Cesarus85--mjolnir-vr/docs/object_matching_logs/game_engine_obj.md

game_engine.obj exact-match ledger

Scope and provenance

• Translation unit: source/game/game_engine.c
• Target object: build/split/source/game/game_engine.obj
• Candidate object: build/base/source/game/game_engine.obj
• Target executable: PAL debug cachebeta.exe, SHA-256 4cc87b45f721270392a96f1674ed2b5cd4a7bb4355faeab4531d1cf1884d9520
• Target object SHA-256: 2c74631e4a056a3d8a94c30d6b4d79ba17971cf4b1fc5d97690fb6be1d0e654b
• Compiler: XDK 3911 Microsoft 32-bit C/C++ 13.00.9254.1 for 80x86.
• Repository flags: /O2 /Oy- /DDEBUG /Dxbox and the checked-in include paths. No lane-specific flag changes are permitted.
• Canonical source baseline: e54ead79c643862cab1bbcb5330fcb2084eadb84.
• Frozen canonical candidate SHA-256: 3a184a158241bc52c54685ac0f9d5a969661ad1009cc2b519edbabf83343482d.
• Strict acceptance oracle: tools/coff_compare.py, section_infos_equal, including padded bytes and semantic relocation identities. Every retained batch also checks the complete canonical exact set for regressions.

Validated baseline and current state

Canonical rebuilt baseline:

• Functions: 125/180 strict exact.
• Padded code: 13,904/33,760 target bytes.
• Fifty-three target functions were not emitted by the candidate.
• Two emitted residuals had target-equal size and relocation count, but failed because the candidate did not own _game_engine and _global_variant.

After retained batch GE01:

• Functions: 130/180 strict exact.
• Padded code: 14,304/33,760 target bytes.
• Candidate SHA-256: bae168dc91f6ce452f4ce9d68ac34b27dcaf5e601beca56c99321b88c5568e63.
• Canonical regressions: none.

After retained batch GE02:

• Functions: 133/180 strict exact.
• Padded code: 14,896/33,760 target bytes.
• Candidate SHA-256: f19b78c05a4b9986cefed66ca1397de4de9dff629365e206ca86c8ad3e831b0e.
• Canonical regressions: none.

After retained batch GE03:

• Functions: 137/180 strict exact.
• Padded code: 16,496/33,760 target bytes.
• Candidate SHA-256: 73519e75b279ec453784dc0ea880561a7e461f15b4bd4804e0b41882e861689d.
• Canonical regressions: none.

After retained batch GE04:

• Functions: 139/180 strict exact.
• Padded code: 16,816/33,760 target bytes.
• Candidate SHA-256: 2b08ed82d77ac468e4530bbfb4ce76726111d94b370f4a3a24dcfbc1b3b5c369.
• Canonical regressions: none.

After retained batch GE05:

• Functions: 144/180 strict exact.
• Padded code: 17,904/33,760 target bytes.
• Candidate SHA-256: fcfda7a08e0928432e8e9c747774ae3cefa461f164a28d06e5d8fcaf834349d6.
• Canonical regressions: none.

After retained batch GE06:

• Functions: 144/180 strict exact.
• Padded code: 17,904/33,760 target bytes.
• Candidate SHA-256: 1b8182d561b2909de59a43cbcdb081ffa96830b8c0359e96c574f707a39ad4e8.
• .bss: strict exact, 1,148/1,148 bytes, zero relocations, target-equal normalized hash.
• Canonical regressions: none.

After retained batch GE07:

• Functions: 152/180 strict exact.
• Padded code: 21,136/33,760 target bytes.
• Candidate SHA-256: 293feb40ebe414da8932b76f17f87d79ad17be4a0b54fc55c6deff0c7ab3392f.
• .bss: remains strict exact.
• Canonical regressions: none.

After retained batch GE08:

• Functions: 156/180 strict exact.
• Padded code: 22,256/33,760 target bytes.
• Candidate SHA-256: a9aa7ce0a0b067003b2b63b78f1559d038307a1124d0b4fe6135b45e5e2f9342.
• .bss: remains strict exact.
• Canonical regressions: none.

After retained batch GE09:

• Functions: 156/180 strict exact.
• Padded code: 22,256/33,760 target bytes.
• Candidate SHA-256: ddda326a95808c5a544ebc92886c6ef8526fc1e68f3289c50829984d4df9e1cf.
• .data: strict exact, 32/32 bytes, zero relocations, target-equal normalized hash.
• .bss: remains strict exact.
• Canonical regressions: none.

After retained batch GE10:

• Functions: 158/180 strict exact.
• Padded code: 22,512/33,760 target bytes.
• Candidate SHA-256: b1c099e6b4152671d352e1d9560e904eb344b2a263422593d4a45f5b36eae9fa.
• Newly exact: _code_00097020 and _code_00096b50.
• .data: remains strict exact at 32/32 bytes with zero relocations.
• .bss: remains strict exact at 1,148/1,148 bytes with zero relocations.
• Canonical regressions: none.
• _code_0009d140 is now a policy-clean emitted structural checkpoint at 1088/1152 bytes and 70/73 relocations; it receives no exact credit.

After retained batch GE11:

• Functions: 159/180 strict exact.
• Padded code: 22,640/33,760 target bytes.
• Candidate SHA-256: 4b669ac72186e8cbbb4b45663254cb5734d23cdf3dccd89df14b3a06e70d7f39.
• Newly exact: _code_0009cb60.
• _populate_statistic_buffer remains strict exact at 560/560 bytes and 27/27 semantic relocations.
• .data: remains strict exact at 32/32 bytes with zero relocations.
• .bss: remains strict exact at 1,148/1,148 bytes with zero relocations.
• Canonical regressions: none.
• Five policy-clean postgame functions are now emitted as structural checkpoints. They receive no exact credit.

After retained batch GE12:

• Functions: 159/180 strict exact.
• Padded code: 22,640/33,760 target bytes.
• Candidate emission: 180/180 target functions; no candidate symbol is absent.
• Candidate SHA-256: 421a662a208d69aabf33cebbab2e7067540e093b0b37d93434e514fe78a11ae0.
• Six ordinary-C target-backed bodies are restored as nonexact structural checkpoints: _code_0009a490, _code_0009b3a0, _code_0009b4f0, _code_0009bdf0, _game_engine_update, and _game_engine_player_killed.
• .data: remains strict exact at 32/32 bytes with zero relocations.
• .bss: remains strict exact at 1,148/1,148 bytes with zero relocations.
• Canonical regressions: none.
• This is an emission-completeness checkpoint only. It receives no new function credit and the object remains active with 21 strict residuals.

The residual table is measured after GE12. Hashes are normalized SHA-256 prefixes; - means the candidate symbol is absent.

Function	Size T/C	Relocs T/C	Normalized hash T/C	First meaningful divergence
_code_00096ba0	112/112	7/7	4ac1ff18279a/9db784535924	Policy-clean body emitted; register scheduling differs
_game_engine_should_spawn_player	256/256	9/9	8259180402f7/c0782ea3a816	Control-flow register allocation differs
_game_engine_get_place	368/368	12/12	91161c382c55/bcf2be6ca02e	Placement loop register allocation differs
_code_000994f0	416/416	18/18	211627377053/10c5400d228a	Policy-clean body emitted; register scheduling differs
_code_0009a490	496/480	16/16	f30da54283e6/01537066ba3b	Complete ordinary-C body emitted; local scheduling is short by 16 bytes
_code_0009a680	448/448	18/18	4c90ec184c40/41e698125368	Policy-clean body emitted; compiler shape differs
_code_0009b3a0	336/336	11/11	7e6f5319e160/dbb1e45ecac4	Complete ordinary-C body emitted; register scheduling differs
_code_0009b4f0	112/96	5/5	048cb68bcbf1/3285bf46e3e7	Complete ordinary-C body emitted; target is 16 bytes longer
_code_0009b6e0	144/144	5/5	675e96da950f/bb509add4c20	One independent terminator store is scheduled before, rather than between, the two HUD call argument pushes
_game_engine_postspawn_player_update	336/336	15/15	4bf0dbc3a0ce/643ef05eed91	Grenade setup local scheduling differs
_code_0009bdf0	992/1008	46/46	2874ef26f3de/dd76f756771b	Complete ordinary-C body emitted; policy-clean scratch clearing is 16 bytes longer
_code_0009c460	176/176	10/10	cb6f30979095/a7e62792e4b5	Register allocation differs despite target-equal relocation identities
_game_engine_get_starting_location_rating	96/96	6/6	9b229c3bccdf/601000c33610	Register allocation differs despite target-equal relocation identities
_game_engine_remap_equipment	304/304	15/15	b315e0bf2bb5/5fd2bf5a01d1	Policy-clean body emitted; compiler shape differs
_game_engine_get_state_message	320/320	10/10	20ff545777ef/63ba933b746c	Respawn-state local scheduling differs
_code_0009cc20	96/112	4/4	43a24b160b72/35ac6d2c5836	Loop-invariant game type occupies the target's counter register
_code_0009d140	1152/1088	73/70	e261315dfb4e/1a8d99b44cb1	Policy-clean title topology is short by 64 bytes and three relocations
_game_engine_post_rasterize_post_game	2528/2528	148/148	5d9500c231fe/a8bfb78acd0f	Policy-clean body emitted; compiler shape differs
_game_engine_update	752/752	67/67	a83ee62930df/1ae46e8434e6	Complete ordinary-C body emitted; compiler scheduling differs
_game_engine_player_killed	832/832	39/39	4d4a8b42b57d/d8d21f2ca76f	Complete ordinary-C body emitted; compiler scheduling differs
_code_0009e670	848/848	41/41	28483cea9891/7bacec539a12	Policy-clean body emitted; compiler shape differs

Accepted controls

• GE01 retains five ordinary C functions recovered from the legal source state at 527fc167705b11887e0aee123bdc9cb91d1ffb15: _code_00096890, _code_00096b30, _code_00096b40, _code_00096c10, and _code_00096d00.
• Exact callers were expressed through those recovered helpers: game_engine_did_player_win_default, get_postgame_hilite_colors, and _code_00096d30. The whole-TU sweep proves they remain exact.
• These are source/topology recoveries supported by target symbols and strict object equality. They are not byte-forcing controls.
• GE02 retains the typed game_engine callback at offset 0x38, its ordinary C objective-weapon scan helpers _code_00096e30 and _code_00096ed0, and the recovered goal-position getter. The callback type changes no structure size or offset; the target symbols and strict function comparisons support the recovered topology.
• GE03 retains the legal C vehicle/weapon prediction and remap flow plus the local HUD fade/target-name helpers. _code_0009a840 currently calls the still-active _code_0009a680 through an ordinary declaration; no match credit is given to that missing dependency.
• GE04 retains the recovered ranking comparator and the measured first-eligible-player team scan. Both are strict exact ordinary C.
• GE05 retains the five map validators. The first build proved four leaf validators exact but expanded _code_0009ccf0 to 1104 bytes and 60 relocations because find_netgame_flags was inlined through _code_0009cbe0. The target dispatcher is 640 bytes and 52 relocations and calls find_netgame_flags. The donor declaration's __declspec(noinline) was therefore restored as target-backed topology; _code_0009ccf0 then became strict exact without any prior regression.
• GE06 replaces imported/Common storage with ordinary typed zero-initialized definitions. The resulting .bss has the target's exact 1,148-byte layout: global_goal[32] at 0, global_variant at 1024, game_engine at 1128, typed private teleporter state at 1132 and 1136, and the autogenerate pointer/count at 1140 and 1144. The strict section comparator proves the complete uninitialized-data section exact. This batch changes no function credit; renewed measurements show that the two emitted residuals also have register-allocation differences and were therefore correctly left unmatched.
• GE07 recovers the HUD score-message topology: the player-state initializer, the full message formatter, two small dispatch helpers, both public score wrappers, the ally/enemy dispatcher, and the player-added path. All eight recovered functions are strict exact. The ally/enemy dispatcher uses an ordinary two-arm C control flow that produces the target's 208 bytes without the earlier volatile parameter workaround. _code_0009b6e0 is emitted with target-equal size and ordered relocations, but remains unmatched because its independent final terminator store is scheduled at a different instruction boundary; no assembly or byte forcing was retained.
• GE08 recovers the statistic score encoder and full ranking buffer plus the weighted item-selection and starting-equipment inventory helpers. All four functions are strict exact ordinary C. The typed callback at game_engine + 0x70 is restored without changing the verified structure layout. Legal source bodies are also retained for their five coupled callers; those callers have target-equal relocation counts but remain unmatched and receive no credit.
• GE09 recovers the complete typed debug_player_color initializer, including the adjacent teleporter flash type, intensity, color, and duration fields. The resulting 32-byte .data section is strict exact and the complete prior function set remains exact.
• GE10 restores the natural weighted-permutation for loop independently preserved at b9aa157a957ac54e58a915bf58a2f690179caf7a. XDK 3911 performs the target's four-way loop transformation by itself; no handwritten unrolling or scheduling control is retained. The result is the target's exact 176 bytes and five semantic relocations for _code_00097020.
• GE10 also restores the policy-clean postgame-title source topology. The named outcome, team-name, and player-entry branches are corroborated by the documented October decomp at C:/Users/isabe/Downloads/halo-main (1)/halo-main/src/halo/game/game_engine.c and by January strings/calls. Referencing _code_00096b50 from that natural private caller restores the target's private ABI and makes the helper strict exact. _code_0009d140 itself remains short by 64 bytes and three relocations and is explicitly parked without credit.
• GE10 removes three raw structural accesses without changing any admitted bytes: player offset 0xC0 is the offset-asserted statistics.multiplayer_statistics member, and the HUD font fields at 0x54/0x64 are exposed through an offset-asserted game_engine_hud_globals view. The three formatter callbacks at game_engine + 0x4C/+0x50/+0x54 are likewise named and offset-asserted. The target-backed non-inline boundary on find_netgame_flags is kept only on its definition, rather than leaking into the public header. Removing that boundary was measured in GE05a to inline the scan into _code_0009ccf0, expanding the exact target function from 640 to 1104 bytes; the definition-local attribute is therefore an unavoidable recovered call boundary, not a byte-forcing control.
• GE11 restores the natural postgame renderer and its private display topology. The renderer's ordinary call to _code_0009cb60 recovers that helper's target-private emission boundary and makes its complete 128 padded bytes and six semantic relocations strict exact. Typed, offset-asserted views replace the HUD definition's bitmap-group offset and the player statistic accesses; the postgame display helpers themselves are retained only as nonexact structural checkpoints.
• The postgame cluster exposed an XDK 3911 whole-translation-unit scheduling interaction in _populate_statistic_buffer: defining the already-exact function after the large renderer reverses two independent local loads. Moving the unchanged natural definition before the postgame functions restores the target order. The retained source has one ordinary definition, no excluded duplicate, and no scheduling primitive. Rebuilt comparison proves both _populate_statistic_buffer and _code_0009cb60 exact simultaneously.
• GE12 restores the final six target-backed function bodies and their typed support surfaces using ordinary C. _code_0009b4f0 keeps external linkage because the target both emits that symbol and inlines its behavior into _game_engine_update; the rebuilt candidate likewise emits both functions at their target relocation counts. _code_0009bdf0 clears its scratch storage with an ordinary byte loop. No assembly, volatile forcing, scheduling barrier, pragma, excluded duplicate, or object patch is retained. A whole-TU sweep proves all 180 target functions now have candidate symbols, the protected 159-function exact set remains exact, and both owned data sections remain strict exact. The six restored bodies remain residuals and receive no exact credit.

Experiment matrix

ID	Source shape	Size T/C	Relocs T/C	Hash / first divergence	Siblings	Decision
GE00	Rebuild canonical e54ead79c unchanged	13,904/33,760 exact bytes	125/180 functions	Baseline object 3a184a158241...	Frozen exact set	retained baseline
GE01	Recover five small adapters and route their existing callers through them	400/400	target-equal per function	All five strict exact	125/125 canonical exact	retained
GE02	Recover typed objective-weapon callback scan and goal getter	592/592	target-equal per function	All three strict exact	130/130 prior exact	retained
GE03	Recover remap/prediction and local HUD fade helpers	1,600/1,600	target-equal per function	All four strict exact	133/133 prior exact	retained
GE04	Recover ranking comparator and team-presence scan	320/320	target-equal per function	Both strict exact	137/137 prior exact	retained
GE05a	Recover five map validators without the donor noinline declaration	_code_0009ccf0 640/1104	52/60	find_netgame_flags body inlined into dispatcher	139/139 prior exact	rejected
GE05b	Restore target-backed find_netgame_flags non-inline boundary	1,088/1,088	target-equal per function	All five strict exact	139/139 prior exact	retained
GE06	Own the complete typed zero-initialized data layout	.bss 1,148/1,148	0/0	Strict section info exact	144/144 prior exact	retained
GE07	Recover HUD formatting, dispatch, score wrappers, and player-added topology	3,232/3,232 exact bytes	target-equal per exact function	Eight strict-exact functions; one 144-byte helper parked	144/144 prior exact	retained
GE08	Recover statistic ranking and weighted starting-equipment helpers	1,120/1,120 exact bytes	target-equal per exact function	Four strict-exact functions; five coupled callers remain parked	152/152 prior exact	retained
GE09	Recover the typed debug/teleporter flash initializer	.data 32/32	0/0	Strict section info exact	156/156 prior exact	retained
GE10	Restore the natural item-weight loop, postgame title topology, and named offset-asserted structural views	256/256 newly exact bytes	target-equal per newly exact function	Two strict-exact functions; _code_0009d140 parked at 1088/1152, 70/73	156/156 prior exact	retained
GE11	Restore the policy-clean postgame renderer topology and place the unchanged ranking-buffer definition before that cluster	128/128 newly exact bytes	6/6 for _code_0009cb60	_code_0009cb60 strict exact; _populate_statistic_buffer remains exact at 560/560, 27/27	158/158 prior exact	retained
GE12	Restore the final six target-backed bodies with ordinary C	180/180 target symbols emitted	Restored bodies have 16/16, 11/11, 5/5, 46/46, 67/67, and 39/39 relocations	No new exact credit; all six bodies remain measured structural residuals	159/159 prior exact	retained emission checkpoint

Post-GE12 retained work

The active lane is codex/game-engine-full-admission-20260729. Its clean restart checkpoint is e311fa706078abeb2ed8cc7b556909cc1de68c51.

After retained batch GE18:

• Functions: 165/180 strict exact.
• Padded code: 25,232/33,760 target bytes.
• Candidate SHA-256: ba69073dfd624a6744e183497ed6e76c4daf642b77e31389d74dca3f723f6c73.
• Candidate emission: 180/180 target functions.
• .data and .bss remain strict exact.
• Canonical regressions: none.

The six retained post-GE12 functions are:

ID	Commit	Exact function	Recovered source topology	Result
GE13	e808f2bde7747b02a4c637e19aeba4fa1c03036f	_code_0009bdf0	Order the independent teleporter-flash stores as fade function, type, duration, priority, intensity, scale, and color; keep the target-backed non-inline boundary on find_netgame_flag	160/180 exact
GE14	bca69538a4d344230a8290331407ef4351ebc8ba	_code_0009b4f0	Use the existing game_engine_has_shield(player_index) predicate and private linkage, then zero both shield fields only for a live unit	161/180 exact
GE15	519f5d2e4db98b26bb2238d745eed52209c1d014	_game_engine_postspawn_player_update	Use the exact code_00097c00() infinite-grenade predicate before restoring both starting grenade counts	162/180 exact
GE16	0594405e063dde6a9d29e7ceccc8f5167b2f7c29	_code_0009cc20	Recover the private prototype's second parameter as short, not long	163/180 exact
GE17	1e22811771f276868d0e497f0a99755b850382a5	_game_engine_remap_equipment	Name the grenade remap predicate, reuse code_00097c00(), and funnel remapped list indices through list_index_to_weapon_definition_index()	164/180 exact
GE18	e311fa706078abeb2ed8cc7b556909cc1de68c51	_game_engine_update	Iterate directly on data_iterator_next, materialize always_invisible through flag/callback arms, and pass iterator.datum_index at the two tail calls	165/180 exact

Each retained step passed a full 180-function section_infos_equal sweep, the policy scan, and a source diff check before commit.

Active residual measurements after GE18

Hashes are normalized SHA-256 prefixes from the hardened comparator.

Function	Size T/C	Relocs T/C	Normalized hash T/C	Current classification
_code_00096ba0	112/112	7/7	4ac1ff18279a/9db784535924	draw-line arithmetic CSE/scheduling
_game_engine_should_spawn_player	256/256	9/9	8259180402f7/c0782ea3a816	boolean/control-flow allocation
_game_engine_get_place	368/368	12/12	91161c382c55/bcf2be6ca02e	tied/all-tied local allocation
_code_000994f0	416/416	18/18	211627377053/10c5400d228a	private draw-line ABI/register allocation
_code_0009a490	496/480	16/16	f30da54283e6/01537066ba3b	select-players topology, short by 16 bytes
_code_0009a680	448/448	18/18	4c90ec184c40/41e698125368	closest-player tail block layout
_code_0009b3a0	336/336	11/11	7e6f5319e160/dbb1e45ecac4	prologue/tail scheduling
_code_0009b6e0	144/144	5/5	675e96da950f/bb509add4c20	multiplayer-message push/store scheduling
_code_0009c460	176/176	10/10	cb6f30979095/a7e62792e4b5	private callback ABI, EBX/EDI mirror
_game_engine_get_starting_location_rating	96/96	6/6	9b229c3bccdf/601000c33610	caller half of EBX/EDI private ABI pair
_game_engine_get_state_message	320/320	10/10	20ff545777ef/63ba933b746c	target shrink-wrapped prologue
_code_0009d140	1152/1088	73/70	e261315dfb4e/1a8d99b44cb1	postgame title topology, short by 64 bytes/3 calls
_game_engine_post_rasterize_post_game	2528/2528	148/148	5d9500c231fe/a8bfb78acd0f	large postgame renderer compiler shape
_game_engine_player_killed	832/832	39/39	4d4a8b42b57d/d8d21f2ca76f	event-block ordering
_code_0009e670	848/848	41/41	28483cea9891/7bacec539a12	score-row private ABI/register allocation

Provenance recovered after GE18

• The January cachebeta.exe symbol atlas identifies _code_00096ba0 as _drawline, _code_000994f0 as _rasterize_in_game_score_draw_line, _code_0009a490 as _select_players_to_display (fuzzy tier), _code_0009a680 as _find_closest_player_index, _code_0009b6e0 as void multiplayer_message(long,long,long), and _code_0009c460 as _default_starting_location_rate_function.
• Public PC 1.10 maps corroborate the sequence find_closest_player_callback, find_closest_player_index, internal_rasterize_target_name: _code_00096c80, _code_0009a680, _code_0009a840.
• Tempera and OpenSauce contain call wrappers and symbol maps for these routines, but no public function body suitable as a donor.
• A direct January PDB module-stream audit found stream 316 contains only S_OBJNAME, S_COMPILE2, and no procedure, local, register, block, or line records. Original local names/order and prototypes cannot be recovered from that PDB. Evidence is recorded in outputs/jan-pdb-game-engine-locals/evidence.md.

Rejected post-GE18 experiments

All entries below were rebuilt with XDK 3911 and restored because they did not produce a strict improvement.

ID	Function/cluster	Source shape	Exact measurement / rejection
GE19a	_code_000994f0 / _code_0009e670	Alias the color local; alias the row local; move row_color to function scope; mark formal declarations register; swap the last two formal parameters and all calls	Color/row/scope/register spellings produced no object change. Parameter swapping also preserved the compiler's existing private ABI. Baseline hashes remain 10c5400d228a and 7bacec539a12.
GE19b	_code_00096ba0	Spell the row ordinate as 2 * (row * 9) + 26, unsigned multiply variants, and separately recomputed expressions	No object change. Target recomputes the two ordinates; candidate CSEs the first value and adds 0x1a. Baseline hash remains 9db784535924.
GE19c	_game_engine_player_killed	Positive unknown_d1 early arm; negative guard without else; merge event 5/event 4 as if/else if	Positive early arm shrank/reordered the body to 816 bytes. The two other forms produced no useful change. Target is 832/832, 39/39, with the unknown_d1 loop at 0x1d7, event-5 fallback at 0x226, and event-4 block at 0x276; candidate orders the same blocks at 0x2e7, 0x1d3, and 0x226.
GE19d	_code_0009a680	Put the failure return inside the best == NONE block and make the outer conversion explicit	448/448, 18/18, candidate hash 5e0ed18322b9; wrong failure/fast-conversion block order.
GE19e	_code_0009a680	Explicit positive object_count guard with do loop	448/448, 18/18, candidate hash 601dd2a2e76d; popped EBX too early and inserted mov edx,eax before the inner conversion.
GE19f	_code_0009a680	Explicit positive object_count guard plus ordinary for loop	448/464, 18/18, candidate hash 564a3c340805; redundant entry test expanded the body by 16 bytes.
GE19g	_code_0009a680	Direct early conversion return followed by an unwrapped search	448/448, 18/18, candidate hash 83138e3c2851; moved the search body and changed register allocation well before the target tail.
GE19h	_code_0009a680	Explicit final if (best == NONE) return best; followed by conversion	448/448, 18/18, candidate hash 5e0ed18322b9; same rejected block order as GE19d.
GE19i	_code_0009a680	Read the ternary false arm through a same-type pointer alias	448/448, 18/18, unchanged candidate hash 41e698125368; optimizer sees through the alias.
GE20a	_code_0009b6e0	Introduce a block-local wchar_t *message_pointer alias and pass it to hud_print_message	No object change: 144/144, 5/5, candidate hash bb509add4c20. The optimizer eliminates the alias and still schedules the terminator store at 0x6c instead of target 0x77.
GE20b	_code_0009b6e0	Materialize player->local_player_index as a block-local word before the terminator store	144/144, 5/5, candidate hash c47997f24cc2. The load moves before the store, but becomes a shorter movzx; the store moves after both argument pushes and the real body ends two bytes early.
GE20c	_code_0009b6e0	Embed the terminator assignment in the message argument with a comma expression	No object change: 144/144, 5/5, candidate hash bb509add4c20; XDK hoists the independent store to the same 0x6c position.
GE21a	_game_engine_get_state_message	Replace the outer if (game_engine) with an early if (!game_engine) return FALSE guard and an unwrapped body	Rejected at 320/304, 10/9, candidate hash 0f94227ea43a. It split the false epilogue, shortened the function by 16 bytes, and disturbed allocation beyond the prologue.
GE21b	_game_engine_get_state_message	Route the false-engine path to an explicit shared exit: label	No object change: 320/320, 10/10, candidate hash 63ba933b746c; XDK canonicalizes the label to the existing outer-if CFG.
GE21c	_game_engine_get_state_message	Move the initialized result declaration ahead of the four other locals	No object change: 320/320, 10/10, candidate hash 63ba933b746c; declaration order does not affect the shrink-wrapped saves.
GE22a	_code_00096ba0	Spell the second ordinate directly as row_index * 18 + 26	No object change: 112/112, 7/7, candidate hash 9db784535924; XDK CSEs the first ordinate.
GE22b	_code_00096ba0	Use a differently factored second ordinate, row_index * 9 * 2 + 26	No object change: 112/112, 7/7, candidate hash 9db784535924; reassociation canonicalizes to the same CSE.
GE22c	_code_00096ba0	Materialize the cast justification as a scoped short between the two ordinate statements	No object change: 112/112, 7/7, candidate hash 9db784535924; the local is eliminated and the justification load remains scheduled before the first ordinate calculation.
GE23a	_code_0009b3a0	Initialize equipment_index before the empty-block early return	336/336, 11/11, candidate hash 0246a597921d. It moves the zero store before the branch as suggested by target, but changes the entire 16-byte prologue schedule without fixing the tail.
GE23b	_code_0009b3a0	Add an explicit scenario local before deriving the equipment-block pointer	No additional object change from GE23a; XDK eliminates the alias and retains hash 0246a597921d.
GE23c	_code_0009b3a0	Increment equipment_index before refreshing equipment_count at the loop tail	No object change from GE23a; store/sign-extension order remains candidate-style.
GE23d	_code_0009b3a0	Remove equipment_count and compare the cast index directly with equipment_block->count	No object change from GE23a; direct condition canonicalizes to the same tail.
GE24a	_game_engine_should_spawn_player	Recover should_spawn as boolean instead of long	Much closer at 256/256, 9/9, candidate hash 031050d5b5fa, but the real body is two bytes shorter. It emits the target byte initialization/update/test, except TRUE is written with mov bl,1 rather than target mov ebx,1; the later respawn_timer == 1 therefore uses an immediate instead of EBX.
GE24b	_game_engine_should_spawn_player	In the boolean variant, compare respawn_timer with should_spawn	No object change from GE24a; SSA constant-folds the known-true boolean back to immediate 1.
GE24c	_game_engine_should_spawn_player	Keep should_spawn as long but cast the timer-zero assignment to boolean	256/256, 9/9, candidate hash ccda5c6da927; XDK decrements memory directly, sets CL, then zero-extends into EBX, diverging more broadly.
GE24d	_game_engine_should_spawn_player	Keep the long assignment and cast only the subsequent false test to boolean	256/256, 9/9, candidate hash 88d4d379707c; the test narrows to BL, but XDK still clears full EBX at initialization and before sete.
GE24e	_game_engine_should_spawn_player	Add a long true_value, copy it to the boolean result, and reuse it for the one-tick comparison	Optimizer eliminates the auxiliary value; identical to GE24a (031050d5b5fa).
GE24f	_game_engine_should_spawn_player	Keep the long result but stage the timer-zero expression through a block-local boolean	256/256, 9/9, candidate hash ff0a5a6c9795; result moves through AL and a later movzx, changing the update tail and remaining two bytes too long/short in different places.
GE25a	_game_engine_get_place	Reverse the declarations of tied and all_tied	No object change: 368/368, 12/12, candidate hash bcf2be6ca02e; stack-slot allocation follows use/lifetime, not declaration order.
GE25b	_game_engine_get_place	Initialize tied before all_tied	368/368, 12/12, candidate hash f3df41c318b9; store order changes, but tied remains at [ebp-1] and all-tied at [ebp-2], opposite the target.
GE25c	_game_engine_get_place	Materialize all_tied & tied as a block-local boolean before building result flags	Rejected at 368/384, 12/12, candidate hash 8bd0c13d5f01; it adds a separate AL value and expands the flag-builder by 16 bytes.
GE26	_game_engine_get_starting_location_rating / _code_0009c460	Prior bounded families: split or initialize the player local separately, reverse formal parameter order and calls, inline player_get, and introduce aliases around player_index/starting_location	No family changed the coupled private ABI mirror. Metrics remain 96/96, 6/6, hash 601000c33610 for the caller and 176/176, 10/10, hash a7e62792e4b5 for the callee.
GE27a	_code_000994f0 / _code_0009e670	Move the font-header pointer declaration to function scope and assign it inside the font block	No object change in either function; hashes remain 10c5400d228a and 7bacec539a12.
GE27b	_code_000994f0 / _code_0009e670	Move the caller's color declaration ahead of text_color and team_colors	No object change; stack allocation and the private call ABI ignore declaration order.
GE27c	_code_000994f0 / _code_0009e670	Change private row_index formal from long to short	Caller remains unchanged and the callee stays 416/416, 18/18, but changes to nonexact hash cd51e44cd367 through a word compare at the row test.
GE28a	_code_0009a490	Rewrite only the move length from maximum_count * 28 - entry_index * 28 - 28 to (maximum_count - entry_index - 1) * 28	Still 496/480, 16/16; candidate hash ce681b033294. First divergence remains the frame immediate at instruction 0x03 (target 0x244, candidate 0x248). The long-lived temporary changes from maximum_count * 28 to the first discarded-entry pointer, but the candidate still removes the target's second comparison and remains 16 bytes short. Full-TU sweep remains the same 165 exact functions and 15 named residuals; rejected and restored.
GE28b	_code_0009a490	Spell only the outer guard as player_count > maximum_count, leaving the nested maximum_count < player_count test unchanged	Still 496/480, 16/16; candidate hash 62f46588e0c2. First divergence remains the frame immediate at 0x03; XDK still eliminates the nested comparison and merely changes the discarded-entry pointer register schedule. Full-TU sweep remains the same 165 exact functions and 15 named residuals; rejected and restored.
GE28c	_code_0009a490	Express the nested gather guard as a one-iteration while (maximum_count < player_count) { ...; break; }	Canonicalizes completely to baseline: 496/480, 16/16, candidate hash 01537066ba3b; first divergence is still the frame immediate at 0x03, and only one comparison remains at 0x7e. Full-TU sweep remains 165 exact with the unchanged 15-residual set; rejected and restored.
GE29a	_code_0009d140	Give each successful postgame outcome branch a block-local outcome_string before its ustrncpy, matching the one already present in the winning-team arm	Regressed from 1152/1088, 73/70, 1a8d99b44cb1 to 1152/1024, 73/66, candidate hash 02877d10d508. First divergence remains the branch at 0x112 (target destination 0x2a7, candidate 0x223). XDK tail-merges even more outcome arms, leaving only two ustrncpy relocations at 0x1f0 and 0x20e; full-TU sweep remains the same 165 exact/15 residuals. Rejected and restored.
GE29b	_code_0009d140	Reorder the semantic outcome chain from NONE, false, true to false, true, NONE, preserving every branch body	1152/1088, 73/70, candidate hash 7fca1b217d7d. First divergence is again the branch at 0x112 (target destination 0x2a7, candidate 0x25d). The compare order follows source order, but XDK still merges the same three ustrncpy sites and emits only two at 0x1dd and 0x248; full-TU sweep remains 165 exact with the unchanged residual set. Rejected and restored.
GE29c	_code_0009d140	Replace the NONE/false/true if chain with a semantically equivalent switch containing explicit breaks	Regressed to 1152/1072, 73/70, candidate hash 9402ff95adec; first divergence remains the branch at 0x112 (target destination 0x2a7, candidate 0x257). The switch retains only two ustrncpy sites at 0x198 and 0x242 and changes compare/layout shape without recovering any missing relocation. Full-TU sweep remains 165 exact/15 residuals; rejected and restored.
GE29d	_code_0009d140	Add a block-local outcome_string only to the false/team arm (0x38), leaving the other four outcome arms at baseline	Regressed to 1152/1072, 73/69, candidate hash cd14c1e44f9f; first divergence remains the 0x112 branch. XDK coalesces more of the tag/string retrieval and still leaves only two ustrncpy sites at 0x1b9 and 0x239, so the selective-local hypothesis does not incrementally recover a target call. Full-TU sweep remains 165 exact/15 residuals; rejected and restored.
GE30a	_game_engine_post_rasterize_post_game	Move only the code_0009cb60(0) team-order decision before loading the two team-format strings, as ordered in the target relocations	Remains 2528/2528, 148/148; candidate hash changes from a8bfb78acd0f to 2452c802321f. First divergence remains the frame immediate at 0x03 (target 0x670, candidate 0x674). This exactly restores the early semantic call order (code_0009cb60 at candidate 0x173, target 0x173) but 125 relocation addresses and later player/prompt blocks remain displaced. Full-TU sweep remains 165 exact with the unchanged 15 residuals; nonexact source change rejected.
GE30b	_game_engine_post_rasterize_post_game	On top of GE30a, declare team_order[2] before team_tab_stops[6]	Regressed to 2528/2528, 148/146, candidate hash a0960d2334c3; first divergence remains 0x03. The stack allocator does not adopt the target slots and two later string-fetch relocations disappear through changed whole-function optimization. Full-TU exact set remains 165/180; rejected and restored.
GE30c	_game_engine_post_rasterize_post_game	On GE30a, leave place, string_list_index, and place_string uninitialized at declaration and assign them after the first row color/tab calls, matching target relocation order	Improves semantic ordering but shrinks to 2528/2512, 148/148, candidate hash fdab273b3ace. First divergence is still the frame immediate at 0x03; the complete relocation-target sequence then agrees except for the final prompt-bounds cluster, but 126 relocation addresses differ. Full-TU sweep stays 165 exact/15 residuals; rejected.
GE30d	_game_engine_post_rasterize_post_game	On GE30c, copy bounds = render.camera.window_bounds before assigning prompt_color.alpha	2528/2512, 148/148, candidate hash d63305c7dc08. First divergence remains 0x03. The only remaining semantic relocation-order delta is the placement of the render + 0x3E viewport-word load inside the prompt cluster; full-TU sweep stays 165/180. Rejected.
GE30e	_game_engine_post_rasterize_post_game	On GE30d, remove explicit prompt bounds.x1 = 640 / bounds.y1 = 480, retaining the copied window bounds as the target disassembly does	Still 2528/2512, 148/148, candidate hash 1b8c8c531b65. The two redundant stores disappear without changing padded size; only the render + 0x3E load order remains semantically displaced, the frame is still 0x674 versus target 0x670, and 130 relocation addresses differ. Full-TU sweep remains 165 exact/15 residuals; rejected.
GE30f	_game_engine_post_rasterize_post_game	On GE30e, remove the block-local draw_row alias and pass entry_index directly to all six row draws	No object change from GE30e: 2528/2512, 148/148, candidate hash 1b8c8c531b65; XDK had already coalesced the alias. Full-TU sweep remains unchanged; rejected and restored.
GE31a	_game_engine_player_killed	Add an explicit positive unknown_d1 jump to a player_quit: label while retaining the negative normal-event guard	Canonicalizes exactly to baseline: 832/832, 39/39, candidate hash d8d21f2ca76f. Target and candidate remain byte-identical through the conditional branch instruction at 0x13b; only its destination differs (0x1d7 target versus 0x2e7 candidate), because the quitting-player broadcast block stays at the tail. Full-TU sweep remains 165 exact with the unchanged 15 residuals; rejected and restored.

The target and GE18 candidate for _code_0009a680 are byte-identical through offset 0x190. The remaining target tail uses EAX for both conversion arguments and reloads best_object_index on the zero-count return path. The candidate uses EDX in the outer conversion and constant-folds the failure to -1. Further work on this function requires a genuinely new control-flow family, not a spelling variant of GE19d-i.

_code_0009b6e0 park packet (GE20): target and baseline are identical through offset 0x6c and again from the call at 0x7e through the padded end. Both are 144 bytes with five ordered semantic relocations. The only difference is the legal scheduling of the independent message[NUMBEROF(message) - 1] = 0 store: target places it after the message pointer push and before the player-index push; the candidate places it before the local-player-index reload. Alias, explicit-local, and comma-expression families are exhausted. Reopen only with donor source or a new compiler scheduling dependency that does not use volatile/barriers.

_game_engine_get_state_message park packet (GE21): both objects are 320 bytes with ten ordered semantic relocations, and offsets 0x26 through the padded end are byte-identical. The sole difference is the first 0x26 bytes. Target saves EBX/ESI before the game_engine test and EDI between the test and branch; candidate shrink-wraps all three saves after the false branch. Early-return, explicit-shared-label, and declaration-order families are exhausted. Reopen only with a new target-backed lifetime/CFG lead that explains the callee-save placement.

_code_00096ba0 park packet (GE22): both sections are 112 bytes with seven ordered semantic relocations. Offsets 0x00..0x34 are exact. Target computes row_index * 18 independently into EDX for bounds.y0, then into EAX for bounds.y1, ending its real body at 0x70. Candidate computes it once in EAX, adds 26 for y1, and ends at 0x6c with four padding NOPs. Direct, differently-factored, unsigned variants from GE19b, and a scoped justification-local family all canonicalize to the same candidate. Reopen only with donor topology or a legal alias/lifetime reason for the target's recomputation.

_code_0009b3a0 park packet (GE23): target/candidate are 336/336 with 11/11 ordered semantic relocations. The central body from 0x30 through 0x127 is byte-identical. Baseline differences are confined to pointer/count setup before 0x30 and loop-index/count scheduling at 0x127..0x135. Moving the zero initialization produces a distinct but non-improving 0246a597921d candidate; scenario aliases, source-order swapping, and a direct loop condition do not refine it. The committed dbb1e45ecac4 baseline is restored. Reopen only with original topology that jointly explains target's lea ebx,[eax+0x384] setup and EAX/ECX tail allocation.

_game_engine_should_spawn_player park packet (GE24): target/baseline are 256/256 with nine ordered semantic relocations. The target exhibits a mixed width lifetime in EBX: initial false and the timer-zero result use BL, the intermediate true uses full EBX and is reused for the one-tick comparison. The natural boolean source is the closest candidate (031050d5b5fa) and matches that behavior except for a two-byte-short mov bl,1/immediate compare pair. Natural long, boolean, cast-at-assignment, cast-at-test, auxiliary constant, and boolean-temporary families are exhausted. The committed long baseline is restored; do not synthesize mixed-width storage through union or pointer byte forcing. Reopen only with donor source or a target-backed local type/lifetime explanation.

_game_engine_get_place park packet (GE25): target/baseline are 368/368 with 12/12 ordered semantic relocations. Target assigns tied to [ebp-2] and all-tied to [ebp-1], then loads both before its flag builder and retains their AND in DL. Baseline assigns the logical locals to the opposite byte slots and uses test cl,dl later. Declaration order is ignored, assignment order changes only store scheduling, and materializing the AND expands the body. A previous packed-struct family also worsened allocation. Baseline is restored; reopen only with original local topology or a target-backed lifetime lead, not manual storage overlays.

Starting-location rating park packet (GE26): the caller is exact through 0x33, then target saves player index in EBX while candidate uses EDI. The private callee receives starting location in EAX in both objects; target's hidden player index is EBX and its player pointer is EDI, while candidate mirrors those roles as EDI/EBX. All instruction sizes, control flow, and ordered semantic relocations otherwise agree (96/96, 6/6 and 176/176, 10/10). The January atlas confirms _code_0009c460 is _default_starting_location_rate_function. Local splitting, aliasing, parameter order, and inline-get families are exhausted. Reopen only with a new whole-TU/private-ABI allocation lead; do not add register-forcing syntax.

Score-row draw park packet (GE27): _code_000994f0 and its large caller _code_0009e670 are respectively 416/416, 18/18 and 848/848, 41/41. Target's private helper passes only string/brighten on the stack, row in EAX, and color in ESI; candidate passes row on the stack and color in EDI. Target therefore retains font_index on the helper's stack and uses EAX for the font pointer, while candidate caches them through ESI. In the caller this is visible at the first call: target pushes two arguments, zeros EAX, and computes color in ESI; candidate pushes three arguments and computes color in EDI. Color/row aliases, formal reordering, register keywords, declaration scope and order, and a short-row prototype are exhausted. Baseline is restored. Reopen only with original private-call topology or a whole-TU allocation lead.

_code_0009a490 bounded structural park packet (GE28): target/baseline are 496/480 with 16/16 ordered semantic relocations. The first divergence is the prologue frame at instruction 0x03: target allocates 0x244, candidate 0x248. At 0x7E, target retains two consecutive maximum_count < player_count checks around the zero initialization and recomputes maximum_count * 28 at 0x168; candidate removes the second check and preserves the product in an extra stack temporary. Consequently target ends its real body at 0x1EE and candidate at 0x1E0. Equivalent move-length algebra, reversed outer comparison spelling, and a one-iteration while/break guard either produce distinct non-improving hashes or canonicalize to the 01537066ba3b baseline. Every trial preserved the 165-function exact set. No source/PDB donor contains the original locals. This packet does not grant target-equal size or exact credit; reopen only with original select_players_to_display topology or a measured reason for both the redundant comparison and absent long-lived product.

_code_0009d140 bounded structural park packet (GE29): target/baseline are 1152/1088 with 73/70 semantic relocations. Instructions 0x00..0x112 agree; the first differing instruction is the 0x112 postgame-state branch, whose destination is target 0x2A7 versus candidate 0x25D. In the outcome cluster target emits five distinct ustrncpy calls, while XDK tail-merges the natural source arms into two, exactly accounting for the three missing call relocations. Homogeneous and selective outcome-pointer locals, semantic arm reordering, and a switch form produce 1024, 1072, or 1088-byte nonmatches and never recover a third call site. The January PDB has no local, block, or line records, and the October decomp corroborates behavior but not the target's source topology. This packet does not grant target-equal size or relocation credit; reopen only with donor source or a new CFG family that explains five unmerged return/copy epilogues without forcing code generation.

_game_engine_post_rasterize_post_game bounded compiler-shape park packet (GE30): target/baseline are 2528/2528 with 148/148 semantic relocations. The first divergence is the prologue frame at 0x03 (target 0x670, candidate 0x674) followed by different callee-save and local-slot allocation. Target orders the team-order predicate before the two team-format lookups, and orders the first row color/tab calls before the place-string lookup; baseline source order is the reverse. GE30a and GE30c recover those semantic call orders, and GE30d/e recover the prompt bounds/progress order and remove two target-absent bound stores. The best combined form has all 148 relocations and only one repeated render + 0x3E relocation-order delta, but shrinks the candidate to 2512 bytes, retains the 0x674 frame, and has hash 1b8c8c531b65. Reordering the team locals instead drops two relocations; removing the draw-row alias is a no-op. All trials preserve the 165 exact functions. Baseline is restored because no partial structural change receives admission. Reopen only with original local lifetime/order evidence capable of jointly explaining the four-byte frame difference and whole-function register allocation.

_game_engine_player_killed compiler-layout park packet (GE19c/GE31): target/baseline are 832/832 with 39/39 semantic relocations and are byte-identical through the conditional instruction at 0x13B. Only its destination differs: target places the quitting-player iterator/broadcast block at 0x1D7, candidate at 0x2E7. Target then places the event-5 fallback at 0x226 and event-4 medal block at 0x276; candidate places them at 0x1D3 and 0x226. A positive early quitting arm shrinks the body to 816 bytes; a negative guard without else, event 5/4 else if, and an explicit positive jump label either preserve the d8d21f2ca76f baseline or worsen layout. Every form keeps the same 39 call/data relocations and the 165-function exact set. Reopen only with a genuinely new target-backed CFG that orders the three event blocks without changing their emitted bodies.

Do-not-repeat list

• Do not import .agent-ge-wave1, raw .obj checkpoints, or their text inventories.
• Do not cherry-pick either artifact-bearing checkpoint commit.
• Do not use inline assembly, volatile byte forcing, pointer-past-object storage, _ReadWriteBarrier, compiler pragmas/flags, object patches, or comparator exceptions.
• Equal size or equal relocation count without ordered semantic relocation identity is not a match and is not sufficient parking evidence.
• Do not repeat GE19a-i or the older cosmetic spelling trials for _code_0009b6e0, _code_0009c460, and _game_engine_get_starting_location_rating; reopen them only with a new ABI or source-topology lead.
• Do not repeat GE28a-c, GE29a-d, GE30a-f, or GE31a. Those families cover the remaining arithmetic/guard, postgame-outcome, renderer-order, and kill-event-layout hypotheses and preserve no strict-exact improvement.

Residual classification

• No candidate symbol is absent; all 180 target functions are emitted.
• Thirteen target-equal-size residuals are evidence-exhausted compiler scheduling, register-allocation, private-ABI, or basic-block-layout shapes: _code_00096ba0, _game_engine_should_spawn_player, _game_engine_get_place, _code_000994f0, _code_0009a680, _code_0009b3a0, _code_0009b6e0, _code_0009c460, _game_engine_get_starting_location_rating, _game_engine_get_state_message, _game_engine_post_rasterize_post_game, _game_engine_player_killed, and _code_0009e670.
• Two structural residuals are evidence-exhausted but do not meet target-equal size/relocation gates: _code_0009a490 is 16 bytes short with equal relocation count, and _code_0009d140 is 64 bytes/three calls short.
• Every one of the 15 residuals has a reproducible bounded packet above. A packet records why ordinary source families are exhausted; it grants no exact or semantic-match credit.
• No residual is currently granted exact credit or marked complete.

Final clean audit after GE31

• Clean XDK 3911 rebuild from source checkpoint e311fa706078....
• Functions: 165/180 strict exact.
• Padded exact code: 25,232/33,760 target bytes.
• Candidate emission: 180/180 target functions.
• Final rebuilt candidate SHA-256: eeadadb05d04c74aad18e31636fe52b9ab111cdbf768b4f78a609484b582194b.
• .data: strict exact at 32/32, 0/0 relocations, normalized hash daa87eb1c49a on both sides.
• .bss: strict exact at 1,148/1,148, 0/0 relocations, normalized hash 509607d81ec2 on both sides.
• The residual names and all 15 baseline metrics reproduce the post-GE18 table exactly.
• Full policy scan has no hits for inline assembly, volatile, _ReadWriteBarrier, intrinsic pragmas, pointer-past-object markers, UB_ markers, or #if 0.
• git diff --check passes, and source/header diff is empty. Only this ledger is changed by the bounded-exhaustion pass.

Reopen criteria

A residual may be retained only after an XDK 3911 rebuild proves its complete padded section and semantic relocations exact, with no loss from the frozen canonical exact set. Formal parked-registry admission additionally needs target-equal size and ordered semantic relocation identities; the two bounded structural packets that fail those gates are documentation only. New PDB/source provenance, donor source, or a measured compiler-shape rule is required to reopen any exhausted spelling.

Disposition

Evidence-exhausted at 165/180, with no legal source change retained after GE18. game_engine.obj remains active and must not be marked Matching until all 180 target functions and every owned data/BSS section pass the strict gates.