Import only independently reviewed production changes. Preserve canonical physics and virtual-keyboard repairs; keep B3 and all unresolved holds out.
Record exactly four approved canary debits (6987 meaningful bytes), six Halo admissions and two revocations. Keep vendor ioinit/storage work separate. Full build, 8252-row sweep, 1318 tests, park/admission/fake audits and 621-object binding pass within approved debit bounds.
Do not publish donor research dumps or private assets. README and unrelated user research remain untouched. See frontier_publication_reconciliation_20260927.md for complete evidence limits and accounting.
Independently gate storage + K, OQ-4 P-a/P-b1, four static-local packets and comment-only disclosures. Preserve all 7641 exact owner rows, 71 valid parks and 1161 passing tests; code/data credit unchanged. G and game_engine admission remain held because current canonical loses populate_statistic_buffer. Existing collision static-local repair is not duplicated. No donor tree, held candidate, scorer or private asset imported.
January's 26 stack-sentinel sites in hud_draw, hud_unit, hud_nav_points,
hud_weapon and motion_sensor share one inlined shape. Both asserts at each site
carry one line literal (a macro). January's 48-byte _check_stack_buffer has no
relocations anywhere, and the Sept-2001 map flags the helper as an inline COMDAT
('i hud_draw.obj'). hud_draw.h now carries the STACK_BUFFER constants, the
unchanged check_stack_buffer body as a header __inline, and the sentinel macro
match_assert_stack_frame (descriptive name: neither the /Od build nor HCEX has
the sentinel). The invented corrupt_stack_found/stack_buffer_checked gotos in
hud_unit are gone, and hud_nav_points and hud_weapon use the macro too (exact
callers). motion_sensor keeps its copy: its sentinel callers are residual, so a
new COMDAT there would break rule (i).
hud_unit (reviewer-amended 01RS + 02-04R): first-party names and storage; the
_fast_ftol rejection is retired (identical copy, pair links pass both ways).
DISCLOSED for an owner ruling: P7 drops rasterizer_xbox_models' dead
#include "interface/hud_draw.h" (project commit 635bd83d; no name used; raw-
and warning-inert). It is load-bearing only as declared-name shielding: the
inline adds ~9 names, which flips __rasterizer_model_transparent_geometry_submit.
Gate (full ninja, objdiff 3.3.1, 23 hud_draw.h consumers): Halo objects 378 ->
379; stable diff unchanged, 0 regressions; parks 86/0/0; admission 11/0/2/0;
pytest 1157 passed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- _hud_render_unit_interface (3,504 B): January's local-player re-read for
the HUD state, flag-macro draw flags, advancing shield color pointer,
named auxiliary panel, direct flash-time indexing (park reopen)
- _flag_render_proper: loop counters reset in the for-initializers
- _path_state_begin: single exit, distance_squared3d + square_root, a
destination pointer shared by the helper and the error text (park reopen)
- _blip_begin: January's caller pushes a zero second argument the callee
never reads; the parameter is added with a provisional name and comment
(park reopen). The caller park _render_motion_sensor is re-measured
(non-exact before and after).
Rejected: _render_debug_trigger_volumes (duplicated arm stores), leaf_map
rows (owner-declined P7 projection_from_vector3d body),
_closest_point_to_attractor (point_from_line3d COMDAT).
Stable diff vs 9062b1e96: 0 regressions; parks 230 -> 226.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Jonas Volman