=1, 6175=1, 6176=1, 6177=1, 6178=2, 6179=1, 6180=1, 6181=1, 6182=1, 6183=1, 6184=1, 6185=1, 6186=1, 6187=1, 6188=1, 6189=1, 6190=2, 6191=1, 6192=2, 6193=1, 6194=2, 6195=1, 6196=1, 6197=2, 6198=4, 6199=1, 6200=1, 6201=1, 6202=1, 6203=1, 6204=1, 6205=1, 6206=1, 6207=1, 6208=1, 6209=1, 6210=1, 6211=1, 6212=1, 6213=1, 6214=1, 6215=2, 6216=1, 6217=1, 6218=1, 6219=1, 6220=2, 6221=1, 6222=1, 6223=1, 6224=1, 6225=1, 6226=1, 6227=1, 6228=3, 6229=1, 6230=1, 6231=2, 6232=1, 6233=1, 6234=1, 6235=1, 6236=1, 6237=1, 6238=1, 6239=1, 6240=1, 6241=1, 6242=1, 6243=1, 6244=1, 6245=1, 6246=1, 6247=1, 6248=1, 6249=1, 6250=2, 6251=3, 6252=1, 6253=1, 6254=1, 6255=1, 6256=1, 6257=1, 6258=2, 6259=2, 6260=3, 6261=2, 6262=1, 6263=1, 6264=1, 6265=2, 6266=1, 6267=1, 6268=1, 6269=2, 6270=1, 6271=1, 6272=1, 6273=1, 6274=2, 6275=1, 6276=1, 6277=2, 6278=1, 6279=1, 6280=1, 6281=1, 6282=2, 6283=1, 6284=1, 6285=1, 6286=1, 6287=1, 6288=1, 6289=4, 6290=1, 6291=2, 6292=1, 6293=1, 6294=1, 6295=1, 6296=2, 6297=1, 6298=1, 6299=1, 6300=1, 6301=1, 6302=1, 6303=2, 6304=1, 6305=1, 6306=1, 6307=1, 6308=1, 6309=1, 6310=1, 6311=1, 6312=1, 6313=1, 6314=1, 6315=1, 6316=1, 6317=2, 6318=2, 6319=1, 6320=1, 6321=1, 6322=2, 6323=1, 6324=1, 6325=1, 6326=1, 6327=1, 6328=1, 6329=1, 6330=1, 6331=1, 6332=2, 6333=1, 6334=1, 6335=1, 6336=2, 6337=1, 6338=1, 6339=2, 6340=1, 6341=1, 6342=1, 6343=1, 6344=1, 6345=2, 6346=1, 6347=1, 6348=1, 6349=1, 6350=1, 6351=1, 6352=1, 6353=1, 6354=1, 6355=1, 6356=1, 6357=1, 6358=2, 6359=1, 6360=1, 6361=1, 6362=1, 6363=1, 6364=1, 6365=1, 6366=1, 6367=1, 6368=1, 6369=1, 6370=1, 6371=1, 6372=2, 6373=2, 6374=2, 6375=1, 6376=1, 6377=1, 6378=1, 6379=1, 6380=1, 6381=1, 6382=2, 6383=3, 6384=1, 6385=1, 6386=1, 6387=2, 6388=1, 6389=1, 6390=1, 6391=2, 6392=1, 6393=1, 6394=1, 6395=1, 6396=1, 6397=1, 6398=1, 6399=1, 6400=1, 6401=1, 6402=1, 6403=1, 6404=1, 6405=1, 6406=1, 6407=1, 6408=1, 6409=1, 6410=1, 6411=1, 6412=1, 6413=1, 6414=1, 6415=1, 6416=2, 6417=1, 6418=1, 6419=1, 6420=1, 6421=1, 6422=1, 6423=1, 6424=1, 6425=1, 6426=1, 6427=2, 6428=2, 6429=1, 6430=1, 6431=1, 6432=1, 6433=1, 6434=1, 6435=1, 6436=1, 6437=1, 6438=1, 6439=2, 6440=1, 6441=1, 6442=1, 6443=1, 6444=1, 6445=1, 6446=1, 6447=1, 6448=1, 6449=1, 6450=1, 6451=1, 6452=1, 6453=1, 6454=1, 6455=1, 6456=1, 6457=1, 6458=2, 6459=1, 6460=1, 6461=1, 6462=1, 6463=1, 6464=1, 6465=1, 6466=1, 6467=1, 6468=1, 6469=1, 6470=1, 6471=1, 6472=1, 6473=1, 6474=1, 6475=1, 6476=1, 6477=1, 6478=1, 6479=1, 6480=1, 6481=1, 6482=1, 6483=1, 6484=1, 6485=1, 6486=1, 6487=1, 6488=2, 6489=1, 6490=2, 6491=1, 6492=1, 6493=1, 6494=1, 6495=1, 6496=1, 6497=1, 6498=1, 6499=1, 6500=1, 6501=1, 6502=1, 6503=2, 6504=1, 6505=1, 6506=1, 6507=1, 6508=1, 6509=1, 6510=1, 6511=2, 6512=1, 6513=1, 6514=1, 6515=1, 6516=1, 6517=1, 6518=1, 6519=1, 6520=1, 6521=1, 6522=1, 6523=1, 6524=1, 6525=1, 6526=1, 6527=1, 6528=1, 6529=1, 6530=1, 6531=1, 6532=1, 6533=2, 6534=1, 6535=1, 6536=1, 6537=1, 6538=1, 6539=1, 6540=1, 6541=1, 6542=1, 6543=1, 6544=1, 6545=1, 6546=1, 6547=1, 6548=1, 6549=1, 6550=1, 6551=1, 6552=1, 6553=1, 6554=1, 6555=1, 6556=1, 6557=1, 6558=1, 6559=1, 6560=1, 6561=1, 6562=1, 6563=1, 6564=1, 6565=1, 6566=3, 6567=1, 6568=1, 6569=1, 6570=1, 6571=1, 6572=1, 6573=1, 6574=1, 6575=1, 6576=1, 6577=1, 6578=1, 6579=1, 6580=1, 6581=1, 6582=1, 6583=1, 6584=1, 6585=1, 6586=1, 6587=1, 6588=1, 6589=1, 6590=1, 6591=1, 6592=1, 6593=1, 6594=2, 6595=1, 6596=1, 6597=2, 6598=1, 6599=1, 6600=2, 6601=2, 6602=2, 6603=1, 6604=1, 6605=1, 6606=2, 6607=2, 6608=2, 6609=1, 6610=2, 6611=2, 6612=2, 6613=2, 6614=2, 6615=2, 6616=2, 6617=2, 6618=2, 6619=2, 6620=2, 6621=2, 6622=2, 6623=2, 6624=1, 6625=1, 6626=1, 6627=1, 6628=1, 6629=1, 6630=1, 6631=1, 6632=1, 6633=1, 6634=1, 6635=1, 6636=1, 6637=78, 6638=72, 6639=69, 6640=64, 6641=73, 6642=69, 6643=67, 6644=66, 6645=64, 6646=66, 6647=71, 6648=67, 6649=64, 6650=64, 6651=64, 6652=64, 6653=62. This pass changed semantic .text coverage by +21754 bytes and uncovered .text by -21754 bytes. Current status is latest batch 6653, 3983968 all-evidence lines / 347660007 bytes, 6703 sidecar sections, 66076 prefixed RetDec/manual native functions, 3782888 prefixed evidence symbols, 85012 recovered .text range rows, 5629584 recovered .text bytes, 17344 uncovered .text bytes (99.69%), and an exact carrier matching 717 gap rows / 17344 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass002-20260506-182511.log.

Unattended reconstruction checkpoint 2026-05-06T19:13:40 added batches 6654-10116. Batch function counts: 6654=1, 6655=1, 6656=1, 6657=1, 6658=1, 6659=1, 6660=1, 6661=1, 6662=1, 6663=1, 6664=1, 6665=1, 6666=1, 6667=1, 6668=1, 6669=1, 6670=1, 6671=1, 6672=1, 6673=1, 6674=1, 6675=1, 6676=1, 6677=1, 6678=1, 6679=1, 6680=1, 6681=1, 6682=1, 6683=1, 6684=1, 6685=1, 6686=1, 6687=1, 6688=1, 6689=1, 6690=1, 6691=1, 6692=1, 6693=1, 6694=1, 6695=1, 6696=1, 6697=1, 6698=1, 6699=1, 6700=1, 6701=1, 6702=1, 6703=1, 6704=1, 6705=1, 6706=1, 6707=1, 6708=1, 6709=1, 6710=1, 6711=1, 6712=1, 6713=1, 6714=1, 6715=1, 6716=1, 6717=1, 6718=1, 6719=1, 6720=1, 6721=1, 6722=1, 6723=1, 6724=1, 6725=1, 6726=1, 6727=1, 6728=1, 6729=1, 6730=1, 6731=1, 6732=1, 6733=1, 6734=1, 6735=1, 6736=1, 6737=1, 6738=1, 6739=1, 6740=1, 6741=1, 6742=1, 6743=1, 6744=1, 6745=1, 6746=1, 6747=1, 6748=1, 6749=1, 6750=1, 6751=1, 6752=1, 6753=1, 6754=1, 6755=1, 6756=1, 6757=1, 6758=1, 6759=1, 6760=1, 6761=1, 6762=1, 6763=1, 6764=1, 6765=1, 6766=1, 6767=1, 6768=1, 6769=1, 6770=1, 6771=1, 6772=1, 6773=1, 6774=1, 6775=1, 6776=1, 6777=1, 6778=1, 6779=1, 6780=1, 6781=1, 6782=1, 6783=1, 6784=1, 6785=1, 6786=1, 6787=1, 6788=1, 6789=1, 6790=1, 6791=1, 6792=1, 6793=1, 6794=1, 6795=1, 6796=1, 6797=1, 6798=1, 6799=1, 6800=1, 6801=1, 6802=1, 6803=1, 6804=1, 6805=1, 6806=1, 6807=1, 6808=1, 6809=1, 6810=1, 6811=1, 6812=1, 6813=1, 6814=1, 6815=1, 6816=1, 6817=1, 6818=1, 6819=1, 6820=1, 6821=1, 6822=1, 6823=1, 6824=1, 6825=1, 6826=1, 6827=1, 6828=1, 6829=1, 6830=1, 6831=1, 6832=1, 6833=1, 6834=1, 6835=1, 6836=1, 6837=1, 6838=1, 6839=1, 6840=1, 6841=1, 6842=1, 6843=1, 6844=1, 6845=1, 6846=1, 6847=1, 6848=1, 6849=1, 6850=1, 6851=1, 6852=1, 6853=1, 6854=1, 6855=1, 6856=1, 6857=1, 6858=1, 6859=1, 6860=1, 6861=1, 6862=1, 6863=1, 6864=1, 6865=1, 6866=1, 6867=1, 6868=1, 6869=1, 6870=1, 6871=1, 6872=1, 6873=1, 6874=1, 6875=1, 6876=1, 6877=1, 6878=1, 6879=1, 6880=1, 6881=1, 6882=1, 6883=1, 6884=1, 6885=1, 6886=1, 6887=1, 6888=1, 6889=1, 6890=1, 6891=1, 6892=1, 6893=1, 6894=1, 6895=1, 6896=1, 6897=1, 6898=1, 6899=1, 6900=1, 6901=1, 6902=1, 6903=1, 6904=1, 6905=1, 6906=1, 6907=1, 6908=1, 6909=1, 6910=1, 6911=1, 6912=1, 6913=1, 6914=1, 6915=1, 6916=1, 6917=1, 6918=1, 6919=1, 6920=1, 6921=1, 6922=1, 6923=1, 6924=1, 6925=1, 6926=1, 6927=1, 6928=1, 6929=1, 6930=1, 6931=1, 6932=1, 6933=1, 6934=1, 6935=1, 6936=1, 6937=1, 6938=1, 6939=1, 6940=1, 6941=1, 6942=1, 6943=1, 6944=1, 6945=1, 6946=1, 6947=1, 6948=1, 6949=1, 6950=1, 6951=1, 6952=1, 6953=1, 6954=1, 6955=1, 6956=1, 6957=1, 6958=1, 6959=1, 6960=1, 6961=1, 6962=1, 6963=1, 6964=1, 6965=1, 6966=1, 6967=1, 6968=1, 6969=1, 6970=1, 6971=1, 6972=1, 6973=1, 6974=1, 6975=1, 6976=1, 6977=1, 6978=1, 6979=1, 6980=1, 6981=1, 6982=1, 6983=1, 6984=1, 6985=1, 6986=1, 6987=1, 6988=1, 6989=1, 6990=1, 6991=1, 6992=1, 6993=1, 6994=1, 6995=1, 6996=1, 6997=1, 6998=1, 6999=1, 7000=1, 7001=1, 7002=1, 7003=1, 7004=1, 7005=1, 7006=1, 7007=1, 7008=1, 7009=1, 7010=1, 7011=1, 7012=1, 7013=1, 7014=1, 7015=1, 7016=1, 7017=1, 7018=1, 7019=1, 7020=1, 7021=1, 7022=1, 7023=1, 7024=1, 7025=1, 7026=1, 7027=1, 7028=1, 7029=1, 7030=1, 7031=1, 7032=1, 7033=1, 7034=1, 7035=1, 7036=1, 7037=1, 7038=1, 7039=1, 7040=1, 7041=1, 7042=1, 7043=1, 7044=1, 7045=1, 7046=1, 7047=1, 7048=1, 7049=1, 7050=1, 7051=1, 7052=1, 7053=1, 7054=1, 7055=1, 7056=1, 7057=1, 7058=1, 7059=1, 7060=1, 7061=1, 7062=1, 7063=1, 7064=1, 7065=1, 7066=1, 7067=1, 7068=1, 7069=1, 7070=1, 7071=1, 7072=1, 7073=1, 7074=1, 7075=1, 7076=1, 7077=1, 7078=1, 7079=1, 7080=1, 7081=1, 7082=1, 7083=1, 7084=1, 7085=1, 7086=1, 7087=1, 7088=1, 7089=1, 7090=1, 7091=1, 7092=1, 7093=1, 7094=1, 7095=1, 7096=1, 7097=1, 7098=1, 7099=1, 7100=1, 7101=1, 7102=1, 7103=1, 7104=1, 7105=1, 7106=1, 7107=1, 7108=1, 7109=1, 7110=1, 7111=1, 7112=1, 7113=1, 7114=1, 7115=1, 7116=1, 7117=1, 7118=1, 7119=1, 7120=1, 7121=1, 7122=1, 7123=1, 7124=1, 7125=1, 7126=1, 7127=1, 7128=1, 7129=1, 7130=1, 7131=1, 7132=1, 7133=1, 7134=1, 7135=1, 7136=1, 7137=1, 7138=1, 7139=1, 7140=1, 7141=1, 7142=1, 7143=1, 7144=1, 7145=1, 7146=1, 7147=1, 7148=1, 7149=1, 7150=1, 7151=1, 7152=1, 7153=1, 7154=1, 7155=1, 7156=1, 7157=1, 7158=1, 7159=1, 7160=1, 7161=1, 7162=1, 7163=1, 7164=1, 7165=1, 7166=1, 7167=1, 7168=1, 7169=1, 7170=1, 7171=1, 7172=1, 7173=1, 7174=1, 7175=1, 7176=1, 7177=1, 7178=1, 7179=1, 7180=1, 7181=1, 7182=1, 7183=1, 7184=1, 7185=1, 7186=1, 7187=1, 7188=1, 7189=1, 7190=1, 7191=1, 7192=1, 7193=1, 7194=1, 7195=1, 7196=1, 7197=1, 7198=1, 7199=1, 7200=1, 7201=1, 7202=1, 7203=1, 7204=1, 7205=1, 7206=1, 7207=1, 7208=1, 7209=1, 7210=1, 7211=1, 7212=1, 7213=1, 7214=1, 7215=1, 7216=1, 7217=1, 7218=1, 7219=1, 7220=1, 7221=1, 7222=1, 7223=1, 7224=1, 7225=1, 7226=1, 7227=1, 7228=1, 7229=1, 7230=1, 7231=1, 7232=1, 7233=1, 7234=1, 7235=1, 7236=1, 7237=1, 7238=1, 7239=1, 7240=1, 7241=1, 7242=1, 7243=1, 7244=1, 7245=1, 7246=1, 7247=1, 7248=1, 7249=1, 7250=1, 7251=1, 7252=1, 7253=1, 7254=1, 7255=1, 7256=1, 7257=1, 7258=2, 7259=1, 7260=1, 7261=1, 7262=1, 7263=1, 7264=1, 7265=1, 7266=1, 7267=1, 7268=1, 7269=1, 7270=1, 7271=1, 7272=1, 7273=1, 7274=1, 7275=1, 7276=1, 7277=1, 7278=1, 7279=1, 7280=1, 7281=1, 7282=1, 7283=1, 7284=1, 7285=1, 7286=1, 7287=1, 7288=1, 7289=1, 7290=1, 7291=1, 7292=1, 7293=1, 7294=1, 7295=1, 7296=1, 7297=1, 7298=1, 7299=1, 7300=1, 7301=1, 7302=1, 7303=1, 7304=1, 7305=1, 7306=1, 7307=1, 7308=1, 7309=1, 7310=1, 7311=1, 7312=1, 7313=1, 7314=1, 7315=1, 7316=1, 7317=1, 7318=1, 7319=1, 7320=1, 7321=1, 7322=1, 7323=1, 7324=1, 7325=1, 7326=1, 7327=1, 7328=1, 7329=1, 7330=1, 7331=1, 7332=1, 7333=1, 7334=1, 7335=1, 7336=1, 7337=1, 7338=1, 7339=1, 7340=1, 7341=1, 7342=1, 7343=1, 7344=1, 7345=1, 7346=1, 7347=1, 7348=1, 7349=1, 7350=1, 7351=1, 7352=1, 7353=1, 7354=1, 7355=1, 7356=1, 7357=1, 7358=1, 7359=1, 7360=1, 7361=1, 7362=1, 7363=1, 7364=1, 7365=1, 7366=1, 7367=1, 7368=1, 7369=1, 7370=1, 7371=1, 7372=1, 7373=1, 7374=1, 7375=1, 7376=1, 7377=1, 7378=1, 7379=1, 7380=1, 7381=1, 7382=1, 7383=1, 7384=1, 7385=1, 7386=1, 7387=1, 7388=1, 7389=1, 7390=1, 7391=1, 7392=1, 7393=1, 7394=1, 7395=1, 7396=1, 7397=1, 7398=1, 7399=1, 7400=1, 7401=1, 7402=1, 7403=1, 7404=1, 7405=1, 7406=1, 7407=1, 7408=1, 7409=1, 7410=1, 7411=1, 7412=1, 7413=1, 7414=1, 7415=1, 7416=1, 7417=1, 7418=1, 7419=1, 7420=1, 7421=1, 7422=1, 7423=1, 7424=1, 7425=1, 7426=1, 7427=1, 7428=1, 7429=1, 7430=1, 7431=1, 7432=1, 7433=1, 7434=1, 7435=1, 7436=1, 7437=1, 7438=1, 7439=1, 7440=1, 7441=1, 7442=1, 7443=1, 7444=1, 7445=1, 7446=1, 7447=1, 7448=1, 7449=1, 7450=1, 7451=1, 7452=1, 7453=1, 7454=1, 7455=1, 7456=1, 7457=1, 7458=1, 7459=1, 7460=1, 7461=1, 7462=1, 7463=1, 7464=1, 7465=1, 7466=1, 7467=2, 7468=1, 7469=1, 7470=1, 7471=1, 7472=1, 7473=1, 7474=1, 7475=1, 7476=1, 7477=1, 7478=1, 7479=1, 7480=1, 7481=1, 7482=1, 7483=1, 7484=1, 7485=1, 7486=1, 7487=1, 7488=1, 7489=1, 7490=1, 7491=1, 7492=1, 7493=1, 7494=1, 7495=1, 7496=1, 7497=1, 7498=1, 7499=1, 7500=1, 7501=1, 7502=1, 7503=1, 7504=1, 7505=1, 7506=1, 7507=1, 7508=1, 7509=1, 7510=1, 7511=1, 7512=1, 7513=1, 7514=1, 7515=1, 7516=1, 7517=1, 7518=1, 7519=1, 7520=1, 7521=1, 7522=1, 7523=1, 7524=1, 7525=1, 7526=1, 7527=1, 7528=1, 7529=1, 7530=1, 7531=1, 7532=1, 7533=1, 7534=1, 7535=1, 7536=1, 7537=1, 7538=1, 7539=1, 7540=1, 7541=1, 7542=1, 7543=1, 7544=1, 7545=1, 7546=1, 7547=1, 7548=1, 7549=1, 7550=1, 7551=1, 7552=1, 7553=1, 7554=1, 7555=1, 7556=1, 7557=1, 7558=2, 7559=1, 7560=1, 7561=1, 7562=1, 7563=1, 7564=1, 7565=1, 7566=1, 7567=1, 7568=1, 7569=1, 7570=1, 7571=1, 7572=1, 7573=1, 7574=1, 7575=1, 7576=1, 7577=1, 7578=1, 7579=1, 7580=1, 7581=1, 7582=1, 7583=1, 7584=1, 7585=1, 7586=1, 7587=1, 7588=1, 7589=1, 7590=1, 7591=1, 7592=1, 7593=1, 7594=1, 7595=2, 7596=1, 7597=2, 7598=1, 7599=1, 7600=1, 7601=1, 7602=1, 7603=1, 7604=1, 7605=1, 7606=1, 7607=1, 7608=1, 7609=1, 7610=1, 7611=1, 7612=1, 7613=1, 7614=2, 7615=1, 7616=1, 7617=1, 7618=1, 7619=1, 7620=1, 7621=1, 7622=1, 7623=1, 7624=1, 7625=1, 7626=1, 7627=1, 7628=1, 7629=1, 7630=1, 7631=1, 7632=1, 7633=1, 7634=1, 7635=1, 7636=1, 7637=1, 7638=1, 7639=1, 7640=1, 7641=1, 7642=1, 7643=1, 7644=1, 7645=1, 7646=1, 7647=1, 7648=1, 7649=1, 7650=1, 7651=1, 7652=1, 7653=1, 7654=1, 7655=1, 7656=1, 7657=1, 7658=1, 7659=1, 7660=1, 7661=1, 7662=1, 7663=1, 7664=1, 7665=1, 7666=1, 7667=1, 7668=1, 7669=1, 7670=1, 7671=1, 7672=1, 7673=1, 7674=1, 7675=1, 7676=1, 7677=1, 7678=1, 7679=1, 7680=1, 7681=1, 7682=1, 7683=1, 7684=1, 7685=1, 7686=1, 7687=1, 7688=1, 7689=1, 7690=1, 7691=1, 7692=1, 7693=2, 7694=1, 7695=1, 7696=1, 7697=1, 7698=1, 7699=1, 7700=1, 7701=1, 7702=1, 7703=1, 7704=1, 7705=1, 7706=1, 7707=1, 7708=1, 7709=1, 7710=1, 7711=1, 7712=1, 7713=1, 7714=1, 7715=1, 7716=1, 7717=1, 7718=1, 7719=1, 7720=1, 7721=1, 7722=1, 7723=1, 7724=1, 7725=1, 7726=1, 7727=1, 7728=1, 7729=1, 7730=1, 7731=1, 7732=1, 7733=1, 7734=1, 7735=1, 7736=1, 7737=1, 7738=1, 7739=1, 7740=1, 7741=1, 7742=1, 7743=1, 7744=1, 7745=1, 7746=1, 7747=2, 7748=1, 7749=1, 7750=1, 7751=1, 7752=1, 7753=1, 7754=1, 7755=1, 7756=1, 7757=1, 7758=1, 7759=1, 7760=1, 7761=1, 7762=1, 7763=1, 7764=1, 7765=1, 7766=1, 7767=1, 7768=1, 7769=1, 7770=1, 7771=1, 7772=1, 7773=1, 7774=1, 7775=1, 7776=1, 7777=1, 7778=1, 7779=1, 7780=1, 7781=1, 7782=1, 7783=1, 7784=1, 7785=1, 7786=1, 7787=1, 7788=1, 7789=1, 7790=1, 7791=1, 7792=1, 7793=1, 7794=1, 7795=1, 7796=1, 7797=1, 7798=1, 7799=1, 7800=1, 7801=1, 7802=1, 7803=1, 7804=1, 7805=1, 7806=1, 7807=1, 7808=1, 7809=1, 7810=1, 7811=1, 7812=1, 7813=1, 7814=1, 7815=1, 7816=1, 7817=1, 7818=1, 7819=1, 7820=1, 7821=1, 7822=1, 7823=1, 7824=1, 7825=1, 7826=1, 7827=1, 7828=1, 7829=1, 7830=1, 7831=1, 7832=1, 7833=1, 7834=1, 7835=1, 7836=1, 7837=1, 7838=1, 7839=1, 7840=1, 7841=1, 7842=1, 7843=1, 7844=1, 7845=1, 7846=1, 7847=1, 7848=1, 7849=1, 7850=1, 7851=1, 7852=1, 7853=1, 7854=1, 7855=1, 7856=1, 7857=1, 7858=1, 7859=1, 7860=1, 7861=1, 7862=1, 7863=1, 7864=1, 7865=1, 7866=1, 7867=1, 7868=1, 7869=1, 7870=1, 7871=1, 7872=1, 7873=1, 7874=1, 7875=1, 7876=1, 7877=1, 7878=1, 7879=1, 7880=1, 7881=1, 7882=1, 7883=1, 7884=1, 7885=1, 7886=1, 7887=1, 7888=1, 7889=1, 7890=1, 7891=1, 7892=1, 7893=1, 7894=1, 7895=1, 7896=1, 7897=1, 7898=1, 7899=1, 7900=1, 7901=1, 7902=1, 7903=1, 7904=1, 7905=1, 7906=1, 7907=1, 7908=1, 7909=1, 7910=1, 7911=1, 7912=2, 7913=1, 7914=1, 7915=1, 7916=1, 7917=1, 7918=1, 7919=1, 7920=1, 7921=1, 7922=1, 7923=1, 7924=1, 7925=1, 7926=1, 7927=1, 7928=1, 7929=1, 7930=1, 7931=1, 7932=1, 7933=1, 7934=1, 7935=1, 7936=1, 7937=1, 7938=1, 7939=1, 7940=1, 7941=1, 7942=1, 7943=1, 7944=1, 7945=1, 7946=1, 7947=1, 7948=1, 7949=1, 7950=1, 7951=1, 7952=1, 7953=1, 7954=1, 7955=1, 7956=1, 7957=1, 7958=1, 7959=1, 7960=1, 7961=1, 7962=1, 7963=1, 7964=1, 7965=1, 7966=1, 7967=1, 7968=1, 7969=1, 7970=1, 7971=1, 7972=1, 7973=1, 7974=1, 7975=1, 7976=1, 7977=1, 7978=1, 7979=1, 7980=1, 7981=1, 7982=1, 7983=1, 7984=1, 7985=1, 7986=1, 7987=1, 7988=1, 7989=1, 7990=1, 7991=1, 7992=1, 7993=1, 7994=1, 7995=1, 7996=1, 7997=1, 7998=2, 7999=1, 8000=1, 8001=1, 8002=1, 8003=1, 8004=1, 8005=1, 8006=1, 8007=1, 8008=1, 8009=1, 8010=1, 8011=1, 8012=1, 8013=1, 8014=1, 8015=1, 8016=1, 8017=1, 8018=1, 8019=1, 8020=1, 8021=1, 8022=1, 8023=1, 8024=1, 8025=1, 8026=1, 8027=1, 8028=1, 8029=1, 8030=1, 8031=1, 8032=1, 8033=1, 8034=1, 8035=1, 8036=1, 8037=1, 8038=1, 8039=1, 8040=1, 8041=1, 8042=1, 8043=1, 8044=1, 8045=1, 8046=1, 8047=1, 8048=1, 8049=1, 8050=1, 8051=1, 8052=1, 8053=1, 8054=1, 8055=1, 8056=1, 8057=1, 8058=1, 8059=1, 8060=1, 8061=1, 8062=1, 8063=1, 8064=1, 8065=1, 8066=1, 8067=1, 8068=1, 8069=1, 8070=1, 8071=1, 8072=1, 8073=1, 8074=1, 8075=1, 8076=1, 8077=1, 8078=1, 8079=1, 8080=1, 8081=1, 8082=1, 8083=1, 8084=2, 8085=1, 8086=1, 8087=1, 8088=1, 8089=1, 8090=1, 8091=1, 8092=1, 8093=1, 8094=1, 8095=1, 8096=1, 8097=1, 8098=1, 8099=1, 8100=1, 8101=1, 8102=1, 8103=1, 8104=1, 8105=1, 8106=1, 8107=1, 8108=1, 8109=1, 8110=1, 8111=1, 8112=1, 8113=1, 8114=1, 8115=1, 8116=1, 8117=1, 8118=1, 8119=1, 8120=1, 8121=1, 8122=1, 8123=1, 8124=1, 8125=1, 8126=1, 8127=1, 8128=1, 8129=1, 8130=1, 8131=1, 8132=1, 8133=1, 8134=1, 8135=1, 8136=1, 8137=1, 8138=1, 8139=1, 8140=1, 8141=1, 8142=1, 8143=1, 8144=1, 8145=1, 8146=1, 8147=1, 8148=1, 8149=1, 8150=1, 8151=1, 8152=1, 8153=1, 8154=1, 8155=1, 8156=1, 8157=1, 8158=1, 8159=1, 8160=1, 8161=1, 8162=1, 8163=1, 8164=1, 8165=1, 8166=1, 8167=1, 8168=1, 8169=1, 8170=1, 8171=1, 8172=1, 8173=1, 8174=1, 8175=1, 8176=1, 8177=1, 8178=1, 8179=1, 8180=1, 8181=1, 8182=1, 8183=1, 8184=1, 8185=1, 8186=1, 8187=1, 8188=1, 8189=1, 8190=1, 8191=1, 8192=1, 8193=1, 8194=1, 8195=1, 8196=1, 8197=1, 8198=1, 8199=1, 8200=1, 8201=1, 8202=1, 8203=1, 8204=1, 8205=1, 8206=1, 8207=1, 8208=1, 8209=1, 8210=1, 8211=1, 8212=1, 8213=1, 8214=1, 8215=1, 8216=1, 8217=2, 8218=1, 8219=1, 8220=1, 8221=1, 8222=1, 8223=1, 8224=1, 8225=1, 8226=1, 8227=1, 8228=1, 8229=1, 8230=1, 8231=1, 8232=1, 8233=1, 8234=1, 8235=1, 8236=1, 8237=1, 8238=1, 8239=1, 8240=1, 8241=1, 8242=1, 8243=1, 8244=1, 8245=1, 8246=1, 8247=1, 8248=1, 8249=1, 8250=1, 8251=1, 8252=1, 8253=1, 8254=1, 8255=1, 8256=1, 8257=1, 8258=1, 8259=1, 8260=1, 8261=1, 8262=1, 8263=1, 8264=1, 8265=1, 8266=1, 8267=1, 8268=1, 8269=1, 8270=1, 8271=1, 8272=1, 8273=1, 8274=1, 8275=1, 8276=1, 8277=1, 8278=1, 8279=1, 8280=1, 8281=1, 8282=1, 8283=1, 8284=1, 8285=1, 8286=1, 8287=1, 8288=1, 8289=1, 8290=1, 8291=1, 8292=1, 8293=1, 8294=1, 8295=1, 8296=1, 8297=1, 8298=1, 8299=1, 8300=1, 8301=1, 8302=1, 8303=1, 8304=1, 8305=1, 8306=1, 8307=1, 8308=1, 8309=1, 8310=1, 8311=1, 8312=1, 8313=1, 8314=1, 8315=1, 8316=1, 8317=1, 8318=1, 8319=1, 8320=1, 8321=1, 8322=1, 8323=1, 8324=1, 8325=1, 8326=1, 8327=1, 8328=1, 8329=1, 8330=1, 8331=1, 8332=1, 8333=1, 8334=1, 8335=1, 8336=1, 8337=1, 8338=1, 8339=1, 8340=1, 8341=1, 8342=1, 8343=1, 8344=1, 8345=1, 8346=1, 8347=1, 8348=1, 8349=1, 8350=1, 8351=1, 8352=1, 8353=1, 8354=1, 8355=1, 8356=1, 8357=1, 8358=1, 8359=1, 8360=1, 8361=1, 8362=1, 8363=1, 8364=1, 8365=1, 8366=1, 8367=1, 8368=1, 8369=1, 8370=1, 8371=1, 8372=1, 8373=1, 8374=1, 8375=1, 8376=1, 8377=1, 8378=1, 8379=1, 8380=1, 8381=1, 8382=1, 8383=1, 8384=1, 8385=1, 8386=1, 8387=1, 8388=1, 8389=1, 8390=1, 8391=1, 8392=1, 8393=1, 8394=1, 8395=1, 8396=1, 8397=1, 8398=1, 8399=1, 8400=1, 8401=1, 8402=1, 8403=1, 8404=1, 8405=1, 8406=1, 8407=1, 8408=1, 8409=1, 8410=1, 8411=1, 8412=1, 8413=1, 8414=1, 8415=1, 8416=1, 8417=1, 8418=1, 8419=1, 8420=1, 8421=1, 8422=1, 8423=1, 8424=1, 8425=1, 8426=1, 8427=1, 8428=1, 8429=1, 8430=1, 8431=1, 8432=1, 8433=1, 8434=1, 8435=1, 8436=1, 8437=1, 8438=1, 8439=1, 8440=1, 8441=1, 8442=1, 8443=1, 8444=1, 8445=1, 8446=1, 8447=1, 8448=1, 8449=1, 8450=1, 8451=1, 8452=1, 8453=1, 8454=1, 8455=1, 8456=1, 8457=1, 8458=1, 8459=1, 8460=1, 8461=1, 8462=1, 8463=1, 8464=1, 8465=1, 8466=1, 8467=1, 8468=1, 8469=1, 8470=1, 8471=1, 8472=1, 8473=1, 8474=1, 8475=1, 8476=1, 8477=1, 8478=1, 8479=1, 8480=1, 8481=1, 8482=1, 8483=1, 8484=1, 8485=1, 8486=1, 8487=1, 8488=1, 8489=1, 8490=1, 8491=1, 8492=1, 8493=1, 8494=1, 8495=1, 8496=1, 8497=1, 8498=1, 8499=1, 8500=1, 8501=1, 8502=1, 8503=1, 8504=1, 8505=1, 8506=1, 8507=1, 8508=1, 8509=1, 8510=1, 8511=1, 8512=1, 8513=1, 8514=1, 8515=1, 8516=1, 8517=1, 8518=1, 8519=1, 8520=1, 8521=1, 8522=1, 8523=1, 8524=1, 8525=1, 8526=1, 8527=1, 8528=1, 8529=1, 8530=1, 8531=1, 8532=1, 8533=1, 8534=1, 8535=1, 8536=1, 8537=1, 8538=1, 8539=1, 8540=1, 8541=1, 8542=1, 8543=1, 8544=1, 8545=1, 8546=1, 8547=1, 8548=1, 8549=1, 8550=1, 8551=1, 8552=1, 8553=1, 8554=1, 8555=2, 8556=1, 8557=1, 8558=1, 8559=1, 8560=1, 8561=1, 8562=1, 8563=1, 8564=1, 8565=1, 8566=1, 8567=1, 8568=1, 8569=1, 8570=1, 8571=1, 8572=1, 8573=1, 8574=1, 8575=1, 8576=1, 8577=1, 8578=1, 8579=1, 8580=1, 8581=1, 8582=1, 8583=1, 8584=1, 8585=1, 8586=1, 8587=1, 8588=1, 8589=1, 8590=2, 8591=1, 8592=1, 8593=1, 8594=1, 8595=1, 8596=1, 8597=1, 8598=1, 8599=1, 8600=1, 8601=1, 8602=1, 8603=1, 8604=1, 8605=1, 8606=1, 8607=1, 8608=1, 8609=1, 8610=1, 8611=1, 8612=1, 8613=1, 8614=1, 8615=1, 8616=1, 8617=1, 8618=1, 8619=1, 8620=1, 8621=1, 8622=1, 8623=1, 8624=1, 8625=2, 8626=1, 8627=1, 8628=1, 8629=1, 8630=1, 8631=1, 8632=1, 8633=1, 8634=1, 8635=1, 8636=1, 8637=1, 8638=1, 8639=1, 8640=1, 8641=1, 8642=1, 8643=1, 8644=1, 8645=1, 8646=1, 8647=1, 8648=1, 8649=1, 8650=1, 8651=1, 8652=1, 8653=1, 8654=1, 8655=1, 8656=1, 8657=1, 8658=1, 8659=1, 8660=1, 8661=1, 8662=1, 8663=1, 8664=1, 8665=1, 8666=1, 8667=2, 8668=1, 8669=1, 8670=1, 8671=1, 8672=1, 8673=1, 8674=1, 8675=1, 8676=1, 8677=1, 8678=1, 8679=1, 8680=1, 8681=1, 8682=1, 8683=1, 8684=1, 8685=1, 8686=1, 8687=1, 8688=1, 8689=1, 8690=1, 8691=1, 8692=1, 8693=1, 8694=1, 8695=1, 8696=1, 8697=1, 8698=1, 8699=1, 8700=1, 8701=1, 8702=1, 8703=1, 8704=1, 8705=1, 8706=1, 8707=1, 8708=1, 8709=1, 8710=1, 8711=1, 8712=1, 8713=1, 8714=1, 8715=1, 8716=1, 8717=1, 8718=1, 8719=1, 8720=1, 8721=1, 8722=1, 8723=1, 8724=1, 8725=1, 8726=1, 8727=1, 8728=1, 8729=1, 8730=1, 8731=1, 8732=1, 8733=1, 8734=1, 8735=1, 8736=1, 8737=1, 8738=1, 8739=1, 8740=1, 8741=1, 8742=1, 8743=1, 8744=1, 8745=1, 8746=1, 8747=1, 8748=1, 8749=2, 8750=1, 8751=1, 8752=1, 8753=1, 8754=1, 8755=1, 8756=1, 8757=1, 8758=1, 8759=1, 8760=1, 8761=1, 8762=1, 8763=1, 8764=1, 8765=1, 8766=1, 8767=1, 8768=1, 8769=1, 8770=1, 8771=1, 8772=1, 8773=1, 8774=1, 8775=1, 8776=1, 8777=1, 8778=1, 8779=1, 8780=1, 8781=1, 8782=1, 8783=1, 8784=1, 8785=1, 8786=1, 8787=1, 8788=1, 8789=1, 8790=1, 8791=1, 8792=1, 8793=1, 8794=1, 8795=1, 8796=1, 8797=1, 8798=1, 8799=1, 8800=1, 8801=1, 8802=1, 8803=1, 8804=1, 8805=1, 8806=1, 8807=1, 8808=1, 8809=1, 8810=1, 8811=1, 8812=1, 8813=1, 8814=1, 8815=1, 8816=1, 8817=1, 8818=1, 8819=1, 8820=1, 8821=1, 8822=1, 8823=1, 8824=1, 8825=1, 8826=1, 8827=1, 8828=1, 8829=1, 8830=1, 8831=2, 8832=1, 8833=1, 8834=1, 8835=2, 8836=1, 8837=1, 8838=1, 8839=2, 8840=1, 8841=1, 8842=1, 8843=1, 8844=1, 8845=1, 8846=1, 8847=1, 8848=1, 8849=1, 8850=1, 8851=1, 8852=1, 8853=1, 8854=1, 8855=1, 8856=1, 8857=1, 8858=1, 8859=1, 8860=1, 8861=1, 8862=1, 8863=1, 8864=1, 8865=1, 8866=1, 8867=1, 8868=1, 8869=1, 8870=1, 8871=1, 8872=1, 8873=1, 8874=1, 8875=1, 8876=1, 8877=1, 8878=1, 8879=1, 8880=1, 8881=1, 8882=1, 8883=1, 8884=1, 8885=1, 8886=1, 8887=1, 8888=1, 8889=1, 8890=1, 8891=1, 8892=1, 8893=1, 8894=1, 8895=1, 8896=1, 8897=1, 8898=1, 8899=1, 8900=2, 8901=1, 8902=1, 8903=1, 8904=1, 8905=1, 8906=1, 8907=1, 8908=1, 8909=1, 8910=1, 8911=1, 8912=1, 8913=1, 8914=1, 8915=1, 8916=1, 8917=1, 8918=1, 8919=1, 8920=1, 8921=1, 8922=1, 8923=1, 8924=1, 8925=1, 8926=2, 8927=1, 8928=1, 8929=1, 8930=1, 8931=1, 8932=1, 8933=1, 8934=1, 8935=1, 8936=1, 8937=1, 8938=1, 8939=1, 8940=1, 8941=1, 8942=1, 8943=1, 8944=1, 8945=1, 8946=1, 8947=1, 8948=1, 8949=1, 8950=1, 8951=1, 8952=1, 8953=1, 8954=1, 8955=1, 8956=1, 8957=1, 8958=1, 8959=1, 8960=1, 8961=1, 8962=1, 8963=1, 8964=1, 8965=1, 8966=1, 8967=1, 8968=1, 8969=2, 8970=1, 8971=1, 8972=1, 8973=1, 8974=1, 8975=1, 8976=1, 8977=1, 8978=1, 8979=1, 8980=1, 8981=1, 8982=1, 8983=1, 8984=1, 8985=1, 8986=1, 8987=1, 8988=1, 8989=1, 8990=1, 8991=1, 8992=1, 8993=1, 8994=1, 8995=1, 8996=1, 8997=1, 8998=1, 8999=1, 9000=1, 9001=2, 9002=1, 9003=1, 9004=1, 9005=1, 9006=1, 9007=1, 9008=1, 9009=1, 9010=1, 9011=1, 9012=1, 9013=1, 9014=1, 9015=1, 9016=1, 9017=1, 9018=1, 9019=1, 9020=1, 9021=1, 9022=1, 9023=2, 9024=1, 9025=1, 9026=1, 9027=1, 9028=1, 9029=1, 9030=1, 9031=1, 9032=1, 9033=1, 9034=2, 9035=1, 9036=1, 9037=1, 9038=1, 9039=1, 9040=1, 9041=1, 9042=1, 9043=1, 9044=1, 9045=1, 9046=1, 9047=1, 9048=1, 9049=1, 9050=1, 9051=1, 9052=1, 9053=1, 9054=1, 9055=1, 9056=1, 9057=1, 9058=1, 9059=1, 9060=1, 9061=1, 9062=1, 9063=1, 9064=1, 9065=1, 9066=1, 9067=1, 9068=1, 9069=1, 9070=1, 9071=1, 9072=1, 9073=1, 9074=1, 9075=1, 9076=1, 9077=1, 9078=1, 9079=1, 9080=1, 9081=1, 9082=1, 9083=1, 9084=1, 9085=1, 9086=1, 9087=1, 9088=1, 9089=1, 9090=1, 9091=1, 9092=1, 9093=1, 9094=1, 9095=1, 9096=1, 9097=1, 9098=1, 9099=1, 9100=1, 9101=1, 9102=1, 9103=1, 9104=1, 9105=1, 9106=1, 9107=1, 9108=1, 9109=1, 9110=1, 9111=1, 9112=1, 9113=1, 9114=1, 9115=1, 9116=1, 9117=1, 9118=1, 9119=1, 9120=1, 9121=1, 9122=1, 9123=1, 9124=1, 9125=1, 9126=1, 9127=1, 9128=1, 9129=1, 9130=1, 9131=1, 9132=1, 9133=1, 9134=1, 9135=1, 9136=1, 9137=1, 9138=1, 9139=1, 9140=1, 9141=1, 9142=1, 9143=1, 9144=1, 9145=1, 9146=1, 9147=1, 9148=1, 9149=1, 9150=1, 9151=1, 9152=1, 9153=1, 9154=1, 9155=1, 9156=1, 9157=1, 9158=1, 9159=1, 9160=1, 9161=1, 9162=1, 9163=1, 9164=1, 9165=1, 9166=1, 9167=1, 9168=1, 9169=1, 9170=1, 9171=1, 9172=1, 9173=1, 9174=1, 9175=1, 9176=1, 9177=1, 9178=1, 9179=1, 9180=1, 9181=1, 9182=1, 9183=1, 9184=1, 9185=1, 9186=1, 9187=1, 9188=1, 9189=1, 9190=1, 9191=2, 9192=1, 9193=1, 9194=1, 9195=1, 9196=1, 9197=1, 9198=1, 9199=1, 9200=2, 9201=1, 9202=1, 9203=1, 9204=1, 9205=1, 9206=1, 9207=1, 9208=1, 9209=2, 9210=1, 9211=1, 9212=1, 9213=1, 9214=1, 9215=1, 9216=1, 9217=1, 9218=1, 9219=1, 9220=2, 9221=1, 9222=1, 9223=1, 9224=1, 9225=1, 9226=1, 9227=1, 9228=1, 9229=1, 9230=1, 9231=1, 9232=1, 9233=1, 9234=1, 9235=1, 9236=1, 9237=1, 9238=1, 9239=1, 9240=1, 9241=1, 9242=1, 9243=1, 9244=1, 9245=1, 9246=1, 9247=2, 9248=1, 9249=1, 9250=1, 9251=1, 9252=1, 9253=1, 9254=1, 9255=1, 9256=1, 9257=1, 9258=1, 9259=1, 9260=1, 9261=1, 9262=1, 9263=1, 9264=1, 9265=2, 9266=1, 9267=1, 9268=1, 9269=1, 9270=1, 9271=1, 9272=1, 9273=1, 9274=1, 9275=1, 9276=1, 9277=1, 9278=1, 9279=1, 9280=1, 9281=1, 9282=1, 9283=1, 9284=1, 9285=1, 9286=1, 9287=1, 9288=1, 9289=1, 9290=1, 9291=1, 9292=1, 9293=1, 9294=1, 9295=1, 9296=1, 9297=1, 9298=1, 9299=1, 9300=1, 9301=1, 9302=1, 9303=1, 9304=1, 9305=1, 9306=1, 9307=1, 9308=1, 9309=1, 9310=1, 9311=1, 9312=1, 9313=1, 9314=1, 9315=1, 9316=1, 9317=1, 9318=1, 9319=1, 9320=1, 9321=1, 9322=1, 9323=1, 9324=1, 9325=1, 9326=1, 9327=1, 9328=1, 9329=1, 9330=1, 9331=1, 9332=1, 9333=1, 9334=1, 9335=1, 9336=1, 9337=1, 9338=1, 9339=1, 9340=1, 9341=1, 9342=1, 9343=1, 9344=1, 9345=1, 9346=1, 9347=1, 9348=1, 9349=1, 9350=1, 9351=1, 9352=1, 9353=1, 9354=1, 9355=1, 9356=1, 9357=1, 9358=1, 9359=1, 9360=1, 9361=1, 9362=1, 9363=1, 9364=1, 9365=1, 9366=1, 9367=1, 9368=1, 9369=1, 9370=1, 9371=1, 9372=1, 9373=1, 9374=1, 9375=1, 9376=1, 9377=1, 9378=1, 9379=1, 9380=1, 9381=1, 9382=1, 9383=1, 9384=1, 9385=1, 9386=1, 9387=1, 9388=1, 9389=2, 9390=1, 9391=1, 9392=1, 9393=1, 9394=1, 9395=1, 9396=1, 9397=1, 9398=1, 9399=1, 9400=1, 9401=1, 9402=1, 9403=1, 9404=1, 9405=1, 9406=1, 9407=1, 9408=1, 9409=1, 9410=1, 9411=1, 9412=1, 9413=1, 9414=1, 9415=1, 9416=1, 9417=1, 9418=1, 9419=1, 9420=1, 9421=1, 9422=1, 9423=1, 9424=1, 9425=1, 9426=1, 9427=1, 9428=1, 9429=1, 9430=1, 9431=1, 9432=1, 9433=1, 9434=1, 9435=1, 9436=1, 9437=1, 9438=1, 9439=1, 9440=1, 9441=1, 9442=1, 9443=1, 9444=1, 9445=1, 9446=1, 9447=1, 9448=1, 9449=1, 9450=1, 9451=1, 9452=1, 9453=1, 9454=1, 9455=1, 9456=1, 9457=1, 9458=2, 9459=1, 9460=1, 9461=1, 9462=1, 9463=1, 9464=1, 9465=1, 9466=1, 9467=1, 9468=1, 9469=1, 9470=1, 9471=1, 9472=1, 9473=1, 9474=1, 9475=2, 9476=1, 9477=1, 9478=1, 9479=1, 9480=1, 9481=1, 9482=1, 9483=1, 9484=1, 9485=2, 9486=1, 9487=1, 9488=1, 9489=1, 9490=1, 9491=1, 9492=1, 9493=1, 9494=1, 9495=1, 9496=1, 9497=1, 9498=1, 9499=1, 9500=1, 9501=1, 9502=1, 9503=1, 9504=1, 9505=1, 9506=1, 9507=1, 9508=1, 9509=1, 9510=1, 9511=1, 9512=1, 9513=1, 9514=1, 9515=1, 9516=1, 9517=1, 9518=1, 9519=1, 9520=1, 9521=2, 9522=1, 9523=1, 9524=1, 9525=1, 9526=1, 9527=1, 9528=1, 9529=1, 9530=1, 9531=1, 9532=1, 9533=1, 9534=1, 9535=1, 9536=1, 9537=1, 9538=1, 9539=1, 9540=1, 9541=1, 9542=1, 9543=1, 9544=1, 9545=1, 9546=1, 9547=1, 9548=1, 9549=1, 9550=1, 9551=1, 9552=1, 9553=1, 9554=1, 9555=1, 9556=1, 9557=1, 9558=1, 9559=1, 9560=1, 9561=1, 9562=1, 9563=1, 9564=1, 9565=1, 9566=1, 9567=1, 9568=1, 9569=1, 9570=1, 9571=1, 9572=1, 9573=1, 9574=1, 9575=1, 9576=1, 9577=1, 9578=1, 9579=1, 9580=1, 9581=1, 9582=1, 9583=1, 9584=1, 9585=1, 9586=1, 9587=1, 9588=1, 9589=1, 9590=1, 9591=1, 9592=2, 9593=1, 9594=1, 9595=1, 9596=1, 9597=1, 9598=1, 9599=1, 9600=1, 9601=1, 9602=1, 9603=1, 9604=1, 9605=1, 9606=1, 9607=1, 9608=1, 9609=1, 9610=1, 9611=1, 9612=2, 9613=1, 9614=1, 9615=1, 9616=1, 9617=1, 9618=1, 9619=1, 9620=1, 9621=1, 9622=1, 9623=1, 9624=1, 9625=1, 9626=1, 9627=1, 9628=1, 9629=1, 9630=1, 9631=1, 9632=1, 9633=1, 9634=1, 9635=1, 9636=1, 9637=1, 9638=1, 9639=1, 9640=1, 9641=1, 9642=1, 9643=1, 9644=1, 9645=1, 9646=1, 9647=1, 9648=1, 9649=1, 9650=1, 9651=1, 9652=1, 9653=1, 9654=1, 9655=1, 9656=1, 9657=1, 9658=1, 9659=1, 9660=1, 9661=1, 9662=1, 9663=1, 9664=1, 9665=1, 9666=1, 9667=1, 9668=1, 9669=1, 9670=1, 9671=1, 9672=1, 9673=1, 9674=1, 9675=1, 9676=1, 9677=1, 9678=1, 9679=1, 9680=1, 9681=1, 9682=1, 9683=1, 9684=1, 9685=1, 9686=1, 9687=1, 9688=1, 9689=1, 9690=1, 9691=1, 9692=1, 9693=1, 9694=1, 9695=1, 9696=1, 9697=1, 9698=1, 9699=1, 9700=1, 9701=1, 9702=1, 9703=1, 9704=1, 9705=1, 9706=1, 9707=1, 9708=1, 9709=1, 9710=1, 9711=1, 9712=1, 9713=1, 9714=1, 9715=1, 9716=1, 9717=1, 9718=1, 9719=1, 9720=1, 9721=1, 9722=1, 9723=1, 9724=1, 9725=1, 9726=1, 9727=1, 9728=1, 9729=1, 9730=1, 9731=1, 9732=1, 9733=1, 9734=1, 9735=1, 9736=1, 9737=1, 9738=1, 9739=1, 9740=1, 9741=1, 9742=1, 9743=1, 9744=1, 9745=1, 9746=1, 9747=1, 9748=1, 9749=1, 9750=1, 9751=1, 9752=1, 9753=1, 9754=1, 9755=1, 9756=1, 9757=1, 9758=1, 9759=1, 9760=1, 9761=1, 9762=1, 9763=1, 9764=1, 9765=1, 9766=1, 9767=1, 9768=1, 9769=1, 9770=1, 9771=1, 9772=1, 9773=1, 9774=1, 9775=1, 9776=1, 9777=1, 9778=1, 9779=1, 9780=1, 9781=1, 9782=1, 9783=1, 9784=1, 9785=1, 9786=1, 9787=1, 9788=1, 9789=1, 9790=1, 9791=1, 9792=1, 9793=1, 9794=1, 9795=1, 9796=1, 9797=1, 9798=1, 9799=1, 9800=1, 9801=1, 9802=1, 9803=1, 9804=1, 9805=1, 9806=1, 9807=1, 9808=1, 9809=1, 9810=1, 9811=1, 9812=1, 9813=1, 9814=1, 9815=1, 9816=1, 9817=1, 9818=1, 9819=1, 9820=1, 9821=1, 9822=1, 9823=1, 9824=1, 9825=1, 9826=1, 9827=1, 9828=1, 9829=1, 9830=1, 9831=1, 9832=1, 9833=1, 9834=1, 9835=1, 9836=1, 9837=1, 9838=1, 9839=1, 9840=1, 9841=1, 9842=1, 9843=1, 9844=1, 9845=1, 9846=1, 9847=1, 9848=1, 9849=1, 9850=1, 9851=1, 9852=1, 9853=1, 9854=1, 9855=1, 9856=1, 9857=1, 9858=1, 9859=1, 9860=1, 9861=1, 9862=1, 9863=1, 9864=1, 9865=1, 9866=1, 9867=1, 9868=1, 9869=1, 9870=1, 9871=1, 9872=1, 9873=1, 9874=1, 9875=1, 9876=1, 9877=1, 9878=1, 9879=1, 9880=1, 9881=1, 9882=1, 9883=1, 9884=1, 9885=1, 9886=1, 9887=1, 9888=1, 9889=1, 9890=1, 9891=1, 9892=1, 9893=1, 9894=1, 9895=1, 9896=2, 9897=1, 9898=1, 9899=1, 9900=1, 9901=1, 9902=1, 9903=1, 9904=1, 9905=1, 9906=1, 9907=1, 9908=1, 9909=1, 9910=1, 9911=1, 9912=1, 9913=1, 9914=1, 9915=1, 9916=1, 9917=1, 9918=1, 9919=1, 9920=1, 9921=1, 9922=1, 9923=1, 9924=1, 9925=1, 9926=1, 9927=1, 9928=1, 9929=1, 9930=1, 9931=1, 9932=1, 9933=1, 9934=1, 9935=1, 9936=1, 9937=1, 9938=1, 9939=1, 9940=1, 9941=1, 9942=1, 9943=1, 9944=1, 9945=1, 9946=1, 9947=1, 9948=1, 9949=1, 9950=1, 9951=1, 9952=1, 9953=1, 9954=1, 9955=1, 9956=1, 9957=1, 9958=1, 9959=1, 9960=1, 9961=1, 9962=1, 9963=1, 9964=1, 9965=1, 9966=1, 9967=1, 9968=1, 9969=1, 9970=1, 9971=1, 9972=1, 9973=1, 9974=1, 9975=1, 9976=1, 9977=1, 9978=1, 9979=1, 9980=1, 9981=1, 9982=1, 9983=1, 9984=1, 9985=1, 9986=1, 9987=1, 9988=1, 9989=1, 9990=1, 9991=1, 9992=1, 9993=1, 9994=1, 9995=1, 9996=1, 9997=1, 9998=1, 9999=1, 10000=1, 10001=1, 10002=1, 10003=1, 10004=1, 10005=1, 10006=1, 10007=1, 10008=1, 10009=1, 10010=1, 10011=1, 10012=1, 10013=1, 10014=1, 10015=1, 10016=1, 10017=1, 10018=1, 10019=1, 10020=1, 10021=1, 10022=1, 10023=1, 10024=1, 10025=1, 10026=1, 10027=1, 10028=1, 10029=1, 10030=1, 10031=1, 10032=1, 10033=1, 10034=1, 10035=1, 10036=1, 10037=1, 10038=1, 10039=1, 10040=1, 10041=1, 10042=1, 10043=1, 10044=1, 10045=1, 10046=1, 10047=1, 10048=1, 10049=1, 10050=1, 10051=1, 10052=1, 10053=1, 10054=1, 10055=1, 10056=1, 10057=1, 10058=1, 10059=1, 10060=1, 10061=1, 10062=1, 10063=1, 10064=1, 10065=1, 10066=1, 10067=1, 10068=1, 10069=1, 10070=1, 10071=1, 10072=1, 10073=1, 10074=1, 10075=1, 10076=1, 10077=1, 10078=1, 10079=1, 10080=1, 10081=1, 10082=1, 10083=1, 10084=1, 10085=1, 10086=1, 10087=1, 10088=1, 10089=1, 10090=1, 10091=1, 10092=1, 10093=1, 10094=1, 10095=1, 10096=1, 10097=1, 10098=1, 10099=1, 10100=1, 10101=1, 10102=1, 10103=1, 10104=1, 10105=1, 10106=1, 10107=1, 10108=1, 10109=1, 10110=1, 10111=1, 10112=1, 10113=1, 10114=1, 10115=1, 10116=1. This pass changed semantic .text coverage by +17344 bytes and uncovered .text by -17344 bytes. Current status is latest batch 10116, 5291813 all-evidence lines / 488372915 bytes, 10166 sidecar sections, 69579 prefixed RetDec/manual native functions, 5637223 prefixed evidence symbols, 91978 recovered .text range rows, 5646928 recovered .text bytes, 0 uncovered .text bytes (100.00%), and an exact carrier matching 0 gap rows / 0 bytes. completion_status remains not_complete. Full autopilot log: dumps/vmtail-wide-1m-w16/unattended_logs/reconstruction-autopilot-pass001-20260506-184313.log.