Independently gate storage + K, OQ-4 P-a/P-b1, four static-local packets and comment-only disclosures. Preserve all 7641 exact owner rows, 71 valid parks and 1161 passing tests; code/data credit unchanged. G and game_engine admission remain held because current canonical loses populate_statistic_buffer. Existing collision static-local repair is not duplicated. No donor tree, held candidate, scorer or private asset imported.
Independently rebuilt and source-reviewed donor b659a777. Restores attested helper, clipping and color-call shapes; 743 meaningful / 752 padded bytes, 0 regressions. No new helpers or storage changes.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Independently verified donor 9f0b3af9413e6dc5c1be28786d22f0ea7df6c119. Restore the first-party-attested null-and-text-box-type invariant. The redundant check is genuine source evidence, not a fabricated allocator lever. Complete 608-byte section and 50 relocations match January; no new helper, owner, warning or exact regression.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Native builds only (#ifdef HALO_LINUX); the matching MSVC build keeps the
original text and stays byte-identical.
- ui_widget_game_data_input_functions.c: the local machine limit follows
HALO_PORT_MAXIMUM_NETWORK_MACHINES and the struct network_game copy holds
HALO_PORT_MAXIMUM_NETWORK_PLAYERS players; its layout is checked against
halo_port_limits.h. The pregame screen keeps its three remote machine
panels and shows the first three remote machines instead of asserting
(sizing its arrays by the machine limit read uninitialized widget
pointers). netgame_prejoin_players scans every player slot, and the
player count texts have room for three digits. network_machine_is_valid
widens the char index before comparing it with 128.
- ui_widget_event_handler_functions.c: the join/unjoin, team swap and
countdown handlers use the port's players offset and player count
instead of 0x226/0x242/0x243 and 16.
- hud.c: hud_draw_players sizes its teammate buffer by the port's player
limit and bounds the fill (more than 16 teammates overflowed the stack).
- motion_sensor.c: multiplayer tests the (horizontal) range before a unit
takes a blip slot, so distant units no longer crowd nearby ones out of
the 16 slots.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Match _hud_update_weapon_local_player: 1472 credited bytes, 68 relocations. Default is unreachable over all 19 loop states. First-party evidence supports the ammo predicates and primary-trigger correction. Independently verified in the three-function batch with zero regressions.
Owner rulings 2026-09-24:
- Q1 YES (04, not 04b): _actor_aim_grenade in its natural /Od body (no goto),
keeping the BUG comment on January's vehicle-path read of the unassigned
aim_vector. Header-inline helpers replace the TU redirects and the NODUP
cross_product2d hand copy; the new COMDATs are identical to January's.
Unlocks collision_features, real_math and path_smoothing (config 03A) and
retires the stale collision_features rejection (04). The decals rejection,
path_structure_bsp and path_obstacle_avoidance are untouched.
- Q4 YES (A2): _first_person_weapon_update without the two NULL guards,
VALID_INDEX at all five /Od-attested sites, and the three magnitude
redirects removed. The weapon-switch invariant is documented in source.
- Q7 YES: _uncompress_int32_to_real_vector3d stages the conversion through a
real temp with a declaration-time initialiser (debug exact; verbatim in
Oct-2001 2276P and the Sept-2001 cache.exe).
Full gate: 383 -> 388 / 468 Halo objects, +3 functions (+2,211 meaningful
code), 0 regressions, parks 82 -> 80, admission 0 contradicted / 0 revoked,
fake-match leads 26, pytest 1,161 passed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Zero credit; every packet was independently adversarially reviewed (22/22 approved).
- critic_3: 72 renames of placeholder/invented static function names across 20
objects to first-party names. Each rename has Sept-2001 linker-map alignment
(cachebeta xbe / retail cache exe, several also Aug-2001), relocation-masked
body identity and matching callers; cachebeta publics show every row was a
January static. hs's radiosity_hack_{start,save,find_point}_evaluate pairing
is proven by the Sept .rdata hs_function_definition pointers; players'
create_weapon also matches HCEX.pdb. Objects: ai_debug (reviewer-amended: a
dead stub removed, its comment re-attached), transport_endpoint_winsock,
transport_endpoint_set_winsock (+ parked.json key renames), profile,
progress_bar, network_connection, saved_game_files, rasterizer_xbox_profile,
xbox_sound_cache, game_engine_king, players, hs, hs_runtime, main, decals,
rasterizer_lights, rasterizer_xbox_dynavobgeom,
rasterizer_xbox_environment_fog, rasterizer_xbox_hardware_bitmaps,
render_cameras.
- hs_compile: whitespace_characters, eol_characters and hs_type_primitive_parsers
are external (cachebeta publics, HCEX DataIsGlobal); hs_compile_finish is
static with a TU-local prototype (no public; HCEX static function).
- bink_playback: bink_playback_idle -> bink_playback_update__internal
(first-party). The bink_decompress_audio_frame rename is NOT landed: it needs
an added call whose position is unattested, the same class canonical held for
hardware_geometry in 4d1ebf17.
Gate (full ninja, objdiff 3.3.1): objects 383, code 1,577,237, data 2,586,915
(all unchanged); stable diff 0 regressions; parks 83/0/0; admission 11/0/2/0;
fake scan 26; pytest 1161 passed; diff --check clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- geometry: drop the NODUP hand copy of plane2d_distance_to_point, so the
header inline is used (selection byte only; removes a latent
collision_bsp<->geometry LNK2005).
- collision_bsp: collision_bsp_usage_times is file-static (cachebeta publics).
- rasterizer_lights P1: HCEX file statics with January's .bss layout (the
load-bearing `= {0}` follows the VC7 initialised-statics law and precedent);
lands atomically with its 6 symbols.json rows.
- motion_sensor: .bss symbol layout fix (object_audit 44/2 -> 44/0).
- rasterizer_xbox_models: five D3D wrapper rows static.
All byte- and credit-neutral (gated with batch 5a); objects stay incomplete
on residual functions and held owner items.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
January's 26 stack-sentinel sites in hud_draw, hud_unit, hud_nav_points,
hud_weapon and motion_sensor share one inlined shape. Both asserts at each site
carry one line literal (a macro). January's 48-byte _check_stack_buffer has no
relocations anywhere, and the Sept-2001 map flags the helper as an inline COMDAT
('i hud_draw.obj'). hud_draw.h now carries the STACK_BUFFER constants, the
unchanged check_stack_buffer body as a header __inline, and the sentinel macro
match_assert_stack_frame (descriptive name: neither the /Od build nor HCEX has
the sentinel). The invented corrupt_stack_found/stack_buffer_checked gotos in
hud_unit are gone, and hud_nav_points and hud_weapon use the macro too (exact
callers). motion_sensor keeps its copy: its sentinel callers are residual, so a
new COMDAT there would break rule (i).
hud_unit (reviewer-amended 01RS + 02-04R): first-party names and storage; the
_fast_ftol rejection is retired (identical copy, pair links pass both ways).
DISCLOSED for an owner ruling: P7 drops rasterizer_xbox_models' dead
#include "interface/hud_draw.h" (project commit 635bd83d; no name used; raw-
and warning-inert). It is load-bearing only as declared-name shielding: the
inline adds ~9 names, which flips __rasterizer_model_transparent_geometry_submit.
Gate (full ninja, objdiff 3.3.1, 23 hud_draw.h consumers): Halo objects 378 ->
379; stable diff unchanged, 0 regressions; parks 86/0/0; admission 11/0/2/0;
pytest 1157 passed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All 100 functions were strict exact and the 934-byte .data section was
identical to January's: same payload, flags and resolved destinations
for all 228 relocations. But 98 handler functions,
event_handler_function_list and new_campaign_profile_name were external
in our source. cachebeta.pdb publics show all 100 were file-static in
January, and no other January object references them. Adding `static`
to their prototypes and definitions keeps every function strict exact.
All 452 January symbols now match, and the .bss is identical.
The object also emits the three stock D3D SDK .rdata tables. Each is
byte-identical to January's selected copy (rasterizer_xbox_decals,
progress_bar, headers) and pair-links in both orders, like the 54
already-admitted objects that emit them. The rasterizer_xbox_profile
hold additionally rests on that object's own shared-declaration debt.
One pinned entry in config/semantic_data_matches.json.
- Canonical scorer (objdiff 3.3.1): credits 934 data bytes and clears
one more revoked row (4 -> 3).
- Pinned objdiff 3.6.0: a verified no-op.
- No code bytes, no config status change.
Verification: full ninja; stable diff vs frozen 8,245-function baseline
0 gained / 0 regressions; parks 103/0/0; fake-match scan 0 -> 0;
pytest 1154 passed; git diff --check clean.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Structural lane batch 1: +8,512 padded / +8,459 meaningful bytes strict
exact (8 functions), zero stable-verdict regressions.
- aim_assist.c: _player_aim_projectile (Lane B body). The debug build
calls set_real_point3d with the three x+i sums; the pin_normal_to_cone3d
prototype now comes from the focused real_math_cones.h. The object stops
emitting _add_vectors3d and _distance3d and emits only the coalescing
_set_real_point3d, byte-identical to January's copy.
- path_obstacle_avoidance.c: _path_avoid_obstacles single-exit body
(Lane B). Its only blocker, the _debug_path/_debug_obstacles static
relabel, landed canonically in 4f4c8502.
- actor_perception.c: _actor_perception_friend_prop_is_attacking
(single exit, /Od 0x472cb0) and _actor_situation_update (/Od statement
order at 0x478d33).
- ui_widget.c: _display_error (/Od 0x65f2e0 shape) and
_widget_instance_text_box_is_focused (/Od 0x66c190 list arm).
- hud_weapon.c: _render_grenade_hud (parent index in its own local,
/Od 0x639128).
- hud_messaging.c: _hud_messaging_update from /Od 0x62cb90 (wchar_t[256]
buffer gives the 0x2a0 frame), plus two relocs.json retargets of a
one-before alias to _button_mappings-18.
- parked.json: unpark the three newly exact parked functions.
- docs: machine-readable manifest and the owner-decision packet.
Gate: ninja PASS, parks 121/0/0, admission 0 contradicted/0 revoked,
selected-provider link PASS on every touched unit, punning casts and
fake-scan leads unchanged, pytest 1152 passed / 5 skipped / 26 subtests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Integrate verified source and data progress; exclude unproven COMMON ownership, held UB/asm forms, and address-named data credit. Stable sweep: 23 exact functions gained, zero lost.
Integrate six accepted exact functions, two whole-object admissions, evidence-backed zero-credit source corrections, owner-header cleanup, and curated campaign records. Preserve zero regressions and exclude generated scratch archives from canonical history.
- _shader_transparent_chicago_create: per-map shader_map_verify(map,
map_index) call as in the exact generic sibling (January's inlined
TRUE-returning verify leaves its store in the loop tail) (park reopen)
- _complete_key_exchange: plain short packet locals replace a long/short
union type-pun (park reopen)
- _debug_realloc: parameter-home reuse and a block-local old_header,
both proven by January's frame (park reopen)
- _lra_allocate: single-exit size check and a conditional round-up
`size = (size & 3) ? (size | 3) + 1 : size` (disclosed) (park reopen)
- _game_state_open_persistent_storage: single-exit success flag (park reopen)
- _progress_bar_create_noise_texture: symbols.json renames _code_000d16d0
in place (static) to the name the 2001-09-25 Xbox linker maps give; an
empty static step called from progress_bar_setup (call position
inferred from map order; the call is required for emission)
Stable diff: 0 regressions; active parks 206 -> 201.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- tiff_file (3/3): _tiff_import as nested single-exit checks with one
TIFFClose and the cseries PIN/match_malloc/match_free helpers;
_tiff_export with a short format, single-exit error handling, byte row
size, per-case pixel expansion, and bitmaps_internal.h replacing
consumer-local prototypes
- _hud_render_nav_points: the TU's local-player unit ternary and a short
nav-point index loop (park reopen)
- _distance3d: square_root(distance_squared3d(a, b)) replaces a
hand-expanded body
Rejected: _item_update (hand-expanded point_from_line3d evading the
COMDAT hold). Stable diff vs 9062b1e96: 77 gained, 0 regressions;
active parks 224 -> 223.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- _hud_render_unit_interface (3,504 B): January's local-player re-read for
the HUD state, flag-macro draw flags, advancing shield color pointer,
named auxiliary panel, direct flash-time indexing (park reopen)
- _flag_render_proper: loop counters reset in the for-initializers
- _path_state_begin: single exit, distance_squared3d + square_root, a
destination pointer shared by the helper and the error text (park reopen)
- _blip_begin: January's caller pushes a zero second argument the callee
never reads; the parameter is added with a provisional name and comment
(park reopen). The caller park _render_motion_sensor is re-measured
(non-exact before and after).
Rejected: _render_debug_trigger_volumes (duplicated arm stores), leaf_map
rows (owner-declined P7 projection_from_vector3d body),
_closest_point_to_attractor (point_from_line3d COMDAT).
Stable diff vs 9062b1e96: 0 regressions; parks 230 -> 226.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reviewed reconstructions, each strict exact in its whole-TU gate with
zero inherited losses, guard passing and no new owners:
- _actor_move_initialize: short sense-ray index (as the sibling loop)
and direct indexed stores instead of per-iteration pointer aliases
- _decal_sprite_get_bounds: edge-relative (0.0f - registration) extents,
matching the adjacent (x1 - registration - x0) extent spelling
- _search_and_replace: single-exit result instead of an early return
- _projectile_accelerate: rotation axis/magnitude scoped to the spin
block (reopens its park)
Rejected in review: _render_ui_widgets and _render_ui_widgets_postgame
(exact only with duplicated identical should_render arms).
Stable diff vs 9062b1e96: 23 functions gained, 0 regressions; parks 261.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The owner-authorized final implementation wave worked only the ten Tier B
functions of the research campaign, each a structural defect confirmed by two
independent lenses; census first, five evidence-driven shapes at most, stop at
allocation, scheduling or x87 ties. Three closed, seven did not.
- hud _temporary_hud_draw_reticle: January does a SIGNED `% 16` (`and eax,
0x8000000f; jns; dec; or -16; inc`) where ours did `and eax,0xf`. NUMBEROF
yields size_t, so `next_point_index % NUMBEROF(points)` was an unsigned modulo;
a signed named count NUMBER_OF_TEMPORARY_HUD_RETICLE_POINTS sizes the array and
bounds the loop. It fixes the type, not a cast. The three point stores become
one set_real_point3d call (laws_w2 A4).
- weapons _weapon_can_be_fired: single-exit form (A3). It writes `result = FALSE`
in two arms, which I tested against the identical-fake-branch prohibition: the
merged `if (age >= 1.0f || chain)` spelling is residual, while January emits a
SEPARATE physical FALSE exit for the age test (`jne; pop edi; xor al,al; pop esi;
pop ebp; ret` at 0x35-0x3c) before game_engine_running is ever called. Two
distinct rejection blocks is laws_w3 A26's admission criterion, unlike the
rejected _bink_query_analog_controller_buttons, whose edges share one block.
- rasterizer_transparent_geometry _rasterizer_transparent_geometry_initialize:
single exit `success = success && aux_buffer()`. Semantics are unchanged; the
error block is the last statement before the call, so the short-circuit sits
exactly where the early return did.
All three parks removed. Not closed and reported in the wave ledgers:
_path_state_traverse, _flag_update, _bitmap_2d_sharpen, _light_volume_render,
_actor_stimulus_prop_acknowledged, _stack_memory_pool_allocate,
_particle_system_new_particle_jet.
Full ninja, parks 268 active / 0 stale / 0 invalid, stable diff vs
scratch/opus5-next150-before.json: gained 15 / 9,504 padded, regressions 0;
fake_match_scan 0 leads on all three files, matching HEAD.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Both admitted by explicit owner rulings on 2026-09-16; each lands as the minimum
hunk after a whole-TU gate, and neither involves undefined behaviour or steering.
render_debug _render_debug_player (+266, park reopened and removed). LAW D, from
the research campaign's frame study, proves January's `sub esp,0x404` cannot come
from a dead local or any other declaration - a dead whole object costs 0 frame -
and only a declared text extent of 1025-1028 yields it. Written in the house
idiom as a named capacity plus its terminator, added to the file's existing
constants enum rather than a new block: `MAXIMUM_RENDER_DEBUG_PLAYER_TEXT_LENGTH =
1024` and `char text[MAXIMUM_RENDER_DEBUG_PLAYER_TEXT_LENGTH + 1]`. The tree
already uses `[X_LENGTH+1]` string buffers 70+ times. This ruling supersedes the
pre-LAW-D park rejection of enlarging the buffer. Whole-TU gate 34 -> 35 with only
this row changing; the sibling park _render_debug_add_cache_entry is unchanged; the
added enumerator shifted no declaration-count-keyed row; fake scan 0 leads.
hud_draw _real_rgb_color_to_pixel32 (+181, previously unwritten). A genuine
bitmaps_inlines.h color-conversion helper, admitted under house rule 10. The owner
ruling rests on affirmative hand-written-assembly evidence in January's bytes -
dword fistp and fmul on non-top x87 stack slots (fmul st(3),st(0)) - not merely on
asm being able to force a match. The permission covers this one body only; it does
not authorize _real_argb_color_to_pixel32, _fast_ftol_C or assembly elsewhere.
Whole-TU gate 20 -> 21 exact, including _hud_draw_meter, which calls it three
times. fake_match_scan: 3 leads, 2 of them pre-existing at HEAD (the naked
get_return_eip); the only new lead is this admitted block.
Full ninja, parks 271 active / 0 stale / 0 invalid, stable diff vs
scratch/opus5-next150-before.json: gained 12 / 8,992 padded, regressions 0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave n1 of the next-150K lane (fresh structural portfolio at ae10935da).
- structures _structure_render_detail_objects (+1136): reopened with the natural
array initializer, which the w2 verifier asked for when it rejected the
hand-written a[0]=0/memset expansion (R6).
- draw_string _bitmap_draw_character (+944).
- hud_sounds _hud_play_sound (+352): closed by removing the one-use index alias
and reading sound_indices directly (A5), NOT by the volatile/goto body that the
park record shows was deliberately replaced.
- bink_playback _bink_free_texture_cache (+96): the park premise was the repo's
own match_dassert wrapper; the user-supplied Bungie random_math.c spells the
same two sites vassert, and the tree is 874 match_vassert to 14 match_dassert.
- structures _structure_get_planar_fog: zero-credit remeasure. Adding the
discarded fog-plane lookup January provably executes (its 15th
_tag_block_get_element_with_size relocation at +0x16d) closes both structural
tags; 448/448 and 15/15, residual now one register-naming window.
Rejected by the verifiers and not landed: _bink_alloc@4 (exact only with an __asm
block in a pool allocator - house rule 10 allows asm only for evidenced
helper/math routines), the progress_bar _code_000d16d0 rename (standing hold),
and the _portal_hull_from_points remeasure. wind _wind_variance_get is HELD for an
owner ruling (see its ledger).
Full ninja, parks 274 active / 0 stale / 0 invalid, stable diff vs
scratch/opus5-next150-before.json: gained 4 / 2,528 padded, regressions 0; fake
scan 0 leads.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave w1 landing, adversarially verified. park reopens: _network_pregame_status_screen_update; zero-credit fuzzy: _player_profile_update_cache_for_nwide_list, _splitscreen_pregame_status_screen_update. Full build of the combined batch: 54 strict gains / 29,440 padded, 0 regressions, parks 355/0/0. Note: the two zero-credit fuzzy bodies are credited by objdiff-shape in the semantic report but are NOT strict exact; they are excluded from the lane's strict accounting. 1 park(s) removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave w1 landing, adversarially verified. exact: _widget_instance_render_column_list. Full build of the combined batch: 54 strict gains / 29,440 padded, 0 regressions, parks 355/0/0.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave w1 landing, adversarially verified. park reopens: _motion_sensor_blip_set_type_and_size, _should_draw_object, _blip_type_get. Full build of the combined batch: 54 strict gains / 29,440 padded, 0 regressions, parks 355/0/0. 3 park(s) removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave w1 landing, adversarially verified. park reopens: _scripted_hud_get_timer_ticks, _scripted_hud_set_objective. Full build of the combined batch: 54 strict gains / 29,440 padded, 0 regressions, parks 355/0/0. 2 park(s) removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Wave w1 landing, adversarially verified. park reopens: _hud_draw_bitmap_internal, _hud_draw_bitmap_direct, _hud_draw_bitmap_with_meter, _get_flash_color. Full build of the combined batch: 54 strict gains / 29,440 padded, 0 regressions, parks 355/0/0. 4 park(s) removed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
bitmap_group.h: signed depth/mipmap_count and union point2d registration_point (HCEA types, January movsx reads and whole-point copies), respelled in its four consumers. bitmaps_mipmap.h declares bitmap_get_max_mipmap_count (fixes an implicit declaration); bitmap_group_internal.h declares bitmap_group_add_bitmap (bitmap_group.h placement regressed decals by declaration count). bitmap_compress_to_mipmap takes the transparent-colour reference pointer January passes. Header renames and their consumers are one measured packet. Unparks _extract_add_bitmap, _extract_build_debug_plate, _extract_mipmaps_to_bitmap, _extract_pixels_from_mipmap, _extract_pixels_to_mipmap (+4,544 padded); re-baselines parked _bitmap_group_add_bitmap (same 992/59). Adversarially verified; 45 bitmap_group.h consumers rebuilt, 0 regressions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
MrBruh