offset corections (dwarf)

Needs heavy curation and problably simplicication.

.gitignore

@@ -15,3 +15,5 @@ toolchain/PSn00bSDK
 *.a
 .sentry-native
 .vscode/settings.json
+toolchain/lfs
+toolchain/lpeg

.vscode/launch.json

@@ -4,7 +4,7 @@
 	// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
 	"version": "0.2.0",
 	"configurations": [
-		{
+{
 			"name": "Debug: Hello Psy-Q!",
 			"type": "gdb",
 			"request": "attach",
@@ -12,6 +12,10 @@
 			"remote": true,
 			"cwd": "${workspaceRoot}/build",
 			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
 			"stopAtConnect": true,
 			"gdbpath": "gdb-multiarch",
 			"windows": {
@@ -20,10 +24,17 @@
 			"osx": {
 				"gdbpath": "gdb"
 			},
-			"executable": "${workspaceRoot}/build/hello_psyq.elf",
+			"executable": "${workspaceRoot}/build/hello_gte.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
 			"autorun": [
 				"monitor reset shellhalt",
-				"load hello_psyq.elf",
+				"load hello_gte.elf",
+				"source scripts/gdb/gdb_tape_atoms.gdb",
 				"tbreak main",
 				"continue"
 			]
@@ -36,6 +47,10 @@
 			"remote": true,
 			"cwd": "${workspaceRoot}/build",
 			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
 			"stopAtConnect": true,
 			"gdbpath": "gdb-multiarch",
 			"windows": {
@@ -44,10 +59,16 @@
 			"osx": {
 				"gdbpath": "gdb"
 			},
-			"executable": "${workspaceRoot}/build/hello_gpu.elf",
+			"executable": "${workspaceRoot}/build/hello_gte.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
 			"autorun": [
 				"monitor reset shellhalt",
-				"load hello_gpu.elf",
+				"load hello_gte.elf",
 				"tbreak main",
 				"continue"
 			]
@@ -60,6 +81,10 @@
 			"remote": true,
 			"cwd": "${workspaceRoot}/build",
 			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
 			"stopAtConnect": true,
 			"gdbpath": "gdb-multiarch",
 			"windows": {
@@ -69,12 +94,55 @@
 				"gdbpath": "gdb"
 			},
 			"executable": "${workspaceRoot}/build/hello_gte.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
 			"autorun": [
 				"monitor reset shellhalt",
 				"load hello_gte.elf",
 				"tbreak main",
 				"continue"
 			]
+		},
+		{
+			"name": "Debug: Hello GTE Psy-Q! (atoms debug — DWARF-injected)",
+			"type": "gdb",
+			"request": "attach",
+			"target": "localhost:3333",
+			"remote": true,
+			"cwd": "${workspaceRoot}",
+			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
+			"stopAtConnect": true,
+			"gdbpath": "gdb-multiarch",
+			"windows": {
+				"gdbpath": "gdb-multiarch.exe"
+			},
+			"osx": {
+				"gdbpath": "gdb"
+			},
+			"executable": "${workspaceRoot}/build/hello_gte.dwarf-injected.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
+			"autorun": [
+				"monitor reset shellhalt",
+				"load build/hello_gte.dwarf-injected.elf",
+				"source scripts/gdb/gdb_tape_atoms.gdb",
+				"source build/gen/hello_gte.gdbinit",
+				"tbreak main",
+				"continue"
+			]
 		}
 	]
 }
+

code/duffle/atom_dsl.h

@@ -3,34 +3,18 @@
  * ============================================================================
  *
  * ATOM DSL: Annotation layer for tape atoms (lottes_tape.h).
+ * The metaprogram (scripts/passes/annotation.lua) reads source-as-written and validates:
+ *   - atom_info(...) shape: up to three sub-calls (atom_bind(Binds_X), atom_reads(...), atom_writes(...)) in any order and are optional.
+ *   - rbind atoms (atom_info(..., atom_bind(Binds_X), ...)) reference a real Binds_* struct declaration.
+ *   - atom word-counts in word_counts.metadata.h match the body's actual .word count.
  *
- *   WHAT THIS HEADER IS
- *   -------------------
- *   The metaprogram (scripts/passes/annotation.lua) reads source-as-written
- *   and validates:
- *     - atom_info(...) shape: up to three sub-calls (atom_bind(Binds_X),
- *       atom_reads(...), atom_writes(...)) in any order. All optional.
- *       (No phase token for now; phases may be reintroduced later.)
- *     - rbind atoms (atom_info(..., atom_bind(Binds_X), ...)) reference a
- *       real Binds_* struct declaration.
- *     - wave-context positions only reference the canonical 4-register
- *       set: R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase.
- *     - atom word-counts in word_counts.metadata.h agree with the body's
- *       actual .word count.
- *
- *   WHY A PURE MACRO (atom_info, atom_bind, atom_reads, atom_writes, atom_label)
- *   -----------------------------------------------------------------
- *   Each of these expands to a C comment or to nothing. The C preprocessor
- *   strips them to whitespace. The metaprogram reads the literal token from
- *   source-as-written, NOT from the preprocessed output. This means:
- *     - the C compiler does no work for them (no __attribute__, no
- *       _Pragma, no asm side-effects)
- *     - they can never silently drift from the metaprogram's view
- *       (the metaprogram re-reads the source on every build)
- *     - the annotation is invisible to the linker, debugger, and IDE
+ * Pure macro anntation.
+ * ---------------
+ * Don't want to constraint the macro usage to some attribute placment constraint, etc, don't want ot dela with the compiler.
+ * atom_info, atom_bind, atom_reads, atom_writes, atom_label, atom_dbg_skip_over each expand to a C comment or to nothing
+ * (C preprocessor strips them to whitespace).
  *
  * ============================================================================
- *
  *  Usage:
  *      MipsAtom_(cube_tri) atom_info(
  *         atom_reads (R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
@@ -60,30 +44,15 @@
  *
  *  Annotation rules
  *  ----------------
- *      1. atom_info(...) is OPTIONAL. Most atoms have no annotation.
- *         Atoms without atom_info are silently skipped by the metaprogram.
- *
- *      2. If present, atom_info takes up to three sub-calls, all
- *         order-independent within the arg list:
- *           - atom_bind(Binds_X) (optional; only for rbind atoms)
- *           - atom_reads(...) (optional; wave-context registers)
- *           - atom_writes(...) (optional; wave-context registers)
- *
- *      3. atom_bind(Binds_X) pins the ABI-struct shape -- the metaprogram
- *         cross-references Binds_X against the
- *         `typedef struct Binds_X { ... } Binds_X;` declaration.
- *
- *      4. atom_reads(...) and atom_writes(...) args are wave-context
- *         registers: R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase.
- *         Closed set. GTE / SP / DMA / I/O state is declared in source
- *         comments, not in atom_reads/atom_writes.
- *
- *      5. atom_label(name) is an anchor -- the macro is empty in C; the
- *         metaprogram records the marker at the current pos for offset
- *         calculation.
- *
- *      6. atom_offset(F, T) is resolved by gen/atom_offsets.h, generated
- *         from the atom_label markers.
+ *      1. atom_info(...) is OPTIONAL. Atoms without atom_info are silently skipped by the metaprogram.
+ *      2. If present, atom_info takes up to three sub-calls, all order-independent within the arg list:
+ *           - atom_bind(Binds_X)
+ *           - atom_reads(...)
+ *           - atom_writes(...)
+ *      3. atom_bind(Binds_X): metaprogram cross-references Binds_X against the `typedef struct Binds_X { ... } Binds_X;` declaration.
+ *      4. atom_reads(...) and atom_writes(...): Used to to check if registers are used correctly in macros: R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase.
+ *      5. atom_label(name: Utilize with atom_offset as a target location.
+ *      6. atom_offset(F, T): Resolved by gen/atom_offsets.h, generated from the atom_label markers. Calculated during the offset pass of the lua  metaprogram.
  */
 
 #ifdef INTELLISENSE_DIRECTIVES
@@ -92,64 +61,69 @@
 #endif
 
 /* ============================================================================
- * WAVE-CONTEXT REGISTERS -- canonical register set for the tape wave model.
- *
- *   R_PrimCursor  output pointer into the prim arena (next OT entry to write)
- *   R_FaceCursor  input pointer into the face array (next face to consume)
- *   R_VertBase    base pointer into the vertex arena (this wave's vertices)
- *   R_OtBase      base pointer into the ordering table (this wave's OT slot)
- *
- * Closed set. If your atom needs to touch GTE / SP / DMA / other side state,
- * declare it at the source level as you normally would -- but DO NOT put
- * those registers in atom_reads/atom_writes.
- *
- * ============================================================================*/
-
-/* ============================================================================
- * atom_reads(...) / atom_writes(...) -- wave-context register list
- *
- *   atom_reads(R_PrimCursor, R_FaceCursor)
- *         ->  (R_PrimCursor, R_FaceCursor)   // comma-evaluated, discarded
- *
- * The macro produces a comma-evaluated expression that the C compiler
- * silently discards (it sits in an unused arg position -- the result is
- * never bound). The Lua tool pattern-matches the "atom_reads(...)" /
- * "atom_writes(...)" token to extract the list.
- *
- * You can have at most one atom_reads(...) and at most one atom_writes(...)
- * in an atom_info(...) call. To declare multiple disjoint sets (rare), just
- * declare the union -- the metaprogram doesn't track which reads need which
- * writes at this granularity.
+ * atom_reads(...) / atom_writes(...)
  *
+ * Used during the static analysis pass of the metaprogram to do
  * ============================================================================*/
 #define atom_reads(...)  (__VA_ARGS__)
 #define atom_writes(...) (__VA_ARGS__)
 
+/* ----------------------------------------------------------------------------
+ * atom_reg (per-enum opt-in marker for the DWARF register-alias registry)
+ *
+ * The bare `atom_reg` token adjacent to an enum entry in mips.h / lottes_tape.h flags that alias as debug-visible for scan_source's register_alias_registry.
+ * The C preprocessor strips it to a comment so no runtime symbol is created; the Lua scanner reads the bare token.
+ * ----------------------------------------------------------------------------*/
+#define atom_reg /* atom_reg: opt the preceding enum entry into the DWARF registry */
+
 /* ============================================================================
- * ATOM ANNOTATION MACROS
- *
- *   atom_info -- single unified annotation. OPTIONAL. Most atoms have none.
- *
+ *   atom_info :
  *      MipsAtom_(cube_tri) atom_info(
  *         atom_reads (R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
  *       , atom_writes(R_PrimCursor, R_FaceCursor)
  *      ){ ... };
- *
- *   Shape (sub-args order-independent; all optional):
- *     - atom_bind(Binds_X):  at most one; pins the ABI-struct shape
- *     - atom_reads(...):     at most one; comma-list of wave-context registers
- *     - atom_writes(...):    at most one; comma-list of wave-context registers
- *
- *   No phase token for now. The metaprogram doesn't check ordering across
- *   atoms -- phases (init / bind / setup / work / commit / terminate) will
- *   be reintroduced when ordering checks are added.
- *
- *   The macro expands to a C comment (or to nothing). The C compiler does
- *   no work. The metaprogram reads the source-as-written directly.
- *
+ * 
+ *  - atom_bind(Binds_X): metaprogram cross-references Binds_X against the `typedef struct Binds_X { ... } Binds_X;` declaration.
+ *  - atom_reads(...):    comma-list of registers
+ *  - atom_writes(...):   comma-list of registers
  * ============================================================================*/
 #define atom_info(...)  /* atom_info(__VA_ARGS__) */
 
+/* ----------------------------------------------------------------------------
+ * DEBUG SOURCE-STEP MARKERS
+ *
+ * Place atom_dbg_skip_over() before a MipsAtom_, MipsAtomComp_, or MipsAtomComp_Proc_.
+ * The following declaration kind determines whether the marker selects a whole atom or a component inline view.
+ * The source scanner associates the marker with that declaration; placement diagnostics are handled by the annotation pass.
+ * ----------------------------------------------------------------------------*/
+#define atom_dbg_skip_over() /* atom_dbg_skip_over: skip the following atom or component source view */
+
+/* ----------------------------------------------------------------------------
+ * Typed-view annotations (Registry for DWARF RR_<R_X> chain resolution)
+ *   atom_type(<T>) -- overloaded:
+ *      (a) enum-site default: `R_Foo = R_Tn, atom_reg atom_type(T)` 
+ *      Sets the per-alias default typed view in the register_alias_registry.
+ *      Consumed by the DWARF chain step (e) when no per-atom atom_ctx / atom_phase / atom_type callsite provides a stronger resolution.
+ *      (b) callsite override: `atom_reads(R_Foo atom_type(T), ...)` Overrides the per-alias default for THIS atom only.
+ *      Last-write-wins per R_Name; conflict -> error.
+ *   atom_ctx(<atom_name>) -- atom-info sub-call:
+ *       Propagate another atom's atom.rbind.fields (its Binds_* typed fields) into THIS atom's typed-view resolution.
+ *       The named atom must be an rbind atom (have `atom_bind(Binds_X)` in its `atom_info`).
+ *       Used as the escape hatch when atom_phase is not the natural correlation.
+ *   atom_phase(<label>) -- atom-info sub-call: 
+ *       Free-form C-identifier label for grouping atoms.
+ *       Within a phase, the FIRST atom in source-order that owns its own atom.rbind provides 
+ *       the Binds_* field types used by all other atoms in the same phase.
+ *       The preferred correlation mechanism; atom_ctx is the escape hatch for non-natural cases.
+ *
+ * All three expand to C comments
+ * (the bare-token convention matching `atom_reg` and `atom_dbg_skip_over`).
+ * The Lua scanner reads the bare tokens in source-as-written; the C preprocessor strips them.
+ * ----------------------------------------------------------------------------*/
+#define atom_type(T)        /* atom_type: associate <T> with the preceding enum entry (enum site) or this register (atom-info site) */
+#define atom_ctx(atom_name) /* atom_ctx: propagate <atom_name>'s Binds_* field types into this atom's typed views */
+#define atom_phase(label)   /* atom_phase: tag this atom with <label> for grouped typed-view resolution */
+
 /* ----------------------------------------------------------------------------
  * atom_bind(Binds_X) -- rbind sub-call of atom_info
  *
@@ -158,13 +132,7 @@
  *       , atom_writes(R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
  *   ){ ... };
  *
- * The Binds_X MUST be a typedef'd type (declared via
- * `typedef struct Binds_X { ... } Binds_X;` somewhere in the source).
- * The Lua tool cross-references this. Missing struct = error.
- *
- * atom_bind is a SUB-CALL of atom_info, not a standalone annotation macro.
- *
- * The macro expands to a C comment. The metaprogram reads source-as-written.
+ * The Binds_X MUST be a typedef'd type (declared via `typedef struct Binds_X { ... } Binds_X;` somewhere in the source).
  * ----------------------------------------------------------------------------*/
 #define atom_bind(binds_struct)  /* atom_bind(binds_struct) */
 
@@ -177,25 +145,11 @@
  *
  *   atom_offset(culling, bounds_chk)         ← resolved by gen/.offsets.h
  *
- * The metaprogram generates gen/atom_offsets.h with one
- *   #define atom_offset__culling__bounds_chk  ((target - branch_pos - 1))
- * per atom_offset(F, T) call. The preprocessor then expands your call to
- * the right immediate value.
- *
- * If gen/atom_offsets.h is stale (or atom_label(name) is undefined),
- * `atom_offset__F__T` becomes an undefined macro and the C build fails.
- * This catches:
- *   - typo in atom_label (no anchor → metaprogram doesn't emit the macro)
- *   - .offsets.h not regenerated after body edits
- *   - body edit that broke the offset math (recompile + retest picks it up
- *     in CPU emulator)
+ * The metaprogram generates gen/atom_offsets.h with one #define with the offset value per atom_offset(F, T) call.
+ * The preprocessor then expands the call to the right immediate value.
  *
+ * If gen/atom_offsets.h is stale (or atom_label(name) is undefined), `atom_offset_F_T` becomes an undefined macro and the C build fails.
  * ============================================================================*/
-
 #define atom_offset(F, T) atom_offset_ ## F ## _ ## T
-/* atom_label is a pure annotation for the metaprogram's offset calculations.
- * The macro expands to a C comment, so the C preprocessor strips it to
- * whitespace — NO instruction word is emitted in the asm. The metaprogram
- * still recognises the literal `atom_label(name)` token in source and
- * records the marker at the current pos. */
+// atom_label is a pure annotation for the metaprogram's offset calculations.
 #define atom_label(name) /* atom_label anchor: name */

code/duffle/gen/duffle.macs.h

@@ -1,7 +1,7 @@
 #ifdef INTELLISENSE_DIRECTIVES
 #pragma once
 #endif
-// Auto-generated by tape_atom_annotation_pass.lua — DO NOT EDIT
+// Auto-generated by ps1_meta.lua — DO NOT EDIT
 // Source: C:\projects\Pikuma\ps1\code\duffle\lottes_tape.h
 // Component atoms (MipsAtomComp_(ac_*)) -> macro variants (mac_*)
 
@@ -23,7 +23,6 @@ WORD_COUNT(mac_yield, 4)
 ,	load_half_u(R_T2, R_FaceCursor, 2 * S_(S2))
 WORD_COUNT(mac_load_tri_indices, 3)
 
-/* Words: 18; Translates indices to vertex addresses and pushes them to GTE  */
 #define mac_gte_load_tri_verts(...) \
 	shift_lleft(R_AT, R_T0, v3s2_byteoff) \
 ,	add_u_self(R_AT, R_VertBase) \
@@ -77,7 +76,7 @@ WORD_COUNT(mac_insert_ot_tag_g4, 11)
 
 #define mac_pack_color_word(off, cmd, r, g, b) \
 	load_upper_i(R_AT, (cmd) << 8  | (b)) \
-,	or_i_self(   R_AT, ((g)   << 8) | (r)) \
+,	or_i_self(   R_AT, ((g)  << 8) | (r)) \
 ,	store_word(  R_AT, R_PrimCursor, (off))
 WORD_COUNT(mac_pack_color_word, 3)
 

code/duffle/gp.h

@@ -1,7 +1,6 @@
 /* ============================================================================
  *  duffle DSL Suffix Conventions
  *  ============================================================================
- *
  *  Every mnemonic in this header follows the same suffix grammar:
  *
  *  Primitive commands: gp0_cmd_poly_f3 = 0x20    (byte opcode)
@@ -26,8 +25,7 @@
  *    0. Opcode IDs             gp0_cmd_poly_f3 = 0x20
  *
  *  Vendor mnemonics (gte_mtc2, gte_mfc2, etc.) are NOT in this header.
- *  They live in the opt-in `gp_vendor_sym.h` for users who prefer the
- *  PSYQ-style names.
+ *  They live in the opt-in `gp_vendor_sym.h` for users who prefer the PSYQ-style names.
  * ============================================================================ */
 
 #ifdef INTELLISENSE_DIRECTIVES
@@ -41,15 +39,14 @@
 /* ============================================================================
  *  Hardware MMIO Addresses
  *  ============================================================================
- *
  *  PSX GPU has two 32-bit ports in the I/O register region at KSEG2
  *  0x1F800000+. GP0 (offset 0x10) is the data port (commands + params).
  *  GP1 (offset 0x14) is the control port (status, ctrl writes).
  * ============================================================================ */
 /* IO base address (KSEG2 0x1F800000+ for the I/O register region).
- * The 16-bit upper half `IO_BASE_ADDR_HI16` is the form used by
- * tape-side macros that pin a register to hold the IO base and access
- * ports via offsets — `lui $reg, 0x1F80` (1 word) then `sw $data, GPIO_PORT*_OFFSET($reg)` (1 word). 
+ * The 16-bit upper half `IO_BASE_ADDR_HI16` is the form used by tape-side macros that pin a register
+ * to hold the IO base and access ports via offsets:
+ *   `lui $reg, 0x1F80` (1 word) then `sw $data, GPIO_PORT*_OFFSET($reg)` (1 word). 
  * Mirrors the `IO_BASE_ADDR equ 0x1F80` + `gpio_port0 equ 0x1810` pattern from graphics_hello/gp.s. */
 enum {
     IO_BASE_ADDR      = 0x1F800000,  /* full 32-bit I/O region base */
@@ -75,12 +72,10 @@ enum {
 /* ============================================================================
  *  GP0 command byte constants + Layer 1 (GPU bitfield shifts)
  *  ============================================================================
- *
  *  8-bit GP0 opcodes (the upper byte of a primitive's first word). These are the BYTE only.
- *  The layer-1 bitfield-layout constants live in the same enum block
- *  so the encoder can reference them by name. 
- *  NO macro body past this point uses a raw shift or raw mask. 
- *  Every shift/width/mask is named here, named once. 
+ *  The layer-1 bitfield-layout constants live in the same enum block so the encoder can reference them by name. 
+ *  NO macro body past this point uses a raw shift or raw mask.
+ *  Every shift/width/mask is named here, named once.
  *  Mirrors the OPCODE_SHIFT / RS_SHIFT / REG_MASK convention from mips.h.
  * ============================================================================ */
 enum {
@@ -143,9 +138,7 @@ enum {
 /* ============================================================================
  *  Layer 1.5 (per-field encoders) + Layer 2 (composite) + Layer 3 (semantic GP0 word builders)
  *  ============================================================================
- *
- *  Layer 1.5 encoders take one field's value, mask it to its own width,
- *  and shift it to its own position. 
+ *  Layer 1.5 encoders take one field's value, mask it to its own width, and shift it to its own position. 
  *  Mirrors `enc_op` / `enc_rs` / `enc_rt` in mips.h and `enc_gte_sf` / `enc_gte_mx` in gte.h. 
  *  Layer-2 composite encoders OR the per-field encoders together; layer-3 semantic macros delegate to the composites.
  *  No raw shifts or magic numbers in any macro body below this point.
@@ -186,10 +179,9 @@ enum {
 /* ============================================================================
  *  GP1 command byte constants + Layer 1 (display-mode + range + draw-area bitfield shifts)
  *  ============================================================================
- *
- *  GP1 status bits are read from HW_GP1; ctrl writes use GP1 commands
- *  packed into 32-bit words (cmd byte in the upper 8 bits via
- *  `enc_gp0_cmd(cmd)` — never a raw shift).
+ *  GP1 status bits are read from HW_GP1;
+ *  ctrl writes use GP1 commands packed into 32-bit words 
+ *  (cmd byte in the upper 8 bits via `enc_gp0_cmd(cmd)`).
  * ============================================================================ */
 enum {
     gp1_cmd_Reset                  = 0x00,
@@ -202,10 +194,9 @@ enum {
     gp1_cmd_VerticalDisplayRange   = 0x07,
     gp1_cmd_DisplayMode            = 0x08,
     /* Note: GP1 only has commands 0x00..0x08. 
-		 * The state-setter commands (SetTextureWindow, * SetDrawArea*, 
-		 * SetDrawOffset, SetMaskBit) live in the GP0 enum as * 0xE1..0xE6. 
-		 * DrawArea word builders are below as GP0s * macros 
-		 * (since they emit GP0 commands). */
+		 * The state-setter commands (SetTextureWindow, * SetDrawArea*, SetDrawOffset, SetMaskBit) 
+		 * live in the GP0 enum as * 0xE1..0xE6.
+		 * DrawArea word builders are below as GP0s * macros (since they emit GP0 commands). */
 
     /* ---- Display-mode payload flags (per PSX-SPX §"GP1 Display Mode").
      * Bit positions match the encoder shifts below; values are the
@@ -259,8 +250,7 @@ enum {
 #define enc_gp1_vrange_word(y1, y2)        (enc_gp0_cmd(gp1_cmd_VerticalDisplayRange)   | enc_gp1_vrange_y1(y1) | enc_gp1_vrange_y2(y2))
 
 /* ---- Layer 2: GP0 state-setter composite encoders ----
- * GP0(0xE3) SetDrawArea top-left and GP0(0xE4) SetDrawArea bottom-right
- * both use the same X/Y 10-bit signed payload as GP1 DisplayRange. */
+ * GP0(0xE3) SetDrawArea top-left and GP0(0xE4) SetDrawArea bottom-right both use the same X/Y 10-bit signed payload as GP1 DisplayRange. */
 #define enc_gp0_draw_area_tl_word(x, y)    (enc_gp0_cmd(gp0_cmd_SetDrawArea_TopLeft)  | enc_gp1_draw_x(x) | enc_gp1_draw_y(y))
 #define enc_gp0_draw_area_br_word(x, y)    (enc_gp0_cmd(gp0_cmd_SetDrawArea_BotRight) | enc_gp1_draw_x(x) | enc_gp1_draw_y(y))
 
@@ -282,7 +272,6 @@ enum {
 /* ============================================================================
  *  Pre-baked GPU state words
  *  ============================================================================
- *
  *  Common command words for boot-time GPU init and standard display configurations.
  * ============================================================================ */
 
@@ -356,7 +345,6 @@ enum {
 /* ============================================================================
  *  Primitive structs (8 polygon variants + tag)
  *  ============================================================================
- *
  *  Each struct follows the GPU-documented memory layout for the corresponding primitive command. 
  *  The PolyTag is the OT-link header; the rest of the struct is the primitive's body.
  *
@@ -390,9 +378,9 @@ typedef Struct_(PolyTag) {
  * No raw C-style casts. RHS values are assumed to be `U4` — caller passes a `U4` directly. */
 #define set_len(tag,v)  (C_(PolyTag_R,tag)->len  = u4_(v))
 #define set_addr(tag,v) (C_(PolyTag_R,tag)->addr = u4_(v))
-/* `set_code` is no longer in the new PolyTag design — the code byte lives
- *  in the primitive body (e.g. `((Poly_F3*)(p))->code`), not in the tag.
- *  Use the typed primitive structs (Poly_F3, Poly_G4, etc.) and the `set_poly_*` setters, 
+/* `set_code` is no longer in the new PolyTag design — the code byte lives in the primitive body
+ * (e.g. `((Poly_F3*)(p))->code`), not in the tag.
+ *  Use the typed primitive structs (Poly_F3, Poly_G4, etc.) and the `set_poly_*` setters,
  *  which set both the tag's length and the code. */
 #define get_len(tag)  C_(U4,C_(PolyTag_R,tag)->len)
 #define get_addr(tag) C_(U4,C_(PolyTag_R,tag)->addr)
@@ -419,7 +407,7 @@ typedef Struct_(Poly_F4) {
     };
 };
 
-/* ---------- Poly_G3 (Gouraud Triangle; 6 words) ---------- */
+/* ---------- Poly_G3 (Gouraud Triangle; 7 words) ---------- */
 typedef Struct_(Poly_G3) {
     U4    tag; RGB8 c0; B1 code;
     V2_S2 p0;  RGB8 c1; B1 pad1;
@@ -427,7 +415,7 @@ typedef Struct_(Poly_G3) {
     V2_S2 p2;
 };
 
-/* ---------- Poly_G4 (Gouraud Quad; 5 words in the demo's interleaved layout) ---------- */
+/* ---------- Poly_G4 (Gouraud Quad; 9 words) ---------- */
 typedef Struct_(Poly_G4) {
     U4    tag; RGB8 c0; B1 code;
     V2_S2 p0;  RGB8 c1; B1 pad1;
@@ -511,7 +499,6 @@ typedef Struct_(Poly_GT4) {
 /* ============================================================================
  *  Texture Page (TPage) bit layout
  *  ============================================================================
- *
  *  The TPage data word sent via GP0(0x2X) has:
  *    bits  0..3   = texture page X    (4 bits, 64-px units, 0..16)
  *    bit   4      = texture page Y    (1 bit,  64-px units, 0/1)
@@ -575,7 +562,6 @@ typedef Struct_(TexturePage) { U4 raw; };
 /* ============================================================================
  *  CLUT (Color Look-Up Table) semantics
  *  ============================================================================
- * 
  *  CLUT is loaded into VRAM by sending a GP0 command whose payload is:
  *    bits  0..5   = Y in 16-px units (palette row)
  *    bits  6..14  = X in 16-px units (palette column)
@@ -608,7 +594,6 @@ enum {
 /* ============================================================================
  *  TIM file format constants and headers
  *  ============================================================================
- *
  *  TIM (Sony .TIM texture image) file structure:
  *    +0x00  U4 file_id (always 0x10 = TIM magic)
  *    +0x04  U4 version (always 0x00 for v1)
@@ -626,9 +611,8 @@ enum {
  *         +0x06 U2 px_height
  *         +0x08 ... pixel data
  *
- *  Future?: add `tim_load_to_vram(tim_ptr, vram_addr)` that
- *  emits the necessary GP0 commands. Stoppped for now at the
- *  struct + enum level.
+ *  Future?: add `tim_load_to_vram(tim_ptr, vram_addr)` that emits the necessary GP0 commands.
+ *  Stoppped for now at the struct + enum level.
  * ============================================================================ */
 enum {
     tim_file_id_magic = 0x10,
@@ -659,35 +643,24 @@ typedef Struct_(TIM_SectionHeader) {
  *  Tape-side GPU operations (NOT in this header)
  *  ============================================================================
  *
- *  No `mac_gp0_send` or related macros live in gp.h. Rationale: the
- *  Lottes tape model uses OT-DMA for primitive submission, so atom bodies
- *  write to main RAM (the OT/primitive buffer) and to GTE state — never
- *  directly to the GPU ports at 0x1F801810 / 0x1F801814. See
- *  `mac_format_f3_color`, `mac_insert_ot_tag`, `mac_gte_store_f3` in
- *  lottes_tape.h for the patterns atom bodies actually use.
+ *  No `mac_gp0_send` or related macros live in gp.h.
+ *  Rationale: the Lottes tape model uses OT-DMA for primitive submission, so atom bodies write to main RAM (the OT/primitive buffer)
+ *  and to GTE state — never directly to the GPU ports at 0x1F801810 / 0x1F801814.
+ *  See `mac_format_f3_color`, `mac_insert_ot_tag`, `mac_gte_store_f3` in lottes_tape.h for the patterns atom bodies actually use.
  *
- *  If a feature need arises requires tape-side GPU port writes (e.g. DMA-kick to
- *  start GPU consumption of the OT, VBlank sync via GP1 status poll),
- *  the right home is `lottes_tape.h` alongside the rest of the `mac_*`
- *  family — the encoder infrastructure is already in place:
+ *  If a feature need arises requires tape-side GPU port writes 
+ *  (e.g. DMA-kick to start GPU consumption of the OT, VBlank sync via GP1 status poll),
+ *  the right home is `lottes_tape.h` alongside the rest of the `mac_*` family:
+ *    1. The caller pins a register to hold the IO base, e.g. register U4 r_io rgcc(R_T4) = IO_BASE_ADDR;
+ *       The compiler emits `lui R_T4, IO_BASE_ADDR_HI16` outside the atom body (in the C prologue before tape_run).
+ *    2. The atom body uses `store_word(R_data, R_T4, GPIO_PORT0_OFFSET)` to write to GP0, and `store_word(R_data, R_T4, GPIO_PORT1_OFFSET)`
+ *       to write to GP1. Both are preprocessor-encodable because R_T4 is a fixed register and the GPIO_PORT*_OFFSET constants
+ *       fit in the `sw`'s 16-bit signed offset field. No placeholder-pun, no asm constraints, no hidden register choice.
+ *       Same pattern as the old graphics_hello/hello_gp_routines.s `reg_io_offset`/`gcmd_push` convention.
  *
- *    1. The caller pins a register to hold the IO base, e.g.
- *         register U4 r_io rgcc(R_T4) = IO_BASE_ADDR;
- *       The compiler emits `lui R_T4, IO_BASE_ADDR_HI16` outside the
- *       atom body (in the C prologue before tape_run).
- *
- *    2. The atom body uses `store_word(R_data, R_T4, GPIO_PORT0_OFFSET)`
- *       to write to GP0, and `store_word(R_data, R_T4, GPIO_PORT1_OFFSET)`
- *       to write to GP1. Both are preprocessor-encodable because R_T4 is
- *       a fixed register and the GPIO_PORT*_OFFSET constants fit in the
- *       `sw`'s 16-bit signed offset field. No placeholder-pun, no asm
- *       constraints, no hidden register choice. Same pattern as the
- *       old graphics_hello/hello_gp_routines.s `reg_io_offset`/`gcmd_push`
- *       convention.
- *
- *  This mirrors the existing tape-side wave-context discipline: the
- *  caller binds the IO-base register via `rgcc()`, the macro assumes
- *  the binding is in effect, and the encoding falls out at preprocessor
- *  time. No additional GPU-domain macro layer required.
+ *  This mirrors the existing tape-side wave-context discipline: 
+ *  the caller binds the IO-base register via `rgcc()`, the macro assumes the binding is in effect,
+ *  and the encoding falls out at preprocessor time. 
+ *  No additional GPU-domain macro layer required.
  * ============================================================================ */
 #pragma endregion Tape-Side Macros

code/duffle/gp_vendor_sym.h

@@ -2,10 +2,8 @@
  *  duffle DSL — GPU Vendor Mnemonics (opt-in)
  *  ============================================================================
  *
- *  Provides the PSYQ-style CamelCase aliases for the canonical duffle GPU
- *  primitive setters and OT operations. The duffle snake_case names are
- *  primary; this header is for users who prefer the PSYQ SDK function
- *  names from the legacy C API.
+ *  Provides the PSYQ-style CamelCase aliases for the canonical duffle GPU primitive setters and OT operations.
+ *  The duffle snake_case names are primary; this header is for users who prefer the PSYQ SDK function names from the legacy C API.
  *
  *  USAGE:   #include "duffle/gp_vendor_sym.h"   // after gp.h
  *
@@ -23,15 +21,11 @@
  *    OT operations:
  *      AddPrim(ot, p)  -> orderingtbl_add_primitive(ot, p)
  *
- *  The gp0_cmd_* / gp1_cmd_* byte constants are already short and
- *  descriptive; no vendor alias is provided for them.
- *
- *  The vendor mnemonics are NOT registered with the duffle word-count
- *  metadata (word_counts.metadata.h). They expand to the duffle canonical
- *  macros which DO have word-count entries (the ones emitted by
- *  mac_format_f3_color / mac_gte_store_f3 / etc.). Verification: V13
- *  (objdump byte-identical) holds.
+ *  The gp0_cmd_* / gp1_cmd_* byte constants are already short and descriptive; no vendor alias is provided for them.
  *
+ *  The vendor mnemonics are NOT registered with the duffle word-count metadata (word_counts.metadata.h).
+ *  They expand to the duffle canonical macros which DO have word-count entries
+ *  (the ones emitted by mac_format_f3_color / mac_gte_store_f3 / etc.). Verification: V13 (objdump byte-identical) holds.
  * ============================================================================ */
 
 #ifdef INTELLISENSE_DIRECTIVES

code/duffle/gte_vendor_sym.h

@@ -2,10 +2,8 @@
  *  duffle DSL — GTE Vendor Mnemonics (opt-in)
  *  ============================================================================
  *
- *  Provides the textbook MIPS assembly mnemonics for the GTE/COP2
- *  instructions as thin aliases to the canonical duffle macros in gte.h.
- *  The duffle names are primary; this header is for users who prefer
- *  the textbook mnemonics.
+ *  Provides the textbook MIPS assembly mnemonics for the GTE/COP2 instructions as thin aliases to the canonical duffle macros in gte.h.
+ *  The duffle names are primary; this header is for users who prefer the textbook mnemonics.
  *
  *  USAGE:   #include "duffle/gte_vendor_sym.h"   // after gte.h
  *

code/duffle/lottes_tape.h

@@ -14,16 +14,14 @@ typedef U4 const MipsCode;
 typedef Slice_(MipsCode);
 typedef Slice_MipsCode MipsAtom;
 
-#define MipsAtom_(sym) MipsCode tmpl(code,sym) [] align_(4) =
+#define MipsAtom_(sym) MipsCode sym [] align_(4) =
 
-// Bare form: file-scope declaration with hardcoded body.
 // Used for components with no args (e.g., ac_load_tri_indices) or identifier-args (hardcoded register names).
 //   MipsAtomComp_(ac_X) { body }
 // expands to:
 //   MipsCode ac_X[] align_(4) = { body };
 #define MipsAtomComp_(sym) MipsCode sym [] align_(4) =
 
-// Function form: function-body block that returns a MipsAtom slice.
 // Used for components with value-args (e.g., ac_format_f3_color).
 //   FI_ MipsAtom ac_X(args) MipsAtomComp_Proc_(ac_X, { body })
 // expands to:
@@ -34,16 +32,16 @@ typedef Slice_MipsCode MipsAtom;
 
 /* Register aliases */
 enum {
-	R_AtomJmp    = R_T9,
-	R_TapePtr    = R_T8,  /* The Instruction Stream Pointer */
-	R_InCursor   = R_T4,  /* Input data cursor */
+	R_AtomJmp    = R_T9 atom_reg,  /* debug-visible; tape yield handshake scratch */
+	R_TapePtr    = R_T8 atom_reg,  /* The Instruction Stream Pointer */
+	R_InCursor   = R_T4,
 
-	R_PrimCursor = R_T7,  /* VRAM output cursor (primitive buffer) */
-	R_FaceCursor = R_T4,  /* Input data cursor (indices/faces) */
-	R_VertBase   = R_T5,  /* Base address of the vertex array */
-	R_OtBase     = R_T6,  /* Base address of the Ordering Table */
+	R_PrimCursor = R_T7 atom_reg atom_type(U4 *),    /* VRAM output cursor (primitive buffer) */
+	R_FaceCursor = R_T4 atom_reg atom_type(V4_S2 *), /* Cube face-index cursor (V4_S2*); floor context switches to V3_S2* via atom_phase */
+	R_VertBase   = R_T5 atom_reg atom_type(V3_S2 *), /* Base address of the vertex array */
+	R_OtBase     = R_T6 atom_reg atom_type(U4 *),    /* Base address of the Ordering Table */
 
-/* Stringification codes for the GCC inline assembler clobber lists */
+/* Stringification codes for the GCC inline assembler clobber lists. */
 #define R_TapePtr_Code     R_T8_Code
 #define R_InCursor_Code    R_T4_Code
 
@@ -89,13 +87,13 @@ FI_ void        tb_init(TapeBuilder* tb, FArena* arena) { tb->ptr = arena->start
 FI_ TapeBuilder tb_make_old(             FArena* arena) { return (TapeBuilder){ arena->start, 0 }; }
 FI_ TapeBuilder tb_make(Slice mem) { return (TapeBuilder){ mem.ptr, mem.len, 0 }; }
 
-#define tb_emit_(tb, atom) tb_emit(tb, tmpl(code,atom))
+#define tb_emit_(tb, atom) tb_emit(tb, atom)
 FI_ void tb_emit(TapeBuilder* tb, MipsCode* atom) { u4_r(tb->ptr)[tb->used] = u4_(atom); ++ tb->used; }
 FI_ void tb_data(TapeBuilder* tb, U4        data) { u4_r(tb->ptr)[tb->used] = u4_(data); ++ tb->used; }
 
-FI_ Slice_U4 tb_end  (TapeBuilder* tb) { tb_emit(tb,code_tape_exit); return (Slice_U4){ C_(U4*,tb->ptr), tb->used }; }
+FI_ Slice_U4 tb_end  (TapeBuilder* tb) { tb_emit(tb,tape_exit); return (Slice_U4){ C_(U4*,tb->ptr), tb->used }; }
 FI_ Slice_U4 tb_slice(TapeBuilder  tb) {                             return (Slice_U4){ C_(U4*,tb.ptr),  tb.used }; }
-#define tb_scope(tb) for(U4 tbs_once=0;tbs_once==0;++tbs_once,tb_emit(tb,code_tape_exit))
+#define tb_scope(tb) for(U4 tbs_once=0;tbs_once==0;++tbs_once,tb_emit(tb,tape_exit))
 
 #pragma endregion Tape Drive
 
@@ -109,8 +107,7 @@ FI_ Slice_U4 tb_slice(TapeBuilder  tb) {                             return (Sli
 MipsAtomComp_(ac_yield) {
 	load_word(R_AtomJmp, R_TapePtr, 0),
 	add_ui_self(         R_TapePtr, S_(MipsCode)),
-	jump_reg( R_AtomJmp),
-	nop,
+	jump_reg( R_AtomJmp), nop,
 };
 
 /* Words: 3; Loads 3 S2 indices from the face array */
@@ -121,6 +118,7 @@ MipsAtomComp_(ac_load_tri_indices) {
 };
 
 /* Words: 18; Translates indices to vertex addresses and pushes them to GTE  */
+atom_dbg_skip_over()
 MipsAtomComp_(ac_gte_load_tri_verts) {
 	shift_lleft(R_AT, R_T0, v3s2_byteoff), add_u_self(R_AT, R_VertBase), load_word(R_V0, R_AT, O_(V3_S2,x)), load_word(R_V1, R_AT, O_(V3_S2,z)), gte_mv_to_data_r(R_V0, C2_VXY0), gte_mv_to_data_r(R_V1, C2_VZ0),
 	shift_lleft(R_AT, R_T1, v3s2_byteoff), add_u_self(R_AT, R_VertBase), load_word(R_V0, R_AT, O_(V3_S2,x)), load_word(R_V1, R_AT, O_(V3_S2,z)), gte_mv_to_data_r(R_V0, C2_VXY1), gte_mv_to_data_r(R_V1, C2_VZ1),
@@ -162,13 +160,12 @@ MipsAtomComp_(ac_insert_ot_tag_g4) {
 FI_ MipsAtom ac_pack_color_word(U4 off, U4 cmd, U1 r, U1 g, U1 b)
 MipsAtomComp_Proc_(ac_pack_color_word, {
 	load_upper_i(R_AT, (cmd) << 8  | (b)),
-	or_i_self(   R_AT, ((g)   << 8) | (r)),
+	or_i_self(   R_AT, ((g)  << 8) | (r)),
 	store_word(  R_AT, R_PrimCursor, (off)),
 })
 
 /* Words: 3; Emits the F3 command+color word (cmd byte | BLUE | GREEN | RED)
- * Args: _r, _g, _b are 8-bit RGB byte values (not raw 16-bit fields).
- * Migrated from hello_gte_tape.c; takes RGB form per the Phase 3 convention. */
+ * Args: _r, _g, _b are 8-bit RGB byte values (not raw 16-bit fields). */
 FI_ MipsAtom ac_format_f3_color(U1 r, U1 g, U1 b)
 MipsAtomComp_Proc_(ac_format_f3_color, { mac_pack_color_word(O_(Poly_F3,color), gp0_cmd_poly_f3, r, g, b) })
 
@@ -237,9 +234,8 @@ FI_ void atombuilder_unroll(MipsAtomBuilder_R ab, Slice_MipsCode_R code) {
 
 // When done authoring, utilize this to cap-off the atom
 FI_ void atombuilder_end(MipsAtomBuilder_R ab) {
-	LP_ MipsAtom_(yield) { mac_yield() };
-	mem_copy(ab->start, u4_(code_yield), S_(code_yield));
-	mem_bump(ab->start, ab->capacity, & ab->used, S_(code_yield));
+	mem_copy(ab->start, u4_(ac_yield), S_(ac_yield));
+	mem_bump(ab->start, ab->capacity, & ab->used, S_(ac_yield));
 }
 
 #define mipsatom_from_builder(ab) (MipsAtom){ab.start, ab.used}
@@ -269,8 +265,7 @@ internal MipsAtom_(mips_flush_icache) {
 	store_word(rret_addr, rstack_ptr, S_(U4)),           // sw  $ra,   4($sp) 
 	add_ui(rret_0, rdiscard, bios_flushcache),           // addiu $a0, $0, 0x44 
 	add_ui(rtmp_0, rdiscard, bios_table_addr),           // addiu $t0, $0, 0xA0 
-	jump_link(rtmp_0, rret_addr),                        // jalr  $t0, $ra 
-	nop,                                                 // BD slot 
+	jump_link(rtmp_0, rret_addr), nop,                   // jalr  $t0, $ra, BD slot
 	load_word(rret_addr, rstack_ptr, S_(U4)),            // lw   $ra, 4($sp) 
 	jump_reg(rret_addr),                                 // jr   $ra 
 	add_ui(rstack_ptr, rstack_ptr, MipsStackAlignment),  // sp += 8 (BD) 

code/duffle/mips.h

@@ -1,38 +1,28 @@
 /* ============================================================================
  *  duffle DSL Suffix Conventions
  *  ============================================================================
- *
  *  Every mnemonic in this header follows the same suffix grammar:
- *
- *    _i        Immediate value (16-bit constant operand). Combine with
- *              _u or _s (single-letter modifier + type combined): add_ui,
- *              add_si. Examples: add_ui, add_si, and_i, or_i, xor_i,
- *              load_upper_i. and_i is sign-agnostic (andi zero-extends).
- *              load_upper_i is a unique verb; _i is the immediate marker,
- *              not a modifier+type combination.
- *
- *    _u        Unsigned (no-overflow, no-sign-extension). R-type
- *              arithmetic examples: add_u, sub_u, mult_u, div_u. I-type
- *              (combined with _i): add_ui.
- *
- *    _s        Signed (overflow-traps, sign-extends). R-type: add_s,
- *              sub_s, mult_s, div_s, set_lt_s. I-type (combined with _i):
- *              add_si.
+ *    _i: Immediate value (16-bit constant operand). 
+ *        Combine with _u or _s (single-letter modifier + type combined): add_ui, add_si.
+ *        Examples: add_ui, add_si, and_i, or_i, xor_i, load_upper_i. and_i is sign-agnostic (andi zero-extends).
+ *        load_upper_i is a unique verb; _i is the immediate marker, not a modifier+type combination.
+ *    _u: Unsigned (no-overflow, no-sign-extension).
+ *        R-type arithmetic examples: add_u, sub_u, mult_u, div_u. I-type (combined with _i): add_ui.
+ *    _s: Signed (overflow-traps, sign-extends). 
+ *        R-type: add_s, sub_s, mult_s, div_s, set_lt_s. I-type (combined with _i): add_si.
  *
  *  --- Shift family (R-type): verb-modifier-direction ---
- *    The shift macros use `shift_<modifier><direction>`. Modifier is
- *    the single letter `l` (logical) or `a` (arithmetic). Direction
- *    is the word `left` or `right`. Combined: `_lleft`, `_lright`,
- *    `_aright`. Examples: shift_lleft( rd, rt, shamt) (= sll)
- *                         shift_lright(rd, rt, shamt) (= srl)
- *                         shift_aright(rd, rt, shamt) (= sra)
- *    (no `_aleft`; MIPS has no `sla` — arithmetic-left is bit-identical
- *    to logical-left, so use shift_lleft for that case)
+ *    The shift macros use `shift_<modifier><direction>`.
+ *    Modifier is the single letter `l` (logical) or `a` (arithmetic).
+ *    Direction is the word `left` or `right`. Combined: `_lleft`, `_lright`, `_aright`.
+ *    Examples: shift_lleft( rd, rt, shamt) (= sll)
+ *              shift_lright(rd, rt, shamt) (= srl)
+ *              shift_aright(rd, rt, shamt) (= sra)
+ *    (no `_aleft`; MIPS has no `sla` — arithmetic-left is bit-identical to logical-left, so use shift_lleft for that case)
  *
  *  --- Jump/Call family ---
- *    Simple jumps keep the original short names: jump (j), jump_reg
- *    (jr), jump_link (jalr rs, rd). The jump-and-link-to variants
- *    (jal, jalr rs with default $ra) get the `call_` verb instead:
+ *    Simple jumps keep the original short names: jump (j), jump_reg (jr), jump_link (jalr rs, rd).
+ *    The jump-and-link-to variants (jal, jalr rs with default $ra) get the `call_` verb instead:
  *    call_addr (jal), call_reg (jalr rs, default $ra).
  *    Examples: jump(off)         (= j)
  *              jump_reg(rs)      (= jr)
@@ -40,32 +30,22 @@
  *              call_reg(rs)      (= jalr rs, default $ra)
  *              call_addr(off)    (= jal)
  *
- *    _r        Register marker — used only when the register type needs
- *              disambiguation (e.g., GTE data register vs control
- *              register). NOT used in plain R-type arithmetic (the
- *              R-type is implicit). Examples: gte_mv_to_data_r,
- *              gte_mv_to_ctrl_r.
+ *    _r: Register marker — used only when the register type needs disambiguation (e.g., GTE data register vs control register).
+ *        NOT used in plain R-type arithmetic (the R-type is implicit). Examples: gte_mv_to_data_r, gte_mv_to_ctrl_r.
+ *    _self:     Destination equals one source operand.
+ *               Examples: add_ui_self (I-type, to self), add_u_self (R-type, to self).
+ *    _mv_to_:   Direction: data flows into X.
+ *               Example: gte_mv_to_data_r, gte_mv_to_ctrl_r.
+ *    _mv_from_: Direction: data flows out of X.
+ *               Example: gte_mv_from_data_r, gte_mv_from_ctrl_r.
+ *    _str:      String-form — emits inline-asm string instead of `.word`.
+ *               Example: gte_rtpt_asm_str.
+ *    _2w / _1w: Word count of the emitted sequence.
+ *               Example: load_imm_2w.
  *
- *    _self     Destination equals one source operand.
- *              Examples: add_ui_self (I-type, to self),
- *                        add_u_self (R-type, to self).
- *
- *    _mv_to_   Direction: data flows into X.
- *              Example: gte_mv_to_data_r, gte_mv_to_ctrl_r.
- *
- *    _mv_from_ Direction: data flows out of X.
- *              Example: gte_mv_from_data_r, gte_mv_from_ctrl_r.
- *
- *    _str      String-form — emits inline-asm string instead of `.word`.
- *              Example: gte_rtpt_asm_str.
- *
- *    _2w / _1w Word count of the emitted sequence.
- *              Example: load_imm_2w.
- *
- *    _cop2     RESERVED — DO NOT USE in macro names. The `gte_` namespace
- *              prefix already implies coprocessor 2. Use `c2` only in:
- *                (a) integer opcode enums (op_lwc2 = 0x32, op_swc2 = 0x3A)
- *                (b) vendor-mnemonic macro aliases (gte_mtc2, gte_mfc2)
+ *    _cop2: RESERVED — DO NOT USE in macro names. The `gte_` namespace prefix already implies coprocessor 2. Use `c2` only in:
+ *      (a) integer opcode enums (op_lwc2 = 0x32, op_swc2 = 0x3A)
+ *      (b) vendor-mnemonic macro aliases (gte_mtc2, gte_mfc2)
  *
  *  Primitive commands: gp0_cmd_poly_f3 = 0x20 (byte opcode)
  *  Packed 32-bit cmd:  gp0_word_poly_f3(r, g, b) (32-bit, shifted)
@@ -80,9 +60,8 @@
  *            gte_lw_v0_xy(base) (gte + lw + v0 + xy)
  *            load_upper_i       (load-upper + immediate, unique verb)
  *
- *  Vendor mnemonics (sll, srl, sra, jr, j, jal, jalr) are NOT in this
- *  header. They live in the opt-in `mips_vendor_sym.h` for users who
- *  prefer the textbook MIPS assembly mnemonics.
+ *  Vendor mnemonics (sll, srl, sra, jr, j, jal, jalr) are NOT in this header.
+ *  They live in the opt-in `mips_vendor_sym.h` for users who prefer the textbook MIPS assembly mnemonics.
  * ============================================================================ */
 
 #ifdef INTELLISENSE_DIRECTIVES
@@ -98,19 +77,17 @@ enum {
 /* ============================================================================
  *  REGISTER INTEGER IDS (preprocessor-visible)
  * ============================================================================
- *  Every R_* enum below has a parallel R_*_Code `#define` so that the
- *  preprocessor can stringify the integer (e.g. for asm clobber lists and
- *  register-variable declarations via `rgcc(R_X)`). The enum value is
- *  bound to the `#define` so the two forms cannot drift apart.
+ *  Every R_* enum below has a parallel R_*_Code `#define` so that the preprocessor can stringify the integer
+ *  (e.g. for asm clobber lists and register-variable declarations via `rgcc(R_X)`).
+ *  The enum value is bound to the `#define` so the two forms cannot drift apart.
  *
- *  Only registers that get stringified need a `_Code` form; the rest are
- *  plain enum values. If you need to add a new one, follow the pattern:
+ *  Only registers that get stringified need a `_Code` form; the rest are plain enum values.
+ *  If you need to add a new one, follow the pattern:
  *      #define R_T7_Code 15
- *      R_T7 = R_T7_Code,        // in the enum
+ *      R_T7 = R_T7_Code,     // in the enum
  *
- *  User code should always reference the enum form (`R_T4`) at arithmetic
- *  sites and let `rlit(R_T4_Code)` / `rgcc(R_T4)` handle the stringify
- *  cases — never write the bare number `12`.
+ *  User code should always reference the enum form (`R_T4`) at arithmetic sites and let
+ *  `rlit(R_T4_Code)` / `rgcc(R_T4)` handle the stringify cases — never write the bare number `12`.
  * ============================================================================ */
 #define R_0_Code    0
 #define R_AT_Code   1
@@ -225,7 +202,6 @@ enum {
 	/* 2F: N/A */
 	// , op_lwc0
 
-
 	// , op_load_addr  = op_la
 	// , op_load_imm   = op_li
 	, op_jump       = op_j
@@ -327,15 +303,15 @@ enum { _BitOffsets = 0
  * Argument order matches the MIPS assembly syntax:
  *   dest-first, then source operands, then immediate last.
  *
- *   load_word(rt, base, off)   → lw   rt, off(base)
- *   store_word(rt, base, off)  → sw   rt, off(base)
- *   add_ui(rt, rs, imm)        → addiu rt, rs, imm
- *   shift_lleft(rd, rt, shamt)   → sll   rd, rt, shamt
- *   shift_lright(rd, rt, shamt)  → srl   rd, rt, shamt
- *   shift_aright(rd, rt, shamt)  → sra   rd, rt, shamt
- *   jump_reg(rs)               → jr    rs
- *   jump_link(rs, rd)          → jalr  rs        (link in rd, default $ra)
- *   nop                        → sll   $0, $0, 0
+ *   load_word(rt, base, off)    → lw   rt, off(base)
+ *   store_word(rt, base, off)   → sw   rt, off(base)
+ *   add_ui(rt, rs, imm)         → addiu rt, rs, imm
+ *   shift_lleft(rd, rt, shamt)  → sll   rd, rt, shamt
+ *   shift_lright(rd, rt, shamt) → srl   rd, rt, shamt
+ *   shift_aright(rd, rt, shamt) → sra   rd, rt, shamt
+ *   jump_reg(rs)                → jr    rs
+ *   jump_link(rs, rd)           → jalr  rs        (link in rd, default $ra)
+ *   nop                         → sll   $0, $0, 0
  */
 #define load_word(rt, base, off)   enc_i(op_lw,    (base), (rt), (off))
 #define load_byte(rt, base, off)   enc_i(op_lb,    (base), (rt), (off))
@@ -404,12 +380,9 @@ enum { _BitOffsets = 0
  * mult_s / mult_u → mult / multu   (writes HI/LO; result in LO)
  * div_s / div_u   → div / divu     (LO = quot, HI = rem)
  *
- * NOTE: dsl.h defines `add_s`/`sub_s`/`mut_s`/`gt_s`/etc. as
- * _Generic-based signed integer-arithmetic helpers for U1/U2/U4. Those
- * live in a different conceptual layer (generic arithmetic on DSL
- * types) and would collide with the instruction encoders here. The
- * `#undef` below lets the gas-style names below win; if a file needs
- * both, the dsl.h versions can be reached via their long forms
+ * NOTE: dsl.h defines `add_s`/`sub_s`/`mut_s`/`gt_s`/etc. as _Generic-based signed integer-arithmetic helpers for U1/U2/U4.
+ * Those live in a different conceptual layer (generic arithmetic on DSL types) and would collide with the instruction encoders here.
+ * The `#undef` below lets the gas-style names below win; if a file needs both, the dsl.h versions can be reached via their long forms
  * (e.g. `def_signed_op`-style or the underlying `add_s1/s2/s4`). */
 #undef add_s
 #undef sub_s
@@ -441,7 +414,7 @@ enum { _BitOffsets = 0
 #define mov_to_low(rs)             enc_r(op_special, (rs), R_0, R_0, 0, fc_mtlo)
 
 /* --- Atomic branches (no pseudos like bgt/bge; compose with slt_* + branch_ne) ---
- * branch_equal  rs, rt, off → beq   rs, rt, off
+ * branch_equal   rs, rt, off → beq   rs, rt, off
  * branch_ne      rs, rt, off → bne   rs, rt, off
  * branch_lt_zero rs, off     → bltz  rs, off
  * branch_gt_zero rs, off     → bgtz  rs, off
@@ -472,22 +445,18 @@ enum { _BitOffsets = 0
 
 /* load_imm_2w — unconditional 2-word `li` form: `lui` + (ori | addi).
  *
- * Granular companion to `load_imm`: skips the compile-time range checks
- * and always emits 2 .words. Use this when:
+ * Granular companion to `load_imm`: skips the compile-time range checks and always emits 2 .words. Use this when:
  *   - you know `imm` is > 0xFFFF (otherwise you're wasting a word), OR
  *   - `imm` is not a compile-time constant and you want predictable
  *     2-word emission without the `__builtin_constant_p` branches.
  *
  * The lo16 strategy is still chosen at expansion time on the lo half:
- *   lo16 in 0x0000..0x7FFF  →  addi (sign-ext is harmless, the lui
- *                              already cleared bits 15..0)
- *   lo16 in 0x8000..0xFFFF  →  ori  (zero-extends to preserve the
- *                              intended bit pattern)
+ *   lo16 in 0x0000..0x7FFF  →  addi (sign-ext is harmless, the lui already cleared bits 15..0)
+ *   lo16 in 0x8000..0xFFFF  →  ori  (zero-extends to preserve the intended bit pattern)
  *
- * For situations where you need to bypass even this choice (e.g. to
- * force a specific encoding for a known discontiguous high/low pair),
+ * For situations where you need to bypass even this choice 
+ * (e.g. to force a specific encoding for a known discontiguous high/low pair),
  * see `load_imm_2w_ori_forced` and `load_imm_2w_addi_forced` below.
- *
  * Statement-level (not expression-level): emits its own `asm volatile(...)`.
  */
 #define load_imm_2w(rt, imm) do {                         \
@@ -518,9 +487,8 @@ enum { _BitOffsets = 0
 } while (0)
 
 /* load_imm_2w_addi_forced — force the `lui` + `addi` form regardless of lo16 sign.
- * Use when you know sign-extension is fine (e.g. lo16 is treated as
- * signed downstream) and you want a smaller effective instruction
- * (the assembler/MIPS hardware will sign-extend the imm16). */
+ * Use when you know sign-extension is fine (e.g. lo16 is treated as signed downstream) 
+ * and you want a smaller effective instruction (the assembler/MIPS hardware will sign-extend the imm16). */
 #define load_imm_2w_addi_forced(rt, imm) do {   \
 	/*U4 _li2a_imm_ = (U4)(imm);*/                \
 	asm volatile(asm_words(                       \
@@ -532,23 +500,17 @@ enum { _BitOffsets = 0
 
 /* load_imm rt, imm — true `li` semantics (assembler `li` pseudo)
  *
- * Dispatches at compile time on the immediate's range, picking the
- * smallest single-instruction form when possible:
- *
- *   imm in   0 ..  0x7FFF  →  addi  rt, $0, imm   (1 word)
- *   imm in 0x8000 .. 0xFFFF →  ori   rt, $0, imm   (1 word; sign-bit must be zeroed)
- *   imm in  0x10000 ..  0xFFFFFFFF  →  lui + (ori | addi)  (2 words)
- *
- * Statement-level (not expression-level): the macro emits its own
- * `asm volatile(...)` block with 1 or 2 .word constants. Callers can
- * group multiple `load_imm` calls in a single volatile by using the
- * lower-level encoders directly:
+ * Dispatches at compile time on the immediate's range, picking the smallest single-instruction form when possible:
+ *   imm in 0       .. 0x7FFF     →  addi  rt, $0, imm   (1 word)
+ *   imm in 0x8000  .. 0xFFFF     →  ori   rt, $0, imm   (1 word; sign-bit must be zeroed)
+ *   imm in 0x10000 .. 0xFFFFFFFF →  lui + (ori | addi)  (2 words)
  *
+ * Statement-level (not expression-level): the macro emits its own `asm volatile(...)` block with 1 or 2 .word constants.
+ * Callers can group multiple `load_imm` calls in a single volatile by using the lower-level encoders directly:
  *      load_imm(R_T4, 0x12345678);          // emits 2 .words
  *
- * Falls back to a 2-word form if `imm` is not a compile-time constant,
- * but that path is unusual (load_imm is most useful with literal
- * addresses and magic numbers). */
+ * Falls back to a 2-word form if `imm` is not a compile-time constant, but that path is unusual
+ * (load_imm is most useful with literal addresses and magic numbers). */
 #define load_imm(rt, imm) do {                                     \
 	if (cexpr_(imm) && ((imm) <= 0x7FFFU)) {                         \
 		/* Small positive: addi rt, $0, imm */                         \
@@ -588,9 +550,8 @@ enum { _BitOffsets = 0
 
 
 /* Standard clobber list for pure-MIPS asm volatile blocks: caller-saved
- * GPRs that the kernel treats as volatile (v0/v1/t0/t1/ra) plus the
- * "memory" barrier. The register ids are passed through `rlit` so
- * the R_*_Code `#define`s are stringified into "$N" at expansion time. */
+ * GPRs that the kernel treats as volatile (v0/v1/t0/t1/ra) plus the "memory" barrier.
+ * The register ids are passed through `rlit` so the R_*_Code `#define`s are stringified into "$N" at expansion time. */
 #define clbr_volatile_gprs rlit(R_V0), rlit(R_T0), rlit(R_T1), rlit(R_RA), clb_mem_drain
 
 #define asm_mips_flush_icache() asm volatile( asm_words( \

code/duffle/mips_vendor_sym.h

@@ -2,9 +2,8 @@
  *  duffle DSL — MIPS Vendor Mnemonics (opt-in)
  *  ============================================================================
  *
- *  Provides the textbook MIPS assembly mnemonics as thin aliases to the
- *  canonical duffle macros in mips.h. The duffle names are primary; this
- *  header is for users who prefer the textbook mnemonics.
+ *  Provides the textbook MIPS assembly mnemonics as thin aliases to the canonical duffle macros in mips.h.
+ *  The duffle names are primary; this header is for users who prefer the textbook mnemonics.
  *
  *  USAGE:   #include "duffle/mips_vendor_sym.h"   // after mips.h
  *

code/duffle/word_count.metadata.h

@@ -5,11 +5,10 @@
 // Format: WORD_COUNT(MACRO_NAME, COUNT)
 // One line per macro that appears in your atom sources.
 //
-// This file is encoding-macros-only. The auto-generated component
-// macros (mac_X) live in duffle/gen/<dir>.macs.h (included separately
-// by the unity build). The unity build should include THIS file and
-// the .macs.h file in the same TU, with both wrapped (or the
-// include guard order handled) to avoid WORD_COUNT redeclaration.
+// This file is encoding-macros-only. 
+// The auto-generated component macros (mac_X) live in duffle/gen/<dir>.macs.h (included separately by the unity build).
+// The unity build should include THIS file and the .macs.h file in the same TU, with both wrapped 
+// (or the include guard order handled) to avoid WORD_COUNT redeclaration.
 //
 // To regenerate: hand-count the instructions in each macro definition.
 // (You'll only need to do this once per macro — they don't change often.)

code/gte_hello/hello_gte.c

@@ -259,9 +259,9 @@ void update(PrimitiveArena* pa, U4* ordering_buf)
 		U4 prim_base   = u4_(pa->buf[smem.active_buf_id]);
 		U4 prim_cursor = prim_base + pa->used;
 
-		LP_ U4 mem_temp_tape[512]; FArena tape_arena; farena_init(& tape_arena, slice_ut_arr(mem_temp_tape));
-		TapeBuilder tb = tb_make_old(&tape_arena); tb_scope(& tb) {
-			tb_emit(& tb, code_rbind_cube_g4_face);
+		LP_ U4 mem_temp_tape[512];
+		TapeBuilder tb = tb_make(slice_ut_arr(mem_temp_tape)); tb_scope(& tb) {
+			tb_emit(& tb, rbind_cube_g4_face);
 				tb_data(& tb, prim_cursor);
 				tb_data(& tb, u4_(smem.cube.faces));
 				tb_data(& tb, u4_(smem.cube.verts));
@@ -269,10 +269,10 @@ void update(PrimitiveArena* pa, U4* ordering_buf)
 
 			for (U4 i = 0; i < Cube_num_faces; i++) {
 				// Two triangles per quad face: (x,y,z) and (x,z,w)
-				tb_emit(& tb, code_cube_g4_face);
+				tb_emit(& tb, cube_g4_face);
 			}
 
-			tb_emit(& tb, code_sync_primitive_arena);
+			tb_emit(& tb, sync_primitive_arena);
 				tb_data(& tb, u4_(& pa->used));
 				tb_data(& tb, prim_base);
 		}
@@ -350,20 +350,20 @@ void update(PrimitiveArena* pa, U4* ordering_buf)
 		// Prepare the tape. (Push protocol to tape)
 		LP_ U4 mem_temp_tape[512];
 		TapeBuilder tb = tb_make(slice_ut_arr(mem_temp_tape)); tb_scope(& tb) {
-			tb_emit(& tb, code_set_gte_world);
+			tb_emit(& tb, set_gte_world);
 				tb_data(& tb, u4_(& smem.tform_world));
 
-			tb_emit(& tb, code_rbind_floor_f3_face);
+			tb_emit(& tb, rbind_floor_f3_face);
 			// TODO(Ed): Just use a single context struct ref
 				tb_data(& tb, prim_cursor);
 				tb_data(& tb, u4_(smem.floor.faces));
 				tb_data(& tb, u4_(smem.floor.verts));
 				tb_data(& tb, u4_(ordering_buf));
 			for (U4 i = 0; i < Floor_num_faces; i++) {
-				tb_emit(& tb, code_floor_f3_face);
+				tb_emit(& tb, floor_f3_face);
 			}
-			// After code_floor_f3_face iterations complete, the primitive arena's used counter needs updating.
-			tb_emit(& tb, code_sync_primitive_arena);
+			// After floor_f3_face iterations complete, the primitive arena's used counter needs updating.
+			tb_emit(& tb, sync_primitive_arena);
 				tb_data(& tb, u4_(& pa->used));
 				tb_data(& tb, prim_base);
 		}

code/gte_hello/hello_gte_tape.c

@@ -22,27 +22,22 @@ typedef Struct_(Binds_CubeTri) {
 	V3_S2* VertBase;
 	U4*    OtBase;
 };
-internal MipsAtom_(rbind_cube_g4_face) atom_info(atom_bind(Binds_CubeTri)
+internal MipsAtom_(rbind_cube_g4_face) atom_info(atom_bind(Binds_CubeTri), atom_phase(cube_g4)
 ,	atom_reads(R_TapePtr)
 ,	atom_writes(R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
 ){
 	/* Pop 4 arguments from the tape directly into the workspace registers */
-	load_word(R_PrimCursor, R_TapePtr, O_(Binds_CubeTri,PrimCursor)), 
-	load_word(R_FaceCursor, R_TapePtr, O_(Binds_CubeTri,FaceCursor)), 
-	load_word(R_VertBase,   R_TapePtr, O_(Binds_CubeTri,VertBase)), 
-	load_word(R_OtBase,     R_TapePtr, O_(Binds_CubeTri,OtBase)), 
+	load_word(R_PrimCursor, R_TapePtr, O_(Binds_CubeTri,PrimCursor)),
+	load_word(R_FaceCursor, R_TapePtr, O_(Binds_CubeTri,FaceCursor)),
+	load_word(R_VertBase,   R_TapePtr, O_(Binds_CubeTri,VertBase)),
+	load_word(R_OtBase,     R_TapePtr, O_(Binds_CubeTri,OtBase)),
 	add_ui_self(            R_TapePtr, S_(Binds_CubeTri)),
 	mac_yield()
 };
 
-/* ============================================================================
- *  cube_g4_face — Draw one cube face (Gouraud-shaded quad) via the GTE tape pipeline
- * ============================================================================
- *  Reads 4 indices from R_FaceCur (V4_S2 = 8 bytes), loads 4 vertices into
- *  the GTE, runs the PsyQ RotAverageNclip4 sequence, and renders a Poly_G4.
- */
-internal 
-MipsAtom_(cube_g4_face) atom_info(
+ // cube_g4_face — Draw one cube face (Gouraud-shaded quad) via the GTE tape pipeline
+internal
+MipsAtom_(cube_g4_face) atom_info(atom_phase(cube_g4),
 		atom_reads( R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase),
 		atom_writes(R_PrimCursor, R_FaceCursor)
 ){
@@ -94,22 +89,23 @@ typedef Struct_(Binds_FloorTri) {
 	V3_S2* VertBase;
 	U4*    OtBase;
 };
-internal 
-MipsAtom_(rbind_floor_f3_face) atom_info(atom_bind(Binds_FloorTri)
+internal
+MipsAtom_(rbind_floor_f3_face) atom_info(atom_bind(Binds_FloorTri), atom_phase(floor_f3)
 	, atom_reads(R_TapePtr)
 	, atom_writes(R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
 ){
 	/* Pop 4 arguments from the tape directly into the workspace registers */
-	load_word(R_PrimCursor, R_TapePtr, O_(Binds_FloorTri,PrimCursor)), 
-	load_word(R_FaceCursor, R_TapePtr, O_(Binds_FloorTri,FaceCursor)), 
-	load_word(R_VertBase,   R_TapePtr, O_(Binds_FloorTri,VertBase)), 
-	load_word(R_OtBase,     R_TapePtr, O_(Binds_FloorTri,OtBase)), 
+	load_word(R_PrimCursor, R_TapePtr, O_(Binds_FloorTri,PrimCursor)),
+	load_word(R_FaceCursor, R_TapePtr, O_(Binds_FloorTri,FaceCursor)),
+	load_word(R_VertBase,   R_TapePtr, O_(Binds_FloorTri,VertBase)),
+	load_word(R_OtBase,     R_TapePtr, O_(Binds_FloorTri,OtBase)),
 	add_ui_self(            R_TapePtr, S_(Binds_FloorTri)),
 	mac_yield()
 };
 
-internal 
-MipsAtom_(floor_f3_face) atom_info(
+internal
+atom_dbg_skip_over()
+MipsAtom_(floor_f3_face) atom_info(atom_phase(floor_f3)
 	, atom_reads( R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
 	, atom_writes(R_PrimCursor, R_FaceCursor)
 ) {
@@ -117,30 +113,29 @@ MipsAtom_(floor_f3_face) atom_info(
 	mac_gte_load_tri_verts(R_T0, R_T1, R_T2),
 	nop2, gte_cmdw_rotate_translate_perspective_triple,
 	nop2, gte_cmdw_nclip,
- 
+
 	/* Culling (Branch forward if Backface) */
 	nop2, gte_mv_from_data_r(R_T0, C2_MAC0),
 	nop,
 	branch_le_zero(R_T0, atom_offset(culling, floor_f3_face_exit)), nop,
 	/* Format Primitive */
-	// mac_format_f3_color(0x20FF, 0xFFFF),  // works
 	mac_format_f3_color(0xFF, 0xFF, 0xFF),  // RGB-form (R=FF, G=FF, B=FF = white)
 	mac_gte_store_f3_post_rtpt(),
-	
+
 	/* Calculate Depth */
-	nop2, gte_avg_sort_z3,            
-	nop2, gte_mv_from_data_r(R_T1, C2_OTZ),      
+	nop2, gte_avg_sort_z3,
+	nop2, gte_mv_from_data_r(R_T1, C2_OTZ),
 	/* Bounds Check OTZ < 2048 (Branch forward to skip insertion) */
-	add_ui(      R_AT, R_0,  OrderingTbl_Len),   
-	set_lt_u(    R_AT, R_T1, R_AT), 
-	branch_equal(R_AT, R_0,  atom_offset(bounds_chk, floor_f3_face_exit)), nop, 
+	add_ui(      R_AT, R_0,  OrderingTbl_Len),
+	set_lt_u(    R_AT, R_T1, R_AT),
+	branch_equal(R_AT, R_0,  atom_offset(bounds_chk, floor_f3_face_exit)), nop,
 	/* Insert into Ordering Table Linked List */
 	mac_insert_ot_tag_f3(),
 	add_ui_self(R_PrimCursor, S_(Poly_F3)), /* Advance Prim Cursor (5 words) */
 		// Note(Ed): No bounds checking, should be checked before atom runs.
 
 /* Advance Input Cursor & Yield (Both branch targets land here) */
-atom_label(floor_f3_face_exit) 
+atom_label(floor_f3_face_exit)
 	add_ui_self(R_FaceCursor, S_(S2) * 4),  /* Advance Face Cursor (4 * S2 = 8 bytes) */
 	mac_yield()
 };
@@ -151,7 +146,7 @@ internal MipsAtom_(sync_primitive_arena) atom_info(atom_bind(Binds_SyncPrimitive
 	, atom_writes(R_TapePtr)
 ){
 	load_word(R_AT, R_TapePtr, O_(Binds_SyncPrimitiveArena,used)),
-	load_word(R_T0, R_TapePtr, O_(Binds_SyncPrimitiveArena,cursor)),      
+	load_word(R_T0, R_TapePtr, O_(Binds_SyncPrimitiveArena,cursor)),
 	add_ui_self(    R_TapePtr, S_(Binds_SyncPrimitiveArena)),
 	/* Calculate byte offset and store directly back to RAM */
 	sub_u(     R_T0, R_PrimCursor, R_T0), // R_T0    = R_PrimCursor - binds.cursor

readme.md

@@ -27,6 +27,13 @@ scoop install luajit
 
 * Lua is slow (even jitted) so this helps.
 
+[lfs (LuaFileSystem)](https://github.com/lunarmodules/luafilesystem)
+
+* Native directory enumeration + `mkdir` for the build scripts.
+* Used by `passes/word_count_eval.lua :: scan_dir` (native walk vs. `dir /b /s` subprocess,
+  ~2ms vs. ~56ms) and by `duffle.lua :: ensure_dir` + `to_absolute_path` (avoids
+  `cmd.exe mkdir` + `cd` shell spawns, ~50ms each).
+
 [pscx-redux](https://github.com/grumpycoders/pcsx-redux/): A collection of tools, research, hardware design, and libraries aiming at development and reverse engineering on the PlayStation 1.
 
 * Used as the runtime sandbox emulated the ps1

scratch/gte_debug.lua

@@ -0,0 +1,30 @@
+-- gte_debug.lua — defensive version + prints error context.
+local ok, err = pcall(function()
+    print("[debug] PCSX exists:", PCSX ~= nil)
+    print("[debug] PCSX.WebServer exists:", PCSX and PCSX.WebServer ~= nil)
+    print("[debug] PCSX.WebServer.Handlers exists:", PCSX and PCSX.WebServer and PCSX.WebServer.Handlers ~= nil)
+    if not PCSX.WebServer then
+        print("[debug] creating PCSX.WebServer...")
+        PCSX.WebServer = {}
+    end
+    if not PCSX.WebServer.Handlers then
+        print("[debug] creating PCSX.WebServer.Handlers...")
+        PCSX.WebServer.Handlers = {}
+    end
+    print("[debug] type of Handlers:", type(PCSX.WebServer.Handlers))
+
+    PCSX.WebServer.Handlers.gte = function(req)
+        local r = PCSX.getRegisters()
+        local out = { "pc=0x" .. string.format("%x", r.pc) }
+        for i = 0, 31 do
+            out[#out + 1] = string.format("D[%d]=0x%08x C[%d]=0x%08x",
+                i, r.CP2D.r[i], i, r.CP2C.r[i])
+        end
+        return table.concat(out, "\n")
+    end
+    print("[debug] handler registered")
+end)
+
+if not ok then
+    print("[debug] ERROR: " .. tostring(err))
+end

scripts/audit_lua_nesting.lua

@@ -18,12 +18,12 @@
 local M = {}
 
 local BLOCK_OPEN = {
-    ["do"]      = true,
-    ["function"] = true,
-    ["if"]      = true,
-    ["for"]     = true,
-    ["while"]   = true,
-    ["repeat"]  = true,
+	["do"]       = true,
+	["function"] = true,
+	["if"]       = true,
+	["for"]      = true,
+	["while"]    = true,
+	["repeat"]   = true,
 }
 
 local function is_block_close(token) return token == "end" or token == "until" end
@@ -31,121 +31,118 @@ local function is_block_close(token) return token == "end" or token == "until" e
 -- (internal) Walk one source file and return a list of
 -- {line, depth, token} entries where depth > max_nesting.
 local function audit_file(path, max_nesting)
-    local f = io.open(path, "r")
-    if not f then error("Cannot open " .. path) end
-    local content = f:read("*a")
-    f:close()
+	local  f = io.open(path, "r")
+	if not f then error("Cannot open " .. path) end
+	local content = f:read("*a")
+	f:close()
 
-    local violations = {}
-    local depth      = 0
-    local line       = 1
-    local pos        = 1
-    local src_len    = #content
-    local token_idx  = 0
+	local violations = {}
+	local depth      = 0
+	local line       = 1
+	local pos        = 1
+	local src_len    = #content
+	local token_idx  = 0
 
-    local function read_ident_at(start_pos)
-        local ident_start = start_pos
-        if ident_start > src_len then return nil end
-        local first_ch = content:sub(ident_start, ident_start)
-        if not (first_ch:match("[%a_]")) then return nil end
-        local scan = start_pos + 1
-        while scan <= src_len do
-            local ch = content:sub(scan, scan)
-            if not (ch:match("[%w_]")) then break end
-            scan = scan + 1
-        end
-        return content:sub(ident_start, scan - 1), scan
-    end
+	local function read_ident_at(start_pos)
+		local ident_start = start_pos
+		if ident_start > src_len then return nil end
+		local first_ch = content:sub(ident_start, ident_start)
+		if not (first_ch:match("[%a_]")) then return nil end
+		local scan = start_pos + 1
+		while scan <= src_len do
+			local ch = content:sub(scan, scan)
+			if not (ch:match("[%w_]")) then break end
+			scan = scan + 1
+		end
+		return content:sub(ident_start, scan - 1), scan
+	end
 
-    -- Skip past a string literal or comment starting at `start_pos`.
-    -- Returns the position just past the construct, or nil if `start_pos`
-    -- is not the start of a string/comment.
-    local function skip_string_or_comment(start_pos)
-        local ch = content:sub(start_pos, start_pos)
-        if ch == '"' or ch == "'" then
-            local scan = start_pos + 1
-            while scan <= src_len do
-                local c = content:sub(scan, scan)
-                if c == "\\" then
-                    scan = scan + 2
-                elseif c == ch then
-                    return scan + 1
-                else
-                    scan = scan + 1
-                end
-            end
-            return src_len + 1
-        elseif ch == "-" and content:sub(start_pos + 1, start_pos + 1) == "-" then
-            local scan = start_pos + 2
-            if content:sub(scan, scan + 1) == "[[" and content:sub(scan + 2, scan + 3) == "[" then
-                -- Long bracket comment [==[ ... ]==]
-                scan = scan + 2
-                local eq = ""
-                while content:sub(scan, scan) == "=" do
-                    eq = eq .. "="
-                    scan = scan + 1
-                end
-                local close_marker = "]" .. eq .. "]"
-                local close_pos = content:find(close_marker, scan, true)
-                if close_pos then
-                    return close_pos + #close_marker
-                else
-                    return src_len + 1
-                end
-            else
-                while scan <= src_len and content:sub(scan, scan) ~= "\n" do scan = scan + 1 end
-                return scan + 1
-            end
-        elseif ch == "[" and content:sub(start_pos + 1, start_pos + 1) == "[" then
-            local scan = start_pos + 2
-            local eq = ""
-            while content:sub(scan, scan) == "=" do
-                eq = eq .. "="
-                scan = scan + 1
-            end
-            local close_marker = "]" .. eq .. "]"
-            local close_pos = content:find(close_marker, scan, true)
-            if close_pos then
-                return close_pos + #close_marker
-            else
-                return src_len + 1
-            end
-        end
-        return nil
-    end
+	-- Skip past a string literal or comment starting at `start_pos`.
+	-- Returns the position just past the construct, or nil if `start_pos`
+	-- is not the start of a string/comment.
+	local function skip_string_or_comment(start_pos)
+		local ch = content:sub(start_pos, start_pos)
+		if    ch == '"' or ch == "'" then
+			local scan = start_pos + 1
+			while scan <= src_len do
+				local  c = content:sub(scan, scan)
+				if     c == "\\" then        scan = scan + 2
+				elseif c == ch   then return scan + 1
+				else                         scan = scan + 1
+				end
+			end
+			return src_len + 1
+		elseif ch == "-" and content:sub(start_pos + 1, start_pos + 1) == "-" then
+			local scan = start_pos + 2
+			if content:sub(scan, scan + 1) == "[[" and content:sub(scan + 2, scan + 3) == "[" then
+				-- Long bracket comment [==[ ... ]==]
+				scan = scan + 2
+				local eq = ""
+				while content:sub(scan, scan) == "=" do
+					eq = eq .. "="
+					scan = scan + 1
+				end
+				local close_marker = "]" .. eq .. "]"
+				local close_pos = content:find(close_marker, scan, true)
+				if close_pos then
+					return close_pos + #close_marker
+				else
+					return src_len + 1
+				end
+			else
+				while scan <= src_len and content:sub(scan, scan) ~= "\n" do scan = scan + 1 end
+				return scan + 1
+			end
+		elseif ch == "[" and content:sub(start_pos + 1, start_pos + 1) == "[" then
+			local scan = start_pos + 2
+			local eq = ""
+			while content:sub(scan, scan) == "=" do
+				eq   = eq .. "="
+				scan = scan + 1
+			end
+			local close_marker = "]" .. eq .. "]"
+			local close_pos = content:find(close_marker, scan, true)
+			if close_pos then
+				return close_pos + #close_marker
+			else
+				return src_len + 1
+			end
+		end
+		return nil
+	end
 
-    while pos <= src_len do
-        local ch = content:sub(pos, pos)
-        if ch == "\n" then line = line + 1 end
+	while pos <= src_len do
+		local ch = content:sub(pos, pos)
+		if ch == "\n" then line = line + 1 end
 
-        local skip_to = skip_string_or_comment(pos)
-        if skip_to then
-            for scan = pos, skip_to - 1 do
-                if content:sub(scan, scan) == "\n" then line = line + 1 end
-            end
-            pos = skip_to
-        elseif ch:match("[%a_]") then
-            local tok, next_pos = read_ident_at(pos)
-            token_idx = token_idx + 1
-            if BLOCK_OPEN[tok] then
-                depth = depth + 1
-                if depth > max_nesting then
-                    violations[#violations + 1] = {
-                        line  = line,
-                        depth = depth,
-                        token = tok,
-                    }
-                end
-            elseif is_block_close(tok) then
-                depth = depth - 1
-            end
-            pos = next_pos
-        else
-            pos = pos + 1
-        end
-    end
+		local skip_to = skip_string_or_comment(pos)
+		if skip_to then
+			for scan = pos, skip_to - 1 do
+				if content:sub(scan, scan) == "\n" then line = line + 1 end
+			end
+			pos = skip_to
+		elseif ch:match("[%a_]") then
+			local tok, next_pos = read_ident_at(pos)
+			token_idx = token_idx + 1
+			if BLOCK_OPEN[tok] then
+				depth = depth + 1
+				if depth > max_nesting then
+					violations[#violations + 1] = {
+						line  = line,
+						depth = depth,
+						token = tok,
+					}
+				end
+			elseif is_block_close(tok) then
+				depth = depth - 1
+			end
+			pos = next_pos
+		else
+			pos = pos + 1
+		end
+	end
 
-    return violations
+	return violations
 end
 
 --- Audit one file. Returns nil if clean, else a list of violations.
@@ -153,78 +150,68 @@ end
 --- @param max_nesting integer  -- default 5
 --- @return table|nil
 function M.audit(path, max_nesting)
-    local violations = audit_file(path, max_nesting or 5)
-    if #violations == 0 then return nil end
-    return violations
+	local  violations = audit_file(path, max_nesting or 5)
+	if     #violations == 0 then return nil end
+	return violations
 end
 
 -- Module CLI.
 if arg and arg[1] then
-    local max_nesting = 5
-    local files = {}
-    for arg_idx = 1, #arg do
-        if arg[arg_idx] == "--max" and arg[arg_idx + 1] then
-            max_nesting = tonumber(arg[arg_idx + 1]) or 5
-        else
-            files[#files + 1] = arg[arg_idx]
-        end
-    end
+	local max_nesting = 5
+	local files = {}
+	for arg_idx = 1, #arg do
+		if arg[arg_idx] == "--max" and arg[arg_idx + 1] then
+			max_nesting = tonumber(arg[arg_idx + 1]) or 5
+		else
+			files[#files + 1] = arg[arg_idx]
+		end
+	end
 
-    -- Accept either a directory or a file path. Directory args are
-    -- expanded via `dir /b *.lua` (Windows) or `ls *.lua` (Unix).
-    local function is_dir(p)
-        local f = io.open(p, "r")
-        if f then f:close() return false end
-        return true
-    end
-    local function list_lua(dir)
-        local out = {}
-        local cmd
-        if package.config:sub(1, 1) == "\\" then
-            cmd = 'dir /b "' .. dir .. '\\*.lua" 2>nul'
-        else
-            cmd = 'ls -1 "' .. dir .. '"/*.lua 2>/dev/null'
-        end
-        local p = io.popen(cmd)
-        if p then
-            for line in p:lines() do
-                if line:match("%.lua$") then
-                    out[#out + 1] = dir .. "/" .. line
-                end
-            end
-            p:close()
-        end
-        return out
-    end
+	-- Accept either a directory or a file path. Directory args are
+	-- expanded via lfs.dir (native, no subprocess).
+	local lfs = require("lfs")
+	local function is_dir(p)
+		return lfs.attributes(p, "mode") == "directory"
+	end
+	local function list_lua(dir)
+		local out = {}
+		if not is_dir(dir) then return out end
+		for entry in lfs.dir(dir) do
+			if entry:match("%.lua$") then
+				out[#out + 1] = dir .. "/" .. entry
+			end
+		end
+		return out
+	end
 
-    local to_check = {}
-    for _, f in ipairs(files) do
-        if is_dir(f) then
-            for _, sub in ipairs(list_lua(f)) do to_check[#to_check + 1] = sub end
-        else
-            to_check[#to_check + 1] = f
-        end
-    end
+	local to_check = {}
+	for _, f in ipairs(files) do
+		if is_dir(f) then
+			for _, sub in ipairs(list_lua(f)) do to_check[#to_check + 1] = sub end
+		else
+			to_check[#to_check + 1] = f
+		end
+	end
 
-    local total_violations = 0
-    for _, f in ipairs(to_check) do
-        local v = M.audit(f, max_nesting)
-        if v then
-            io.write(string.format("\n%s\n", f))
-            for _, x in ipairs(v) do
-                io.write(string.format("  line %d: depth %d (after '%s')\n", x.line, x.depth, x.token))
-            end
-            total_violations = total_violations + #v
-        end
-    end
+	local total_violations = 0
+	for _, f in ipairs(to_check) do
+		local v = M.audit(f, max_nesting)
+		if v then
+			io.write(string.format("\n%s\n", f))
+			for _, x in ipairs(v) do
+				io.write(string.format("  line %d: depth %d (after '%s')\n", x.line, x.depth, x.token))
+			end
+			total_violations = total_violations + #v
+		end
+	end
 
-    if total_violations == 0 then
-        io.write("OK: no files exceed max nesting of " .. max_nesting .. "\n")
-        os.exit(0)
-    else
-        io.write(string.format("\n%d nesting violation(s) found.\n", total_violations))
-        os.exit(1)
-    end
+	if total_violations == 0 then
+		io.write("OK: no files exceed max nesting of " .. max_nesting .. "\n")
+		os.exit(0)
+	else
+		io.write(string.format("\n%d nesting violation(s) found.\n", total_violations))
+		os.exit(1)
+	end
 end
 
 return M

scripts/build_psyq.ps1

@@ -321,11 +321,12 @@ function ps1-meta { param(
 		[Parameter(Mandatory=$true)][string[]]$sources,
 		[Parameter(Mandatory=$true)][string]$metadata,
 		[string]$out_root = (join-path $path_build 'gen'),
-		[string[]]$passes = @('--all')
+		[string[]]$passes = @('--pre-link'),
+		[string[]]$extra_args = @()
 	)
 	$script = join-path $path_scripts 'ps1_meta.lua'
 	write-host "ps1-meta  $($sources.Count) source(s), passes=$($passes -join ',')" ` -ForegroundColor Magenta
-	$arg_list = @($passes) + @('--metadata', $metadata) + @('--out-root', $out_root)
+	$arg_list = @($passes) + @('--metadata', $metadata) + @('--out-root', $out_root) + @($extra_args)
 	foreach ($s in $sources) { $arg_list += @('--source', $s) }
 	& luajit $script @arg_list
 	if ($LASTEXITCODE -ne 0) {
@@ -378,11 +379,80 @@ function build-gte_hello {
 	$link_args += $f_debug
 	# $link_args += $f_optimize_size
 	$link_modules = @(
-		$module_asm_crt, 
+		$module_asm_crt,
 		$module_c
 	)
 	link-modules $link_modules $elf $link_args
 	make-binary $elf $exe
+
+	# Post-link: gdb-runtime + dwarf-injection in a single Lua invocation (one luajit cold start).
+	ps1-meta -sources $atom_sources -metadata $path_atom_metadata `
+		-out_root (join-path $path_build 'gen') `
+		-passes @('--post-link') `
+		-extra_args @('--elf', $elf)
+
+	# F' + G' splice: collapse 9 objcopy subprocess invocations into 3.
+	# - 1 call: 3x --update-section for F' (line / aranges / rnglists)
+	# - 1 call: 3x --update-section for G' (info / abbrev / str)
+	# - 1 call: 2x --add-section for G' (loc / loclists — these don't exist in the source ELF)
+	# - 1 call: 1x --set-section-flags (.rodata / .data enable code flag)
+	# = 4 objcopy calls (was 9; saved 5 spawns).
+	$dwarfLineBin     = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_line.bin'
+	$dwarfArangesBin  = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_aranges.bin'
+	$dwarfRnglistsBin = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_rnglists.bin'
+	$injectElf        = join-path $path_build 'hello_gte.dwarf-injected.elf'
+	if ((Test-Path $dwarfLineBin) -and (Test-Path $dwarfArangesBin) -and (Test-Path $dwarfRnglistsBin))
+	{
+		Write-Host "[build] DWARF-injecting $elf -> $injectElf"
+		Copy-Item -LiteralPath $elf -Destination $injectElf -Force
+
+		# Single objcopy call: 3x --update-section for F' (line, aranges, rnglists).
+		$f_args = @(
+			"--update-section=.debug_line=$dwarfLineBin",
+			"--update-section=.debug_aranges=$dwarfArangesBin",
+			"--update-section=.debug_rnglists=$dwarfRnglistsBin"
+		)
+		& $Objcopy @f_args $injectElf 2>&1 | Out-Null
+		if ($LASTEXITCODE -ne 0) {
+			Write-Warning "[build] objcopy F' splice failed (exit $LASTEXITCODE); removing $injectElf"
+			Remove-Item -LiteralPath $injectElf -ErrorAction SilentlyContinue
+			return;
+		}
+
+		# G' 5-section splice: 3 update-section (info / abbrev / str) + 2 add-section (loc / loclists).
+		$dwarfInfoBin     = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_info.bin'
+		$dwarfAbbrevBin   = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_abbrev.bin'
+		$dwarfStrBin      = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_str.bin'
+		$dwarfLocBin      = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_loc.bin'
+		$dwarfLoclistsBin = join-path (join-path $path_build 'gen') 'hello_gte.dwarf_loclists.bin'
+		$g_args = @(
+			"--update-section=.debug_info=$dwarfInfoBin",
+			"--update-section=.debug_abbrev=$dwarfAbbrevBin",
+			"--update-section=.debug_str=$dwarfStrBin",
+			"--add-section=.debug_loc=$dwarfLocBin",
+			"--add-section=.debug_loclists=$dwarfLoclistsBin"
+		)
+		& $Objcopy @g_args $injectElf 2>&1 | Out-Null
+		if ($LASTEXITCODE -ne 0) {
+			Write-Warning "[build] objcopy G' splice failed (exit $LASTEXITCODE); removing $injectElf"
+			Remove-Item -LiteralPath $injectElf -ErrorAction SilentlyContinue
+			return;
+		}
+
+		# Baked atoms execute from RAM but are emitted as C data arrays, so their ELF sections lack SHF_EXECINSTR.
+		# GDB discards line rows for non-code sections. Mark only the debug-copy sections executable.
+		# The shipping ELF and PS-EXE remain byte/flag unchanged.
+		& $Objcopy `
+			--set-section-flags ".rodata=alloc,load,readonly,code,contents" `
+			--set-section-flags ".data=alloc,load,data,code,contents" `
+			$injectElf 2>&1 | Out-Null
+		if ($LASTEXITCODE -ne 0) {
+			Write-Warning "[build] atom-section flag update failed (exit $LASTEXITCODE); removing $injectElf"
+			Remove-Item -LiteralPath $injectElf -ErrorAction SilentlyContinue
+		} else {
+			Write-Host "[build] DWARF-injected ELF: $injectElf"
+		}
+	}
 }
 build-gte_hello
 

scripts/duffle.lua

@@ -8,20 +8,17 @@
 ---   - **C-language scanner** (`skip_ws_and_cmt`, `skip_str_or_cmt`, `read_ident`, `read_parens`, `read_braces`, `read_brackets`, `read_balanced`, `scan_to_char`, `split_top_level_commas`).
 ---   - **Word-count loader** (`load_word_counts` for `WORD_COUNT(...)` metadata files).
 ---   - **Line lookup** (`LineIndex` returns an O(log N) `line_of(pos)` closure for source-mapping).
----   - **Domain tables** (`WAVE_CONTEXT_REGS`, `TAPE_ATOM_MACROS`, `GTE_PIPELINE_LATENCY`, `GP0_CMD_SIZE`, `GP0_CMD_BY_SHAPE`, `GP0_MACRO_CONTRIB`, `INSTRUCTION_LATENCY`).
----   - **Process-bootstrap helper** (`setup_package_path`replaces the 8-line `arg[0]`-resolution boilerplate duplicated across 7 entry scripts)
+---   - **Domain tables** (`TAPE_ATOM_MACROS`, `GTE_PIPELINE_LATENCY`, `GP0_CMD_SIZE`, `GP0_CMD_BY_SHAPE`, `GP0_MACRO_CONTRIB`, `INSTRUCTION_LATENCY`).
 ---
 --- **Conventions**: tabs (1/level), EmmyLua annotations, no regex.
---- Lua 5.3 compatible; no `<close>`/`<toclose>`, no `continue`, no
---- 5.4 string.dump improvements. LuaJIT 5.1+extensions model is the primary target.
----
---- **No `:match` / `:gmatch` regex use anywhere**; all delimiter-
---- splitting is hand-rolled or via LPeg (the regex-free PEG library).
---- The hot lexer primitives are LPeg-backed where it pays off;
---- hand-rolled variants remain for callers that need a fallback.
 
 local M = {}
 
+-- Required native extension: lfs (LuaFileSystem). Built by `update_deps.ps1` to
+-- `toolchain/lfs/lfs.dll` and wired into package.cpath by `scripts/duffle_paths.lua`.
+-- If lfs is missing, `require` throws — fail loud per the build-tool convention.
+local lfs = require("lfs")
+
 -- ════════════════════════════════════════════════════════════════════════════
 -- Cross-file type aliases
 -- ════════════════════════════════════════════════════════════════════════════
@@ -43,96 +40,48 @@ local M = {}
 -- ASCII byte constants
 -- ════════════════════════════════════════════════════════════════════════════
 
-local BYTE_SPACE      = 32    -- ' '
-local BYTE_TAB        = 9     -- '\t'
-local BYTE_NEWLINE    = 10    -- '\n'
-local BYTE_CR         = 13    -- '\r'
-local BYTE_VT         = 11    -- '\v'
-local BYTE_FF         = 12    -- '\f'
+local BYTE_SPACE      = 0x20    -- ' '
+local BYTE_TAB        = 0x09    -- '\t'
+local BYTE_NEWLINE    = 0x0A    -- '\n'
+local BYTE_CR         = 0x0D    -- '\r'
+local BYTE_VT         = 0x0B    -- '\v'
+local BYTE_FF         = 0x0C    -- '\f'
 
-local BYTE_UNDERSCORE = 95    -- '_'
-local BYTE_DOT        = 46    -- '.'
-local BYTE_SLASH      = 47    -- '/'
-local BYTE_BACKSLASH  = 92    -- '\\'
-local BYTE_STAR       = 42    -- '*'
-local BYTE_DQUOTE     = 34    -- '"'
-local BYTE_SQUOTE     = 39    -- '\''
-local BYTE_COMMA      = 44    -- ','
-local BYTE_SEMI       = 59    -- ';'
+local BYTE_UNDERSCORE = 0x5F    -- '_'
+local BYTE_DOT        = 0x2E    -- '.'
+local BYTE_SLASH      = 0x2F    -- '/'
+local BYTE_BACKSLASH  = 0x5C    -- '\\'
+local BYTE_STAR       = 0x2A    -- '*'
+local BYTE_DQUOTE     = 0x22    -- '"'
+local BYTE_SQUOTE     = 0x27    -- '\''
+local BYTE_COMMA      = 0x2C    -- ','
+local BYTE_SEMI       = 0x3B    -- ';'
 
-local BYTE_OPEN_PAREN  = 40   -- '('
-local BYTE_OPEN_BRACE  = 123  -- '{'
-local BYTE_OPEN_BRACK  = 91   -- '['
+local BYTE_OPEN_PAREN  = 0x28   -- '('
+local BYTE_OPEN_BRACE  = 0x7B   -- '{'
+local BYTE_OPEN_BRACK  = 0x5B   -- '['
 
-local BYTE_LOWER_A = 97       -- 'a'
-local BYTE_LOWER_Z = 122      -- 'z'
-local BYTE_UPPER_A = 65       -- 'A'
-local BYTE_UPPER_Z = 90       -- 'Z'
+local BYTE_LOWER_A = 0x61       -- 'a'
+local BYTE_LOWER_Z = 0x7A       -- 'z'
+local BYTE_UPPER_A = 0x41       -- 'A'
+local BYTE_UPPER_Z = 0x5A       -- 'Z'
 
-local BYTE_DIGIT_0 = 48       -- '0'
-local BYTE_DIGIT_9 = 57       -- '9'
+local BYTE_DIGIT_0 = 0x30       -- '0'
+local BYTE_DIGIT_9 = 0x39       -- '9'
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section -1: Bootstrap (path-setup at module load)
 -- ════════════════════════════════════════════════════════════════════════════
 --
--- When duffle.lua is first loaded (via `dofile` from an entry script or via `require` from a passes script), 
--- the code below sruns and sets `package.path` + `package.cpath` so subsequent `require`s resolve.
--- Idempotent: re-loads just re-set the same paths.
+-- Path setup is done by `scripts/duffle_paths.lua`, which derives the repo root from `debug.getinfo(1, "S").source` (NO subprocess, ~0ms) and then calls `require("duffle")`.
+-- The prior `io.popen("git rev-parse ...")` approach in this section was removed during F'' because:
+--   1. Every entry script + every passes script now uses `dofile("duffle_paths.lua")` (14 call sites; verified via grep).
+--      The `find_repo_root` / `setup_package_path` defined here was dead code in practice.
+--   2. `git rev-parse` costs ~100-180ms per subprocess spawn on Windows.
+--      `debug.getinfo` is <1ms. There's no reason to keep the slow path even as a "fallback".
 --
--- **Entry scripts** trigger this with one line:
--- `local duffle = dofile(arg[0]:match("(.*[/\\])") .. "/../duffle.lua")` which runs this top-level + returns `M`.
---
--- **Passes scripts** are loaded via `require("passes.X")` from the entry script; by the time they run, 
--- the entry script has already triggered this bootstrap, so the paths are set.
-
---- Resolve the repo root via `git rev-parse --show-toplevel` (cached).
---- Returns a path with a trailing separator, or nil if not in a git repo.
---- @return string|nil
-local function find_repo_root()
-	-- Cached in `package.loaded` (process-global) so all 8 entry scripts + passes scripts share one git call.
-	-- Without this, git rev-parse runs once per script load.
-	if package.loaded.__duffle_repo_root__ then return package.loaded.__duffle_repo_root__ end
-	local p = io.popen("git rev-parse --show-toplevel 2>nul")
-	local root
-	if p then
-		root = p:read("*l")
-		p:close()
-	end
-	if not root or root == "" then return nil end
-	if not root:match("[/\\]$") then root = root .. "/" end
-	package.loaded.__duffle_repo_root__ = root
-	return root
-end
-
---- Set `package.path`  (for `require("duffle")` + `require("passes.X")`)
---- and `package.cpath` (for `lpeg.dll` on Windows).
-function M.setup_package_path()
-	local repo_root = find_repo_root()
-	if not repo_root then
-		io.stderr:write("[duffle] git rev-parse failed -- not in a git repo?\n")
-		os.exit(2)
-	end
-
-	-- From the repo root, derive both `scripts/` and `scripts/passes/` so `require("duffle")` AND `require("passes.annotation")` resolve.
-	local scripts_dir = repo_root .. "scripts/"
-	local passes_dir  = repo_root .. "scripts/passes/"
-	package.path = scripts_dir .. "?.lua;"
-		.. scripts_dir .. "?/init.lua;"
-		.. passes_dir .. "?.lua;"
-		.. passes_dir .. "?/init.lua;"
-		.. package.path
-
--- cpath: only needed on Windows for the bundled lpeg.dll. 
--- (LPeg is optional -- duffle.lua's `pcall(require, "lpeg")` falls back to hand-rolled scanners if the .dll isn't loadable.)
-	if package.config:sub(1, 1) == "\\" then
-		package.cpath = repo_root .. "toolchain/luajit-2.1/lib/lua/5.1/?.dll;"
-			.. package.cpath
-	end
-end
-
--- NOTE: `M.setup_package_path()` is NOT auto-called here. The entry scripts explicitly `dofile("duffle_paths.lua")` first, which calls `M.setup_package_path()`. 
--- The function exists for the helper to use (so the path-setup logic is centralized in duffle.lua).
+-- If a future use case ever needs to load `duffle.lua` WITHOUT going through `duffle_paths.lua`, set `package.path` manually before `require`.
+-- See `docs/guide_metaprogram_ssdl.md` §"I/O primitives" for the pattern.
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section 0: LPeg patterns (compiled once at module load)
@@ -175,7 +124,7 @@ local lpeg_block_cmt_pat = P("/*") * (P(1) - P("*/"))^0 * P("*/")
 local lpeg_str_or_cmt_pat = lpeg_str_pat + lpeg_chr_pat + lpeg_line_cmt_pat + lpeg_block_cmt_pat
 
 -- Whitespace + comment skipper: zero+ (whitespace run | string | comment).
-local ws_pat = S(" \t\n\r\v\f")
+local ws_pat              = S(" \t\n\r\v\f")
 local lpeg_ws_and_cmt_pat = (ws_pat + lpeg_str_or_cmt_pat)^0
 
 -- Generic "skip until target, but step over balanced groups" matcher.
@@ -187,12 +136,8 @@ local lpeg_scan_to_target_pat = function(target) return (P(1) - P(target))^0  en
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section 1: character classification (byte-based for hot loops)
 -- ════════════════════════════════════════════════════════════════════════════
---
--- Two APIs:
---   is_space(c), is_alpha(c), etc. — accept a single-char STRING (legacy)
---   is_space_byte(b), is_alpha_byte(b), etc. — accept a single-byte INTEGER
---
--- The byte-based versions are 5-10x faster in tight loops because they avoid the string allocation per s:sub(pos, pos) call.
+-- Byte-based versions (accept a single-byte INTEGER).
+-- Used in all hot loops because they avoid the string allocation per s:sub(pos, pos) call.
 
 -- Whitespace characters per C locale.
 function M.is_space_byte(b) return b == BYTE_SPACE or b == BYTE_TAB or b == BYTE_NEWLINE or b == BYTE_CR or b == BYTE_VT  or b == BYTE_FF end
@@ -211,8 +156,8 @@ function M.is_digit_byte(b) return b and b >= BYTE_DIGIT_0 and b <= BYTE_DIGIT_9
 -- Letter OR digit OR underscore.
 function M.is_alnum_byte(b) return M.is_alpha_byte(b) or M.is_digit_byte(b) end
 
--- String-based wrappers (kept for callers that already have a single-char
--- string; the byte versions are what the hot loops should call).
+-- String-based wrappers (kept for callers that already have a single-char string;
+-- the byte versions are what the hot loops should call).
 function M.is_space(c)
 	if type(c) == "number" then return M.is_space_byte(c) end
 	return c == " "  or c == "\t" or c == "\n" or c == "\r" or c == "\v" or c == "\f"
@@ -242,7 +187,6 @@ function M.trim(s)
 end
 
 -- Linear-search for a single-byte target in a string.
--- (Phase 3 retained this for places where LPeg is overkill.)
 -- @param haystack string
 -- @param target integer  -- byte value
 -- @param start integer   -- optional 1-indexed start (default 1)
@@ -284,6 +228,9 @@ end
 -- Section 3: I/O primitives
 -- ════════════════════════════════════════════════════════════════════════════
 
+-- File contents intentionally use io.open below. LuaFileSystem handles path
+-- metadata, directory iteration, the current directory, and mkdir; it does not
+-- expose file-content read/write streams.
 function M.read_file(path)
 	local  f = io.open(path, "r")
 	if not f then error("Cannot open " .. path) end
@@ -297,44 +244,104 @@ function M.write_file(path, content)
 	f:write(content); f:close()
 end
 
+-- Write content to disk in binary mode so LF line endings are preserved on Windows
+-- (text mode would convert LF -> CRLF, breaking byte-identical diffs against git-tracked gen/*.h files which are stored as LF).
+-- @param path string
+-- @param content string
+function M.write_file_lf(path, content)
+	local  f = io.open(path, "wb")
+	if not f then error("Cannot write " .. path) end
+	f:write(content); f:close()
+end
+
+-- Return `{path, ...}` for files in `out_root` whose basename matches `pattern` (Lua pattern, NOT regex — `%.` not `\.`).
+-- Empty list if `out_root` doesn't exist or matches nothing.
+-- @param out_root Path
+-- @param pattern string  -- Lua pattern matched against basename only
+-- @return string[]
+function M.list_dir(out_root, pattern)
+	local files = {}
+	if lfs.attributes(out_root, "mode") ~= "directory" then return files end
+	for entry in lfs.dir(out_root) do
+		if entry:match(pattern) then
+			files[#files + 1] = out_root .. "\\" .. entry
+		end
+	end
+	return files
+end
+
+-- Convert a (possibly relative) path to an absolute path, using CWD if needed.
+-- Normalizes forward slashes to backslashes on Windows.
+-- Used for byte-identical emit: the // Source: comment line uses the absolute path.
+--
+-- The CWD is memoized on first call.
+-- @param path string
+-- @return string
+local _absolute_path_cache = {}
+
+function M.to_absolute_path(path)
+	if _absolute_path_cache[path] then return _absolute_path_cache[path] end
+	if #path >= 2 and path:sub(2, 2) == ":" then
+		-- Already absolute; normalize slashes for consistency.
+		local result = (path:gsub("/", "\\"))
+		_absolute_path_cache[path] = result
+		return result
+	end
+	local  cwd = lfs.currentdir()
+	if not cwd then _absolute_path_cache[path] = path; return path end
+	cwd = cwd:gsub("/", "\\")
+	local tail   = (path:gsub("/", "\\"))
+	local result = cwd .. "\\" .. tail
+	_absolute_path_cache[path] = result
+	return result
+end
+
 -- Cache of directories already verified to exist in this process.
--- Each ensure_dir() call may otherwise spawn a `cmd.exe mkdir` (50-100ms per call on Windows) — calling it inside per-source loops added 1.5+
--- seconds to the report pass. Cache makes ensure_dir idempotent within the process lifetime.
--- (safe across passes; the dir state doesn't change).
 local _ensured_dirs = {}
 
 function M.ensure_dir(path)
 	if _ensured_dirs[path] then return end
 	_ensured_dirs[path] = true
-	local is_win = package.config:sub(1, 1) == "\\"
-	os.execute(is_win and ('if not exist "' .. path .. '" mkdir "' .. path .. '"') or ('mkdir -p "' .. path .. '" 2>/dev/null'))
+	-- lfs.attributes + lfs.mkdir: ~0ms when dir exists, ~2ms when creating. No shell spawn.
+	-- Falls through silently if lfs.mkdir fails (e.g. permission denied); the subsequent write_file will surface the error.
+	if lfs.attributes(path, "mode") ~= "directory" then lfs.mkdir(path) end
 end
 
 -- Test helper: clear the cache (used by tests + between process runs).
 -- Not normally needed since Lua state is per-process.
 function M._reset_ensured_dirs() _ensured_dirs = {} end
 
+-- Group a list of `SourceFile`-shaped records by their `dir` field.
+-- Used by the annotation / static-analysis / report passes to partition sources into per-DIRECTORY (per-module) buckets
+-- before emitting per-module reports. Insertion order preserved within each bucket (matches source order in `ctx.sources`).
+-- @param sources table[]          -- list of source records (each having a `dir` string field)
+-- @return table<string, table[]>  -- map of `dir` -> sources in that dir
+function M.group_sources_by_dir(sources)
+	local by_dir = {}
+	for _, src in ipairs(sources) do
+		by_dir[src.dir] = by_dir[src.dir] or {}
+		table.insert(by_dir[src.dir], src)
+	end
+	return by_dir
+end
+
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section 4: C-language scanner primitives
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Skip a string or C-style comment starting at position `pos`.
--- Returns the position just past the construct, or `pos` unchanged if no string/comment starts there. LPeg-backed.
-function M.skip_str_or_cmt(s, pos)
-	return lpeg.match(lpeg_str_or_cmt_pat, s, pos) or pos
-end
+-- Returns the position just past the construct, or `pos` unchanged if no string/comment starts there.
+function M.skip_str_or_cmt(s, pos) return lpeg.match(lpeg_str_or_cmt_pat, s, pos) or pos end
 
 -- Skip whitespace AND C-style comments starting at position `pos`.
 -- LPeg-backed; ~5-10x faster than a hand-rolled byte-by-byte walker.
-function M.skip_ws_and_cmt(s, pos)
-	return lpeg.match(lpeg_ws_and_cmt_pat, s, pos) or pos
-end
+function M.skip_ws_and_cmt(s, pos) return lpeg.match(lpeg_ws_and_cmt_pat, s, pos) or pos end
 
 -- Read a C-style identifier (alpha followed by zero+ alnum) starting at position `pos`. 
--- Returns the identifier string + the position just past it, or nil + pos if no identifier starts here. LPeg-backed.
+-- Returns the identifier string + the position just past it, or nil + pos if no identifier starts here.
 function M.read_ident(s, pos)
 	local result = lpeg.match(lpeg_ident_pat, s, pos)
-	if result then return result, pos + #result end
+	if    result then return result, pos + #result end
 	return nil, pos
 end
 
@@ -344,7 +351,9 @@ end
 function M.read_balanced(s, open_char, close_char, pos)
 	local open_byte = open_char:byte()
 	if s:byte(pos) ~= open_byte then return nil, pos end
+	-- scan: <open_char>
 	pos = pos + 1
+	-- scan: <open_char> <inner...>
 	local len   = #s
 	local depth = 1
 	local a     = pos
@@ -353,15 +362,23 @@ function M.read_balanced(s, open_char, close_char, pos)
 		if c == open_byte then
 			depth = depth + 1
 			pos = pos + 1
+			-- scan: <open_char> <inner...> <open_char> (depth=depth)
 		elseif c == close_char:byte() then
 			depth = depth - 1
 			if depth == 0 then break end
 			pos = pos + 1
+			-- scan: <open_char> <inner...> <close_char> (depth=depth)
 		else
 			local nx = M.skip_str_or_cmt(s, pos)
-			if nx > pos then pos = nx else pos = pos + 1 end
+			if nx > pos then
+				-- scan: <open_char> <inner...> <str|cmt>
+				pos = nx
+			else
+				pos = pos + 1
+			end
 		end
 	end
+	-- scan: <open_char> <inner> <close_char>
 	return s:sub(a, pos - 1), pos + 1
 end
 
@@ -377,25 +394,38 @@ function M.scan_to_char(s, target, start)
 	local target_byte = target:byte()
 	local pos = start
 	while pos <= #s do
-		local c = s:byte(pos)
-		if      c == target_byte then return pos end
-		if      c == BYTE_OPEN_PAREN  then local _, a = M.read_balanced(s, "(", ")", pos); pos = a
-		elseif  c == BYTE_OPEN_BRACE  then local _, a = M.read_balanced(s, "{", "}", pos); pos = a
-		elseif  c == BYTE_OPEN_BRACK  then local _, a = M.read_balanced(s, "[", "]", pos); pos = a
+		local   c = s:byte(pos)
+		if      c == target_byte      then return pos end                                          -- scan: ... <target found> | <skipping to target>
+		if      c == BYTE_OPEN_PAREN  then local _, a = M.read_balanced(s, "(", ")", pos); pos = a -- scan: ... ( <balanced> ) ...
+		elseif  c == BYTE_OPEN_BRACE  then local _, a = M.read_balanced(s, "{", "}", pos); pos = a -- scan: ... { <balanced> } ...
+		elseif  c == BYTE_OPEN_BRACK  then local _, a = M.read_balanced(s, "[", "]", pos); pos = a -- scan: ... [ <balanced> ] ...
 		else
 			local nx = M.skip_str_or_cmt(s, pos)
 			pos      = (nx > pos) and nx or (pos + 1)
+			-- scan: ... <str|cmt skipped> ...
 		end
 	end
 	return nil
 end
 
--- Split a brace-body into top-level comma-separated tokens. Honors nested
--- parens/braces/brackets and skips strings/comments.
+-- If `s[pos]` is `#`, skip to the end of the preprocessor directive line (past the newline).
+-- Returns the position past the newline, or nil if `s[pos]` is not `#`.
+-- scan: #<directive>\n -> past the newline
+function M.skip_preprocessor_line(s, pos)
+	if s:byte(pos) ~= 35 then return nil end  -- '#'
+	local scan = pos
+	local len = #s
+	while scan <= len and s:byte(scan) ~= BYTE_NEWLINE do
+		scan = scan + 1
+	end
+	return scan + 1
+end
+
+-- Split a brace-body into top-level comma-separated tokens. Honors nested parens/braces/brackets and skips strings/comments.
 --
 -- FIX (2026-07-09): split at top-level NEWLINES and SEMICOLONS too, AND emit a token break after a top-level comment/string. 
 -- Previous behavior glued the macro call after a comment into the same token, so `word_count_of_token` only saw the 
--- leading ident (often nil after stripping the comment), undercounting the body. See Phase 1 of the branch-offset regression  investigation. 
+-- leading ident (often nil after stripping the comment), undercounting the body.
 -- Pure-comment / pure-string chunks (which now appear between real statements) are filtered out so they contribute 0 words instead of 1.
 function M.split_top_level_commas(body)
 	local tokens      = {}
@@ -447,28 +477,29 @@ function M.split_top_level_commas(body)
 	end
 
 	while pos <= body_len do
-		local c = body:byte(pos)
-		if c == BYTE_OPEN_PAREN then              -- '('
-			local _, a = M.read_parens(body, pos); pos = a
-		elseif c == BYTE_OPEN_BRACE then          -- '{'
-			local _, a = M.read_braces(body, pos); pos = a
-		elseif c == BYTE_OPEN_BRACK then          -- '['
-			local _, a = M.read_brackets(body, pos); pos = a
-		elseif c == BYTE_COMMA then               -- ','
+		local  c = body:byte(pos)
+		if     c == BYTE_OPEN_PAREN then local _, a = M.read_parens(body, pos);   pos = a -- scan: ... ( <balanced> ...
+		elseif c == BYTE_OPEN_BRACE then local _, a = M.read_braces(body, pos);   pos = a -- scan: ... { <balanced> ...
+		elseif c == BYTE_OPEN_BRACK then local _, a = M.read_brackets(body, pos); pos = a -- scan: ... ( <balanced> ...
+		elseif c == BYTE_COMMA then
+			-- scan: ... <token> , <next> ...
 			emit(pos - 1)
 			pos         = pos + 1
 			token_start = pos
-		elseif c == BYTE_SEMI then                -- ';'
+		elseif c == BYTE_SEMI then
+			-- scan: ... <token> ; <next> ...
 			emit(pos - 1)
 			pos         = pos + 1
 			token_start = pos
-		elseif c == BYTE_NEWLINE then             -- '\n'
+		elseif c == BYTE_NEWLINE then
+			-- scan: ... <token> \n <next> ...
 			emit(pos - 1)
 			pos         = pos + 1
 			token_start = pos
 		else
 			local nx = M.skip_str_or_cmt(body, pos)
 			if nx > pos then
+				-- scan: ... <str|cmt> ...
 				-- Skipped a comment or string at top level: emit token break.
 				pos = nx
 				emit(pos - 1)
@@ -477,24 +508,154 @@ function M.split_top_level_commas(body)
 			end
 		end
 	end
+	-- scan: <token> , <token> , ... <token>
 	emit(body_len)
 	return tokens
 end
 
+-- ════════════════════════════════════════════════════════════════════════════
+-- Section 4: tokenize_body + build_body_line_index (shared, memoized)
+-- ════════════════════════════════════════════════════════════════════════════
+
+local _tokenize_body_cache   = {}
+local _body_line_index_cache = {}
+
+--- Tokenize the body inner-text into a flat list of `{tok, rel}` pairs.
+--- `tok` is the trimmed token string; `rel` is the byte offset within `body`.
+--- Memoized on the body string — first call pays O(body_len), subsequent calls return cached.
+--- @param body string
+--- @return table[]  -- {{tok=string, rel=integer}, ...}
+function M.tokenize_body(body)
+	if _tokenize_body_cache[body] ~= nil then return _tokenize_body_cache[body] end
+	local out = {}
+	local len = #body
+	local rel = 1
+	while rel <= len do
+		local ws_end = M.skip_ws_and_cmt(body, rel)
+		if ws_end > rel then rel = ws_end end
+		if rel    > len then break end
+
+		local scan = rel
+		while scan <= len do
+			local c = body:byte(scan)
+			-- Terminator bytes (delimit a token at the top level): ',' = 0x2C, '\n' = 0x0A, ';' = 0x3B.
+			-- These also appear as separators between argument lists inside the parens/braces/brackets, 
+			-- so we stop the scan when we hit any of them.
+			if     c == BYTE_COMMA   then break end
+			if     c == BYTE_NEWLINE then break end
+			if     c == BYTE_SEMI    then break end
+			-- Group opener bytes (consume the balanced group via the matching reader): '(' = 0x28, '{' = 0x7B, '[' = 0x5B.
+			if     c == BYTE_OPEN_PAREN then local _, a = M.read_parens   (body, scan); scan = a
+			elseif c == BYTE_OPEN_BRACE then local _, a = M.read_braces   (body, scan); scan = a
+			elseif c == BYTE_OPEN_BRACK then local _, a = M.read_brackets (body, scan); scan = a
+			-- String-literal byte ('"' = 0x22 or '\'' = 0x27): skip past the quoted region in one shot.
+			elseif c == BYTE_DQUOTE or c == BYTE_SQUOTE then
+				scan = M.skip_str_or_cmt(body, scan) + 1
+			else
+				scan = scan + 1
+			end
+		end
+		local tok = M.trim(body:sub(rel, scan - 1))
+		if tok ~= "" then out[#out + 1] = { tok = tok, rel = rel } end
+		if scan <= len then
+			scan = scan + 1
+			local w = M.skip_ws_and_cmt(body, scan)
+			if w > scan then scan = w end
+		end
+		rel = scan
+	end
+	_tokenize_body_cache[body] = out
+	return out
+end
+
+--- Build a line-index: count `\n` chars from offset 1 up to the offset; that count + 1 is the line number (1-based).
+--- Memoized on the body string.
+--- @param body string
+--- @return table  -- index[pos] = line_number
+function M.build_body_line_index(body)
+	if _body_line_index_cache[body] ~= nil then return _body_line_index_cache[body] end
+	local index = {}
+	local len   = #body
+	local newline_count = 0
+	for pos = 1, len do
+		if pos > 1 then
+			index[pos] = newline_count + 1
+		end
+		-- Newline byte = 0x0A (BYTE_NEWLINE). Counts line boundaries so the
+		-- index maps each source-byte offset → its 1-based line number.
+		if body:byte(pos) == BYTE_NEWLINE then
+			newline_count = newline_count + 1
+		end
+	end
+	index[len + 1] = newline_count + 1
+	_body_line_index_cache[body] = index
+	return index
+end
+
+--- Find the end of a marker call (`atom_label(...)` or `atom_offset(...)`).
+--- Returns the position past the closing `)`, or nil if the token isn't a marker call.
+--- @param tok string
+--- @return integer|nil
+function M.find_marker_call_end(tok)
+	local  ident, after = M.read_ident(tok, 1)
+	if not ident then return nil end
+	if ident ~= "atom_label" and ident ~= "atom_offset" then return nil end
+	local paren_pos = M.skip_ws_and_cmt(tok, after)
+	if tok:sub(paren_pos, paren_pos) ~= "(" then return nil end
+	local _, close = M.read_parens(tok, paren_pos)
+	return close
+end
+
+--- True iff `tok` is an atom-label or atom-offset marker call.
+--- Sibling helper to M.find_marker_call_end; uses the same string constants.
+--- @param tok string
+--- @return boolean
+function M.is_marker_token(tok)
+	local  leading = M.read_ident(tok, 1)
+	return leading == "atom_label" or leading == "atom_offset"
+end
+
+--- Count words contributed by the non-marker portion of `tok` (after the marker's closing `)`).
+--- Returns 0 if `tok` isn't a marker call or has no trailing content.
+---
+--- `count_token_words_fn` is injected by the caller rather than imported here because the
+--- dependency arrow already points the other way: `passes/offsets.lua` and
+--- `passes/atoms_source_map.lua` both `require("word_count_eval")` and pass its
+--- `count_token_words` as the 3rd argument to this function, while `word_count_eval`
+--- itself loads `duffle` via `duffle_paths.lua` (see `passes/word_count_eval.lua` near
+--- the top of the file) and calls `duffle.trim` / `duffle.read_ident` /
+--- `duffle.skip_ws_and_cmt` from `M.count_token_words`. Importing `word_count_eval`
+--- from this module would reverse that direction and form a recursive require cycle.
+--- The callback keeps the marker-syntax helpers (`find_marker_call_end`,
+--- `is_marker_token`, this function) shared in `duffle` without making the foundational
+--- utility depend on a pass module.
+--- @param tok string
+--- @param word_counts table
+--- @param count_token_words_fn fun(tok: string, wc: table): integer
+--- @return integer
+function M.count_marker_rest(tok, word_counts, count_token_words_fn)
+	local marker_end = M.find_marker_call_end(tok)
+	if not marker_end or marker_end >= #tok then return 0 end
+	local rest = M.trim(tok:sub(marker_end))
+	if rest == "" then return 0 end
+	return count_token_words_fn(rest, word_counts)
+end
+
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section 5: load_word_counts
 -- ════════════════════════════════════════════════════════════════════════════
 
 function M.load_word_counts(metadata_path)
-	local counts      = {}
-	local content     = M.read_file(metadata_path)
-	local len         = #content
-	local pos         = 1
-	local prefix      = "WORD_COUNT("
+	local counts  = {}
+	local content = M.read_file(metadata_path)
+	local len     = #content
+	local pos     = 1
+	local prefix  = "WORD_COUNT("
 	while pos <= len do
 		local nl       = M.find_byte(content, BYTE_NEWLINE, pos)
 		local line_end = nl or (len + 1)
 		local line     = content:sub(pos, line_end - 1)
+		-- scan: WORD_COUNT(<name>, <N>)
 		local trimmed  = M.trim(line)
 		if trimmed:sub(1, #prefix) == prefix and trimmed:sub(-1) == ")" then
 			local inner = trimmed:sub(#prefix + 1, #trimmed - 1)
@@ -509,9 +670,9 @@ function M.load_word_counts(metadata_path)
 	return counts
 end
 
--- ════════════════════════════════════════════════════════════════════════════
+-- ══════════════════════════════════════════════════
 -- Section 6: LineIndex (perf fix — replaces the per-call rescan line_of)
--- ════════════════════════════════════════════════════════════════════════════
+-- ══════════════════════════════════════════════════
 
 function M.LineIndex(source)
 	local positions = {}
@@ -522,90 +683,83 @@ function M.LineIndex(source)
 			positions[n] = pos
 		end
 	end
-	-- (internal) Binary-search for the line number containing `query_pos`.
+	-- (internal) Binary-search for the line number containing query_pos.
 	local function line_of(query_pos)
 		local lo,   hi = 1, n
 		while lo <= hi do
 			local mid = math.floor((lo + hi) / 2)
-			if positions[mid] <= query_pos then
-				lo = mid + 1
-			else
-				hi = mid - 1
-			end
+			if positions[mid] <= query_pos then lo = mid + 1
+			else                                hi = mid - 1 end
 		end
 		return hi + 1
 	end
 	return line_of
 end
 
--- ════════════════════════════════════════════════════════════════════════════
 -- Section 7: domain tables
 -- ════════════════════════════════════════════════════════════════════════════
 
-M.WAVE_CONTEXT_REGS = {
-	["R_PrimCursor"] = { alias = "R_T7", size = 4, role = "output cursor (prim arena)" },
-	["R_FaceCursor"] = { alias = "R_T4", size = 4, role = "input cursor (face array)" },
-	["R_VertBase"]   = { alias = "R_T5", size = 4, role = "base pointer (vertex array)" },
-	["R_OtBase"]     = { alias = "R_T6", size = 4, role = "base pointer (ordering table)" },
-}
-
 -- The annotation DSL has been reduced to a single annotation macro:
 --   atom_info(atom_bind(Binds_X), atom_reads(...), atom_writes(...))
--- All phase / region / cadence / async / resource / group tokens have
--- been dropped. They may be reintroduced later as optional sub-calls
--- of atom_info; for now, the parser only recognizes atom_info + its
--- three sub-calls (atom_bind, atom_reads, atom_writes).
+-- All phase / region / cadence / async / resource / group tokens have been dropped.
+-- They may be reintroduced later as optional sub-calls of atom_info; 
+-- for now, the parser only recognizes atom_info + its three sub-calls (atom_bind, atom_reads, atom_writes).
 M.TAPE_ATOM_MACROS = {
 	["atom_info"] = { kind = "info", binds = false },
 }
 
--- GTE pipeline-fill latency table (static-analysis Phase 1).
+-- GTE pipeline-fill latency table.
 --
--- For each `gte_cmdw_*` macro in code/duffle/gte.h, the minimum number of consecutive COP2 "nop" words that MUST appear 
--- before any other COP2 read or non-nop instruction (so the GTE pipeline latency is fully retired). 
--- Latencies are sourced from the doxygen comments in gte.h 
--- (e.g. `* @brief Rotate, Translate and Perspective Triple (23 cycles)` with body `Two nop words fill the COP2 pipeline latency`).
+-- For each `gte_cmdw_*` macro in code/duffle/gte.h, the minimum number of consecutive COP2 "nop" words that MUST appear
+-- before the command issues so that any preceding `lwc2`/`swc2`/C2 state writes have retired before the GTE starts reading its input registers.
 --
--- The check (`scripts/passes/static_analysis.lua :: check_gte_pipeline_fill`) walks each atom body, 
--- counts the consecutive nop words after every `gte_cmdw_*` invocation, and reports a finding if the count is below this minimum.  
--- Aliases are dereferenced before lookup (gté_cmdw_rtps_alias -> gte_cmdw_rtps -> 2).
--- 
--- Values verified against PSX-SPX gte.txt (rtpt 23cy / 8cy per divide => 2 nops; nclip 8cy => 2 nops; avsz3/avsz4 14cy => 2 nops; 
--- op single-cycle atomic => 0 nops; mvmva 8cy matrix-vector => 2 nops).
+-- The check (`scripts/passes/static_analysis.lua :: check_gte_pipeline_fill`) walks each atom body,
+-- counts the consecutive nop words before every `gte_cmdw_*` invocation, and reports a finding if the count is below this minimum.
+--
+-- PRE-FILL vs POST-FILL: this table models PRE-cmdw nops (retiring preceding C2 writes).
+-- The PSX-SPX pipeline timings doc (`docs/psx-spx/docs/gtepipelinetimings.md`) measures a DIFFERENT number:
+-- the smallest N nops between `cop2` and `mtc2` to a specific input register at which the write no longer affects the output.
+-- For nearly all instructions, inputs latch in the first 0-4 cycles — the GTE snapshots its input register file early and works
+--  from internal pipeline storage afterward. 
+-- The documented total cycle count is NOT the "do not touch inputs" window; the actual read window is much shorter.
+--
+-- The `gte_rtpt()` / `gte_nclip()` wrapper macros in gte.h emit the pre-cmd nops internally (asm_words(nop, nop, ...)),
+-- but THOSE WRAPPERS ARE NOT USED INSIDE ATOM BODIES in this codebase.
+-- Every MipsAtom_(name) body uses raw `nop2, gte_cmdw_<X>, ...` form instead — that `nop2,` is the pre-fill this check validates.
+-- So values here reflect the source-level convention, NOT the wrapper-internal pre-fill.
+--
+-- Cycle counts from PSX-SPX `docs/psx-spx/docs/geometrytransformationenginegte.md`:
+--   cmd      PSX-SPX cycles  min pre-nops  rationale
+--   rtps         15              2         8c per perspective divide + 6c for IR1..4 + mac write
+--   rtpt         23              2         3x rtps worth of pipeline depth (per-vertex pipeline fill)
+--   nclip         8              2         MAC0 write + 5c for sign computation
+--   avsz3         5              2         5c to compute average + write OTZ (all inputs latch at N=0)
+--   avsz4         6              2         avsz3 + 1c extra for 4th vertex
+--   mvmva         8              2         IR1..4 write + matrix work (8c regardless of mx/v/cv selection)
+--   op            6              0         cross product; output to IR1..3 only (atomic 6c calc, no pre-fill needed)
+--
+-- The pre-nop values (2 for most commands) are conservative: PSX-SPX pipeline timings show most inputs latch at N=0-1
+-- relative to a preceding mtc2, but 2 nops is the gte.h convention for retiring preceding lwc2/swc2 + C2 state.
+-- OP is set to 0 because it's a short atomic op with no input that needs a long retire window.
+--
+-- Aliases are listed separately because source code may use either the alias or the canonical name.
 M.GTE_PIPELINE_LATENCY = {
-	-- Minimum number of consecutive `nop` words that must appear IMMEDIATELY BEFORE a `gte_cmdw_<X>` invocation 
-	-- to retire any preceding `lwc2` / `swc2` / pre-existing C2 state writes before the GTE pipeline starts reading 
+	-- Minimum number of consecutive `nop` words that must appear IMMEDIATELY BEFORE a `gte_cmdw_<X>` invocation
+	-- to retire any preceding `lwc2` / `swc2` / pre-existing C2 state writes before the GTE pipeline starts reading
 	-- from V0/V1/V2 or MAC0..3 / OTZ / IR0..3 at the command's issue cycle.
 	--
-	-- Values are from the doxygen comments in code/duffle/gte.h and cross-checked against PSX-SPX `geometrytransformationenginegte.md`:
-	--   cmd      cycles  min pre-nops  rationale
-	--   rtps        14      2         8c per perspective divide + 6c for IR1..4 + mac write
-	--   rptt        22      2         3x rtps worth of pipeline depth
-	--   nclip        7      2         MAC0 write + 5c for sign
-	--   avsz3       14      2         14c to compute average + write OTZ
-	--   avsz4       16      2         avsz3 + 2c extra for avg over 4
-	--   mvmva        8      2         IR1..4 write + matrix work
-	--   op           5      0         output to MAC0 only (atomic 5c calc)
-	--
-	-- The `gte_rtpt()` / `gte_nclip()` / `gte_avsz3()` wrapper macros in gte.h emit the pre-cmd nops internally (asm_words(nop, nop, ...)), 
-	-- but THOSE WRAPPERS ARE NOT USED INSIDE ATOM BODIES in this codebase. 
-	-- Every MipsAtom_(name) body uses raw `nop2, gte_cmdw_<X>, ...` form instead -- that `nop2,` is the pre-fill this check validates. 
-	-- So values here must reflect the source-level convention, NOT the wrapper-internal pre-fill (which is invisible at the source level).
-	--
-	-- Existing clean-atom bodies (cube_g4_face, floor_f3_face, diag_gte) all emit `nop2,` before every `gte_cmdw_<X>` (which matches values >= 2).
-	-- The check passes them all.
-	--
-	-- Aliases are listed separately because source code may use either the alias or the canonical name.
-	-- The check looks up the EXACT macro text, so both forms must be in the table.
+	-- Values are from the doxygen comments in code/duffle/gte.h and cross-checked against
+	-- PSX-SPX `docs/psx-spx/docs/geometrytransformationenginegte.md` (cycle counts) and
+	-- `docs/psx-spx/docs/gtepipelinetimings.md` (input-latch boundaries).
 
 	-- Canonical macros (from code/duffle/gte.h)
-	["gte_cmdw_rtps"]   = 2,
-	["gte_cmdw_rtpt"]   = 2,
-	["gte_cmdw_nclip"]  = 2,
-	["gte_cmdw_op"]     = 0,
-	["gte_cmdw_mvmva"]  = 2,
-	["gte_cmdw_avsz3"]  = 2,
-	["gte_cmdw_avsz4"]  = 2,
+	["gte_cmdw_rtps"]   = 2,  -- RTPS: 15 cycles (PSX-SPX)
+	["gte_cmdw_rtpt"]   = 2,  -- RTPT: 23 cycles (PSX-SPX)
+	["gte_cmdw_nclip"]  = 2,  -- NCLIP: 8 cycles (PSX-SPX)
+	["gte_cmdw_op"]     = 0,  -- OP: 6 cycles, atomic (PSX-SPX)
+	["gte_cmdw_mvmva"]  = 2,  -- MVMVA: 8 cycles (PSX-SPX)
+	["gte_cmdw_avsz3"]  = 2,  -- AVSZ3: 5 cycles (PSX-SPX)
+	["gte_cmdw_avsz4"]  = 2,  -- AVSZ4: 6 cycles (PSX-SPX)
 
 	-- Aliases (must have the same value as their canonical target)
 	["gte_cmdw_rotate_translate_perspective_single"] = 2,
@@ -621,7 +775,18 @@ M.GTE_PIPELINE_LATENCY = {
 }
 
 -- GP0 packet sizes (total words including the 1-word tag) per GP0 cmd byte.
--- Verified against code/duffle/gp.h struct sizes + the set_poly_* macros
+-- Per PSX-SPX `docs/psx-spx/docs/graphicsprocessingunitgpu.md` §"GPU Render Polygon Commands":
+--   Each polygon command's word count = 1 (tag/cmd) + per-vertex (vertex + optional color + optional UV).
+--   F3:  cmd + 3 vertices = 4 words; +1 tag = 5
+--   F4:  cmd + 4 vertices = 5 words; +1 tag = 6
+--   G3:  cmd + 3×(color + vertex) = 6 words; +1 tag = 7
+--   G4:  cmd + 4×(color + vertex) = 8 words; +1 tag = 9
+--   FT3: cmd + tpage + clut + 3×(vertex + UV) = 7 words; +1 tag = 8
+--   FT4: cmd + tpage + clut + 4×(vertex + UV) = 9 words; +1 tag = 10
+--   GT3: cmd + tpage + clut + 3×(color + vertex + UV) = 9 words; +1 tag = 10
+--   GT4: cmd + tpage + clut + 4×(color + vertex + UV) = 12 words; +1 tag = 13
+--
+-- Cross-checked against code/duffle/gp.h struct sizes + the set_poly_* macros
 -- (which encode "len" = "words after tag"):
 --   set_poly_f3(p)   -> set_len(p, 4)   ->  5 total GP0 0x20
 --   set_poly_ft3(p)  -> set_len(p, 7)   ->  8 total GP0 0x24
@@ -666,28 +831,35 @@ M.GP0_MACRO_CONTRIB = {
 	["mac_insert_ot_tag_g4"]                        = 1,
 }
 
--- Per-macro cycle cost (best-case, no stalls). Used by the static-analysis `count_atom_cycles` pass (Phase 3) to emit per-atom cycle budgets. 
+-- Per-macro cycle cost (best-case, no stalls). Used by the static-analysis pass to emit per-atom cycle budgets.
 -- The counts cover the EXPANDED instruction sequence the macro emits (NOT just the token it appears as in source).
--- For example: 
+-- For example:
 --   mac_pack_color_word(off, cmd, r, g, b) emits:
 --     load_upper_i(R_AT, (cmd << 8) | b)        -- 1 cycle
 --     or_i_self(R_AT, (g << 8) | r)             -- 1 cycle
 --     store_word(R_AT, R_PrimCursor, off)       -- 1 cycle
 --                                              = 3 cycles total
 --
---   mac_yield emits a control-transfer sequence (load_word, add_ui_self, jump_reg, nop) 
---   which "yields control" the atom body's cycle budget doesn't include the yield's cost (we model it as 0; 
+--   mac_yield emits a control-transfer sequence (load_word, add_ui_self, jump_reg, nop)
+--   which "yields control" the atom body's cycle budget doesn't include the yield's cost (we model it as 0;
 --   runtime cost becomes part of the NEXT atom's prologue).
 --
 -- GTE command values are the GTE instruction's intrinsic cycles (the latency AFTER any pre-cmd `nop2` has retired).
 -- When the source emits `nop2, gte_cmdw_X` the nops' cycles are added separately (1+1) plus the gte_cmdw_X value here:
---   rtpt  = 21 + 2 nops = 23 total cycles  (matches PSX-SPX)
---   rtps  = 12 + 2 nops = 14 total
---   nclip =  6 + 2 nops = 8 total
---   avsz3 = 12 + 2 nops = 14 total
---   avsz4 = 14 + 2 nops = 16 total
---   mvmva =  6 + 2 nops = 8 total
---   op    =  5 (no pre-cmd nops required; single-cycle atomic)
+--   rtpt  = 23 + 2 nops = 25 total cycles  (PSX-SPX says 23 cycles for the cmd itself; the nops are pre-fill)
+--   rtps  = 15 + 2 nops = 17 total
+--   nclip =  8 + 2 nops = 10 total
+--   avsz3 =  5 + 2 nops =  7 total
+--   avsz4 =  6 + 2 nops =  8 total
+--   mvmva =  8 + 2 nops = 10 total
+--   op    =  6 (no pre-cmd nops required; atomic)
+--
+-- Note: the "total" above is the pre-fill nops + the GTE intrinsic cycles. PSX-SPX documents the GTE
+-- intrinsic cycles as the total execution time of the command itself (rtpt=23, rtps=15, nclip=8, etc.).
+-- The pre-fill nops are a codebase convention for retiring preceding C2 writes, not part of the GTE's
+-- own execution time. See `docs/psx-spx/docs/geometrytransformationenginegte.md` for the canonical
+-- per-command cycle counts and `docs/psx-spx/docs/gtepipelinetimings.md` for the hardware-verified
+-- input-latch boundaries (which show most inputs are safe to clobber after just 0-4 cycles).
 M.INSTRUCTION_LATENCY = {
 	-- CPU ALU (single-cycle R3000A ops)
 	["nop"]                 = 1,
@@ -750,31 +922,31 @@ M.INSTRUCTION_LATENCY = {
 	["gte_mv_from_ctrl_r"]  = 1,
 	["gte_lw"]              = 1,  ["gte_lwc2"]           = 1,
 	["gte_sw"]              = 1,  ["gte_swc2"]           = 1,
-	-- COP2 commands (intrinsic cycles, EXCLUDING the 2 pre-cmd nops that
-	-- the source typically emits as `nop2, gte_cmdw_X`; those nops are
-	-- counted separately via the `nop2` entry above)
-	["gte_cmdw_rtpt"]          = 21,
-	["gte_cmdw_rtps"]          = 12,
-	["gte_cmdw_nclip"]         = 6,
-	["gte_cmdw_avsz3"]         = 12,
-	["gte_cmdw_avsz4"]         = 14,
-	["gte_cmdw_mvmva"]         = 6,
-	["gte_cmdw_op"]            = 5,
-	["gte_cmdw_outer_product"] = 5,
-	["gte_cmdw_wedge"]         = 5,
+	-- COP2 commands (intrinsic cycles per PSX-SPX, EXCLUDING the 2 pre-cmd nops that
+	-- the source typically emits as `nop2, gte_cmdw_X`; those nops are counted
+	-- separately via the `nop2` entry above)
+	["gte_cmdw_rtpt"]          = 23,  -- RTPT: 23 cycles (PSX-SPX)
+	["gte_cmdw_rtps"]          = 15,  -- RTPS: 15 cycles (PSX-SPX)
+	["gte_cmdw_nclip"]         = 8,   -- NCLIP: 8 cycles (PSX-SPX)
+	["gte_cmdw_avsz3"]         = 5,   -- AVSZ3: 5 cycles (PSX-SPX)
+	["gte_cmdw_avsz4"]         = 6,   -- AVSZ4: 6 cycles (PSX-SPX)
+	["gte_cmdw_mvmva"]         = 8,   -- MVMVA: 8 cycles (PSX-SPX)
+	["gte_cmdw_op"]            = 6,   -- OP: 6 cycles (PSX-SPX)
+	["gte_cmdw_outer_product"] = 6,   -- alias for OP
+	["gte_cmdw_wedge"]         = 6,   -- alias for OP
 	-- Long-form aliases (same cost as canonical)
-	["gte_cmdw_rotate_translate_perspective_single"] = 12,  -- alias for rtps
-	["gte_cmdw_rotate_translate_perspective_triple"] = 21,  -- alias for rtpt
-	["gte_cmdw_avg_sort_z4"]                         = 14,  -- alias for avsz4
+	["gte_cmdw_rotate_translate_perspective_single"] = 15,  -- alias for rtps
+	["gte_cmdw_rotate_translate_perspective_triple"] = 23,  -- alias for rtpt
+	["gte_cmdw_avg_sort_z4"]                         = 6,   -- alias for avsz4
 	-- Non-cmdw aliases from gte.h (these are `#define gte_X gte_cmdw_Y`):
-	["gte_avg_sort_z3"]                              = 12,  -- alias for avsz3
-	["gte_avg_sort_z4"]                              = 14,  -- alias for avsz4
-	["gte_rtps"]                                     = 12,  -- alias for rtps
-	["gte_rtpt"]                                     = 21,  -- alias for rtpt
-	["gte_nclip"]                                    = 6,   -- alias for nclip
-	["gte_avsz3"]                                    = 12,
-	["gte_avsz4"]                                    = 14,
-	-- Legacy single-cycle store helpers (gte_stotz, gte_stsxy3 are 1 cycle)
+	["gte_avg_sort_z3"]                              = 5,   -- alias for avsz3
+	["gte_avg_sort_z4"]                              = 6,   -- alias for avsz4
+	["gte_rtps"]                                     = 15,  -- alias for rtps
+	["gte_rtpt"]                                     = 23,  -- alias for rtpt
+	["gte_nclip"]                                    = 8,   -- alias for nclip
+	["gte_avsz3"]                                    = 5,
+	["gte_avsz4"]                                    = 6,
+	-- Single-cycle store helpers (gte_stotz, gte_stsxy3 are 1 cycle)
 	["gte_stotz"]           = 1,
 	["gte_stsxy3"]          = 1,
 	-- High-level GTE helpers (gte_load_v0/v1/v2 do multiple lwc2s)
@@ -806,7 +978,7 @@ M.INSTRUCTION_LATENCY = {
 	["atom_writes"]         = 0,
 }
 
--- Default cycle cost for unknown macros. 
+-- Default cycle cost for unknown macros.
 -- The static-analysis pass adds 1 cycle per unknown token and emits a "new macro; update INSTRUCTION_LATENCY"
 -- advisory so the cycle budget stays accurate as the codebase grows.
 M.UNKNOWN_INSTRUCTION_CYCLES = 1

scripts/duffle_paths.lua

@@ -1,31 +1,51 @@
 --- duffle_paths.lua — Single-line bootstrap helper for the tape-atom Lua scripts.
 ---
---- Each entry script (ps1_meta.lua, word_count_eval.lua, and the 5 passes/*.lua files) starts with:
+--- Each entry script (ps1_meta.lua + the 7 passes/*.lua files) starts with one of:
 ---   ```lua
+---   -- Entry script (ps1_meta.lua — `arg[0]` is set):
 ---   local duffle = dofile((arg[0]:match("(.*[/\\])") or "./") .. "duffle_paths.lua")
+---
+---   -- Pass module (debug.getinfo path resolution; works both standalone and when require'd):
+---   local _bootstrap_dir = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
+---   local duffle = dofile(_bootstrap_dir .. "../duffle_paths.lua")
 ---   ```
---- That single line: (a) locates this helper via `arg[0]`, 
---- (b) loads it (which sets `package.path` + `package.cpath` via `git rev-parse`),
---- (c) returns the `M` table (a wrapper around the setup function). 
---- After this line, `require("duffle")` and `require("passes.X")` both resolve normally.
+---
+--- That small bootstrap: (a) locates this helper via `arg[0]` / `debug.getinfo`,
+--- (b) loads it (which sets `package.path` + `package.cpath` via cached `git rev-parse`),
+--- (c) at the bottom calls `require("duffle")` (now resolvable since `package.path` was just set) and returns the duffle M.
+--- Net effect: the caller gets the duffle module in one statement; no separate `dofile(...)` + `require("duffle")` dance.
+---
+--- Replaces the prior 2-line (entry) or 4-line (pass) pattern that had the call site do its own path resolution + duplicated setup.
 
 local M = {}
 
--- Cache key for the repo root. Stored in `package.loaded` (process-global) so all 8 entry scripts + passes scripts share one git call.
--- Without this cache, `git rev-parse --show-toplevel` runs once per script load.
+-- Cache key for the repo root. Stored in `package.loaded` (process-global) so all 8 entry scripts + passes scripts share one resolution.
 local CACHE_KEY = "__duffle_repo_root__"
 
---- Resolve the repo root via git (cached after first call).
---- Returns a normalized path with a trailing forward-slash, or nil if not in a git repo.
+--- Resolve the repo root from this script's own path. Zero shell spawn.
+--- `duffle_paths.lua` always lives at `<repo>/scripts/duffle_paths.lua`, so the repo root is the
+--- parent of the directory containing this script. We derive it directly from `debug.getinfo(1, "S").source`
+--- (returns `@<path>` for the currently-running chunk).
+---
+--- Replaces the prior `io.popen("git rev-parse --show-toplevel")` approach, which cost ~100-180ms per
+--- LuaJIT process on Windows due to git's CLI startup. The path-derive approach costs <1ms.
+---
+--- If `debug.getinfo` can't parse this script's path (shouldn't happen — dofile always populates source),
+--- return nil and let `M.setup()` fail loud.
 --- @return string|nil
 local function find_repo_root()
 	if package.loaded[CACHE_KEY] then return package.loaded[CACHE_KEY] end
-	local p = io.popen("git rev-parse --show-toplevel 2>nul")
-	local root
-	if p then root = p:read("*l"); p:close() end
-	if not root or root == "" then return nil end
-	-- Normalize to forward slashes (Windows accepts both, but mixed `\` + `/` confuses LuaJIT's file APIs).
+
+	local source = debug.getinfo(1, "S").source
+	-- Strip the leading `@` (Lua's dofile marker) and the trailing `/duffle_paths.lua` filename.
+	-- What remains is the directory containing this script, i.e. `<repo>/scripts/`.
+	local scripts_dir = source and source:match("^@?(.*)[/\\]duffle_paths%.lua$")
+	if not scripts_dir then return nil end
+
+	-- The repo root is the parent of `scripts/`. Strip the trailing `scripts/` (with or without trailing slash).
+	local root = scripts_dir:gsub("scripts[\\/]?$", "")
 	root = root:gsub("\\", "/")
+	if root == "" then root = "./" end
 	if not root:match("/$") then root = root .. "/" end
 	package.loaded[CACHE_KEY] = root
 	return root
@@ -54,13 +74,18 @@ function M.setup()
 		.. package.path
 
 	-- lpeg: built by `update_deps.ps1` to `toolchain/lpeg/lpeg.dll`.
-	-- Wire its directory into cpath so `require("lpeg")` resolves.
+	-- lfs: compiled from pcsx-redux's vendored luafilesystem source to `toolchain/lfs/lfs.dll`.
+	-- Wire both directories into cpath so `require("lpeg")` and `require("lfs")` resolve.
 	local lpeg_dir = repo_root .. "toolchain/lpeg/"
+	local lfs_dir  = repo_root .. "toolchain/lfs/"
 	package.cpath = lpeg_dir .. "?.dll;"
+		.. lfs_dir  .. "?.dll;"
 		.. package.cpath
 end
 
 -- Run the setup as a side effect.
 M.setup()
 
-return M
+-- Now that package.path includes scripts/, `require("duffle")` resolves. Return the duffle module
+-- so callers can do `local duffle = dofile(...duffle_paths.lua)` in one line.
+return require("duffle")

scripts/elf_dwarf.lua

@@ -0,0 +1,925 @@
+--- elf_dwarf.lua — ELF32 + DWARF + atoms source-map utilities.
+--- All ELF32 + DWARF-specific code lives here.
+---
+--- **What this module contains:**
+---   - **Format-constant tables** (the byte-offset / opcode / size encyclopedias for ELF32, DWARF4 aranges, DWARF5 rnglists, DWARF line-program, MIPS).
+---     Every constant carries a spec:` comment naming the spec section that defines it.
+---   - **I/O helpers**: little-endian byte read/write, ELF32 section walker, nm symbol reader, source-map parser, native directory glob.
+---
+--- **Conventions:** tabs (1/level), EmmyLua annotations, no regex,
+--- Lua 5.3 compatible.
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Native dependencies
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- lfs is wired into package.cpath by `duffle_paths.lua` (vendored under `toolchain/lfs/lfs.dll`). 
+local lfs = require("lfs")
+
+local M = {}
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- DWARF tag + form constants
+-- ════════════════════════════════════════════
+-- (DWARF5 §7.5.5 "Tag Encodings" + Table 7.1; gcc emits these exact values for the DWARF3-extension and DWARF5 line units.)
+
+M.DW_TAG = {
+	compile_unit       = 0x11,
+	subprogram         = 0x2E,
+	variable           = 0x34,
+	structure_type     = 0x13,
+	member             = 0x0D,
+	base_type          = 0x24,
+	typedef            = 0x2A,
+	pointer_type       = 0x0F,
+	const_type         = 0x26,
+	volatile_type      = 0x27,
+	inlined_subroutine = 0x1D,
+	-- We index the canonical gcc-emitted tags. Anything else falls through.
+}
+
+M.DW_AT = {
+	name                  = 0x03,
+	low_pc                = 0x11,
+	high_pc               = 0x12,
+	language              = 0x13,
+	location              = 0x02,
+	comp_dir              = 0x1B,
+	byte_size             = 0x0B,
+	encoding              = 0x3E,
+	data_member_location  = 0x38,
+	type                  = 0x49,
+	linkage_name          = 0x6E,
+	external              = 0x3F,
+	abstract_origin       = 0x31,
+	call_file             = 0x58,
+	call_line             = 0x59,
+	inline                = 0x20,
+	decl_file             = 0x3A,
+	decl_line             = 0x3B,
+}
+
+M.DW_FORM = {
+	addr        = 0x01,
+	data1       = 0x0B,
+	data2       = 0x05,
+	data4       = 0x06,
+	string      = 0x08,
+	strp        = 0x0E,
+	exprloc     = 0x18,
+	ref4        = 0x13,
+	udata       = 0x0F,
+	ref_sig8    = 0x20,
+	implicit_const = 0x21,
+	flag_present = 0x19,
+	sec_offset  = 0x17,
+}
+
+M.DW_ATE = {
+	address       = 0x01,
+	boolean       = 0x02,
+	complex_float = 0x03,
+	float         = 0x04,
+	signed        = 0x05,
+	signed_char   = 0x06,
+	unsigned      = 0x07,
+	unsigned_char = 0x08,
+}
+
+-- DWARF5 §7.5.6 DW_FORM_implicit_const
+local DW_FORM_implicit_const = 0x21
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Format-constant tables
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- ----------------------------------------------------------------------------
+-- MIPS sizes
+-- ----------------------------------------------------------------------------
+
+--- spec: MIPS o32 ABI §"Register Usage" — 32-bit general-purpose registers
+M.MIPS_BYTES_PER_WORD = 0x04
+
+
+-- ----------------------------------------------------------------------------
+-- ELF32 (System V ABI gABI v1.2)
+-- ----------------------------------------------------------------------------
+--- **Wire-offset contract:** format offsets, fixed-width reader offsets, LEB/parser cursors,
+--- and section-relative values are zero-based wire offsets. Only Lua string APIs receive
+--- a `+ 1` conversion at their boundary (`byte`, `sub`, and `find`).
+---
+--- ELF/DWARF field offsets are expressed in hex so they map directly to the
+--- zero-based byte positions in the binary file.
+
+
+--- spec: System V ABI gABI v1.2 §"ELF Header" (Table 1) + §"Section Header Table"
+M.ELF32 = {
+	magic_offset          = 0x00,         -- 4-byte magic "\127ELF" at file offset 0x00
+	magic                 = "\127ELF",
+	class_offset          = 0x04,         -- 1-byte; 1 = ELF32, 2 = ELF64
+	class_elf32           = 1,
+	endian_offset         = 0x05,         -- 1-byte; 1 = little-endian, 2 = big-endian
+	endian_little         = 1,
+	header_bytes          = 0x34,         -- spec: gABI v1.2 §"ELF Header" — ELF32 header is 52 bytes total
+	e_shoff_offset        = 0x20,         -- 4-byte LE; section-header table file offset
+	e_shentsize_offset    = 0x2E,         -- 2-byte LE; section-header entry size in bytes
+	e_shnum_offset        = 0x30,         -- 2-byte LE; number of section headers
+	e_shstrndx_offset     = 0x32,         -- 2-byte LE; index of section-name string table
+	sh_size_bytes         = 0x28,         -- spec: gABI v1.2 §"Section Header Table" — each entry is 40 bytes
+	sh_name_offset        = 0x00,         -- 4-byte LE; offset into .shstrtab
+	sh_type_offset        = 0x04,         -- 4-byte LE; section type (SHT_*)
+	sh_offset_offset      = 0x10,         -- 4-byte LE; section's file offset
+	sh_size_offset        = 0x14,         -- 4-byte LE; section's size in bytes
+	dw_dwarf32_terminator = 0xFFFFFFFF,   -- spec: DWARF4 spec §7.4 — 32-bit DWARF initial-length terminator
+}
+
+-- ----------------------------------------------------------------------------
+-- DWARF4 .debug_aranges (per DWARF5 spec §7.4 — Address Range Table)
+-- ----------------------------------------------------------------------------
+-- All offsets are zero-based wire offsets.
+
+--- spec: DWARF5 spec §7.4 (Address Range Table) — 32-bit DWARF form
+M.DWARF4_ARANGES = {
+	unit_length_offset = 0x00,    -- 4-byte LE; length of unit body (excludes these 4 bytes)
+	version_offset     = 0x04,    -- 2-byte LE; expected = 2
+	cu_offset_offset   = 0x06,    -- 4-byte LE; CU DIE offset in .debug_info
+	addr_size_offset   = 0x0A,    -- 1-byte;  expected = 4 (32-bit MIPS)
+	seg_size_offset    = 0x0B,    -- 1-byte;  expected = 0
+	entry_size         = 0x08,    -- 4-byte addr + 4-byte length (per §7.4)
+	terminator_size    = 0x08,    -- 8 zero bytes (per §7.4 end-of-list marker)
+	version_expected   = 2,
+	addr_size_expected = 4,
+	seg_size_expected  = 0,
+}
+
+-- ----------------------------------------------------------------------------
+-- DWARF5 .debug_rnglists (per DWARF5 spec §2.17 + §7.21)
+-- ----------------------------------------------------------------------------
+-- All offsets are zero-based wire offsets.
+
+--- spec: DWARF5 spec §2.17 + §7.21 (Range List Table) — 32-bit DWARF form
+M.DWARF5_RNGLISTS = {
+	unit_length_offset    = 0x00,    -- 4-byte LE
+	version_offset        = 0x04,    -- 2-byte LE; expected = 5
+	addr_size_offset      = 0x06,    -- 1-byte;  expected = 4
+	seg_size_offset       = 0x07,    -- 1-byte;  expected = 0
+	offset_count_offset   = 0x08,    -- 4-byte LE; expected = 0
+	first_entry_offset    = 0x0C,
+	end_of_list           = 0x00,    -- spec: DWARF5 §7.7 — DW_RLE_end_of_list byte value
+	start_length          = 0x07,    -- spec: DWARF5 §7.7 — DW_RLE_start_length byte value
+	version_expected      = 5,
+	addr_size_expected    = 4,
+	seg_size_expected     = 0,
+	offset_count_expected = 0,
+}
+
+-- ----------------------------------------------------------------------------
+-- DWARF line-program opcodes (per DWARF5 spec §6.2.5)
+-- ----------------------------------------------------------------------------
+-- Opcode VALUES stay in decimal — they're identifiers (DW_LNS_copy = 1), not binary positions.
+-- Compare to the *_offset fields above which are hex.
+
+--- spec: DWARF5 spec §6.2.5 (Line Number Program Opcodes)
+M.DWARF_LINE_OPS = {
+	-- Standard opcodes (§6.2.5.2)
+	DW_LNS_extended     = 0,    -- spec: §6.2.5.2 — extended opcode marker byte
+	DW_LNS_copy         = 1,
+	DW_LNS_advance_pc   = 2,
+	DW_LNS_advance_line = 3,
+	DW_LNS_set_file     = 4,
+	DW_LNS_negate_stmt  = 6,    -- spec: §6.2.5.2 — toggle the line-state is_stmt register
+	-- Extended sub-opcodes (§6.2.5.3)
+	DW_LNE_end_sequence = 1,    -- spec: §6.2.5.3
+	DW_LNE_set_address  = 2,    -- spec: §6.2.5.3
+	-- Standard opcode header (§6.2.5.1)
+	-- opcode_base + line_range are 1-byte header fields; hex so they map
+	-- directly to their position in the line-program header byte sequence.
+	-- line_base stays signed decimal (=-5) since 0xFB obscures the spec semantics.
+	opcode_base              = 0x0D,
+	line_base                = -5,
+	line_range               = 0x0E,
+	-- Extended opcode payload sizes (include the sub-opcode byte; §6.2.5.3)
+	-- Hex so they match the byte positions in the line-program wire format.
+	end_sequence_payload_size = 0x01,   -- size = sub_opcode only
+	set_address_payload_size  = 0x05,   -- size = sub_opcode(1) + addr(4)
+}
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- I/O helpers: little-endian byte read/write
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- Read a 4-byte little-endian unsigned integer from `buf` at zero-based wire offset `off`.
+--- Equivalent to `string.unpack("<I4", buf, off + 1)` but avoids the table-return shape + works under LuaJIT 2.1
+--- (which has partial `string.unpack` coverage).
+---
+--- **Convention:** `off` is a zero-based wire offset; `+ 1` is applied only at the `string.byte` boundary.
+---
+--- **Byte weights** are written as `0x100`, `0x10000`, `0x1000000` (i.e. 2^8, 2^16, 2^24) so the LE byte positions are visually explicit:
+--- byte 0 contributes its value directly; byte 1 is shifted left by 8
+--- (= 0x100); byte 2 by 16 (= 0x10000); byte 3 by 24 (= 0x1000000).
+--- @param buf string
+--- @param off integer  -- zero-based wire offset
+--- @return integer
+function M.read_u32_le(buf, off)
+	local byte_off = off + 1
+	return buf:byte(byte_off)
+		+ buf:byte(byte_off + 0x01) * 0x00000100
+		+ buf:byte(byte_off + 0x02) * 0x00010000
+		+ buf:byte(byte_off + 0x03) * 0x01000000
+end
+
+--- Read a 2-byte little-endian unsigned integer from `buf` at zero-based wire offset `off`.
+--- (`off` is zero-based; `+ 1` is applied only at the `string.byte` boundary.)
+--- @param buf string
+--- @param off integer  -- zero-based wire offset
+--- @return integer
+function M.read_u16_le(buf, off)
+	local byte_off = off + 1
+	return buf:byte(byte_off) + buf:byte(byte_off + 0x01) * 0x00000100
+end
+
+-- Pure-Lua 5.3 LEB128 readers (no `bit` library). `2^shift` arithmetic matches the existing parser.
+-- Offsets are 0-based; returns (value, next_pos).
+-- Track A Task 10: promoted from `local function` to M.* exports so passes/dwarf_injection.lua
+-- can import them as file-scope locals per the 2nd-caller lift precedent
+-- (the uleb128 + sleb128 encoders were promoted the same way).
+function M.read_uleb128_at(buf, pos)
+	local value, shift = 0, 0
+	local len = #buf
+	while pos < len do
+		local b = buf:byte(pos + 1)
+		value = value + (b % 0x80) * (2 ^ shift)
+		shift = shift + 7
+		pos   = pos + 1
+		if b < 0x80 then return value, pos end
+	end
+	return nil, pos
+end
+
+function M.read_sleb128_at(buf, pos)
+	local value, shift = 0, 0
+	local len = #buf
+	while pos < len do
+		local b = buf:byte(pos + 1)
+		value = value + (b % 0x80) * (2 ^ shift)
+		shift = shift + 7
+		pos   = pos + 1
+		if b < 0x80 then
+			if b >= 0x40 then value = value - (2 ^ shift) end
+			return value, pos
+		end
+	end
+	return nil, pos
+end
+
+-- Find the 0-based offset of the table-terminator byte (a single 0) for the abbrev table starting at `table_start`.
+-- Returns nil on truncated input. Walks declaration headers
+-- (code, tag, has_children, attr/form pairs, DW_FORM_implicit_const constant) until it finds a 0 byte that follows a complete declaration.
+function M.find_abbrev_table_end(table_bytes, table_start)
+	local pos, len = table_start, #table_bytes
+	if    pos >= len or table_bytes:byte(pos + 1) == 0 then return pos end
+	while pos < len do
+		local  _code, code_end = M.read_uleb128_at(table_bytes, pos)
+		if not _code then return nil end
+		pos = code_end
+		local  _tag, tag_end = M.read_uleb128_at(table_bytes, pos)
+		if not _tag then return nil end
+		pos = tag_end
+		if pos >= len then return nil end
+		pos = pos + 1   -- has_children byte
+		while pos < len do
+			local  attr, attr_end = M.read_uleb128_at(table_bytes, pos)
+			if not attr then return nil end
+			pos = attr_end
+			local  form, form_end = M.read_uleb128_at(table_bytes, pos)
+			if not form then return nil end
+			pos = form_end
+			if attr == 0 and form == 0 then break end
+			if form == DW_FORM_implicit_const then
+				local _c, ce = M.read_sleb128_at(table_bytes, pos)
+				if not _c then return nil end
+				pos = ce
+			end
+		end
+		if pos >= len then return nil end
+		if table_bytes:byte(pos + 1) == 0 then return pos end
+	end
+	return nil
+end
+
+-- Read the null-terminated C string at 0-based offset `off` in `buf`.
+-- Stops at the first 0 byte or end of buffer.
+local function read_c_string_at(buf, off)
+	local len = #buf
+	local start = off
+	while off < len and buf:byte(off + 1) ~= 0 do off = off + 1 end
+	return buf:sub(start + 1, off)
+end
+
+-- Walk the .debug_abbrev table starting at 0-based offset `table_start` and return a list of declarations:
+-- {code, tag, has_children, attrs={ {name, form}, ... }}.
+-- Stops at the table terminator.
+local function parse_abbrev_table(table_bytes, table_start)
+	local table_end = M.find_abbrev_table_end(table_bytes, table_start)
+	if not table_end then return nil, "no terminator" end
+	local decls = {}
+	local pos = table_start
+	while pos < table_end do
+		local  code, code_end = M.read_uleb128_at(table_bytes, pos)
+		if not code then return nil, "truncated code" end
+		pos = code_end
+		local  tag, tag_end = M.read_uleb128_at(table_bytes, pos)
+		if not tag then return nil, "truncated tag" end
+		pos = tag_end
+		local has_children = table_bytes:byte(pos + 1)
+		pos = pos + 1
+		local attrs = {}
+		while true do
+			local  attr, attr_end = M.read_uleb128_at(table_bytes, pos)
+			if not attr then return nil, "truncated attr" end
+			pos = attr_end
+			local form, form_end = M.read_uleb128_at(table_bytes, pos)
+			if not form then return nil, "truncated form" end
+			pos = form_end
+			if attr == 0 and form == 0 then break end
+			attrs[#attrs + 1] = { name = attr, form = form }
+			if form == DW_FORM_implicit_const then
+				local  _c, ce = M.read_sleb128_at(table_bytes, pos)
+				if not _c then return nil, "truncated const" end
+				pos = ce
+			end
+		end
+		decls[#decls + 1] = { code = code, tag = tag, has_children = has_children, attrs = attrs }
+	end
+	return decls
+end
+
+-- Read a ULEB attribute value at 0-based offset `pos` for the given `form`.
+-- Returns (value, next_pos). For DW_FORM_string we return the inline string.
+-- For DW_FORM_strp we return the inline string resolved from `str_buf`.
+-- For DW_FORM_ref4 we return the absolute CU-relative offset.
+-- The caller decides whether to interpret that as a section offset.
+local function read_form_value(buf, str_buf, pos, form)
+	if form == M.DW_FORM.addr then
+		return M.read_u32_le(buf, pos), pos + 4
+	elseif form == M.DW_FORM.string then
+		local s = read_c_string_at(buf, pos)
+		return s, pos + #s + 1
+	elseif form == M.DW_FORM.strp then
+		-- DW_FORM_strp: 4-byte offset into .debug_str.
+		local strp_off = M.read_u32_le(buf, pos)
+		return read_c_string_at(str_buf, strp_off), pos + 4
+	elseif form == M.DW_FORM.udata then return M.read_uleb128_at(buf, pos)
+	elseif form == M.DW_FORM.data1 then return buf:byte(pos + 1), pos + 1
+	elseif form == M.DW_FORM.data2 then return M.read_u16_le(buf, pos), pos + 2
+	elseif form == M.DW_FORM.data4 then return M.read_u32_le(buf, pos), pos + 4
+	elseif form == M.DW_FORM.ref4  then return M.read_u32_le(buf, pos), pos + 4
+	elseif form == M.DW_FORM.sec_offset then
+		-- DW_FORM_sec_offset: 4-byte offset (size depends on DWARF version;
+		-- on DWARF5 32-bit it's always 4 bytes).
+		return M.read_u32_le(buf, pos), pos + 4
+	elseif form == M.DW_FORM.flag_present then
+		return 1, pos
+	elseif form == M.DW_FORM.exprloc then
+		-- DW_FORM_exprloc: ULEB byte count + that many bytes of DW_OP_*.
+		local  len, ne = M.read_uleb128_at(buf, pos)
+		if not len then return nil, pos end
+		return nil, ne + len
+	elseif form == DW_FORM_implicit_const then
+		-- The constant is declared in the abbrev; no value bytes in the DIE.
+		return nil, pos
+	elseif form == M.DW_FORM.ref_sig8 then
+		-- DW_FORM_ref_sig8 (DWARF5 §7.4.2): an 8-byte value identifying a type
+		-- by signature. The low 4 bytes (LE) are the type signature (content hash);
+		-- the high 4 bytes (LE) are a CU-relative offset into the matching type unit.
+		-- Consumers use the low 4 to look up the type unit (see M.find_type_unit_by_signature)
+		-- then the high 4 to resolve the specific type within it.
+		-- Return the low 4 as the primary value to preserve the (value, next_pos) shape;
+		-- the high 4 is exposed via M.read_ref_sig8 (which returns both halves).
+		local _, _, next_pos = M.read_ref_sig8(buf, pos)
+		return M.read_u32_le(buf, pos), next_pos
+	else
+		return nil, pos
+	end
+end
+
+--- Read a `DW_FORM_ref_sig8` value at 0-based offset `pos` from `buf`.
+--- Returns the low 4 bytes (LE) as `low`, the high 4 bytes (LE) as `high`, and
+--- the cursor position after the 8-byte value as `next_pos`.
+--- Callers that need the full type-unit + type-offset pair
+--- (e.g. to resolve a type identifier embedded as a signature)
+--- should use this directly rather than going through `read_form_value`,
+--- which only exposes the low 4 bytes to preserve its existing (value, next_pos) return shape.
+--- @param buf string
+--- @param pos integer  -- zero-based wire offset
+--- @return integer  -- low 4 bytes (LE), the type signature
+--- @return integer  -- high 4 bytes (LE), the offset within the matching type unit
+--- @return integer  -- cursor after the 8-byte value
+function M.read_ref_sig8(buf, pos)
+	return M.read_u32_le(buf, pos), M.read_u32_le(buf, pos + 4), pos + 8
+end
+
+-- DWARF5 §7.5.6 (Type Entries).
+-- Walk all units in `info` and return the 0-based offset of the first unit
+-- whose `DW_AT_type_signature` (8-byte value at the end of the unit header) equals `target_sig`.
+-- The signature is interpreted as two 32-bit halves (low/high) per the read_ref_sig8 contract;
+-- we match both halves (i.e. the 8-byte value as a whole). Returns nil if no matching unit exists.
+--
+-- Unit header layout (from pos 0):
+--   unit_length(4) + version(2) + unit_type(1) + address_size(1) + debug_abbrev_offset(4)
+--   -- followed by type_unit_specific fields:
+--   type_signature(8) + type_offset(4)
+-- The type_signature is at byte offset 8 of the body (right after debug_abbrev_offset).
+-- @param info string  -- the .debug_info section bytes
+-- @param target_sig_lo integer  -- low 4 bytes (LE) of the desired signature
+-- @param target_sig_hi integer  -- high 4 bytes (LE) of the desired signature
+-- @return integer|nil, integer|nil  -- unit offset, type_offset within the unit
+function M.find_type_unit_by_signature(info, target_sig_lo, target_sig_hi)
+	local pos = 0
+	local section_len = #info
+	while pos + 4 < section_len do
+		local unit_length = M.read_u32_le(info, pos)
+		if unit_length == 0xFFFFFFFF then
+			return nil, nil  -- DWARF64 not supported
+		end
+		-- unit_length is the body size, NOT including the 4-byte unit_length field itself.
+		local body_start = pos + 4
+		local body_end   = body_start + unit_length
+		if body_end > section_len then
+			return nil, nil  -- malformed
+		end
+		-- Per DWARF5 §7.5.6, the type_unit (DW_UT_type = 0x02) body layout is:
+		--   0:  version (2)
+		--   2:  unit_type (1) -- DW_UT_type = 0x02
+		--   3:  address_size (1)
+		--   4:  debug_abbrev_offset (4)
+		--   8:  type_signature (8)
+		--   16: type_offset (4)
+		--   20: <children>
+		if body_end - body_start >= 20 then
+			-- read_ref_sig8 / write_u32_le / etc. are 1-indexed (string:byte);
+			-- pos / body_start / body_end are 0-based wire offsets, so the
+			-- 1-indexed byte at 0-based wire offset X is string:byte(X + 1).
+			-- Per DWARF5 §7.5.6, the type_unit body is laid out as:
+			--   byte 0-1: version (2)
+			--   byte 2:   unit_type (1) -- DW_UT_type = 0x02
+			--   byte 3:   address_size (1)
+			--   byte 4-7: debug_abbrev_offset (4)
+			--   byte 8-15: type_signature (8)
+			--   byte 16-19: type_offset (4)
+			local unit_type = info:byte(body_start + 2 + 1)  -- 0-based +2 = unit_type in 1-indexed
+			if unit_type == 0x02 then  -- DW_UT_type
+				local sig_lo, sig_hi, _ = M.read_ref_sig8(info, body_start + 8)  -- 0-based +8 = type_signature in 1-indexed
+				if sig_lo == target_sig_lo and sig_hi == target_sig_hi then
+					local type_offset = M.read_u32_le(info, body_start + 16)  -- 0-based +16 = type_offset in 1-indexed
+					return pos, type_offset
+				end
+			end
+		end
+		-- Advance to the next unit (the 4-byte unit_length + the body).
+		pos = body_end
+	end
+	return nil, nil
+end
+
+--- Return a 4-byte little-endian byte string for `value`.
+--- Caller concatenates with `..` if composing multi-word blobs.
+--- **Byte weights** written as `0x100` etc. (see `M.read_u32_le` for rationale).
+--- @param value integer  -- 0 ≤ value ≤ 0xFFFFFFFF
+--- @return string
+function M.write_u32_le(value)
+	return string.char(
+		value                          % 0x00000100,
+		math.floor(value / 0x00000100) % 0x00000100,
+		math.floor(value / 0x00010000) % 0x00000100,
+		math.floor(value / 0x01000000) % 0x00000100)
+end
+
+--- Return a 2-byte little-endian byte string for `value`.
+--- @param value integer  -- 0 ≤ value ≤ 0xFFFF
+--- @return string
+function M.write_u16_le(value)
+	return string.char(value % 0x00000100, math.floor(value / 0x00000100) % 0x00000100)
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- I/O helpers: ELF32 / DWARF / symbols
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- Read the named sections from a post-link ELF32 by walking the ELF32 section-header table directly
+--- (no subprocess; lfs only for the existence check). Returns `{[name] = bytes_or_empty_string, ...}`.
+---
+--- **Convention:** ELF/DWARF offsets are zero-based wire offsets. Direct Lua string APIs add `+ 1` at the boundary.
+--- Every requested name has an entry in the returned dict;
+--- missing sections have an empty string (NOT nil) so callers can do `sections[".debug_x"] or ""` for the missing case.
+---
+--- **Cost:** one file open + one `f:seek` + one `f:read` per section header 
+--- (we walk all `e_shnum` headers regardless of how many names are requested, to find the .shstrtab first).
+--- For frequent callers, pass the union of all needed sections in one call.
+--  Can add `.debug_info` + `.debug_loc` + `.debug_str_offsets` to the list without writing a 2nd ELF walker.
+--- @param elf_path Path
+--- @param section_names string[]  -- list of section names to read
+--- @return table<string, string>
+function M.read_elf_sections(elf_path, section_names)
+	-- Initialize result with all requested names set to "" so callers can do `sections[X] 
+	-- or ""` for missing sections without nil-checks.
+	local result = {}
+	for _, name in ipairs(section_names) do result[name] = "" end
+
+	-- O(1) lookup set.
+	local wanted = {}
+	for _, name in ipairs(section_names) do wanted[name] = true end
+
+	-- Existence check (lfs.attributes avoids an io.open-vs-fail race).
+	if lfs.attributes(elf_path, "mode") ~= "file" then
+		io.stderr:write(string.format("[elf_dwarf.read_elf_sections] ELF not found: %s\n", elf_path))
+		return result
+	end
+
+	local f = io.open(elf_path, "rb")
+	if not f then
+		io.stderr:write(string.format("[elf_dwarf.read_elf_sections] io.open failed: %s\n", elf_path))
+		return result
+	end
+
+	-- Read the ELF32 header.
+	local header = f:read(M.ELF32.header_bytes)
+	if not header or #header < M.ELF32.header_bytes then
+		io.stderr:write("[elf_dwarf.read_elf_sections] ELF too small for ELF32 header\n")
+		f:close()
+		return result
+	end
+
+	-- Sanity-check magic + class + endianness.
+	if header:sub(M.ELF32.magic_offset + 1, M.ELF32.magic_offset + 0x04) ~= M.ELF32.magic then
+		io.stderr:write("[elf_dwarf.read_elf_sections] not an ELF file\n")
+		f:close()
+		return result
+	end
+	if header:byte(M.ELF32.class_offset + 1) ~= M.ELF32.class_elf32 then
+		io.stderr:write(string.format("[elf_dwarf.read_elf_sections] not ELF32 (class=%d)\n", header:byte(M.ELF32.class_offset + 1)))
+		f:close()
+		return result
+	end
+	if header:byte(M.ELF32.endian_offset + 1) ~= M.ELF32.endian_little then
+		io.stderr:write("[elf_dwarf.read_elf_sections] not little-endian; unsupported\n")
+		f:close()
+		return result
+	end
+
+	-- Parse section-header table location + dimensions from the header.
+	local e_shoff     = M.read_u32_le(header, M.ELF32.e_shoff_offset)
+	local e_shentsize = M.read_u16_le(header, M.ELF32.e_shentsize_offset)
+	local e_shnum     = M.read_u16_le(header, M.ELF32.e_shnum_offset)
+	local e_shstrndx  = M.read_u16_le(header, M.ELF32.e_shstrndx_offset)
+
+	-- Read the section-header string table (.shstrtab) so we can resolve section names from their `sh_name` offsets.
+	f:seek("set", e_shoff + e_shstrndx * e_shentsize)
+	local strtab_hdr = f:read(e_shentsize)
+	if not strtab_hdr or #strtab_hdr < e_shentsize then
+		io.stderr:write("[elf_dwarf.read_elf_sections] could not read .shstrtab header\n")
+		f:close()
+		return result
+	end
+	local strtab_offset = M.read_u32_le(strtab_hdr, M.ELF32.sh_offset_offset)
+	local strtab_size   = M.read_u32_le(strtab_hdr, M.ELF32.sh_size_offset)
+	f:seek("set", strtab_offset)
+	local strtab = f:read(strtab_size) or ""
+
+	-- Walk all section headers; collect (offset, size) for the wanted names.
+	local function read_section_bytes(sh_offset, sh_size)
+		f:seek("set", sh_offset)
+		return f:read(sh_size) or ""
+	end
+
+	for sh_idx = 0, e_shnum - 1 do
+		f:seek("set", e_shoff + sh_idx * e_shentsize)
+		local sh = f:read(e_shentsize)
+		if not sh or #sh < e_shentsize then break end
+		local sh_name   = M.read_u32_le(sh, M.ELF32.sh_name_offset)
+		local sh_offset = M.read_u32_le(sh, M.ELF32.sh_offset_offset)
+		local sh_size   = M.read_u32_le(sh, M.ELF32.sh_size_offset)
+
+		-- Extract the name (null-terminated C string in strtab).
+		local name_end = strtab:find("\0", sh_name + 1, true) or (sh_name + 1)
+		local name     = strtab:sub(sh_name + 1, name_end - 1)
+		if wanted[name] then
+			result[name] = read_section_bytes(sh_offset, sh_size)
+		end
+	end
+
+	f:close()
+	return result
+end
+
+--- Read ELF symbol addresses by walking the `.symtab` + `.strtab` sections directly (no `nm` subprocess). 
+--- Returns a map `{name -> {addr, size_bytes}}` for every `code_<name>` symbol.
+---
+--- **Conventions:**
+--- - ELF32 symtab entry = 16 bytes (`st_name:4 + st_value:4 + st_size:4 + st_info:1 + st_other:1 + st_shndx:2`); offsets within each entry are zero-based wire offsets.
+--- - Direct Lua `string.byte`/`string.sub`/`string.find` boundaries receive `+ 1`.
+--- - We filter on STB_GLOBAL (high nibble of st_info = 1) to match `nm`'s default (external symbols only). STB_WEAK excluded.
+--- - We strip the `code_` prefix to match the previous `read_nm` output. 
+--- - `st_size > 0` filter excludes undefined/imported symbols.
+--- @param elf_path Path
+--- @return table<string, {integer, integer}>
+function M.read_nm(elf_path)
+	local addrs = {}
+
+	-- Read .symtab + .strtab via the existing ELF walker (no subprocess).
+	local sections = M.read_elf_sections(elf_path, {".symtab", ".strtab"})
+	local symtab   = sections[".symtab"]
+	local strtab   = sections[".strtab"]
+	if not symtab or not strtab or #symtab == 0 or #strtab == 0 then
+		-- No symbol table (e.g. stripped ELF). Return empty.
+		return addrs
+	end
+
+	-- Iterate the 16-byte ELF32 symtab entries.
+	-- Each entry (zero-based): st_name at 0, st_value at 4, st_size at 8, st_info at 12, st_other at 13, st_shndx at 14.
+	local SYM_ENTRY_BYTES = 0x10
+	local SYM_ST_NAME     = 0x00
+	local SYM_ST_VALUE    = 0x04
+	local SYM_ST_SIZE     = 0x08
+	local SYM_ST_INFO     = 0x0C
+	local n_syms = #symtab / SYM_ENTRY_BYTES
+	for i = 0, n_syms - 1 do
+		local entry_off  = i * SYM_ENTRY_BYTES
+		local st_info    = symtab:byte(entry_off + SYM_ST_INFO + 1)
+		-- High nibble = binding (STB_LOCAL=0, STB_GLOBAL=1, STB_WEAK=2).
+		-- Use math.floor(/16) instead of bit.rshift for LuaJIT 2.1 compat
+		-- (LuaJIT's `>>` is 5.3+, but math.floor(x/16) works on all versions).
+		local binding    = math.floor(st_info / 16)
+		if binding == 0 or binding == 1 then            -- STB_LOCAL or STB_GLOBAL
+			local st_size   = M.read_u32_le(symtab, entry_off + SYM_ST_SIZE)
+			if st_size > 0 then
+				local st_name_off = M.read_u32_le(symtab, entry_off + SYM_ST_NAME)
+				-- Extract the name from .strtab (null-terminated C string).
+				local name_end = strtab:find("\0", st_name_off + 1, true) or (st_name_off + 1)
+				local name     = strtab:sub(st_name_off + 1, name_end - 1)
+				-- Filter: keep all symbol-table symbols (atoms emit their name as the bare `<name>` since the `code_` prefix was removed from the MipsAtom_ macro).
+				-- The atoms_source_map pass already filters out non-atom symbols via the source-map.txt cross-ref.
+				if name and #name > 0 then
+					local st_value = M.read_u32_le(symtab, entry_off + SYM_ST_VALUE)
+					addrs[name] = { st_value, st_size }
+				end
+			end
+		end
+	end
+
+	return addrs
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- LEB128 encoders (Unsigned + Signed Little-Endian Base 128)
+-- ════════════════════════════════════════════════════════════════════════════
+--
+-- DWARF uses LEB128 to encode variable-length integers in its wire format (line-program opcodes, DW_AT values, etc.).
+-- Both encoders pack 7 bits of data per byte + 1 bit of "more bytes follow" signaling.
+--
+-- Per-byte layout:
+--     bit:   7 6 5 4 3 2 1 0
+--           │ └───── 7-bit data ─────┘
+--           └─ continuation flag (LEB_CONT_BIT = 0x80)
+--
+-- For SLEB128 (signed), bit 6 of the 7-bit data is the sign bit that the
+-- decoder uses for sign extension:
+--     bit 6 = 0 → value is positive (or zero); zero-extend on decode
+--     bit 6 = 1 → value is negative;            one-extend on decode
+--
+-- The signed encoder must emit the MINIMUM number of bytes whose final 7-bit payload already has the correct sign bit set 
+-- (otherwise the decoder would round-trip to a different value).
+--
+-- Spec: DWARF5 §7.6 "Variable-Length Data" / Appendix C.
+
+-- Top bit of each LEB128 byte. Set if more bytes follow in the encoding.
+local LEB_CONT_BIT = 0x80
+
+-- Low 7 bits of each LEB128 byte. The actual data payload.
+local LEB_DATA_MASK = 0x7F
+
+-- Bit 6 of the 7-bit data (i.e. 0x40). For SLEB128: the sign-bit position used by the decoder for sign extension.
+-- Encoders MUST stop when the next byte would be redundant AND the sign bit in the last byte matches the value's sign.
+local SLEB_SIGN_BIT = 0x40
+
+--- ULEB128 (Unsigned Little-Endian Base 128) encoder. Returns the byte string for the non-negative integer `n`.
+--- Algorithm:
+---   - Extract the low 7 bits of `n` (LEB_DATA_MASK = 0x7F).
+---   - Shift `n` right by 7 bits.
+---   - If more bytes remain, OR in the continuation flag (LEB_CONT_BIT).
+---   - Repeat until `n` is fully consumed.
+--- @param n integer  -- non-negative
+--- @return string
+function M.uleb128(n)
+	if n == nil or type(n) ~= "number" then
+		io.stderr:write("[elf_dwarf.uleb128] got " .. type(n) .. ": " .. tostring(n) .. "\n")
+		io.stderr:write(debug.traceback() .. "\n")
+		error("uleb128 requires non-negative number")
+	end
+	assert(n >= 0, "uleb128 requires non-negative input")
+	local bytes = {}
+	repeat
+		local b = n % (LEB_DATA_MASK + 1)      -- extract low 7 bits
+		n = (n - b) / (LEB_DATA_MASK + 1)      -- shift right by 7 bits
+		if n > 0 then b = b + LEB_CONT_BIT end -- set continuation bit if more bytes follow
+		bytes[#bytes + 1] = string.char(b)
+	until n == 0
+	return table.concat(bytes)
+end
+
+--- SLEB128 (Signed Little-Endian Base 128) encoder. Returns the byte string for the integer `n` (may be negative).
+--- Algorithm differs from ULEB128 by the termination condition: 
+--- stop when the remaining bits can be inferred from the sign bit in the last byte's 7-bit data payload.
+---   - If `n == 0`  (no more value bits)   AND bit 6 of the data = 0 → positive terminator (sign bit says "zero-extend").
+---   - If `n == -1` (sign-extended all-1s) AND bit 6 of the data = 1 → negative terminator (sign bit says "one-extend").
+---
+--- Without these checks, the decoder would round-trip to a different value
+--- (e.g. encoding `0` as `0x80 0x00` decodes to `0` correctly but is 2 bytes long; the termination check picks the 1-byte `0x00` form).
+--- @param n integer  -- any integer (negative allowed)
+--- @return string
+function M.sleb128(n)
+	local bytes = {}
+	local more = true
+	while more do
+		local b = n % (LEB_DATA_MASK + 1) -- extract low 7 bits
+		n = (n - b) / (LEB_DATA_MASK + 1) -- arithmetic shift right by 7
+		-- Termination: remaining value bits fit in the sign bit of the last byte.
+		if     n == 0  and b <  SLEB_SIGN_BIT then more = false end  -- positive terminator
+		if     n == -1 and b >= SLEB_SIGN_BIT then more = false end  -- negative terminator
+		if more then b = b + LEB_CONT_BIT end
+		bytes[#bytes + 1] = string.char(b)
+	end
+	return table.concat(bytes)
+end
+
+--- ULEB128 byte-length: number of bytes the encoder M.uleb128 would produce for `n`.
+--- Used by callers that need to size a buffer before encoding (e.g. compute_loclists_offsets
+--- needs the encoded length of an `uleb128(4)` for a `DW_OP_piece + uleb128(U4_BYTE_SIZE)` tail).
+--- @param n integer  -- non-negative
+--- @return integer  -- 1..5 for n in [0, 2^32)
+function M.uleb128_size(n)
+	assert(n >= 0, "uleb128_size requires non-negative input")
+	if n == 0 then return 1 end
+	local bytes = 1
+	while n >= 0x80 do
+		n = (n - (n % (LEB_DATA_MASK + 1))) / (LEB_DATA_MASK + 1)  -- arithmetic shift right by 7
+		bytes = bytes + 1
+	end
+	return bytes
+end
+
+--- SLEB128 byte-length: number of bytes the encoder M.sleb128 would produce for `n`.
+--- Used by callers that need to size a buffer before encoding.
+--- (e.g. compute_loclists_offsets needs the encoded length of an `sleb128(field.offset)` in a tape piece).
+--- Handles the signed DWARF5 termination: positive terminator if (n == 0) and bit 6 of last byte is unset;
+--- negative terminator if (n == -1) and bit 6 of last byte is set.
+--- @param n integer  -- any integer (negative allowed)
+--- @return integer
+function M.sleb128_size(n)
+	local more = true
+	local bytes = 0
+	local v = n
+	while more do
+		local b = v % (LEB_DATA_MASK + 1) -- extract low 7 bits
+		v = (v - b) / (LEB_DATA_MASK + 1) -- arithmetic shift right by 7
+		if     v == 0  and b <  SLEB_SIGN_BIT then more = false end  -- positive terminator
+		if     v == -1 and b >= SLEB_SIGN_BIT then more = false end  -- negative terminator
+		if more then b = b + LEB_CONT_BIT end
+		bytes = bytes + 1
+	end
+	return bytes
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- I/O helpers: atoms source-map + native directory glob
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- Parse a FORMAT_VERSION <expected_version> atoms-meta file (sourcemap or provenance).
+--- Shared by M.parse_source_map_file + M.parse_provenance_file.
+--- The two callers differ only in how they parse WORD lines; that's `extract_word(line)`.
+--- Returns the standard `{name -> {total, words}}` shape.
+--- Returns `{}` on format-version mismatch (and logs to stderr).
+--- @param path             string
+--- @param expected_version integer
+--- @param extract_word     fun(line: string): table|nil  -- caller-supplied per-line parser
+--- @return table<string, table>
+function M.parse_atom_records(path, expected_version, extract_word)
+	local out = {}
+	local cur_name, cur_words = nil, {}
+	for raw in io.lines(path) do
+		local line = raw
+		if line:match("^#") then
+			local ver = line:match("^# FORMAT_VERSION%s+(%d+)")
+			if ver and tonumber(ver) ~= expected_version then
+				io.stderr:write(string.format(
+					"[elf_dwarf.parse_atom_records] version mismatch (got %s, expected %d) in %s\n",
+					ver, expected_version, path))
+				return {}
+			end
+			-- skip other comments
+		elseif line:sub(1, 4) == "ATOM" then
+			-- ATOM <name> "<abs-source-path>" <total>
+			local _, _, name = line:find("ATOM%s+(%S+)%s+\"[^\"]*\"%s+(%d+)")
+			if name then
+				cur_name  = name
+				cur_words = {}
+				out[name] = { total = 0, words = cur_words }
+			end
+		elseif line == "ENDATOM" then
+			-- Update the recorded total from the entries count
+			-- (matches the `lines[1] = lines[1]:gsub(" 0$", " " .. total)` patch in atoms_source_map.lua:170).
+			if cur_name and out[cur_name] then
+				out[cur_name].total = #cur_words
+			end
+			cur_name, cur_words = nil, {}
+		elseif line:sub(1, 4) == "WORD" and cur_name then
+			local field = extract_word(line)
+			if field then
+				cur_words[#cur_words + 1] = field
+			end
+		end
+	end
+	return out
+end
+
+--- Parse a FORMAT_VERSION <expected_version> `*.atoms.sourcemap.txt` file.
+--- Returns `{name -> {total = N, words = {{pos, line}, ...}}}`.
+--- Returns `{}` on format-version mismatch (and logs to stderr).
+---
+--- **Wire format** (emitted by `passes/atoms_source_map.lua`):
+--- ```
+--- # FORMAT_VERSION <n>
+--- ATOM <name> "<abs-source-path>" <total>
+--- WORD <n> LINE <line> TEXT <text...>
+--- ...
+--- ENDATOM
+--- ```
+---
+--- **Conventions:** the in-memory shape uses `{pos, line, text}`
+--- (`atoms_source_map.lua:142`); the `.txt` file uses `WORD <n>` so the parser maps `n` → `pos` field name.
+--- @param sm_path Path
+--- @param expected_version integer  -- expected FORMAT_VERSION line
+--- @return table<string, table>
+function M.parse_source_map_file(sm_path, expected_version)
+	return M.parse_atom_records(sm_path, expected_version, function(line)
+		local _, n, _, src_line = line:find("WORD%s+(%d+)%s+LINE%s+(%d+)")
+		if n and src_line then
+			return { pos = tonumber(n), line = tonumber(src_line) }
+		end
+	end)
+end
+
+--- Parse a FORMAT_VERSION <expected_version> `*.atoms.provenance.txt` file.
+--- Returns `{name -> {total = N, words = {{pos, call_file, call_line, comp_name, comp_file, comp_line}, ...}}}`.
+--- Returns `{}` on format-version mismatch (and logs to stderr).
+---
+--- **Wire format** (emitted by `passes/atoms_source_map.lua`):
+--- ```
+--- # FORMAT_VERSION <n>
+--- ATOM <name> "<abs-source-path>" <total>
+--- WORD <n>  CALL <src-file>:<src-line>  RAW
+--- WORD <n>  CALL <src-file>:<src-line>  MACRO <comp_name> "<comp-file>:<comp-line>"
+--- ...
+--- ENDATOM
+--- ```
+---
+--- **Used by** `passes/dwarf_injection.lua` to:
+---   - group consecutive MACRO rows into component invocations (one `DW_TAG_inlined_subroutine` each)
+---   - emit abstract `DW_TAG_subprogram` per unique component name
+---   - extend `.debug_line` so stepping into a `mac_X(...)` lands on the component's source line.
+--- @param prov_path string  -- path to *.atoms.provenance.txt
+--- @param expected_version integer  -- expected FORMAT_VERSION line
+--- @return table<string, table>
+function M.parse_provenance_file(prov_path, expected_version)
+	return M.parse_atom_records(prov_path, expected_version, function(line)
+		-- Two accepted shapes:
+		--   WORD <n>  CALL <call-file>:<call-line>  RAW
+		--   WORD <n>  CALL <call-file>:<call-line>  MACRO <comp_name> "<comp-file>:<comp-line>"
+		local pos, call_file, call_line, comp_name, comp_file, comp_line =
+			line:match('WORD%s+(%d+)%s+CALL%s+(.-):(%d+)%s+MACRO%s+(%S+)%s+"([^"]*):(%d+)"')
+		if pos then
+			return {
+				pos       = tonumber(pos),
+				call_file = call_file,
+				call_line = tonumber(call_line),
+				comp_name = comp_name,
+				comp_file = comp_file,
+				comp_line = tonumber(comp_line),
+			}
+		end
+		-- RAW row.
+		local raw_pos, raw_file, raw_line = line:match('WORD%s+(%d+)%s+CALL%s+(.-):(%d+)%s+RAW')
+		if raw_pos then
+			return {
+				pos       = tonumber(raw_pos),
+				call_file = raw_file,
+				call_line = tonumber(raw_line),
+				comp_name = nil,
+				comp_file = nil,
+				comp_line = nil,
+			}
+		end
+	end)
+end
+
+return M

scripts/gdb/gdb_tape_atoms.gdb

@@ -0,0 +1,105 @@
+# scripts/gdb/gdb_tape_atoms.gdb
+#
+# Wrapper for the tape-atom step-debug helpers.
+# The 9 user commands are defined here as STUBS (degraded-state messages). 
+# The real implementations + the per-atom data tables are emitted by `passes/atoms_source_map.lua` 
+# (post-link invocation: `ps1_meta.lua --atoms-source-map --gdb-runtime --elf <elf>`) into `build/gen/gdb_tape_atoms_runtime.gdb`.
+# Sourcing that file RE-DEFINES the commands with real implementations.
+#
+# If `build/gen/gdb_tape_atoms_runtime.gdb` is missing or stale, the stubs remain (E1: no source map).
+# The user just needs to re-run `build_psyq.ps1` to regenerate.
+
+# ── Stub commands (defined here so they're always present, even if the runtime file is missing). The runtime file overrides these if sourced. ──
+
+define tape_atoms
+  echo "[gdb_tape_atoms] STUB: runtime file build/gen/gdb_tape_atoms_runtime.gdb not found."
+  echo "[gdb_tape_atoms] STUB: run .\\build_psyq.ps1 to regenerate, then re-source this file."
+end
+document tape_atoms
+  List every tape atom symbol in the loaded ELF (code_<name>) with its .rodata address and word count.
+  STUB state: runtime file not sourced. Run build_psyq.ps1 to regenerate.
+end
+
+define break_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document break_atom
+  Set a breakpoint at the start of tape atom <name>. STUB state.
+end
+
+define step_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document step_atom
+  Resume execution until the next atom boundary. STUB state.
+end
+
+define next_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document next_atom
+  Alias for step_atom. STUB state.
+end
+
+define where_in_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document where_in_atom
+  Report current atom name, .rodata addr, word offset, and source line (if known). STUB state.
+end
+
+define stepi_inside_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document stepi_inside_atom
+  One MIPS-instruction step, then where_in_atom. STUB state.
+end
+
+define show_c2
+  printf "C2[ 0]   0x%08x\n", $c2_data[0]
+  printf "C2[ 7]   0x%08x  [otz]\n", $c2_data[7]
+  printf "C2[12]   0x%08x  [sxy0]\n", $c2_data[12]
+  printf "C2[13]   0x%08x  [sxy1]\n", $c2_data[13]
+  printf "C2[14]   0x%08x  [sxy2]\n", $c2_data[14]
+  printf "C2[24]   0x%08x  [mac0]\n", $c2_data[24]
+  printf "...\n"
+   echo "(STUB state: only 7 representative regs shown. Run build_psyq.ps1 for full dump.)"
+end
+document show_c2
+  Pretty-print all 32 C2 data registers as hex + named alias. STUB state (7 reg subset).
+end
+
+define show_c2ctl
+  printf "C2CTL[ 0]  0x%08x\n", $c2_control[0]
+  printf "...\n"
+  echo "(STUB state: only 1 reg shown. Run build_psyq.ps1 for full dump.)"
+end
+document show_c2ctl
+  Pretty-print all 32 C2 control registers. STUB state (1 reg subset).
+end
+
+define wave_ctx
+  printf "$t4 = R_FaceCursor     0x%08x\n", $t4
+  printf "$t5 = R_VertBase       0x%08x\n", $t5
+  printf "$t6 = R_OtBase         0x%08x\n", $t6
+  printf "$t7 = R_PrimCursor     0x%08x\n", $t7
+end
+document wave_ctx
+  Pretty-print the 4 wave-context GPRs ($t4..$t7). (wave_ctx works in stub state too.)
+end
+
+
+# ── Source the runtime file (re-defines commands with real impls + data). ──
+
+# Try to source from project-root-relative path first (the typical case).
+# If the user is in a different CWD, the source will fail and stubs remain.
+# The runtime file path is computed relative to the ELF's source map convention (build/gen/gdb_tape_atoms_runtime.gdb).
+echo [gdb_tape_atoms] Wrapper loaded. Sourcing runtime file...
+# Suppress the "Redefine command" prompts that would otherwise appear when the runtime file overrides the 9 stub commands defined above.
+# The runtime's `define` blocks are intended to overwrite — there's no ambiguity to confirm.
+set confirm off
+
+# Source the runtime file (re-defines commands with real impls + data).
+source build/gen/gdb_tape_atoms_runtime.gdb
+set confirm on
+echo [gdb_tape_atoms] Runtime sourced successfully (9 commands now have real implementations).

scripts/launch_pcsx_debug.ps1

@@ -0,0 +1,99 @@
+# scripts/launch_pcsx_debug.ps1
+#
+# One-shot launcher for debug sessions: starts pcsx-redux with the .ps-exe
+# loaded, the gdb stub enabled, AND the pcsx_debug_helper Lua plugin loaded
+# so external CLI tools (gdb's `shell` command, etc.)
+# can read GTE state via http://localhost:8080/api/v1/lua/gte
+# (the gdb stub doesn't expose COP2 at all).
+#
+# usage:
+#   .\scripts\launch_pcsx_debug.ps1
+#   .\scripts\launch_pcsx_debug.ps1 -ExePath build\hello_gte.ps-exe
+#   .\scripts\launch_pcsx_debug.ps1 -HelperZip scripts\pcsx_debug_helper.zip
+#
+# After launch:
+#   - gdb: target remote localhost:3333
+#   - web: curl http://localhost:8080/api/v1/lua/gte
+#
+# Companion: scripts/debug_psyq.ps1 (bare launch — no .ps-exe, no helper).
+
+[CmdletBinding()]
+param(
+    [string]$PcsxPath = (Join-Path $PSScriptRoot '..\toolchain\pcsx-redux\vsprojects\x64\Release\pcsx-redux.exe'),
+    [string]$ExePath  = (Join-Path $PSScriptRoot '..\build\hello_gte.ps-exe'),
+    [string]$HelperZip = (Join-Path $PSScriptRoot 'pcsx_debug_helper.zip'),
+    [int]   $GdbPort  = 3333,
+    [int]   $WebPort  = 8080
+)
+
+$ErrorActionPreference = 'Stop'
+
+$gdbInitPath = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\build\gen\hello_gte.gdbinit'))
+if (-not (Test-Path -LiteralPath $gdbInitPath -PathType Leaf)) {
+    Write-Warning "Generated GDB skip sidecar missing (non-fatal): $gdbInitPath. Run the GTE build to regenerate it; debugger launch will continue without generated skip-over commands."
+}
+
+# ── Pre-checks ──
+foreach ($p in @($PcsxPath, $ExePath, $HelperZip)) {
+    if (-not (Test-Path $p)) {
+        Write-Error "Missing: $p"
+        exit 1
+    }
+}
+
+# Kill any existing pcsx-redux so the archive file isn't locked.
+Get-Process pcsx-redux -ErrorAction SilentlyContinue | Stop-Process -Force
+Start-Sleep -Seconds 2
+
+# ── Launch ──
+$absExe  = [System.IO.Path]::GetFullPath($ExePath)
+$absZip  = [System.IO.Path]::GetFullPath($HelperZip)
+
+$args = @(
+    '-gdb', '-run'
+    '-loadexe', "`"$absExe`""
+    '-archive', "`"$absZip`""
+)
+
+Write-Host "Launching pcsx-redux..." -ForegroundColor Cyan
+Write-Host "  ps-exe    : $absExe"
+Write-Host "  helper zip: $absZip"
+Write-Host "  gdb       : localhost:$GdbPort"
+Write-Host "  web       : localhost:$WebPort/api/v1/lua/gte"
+Write-Host ""
+
+Start-Process -FilePath $PcsxPath -ArgumentList $args | Out-Null
+
+# ── Wait for both endpoints to come up ──
+$deadline = (Get-Date).AddSeconds(15)
+while ((Get-Date) -lt $deadline) {
+    $gdbUp = $false
+    $webUp = $false
+    try {
+        $tcp = New-Object System.Net.Sockets.TcpClient
+        $tcp.BeginConnect('localhost', $GdbPort, $null, $null) | Out-Null
+        Start-Sleep -Milliseconds 100
+        $gdbUp = $tcp.Connected
+        $tcp.Close()
+    } catch { $gdbUp = $false }
+    try {
+        $r = Invoke-WebRequest -Uri "http://localhost:$WebPort/" -UseBasicParsing -TimeoutSec 1 -ErrorAction SilentlyContinue
+        $webUp = $r.StatusCode -ne 0
+    } catch { $webUp = $false }
+    if ($gdbUp -and $webUp) { break }
+    Start-Sleep -Milliseconds 500
+}
+
+# ── Smoke-test the gte handler ──
+try {
+    $r = Invoke-WebRequest -Uri "http://localhost:$WebPort/api/v1/lua/gte" -UseBasicParsing -TimeoutSec 5
+    $firstLine = ([System.Text.Encoding]::UTF8.GetString($r.Content) -split "`n")[0]
+    Write-Host "GTE handler OK: $firstLine" -ForegroundColor Green
+} catch {
+    Write-Warning "GTE handler NOT responding: $_"
+    Write-Host "Check the pcsx-redux Lua Console for debug cli messages." -ForegroundColor Yellow
+}
+
+Write-Host ""
+Write-Host "pcsx-redux running. PIDs:" -ForegroundColor Cyan
+Get-Process pcsx-redux | Select-Object Id, ProcessName | Format-Table

scripts/passes/atoms_source_map.lua

@@ -0,0 +1,749 @@
+--- passes/atoms_source_map.lua — Per-.word source-line map emitter for tape atoms.
+---
+--- Reads the pre-scanned SourceScan payload (produced once upstream by `duffle.scan_source`)
+--- for `MipsAtom_(name)` (kind="atom"), `MipsAtomComp_` / `MipsAtomComp_Proc_` (kind="comp_*"),
+--- and `MipsCode code_<name>` (kind="raw_atom") declarations. 
+--- Walks each atom's pre-tokenized body (`{{tok=string, rel=integer}, ...}` from `duffle.tokenize_body`), 
+--- counts per-token word contributions via `ctx.shared.word_counts`, and emits one
+--- `WORD N LINE L TEXT T` line per `.word` to `<out_root>/<basename>.atoms.sourcemap.txt`.
+---
+--- **Two output forms** (per the workspace's per-emission-form pattern from
+--- `guide_metaprogram_ssdl.md`):
+---   1. **Canonical text form** — `<out_root>/<basename>.atoms.sourcemap.txt`.
+---      Format-version-tagged for forward-compat. 
+---      Lives in `<out_root>/` (build/gen).
+---      Matches the convention used by `annotation.lua` (`<out_root>/<basename>.errors.h`) + `static_analysis.lua` (`<out_root>/<basename>.static_analysis.txt`).
+---      Compile artifacts (`*.macs.h`, `*.offsets.h`) stay in `<source_dir>/gen/`.
+---   2. **gdb-runtime form** — `<ctx.out_root>/gdb_tape_atoms_runtime.gdb`
+---      (pure gdb command script; addresses pre-computed via `nm`; the 9 user commands defined as `define ... end` blocks).
+---      Emitted ONLY when `ctx.flags.gdb_runtime` is true AND `ctx.flags.elf_path` points to an existing ELF.
+---      The gdb runtime form lets `gdb-multiarch --without-python` users (the common case on Windows MinGW builds)
+---      load the source-map data via `source <path>` — no Python/Tcl/Guile required.
+---
+--- **Output format** (canonical text form):
+---   ```
+---   # FORMAT_VERSION 1
+---   # auto-generated by ps1_meta.lua (passes/atoms_source_map.lua) — DO NOT EDIT
+---   ATOM <name> "<abs-source-path>" <total_words>
+---   WORD 0  LINE 49  TEXT load_half_u(R_T0, R_FaceCursor, 0 * S_(S2)),
+---   WORD 1  LINE 49  TEXT load_half_u(R_T0, R_FaceCursor, 0 * S_(S2)),
+---   ... (one WORD line per .word emitted by the atom body) ...
+---   ENDATOM
+---   ATOM <next-name> "<abs-source-path>" <total_words>
+---   ...
+---   ENDATOM
+---   ```
+---
+--- Marker calls (`atom_label(...)`, `atom_offset(...)`) emit 0 `.word`s. 
+--- They share the same walking convention as `passes/offsets.lua :: scan_atom_body`: 
+--- Markers do NOT advance the word-offset counter, but if a marker is bundled on the same token with a trailing instruction 
+--- (e.g. `atom_label(foo) load_half_u(...)`), the trailing instruction's word count is added. This matches `offsets.lua :: count_marker_rest`.
+---
+--- **Conventions:** tabs (1/level), EmmyLua annotations, no regex,
+--- Lua 5.3 compatible.
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Module-scope requires + package.path setup
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` 
+-- (works both standalone + when require'd). `duffle_paths.lua` sets package.path then returns `require("duffle")` 
+-- at the bottom, so the dofile value IS the duffle module.
+local _bootstrap_dir = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
+local duffle           = dofile(_bootstrap_dir .. "../duffle_paths.lua")
+local elf_dwarf        = require("elf_dwarf")
+local word_count_eval  = require("word_count_eval")
+local count_token_words = word_count_eval.count_token_words
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Constants
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Format version emitted as the first line. Bump + add a migration test if the format changes; 
+-- the gdb runtime loader rejects mismatches (E2).
+local FORMAT_VERSION = 1
+
+-- Marker-call identifiers (mirrors offsets.lua:33-34).
+local LABEL_MARKER  = "atom_label"
+local OFFSET_MARKER = "atom_offset"
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Type declarations
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- @class AtomSourceMapCtx
+--- @field sources            table[] -- SourceScan payload per source (from `ctx.sources`)
+--- @field shared             table   -- `ctx.shared`
+--- @field shared.word_counts table   -- macro name -> word count (populated by word-counts + components passes)
+--- @field out_root           string  -- output root (e.g. "build/gen")
+--- @field dry_run            boolean -- if true, compute but don't write
+--- @field flags              table   -- `ctx.flags`; reads `flags.gdb_runtime` + `flags.elf_path`
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Helpers
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Provenance emission
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Component-macro invocation prefix (mirrors components.lua's MAC_PREFIX).
+local MAC_PREFIX     = "mac_"
+local MAC_PREFIX_LEN = 4
+
+--- Strip the `mac_` prefix from a token's leading identifier.
+--- Returns nil if the identifier doesn't start with `mac_`
+--- (so non-component tokens like `load_half_u`, `nop2`, `gte_cmdw_*` fall through cleanly).
+--- @param tok string
+--- @return string|nil
+local function strip_mac_prefix_from_token(tok)
+	local leading = duffle.read_ident(tok, 1)
+	if not leading then return nil end
+	if leading:sub(1, MAC_PREFIX_LEN) == MAC_PREFIX then
+		return leading:sub(MAC_PREFIX_LEN + 1)
+	end
+	return nil
+end
+
+--- Fetch the per-word body lines for a `mac_X(...)` invocation.
+--- Walks the component's pre-tokenized body in lockstep with `count_token_words` and attributes each emitted `.word`
+--- to a source line via `idx.line_of(...)`. 
+--- Atom labels (`atom_label(...)`) emit 0 `.word`s and are skipped.
+--- @param bare string|nil          -- the bare component name (e.g. `gte_load_tri_verts`)
+--- @param comp_body_index table
+--- @param wc table
+--- @return table|nil                -- list of source lines, 1-based by word position
+local function fetch_body_lines(bare, comp_body_index, wc)
+	if not (bare and comp_body_index) then return nil end
+	local idx = comp_body_index[bare]
+	if not (idx and idx.body_tokens and idx.line_of) then return nil end
+	local lines = {}
+	for _, bt in ipairs(idx.body_tokens) do
+		local bt_tok = duffle.trim(bt.tok or "")
+		if bt_tok ~= "" then
+			local leading = duffle.read_ident(bt_tok, 1)
+			local bt_words
+			if leading == "atom_label" or leading == "atom_offset" then
+				bt_words = 0
+			else
+				bt_words = count_token_words(bt_tok, wc)
+			end
+			if bt_words > 0 then
+				local body_line = idx.line_of(idx.body_off + bt.rel)
+				for _ = 1, bt_words do lines[#lines + 1] = body_line end
+			end
+		end
+	end
+	return lines
+end
+
+--- Unified per-word entry walker. `mode` is "sourcemap" (3 fields) or "provenance" (8 fields including component + body-line lookup).
+--- Returns (entries, total_words). Markers contribute 0 entries.
+--- @param atom table
+--- @param src  table
+--- @param wc   table
+--- @param mode string           -- "sourcemap" | "provenance"
+--- @param comp table|nil        -- shared.components map (provenance only)
+--- @param comp_body_index table|nil  -- per-source body index (provenance only)
+--- @return table[], integer
+local function compute_word_entries(atom, src, wc, mode, comp, comp_body_index)
+	local entries = {}
+	local pos     = 0
+	for _, t in ipairs(atom.body_tokens) do
+		local tok = t.tok
+		local rel = t.rel
+
+		local words
+		if duffle.is_marker_token(tok) then
+			words = duffle.count_marker_rest(tok, wc, count_token_words)
+		else
+			words = count_token_words(tok, wc)
+		end
+
+		-- Provenance-only: resolve component + body_lines (one fetch per token).
+		local comp_name, comp_line, comp_path, comp_kind
+		local body_lines
+		if mode == "provenance" then
+			local bare = strip_mac_prefix_from_token(tok)
+			if bare and comp and comp[bare] then
+				comp_name = bare
+				comp_line = comp[bare].line
+				comp_path = comp[bare].path
+				comp_kind = comp[bare].kind
+			end
+			if comp_name then body_lines = fetch_body_lines(bare, comp_body_index, wc) end
+		end
+
+		if words > 0 then
+			local line = src.scan.line_of(atom.body_off + rel)
+			local text = duffle.trim(tok):gsub("[\t\r\n]+", " ")
+			for i = 1, words do
+				local entry
+				if mode == "provenance" then
+					entry = {
+						pos       = pos,
+						line      = line,
+						text      = text,
+						comp_name = comp_name,
+						comp_line = comp_line,
+						comp_path = comp_path,
+						comp_kind = comp_kind,
+						body_line = body_lines and body_lines[i],
+					}
+				else  -- "sourcemap" (default)
+					entry = { pos = pos, line = line, text = text }
+				end
+				entries[#entries + 1] = entry
+				pos = pos + 1
+			end
+		end
+	end
+	return entries, pos
+end
+
+--- Render one atom's provenance stanza. Format:
+---   `WORD N  CALL <src-path>:<src-line>  MACRO <name> "<def-path>:<def-line>"  [BODY <line>]`  (for component words)
+---   `WORD N  CALL <src-path>:<src-line>  RAW`                                                  (for direct instructions)
+--- `BODY <line>` is the source line of THIS specific word within the macro body
+--- (lottes_tape.h:N where N is the per-word body line).
+--- Absent for RAW rows and for component rows whose component declaration could not be indexed (older pass combinations / external macros).
+--- Downstream consumers (dwarf_injection, tests) fall back to DefLine / comp_line when BODY is absent.
+--- Returns (lines, total_words).
+--- @param src    table
+--- @param atom   table
+--- @param wc     table
+--- @param comp   table  -- shared.components map
+--- @param comp_body_index table  -- per-source component body index: bare_name -> {body_off, body_tokens, line_of}
+--- @return string[], integer
+local function emit_provenance_stanza(src, atom, wc, comp, comp_body_index)
+	local lines    = {}
+	local rel_path = src.path:gsub("\\", "/")
+	local entries, total = compute_word_entries(atom, src, wc, "provenance", comp, comp_body_index)
+
+	-- ATOM header line with placeholder total (patched after we know it).
+	lines[#lines + 1] = string.format('ATOM %s "%s" 0', atom.raw_name or atom.name, rel_path)
+
+	for _, pe in ipairs(entries) do
+		if pe.comp_name then
+			local body_suffix = ""
+			if pe.body_line then
+				body_suffix = "  BODY " .. tostring(pe.body_line)
+			end
+			lines[#lines + 1] = string.format('WORD %d  CALL %s:%d  MACRO %s "%s:%d"%s',
+				pe.pos, rel_path, pe.line, pe.comp_name, pe.comp_path, pe.comp_line, body_suffix)
+		else
+			lines[#lines + 1] = string.format("WORD %d  CALL %s:%d  RAW", pe.pos, rel_path, pe.line)
+		end
+	end
+
+	-- Patch the placeholder total in the ATOM header line.
+	lines[1] = lines[1]:gsub(" 0$", " " .. tostring(total))
+	lines[#lines + 1] = "ENDATOM"
+	return lines, total
+end
+
+--- Build a per-source component body index keyed by the bare component name (e.g. `gte_load_tri_verts`).
+--- Each entry holds the data we need to map each emitted `.word` to its actual source line within the macro body:
+---   body_off    -- byte offset of the `{` (start of body) in the component's source file.
+---   body_tokens -- list of {tok, rel} pairs; `rel` is the byte offset within the body.
+---   line_of     -- closure resolving byte offsets in the component's source file to lines.
+--- Only `comp_bare` + `comp_proc` declarations contribute (a macro invocation can only resolve to one of those).
+--- First declaration wins (subsequent redeclarations would collide; today's sources declare each component exactly once).
+--- Render the full provenance file content for one source (one `.atoms.provenance.txt` per source).
+--- @param src table
+--- @param wc table
+--- @param comp table  -- shared.components map
+--- @param comp_body_index table  -- cross-source component body index (built once in M.run; may be empty)
+--- @return string
+local function render_provenance(src, wc, comp, comp_body_index)
+	local lines = {}
+	lines[#lines + 1] = "# FORMAT_VERSION 1"
+	lines[#lines + 1] = "# auto-generated by ps1_meta.lua (passes/atoms_source_map.lua) — DO NOT EDIT"
+	lines[#lines + 1] = "# Per-.word provenance: maps each emitted .word to its call site (atom body"
+	lines[#lines + 1] = "# file:line) and, when the word was emitted by a `mac_X(...)` component invocation,"
+	lines[#lines + 1] = "# the component's definition file:line + the per-word BODY line. Used by"
+	lines[#lines + 1] = "# dwarf_injection to synthesize DW_TAG_inlined_subroutine instances + per-word"
+	lines[#lines + 1] = "# line program rows for native source-level step into component bodies."
+
+	-- The cross-source component body index is passed in from M.run (one global lookup shared across every source's provenance file).
+	-- A per-source lookup would miss every component whose declaration is in another source (e.g. `gte_load_tri_verts` is declared in `lottes_tape.h` but invoked from `hello_gte_tape.c`).
+
+	for _, atom in ipairs(src.scan.atoms or {}) do
+		local stanza = emit_provenance_stanza(src, atom, wc, comp, comp_body_index)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+	for _, atom in ipairs(src.scan.raw_atoms or {}) do
+		local stanza = emit_provenance_stanza(src, atom, wc, comp, comp_body_index)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+
+	return table.concat(lines, "\n") .. "\n"
+end
+
+--- Render one atom's stanza for the canonical text form (ATOM header line, N WORD lines, ENDATOM marker).
+--- Returns (lines, total_words).
+--- @param src    table
+--- @param atom   table
+--- @param wc     table
+--- @return string[], integer
+local function emit_atom_stanza(src, atom, wc)
+	local lines              = {}
+	local rel_path           = src.path:gsub("\\", "/")
+	local entries, total     = compute_word_entries(atom, src, wc)
+
+	-- ATOM header line with placeholder total (patched after we know it).
+	lines[#lines + 1] = string.format('ATOM %s "%s" 0', atom.raw_name or atom.name, rel_path)
+	for _, we in ipairs(entries) do
+		lines[#lines + 1] = string.format("WORD %d  LINE %d  TEXT %s",
+			we.pos, we.line, we.text)
+	end
+
+	-- Patch the placeholder total in the ATOM header line.
+	lines[1] = lines[1]:gsub(" 0$", " " .. tostring(total))
+	lines[#lines + 1] = "ENDATOM"
+	return lines, total
+end
+
+--- Render the full source map file content for one source (one .atoms.sourcemap.txt per source).
+--- Mirrors offsets.lua's `project_atoms` shape: scan.atoms + scan.raw_atoms, no kind filter.
+--- @param src table
+--- @param wc table
+--- @return string
+local function render_source_map(src, wc)
+	local lines = {}
+	lines[#lines + 1] = "# FORMAT_VERSION " .. FORMAT_VERSION
+	lines[#lines + 1] = "# auto-generated by ps1_meta.lua (passes/atoms_source_map.lua) — DO NOT EDIT"
+
+	for   _, atom in ipairs(src.scan.atoms or {}) do
+		local stanza = emit_atom_stanza(src, atom, wc)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+	for   _, atom in ipairs(src.scan.raw_atoms or {}) do
+		local stanza = emit_atom_stanza(src, atom, wc)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+
+	return table.concat(lines, "\n") .. "\n"
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- gdb-runtime emission (post-link, addresses via nm)
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- Escape a string for embedding in a gdb `set $var = "..."` literal.
+--- gdb uses C-style escaping; we escape `\` and `"` (newlines were flattened earlier).
+--- @param s string
+--- @return string
+local function gdb_escape(s)
+	return (s:gsub("\\", "\\\\"):gsub('"', '\\"'))
+end
+
+--- Build the list of atoms with addresses + word entries.
+--- Shared helper for the gdb-runtime file emission.
+--- @param ctx PassCtx
+--- @return table[] -- list of {idx, name, src_path, file_base, addr, size_bytes, words, entries}
+local function build_atom_table(ctx)
+	local wc    = (ctx.shared and ctx.shared.word_counts) or {}
+	local addrs = elf_dwarf.read_nm(ctx.flags.elf_path)
+
+	local matched = {}
+	for _, src in ipairs(ctx.sources) do
+		if src.scan then
+			local file_base = src.path:match("([^/\\]+)$") or src.path
+			for _, atom in ipairs(src.scan.atoms or {}) do
+				if atom.kind == nil or atom.kind == "atom" then
+					local name    = atom.raw_name or atom.name
+					local info    = addrs[name]
+					if info then
+						local entries, total = compute_word_entries(atom, src, wc)
+						matched[#matched + 1] = {
+							name       = name,
+							src_path   = src.path,
+							file_base  = file_base,
+							addr       = info[1],
+							size_bytes = info[2],
+							words      = total,
+							entries    = entries,
+						}
+					end
+				end
+			end
+			for _, atom in ipairs(src.scan.raw_atoms or {}) do
+				local name = atom.name
+				local info = addrs[name]
+				if info then
+					local entries, total = compute_word_entries(atom, src, wc)
+					matched[#matched + 1] = {
+						name       = name,
+						src_path   = src.path,
+						file_base  = file_base,
+						addr       = info[1],
+						size_bytes = info[2],
+						words      = total,
+						entries    = entries,
+					}
+				end
+			end
+		end
+	end
+
+	-- Deterministic order: sort by address (matches `nm` output ordering).
+	table.sort(matched, function(a, b) return a.addr < b.addr end)
+	for i, a in ipairs(matched) do
+		a.idx = i - 1
+	end
+	return matched
+end
+
+--- Append the 9 gdb command definitions to `lines`. Pure gdb scripting no Python, no Tcl, no Guile required. 
+--- **Fully hardcoded per-atom** because gdb doesn't do nested `$` substitution in var names
+--- `$__atom_name_$__i` inside a `while` loop is treated as one literal identifier, not a concat.
+---
+--- Each command is a static sequence of `printf` / `tbreak` / `if ... end` blocks.
+--- The Lua pass emits N atoms' worth of lines — no runtime iteration. 
+--- @param lines   table  -- output line buffer (mutated in place)
+--- @param matched table  -- list of atom records from `build_atom_table`
+local function append_gdb_commands(lines, matched)
+	-- ── tape_atoms ──
+	-- Hardcoded one printf per atom. No loop.
+	lines[#lines + 1] = "define tape_atoms"
+	for _, a in ipairs(matched) do
+		-- gdb 12.1 quirk: literals in printf args require an attached target.
+		-- Use the per-atom convenience vars set above as printf args.
+		lines[#lines + 1] = string.format('  printf "  code_%%-32s @ 0x%%08x  %%4d words\\n", $__atom_name_%d, $__atom_addr_%d, $__atom_words_%d',
+			a.idx, a.idx, a.idx)
+	end
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document tape_atoms"
+	lines[#lines + 1] = "  List every tape atom symbol in the loaded ELF (code_<name>) with .rodata addr + word count."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── break_atom (generic) + per-atom break_atom_X ──
+	lines[#lines + 1] = "define break_atom"
+	lines[#lines + 1] = '  echo "Usage: break_atom_<exact_name>  (pick from the list below)"'
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format('  printf "  break_atom_%%-32s\\n", $__atom_name_%d', a.idx)
+	end
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document break_atom"
+	lines[#lines + 1] = "  Generic help: lists the per-atom break_atom_<name> commands."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format("define break_atom_%s", a.name)
+		lines[#lines + 1] = string.format("  break *$__atom_addr_%d", a.idx)
+		lines[#lines + 1] = string.format('  printf "  Breakpoint set at code_%s (0x%%08x)\\n", $__atom_addr_%d', a.name, a.idx)
+		lines[#lines + 1] = "end"
+		lines[#lines + 1] = string.format("document break_atom_%s", a.name)
+		lines[#lines + 1] = string.format("  Set a breakpoint at code_%s.", a.name)
+		lines[#lines + 1] = "end"
+		lines[#lines + 1] = ""
+	end
+
+	-- ── step_atom / next_atom ──
+	-- Hardcoded one tbreak per atom. No loop.
+	lines[#lines + 1] = "define step_atom"
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format("  tbreak *$__atom_addr_%d", a.idx)
+	end
+	lines[#lines + 1] = "  continue"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document step_atom"
+	lines[#lines + 1] = "  Set one-shot BPs at every atom + continue. Stops at the next atom boundary."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	lines[#lines + 1] = "define next_atom"
+	lines[#lines + 1] = "  step_atom"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document next_atom"
+	lines[#lines + 1] = "  Alias for step_atom."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── where_in_atom ──
+	-- Hardcoded one outer-if per atom; inside, one inner-if per WORD entry.
+	lines[#lines + 1] = "define where_in_atom"
+	lines[#lines + 1] = "  set $__pc = (unsigned int)$pc"
+	lines[#lines + 1] = "  set $__matched = 0"
+	for _, a in ipairs(matched) do
+		-- Precompute end_addr (gdb 12.1's expression evaluator chokes on `addr + words*4`).
+		lines[#lines + 1] = string.format("  set $__end_%d = $__atom_addr_%d + $__atom_words_%d * 4", a.idx, a.idx, a.idx)
+		lines[#lines + 1] = string.format("  if $__pc >= $__atom_addr_%d && $__pc < $__end_%d", a.idx, a.idx)
+		lines[#lines + 1] = string.format('    printf "atom:    code_%%s\\n", $__atom_name_%d', a.idx)
+		lines[#lines + 1] = '    printf "addr:    0x%08x\\n", $__pc'
+		lines[#lines + 1] = string.format("    set $__word = ($__pc - $__atom_addr_%d) / 4", a.idx)
+		lines[#lines + 1] = string.format('    printf "word:    %%d/%%d\\n", $__word, $__atom_words_%d', a.idx)
+		-- One inner-if per WORD entry. Each word's line + text hardcoded.
+		for _, we in ipairs(a.entries) do
+			lines[#lines + 1] = string.format("    if $__word == %d", we.pos)
+			-- Escape TEXT for printf format string.
+			local escaped_text = we.text:gsub("%%", "%%%%"):gsub('"', '\\"')
+			lines[#lines + 1] = string.format('      printf "source:  %%s:%%d  %%s\\n", $__atom_file_%d, %d, "%s"', a.idx, we.line, escaped_text)
+			lines[#lines + 1] = "    end"
+		end
+		-- Fallback for words beyond the source map (shouldn't happen if nm matches).
+		local max_word = 0
+		if #a.entries > 0 then max_word = a.entries[#a.entries].pos end
+		lines[#lines + 1] = string.format('    if $__word > %d', max_word)
+		lines[#lines + 1] = '      printf "source:  (no source-map entry for word %%d; map may be stale)\\n", $__word'
+		lines[#lines + 1] = "    end"
+		lines[#lines + 1] = "    set $__matched = 1"
+		lines[#lines + 1] = "  end"
+	end
+	lines[#lines + 1] = "  if !$__matched"
+	lines[#lines + 1] = '    echo PC is not inside any known atom (in .text or unmapped region).'
+	lines[#lines + 1] = "  end"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document where_in_atom"
+	lines[#lines + 1] = "  Report current atom name, .rodata addr, word offset, and source line."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── stepi_inside_atom ──
+	-- Hardcoded one if-containment-check per atom (no loop).
+	-- Precompute end_addr in Lua so we don't ask gdb to evaluate `addr + words*4` inside the if condition
+	-- (gdb 12.1's expression evaluator chokes on the `*` and emits a misleading 'function malloc' error in some gdb builds).
+	lines[#lines + 1] = "define stepi_inside_atom"
+	lines[#lines + 1] = "  set $__in_atom = 0"
+	lines[#lines + 1] = "  set $__did_step = 0"
+	lines[#lines + 1] = "  set $__pc = (unsigned int)$pc"
+	for _, a in ipairs(matched) do
+		-- Precompute end_addr in the convenience var (single expression gdb handles).
+		lines[#lines + 1] = string.format("  set $__end_%d = $__atom_addr_%d + $__atom_words_%d * 4", a.idx, a.idx, a.idx)
+		lines[#lines + 1] = string.format("  if $__pc >= $__atom_addr_%d && $__pc < $__end_%d", a.idx, a.idx)
+		lines[#lines + 1] = "    set $__in_atom = 1"
+		lines[#lines + 1] = "    stepi"
+		lines[#lines + 1] = "    set $__did_step = 1"
+		lines[#lines + 1] = "  end"
+	end
+	lines[#lines + 1] = "  if !$__did_step"
+	lines[#lines + 1] = '    echo [gdb_tape_atoms] stepi_inside_atom: PC is not inside any atom; refusing to step.'
+	lines[#lines + 1] = "  end"
+	lines[#lines + 1] = "  where_in_atom"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document stepi_inside_atom"
+	lines[#lines + 1] = "  One MIPS-instruction step, then where_in_atom. The step-and-see-source-line workflow."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── show_c2 ──
+	-- GTE data regs (COP2). pcsx-redux's gdb stub doesn't expose COP2 (only 72 regs: 32 GPR + COP0 + FPR).
+	--   curl http://localhost:8080/api/v1/lua/gte
+	-- We keep the command definition as a stub that points the user at the plugin.
+	lines[#lines + 1] = "define show_c2"
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] show_c2: gdb stub does not expose COP2 in this build."'
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] Use scripts/pcsx_debug_helper.zip + curl http://localhost:8080/api/v1/lua/gte"'
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] (or pcsx-redux Debug > Registers window for a native view)"'
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document show_c2"
+	lines[#lines + 1] = "  Stub. The gdb stub in this pcsx-redux build does not expose COP2 regs."
+	lines[#lines + 1] = "  For GTE data + control state, use the pcsx_debug_helper Lua plugin or the"
+	lines[#lines + 1] = "  pcsx-redux Debug > Registers window."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── show_c2ctl ──
+	lines[#lines + 1] = "define show_c2ctl"
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] show_c2ctl: see show_c2 for the same workaround."'
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document show_c2ctl"
+	lines[#lines + 1] = "  Stub. Same workaround as show_c2."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── wave_ctx ──
+	lines[#lines + 1] = "define wave_ctx"
+	lines[#lines + 1] = '  printf "$t4 = R_FaceCursor     0x%08x\\n", $t4'
+	lines[#lines + 1] = '  printf "$t5 = R_VertBase       0x%08x\\n", $t5'
+	lines[#lines + 1] = '  printf "$t6 = R_OtBase         0x%08x\\n", $t6'
+	lines[#lines + 1] = '  printf "$t7 = R_PrimCursor     0x%08x\\n", $t7'
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document wave_ctx"
+	lines[#lines + 1] = "  Pretty-print the 4 wave-context GPRs ($t4=R_FaceCursor, $t5=R_VertBase, $t6=R_OtBase, $t7=R_PrimCursor). Requires target attached."
+	lines[#lines + 1] = "end"
+end
+
+--- Emit the gdb-runtime file (post-link). Pure gdb scripting — no Python.
+--- Reads ELF addresses via `mipsel-none-elf-nm -S`, embeds them in `<ctx.out_root>/gdb_tape_atoms_runtime.gdb`
+--- so gdb loads the data via `set $var = ...` + `define ... end` blocks at source-time.
+--- @param ctx PassCtx
+local function emit_gdb_runtime(ctx)
+	if not (ctx.flags and ctx.flags.gdb_runtime) then return end
+	local  elf_path = ctx.flags.elf_path
+	if not elf_path or elf_path == "" then
+		io.stderr:write("[atoms_source_map] --gdb-runtime requires --elf <elf>\n")
+		return
+	end
+	if lfs.attributes(elf_path, "mode") ~= "file" then
+		io.stderr:write(string.format(
+			"[atoms_source_map] --gdb-runtime: ELF not found at %s\n", elf_path))
+		return
+	end
+
+	local matched = build_atom_table(ctx)
+	if #matched == 0 then
+		io.stderr:write("[atoms_source_map] --gdb-runtime: no atoms matched against nm symbols (stale scan?).\n")
+		return
+	end
+
+	local lines = {}
+	lines[#lines + 1] = "# Auto-generated by ps1_meta.lua (passes/atoms_source_map.lua)"
+	lines[#lines + 1] = "# DO NOT EDIT — re-run ps1_meta.lua --atoms-source-map --gdb-runtime to regenerate"
+	lines[#lines + 1] = "# Sourced by scripts/gdb/gdb_tape_atoms.gdb (the wrapper)."
+	lines[#lines + 1] = "# Pure gdb scripting — no Python, no Tcl, no Guile required."
+	lines[#lines + 1] = "# Commands are FULLY HARDCODED per-atom because gdb doesn't do nested"
+	lines[#lines + 1] = "# `$` substitution in var names (`$foo_$i` is one literal identifier)."
+	lines[#lines + 1] = "# Per-atom convenience vars ($__atom_name_<i> etc.) are set so gdb's"
+	lines[#lines + 1] = "# `printf` has valid expression args (gdb 12.1 quirks: literals in"
+	lines[#lines + 1] = "# printf args require an attached target; convenience-var args do not)."
+	lines[#lines + 1] = string.format("# %d atoms from ELF: %s", #matched, elf_path)
+	lines[#lines + 1] = ""
+
+	-- Format version + count + ELF path (the latter is referenced by the load-line).
+	lines[#lines + 1] = "set $__atom_format_version = " .. FORMAT_VERSION
+	lines[#lines + 1] = string.format("set $__atom_count = %d", #matched)
+	lines[#lines + 1] = string.format('set $__elf_path = "%s"', gdb_escape(elf_path))
+	lines[#lines + 1] = ""
+
+	-- Per-atom convenience vars (used as printf args; literals aren't accepted
+	-- without an attached target on gdb 12.1).
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format('set $__atom_name_%d = "%s"', a.idx, gdb_escape(a.name))
+		lines[#lines + 1] = string.format("set $__atom_addr_%d = 0x%x", a.idx, a.addr)
+		lines[#lines + 1] = string.format("set $__atom_words_%d = %d", a.idx, a.words)
+		lines[#lines + 1] = string.format('set $__atom_file_%d = "%s"', a.idx, gdb_escape(a.file_base))
+	end
+	lines[#lines + 1] = ""
+
+	-- The 9 commands (each `define ... end` overrides the wrapper's stub).
+	lines[#lines + 1] = "# ── 9 user commands (overrides wrapper stubs) ──"
+	append_gdb_commands(lines, matched)
+	lines[#lines + 1] = ""
+
+	-- Confirmation line for the source operator.
+	lines[#lines + 1] = 'printf "[gdb_tape_atoms] runtime loaded %d atoms from %s\\n", $__atom_count, $__elf_path'
+
+	local out_path = ctx.out_root .. "/gdb_tape_atoms_runtime.gdb"
+	if not ctx.dry_run then
+		duffle.ensure_dir(duffle.dirname(out_path))
+		duffle.write_file_lf(out_path, table.concat(lines, "\n") .. "\n")
+	end
+	io.stderr:write(string.format(
+		"[atoms_source_map] wrote %s (%d atoms)\n", out_path, #matched))
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- M — module exports
+-- ════════════════════════════════════════════════════════════════════════════
+
+local M = {}
+
+--- Build the cross-source component body index used by `render_provenance` to attribute each emitted `.word` to its actual line within the macro body.
+---
+--- Components are declared in one source (the header that contains `MipsAtomComp_(ac_X)` / `MipsAtomComp_Proc_(ac_X, ...)`) 
+--- but invoked from many source files (every atom body that calls `mac_X(...)`).
+--- The body_offset + body_tokens + line_of live with the declaration source, so a per-source index would miss invocations from other sources.
+---
+--- The cross-source index is keyed by the bare component name (`gte_load_tri_verts`, NOT `ac_gte_load_tri_verts`)
+--- `strip_mac_prefix_from_token` strips the `mac_` prefix from call-site identifiers and yields that exact bare name;
+--- matching it here keeps the lookup aligned with the `ctx.shared.components` map's keying convention.
+--- First declaration wins (subsequent redeclarations would collide; today's sources declare each component exactly once).
+--- @param ctx PassCtx
+--- @return table<string, table>  -- {[comp_name] = {body_off, body_tokens, line_of}}
+local function build_cross_source_component_body_index(ctx)
+	local index = {}
+	for _, src in ipairs(ctx.sources or {}) do
+		if src.scan and src.scan.atoms then
+			local line_of = src.scan.line_of
+			for _, atom in ipairs(src.scan.atoms) do
+				if atom.kind == "comp_bare" or atom.kind == "comp_proc" then
+					-- Prefer `atom.name` (stripped of `ac_` prefix); fall back to `raw_name`
+					-- only if the stripped name is absent (defensive — current scan-source always sets both).
+					local name = atom.name or atom.raw_name
+					if name and not index[name] then
+						index[name] = {
+							body_off    = atom.body_off,
+							body_tokens = atom.body_tokens,
+							line_of     = line_of,
+						}
+					end
+				end
+			end
+		end
+	end
+	return index
+end
+
+--- Pass entry: emit one `<out_root>/<basename>.atoms.sourcemap.txt` per source file that contains at least one `MipsAtom_(name)` / `MipsCode code_<name>` declaration.
+--- Also emits `<out_root>/<basename>.atoms.provenance.txt`:
+--- per-.word provenance with `mac_X(...)` component resolution back to the component's definition file:line + the per-word body line.
+--- Optionally also emit `<ctx.out_root>/gdb_tape_atoms_runtime.gdb` when `ctx.flags.gdb_runtime` is true.
+--- @param ctx PassCtx
+--- @return PassResult
+function M.run(ctx)
+	local outputs  = {}
+	local errors   = {}
+	local warnings = {}
+
+	-- word-counts + components passes must have populated shared.word_counts.
+	-- If absent, the orchestrator wired the deps wrong — fail loud.
+	local wc = (ctx.shared and ctx.shared.word_counts) or {}
+	if not wc or not next(wc) then
+		warnings[#warnings + 1] = {
+			line = 0,
+			msg  = "atoms_source_map: ctx.shared.word_counts is empty; the word-counts + components passes may not have populated it. Check the PASSES dep edges.",
+		}
+	end
+
+	-- shared.components map is populated by `passes/components.lua`.
+	-- Used to attribute each emitted `.word` to either a component macro or the enclosing atom body.
+	-- If absent, all words fall through as RAW (correct behavior — provenance is additive).
+	local comp = (ctx.shared and ctx.shared.components) or {}
+
+	-- Cross-source component body index.
+	-- Built ONCE so every source's provenance writer can resolve `mac_X(...)` invocations back to the macro's body tokens (regardless of which source declared the component).
+	-- Per-source copies were insufficient — the atom file (`hello_gte_tape.c`) does not contain the `MipsAtomComp_(...)` declarations, 
+	-- so the body data would be missing for every component invocation the atom file emitted.
+	local comp_body_index = build_cross_source_component_body_index(ctx)
+
+	-- Always emit the canonical text form (per-source).
+	for _, src in ipairs(ctx.sources) do
+		if src.scan then
+			local n_atoms     = src.scan.atoms and #src.scan.atoms or 0
+			local n_raw_atoms = src.scan.raw_atoms and #src.scan.raw_atoms or 0
+			if n_atoms + n_raw_atoms > 0 then
+				local basename = duffle.basename_no_ext(src.path)
+
+				-- (1) atoms.sourcemap.txt — per-.word line map (unchanged contract).
+				local sourcemap_path = ctx.out_root .. "/" .. basename .. ".atoms.sourcemap.txt"
+				local sourcemap_body = render_source_map(src, wc)
+
+				-- (2) atoms.provenance.txt — per-.word provenance with `mac_X(...)` component resolution back to the component's definition file:line.
+				--     Consumed by `passes/dwarf_injection.lua` to synthesize `DW_TAG_inlined_subroutine` instances for source-level Step Into on component invocations.
+				local prov_path = ctx.out_root .. "/" .. basename .. ".atoms.provenance.txt"
+				local prov_body = render_provenance(src, wc, comp, comp_body_index)
+
+				if not ctx.dry_run then
+					duffle.ensure_dir(duffle.dirname(sourcemap_path))
+					duffle.write_file_lf(sourcemap_path, sourcemap_body)
+					duffle.write_file_lf(prov_path,    prov_body)
+				end
+
+				outputs[#outputs + 1] = { kind = "report", path = sourcemap_path }
+				outputs[#outputs + 1] = { kind = "report", path = prov_path }
+			end
+		end
+	end
+
+	-- Optionally emit the gdb-runtime form (post-link, one file per build).
+	if ctx.flags and ctx.flags.gdb_runtime then
+		emit_gdb_runtime(ctx)
+	end
+
+	return { outputs = outputs, errors = errors, warnings = warnings }
+end
+
+return M

scripts/passes/components.lua

@@ -1,7 +1,11 @@
 --- passes/components.lua — Component-macro header generator.
 ---
---- Walks every source for `MipsAtomComp_(ac_X) { body }` (and the function-form `MipsAtomComp_Proc_(ac_X, { body })`) declarations and 
---- emits a per-directory `<dir_basename>.macs.h` containing one `#define mac_X(sig) \` macro per component + `WORD_COUNT(mac_X, N)` 
+--- Reads the pre-scanned SourceScan payload (produced once upstream by `duffle.scan_source`)
+--- for `MipsAtomComp_(ac_X)` and `MipsAtomComp_Proc_(ac_X, { body })` declarations, then does per-source backward lookups
+--- for the function-args string (from the preceding `FI_ MipsAtom ac_X(...)` function declaration)
+--- and the preceding comment block (for LSP/IntelliSense signature docs).
+---
+--- Emits a per-directory `<dir_basename>.macs.h` containing one `#define mac_X(sig) \` macro per component + `WORD_COUNT(mac_X, N)`
 --- entries for downstream offset computation.
 ---
 --- **Conventions**: tabs (1/level), EmmyLua annotations, no regex,
@@ -20,14 +24,13 @@
 -- Module-scope requires + package.path setup
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Resolve `arg[0]` to an absolute-ish script directory so that `require("duffle")` resolves against `scripts/` regardless of CWD.
+-- Bootstrap: same as entry scripts. See `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
--- Uses `debug.getinfo` to find this file's own directory, so it works
--- both standalone and when require'd from the orchestrator.
-local _src = debug.getinfo(1, "S").source:sub(2)
-local _dir = _src:match("(.*[/\\])") or "./"
-dofile(_dir .. "../duffle_paths.lua")
-local duffle          = require("duffle")
+-- Uses `debug.getinfo` to find this file's own directory, so it works both standalone and when require'd from the orchestrator.
+-- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` (works both standalone + when require'd).
+-- duffle_paths.lua sets package.path then returns `require("duffle")` at the bottom, so the dofile value IS the duffle module.
+local _bootstrap_dir  = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
+local duffle          = dofile(_bootstrap_dir .. "../duffle_paths.lua")
 local word_count_eval = require("word_count_eval")
 
 -- ════════════════════════════════════════════════════════════════════════════
@@ -36,13 +39,12 @@ local word_count_eval = require("word_count_eval")
 
 -- Atom component declaration identifiers.
 local ATOM_COMP_PROC  = "MipsAtomComp_Proc_"
-local ATOM_COMP       = "MipsAtomComp_"
 local MIPS_ATOM       = "MipsAtom"  -- prefix on the function declaration that wraps an AtomComp_Proc_
 
 -- Component-name prefixes.
-local AC_PREFIX       = "ac_"        -- arg to MipsAtomComp_(ac_X); the X is the atom name
+local AC_PREFIX       = "ac_"  -- arg to MipsAtomComp_(ac_X); the X is the atom name
 local AC_PREFIX_LEN   = 3
-local MAC_PREFIX      = "mac_"       -- prefix on generated macros; the rest is the atom name
+local MAC_PREFIX      = "mac_" -- prefix on generated macros; the rest is the atom name
 local MAC_PREFIX_LEN  = 4
 
 -- ASCII byte values used in tokenization.
@@ -61,6 +63,7 @@ local GEN_SUBDIR      = "gen"
 --- @field text     string  -- the full source text
 --- @field dir      string  -- the directory containing the source
 --- @field basename string  -- filename without extension
+--- @field scan     table   -- pre-scanned SourceScan payload (from duffle.scan_source)
 
 --- @class PassCtx
 --- @field sources            SourceFile[]           -- all source files in the build
@@ -72,7 +75,7 @@ local GEN_SUBDIR      = "gen"
 --- @field upstream           table<string, table>   -- per-pass upstream outputs
 --- @field flags              table                  -- CLI flags
 --- @field dry_run            boolean                -- if true, compute but don't write
---- @field verbose            boolean                -- if true, log diagnostic info
+--- @field verbose            boolean                -- log diagnostic info
 
 --- @class PassResult
 --- @field outputs  table[]  -- {kind=, path=} entries describing emit files
@@ -80,88 +83,48 @@ local GEN_SUBDIR      = "gen"
 --- @field warnings table[]  -- {line=, msg=} entries; build-succeeds
 
 --- @class Component
---- @field name    string        -- atom name (without `ac_` prefix)
---- @field body    string        -- brace-delimited body (without the braces)
---- @field args    string|nil    -- function-args string (function form only)
---- @field line    integer       -- source line of the declaration
---- @field comment string|nil    -- preceding `/* */` or `//` comment block (signature doc)
+--- @field name    string     -- atom name (without `ac_` prefix)
+--- @field body    string     -- brace-delimited body (without the braces)
+--- @field args    string|nil -- function-args string (function form only)
+--- @field line    integer    -- source line of the declaration
+--- @field comment string|nil -- preceding `/* */` or `//` comment block (signature doc)
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Local helpers (file I/O + path normalization)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Write content to disk in binary mode so LF line endings are preserved on Windows 
--- (text mode would convert LF -> CRLF, breaking byte-identical diffs against git-tracked gen/*.macs.h files which are stored as LF).
--- @param path string
--- @param content string
-local function write_file_lf(path, content)
-	local f = io.open(path, "wb")
-	if not f then error("Cannot write " .. path) end
-	f:write(content); f:close()
-end
-
--- Convert a (possibly relative) path to an absolute Windows path. 
--- The pre-rework output's "// Source:" comment line used the absolute path (e.g. "C:\projects\Pikuma\ps1\code\duffle\lottes_tape.h"); 
--- If we want byte-identical output, we must normalize relative -> absolute before emitting that comment.
--- @param path string
--- @return string
-local function to_absolute_path(path)
-	if #path >= 2 and path:sub(2, 2) == ":" then
-		-- Already absolute; normalize slashes for consistency.
-		return (path:gsub("/", "\\"))
-	end
-	local p = io.popen("cd")
-	if not p then return path end
-	local cwd = p:read("*l")
-	p:close()
-	if not cwd then return path end
-	-- Normalize forward slashes to backslashes (Windows convention) on both the cwd AND the relative path tail, so the join is uniform.
-	cwd = cwd:gsub("/", "\\")
-	local tail = (path:gsub("/", "\\"))
-	return cwd .. "\\" .. tail
-end
-
 local M = {}
 
 -- ════════════════════════════════════════════════════════════════════════════
--- Function-args extraction (precedes MipsAtomComp_Proc_ invocations)
+-- Back-walk helpers (composed into the 2 entry points below: find_function_args_for + preceding_comment_block)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Find the LAST occurrence of `name + "("` in `source[1..before_pos]`.
--- Returns the position of the open paren, or nil if not found.
--- @param source string
--- @param name string
--- @param before_pos integer
--- @return integer|nil
-local function find_last_name_open_paren(source, name, before_pos)
-	local search     = source:sub(1, before_pos)
-	local name_open  = name .. "("
-	local last_idx   = nil
-	local scan_pos   = 1
-	while true do
-		local found = search:find(name_open, scan_pos, true)  -- plain (no regex)
-		if not found then break end
-		last_idx = found
-		scan_pos = found + #name_open
-	end
-	return last_idx
-end
-
 --- Find the args of the function declaration that immediately precedes a `MipsAtomComp_Proc_` invocation of the given name.
 --- Returns the args string (e.g., `"U4 off, U4 code, U1 r, U1 g, U1 b"`) or nil if no function declaration is found.
 ---
 --- Convention: function form is
 ---   `FI_ MipsAtom ac_X(args) MipsAtomComp_Proc_(ac_X, { body })`
 --- We find the LAST occurrence of `"ac_X("` before `before_pos` and extract the args from inside the parens.
---- We then verify the preceding context ends with `MipsAtom` (the function-decl keyword
---- with possible qualifiers between).
+--- We then verify the preceding context ends with `MipsAtom`
+--- (the function-decl keyword with possible qualifiers between).
 ---
 --- @param source string
 --- @param name string
 --- @param before_pos integer
 --- @return string|nil
 local function find_function_args_for(source, name, before_pos)
-	local last_idx = find_last_name_open_paren(source, name, before_pos)
+	-- Find the LAST occurrence of `name + "("` in `source[1..before_pos]`.
+	local name_open  = name .. "("
+	local last_idx   = nil
+	local scan_pos   = 1
+	while true do
+		-- Pass `before_pos + 1` so string.find only returns positions < before_pos + 1
+		-- (string.find's 4th arg `plain` is true; we use the 3rd arg `init` for the upper bound).
+		local found = source:find(name_open, scan_pos, true)
+		if not found or found >= before_pos then break end
+		last_idx = found
+		scan_pos = found + #name_open
+	end
 	if not last_idx then return nil end
 
 	-- Verify the preceding context ends with "MipsAtom" (with possible qualifiers between).
@@ -180,100 +143,11 @@ local function find_function_args_for(source, name, before_pos)
 	return inner
 end
 
--- ════════════════════════════════════════════════════════════════════════════
--- Preceding-comment-block extraction
--- ════════════════════════════════════════════════════════════════════════════
-
--- Skip whitespace (space/tab/newline/CR) backward from `pos`, returning the position of the first non-whitespace char.
--- @param source string
--- @param pos integer
--- @return integer
-local function skip_ws_backward(source, pos)
-	local back = pos - 1
-	while back > 0 do
-		local ch = source:sub(back, back)
-		if ch == " " or ch == "\t" or ch == "\n" or ch == "\r" then
-			back = back - 1
-		else
-			break
-		end
-	end
-	return back
-end
-
--- Find the opening `/*` for a block comment whose `*/` ends at `close_pos`.
--- Returns the position of `/`, or nil if not found.
--- @param source string
--- @param close_pos integer  -- position of the closing `*` of `*/`
--- @return integer|nil
-local function find_block_comment_open(source, close_pos)
-	local prefix  = source:sub(1, close_pos - 1)
-	local open_at = nil
-	for scan = #prefix - 1, 1, -1 do
-		if prefix:sub(scan, scan + 1) == "/*" then
-			open_at = scan
-			break
-		end
-	end
-	return open_at
-end
-
--- Walk back from `open_at` over leading spaces + tabs to include the indentation before the `/*` in the captured comment.
--- @param source string
--- @param open_at integer
--- @return integer
-local function extend_left_over_indent(source, open_at)
-	local start = open_at
-	while start > 1 do
-		local ch = source:sub(start - 1, start - 1)
-		if ch == " " or ch == "\t" then
-			start = start - 1
-		else
-			break
-		end
-	end
-	return start
-end
-
--- Walk back from `line_end` to the start of the source line (the most recent `\n` or position 1).
--- @param source string
--- @param line_end integer
--- @return integer
-local function find_line_start(source, line_end)
-	local start = line_end
-	while start > 1 and source:sub(start - 1, start - 1) ~= "\n" do
-		start = start - 1
-	end
-	return start
-end
-
--- (internal) Capture one `/* ... */` block comment whose closing `*/`
--- ends at `close_end_pos`. Returns (block_text, new_scan_pos) where `new_scan_pos`
--- is where to continue scanning for more comments, or nil if no block comment was found.
-local function capture_block_comment(source, close_end_pos)
-	local open_at = find_block_comment_open(source, close_end_pos)
-	if not open_at then return nil end
-	local block_start = extend_left_over_indent(source, open_at)
-	return source:sub(block_start, close_end_pos), block_start
-end
-
--- (internal) Capture one `// ...` line comment ending at `line_end_pos`.
--- Returns (comment_text, new_scan_pos) or nil if the line is not a `//` comment.
-local function capture_line_comment(source, line_end_pos)
-	local line_start = find_line_start(source, line_end_pos)
-	local line       = source:sub(line_start, line_end_pos)
-	if line:sub(1, 2) == "//" then
-		return line, line_start - 1
-	end
-	return nil
-end
-
 --- Find the contiguous comment block immediately preceding `pos` in `source`.
 --- Returns the comment text (with the `/* */` or `//` markers preserved) or an empty string if no comment is adjacent.
 ---
 --- Used to copy signature comments from the source declaration (`MipsAtomComp_` / `MipsAtomComp_Proc_` / function decl)
 --- over to the generated `mac_X` macro, so LSP/IntelliSense displays the args doc.
----
 --- @param source string
 --- @param pos integer
 --- @return string
@@ -281,22 +155,59 @@ local function preceding_comment_block(source, pos)
 	local scan_pos = pos
 	local pieces   = {}
 	while true do
-		local non_ws = skip_ws_backward(source, scan_pos)
+		-- Skip whitespace (space/tab/newline/CR) backward from `scan_pos`,
+		-- returning the position of the first non-whitespace char.
+		local non_ws = scan_pos - 1
+		while non_ws > 0 do
+			local ch = source:sub(non_ws, non_ws)
+			if ch == " " or ch == "\t" or ch == "\n" or ch == "\r" then
+				non_ws = non_ws - 1
+			else
+				break
+			end
+		end
 		if non_ws == 0 then break end
 
 		local is_block_close = non_ws >= 2 and source:sub(non_ws - 1, non_ws) == "*/"
 		local is_line_end    = source:sub(non_ws, non_ws) == "\n" or source:sub(non_ws, non_ws) == "\r"
 
 		if is_block_close then
-			local block_text, new_scan_pos = capture_block_comment(source, non_ws)
-			if not block_text then break end
-			table.insert(pieces, 1, block_text)
-			scan_pos = new_scan_pos
+			-- Find the opening `/*` for a block comment whose `*/` ends at `non_ws`.
+			-- Walk back from `non_ws` over `/*` candidates.
+			local prefix  = source:sub(1, non_ws - 1)
+			local open_at = nil
+			for scan = #prefix - 1, 1, -1 do
+				if prefix:sub(scan, scan + 1) == "/*" then
+					open_at = scan
+					break
+				end
+			end
+			if not open_at then break end
+			-- Walk back from `open_at` over leading spaces + tabs to include the indentation before the `/*`.
+			local block_start = open_at
+			while block_start > 1 do
+				local ch = source:sub(block_start - 1, block_start - 1)
+				if ch == " " or ch == "\t" then
+					block_start = block_start - 1
+				else
+					break
+				end
+			end
+			table.insert(pieces, 1, source:sub(block_start, non_ws))
+			scan_pos = block_start
 		elseif is_line_end then
-			local line_text, new_scan_pos = capture_line_comment(source, non_ws)
-			if not line_text then break end
-			table.insert(pieces, 1, line_text)
-			scan_pos = new_scan_pos
+			-- Walk back from `non_ws` to the start of the source line (the most recent `\n` or position 1).
+			local line_start = non_ws
+			while line_start > 1 and source:sub(line_start - 1, line_start - 1) ~= "\n" do
+				line_start = line_start - 1
+			end
+			local line = source:sub(line_start, non_ws)
+			if line:sub(1, 2) == "//" then
+				table.insert(pieces, 1, line)
+				scan_pos = line_start - 1
+			else
+				break
+			end
 		else
 			break
 		end
@@ -309,49 +220,10 @@ end
 -- Argument-name extraction
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Walk `trimmed` backward from `pos` over trailing whitespace / asterisks / brackets, returning the position of the first
--- non-trailer character (i.e. the end of the identifier).
--- @param trimmed string
--- @param pos integer
--- @return integer
-local function trim_trailer_back(trimmed, pos)
-	local back = pos
-	while back > 0 do
-		local ch = trimmed:sub(back, back)
-		if ch == " " or ch == "\t" or ch == "*" or ch == "]" or ch == "[" then
-			back = back - 1
-		else
-			break
-		end
-	end
-	return back
-end
-
--- Walk `trimmed` backward from `pos` over identifier chars (alnum + `_`),
--- returning the position just before the identifier starts.
--- @param trimmed string
--- @param pos integer
--- @return integer
-local function trim_ident_back(trimmed, pos)
-	local back = pos
-	while back > 0 do
-		local ch = trimmed:sub(back, back)
-		if duffle.is_alnum(ch) or ch == "_" then
-			back = back - 1
-		else
-			break
-		end
-	end
-	return back
-end
-
 --- Extract just the parameter NAMES from a function-args string (stripping type annotations). E.g.,
 ---   `"U4 off, U4 code, U1 r, U1 g, U1 b"`  ->  `{"off", "code", "r", "g", "b"}`
 ---   `"U4 *ptr"`                            ->  `{"ptr"}`
 ---   `""`                                   ->  nil
----
---- No regex — uses `duffle.is_alnum` + plain string ops.
----
 --- @param args_str string|nil
 --- @return string[]|nil
 local function extract_arg_names(args_str)
@@ -361,8 +233,28 @@ local function extract_arg_names(args_str)
 	for _, tok in ipairs(tokens) do
 		local trimmed = duffle.trim(tok)
 		if trimmed ~= "" then
-			local ident_end = trim_trailer_back(trimmed, #trimmed)
-			local ident_start = trim_ident_back(trimmed, ident_end) + 1
+			-- Find the identifier at the end: walk back over trailers (whitespace + `*` + `[]`),
+			-- then walk back over the identifier chars (alnum + `_`).
+			-- Plex: inlined the 2 single-caller helpers (no 2-caller rule met).
+			local ident_end = #trimmed
+			while ident_end > 0 do
+				local ch = trimmed:sub(ident_end, ident_end)
+				if ch == " " or ch == "\t" or ch == "*" or ch == "]" or ch == "[" then
+					ident_end = ident_end - 1
+				else
+					break
+				end
+			end
+			local ident_start = ident_end
+			while ident_start > 0 do
+				local ch = trimmed:sub(ident_start, ident_start)
+				if duffle.is_alnum(ch) or ch == "_" then
+					ident_start = ident_start - 1
+				else
+					break
+				end
+			end
+			ident_start = ident_start + 1
 			local name = trimmed:sub(ident_start, ident_end)
 			if name ~= "" then names[#names + 1] = name end
 		end
@@ -372,122 +264,30 @@ local function extract_arg_names(args_str)
 end
 
 -- ════════════════════════════════════════════════════════════════════════════
--- Component scanner (bare + function forms)
+-- Component projection (read from pre-scanned SourceScan)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Parse the inner content of an `AtomComp_(name, ...)` call. 
--- Returns (name, body_or_nil) — `body_or_nil` is non-nil iff this is the function-form `MipsAtomComp_Proc_(name, { body })` invocation.
--- @param inner string  -- the content between ( and ) of the AtomComp_ call
---- @return string|nil, string|nil
-local function parse_atomcomp_inner(inner)
-	local tokens = duffle.split_top_level_commas(inner)
-	if #tokens == 1 then
-		return duffle.trim(tokens[1]), nil
-	elseif #tokens == 2 then
-		local name     = duffle.trim(tokens[1])
-		local body_raw = duffle.trim(tokens[2])
-		-- Strip leading { and trailing } if present.
-		local body
-		if #body_raw >= 2 and body_raw:sub(1, 1) == "{" and body_raw:sub(-1) == "}" then
-			body = duffle.trim(body_raw:sub(2, -2))
-		else
-			body = body_raw
-		end
-		return name, body
-	end
-	return nil, nil
-end
-
--- (internal) Try to extract a bare-form `MipsAtomComp_(ac_X)` declaration.
--- Bare form: `MipsAtomComp_(ac_X) { body }` — body comes from the brace block AFTER the parens.
--- @param source string
--- @param name string      -- the `ac_X` ident from the parens
---- @param ident_pos integer -- position of the `MipsAtomComp_` ident start
---- @param after_paren integer -- position just past the closing `)`
---- @param line_of fun(pos: integer): integer
---- @param args string|nil  -- function-args from preceding function decl
---- @param comment string   -- preceding comment block
---- @return Component|nil, integer  -- the component + new source position
-local function make_bare_component(source, name, ident_pos, after_paren, line_of, args, comment)
-	local brace = duffle.scan_to_char(source, "{", after_paren)
-	-- scan: <ident>(<name>) {
-	if not brace then return nil, after_paren + 1 end
-	local body, after_brace = duffle.read_braces(source, brace)
-	-- scan: <ident>(<name>) { <body> }
-	return {
-		line    = line_of(ident_pos),
-		name    = name:sub(AC_PREFIX_LEN + 1),  -- strip "ac_" prefix
-		body    = body,
-		args    = args,
-		comment = comment,
-	}, after_brace
-end
-
--- (internal) Build the function-form `MipsAtomComp_Proc_` component. Body
--- came from inside the parens; no following brace block.
-local function make_proc_component(name, body, ident_pos, line_of, args, comment)
-	return {
-		line    = line_of(ident_pos),
-		name    = name:sub(AC_PREFIX_LEN + 1),
-		body    = body,
-		args    = args,
-		comment = comment,
-	}
-end
-
---- Find every `MipsAtomComp_(ac_<X>) { body }` declaration in source.
---- Supports BOTH the bare form and the function form:
----   Bare:      `MipsAtomComp_(ac_X) { body }`
----   Function:  `MipsAtomComp_Proc_(ac_X, { body })`  (with a preceding
----              `"FI_ MipsAtom ac_X(args)"` function declaration)
----
---- @param source string
---- @return Component[]
-local function find_component_atoms(source)
-	local line_of = duffle.LineIndex(source)
-	local out     = {}
-	local pos     = 1
-	local src_len = #source
-	while pos <= src_len do
-		pos = duffle.skip_ws_and_cmt(source, pos)
-		if pos > src_len then break end
-
-		local ident, after_ident = duffle.read_ident(source, pos)
-		-- scan: <ident>
-		local is_comp = ident == ATOM_COMP or ident == ATOM_COMP_PROC
-		if not ident then
-			pos = pos + 1
-		elseif not is_comp then
-			pos = after_ident
-		else
-			local open_paren = duffle.skip_ws_and_cmt(source, after_ident)
-			if source:sub(open_paren, open_paren) ~= "(" then
-				pos = open_paren + 1
-			else
-				local inner, after_paren = duffle.read_parens(source, open_paren)
-				-- scan: <ident>(<args>)
-				local name, body = parse_atomcomp_inner(inner)
-				-- scan: <ident>(<name>)  OR  <ident>(<name>, { <body> })
-				if not name or name:sub(1, AC_PREFIX_LEN) ~= AC_PREFIX then
-					pos = open_paren + 1
-				else
-					local args    = find_function_args_for(source, name, open_paren)
-					local comment = preceding_comment_block(source, pos)
-					if body == nil then
-						-- Bare form: body comes from the brace block after the parens.
-						-- scan: <ident>(<name>) {
-						local comp, new_pos = make_bare_component(source, name, pos, after_paren, line_of, args, comment)
-						-- scan: <ident>(<name>) { <body> }
-						if comp then out[#out + 1] = comp end
-						pos = new_pos
-					else
-						-- Function form: body was inside the parens.
-						-- scan: <ident>(<name>, { <body> })
-						out[#out + 1] = make_proc_component(name, body, pos, line_of, args, comment)
-						pos = after_paren
-					end
-				end
-			end
+-- Project pre-scanned MipsAtomComp_ / MipsAtomComp_Proc_ entries into Component shape.
+-- Does per-source backward lookups for args (preceding function decl) and comment (preceding comment block).
+-- Carries `body_tokens` forward from scan-source so word_count_rec reads from the precomputed table instead of calling duffle.tokenize_body again.
+-- @param source string  -- the full source text (needed for backward lookups)
+-- @param scan  table   -- SourceScan from duffle.scan_source
+-- @return Component[]
+local function project_components(source, scan)
+	local out = {}
+	for _, a in ipairs(scan.atoms) do
+		if a.kind == "comp_bare" or a.kind == "comp_proc" then
+			local args    = find_function_args_for(source, a.raw_name, a.ident_pos)
+			local comment = preceding_comment_block(source, a.ident_pos)
+			out[#out + 1] = {
+				line        = a.line,
+				name        = a.name,
+				body        = a.body,
+				body_tokens = a.body_tokens,
+				args        = args,
+				comment     = comment,
+				kind        = a.kind,  -- "comp_bare" | "comp_proc"; provenance emitter reads this.
+			}
 		end
 	end
 	return out
@@ -498,8 +298,7 @@ end
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Convert `//` line comments to `/* */` block comments in a token.
---
--- C macros use `\` line-continuations; a `//` comment before `\` would consume the continuation, 
+-- C macros use `\` line-continuations; a `//` comment before `\` would consume the continuation,
 -- breaking the macro. We convert `//` to `/* */` so the multi-line macro structure is preserved.
 --
 -- Skips `//` sequences that are inside string or character literals
@@ -522,8 +321,8 @@ local function convert_line_comments_to_block(s)
 			while eol <= len and result:byte(eol) ~= BYTE_NEWLINE do
 				eol = eol + 1
 			end
-			local before   = result:sub(1, pos - 1)
-			local comment  = result:sub(pos + 2, eol - 1)  -- skip the `//`
+			local before  = result:sub(1, pos - 1)
+			local comment = result:sub(pos + 2, eol - 1)  -- skip the `//`
 			local after
 			if eol <= len and result:byte(eol) == BYTE_NEWLINE then
 				after = " */" .. result:sub(eol)  -- keep the newline
@@ -541,8 +340,9 @@ end
 -- Word-count computation (memoized recursive lookup)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Strip the `mac_` prefix from a component-call ident so we can look it up against the components-by-name table. Returns the ident unchanged
--- if it doesn't start with the prefix (so a non-component ident like `mask_upper` falls through to the wc-table branch).
+-- Strip the `mac_` prefix from a component-call ident so we can look it up against the components-by-name table. 
+-- Returns the ident unchanged if it doesn't start with the prefix 
+-- (so a non-component ident like `mask_upper` falls through to the wc-table branch).
 -- @param ident string|nil
 -- @return string|nil
 local function strip_mac_prefix(ident)
@@ -553,8 +353,8 @@ local function strip_mac_prefix(ident)
 	return ident
 end
 
--- (internal) Recursive word-count lookup. `cache` is the memoization table across all calls to `compute_component_word_count`; 
--- the in-progress -1 sentinel detects cycles (A -> B -> A).
+-- (internal) Recursive word-count lookup. `cache` is the memoization table shared across all components
+-- in a single source's `count_all_components` pass; the in-progress -1 sentinel detects cycles (A -> B -> A).
 -- @param name string -- the component name (without `mac_`)
 -- @param comp_by_name table<string, Component>
 -- @param wc table<string, integer>
@@ -567,8 +367,9 @@ local function word_count_rec(name, comp_by_name, wc, cache)
 	local n
 	if cc then
 		n = 0
-		for _, t in ipairs(duffle.split_top_level_commas(cc.body)) do
-			local trimmed = duffle.trim(t)
+		local tokens = cc.body_tokens
+		for _, t in ipairs(tokens) do
+			local trimmed = t.tok
 			if trimmed ~= "" then
 				local lookup = strip_mac_prefix(duffle.read_ident(trimmed, 1))
 				if lookup and comp_by_name[lookup] then
@@ -591,25 +392,23 @@ local function word_count_rec(name, comp_by_name, wc, cache)
 	return n
 end
 
---- Compute the word count of a component body, accounting for macro expansion.
---- Each comma-separated entry in the body is a "slot" that contributes its own word count.
---- For most entries (regular MIPS instructions) the count is 1. 
---- For `mac_Y(...)` calls, the count is the word count of `mac_Y` (recursive lookup through `components`).
---- For encoding macros with a known multi-word count (e.g. `mask_upper` = 2),
---- the count is taken from `word_counts`.
----
---- The lookup is memoized via `word_count_rec` to avoid infinite recursion (e.g. if two components referenced each other).
---- This is the same algorithm as the original `tape_atom_annotation_pass.lua` (commit 7d20a4d).
----
---- @param c Component
+--- Compute word counts for every component in `components` in a single pass.
+--- The name-lookup table + memoization cache are built ONCE (per source) instead of per-component,
+--- so the cache survives across siblings and a component's recursive `mac_Y(...)` 
+--- references hit memoized values instead of re-walking the body.
+--- Cycle detection (A -> B -> A) is preserved via the in-progress `-1` sentinel in `cache`.
 --- @param components Component[]
 --- @param wc table<string, integer>
---- @return integer
-local function compute_component_word_count(c, components, wc)
+--- @return table<string, integer>  -- map of component name (without `mac_`) -> word count
+local function count_all_components(components, wc)
 	local comp_by_name = {}
 	for _, cc in ipairs(components) do comp_by_name[cc.name] = cc end
-	local cache = {}
-	return word_count_rec(c.name, comp_by_name, wc, cache)
+	local cache        = {}
+	local counts       = {}
+	for _, c in ipairs(components) do
+		counts[c.name] = word_count_rec(c.name, comp_by_name, wc, cache)
+	end
+	return counts
 end
 
 -- ════════════════════════════════════════════════════════════════════════════
@@ -636,24 +435,12 @@ local function split_comment_lines(s)
 	return out
 end
 
---- Split an atom body by top-level commas; drop empty tokens.
---- @param body string
---- @return string[]
-local function tokens_from_body(body)
-	local out = {}
-	for _, t in ipairs(duffle.split_top_level_commas(body)) do
-		local trimmed = duffle.trim(t)
-		if trimmed ~= "" then out[#out + 1] = trimmed end
-	end
-	return out
-end
-
 --- Determine the macro signature: function-args list (function form) or variadic-ignored (bare form).
 --- @param args_str string|nil
 --- @return string
 local function signature_from_args(args_str)
 	local arg_names = extract_arg_names(args_str)
-	if arg_names and #arg_names > 0 then
+	if    arg_names and #arg_names > 0 then
 		return table.concat(arg_names, ", ")
 	end
 	return "..."
@@ -663,7 +450,7 @@ end
 --- The last 2 chars are always that pair.
 local function strip_trailing_continuation(lines)
 	local last = lines[#lines]
-	if last:sub(-2) == " \\" then
+	if    last:sub(-2) == " \\" then
 		lines[#lines] = last:sub(1, -3)
 	end
 end
@@ -682,13 +469,13 @@ local function emit_macro_body(lines, c, sig, tokens)
 	strip_trailing_continuation(lines)
 end
 
---- Build the list of lines for one component 
+--- Build the list of lines for one component
 --- (signature comment, `#define mac_X(...)` line with backslash-continued tokens, then `WORD_COUNT(mac_X, N)` entry).
 --- @param c Component
 --- @param components Component[]
 --- @param wc table<string, integer>
 --- @return string[]  -- list of lines for this component
-local function build_component_lines(c, components, wc)
+local function build_component_lines(c, counts)
 	local lines = {}
 
 	if c.comment and c.comment ~= "" then
@@ -697,9 +484,11 @@ local function build_component_lines(c, components, wc)
 		end
 	end
 
-	local tokens = tokens_from_body(c.body)
+	local tokens = duffle.split_top_level_commas(c.body)
+	for i = 1, #tokens do tokens[i] = duffle.trim(tokens[i]) end
 	local sig    = signature_from_args(c.args)
-	local n      = compute_component_word_count(c, components, wc)
+	-- Direct lookup against the per-source precomputed `counts` table (built once by count_all_components).
+	local n      = counts[c.name]
 
 	if n > 0 then
 		emit_macro_body(lines, c, sig, tokens)
@@ -716,24 +505,24 @@ end
 -- Per-source emit logic
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Build the boilerplate header lines (the `#ifdef INTELLISENSE_DIRECTIVES` block, 
+-- Build the boilerplate header lines (the `#ifdef INTELLISENSE_DIRECTIVES` block,
 -- the `// Auto-generated` comment, the `// Source:` line, and the self-contained `WORD_COUNT` macro definition).
 -- @param src SourceFile
 -- @return string[]
 local function header_boilerplate(src)
 	return {
-		-- #pragma once wrapped in #ifdef INTELLISENSE_DIRECTIVES, matching the convention in lottes_tape.h.  
+		-- #pragma once wrapped in #ifdef INTELLISENSE_DIRECTIVES, matching the convention in lottes_tape.h.
 		-- The build does manual unity includes (the user controls include order), so the pragma is only active for IDE/tooling.
 		"#ifdef INTELLISENSE_DIRECTIVES",
 		"#pragma once",
 		"#endif",
-		"// Auto-generated by tape_atom_annotation_pass.lua — DO NOT EDIT",
-		"// Source: " .. to_absolute_path(src.path),
+		"// Auto-generated by ps1_meta.lua — DO NOT EDIT",
+		"// Source: " .. duffle.to_absolute_path(src.path),
 		"// Component atoms (MipsAtomComp_(ac_*)) -> macro variants (mac_*)",
 		"",
 		-- Self-contained: define WORD_COUNT if not already defined.
-		-- We use the same definition here so the auto-generated entries below expand to compile-time constants whether
-		-- the metadata file is included first or not.
+		-- We use the same definition here so the auto-generated entries below expand
+		-- to compile-time constants whether the metadata file is included first or not.
 		"#ifndef WORD_COUNT",
 		"#define WORD_COUNT(name, count)  enum { words_##name = (count) };",
 		"#endif",
@@ -742,49 +531,45 @@ local function header_boilerplate(src)
 end
 
 -- Compute the output path for one source's `.macs.h` file.
--- The pre-rework convention uses the *directory* basename 
--- (not the source file basename) — e.g. `code/duffle/lottes_tape.h` produces `code/duffle/gen/duffle.macs.h`. 
+-- The pre-rework convention uses the *directory* basename
+-- (not the source file basename) e.g. `code/duffle/lottes_tape.h` produces `code/duffle/gen/duffle.macs.h`.
 -- This matches what the C codebase #includes.
 -- @param src SourceFile
 -- @return string  -- the output directory
 -- @return string  -- the full output path
 local function compute_macs_h_path(src)
-	local out_dir  = src.dir .. "/" .. GEN_SUBDIR
-	local out_path = out_dir .. "/" .. duffle.basename_no_ext(src.dir) .. ".macs.h"
+	local  out_dir  = src.dir .. "/" .. GEN_SUBDIR
+	local  out_path = out_dir .. "/" .. duffle.basename_no_ext(src.dir) .. ".macs.h"
 	return out_dir, out_path
 end
 
---- Emit a per-source `.macs.h` header with the `mac_X` macros + `WORD_COUNT` entries. Writes in BINARY mode so LF line endings are
---- preserved (the git blob is LF; Windows text-mode would emit CRLF and break the byte-identical diff).
----
+--- Emit a per-source `.macs.h` header with the `mac_X` macros + `WORD_COUNT` entries. 
+--- Writes in BINARY mode so LF line endings are preserved (the git blob is LF; Windows text-mode would emit CRLF and break the byte-identical diff).
 --- Honors `ctx.dry_run`: prints the intended path but does not write the file.
----
 --- @param ctx PassCtx
 --- @param src SourceFile
 --- @param components Component[]
+--- @param counts table<string, integer>  -- precomputed word counts (from count_all_components)
 --- @return string|nil  -- path to the written file (nil if no components)
-local function emit_component_macros_h(ctx, src, components)
+local function emit_component_macros_h(ctx, src, components, counts)
 	if #components == 0 then return nil end
-
 	local out_dir, out_path = compute_macs_h_path(src)
 	local lines             = header_boilerplate(src)
 
-	local wc = ctx.shared.word_counts
 	for _, c in ipairs(components) do
-		for _, l in ipairs(build_component_lines(c, components, wc)) do
+		for _, l in ipairs(build_component_lines(c, counts)) do
 			lines[#lines + 1] = l
 		end
 	end
 
 	local content = table.concat(lines, "\n") .. "\n"
-
 	if ctx.dry_run then
 		print(string.format("  -> %s (dry-run)", out_path))
 		return out_path
 	end
 
 	duffle.ensure_dir(out_dir)
-	write_file_lf(out_path, content)
+	duffle.write_file_lf(out_path, content)
 	print(string.format("  -> %s", out_path))
 	return out_path
 end
@@ -793,14 +578,41 @@ end
 -- Pass entry
 -- ════════════════════════════════════════════════════════════════════════════
 
--- (internal) Extend `ctx.shared.word_counts` with this source's component macros 
--- so offsets sees them without re-reading the file.
+-- (internal) Extend `ctx.shared.word_counts` with this source's component macros so offsets sees them without re-reading the file.
 -- @param ctx PassCtx
 -- @param components Component[]
-local function update_shared_word_counts(ctx, components)
+-- @param counts table<string, integer>  -- precomputed word counts (from count_all_components)
+local function update_shared_word_counts(ctx, components, counts)
 	local wc = ctx.shared.word_counts
 	for _, c in ipairs(components) do
-		wc["mac_" .. c.name] = compute_component_word_count(c, components, wc)
+		wc["mac_" .. c.name] = counts[c.name]
+	end
+end
+
+--- @class ComponentDef
+--- @field name    string  -- bare name (without ac_/mac_ prefix)
+--- @field line    integer -- definition source line (line of `MipsAtomComp_(ac_X)` / `MipsAtomComp_Proc_(ac_X, ...)`)
+--- @field path    string  -- absolute source path of the definition
+--- @field kind    string  -- "comp_bare" | "comp_proc"
+
+--- (internal) Extend `ctx.shared.components` with this source's components-by-name map so downstream passes
+--- (atoms_source_map, dwarf_injection) can resolve `mac_X(...)` invocations back to their component definition file:line.
+--- provenance emission uses this to attribute each emitted `.word` to either a component macro or the enclosing atom body.
+-- @param ctx PassCtx
+-- @param src SourceFile
+-- @param components Component[]
+local function update_shared_components(ctx, src, components)
+	ctx.shared.components         = ctx.shared.components or {}
+	local rel_path = src.path:gsub("\\", "/")
+	for _, c in ipairs(components) do
+		-- Keyed by bare name (e.g. `yield`, `load_tri_indices`). 
+		-- The atoms_source_map pass strips the `mac_` prefix from the call site identifier before lookup.
+		ctx.shared.components[c.name] = {
+			name = c.name,
+			line = c.line,
+			path = rel_path,
+			kind = c.kind or "comp_bare",
+		}
 	end
 end
 
@@ -811,14 +623,24 @@ function M.run(ctx)
 	local errors   = {}
 	local warnings = {}
 
+	-- Initialize shared component map.
+	-- The atoms_source_map and dwarf_injection passes consume `ctx.shared.components` to resolve `mac_X(...)` 
+	-- invocations back to the component's definition file:line.
+	ctx.shared.components = ctx.shared.components or {}
+
 	for _, src in ipairs(ctx.sources) do
-		-- find_component_atoms operates on src.text
-		local components = find_component_atoms(src.text)
+		-- project_components reads from src.scan + does backward lookups on src.text
+		local components = project_components(src.text, src.scan)
 		if #components > 0 then
-			local macs_path = emit_component_macros_h(ctx, src, components)
+			-- Compute word counts for ALL components once (was: rebuilt per call inside the helpers).
+			local counts = count_all_components(components, ctx.shared.word_counts)
+			local macs_path = emit_component_macros_h(ctx, src, components, counts)
 			if macs_path then
 				outputs[#outputs + 1] = { macs_h = macs_path }
-				update_shared_word_counts(ctx, components)
+				update_shared_word_counts(ctx, components, counts)
+				-- share component definitions with downstream passes.
+				-- `mac_X(...)` invocations in atom bodies resolve back to (path, line) via this map.
+				update_shared_components(ctx, src, components)
 			end
 		end
 	end

scripts/passes/offsets.lua

@@ -1,8 +1,9 @@
 --- passes/offsets.lua — Branch-offset generator.
 ---
---- Scans every source for `MipsAtom_(name) { ... }` (and the raw `MipsCode code_<name> { ... }` form) declarations, 
---- computes the word offset from each `atom_offset(F, T)` marker to its target `atom_label(T)` declaration, 
---- and emits `<dir_basename>.offsets.h` with one `#define _atom_offset_F_T = N` per branch.
+--- Reads the pre-scanned SourceScan payload (produced once upstream by `duffle.scan_source`)
+--- for `MipsAtom_(name)` and `MipsCode code_<name>` declarations, computes the word offset
+--- from each `atom_offset(F, T)` marker to its target `atom_label(T)` declaration, and emits
+--- `<dir_basename>.offsets.h` with one `#define _atom_offset_F_T = N` per branch.
 ---
 --- The offset is `target_word - branch_word - 1` (the standard MIPS branch-immediate encoding: branch_offset = relative_pc_in_words - 1).
 ---
@@ -13,15 +14,14 @@
 -- Module-scope requires + package.path setup
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Resolve `arg[0]` to an absolute-ish script directory so that `require("duffle")` resolves against `scripts/` regardless of CWD.
--- Bootstrap: see `ps1_meta.lua` for the rationale.
+-- Bootstrap: same as entry scripts. See `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
 -- Uses `debug.getinfo` to find this file's own directory, so it works
 -- both standalone and when require'd from the orchestrator.
-local _src = debug.getinfo(1, "S").source:sub(2)
-local _dir = _src:match("(.*[/\\])") or "./"
-dofile(_dir .. "../duffle_paths.lua")
-local duffle = require("duffle")
+-- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` (works both standalone + when require'd).
+-- duffle_paths.lua sets package.path then returns `require("duffle")` at the bottom, so the dofile value IS the duffle module.
+local _bootstrap_dir = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
+local duffle        = dofile(_bootstrap_dir .. "../duffle_paths.lua")
 local word_count_eval = require("word_count_eval")
 local count_token_words = word_count_eval.count_token_words
 
@@ -29,21 +29,6 @@ local count_token_words = word_count_eval.count_token_words
 -- Constants
 -- ════════════════════════════════════════════════════════════════════════════
 
--- C qualifier keywords that may precede a `MipsAtom_` declaration
--- (and should be skipped by `skip_qualifiers`).
-local QUALIFIER_KEYWORDS = {
-	["static"]   = true, ["const"]    = true, ["volatile"] = true,
-	["extern"]   = true, ["register"] = true, ["auto"]     = true,
-	["inline"]   = true, ["typedef"]  = true,
-	["internal"] = true, ["LP_"]      = true, ["global"]   = true, ["gkknown"] = true,
-}
-
--- Atom declaration identifiers.
-local ATOM_PREFIX       = "MipsAtom_"
-local CODE_DECL         = "MipsCode"
-local CODE_RAW_PREFIX   = "code_"   -- raw atom form: `MipsCode code_<name> { ... }`
-local CODE_RAW_PREFIX_LEN = 5       -- = #CODE_RAW_PREFIX
-
 -- Marker-call identifiers inside atom bodies.
 local LABEL_MARKER    = "atom_label"
 local OFFSET_MARKER   = "atom_offset"
@@ -64,6 +49,7 @@ local OFFSET_MACRO_COL = 44
 --- @field text     string  -- the full source text
 --- @field dir      string  -- the directory containing the source
 --- @field basename string  -- filename without extension
+--- @field scan     table   -- pre-scanned SourceScan payload (from duffle.scan_source)
 
 --- @class PassCtx
 --- @field sources            SourceFile[]           -- all source files in the build
@@ -75,17 +61,13 @@ local OFFSET_MACRO_COL = 44
 --- @field upstream           table<string, table>   -- per-pass upstream outputs
 --- @field flags              table                  -- CLI flags
 --- @field dry_run            boolean                -- if true, compute but don't write
---- @field verbose            boolean                -- if true, log diagnostic info
+--- @field verbose            boolean                -- log diagnostic info
 
 --- @class PassResult
 --- @field outputs  table[]  -- {kind=, path=} entries describing emit files
 --- @field errors   table[]  -- {line=, msg=} entries; build-stops
 --- @field warnings table[]  -- {line=, msg=} entries; build-succeeds
 
---- @class Atom
---- @field name string  -- atom name (e.g. "cube_g4_face")
---- @field body string  -- the brace-delimited body (without the braces)
-
 --- @class BranchOffset
 --- @field tag    string   -- the marker tag (e.g. "F" in `atom_offset(F, T)`)
 --- @field target string   -- the target label name (e.g. "T" in `atom_offset(F, T)`)
@@ -98,44 +80,7 @@ local OFFSET_MACRO_COL = 44
 --- @field offsets     BranchOffset[] -- per-branch offset list
 
 -- ════════════════════════════════════════════════════════════════════════════
--- Local helpers
--- ════════════════════════════════════════════════════════════════════════════
-
--- Returns true if `s` starts with `prefix`.
--- @param s string
--- @param prefix string
--- @return boolean
-local function starts_with(s, prefix)
-	if #s < #prefix then return false end
-	for pos = 1, #prefix do
-		if s:sub(pos, pos) ~= prefix:sub(pos, pos) then return false end
-	end
-	return true
-end
-
--- Replace every non-alphanumeric char in `s` with underscore.
--- @param s string
--- @return string
-local function to_alnum_underscore(s)
-	local out = ""
-	for pos = 1, #s do
-		local ch = s:sub(pos, pos)
-		if duffle.is_alnum(ch) then out = out .. ch else out = out .. "_" end
-	end
-	return out
-end
-
--- Right-pad `s` with spaces to width `w`. If `s` is already `w` or
--- wider, no padding is added.
--- @param s string
--- @param w integer
--- @return string
-local function pad_right(s, w)
-	return s .. string.rep(" ", math.max(0, w - #s))
-end
-
--- ════════════════════════════════════════════════════════════════════════════
--- Marker-call helpers
+-- Per-token marker-call helpers (atom_label / atom_offset inside bodies)
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Extract comma-separated identifier args from a parenthesized group after a function-like macro call.
@@ -187,6 +132,14 @@ local function record_offset_marker(branches, args, at_pos)
 	end
 end
 
+-- MARKER_TO_HANDLER — data-driven marker dispatch (the plex pattern).
+-- Maps the marker ident to its recorder function. Each handler takes (out_table, args, at_pos).
+-- Adding a new marker type = 1 row + 1 recorder function.
+local MARKER_TO_HANDLER = {
+	[LABEL_MARKER]  = record_label_marker,
+	[OFFSET_MARKER] = record_offset_marker,
+}
+
 --- Scan a single token for atom_label/atom_offset markers, walking through balanced groups transparently (so nested calls are found).
 --- @param token string
 --- @param at_pos integer    -- the branch-free word position of this token in the body
@@ -201,13 +154,13 @@ local function scan_for_atom_markers(token, at_pos, labels, branches)
 		local ch = token:sub(pos, pos)
 		if duffle.is_alpha(ch) then
 			local ident, after = duffle.read_ident(token, pos)
-			if ident == LABEL_MARKER then
+			local handler = MARKER_TO_HANDLER[ident]
+			if handler then
 				local args, after_paren = extract_ident_args(token, after)
-				record_label_marker(labels, args, at_pos)
-				pos = after_paren or after
-			elseif ident == OFFSET_MARKER then
-				local args, after_paren = extract_ident_args(token, after)
-				record_offset_marker(branches, args, at_pos)
+				-- Marker found — dispatch to its recorder. markers share labels and branches as
+				-- out-tables; the recorder picks which one(s) to write to based on its semantics.
+				-- (record_label_marker writes to labels; record_offset_marker writes to branches.)
+				handler(ident == LABEL_MARKER and labels or branches, args, at_pos)
 				pos = after_paren or after
 			else
 				pos = after
@@ -219,190 +172,26 @@ local function scan_for_atom_markers(token, at_pos, labels, branches)
 	end
 end
 
---- Find the end position (just past the closing ')') of the first atom_label/atom_offset call in `tok`. Returns 0 if no such call.
---- @param tok string
---- @return integer  -- 0 if no marker call found; otherwise end-1 (just past ')')
-local function find_marker_call_end(tok)
-	local pos     = 1
-	local tok_len = #tok
-	while pos <= tok_len do
-		pos = duffle.skip_ws_and_cmt(tok, pos)
-		if pos > tok_len then break end
-		local ch = tok:sub(pos, pos)
-		if duffle.is_space(ch) then
-			pos = pos + 1
-		elseif ch == "/" then
-			-- comment — skip past it (delegated to duffle.skip_str_or_cmt)
-			local nx = duffle.skip_str_or_cmt(tok, pos)
-			pos = (nx > pos) and nx or (pos + 1)
-		else
-			local ident, after_ident = duffle.read_ident(tok, pos)
-			-- scan: <ident>
-			if ident == LABEL_MARKER or ident == OFFSET_MARKER then
-				-- scan: atom_label(<name>)  OR  atom_offset(<tag>, <target>)
-				local open_paren = duffle.skip_ws_and_cmt(tok, after_ident)
-				if tok:sub(open_paren, open_paren) == "(" then
-					local _, end_paren = duffle.read_parens(tok, open_paren)
-					return end_paren - 1
-				end
-				return 0
-			end
-			pos = after_ident or (pos + 1)
-		end
-	end
-	return 0
-end
-
--- ════════════════════════════════════════════════════════════════════════════
--- Atom scanner
--- ════════════════════════════════════════════════════════════════════════════
-
---- Skip C qualifier keywords (`static`, `const`, etc.) and return the position past the last qualifier.
---- @param source string
---- @param pos integer
---- @return integer
-local function skip_qualifiers(source, pos)
-	while true do
-		pos = duffle.skip_ws_and_cmt(source, pos)
-		local ident, after = duffle.read_ident(source, pos)
-		if not ident           then return pos end
-		if QUALIFIER_KEYWORDS[ident] then pos = after else return pos end
-	end
-end
-
--- (internal) Try to parse the wrapped atom form: `MipsAtom_(<name>) { ... }`.
--- Returns the parsed Atom (name + body + position past body), or nil if the form didn't match.
--- @param source_text string
--- @param after_pos integer   -- position just past `MipsAtom_`
--- @return Atom|nil
-local function try_wrapped_atom(source_text, after_pos)
-	local paren_pos = duffle.skip_ws_and_cmt(source_text, after_pos)
-	if source_text:sub(paren_pos, paren_pos) ~= "(" then return nil end
-	local inner, after_paren = duffle.read_parens(source_text, paren_pos)
-	-- scan: MipsAtom_(<name>)
-
-	local name_start = 1
-	while name_start <= #inner and duffle.is_space(inner:sub(name_start, name_start)) do
-		name_start = name_start + 1
-	end
-	local name_end = name_start
-	while name_end <= #inner and duffle.is_alnum(inner:sub(name_end, name_end)) do
-		name_end = name_end + 1
-	end
-	local name = inner:sub(name_start, name_end - 1)
-	if    name == "" then return nil end
-
-	local  brace_pos = duffle.scan_to_char(source_text, "{", after_paren)
-	-- scan: MipsAtom_(<name>) {
-	if not brace_pos then return nil end
-	local body, after_brace = duffle.read_braces(source_text, brace_pos)
-	-- scan: MipsAtom_(<name>) { <body> }
-	return { name = name, body = body, after_brace = after_brace }
-end
-
--- (internal) Try to parse the raw atom form: `MipsCode code_<name> { ... }`.
--- @param source_text string
--- @param after_pos integer   -- position just past `MipsCode`
--- @return Atom|nil
-local function try_raw_atom(source_text, after_pos)
-	local next_pos = duffle.skip_ws_and_cmt(source_text, after_pos)
-	local next_ident, next_after = duffle.read_ident(source_text, next_pos)
-	-- scan: MipsCode <next_ident>
-	if not next_ident then return nil end
-	if not starts_with(next_ident, CODE_RAW_PREFIX) then return nil end
-	if #next_ident <= CODE_RAW_PREFIX_LEN then return nil end
-	local atom_name = next_ident:sub(CODE_RAW_PREFIX_LEN + 1)
-	-- scan: MipsCode code_<name>
-	local brace_pos = duffle.scan_to_char(source_text, "{", next_after)
-	-- scan: MipsCode code_<name> {
-	if not brace_pos then return nil end
-	local body, after_brace = duffle.read_braces(source_text, brace_pos)
-	-- scan: MipsCode code_<name> { <body> }
-	return { name = atom_name, body = body, after_brace = after_brace }
-end
-
---- Find every `MipsAtom_(name) { ... }` (or raw `MipsCode code_<name> { ... }`) declaration in a source.
---- @param source_text string
---- @return Atom[]
-local function find_atoms(source_text)
-	local atoms   = {}
-	local pos     = 1
-	local src_len = #source_text
-
-	while pos <= src_len do
-		pos = duffle.skip_ws_and_cmt(source_text, pos); if pos > src_len then break end
-		pos = skip_qualifiers(source_text, pos);        if pos > src_len then break end
-
-		local ident, after = duffle.read_ident(source_text, pos)
-		-- scan: <ident>
-		if not ident then
-			pos = pos + 1
-		elseif ident == ATOM_PREFIX then
-			-- scan: MipsAtom_(<name>) { <body> }
-			local atom = try_wrapped_atom(source_text, after)
-			if atom then
-				atoms[#atoms + 1] = { name = atom.name, body = atom.body }
-				pos = atom.after_brace
-			else
-				pos = pos + 1
-			end
-		elseif ident == CODE_DECL then
-			-- scan: MipsCode code_<name> { <body> }
-			local atom = try_raw_atom(source_text, after)
-			if atom then
-				atoms[#atoms + 1] = { name = atom.name, body = atom.body }
-				pos = atom.after_brace
-			else
-				pos = after
-			end
-		else
-			pos = after
-		end
-	end
-	return atoms
-end
-
--- ════════════════════════════════════════════════════════════════════════════
--- Per-atom body scan
--- ════════════════════════════════════════════════════════════════════════════
-
--- (internal) Count words emitted by the rest of `tok` after a marker call 
--- (the marker call itself emits 0 words, but the source pattern may bundle the marker with the next instruction on the same line, 
--- separated by no top-level comma). 
--- Returns the word count contributed by that rest.
--- @param tok string
--- @param word_counts table
--- @return integer
-local function count_marker_rest(tok, word_counts)
-	local marker_end = find_marker_call_end(tok)
-	if marker_end <= 0 or marker_end >= #tok then return 0 end
-	local rest = duffle.trim(tok:sub(marker_end + 1))
-	if rest == "" then return 0 end
-	return count_token_words(rest, word_counts)
-end
-
--- (internal) Is this token a marker call (`atom_label` or `atom_offset`)?
--- @param tok string
--- @return boolean
-local function is_marker_token(tok)
-	local leading_ident = duffle.read_ident(tok, 1)
-	return leading_ident == LABEL_MARKER or leading_ident == OFFSET_MARKER
-end
-
 --- Scan an atom body for labels + branches, count total words.
 --- Returns (labels, branches, total_words).
 --- @param body string
 --- @param word_counts table
 --- @return table<string, integer>, table[], integer
-local function scan_atom_body(body, word_counts)
+-- scan_atom_body: walk pre-tokenized body for atom_label/atom_offset markers + word counts.
+-- Uses `atom.body_tokens` from the SourceScan payload (pre-tokenized by scan-source pass).
+-- @param body_tokens table[]  -- {{tok=string, rel=integer}, ...} from duffle.tokenize_body
+-- @param word_counts table
+-- @return table, table, integer  -- labels, branches, total_words
+local function scan_atom_body(body_tokens, word_counts)
 	local pos      = 0
 	local labels   = {}
 	local branches = {}
-	for _, tok in ipairs(duffle.split_top_level_commas(body)) do
-		if is_marker_token(tok) then
+	for _, t in ipairs(body_tokens) do
+		local tok = t.tok
+		if duffle.is_marker_token(tok) then
 			-- Marker call: record at the current pos, do NOT advance pos.
 			scan_for_atom_markers(tok, pos, labels, branches)
-			pos = pos + count_marker_rest(tok, word_counts)
+			pos = pos + duffle.count_marker_rest(tok, word_counts, count_token_words)
 		else
 			local words = count_token_words(tok, word_counts)
 			scan_for_atom_markers(tok, pos, labels, branches)
@@ -416,8 +205,7 @@ end
 -- Offset computation + header generation
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Compute branch offsets as `target_word - branch_word - 1`
--- (the standard MIPS branch-immediate encoding).
+-- Compute branch offsets as `target_word - branch_word - 1` (the standard MIPS branch-immediate encoding).
 -- @param labels table<string, integer>
 -- @param branches table[]
 -- @return BranchOffset[]
@@ -433,8 +221,15 @@ local function compute_offsets(labels, branches)
 	return results
 end
 
--- (internal) Build a constant-table entry `{macro_name, enum_name, value}`
--- from a BranchOffset.
+-- Right-pad `s` with spaces to width `w`. If `s` is already `w` or wider, no padding is added.
+-- @param s string
+-- @param w integer
+-- @return string
+local function pad_right(s, w)
+	return s .. string.rep(" ", math.max(0, w - #s))
+end
+
+-- (internal) Build a constant-table entry `{macro_name, enum_name, value}` from a BranchOffset.
 -- @param r BranchOffset
 -- @return table
 local function make_offset_const(r)
@@ -499,18 +294,35 @@ end
 
 local M = {}
 
--- (internal) Process one source: find atoms, scan bodies, write header.
+-- Project the pre-scanned SourceScan entries into the {name, body, body_tokens} shape this pass needs.
+-- MipsAtom_ entries have kind="atom"; MipsCode code_<name> entries have kind="raw_atom".
+-- `body_tokens` is set by scan-source on every `scan.atoms[i]` / `scan.raw_atoms[i]`; we carry it forward
+-- so `scan_atom_body` reads from the precomputed table directly (no per-atom tokenize_body fallback).
+-- @param scan table  -- SourceScan from duffle.scan_source
+-- @return table[]  -- list of {name=, body=, body_tokens=}
+local function project_atoms(scan)
+	local out = {}
+	for _, a in ipairs(scan.atoms) do
+		out[#out + 1] = { name = a.raw_name, body = a.body, body_tokens = a.body_tokens }
+	end
+	for _, a in ipairs(scan.raw_atoms) do
+		out[#out + 1] = { name = a.name, body = a.body, body_tokens = a.body_tokens }
+	end
+	return out
+end
+
+-- (internal) Process one source: project atoms from scan, scan bodies, write header.
 -- Returns the offsets_h path if a header was written, or nil.
 -- @param ctx PassCtx
 -- @param src SourceFile
 -- @return string|nil  -- the offsets_h path
 local function process_source(ctx, src)
-	local atoms = find_atoms(src.text)
+	local atoms = project_atoms(src.scan)
 	if #atoms == 0 then return nil end
 
 	local atoms_data = {}
 	for _, atom in ipairs(atoms) do
-		local labels, branches, total = scan_atom_body(atom.body, ctx.shared.word_counts)
+		local labels, branches, total = scan_atom_body(atom.body_tokens, ctx.shared.word_counts)
 		atoms_data[#atoms_data + 1] = {
 			name        = atom.name,
 			total_words = total,
@@ -526,9 +338,9 @@ local function process_source(ctx, src)
 	return out_path
 end
 
---- Run the offsets pass. 
---- For each source, emits a per-module `<dir_basename>.offsets.h` containing `#define _atom_offset_F_T = N` constants for every `atom_offset(F, T)` reference
---- in the source's atoms.
+--- Run the offsets pass.
+--- For each source, emits a per-module `<dir_basename>.offsets.h` containing `#define _atom_offset_F_T = N` constants 
+--- for every `atom_offset(F, T)` reference in the source's atoms.
 --- @param ctx PassCtx
 --- @return PassResult
 function M.run(ctx)

scripts/passes/report.lua

@@ -2,34 +2,28 @@
 --- project-wide summary writer.
 ---
 --- Two output files per build:
----   - `build/gen/<dir_basename>.annotations.txt` — one per source-directory
----     containing atoms; aggregates across all sources in the directory.
+---   - `build/gen/<dir_basename>.annotations.txt` — one per source-directory containing atoms; aggregates across all sources in the directory.
 ---   - `build/gen/annotation_validation.txt` — the project summary.
 ---
---- The annotation pass stashes per-MODULE summary entries in
---- `ctx.flags._annot_results` (set by `passes/annotation.lua`). This
---- pass re-validates each source via `annotation.validate()` to get
---- the detailed per-source results needed for the report. The cost is
---- acceptable: `validate()` is fast (~5ms per source) and runs once.
+--- The annotation pass stashes per-MODULE summary entries in `ctx.flags._annot_results` (set by `passes/annotation.lua`). 
+--- This pass re-validates each source via `annotation.validate()` to get the detailed per-source results needed for the report. 
 ---
 --- **Conventions**: tabs (1/level), EmmyLua annotations, no regex,
---- Lua 5.3 compatible. See
---- `C:\projects\Pikuma\ps1-ai\conductor\code_styleguides\lua.md`.
+--- Lua 5.3 compatible.
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Module-scope requires + package.path setup
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Resolve `arg[0]` to an absolute-ish script directory so that `require("duffle")` resolves against `scripts/` regardless of CWD.
--- Note: this boilerplate is duplicated in 6 other entry scripts; a Phase-6 extraction target (`duffle.setup_package_path()`).
 -- Bootstrap: see `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
 -- Uses `debug.getinfo` to find this file's own directory, so it works
 -- both standalone and when require'd from the orchestrator.
-local _src = debug.getinfo(1, "S").source:sub(2)
-local _dir = _src:match("(.*[/\\])") or "./"
-dofile(_dir .. "../duffle_paths.lua")
-local duffle = require("duffle")
+-- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` (works both standalone + when require'd).
+-- duffle_paths.lua sets package.path then returns `require("duffle")` at the bottom, so the dofile value IS the duffle module.
+local _bootstrap_dir = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
+local duffle        = dofile(_bootstrap_dir .. "../duffle_paths.lua")
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Constants
@@ -66,16 +60,16 @@ local PASS_NAME = "report"
 --- @field basename string  -- filename without extension
 
 --- @class PassCtx
---- @field sources            SourceFile[]            -- all source files in the build
---- @field metadata_path      string                  -- path to word_count.metadata.h
---- @field shared             table                   -- cross-pass shared state
---- @field out_root           string                  -- output root (e.g. "build/gen")
---- @field project_root       string                  -- project root (e.g. "code/")
---- @field upstream           table<string, table>    -- per-pass upstream outputs
---- @field flags              table                   -- CLI flags + per-pass stash
---- @field flags._annot_results ModuleEntry[]         -- stashed by annotation pass
---- @field dry_run            boolean                 -- if true, compute but don't write
---- @field verbose            boolean                 -- if true, log diagnostic info
+--- @field sources            SourceFile[]         -- all source files in the build
+--- @field metadata_path      string               -- path to word_count.metadata.h
+--- @field shared             table                -- cross-pass shared state
+--- @field out_root           string               -- output root (e.g. "build/gen")
+--- @field project_root       string               -- project root (e.g. "code/")
+--- @field upstream           table<string, table> -- per-pass upstream outputs
+--- @field flags              table                -- CLI flags + per-pass stash
+--- @field flags._annot_results ModuleEntry[]      -- stashed by annotation pass
+--- @field dry_run            boolean              -- if true, compute but don't write
+--- @field verbose            boolean              -- if true, log diagnostic info
 
 --- @class PassResult
 --- @field outputs  table[]  -- {kind=, path=} entries describing emit files
@@ -266,6 +260,28 @@ local function render_module_warnings_section(add, results, total_warnings)
 	add("")
 end
 
+-- ════════════════════════════════════════════════════════════════════════════
+-- SECTION_RENDERERS — data-driven section dispatch (the plex pattern)
+-- ════════════════════════════════════════════════════════════════════════════
+--
+-- Each entry maps a section to its (header, render_fn). The render_fn signature:
+--   render_fn(add, results, totals)
+--     add    -- the `add(line)` closure from the surrounding report renderer
+--     results -- AnnotationResult[] (per-source results)
+--     totals -- {atoms, annots, binds, macros, errors, warnings} counts
+--
+-- Sections that need to render "(none)" vs iterate use totals.errors / totals.warnings;
+-- other sections ignore the totals arg.
+-- Adding a new section = 1 row here + 1 render_<thing>_section function.
+local SECTION_RENDERERS = {
+	{ header = SECTION_HEADER_ATOMS,    render = render_module_atoms_section     },
+	{ header = SECTION_HEADER_ANNOTS,   render = render_module_annots_section    },
+	{ header = SECTION_HEADER_BINDS,    render = render_module_binds_section     },
+	{ header = SECTION_HEADER_MACROS,   render = render_module_macros_section    },
+	{ header = SECTION_HEADER_ERRORS,   render = function(add, results, totals) return render_module_errors_section(add, results, totals.errors)   end },
+	{ header = SECTION_HEADER_WARNINGS, render = function(add, results, totals) return render_module_warnings_section(add, results, totals.warnings) end },
+}
+
 --- Render the per-MODULE annotation report (one `<dir_basename>.annotations.txt`).
 --- @param dir string                  -- module directory path
 --- @param sources SourceFile[]        -- sources in this module
@@ -287,18 +303,28 @@ local function render_module_report(dir, sources, results)
 		total_atoms, total_annots, total_binds, total_macros))
 	add("")
 
-	render_module_atoms_section(add, results)
-	render_module_annots_section(add, results)
-	render_module_binds_section(add, results)
-	render_module_macros_section(add, results)
-	render_module_errors_section(add, results, total_errors)
-	render_module_warnings_section(add, results, total_warnings)
+	-- Bundle the totals so the section renderers don't need separate parameter lists.
+	-- Errors/warnings sections need their total count to decide "(none)" vs iterate.
+	-- Sections without totals (atoms/annots/binds/macros) ignore this arg.
+	local totals = {
+		atoms    = total_atoms,  annots = total_annots,  binds  = total_binds,
+		macros   = total_macros, errors = total_errors,  warnings = total_warnings,
+	}
+
+	-- THE per-section dispatch. ONE loop over SECTION_RENDERERS.
+	-- Each renderer writes its header + content via the `add` closure (pre-bound above).
+	-- Adding a new section = 1 row here + 1 render_<thing>_section function.
+	for _, section in ipairs(SECTION_RENDERERS) do
+		add(section.header)
+		section.render(add, results, totals)
+		add("")
+	end
 
 	return table.concat(lines, "\n") .. "\n"
 end
 
 -- ════════════════════════════════════════════════════════════════════════════
--- Per-project summary (ported from tape_atom_annotation_pass.lua:1488-1528)
+-- Per-project summary
 -- ════════════════════════════════════════════════════════════════════════════
 
 --- Render the per-project summary (`build/gen/annotation_validation.txt`).
@@ -351,32 +377,24 @@ end
 -- Orchestration helpers
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Group source files by their `dir` field. Used to mirror the per-DIRECTORY partitioning the annotation pass uses.
--- @param sources SourceFile[]
--- @return table<string, SourceFile[]>  -- map of dir -> sources in that dir
-local function group_sources_by_dir(sources)
-	local by_dir = {}
-	for _, src in ipairs(sources) do
-		by_dir[src.dir] = by_dir[src.dir] or {}
-		table.insert(by_dir[src.dir], src)
-	end
-	return by_dir
-end
-
--- (internal) Validate each source in `dir_sources` via the annotation pass, tagging each result with `result.source = src.path` for downstream rendering.
+-- (internal) Pull per-source validate() results from the annotation pass's stash.
+-- The annotation pass runs first in the dep chain and caches results in `ctx.flags._annot_source_results`;
+-- we read from there instead of re-validating each source.
 -- Returns the list of module results + the flat list of all results (for the project-wide summary).
 -- @param ctx PassCtx
 -- @param dir_sources SourceFile[]
 -- @return AnnotationResult[], AnnotationResult[]
-local function validate_module_sources(ctx, dir_sources)
-	local annotation     = require("passes.annotation")
+local function lookup_module_results(ctx, dir_sources)
+	local src_cache      = (ctx.flags and ctx.flags._annot_source_results) or {}
 	local module_results = {}
 	local all_results    = {}
 	for _, src in ipairs(dir_sources) do
-		local result  = annotation.validate(ctx, src)
-		result.source = src.path
-		module_results[#module_results + 1] = result
-		all_results[#all_results + 1] = result
+		local result = src_cache[src.path]
+		if result then
+			result.source = src.path                                    -- defensive (annotation tags it too; this guards against cache misses from earlier iterations)
+			module_results[#module_results + 1] = result
+			all_results[#all_results + 1] = result
+		end
 	end
 	return module_results, all_results
 end
@@ -418,7 +436,7 @@ function M.run(ctx)
 	local warnings = {}
 
 	local module_entries = (ctx.flags and ctx.flags._annot_results) or {}
-	local by_dir         = group_sources_by_dir(ctx.sources)
+	local by_dir         = ctx.by_dir or duffle.group_sources_by_dir(ctx.sources)
 
 	if not ctx.dry_run then duffle.ensure_dir(ctx.out_root) end
 
@@ -428,7 +446,7 @@ function M.run(ctx)
 
 		if entry.atoms_count > 0 or #(by_dir[entry.dir] or {}) > 0 then
 			local dir_sources                 = by_dir[entry.dir] or {}
-			local module_results, all_results = validate_module_sources(ctx, dir_sources)
+			local module_results, all_results = lookup_module_results(ctx, dir_sources)
 			for _, r in ipairs(all_results) do
 				all_results_for_summary[#all_results_for_summary + 1] = r
 			end

scripts/passes/word_count_eval.lua

@@ -4,7 +4,6 @@
 ---   1. **Public utilities** (used by `passes/components.lua`, `passes/offsets.lua`, `passes/annotation.lua`):
 ---        - `M.count_token_words(token, wc)` — words emitted by one token
 ---        - `M.scan_dir(dir, suffix)` — glob walk for *.macs.h
----        - `M.count_body_words(body, wc)` — words emitted by an atom body
 ---   2. **Pass entry** `M.run(ctx)` — loads metadata.h + *.macs.h into `ctx.shared.word_counts` for downstream passes.
 ---   3. **Internal helpers** for the body scanner.
 ---
@@ -16,26 +15,22 @@
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Resolve `arg[0]` to an absolute-ish script directory so that `require("duffle")` resolves against `scripts/` regardless of CWD.
--- Note: this boilerplate is duplicated in 6 other entry scripts; a Phase-6 extraction target (`duffle.setup_package_path()`).
 -- Bootstrap: see `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
 -- Uses `debug.getinfo` to find this file's own directory, so it works both standalone and when require'd from the orchestrator.
-local _src = debug.getinfo(1, "S").source:sub(2)
-local _dir = _src:match("(.*[/\\])") or "./"
-dofile(_dir .. "../duffle_paths.lua")
-local duffle = require("duffle")
+-- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` (works both standalone + when require'd).
+-- duffle_paths.lua sets package.path then returns `require("duffle")` at the bottom, so the dofile value IS the duffle module.
+local _bootstrap_dir = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
+local duffle        = dofile(_bootstrap_dir .. "../duffle_paths.lua")
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Constants
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Windows separator chars — used to convert `dir /b /s` output (which uses `\`) into POSIX paths (which our scripts expect).
-local PATH_SEP_BACKSLASH = "\\"
-local PATH_SEP_FORWARD   = "/"
-
--- Glob command for Windows directory walk. `dir /b /s` lists all matching files recursively with bare paths (no headers); 
--- `2>nul` discards the "file not found" stderr when nothing matches.
-local DIR_GLOB_CMD = 'dir /b /s "%s\\%s" 2>nul'
+-- Required native extension: lfs (LuaFileSystem). Built by `update_deps.ps1` to
+-- `toolchain/lfs/lfs.dll` and wired into package.cpath by `scripts/duffle_paths.lua`.
+-- If lfs is missing, `require` throws — fail loud per the build-tool convention.
+local lfs = require("lfs")
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Type declarations
@@ -81,7 +76,6 @@ local M = {}
 --- For most tokens (regular MIPS instructions) this returns 1.
 --- For `mac_X(...)` calls, this returns the resolved word count from `wc` (recursively if needed). For `nop2` etc., returns wc[name].
 --- For unknown macros, returns 1 and (optionally) warns.
----
 --- @param token string        -- a single token from split_top_level_commas
 --- @param wc WordCounts       -- the shared word-count table
 --- @return integer
@@ -102,54 +96,40 @@ end
 -- │ Shared utility: scan_dir                                           │
 -- └────────────────────────────────────────────────────────────────────┘
 
---- Recursively scan a directory for files matching a glob suffix.
---- No regex per the no_regex constraint — uses plain byte matching via `dir /b /s` on Windows.
----
---- The `.macs.h` files produced by the components pass always live at `<project_root>/<module>/gen/`.
---- We can shortcut the `dir /b /s` walk by listing modules first (one `dir /b /ad`), then walking each `<module>/gen/`
---- (one `dir /b` per module, no recursion). 
---- For projects with 2 modules and 0 .macs.h files, this drops the cost from ~52ms 
---- (full recursive walk of the entire project tree) to ~5ms.
----
---- @param dir string        -- directory to scan (absolute or relative)
---- @param suffix string     -- file pattern, e.g. "*.macs.h"
---- @return string[]
--- Cache the scan_dir result per (dir, suffix) in package.loaded. 
--- Each `io.popen` call on Windows is ~50-100ms of subprocess overhead, so caching the result saves a fixed cost on every build.
+-- Cache the scan_dir result per (dir, suffix) in package.loaded.
 -- The cache persists for the lifetime of the Lua process (cleared when ps1_meta.lua exits).
 -- If a build removes/creates .macs.h files mid-process, the caller can invalidate by calling `M._invalidate_scan_cache()`.
 local SCAN_CACHE_KEY = "__word_count_eval_scan_cache__"
 
---- Recursively scan a directory for files matching a glob suffix.
---- No regex per the no_regex constraint — uses plain byte matching via `dir /b /s` on Windows.
----
---- @param dir string        -- directory to scan (absolute or relative)
+--- Scan `code/` for files matching `suffix` (e.g. `*.macs.h`).
+--- Native directory enumeration via lfs (~2ms). Zero subprocess spawns.
+--- @param dir string        -- project root directory
 --- @param suffix string     -- file pattern, e.g. "*.macs.h"
 --- @return string[]
 function M.scan_dir(dir, suffix)
 	local key = dir .. "\0" .. suffix
 
-	-- Check the in-process cache first. (Mostly helps when a build triggers multiple `M.run` calls -- e.g. 
-	-- the audit_lua_nesting script's stress tests but the cost is ~free either way.)
 	local cache = package.loaded[SCAN_CACHE_KEY]
 	if    cache and cache[key] then return cache[key] end
 
 	local results = {}
-	local pipe = io.popen(DIR_GLOB_CMD:format(dir, suffix))
-	if not pipe then
-		-- Cache the empty result too (avoids re-scan if the dir is genuinely empty -- e.g. a clean build before components has run yet).
-		cache      = cache or {}
-		cache[key] = results
-		package.loaded[SCAN_CACHE_KEY] = cache
-		return results
+	local code_dir = dir .. "/code"
+	if lfs.attributes(code_dir, "mode") == "directory" then
+		for mod_name in lfs.dir(code_dir) do
+			if mod_name ~= "." and mod_name ~= ".." then
+				local gen_path = code_dir .. "/" .. mod_name .. "/gen"
+				if lfs.attributes(gen_path, "mode") == "directory" then
+					for fname in lfs.dir(gen_path) do
+						if fname:match("%.macs%.h$") then
+							results[#results + 1] = gen_path .. "/" .. fname
+						end
+					end
+				end
+			end
+		end
 	end
-	for raw_line in pipe:lines() do
-		local path = raw_line:gsub(PATH_SEP_BACKSLASH, PATH_SEP_FORWARD)
-		results[#results + 1] = path
-	end
-	pipe:close()
 
-	-- Cache the result.
+	-- Cache the result (including empty results).
 	cache      = cache or {}
 	cache[key] = results
 	package.loaded[SCAN_CACHE_KEY] = cache
@@ -160,95 +140,12 @@ end
 --- Invalidate the scan cache (call after creating new .macs.h files in the same Lua process — usually not needed).
 function M._invalidate_scan_cache() package.loaded[SCAN_CACHE_KEY] = nil end
 
--- ┌────────────────────────────────────────────────────────────────────┐
--- │ Shared utility: count_body_words                                   │
--- └────────────────────────────────────────────────────────────────────┘
-
---- Count words emitted by an entire atom body (a brace-delimited block).
---- Splits by top-level commas; for each token, delegates to count_token_words.
---- Handles `atom_label(name)` / `atom_offset(tag, name)` markers 
---- (record at current pos, do NOT advance pos; if the marker call bundles an instruction after it, count that instruction too).
----
---- @param body string         -- brace-delimited atom body (without braces)
---- @param wc WordCounts       -- the shared word-count table
---- @return integer            -- total words
-function M.count_body_words(body, wc)
-	local total = 0
-	for _, tok in ipairs(duffle.split_top_level_commas(body)) do
-		local pos     = 1
-		local tok_len = #tok
-		while pos <= tok_len and duffle.is_space(tok:sub(pos, pos)) do
-			pos = pos + 1
-		end
-		local leading_ident = duffle.read_ident(tok, pos)
-		local is_marker = leading_ident == "atom_label" or leading_ident == "atom_offset"
-		if is_marker then
-			-- Marker call: record at current pos, do NOT advance pos.
-			-- But the source pattern may bundle the marker with the next instruction on a new line (no top-level comma between them).
-			-- In that case, the rest of `tok` after the marker call is a real instruction that must still be counted.
-			local marker_end = M.find_marker_call_end(tok)
-			if marker_end > 0 and marker_end < #tok then
-				local rest = duffle.trim(tok:sub(marker_end + 1))
-				if rest ~= "" then
-					total = total + M.count_token_words(rest, wc)
-				end
-			end
-		else
-			total = total + M.count_token_words(tok, wc)
-		end
-	end
-	return total
-end
-
---- Find the end position (just past the closing ')') of the first atom_label/atom_offset call in `tok`. Returns 0 if no such call.
---- Internal helper for count_body_words.
----
---- @param tok string
---- @return integer  -- 0 if no marker call found
-function M.find_marker_call_end(tok)
-	local pos     = 1
-	local tok_len = #tok
-	while pos <= tok_len do
-		pos = duffle.skip_ws_and_cmt(tok, pos)
-		if pos > tok_len then break end
-		local ch = tok:sub(pos, pos)
-		if duffle.is_space(ch) then
-			pos = pos + 1
-		elseif ch == "/" then
-			-- comment — skip past it (delegated to duffle.skip_str_or_cmt)
-			local nx = duffle.skip_str_or_cmt(tok, pos)
-			pos      = (nx > pos) and nx or (pos + 1)
-		else
-			local ident, after_ident = duffle.read_ident(tok, pos)
-			local marker_end         = find_marker_end(tok, ident, after_ident)
-			if marker_end > 0 then return marker_end end
-			pos = after_ident or (pos + 1)
-		end
-	end
-	return 0
-end
-
--- (internal) If `ident` is `atom_label`/`atom_offset` followed by `(...)`, return the position just past the closing ')'. 
--- Otherwise 0.
--- @param tok string
--- @param ident string|nil
--- @param after_ident integer
--- @return integer
-local function find_marker_end(tok, ident, after_ident)
-	if ident ~= "atom_label" and ident ~= "atom_offset" then return 0 end
-	local open_paren = duffle.skip_ws_and_cmt(tok, after_ident)
-	if tok:sub(open_paren, open_paren) ~= "(" then return 0 end
-	local _, end_paren = duffle.read_parens(tok, open_paren)
-	return end_paren - 1
-end
-
 -- ┌────────────────────────────────────────────────────────────────────┐
 -- │ Pass entry: M.run(ctx) — "word-counts" pass                        │
 -- └────────────────────────────────────────────────────────────────────┘
 
 --- Load metadata.h + scan for existing *.macs.h files into ctx.shared.word_counts.
 --- Loading the .macs.h files is idempotent: entries from later (current-build) .macs.h files override metadata.h entries of the same name.
----
 --- @param ctx PassCtx
 --- @return PassResult
 function M.run(ctx)

scripts/pcsx_debug_helper/autoexec.lua

@@ -0,0 +1,51 @@
+-- autoexec.lua - pcsx_debug_helper plugin entry point.
+-- Packaged in scripts/pcsx_debug_helper.zip. Loaded by pcsx-redux via the -archive CLI flag (see scripts/launch_pcsx_debug.ps1).
+--
+-- Registers two web handlers for external CLI tools:
+--   /api/v1/lua/gte - full GTE state (32 data + 32 control regs + PC)
+--   /api/v1/lua/gp  - GP state summary (screenshot endpoint + VRAM endpoint refs)
+--
+-- The GTE handler reads COP2 regs via PCSX.getRegisters().CP2D/CP2C.
+-- The pcsx-redux gdb stub doesn't expose COP2, so this is the only way for external tools to see GTE state.
+--
+-- The GP handler is a thin pointer: 
+-- pcsx-redux's Lua API exposes only PCSX.GPU.takeScreenShot() (no GPUSTAT, no GP0/GP1 command log, no display state). For richer GP state, the existing web endpoints are the practical path:
+--   /api/v1/state/still      - PNG screenshot
+--   /api/v1/gpu/vram/raw     - VRAM raw bytes (1MB)
+--
+-- Companion: scripts/gdb/gdb_tape_atoms.gdb (covers GPRs + atom-aware stepping).
+
+local function register_handlers()
+    if not PCSX.WebServer then PCSX.WebServer = {} end
+    if not PCSX.WebServer.Handlers then PCSX.WebServer.Handlers = {} end
+
+    -- ── GTE state ──
+    PCSX.WebServer.Handlers.gte = function(req)
+        local r = PCSX.getRegisters()
+        local out = { "pc=0x" .. string.format("%x", r.pc) }
+        for i = 0, 31 do
+            out[#out + 1] = string.format("D[%d]=0x%08x C[%d]=0x%08x",
+                i, r.CP2D.r[i], i, r.CP2C.r[i])
+        end
+        return table.concat(out, "\n")
+    end
+
+		-- ── GP state (pointer to existing endpoints) ──
+		-- pcsx-redux's Lua GPU API exposes only takeScreenShot(); no GPUSTAT / GP0 / GP1 command log / display state.
+		-- We point to the existing web endpoints that DO expose those (when the emulator is actually rendering. Paused-at-BP frames won't have a fresh frame).
+    PCSX.WebServer.Handlers.gp = function(req)
+        local out = {
+            "gpu_screenshot_png=http://localhost:8080/api/v1/state/still",
+            "vram_raw=http://localhost:8080/api/v1/gpu/vram/raw (1MB VRAM)",
+            "gpustat=NOT_AVAILABLE_VIA_LUA",
+            "gp_command_log=NOT_AVAILABLE_VIA_LUA (use pcsx-redux Debug > GPU Logger)",
+            "hint_run_emulator_unpaused_for_screenshot",
+        }
+        return table.concat(out, "\n")
+    end
+end
+
+local ok, err = pcall(register_handlers)
+if ok then print("[pcsx_debug_helper] handlers registered: gte, gp")
+else       print("[pcsx_debug_helper] registration failed: " .. tostring(err))
+end

scripts/ps1_meta.lua

@@ -1,29 +1,41 @@
---- ps1_meta.lua — Orchestrator entry point for the tape-atom metaprogram pipeline.
+--- ps1_meta.lua — Orchestrator entry point for the tape-atom metaprogram.
 ---
---- Dispatches to pass modules under `scripts/passes/`, resolving
---- dependencies topologically (Kahn's algorithm + cycle detection).
---- Single CLI surface (`--<pass>` flags + auto-dep expansion + --dry-run).
+--- Dispatches to pass modules under `scripts/passes/`, resolving dependencies topologically (Kahn's algorithm + cycle detection).
 ---
 --- **Architecture**:
 ---   - **PASSES table** — declarative dep graph (data, not code).
----   - **FLAG_HANDLERS table** — per-flag CLI dispatchers (handler-map
----     pattern; replaces an 8-way if/elseif chain).
----   - **parse_args** → **build_ctx** → **topo_sort** → **dispatch_passes**.
+---   - **FLAG_HANDLERS table** — per-flag CLI dispatchers (handler-map pattern; replaces an 8-way if/elseif chain).
+---   - **parse_args** → **build_ctx** (just opens + reads source files; no inline scanning) → **topo_sort** → **dispatch_passes**.
+---   - The first pass in the dep graph is `scan-source` (see `passes/scan_source.lua`).
+---     It calls `duffle.scan_source` once per source to produce the fat `SourceScan` payload, which is attached to each `src.scan`. 
+---     Every other pass that reads source structure depends on `scan-source` and consumes `src.scan` as a read-only. 
 ---
 --- **Conventions**: tabs (1/level), EmmyLua annotations, no regex,
---- Lua 5.3 compatible. 
---- 
+--- Lua 5.3 compatible.
+---
 -- ════════════════════════════════════════════════════════════════════════════
 -- Module-scope requires + package.path setup
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Resolve `arg[0]` to an absolute-ish script directory so that `require("duffle")` resolves against `scripts/` regardless of CWD.
--- Note: this boilerplate is duplicated in 6 other entry scripts; a
--- Phase-6 extraction target (`duffle.setup_package_path()`).
--- Bootstrap: load `duffle_paths.lua` (uses `git rev-parse` to find the repo root, then sets package.path + package.cpath).
--- After this line, `require("duffle")` and `require("passes.X")` both resolve.
-dofile((arg[0]:match("(.*[/\\])") or "./") .. "duffle_paths.lua")
-local duffle = require("duffle")
+-- Bootstrap: load `duffle_paths.lua` via this script's own path.
+-- Use `arg[0]` when this file is the entry script (`arg[0]` ends in
+-- "ps1_meta.lua"); fall back to `debug.getinfo(1, "S").source` when this
+-- file is being dofile()'d or require()'d (in which case `arg[0]` is the
+-- *caller's* path, not ours).
+--
+-- That single statement: (a) sets `package.path` + `package.cpath`
+-- (via cached `git rev-parse`), (b) at the bottom returns `require("duffle")`.
+-- So the dofile's return value is the duffle module.
+local _is_entry_script = arg and arg[0] and arg[0]:match("ps1_meta%.lua$") ~= nil
+local _bootstrap_src
+if _is_entry_script then
+	_bootstrap_src = arg[0]
+else
+	-- debug.getinfo(1, "S").source returns "@<path>" for the current chunk;
+	-- strip the leading "@" so the directory match works in both cases.
+	_bootstrap_src = debug.getinfo(1, "S").source:sub(2)
+end
+local duffle = dofile((_bootstrap_src:match("(.*[/\\])") or "./") .. "duffle_paths.lua")
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Constants
@@ -52,6 +64,8 @@ local PASS_FLAG_DISPATCH_KEY   = "__pass__"
 --- @field module string       -- module name passed to require()
 --- @field kind   string       -- "shared" | "header-output" | "validation" | "report"
 --- @field deps   string[]     -- names of upstream passes
+--- @field groups string[]?    -- OPTIONAL build-phase groups this pass is a root of
+---                             -- (e.g. { "pre-link" }, { "post-link" }); absent ⇒ dependency-only
 --- @field desc   string       -- human description (used by --help + ASCII graph)
 --- @field out    PassOutput[] -- output paths (used by --dry-run + report)
 
@@ -103,25 +117,40 @@ local PASS_FLAG_DISPATCH_KEY   = "__pass__"
 -- PASSES table (data, not code) — the orchestrator's dep graph
 -- ════════════════════════════════════════════════════════════════════════════
 
+-- Build-phase groups: each PASSES row may declare membership in one or more
+-- named groups via `groups = { ... }`. The CLI flags --pre-link and
+-- --post-link request the *roots* of their group; topo_sort then closes
+-- transitive dependencies from those roots, and dispatch_passes runs every
+-- pass in the resulting closure without phase-filtering.
+--
+-- A row without a `groups` entry is dependency-only: it runs only when a
+-- transitive dep requests it, but it remains directly requestable through
+-- its explicit CLI flag (e.g. --atoms-source-map, --scan-source).
+
 local PASSES = {
+	["scan-source"] = {
+		module = "passes.scan_source",
+		kind   = "shared", deps = {},
+		desc   = "Walk each source once; produce the fat SourceScan payload for downstream passes",
+		out    = {},
+	},
 	["word-counts"] = {
 		module = "passes.word_count_eval",
-		kind   = "shared",
-		deps   = {},
+		kind   = "shared", deps = {},
 		desc   = "Build the shared metadata table (metadata.h + .macs.h)",
 		out    = {},
 	},
 	components = {
 		module = "passes.components",
 		kind   = "header-output",
-		deps   = {"word-counts"},
+		deps   = {"scan-source", "word-counts"},
 		desc   = "Emit mac_X macros from MipsAtomComp_ declarations",
 		out    = { { kind = "header", path_template = "<source_dir>/gen/<basename>.macs.h" } },
 	},
 	annotation = {
 		module = "passes.annotation",
 		kind   = "validation",
-		deps   = {"word-counts"},
+		deps   = {"scan-source", "word-counts"},
 		desc   = "Validate atom DSL usage; emit errors.h + annotations.txt",
 		out    = {
 			{ kind = "report", path_template = "<out_root>/<basename>.errors.h" },
@@ -131,26 +160,99 @@ local PASSES = {
 	offsets = {
 		module = "passes.offsets",
 		kind   = "header-output",
-		deps   = {"word-counts", "components"},
+		deps   = {"scan-source", "word-counts", "components"},
+		groups = { "pre-link" },
 		desc   = "Compute branch offsets for atom_label / atom_offset",
 		out    = { { kind = "header", path_template = "<source_dir>/gen/<basename>.offsets.h" } },
 	},
 	["static-analysis"] = {
 		module = "passes.static_analysis",
 		kind   = "validation",
-		deps   = {"word-counts", "components"},
-		desc   = "[FUTURE] GTE pipeline-fill, mac_yield uniformity, etc.",
+		deps   = {"scan-source", "word-counts", "components"},
+		desc   = "Static analysis: GTE pipeline-fill, mac_yield uniformity, ABI handoff, GPU port-store shape, per-atom cycle budget, type consistency",
 		out    = { { kind = "report", path_template = "<out_root>/<basename>.static_analysis.txt" } },
 	},
+	["atoms-source-map"] = {
+		module = "passes.atoms_source_map",
+		kind   = "header-output",
+		deps   = {"word-counts", "components"},
+		desc   = "Emit gen/<basename>.atoms.sourcemap.txt (per-.word C source line map for gdb debugging) AND gen/<basename>.atoms.provenance.txt (per-.word provenance; each word tagged with its call-site file:line and, when emitted by a mac_X(...) component invocation, the component's definition file:line). Consumed by passes/dwarf_injection.lua to synthesize DW_TAG_inlined_subroutine instances for source-level Step Into on component invocations.",
+		out    = {
+			{ kind = "report", path_template = "<out_root>/<basename>.atoms.sourcemap.txt"   },
+			{ kind = "report", path_template = "<out_root>/<basename>.atoms.provenance.txt" },
+		},
+	},
+	["dwarf-injection"] = {
+		module = "passes.dwarf_injection",
+		kind   = "shared",
+		deps   = {"scan-source", "atoms-source-map"},
+		groups = { "post-link" },
+		desc   = "Inject per-atom .debug_line + .debug_aranges (F') + per-atom .debug_info subprogram + per-wave-context-reg .debug_info variables (G') into the ELF (post-link; writes 7 section .bin blobs plus one deterministic .gdbinit sidecar). (rbind composite) reads ctx.sources[i].scan to find atom_bind(Binds_X) atoms + their Binds_X struct fields; emits per-Binds_X DW_TAG_structure_type DIEs + per-rbind-atom DW_TAG_variable 'bind_args' DIEs with piece-chain DW_OP_bregN/DW_OP_piece location expressions.",
+		out    = {
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_line.bin"     },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_aranges.bin"  },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_rnglists.bin" },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_abbrev.bin"   },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_info.bin"     },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_str.bin"      },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_loc.bin"      },
+			{ kind = "report", path_template = "<out_root>/<basename>.gdbinit"            },
+		},
+	},
 	report = {
 		module = "passes.report",
 		kind   = "report",
 		deps   = {"annotation", "static-analysis"},
+		groups = { "pre-link" },
 		desc   = "Render the per-project summary",
 		out    = { { kind = "report", path_template = "<out_root>/annotation_validation.txt" } },
 	},
 }
 
+-- ────────────────────────────────────────────────────────────────────────────
+-- Phase-root selection: derive the sorted set of roots belonging to a named
+-- build-phase group, then append them to `args.requested_set`. topo_sort
+-- closes the transitive deps from there; dispatch_passes runs every resolved
+-- pass without phase-filtering.
+-- ────────────────────────────────────────────────────────────────────────────
+
+--- @param group_name string  -- the build-phase group ("pre-link" | "post-link")
+--- @return string[]          -- sorted root pass names belonging to that group
+local function roots_for_group(group_name)
+	local names = {}
+	for name, pass in pairs(PASSES) do
+		if pass.groups then
+			for _, g in ipairs(pass.groups) do
+				if g == group_name then
+					names[#names + 1] = name
+					break
+				end
+			end
+		end
+	end
+	table.sort(names)
+	return names
+end
+
+--- Append every root belonging to `group_name` to `args.requested_set`.
+--- Errors loudly if no PASSES row declares the group, so a typo'd or
+--- future-removed group name cannot silently fall through to pre-link
+--- (or any other default) and dispatch nothing.
+--- @param args ParsedArgs
+--- @param group_name string
+local function request_roots_for_group(args, group_name)
+	local roots = roots_for_group(group_name)
+	if #roots == 0 then
+		error(string.format(
+			"ps1_meta: build-phase group %q has zero roots in PASSES; "
+			.. "check PASSES rows for a `groups = { %q }` field",
+			group_name, group_name))
+	end
+	for _, name in ipairs(roots) do
+		args.requested_set[#args.requested_set + 1] = name
+	end
+end
+
 -- Pass-kind taxonomy: which kinds stop the build on errors?
 local PASS_KIND_STOP_ON_ERROR = {
 	["shared"]        = false,
@@ -160,32 +262,41 @@ local PASS_KIND_STOP_ON_ERROR = {
 }
 
 -- Closed set of CLI flags -> pass names.
+-- Per-pass flags (e.g. --word-counts) live here; phase flags (--pre-link,
+-- --post-link, --all) live in FLAG_HANDLERS because they own side effects
+-- or invoke group-derivation logic. --dwarf-injection is *also* a per-pass
+-- opt-in flag, but its selection + opt-in state are both owned by the
+-- explicit FLAG_HANDLERS entry below (it sets args.flags.dwarf_injection
+-- and appends "dwarf-injection" to requested_set), so it is intentionally
+-- absent from this table.
 local PASS_FLAG_TO_NAME = {
-	["--word-counts"]     = "word-counts",
-	["--components"]      = "components",
-	["--validate"]        = "annotation",
-	["--offsets"]         = "offsets",
-	["--static-analysis"] = "static-analysis",
-	["--report"]          = "report",
-	["--all"]             = ALL_PASSES_SENTINEL,
+	["--word-counts"]       = "word-counts",
+	["--components"]        = "components",
+	["--validate"]          = "annotation",
+	["--offsets"]           = "offsets",
+	["--static-analysis"]   = "static-analysis",
+	["--atoms-source-map"]  = "atoms-source-map",
+	["--report"]            = "report",
+	["--scan-source"]       = "scan-source",
+	["--all"]               = ALL_PASSES_SENTINEL,
 }
 
-local ALL_PASS_NAMES = {
-	"word-counts", "components", "annotation",
-	"offsets", "static-analysis", "report",
-}
-
---- Append every pass name to args.requested_set. Used by --all and by the "default to --all if no pass flags were given" fallback.
+--- Append every pass name to args.requested_set. Names are derived from
+--- PASSES (no parallel name list); used by --all and by any caller that
+--- wants the full closure.
 --- @param args ParsedArgs
 local function request_all_passes(args)
-	for _, n in ipairs(ALL_PASS_NAMES) do
+	local names = {}
+	for name in pairs(PASSES) do names[#names + 1] = name end
+	table.sort(names)
+	for _, n in ipairs(names) do
 		args.requested_set[#args.requested_set + 1] = n
 	end
 end
 
 -- Per-flag handlers. Each handler takes (args, argv, arg_idx) and returns the new arg_idx (so multi-arg flags like --source FILE advance it). 
--- Returning nil + os.exit() handles termination flags (--help). This replaces the 8-way `if/elseif/elseif...` chain that nested 4 levels deep 
--- and made the dispatch logic hard to scan.
+-- Returning nil + os.exit() handles termination flags (--help). 
+-- This replaces the 8-way `if/elseif/elseif...` chain that nested 4 levels deep and made the dispatch logic hard to scan.
 local FLAG_HANDLERS = {}
 
 -- ════════════════════════════════════════════════════════════════════════════
@@ -200,20 +311,36 @@ ps1_meta.lua - Tape-atom metaprogram orchestrator
 USAGE:
   ps1_meta.lua [PASS_FLAGS] [COMMON_FLAGS]
 
-PASS_FLAGS (pick one or more, or use --all):
-  --word-counts         Load metadata.h + scan for existing .macs.h
-  --components          Generate <module>/gen/<basename>.macs.h
-  --validate            Run atom annotation DSL validation
-  --offsets             Generate <module>/gen/<basename>.offsets.h
-  --static-analysis     [FUTURE] GTE pipeline-fill, mac_yield uniformity
-  --report              Render per-project summary
-  --all                 Equivalent to all 6 flags above (default)
+PASS_FLAGS:
+  Pick a phase or one-or-more individual passes:
+    --pre-link            [phase; default] Run the pre-link group + transitive deps.
+                         The root set is data-driven from each PASSES row's
+                         `groups` field; no parallel name list is maintained.
+    --post-link           [phase] Run the post-link group + transitive deps.
+                         Requires --elf. Sets --gdb-runtime and --dwarf-injection
+                         opt-in flags as well.
+    --all                 Select every row of the PASSES table. Pass-local opt-in
+                         guards remain active, so --dwarf-injection still requires
+                         --elf and --gdb-runtime still requires a runtime emission.
+  Or pick any subset:
+    --scan-source         Scan sources into the fat SourceScan payload
+    --word-counts         Load metadata.h + scan for existing .macs.h
+    --components          Generate <module>/gen/<basename>.macs.h
+    --validate            Run atom annotation DSL validation
+    --offsets             Generate <module>/gen/<basename>.offsets.h
+    --atoms-source-map    Generate <basename>.atoms.sourcemap.txt per source
+    --dwarf-injection     [opt-in] Select the post-link dwarf-injection pass + set the
+                         opt-in flag. Requires --elf.
+    --static-analysis     Static analysis: GTE pipeline-fill, mac_yield, ABI handoff, cycle budget
+    --report              Render per-project summary
 
 COMMON_FLAGS:
   --source FILE         Source file to process (repeatable)
   --metadata PATH       Path to metadata.h (required)
   --out-root DIR        Output root for reports (default: build/gen)
   --project-root DIR    Project root for .macs.h scan (default: dirname(metadata))
+  --gdb-runtime         Also emit <out_root>/gdb_tape_atoms_runtime.gdb (post-link, requires --elf)
+  --elf PATH            Path to linked .elf (for --gdb-runtime / --dwarf-injection)
   --dry-run             Print dep order + ASCII graph; exit 0 without running
   --verbose             Print per-pass debug output
   --help                Show this help and exit
@@ -224,7 +351,9 @@ EXIT CODES:
   2  Metaprogram internal error
 
 EXAMPLE:
-  ps1_meta.lua --all --metadata metadata.h --source code/foo.c --source code/bar.c
+  ps1_meta.lua --pre-link  --metadata metadata.h --source code/foo.c --source code/bar.c
+  ps1_meta.lua --post-link --metadata metadata.h --source code/foo.c --source code/bar.c --elf build/hello_gte.elf
+  ps1_meta.lua --all       --metadata metadata.h --source code/foo.c --source code/bar.c
 ]])
 end
 
@@ -246,7 +375,40 @@ FLAG_HANDLERS["--metadata"]     = function(args, argv, arg_idx) args.metadata
 FLAG_HANDLERS["--out-root"]     = function(args, argv, arg_idx) args.out_root                   = argv[arg_idx + 1]; return arg_idx + 1 end
 FLAG_HANDLERS["--project-root"] = function(args, argv, arg_idx) args.project_root               = argv[arg_idx + 1]; return arg_idx + 1 end
 
--- Pass-flag handler. Reads the closed-set table, expands --all, appends to requested_set. Single-statement, no nesting.
+-- Per-pass stash flags. Read by `passes/atoms_source_map.lua` to opt into the post-link gdb-runtime emission.
+-- Same shape as the existing per-flag handlers. mutates `args.flags` (which propagates into `ctx.flags`).
+FLAG_HANDLERS["--gdb-runtime"]  = function(args) args.flags                = args.flags or {}; args.flags.gdb_runtime = true end
+FLAG_HANDLERS["--elf"]          = function(args, argv, arg_idx) args.flags = args.flags or {}; args.flags.elf_path    = argv[arg_idx + 1]; return arg_idx + 1 end
+-- Enable DWARF injection (default OFF). Opts in to the post-link pass and
+-- sets the flag in one shot — the explicit handler below owns both
+-- selection and opt-in state, so --dwarf-injection is intentionally absent
+-- from PASS_FLAG_TO_NAME.
+FLAG_HANDLERS["--dwarf-injection"] = function(args)
+	args.flags                 = args.flags or {}
+	args.flags.dwarf_injection = true
+	args.requested_set[#args.requested_set + 1] = "dwarf-injection"
+end
+-- Build-phase flags: --pre-link and --post-link request the roots of their
+-- declared groups (see roots_for_group). topo_sort closes transitive deps
+-- from those roots; dispatch_passes runs every pass in the resolved
+-- closure without phase-filtering.
+FLAG_HANDLERS["--pre-link"] = function(args)
+	request_roots_for_group(args, "pre-link")
+end
+-- Batch post-link phase: gdb-runtime + dwarf-injection in one luajit cold
+-- start. Sets the same opt-in flags as --gdb-runtime + --dwarf-injection
+-- and selects the post-link build-phase group.
+-- --elf is required; parse_args enforces it after all flags are parsed.
+FLAG_HANDLERS["--post-link"]      = function(args)
+	args.flags = args.flags or {}
+	args.flags.gdb_runtime     = true
+	args.flags.dwarf_injection = true
+	request_roots_for_group(args, "post-link")
+end
+
+-- G' (atom locals) is now consolidated into --dwarf-injection; no separate flag.
+
+-- Pass-flag handler. Reads the closed-set table, expands --all, appends to requested_set.
 FLAG_HANDLERS[PASS_FLAG_DISPATCH_KEY] = function(args, a)
 	local name = PASS_FLAG_TO_NAME[a]
 	if name == ALL_PASSES_SENTINEL then
@@ -257,7 +419,6 @@ FLAG_HANDLERS[PASS_FLAG_DISPATCH_KEY] = function(args, a)
 end
 
 --- Parse argv into a structured table. Validates against a closed enum.
----
 --- @param argv string[]
 --- @return ParsedArgs
 local function parse_args(argv)
@@ -287,8 +448,10 @@ local function parse_args(argv)
 		pos = pos + 1
 	end
 
-	-- Default: --all if no explicit pass flags.
-	if #args.requested_set == 0 then request_all_passes(args) end
+	-- Default: --pre-link if no explicit pass flags were given. The first
+	-- invocation of a build is always pre-link, so this avoids silently
+	-- also invoking post-link work in builds without an ELF artifact.
+	if #args.requested_set == 0 then request_roots_for_group(args, "pre-link") end
 
 	-- Defaults: project_root = dirname(metadata).
 	if args.metadata and not args.project_root then
@@ -308,6 +471,20 @@ local function parse_args(argv)
 		os.exit(EXIT_INTERNAL_ERROR)
 	end
 
+	-- Post-link opt-ins (--gdb-runtime, --dwarf-injection) write output that
+	-- depends on the linked ELF. Without --elf the metaprogram can't satisfy
+	-- those requests, so refuse loud and early. This covers the explicit
+	-- --post-link batch, --dwarf-injection by itself, and --gdb-runtime by
+	-- itself.
+	local flags      = args.flags or {}
+	local elf_path   = flags.elf_path
+	local has_elf    = type(elf_path) == "string" and #elf_path > 0
+	local post_links = flags.gdb_runtime or flags.dwarf_injection
+	if post_links and not has_elf then
+		io.stderr:write("ps1_meta: --elf PATH is required for post-link output\n")
+		os.exit(EXIT_INTERNAL_ERROR)
+	end
+
 	return args
 end
 
@@ -317,12 +494,13 @@ end
 
 --- Build the PassCtx from parsed args. Reads each source file once at startup;
 --- passes consume `src.text`, not the path (path is preserved for error reporting).
----
 --- @param args ParsedArgs
 --- @return PassCtx
 local function build_ctx(args)
 	local sources = {}
 	for _, path in ipairs(args.sources) do
+		-- lfs handles path metadata and directories, not file-content streams.
+		-- Keep this io.open local so this entry point preserves its tailored diagnostic and exit path below.
 		local  f = io.open(path, "r")
 		if not f then
 			io.stderr:write("ps1_meta: cannot open --source " .. path .. "\n")
@@ -337,6 +515,8 @@ local function build_ctx(args)
 			dir = dir:sub(1, -2)
 		end
 
+		-- src.scan is populated by the "scan-source" pass (the first pass in the dep graph).
+		-- build_ctx just opens + reads the files; the scan itself happens in the pass module, not inline in the orchestrator.
 		sources[#sources + 1] = {
 			path     = path,
 			text     = text,
@@ -345,14 +525,20 @@ local function build_ctx(args)
 		}
 	end
 
+	-- Pre-compute the per-directory grouping once (Fleury: expose structure).
+	-- Three passes (annotation, report, static-analysis) call group_sources_by_dir with the same ctx.sources;
+	-- computing it here and stashing on ctx.by_dir eliminates 2 redundant calls.
+	local by_dir = duffle.group_sources_by_dir(sources)
+
 	return {
 		sources       = sources,
+		by_dir        = by_dir,
 		metadata_path = args.metadata,
 		shared        = {},
 		upstream      = {},
 		out_root      = args.out_root,
 		project_root  = args.project_root,
-		flags         = {},
+		flags         = args.flags or {},
 		dry_run       = args.dry_run,
 		verbose       = args.verbose,
 	}
@@ -362,12 +548,17 @@ end
 -- Topological sort (Kahn's algorithm + cycle detection)
 -- ════════════════════════════════════════════════════════════════════════════
 
---- Compute the dep-closure of `requested_set`: include every pass name transitively required by the requested set.
----
+--- Topologically sort the requested pass set, augmented with all transitive deps.
+--- Detects cycles and errors out with details.
 --- @param passes table<string, PassDescriptor>
 --- @param requested_set string[]
---- @return table<string, boolean>  -- set of pass names needed (including transitive deps)
-local function dep_closure(passes, requested_set)
+--- @return string[]  -- execution order
+---
+--- Implementation note: the 4 algorithm phases (dep-closure, in-degree, ready-queue, sort) are inlined as 3 small blocks within this function. 
+--- Each was a 1-caller helper; the 2-caller rule doesn't apply, so inlining produces a single readable function
+--- (plex: small patterns → shared, but only when shared; here they're not).
+local function topo_sort(passes, requested_set)
+	-- Phase 1: dep-closure. Include every pass name transitively required by `requested_set`.
 	local needed = {}
 	for _, name in ipairs(requested_set) do needed[name] = true end
 	local changed = true
@@ -386,24 +577,8 @@ local function dep_closure(passes, requested_set)
 			end
 		end
 	end
-	return needed
-end
 
---- Count entries in a hash table (Lua's `#t` doesn't work for hash tables).
---- @param t table
---- @return integer
-local function count_entries(t)
-	local n = 0
-	for _ in pairs(t) do n = n + 1 end
-	return n
-end
-
---- Compute in-degrees for the Kahn sort: for each pass in `needed`, the number of its deps that are also in `needed`.
----
---- @param passes table<string, PassDescriptor>
---- @param needed table<string, boolean>
---- @return table<string, integer>
-local function compute_in_degrees(passes, needed)
+	-- Phase 2: in-degrees for Kahn's algorithm. For each pass in `needed`, the number of its deps that are also in `needed`.
 	local in_degree = {}
 	for name, _ in pairs(needed) do in_degree[name] = 0 end
 	for name, _ in pairs(needed) do
@@ -413,67 +588,41 @@ local function compute_in_degrees(passes, needed)
 			end
 		end
 	end
-	return in_degree
-end
 
---- Seed the Kahn ready queue with passes whose in-degree is 0, sorted alphabetically for deterministic execution order.
----
---- @param in_degree table<string, integer>
---- @return string[]
-local function seed_ready_queue(in_degree)
+	-- Phase 3: seed the ready queue with passes whose in-degree is 0, sorted alphabetically for deterministic order.
 	local ready = {}
 	for name, deg in pairs(in_degree) do
 		if deg == 0 then ready[#ready + 1] = name end
 	end
 	table.sort(ready)
-	return ready
-end
 
--- (internal) Pop the next ready pass, decrement the in-degree of every remaining pass that depended on it
--- (inserting newly-zero-degree passes back into the ready queue), and append to `order`. Keeps `ready` sorted.
--- @param passes table<string, PassDescriptor>
--- @param needed table<string, boolean>
--- @param in_degree table<string, integer>
--- @param ready string[]
--- @param order string[]
-local function process_next_ready(passes, needed, in_degree, ready, order)
-	local just_finished = table.remove(ready, 1)
-	order[#order + 1] = just_finished
-	for name, _ in pairs(needed) do
-		if name ~= just_finished then
-			for _, dep in ipairs(passes[name].deps) do
-				if dep == just_finished then
-					in_degree[name] = in_degree[name] - 1
-					if in_degree[name] == 0 then
-						ready[#ready + 1] = name
-						table.sort(ready)
+	-- Phase 4: drain the ready queue. For each popped pass, decrement the in-degree of every remaining pass that depended on it.
+	-- Newly-zero-degree passes are inserted back into the ready queue (kept sorted).
+	local order = {}
+	while #ready > 0 do
+		local just_finished = table.remove(ready, 1)
+		order[#order + 1] = just_finished
+		for name, _ in pairs(needed) do
+			if name ~= just_finished then
+				for _, dep in ipairs(passes[name].deps) do
+					if dep == just_finished then
+						in_degree[name] = in_degree[name] - 1
+						if in_degree[name] == 0 then
+							ready[#ready + 1] = name
+							table.sort(ready)
+						end
 					end
 				end
 			end
 		end
 	end
-end
 
---- Topologically sort the requested pass set, augmented with all transitive deps.
---- Detects cycles and errors out with details.
----
---- @param passes table<string, PassDescriptor>
---- @param requested_set string[]
---- @return string[]  -- execution order
-local function topo_sort(passes, requested_set)
-	local needed    = dep_closure(passes, requested_set)
-	local in_degree = compute_in_degrees(passes, needed)
-	local ready     = seed_ready_queue(in_degree)
-
-	local order = {}
-	while #ready > 0 do
-		process_next_ready(passes, needed, in_degree, ready, order)
-	end
-
-	-- Cycle detection: if order doesn't include all needed passes, some are stuck with in_degree > 0 (the cycle closed on itself
-	-- before Kahn could process them). Without this check, a fully-closed cycle (e.g. A -> B -> A) would silently return an emspty order list, 
-	-- leaving the orchestrator to dispatch nothing.
-	if #order ~= count_entries(needed) then
+	-- Cycle detection: if `order` doesn't include all needed passes, some are stuck with in_degree > 0
+	-- (the cycle closed on itself before Kahn could process them).
+	-- Without this check, a fully-closed cycle (e.g. A -> B -> A) would silently return an empty order list, leaving the orchestrator to dispatch nothing.
+	local needed_count = 0
+	for _ in pairs(needed) do needed_count = needed_count + 1 end  -- count hash entries; Lua's #t doesn't work
+	if #order ~= needed_count then
 		for name, deg in pairs(in_degree) do
 			if deg > 0 then
 				error("dependency cycle detected involving pass '" .. name .. "'")
@@ -490,18 +639,16 @@ end
 
 --- Render the dep graph as ASCII art. Output width capped at 78 columns.
 --- Falls back to the simpler "Resolved dependency order" list only if graph width exceeds terminal width.
----
 --- @param passes table<string, PassDescriptor>
---- @param requested string[]  -- originally-requested passes (subset of closed)
 --- @param closed string[]     -- dep-closed execution order
 --- @return string
-local function render_dep_graph(passes, requested, closed)
+local function render_dep_graph(passes, closed)
 	local lines = {}
 	local function add(s) lines[#lines + 1] = s end
 
 	add("[ps1_meta] Resolved dependency order (closed under deps):")
 	for pass_idx, name in ipairs(closed) do
-		local p = passes[name]
+		local p        = passes[name]
 		local deps_str = (#p.deps == 0) and "(no deps)" or
 			"(deps: " .. table.concat(p.deps, ", ") .. ")"
 		add(string.format("  %d. %-22s %-45s [%s]",
@@ -509,41 +656,204 @@ local function render_dep_graph(passes, requested, closed)
 	end
 	add("")
 
-	add("[ps1_meta] Pass graph (read top-to-bottom):")
+	-- Data-driven ASCII graph built from the actual PASSES table.
+	-- Kahn layers determine the row of each box; each pass becomes a 4-row
+	-- box (top border, name, kind+output-count, bottom border). Boxes in
+	-- the same layer are rendered side-by-side; layers are connected by a
+	-- 'v' marker row whose 'v' chars are centered under each box, indicating
+	-- the downward 'feeds into' direction.
+	--
+	-- Layout invariants enforced here:
+	--   * MAX_GRAPH_WIDTH = 78 cols: no emitted line exceeds this. The
+	--     "simplest" way to stay under the budget is to limit each sub-row
+	--     to MAX_BOXES_PER_ROW = 3 boxes; for the canonical 9-row PASSES
+	--     table the largest layer has 3 boxes, so no wrap engages today.
+	--     If a future layer grows past 3 boxes, the layer is split into
+	--     adjacent sub-rows (each ending in its own 'v'-marker row).
+	--   * No silent truncation: per-layer box width is computed from the
+	--     layer's widest content (max(name length, kind-suffix length))
+	--     plus a 1-char leading + 1-char trailing padding + 2 wall chars.
+	--     Long names widen the box; they are NEVER truncated.
+	--   * Collision-safety: every PASSES row has a unique name, kind, and
+	--     out-list, so two distinct passes cannot produce visually identical
+	--     boxes.
+	add("[ps1_meta] Pass graph (read top-to-bottom; edges = 'feeds into'):")
 	add("")
-	add("                       metadata.h")
-	add("                           |")
-	add("                           v")
-	add("   +-----------+   +-----------------+   +-----------------+")
-	add("   |   word-   |-->|    components   |-->|     offsets     |")
-	add("   |   counts  |   +-----------------+   +-----------------+")
-	add("   |   (load)  |            |                        ^")
-	add("   +-----------+            |                        |")
-	add("        |                   v                        |")
-	add("        |  code/<module>/gen/<basename>.macs.h       |")
-	add("        |     (header - co-located for #include)     |")
-	add("        |                                            |")
-	add("        |           +-----------------+              |")
-	add("        +---------->|    annotation   |--------------+")
-	add("        |           +-----------------+              |")
-	add("        |                   |                        |")
-	add("        |                   v                        |")
-	add("        |       build/gen/<basename>.errors.h        |")
-	add("        |       build/gen/<basename>.annotations.txt |")
-	add("        |         (report - NOT #included)           |")
-	add("        |                                            |")
-	add("        |           +-----------------+              |")
-	add("        +---------->| static-analysis |--------------+")
-	add("                    +-----------------+")
-	add("                            |")
-	add("                            v")
-	add("                    +---------------+")
-	add("                    |    report     |")
-	add("                    +---------------+")
-	add("                            |")
-	add("                            v")
-	add("                    build/gen/annotation_validation.txt")
-	add("                      (project summary)")
+
+	-- Compute Kahn layer per pass: layer L = max(deps' layer) + 1, layer 0
+	-- for deps-less passes. Repeated sweeps until every pass in `closed` is
+	-- assigned (handles forward refs that resolve on the second pass).
+	local pass_layer, max_layer = {}, 0
+	local sorted_closed = {}
+	for _, name in ipairs(closed) do sorted_closed[#sorted_closed + 1] = name end
+	table.sort(sorted_closed)
+	local function assign_layers()
+		local assigned_count = 0
+		for _, name in ipairs(sorted_closed) do
+			if pass_layer[name] == nil then
+				local p = passes[name]
+				local max_dep, ready = -1, true
+				for _, dep in ipairs(p.deps) do
+					if pass_layer[dep] == nil then ready = false; break end
+					if pass_layer[dep] > max_dep then max_dep = pass_layer[dep] end
+				end
+				if ready then
+					pass_layer[name] = max_dep + 1
+					if pass_layer[name] > max_layer then max_layer = pass_layer[name] end
+					assigned_count = assigned_count + 1
+				end
+			end
+		end
+		return assigned_count
+	end
+	while assign_layers() > 0 do end
+	-- Defensive invariant: any unresolved pass is a bug. topo_sort already
+	-- errors on cycles before this point, so reaching here means a logic
+	-- error in the renderer (or a synthetic call that bypassed topo_sort).
+	-- Surface the failure loudly with the offending names; never silently
+	-- place unresolved passes at layer 0 (which would corrupt the graph).
+	local unresolved = {}
+	for _, name in ipairs(sorted_closed) do
+		if pass_layer[name] == nil then unresolved[#unresolved + 1] = name end
+	end
+	if #unresolved > 0 then
+		error("render_dep_graph: unresolved Kahn layer for pass(es): "
+			.. table.concat(unresolved, ", ")
+			.. "; topo_sort should have caught this earlier")
+	end
+
+	-- Bucket passes by layer; sort each bucket alphabetically for stability.
+	local layers = {}
+	for i = 0, max_layer do layers[i] = {} end
+	for _, name in ipairs(sorted_closed) do
+		layers[pass_layer[name]][#layers[pass_layer[name]] + 1] = name
+	end
+	for i = 0, max_layer do table.sort(layers[i]) end
+
+	-- Layout constants. Boxes in the same layer share the same width
+	-- (computed as the layer's widest content + padding + walls).
+	local MAX_GRAPH_WIDTH   = 78
+	local MAX_BOXES_PER_ROW = 3
+	local GAP               = 3
+
+	local function pad_right(s, width)
+		if #s >= width then return s:sub(1, width) end
+		return s .. string.rep(" ", width - #s)
+	end
+
+	-- Compute the box width (in chars, including both walls) for a layer.
+	-- The interior is the wider of (a) the longest pass name + 1 leading
+	-- space and (b) the longest "<kind> <N>" suffix + 1 leading space.
+	-- Then add 2 for the wall chars.
+	--
+	-- Why +1 (not +2): the +1 formula means the layer's max-content row
+	-- has 0 padding before the right wall (the `|` is immediately after
+	-- the content). This is the collision-safe widening policy the task
+	-- requires — long names widen the box and never get trailing padding.
+	-- Shorter passes in the same layer get trailing padding to fill the
+	-- interior to the layer's uniform width; they never get truncated.
+	local function box_w_for_layer(bucket)
+		local max_content = 0
+		for _, name in ipairs(bucket) do
+			local p        = passes[name]
+			local out_n    = #(p.out or {})
+			local kind_suf = string.format("%s %d>", p.kind, out_n)
+			if #name     > max_content then max_content = #name     end
+			if #kind_suf > max_content then max_content = #kind_suf end
+		end
+		-- Interior = 1 leading space + max_content + 0 trailing (the
+		-- trailing `|` IS the right boundary); walls = 2.
+		return max_content + 3
+	end
+
+	-- Render one pass as a 4-row box at the given box_w. The interior is
+	-- always padded to fit exactly; no string is ever truncated.
+	local function render_box(name, box_w)
+		local p        = passes[name]
+		local out_n    = #(p.out or {})
+		local kind_suf = string.format("%s %d>", p.kind, out_n)
+		local interior = box_w - 2
+		local border   = "+" .. string.rep("-", interior) .. "+"
+		return {
+			border,
+			"|" .. pad_right(" " .. name,     interior) .. "|",
+			"|" .. pad_right(" " .. kind_suf, interior) .. "|",
+			border,
+		}
+	end
+
+	-- Join a single row (1..4) across all boxes in a sub-row, with GAP
+	-- spaces between adjacent boxes.
+	local function join_row(box_rows, row_idx)
+		local parts = {}
+		for i, b in ipairs(box_rows) do
+			parts[#parts + 1] = b[row_idx]
+			if i < #box_rows then parts[#parts + 1] = string.rep(" ", GAP) end
+		end
+		return table.concat(parts)
+	end
+
+	-- 'v' marker row beneath a sub-row: one 'v' centered under each box.
+	local function v_marker_row(box_rows)
+		local total = 0
+		local centers = {}
+		for i, b in ipairs(box_rows) do
+			local w = #b[1]  -- box width = length of the top border row
+			local center = total + math.floor(w / 2)
+			centers[#centers + 1] = center
+			total = total + w + GAP
+		end
+		-- total now includes a trailing GAP we don't want; trim it.
+		total = total - GAP
+		local s = string.rep(" ", total)
+		for _, c in ipairs(centers) do
+			s = s:sub(1, c) .. "v" .. s:sub(c + 2)
+		end
+		return s
+	end
+
+	-- Render a single sub-row (a contiguous chunk of a layer's bucket).
+	-- Emits the 4 box rows + an empty line + the 'v' marker row + an
+	-- empty line, EXCEPT the very last sub-row of the very last layer
+	-- omits the trailing 'v' marker (nothing flows below it).
+	local function render_subrow(bucket_chunk, is_last_subrow, is_last_layer)
+		local box_w = box_w_for_layer(bucket_chunk)
+		local boxes = {}
+		for _, name in ipairs(bucket_chunk) do boxes[#boxes + 1] = render_box(name, box_w) end
+		add(join_row(boxes, 1))  -- top borders
+		add(join_row(boxes, 2))  -- names
+		add(join_row(boxes, 3))  -- kind + output-count
+		add(join_row(boxes, 4))  -- bottom borders
+		-- 'v' marker row beneath this sub-row connects downward to the
+		-- next sub-row of the same layer (if any) OR to the next layer.
+		-- Skip the trailing 'v' only on the very last sub-row of the
+		-- final layer, where nothing flows below it.
+		if not is_last_subrow or not is_last_layer then
+			add("")
+			add(v_marker_row(boxes))
+			add("")
+		end
+	end
+
+	for layer_idx = 0, max_layer do
+		local bucket   = layers[layer_idx]
+		local is_last  = (layer_idx == max_layer)
+		-- Split the layer into sub-rows of at most MAX_BOXES_PER_ROW boxes.
+		-- With a 20-char box width (the canonical case: name "static-analysis"
+		-- is 15 chars, suffix "header-output 2>" is 16 chars) and GAP=3,
+		-- 3 boxes per sub-row = 3*20 + 2*3 = 66 cols + a 'v' row of 66 cols;
+		-- well within MAX_GRAPH_WIDTH. A 4th box would push to 4*20 + 3*3 = 89,
+		-- which is why MAX_BOXES_PER_ROW = 3 (wrap when >3).
+		local chunk_size = math.min(MAX_BOXES_PER_ROW, #bucket)
+		if chunk_size < 1 then chunk_size = 1 end
+		for chunk_start = 1, #bucket, chunk_size do
+			local chunk_end = math.min(chunk_start + chunk_size - 1, #bucket)
+			local chunk = {}
+			for i = chunk_start, chunk_end do chunk[#chunk + 1] = bucket[i] end
+			local is_last_subrow = (chunk_end == #bucket)
+			render_subrow(chunk, is_last_subrow, is_last)
+		end
+	end
 
 	return table.concat(lines, "\n") .. "\n"
 end
@@ -573,7 +883,7 @@ end
 -- @param result PassResult
 -- @return boolean
 local function report_validation_errors(pass_name, pass, result)
-	local has_errors = result.errors and #result.errors > 0
+	local   has_errors = result.errors and #result.errors > 0
 	if not (has_errors and PASS_KIND_STOP_ON_ERROR[pass.kind]) then
 		return false
 	end
@@ -585,7 +895,6 @@ local function report_validation_errors(pass_name, pass, result)
 end
 
 -- (internal) Run each pass in `order` in topological sequence.
---
 -- @param ctx PassCtx
 -- @param order string[]
 -- @return boolean  -- true if any validation errors were reported
@@ -594,6 +903,7 @@ local function dispatch_passes(ctx, order)
 	local had_errors = false
 	for _, pass_name in ipairs(order) do
 		local pass   = PASSES[pass_name]
+		io.stderr:write(string.format("[ps1_meta] %-22s running\n", pass_name))
 		local mod    = require(pass.module)
 		local result = mod.run(ctx)
 
@@ -617,7 +927,7 @@ local function main(argv)
 
 		-- --dry-run: print dep order + ASCII graph, exit OK.
 		if args.dry_run then
-			io.write(render_dep_graph(PASSES, requested, closed))
+			io.write(render_dep_graph(PASSES, closed))
 			os.exit(EXIT_OK)
 		end
 
@@ -633,4 +943,20 @@ local function main(argv)
 	os.exit(EXIT_OK)
 end
 
-main({...})
+-- Module export for in-process consumers (tests that dofile this script).
+-- The closure above, `render_dep_graph`, and the canonical `PASSES` table
+-- are exposed so a test can render the graph for synthetic PASSES tables
+-- without spawning a subprocess. The conditional `main(...)` call below
+-- only fires when this file is invoked as the entry script (arg[0] ends
+-- in "ps1_meta.lua"); in dofile() mode (test's arg[0] does not match),
+-- main() is skipped and the chunk returns `_M` to the caller.
+local _M = {
+	render_dep_graph = render_dep_graph,
+	PASSES           = PASSES,
+}
+
+if arg and arg[0] and arg[0]:match("ps1_meta%.lua$") then
+	main({...})
+end
+
+return _M

scripts/update_deps.ps1

@@ -10,19 +10,6 @@ $ErrorActionPreference = 'Stop'
 $misc = join-path $PSScriptRoot 'helpers/misc.ps1'
 . $misc
 
-# TODO(Ed): Review usage of these deps
-# I originally cloned them when starting to get to the C runtime usage of the course
-# However, based on the heavy reliance of the PSX.Dev extension I might fallback; also
-# The gdb server doesn't need the full repo and were only using the src/mips
-# which has a standalone repo (nuggets)
-# armips may not be used at all but I'm not sure...
-#
-# PCSX-Redux: built via MSBuild (VS2022) — automated in the build section below.
-# Requires: VS2022 with C++ desktop workload + PlatformToolset=v143 retarget.
-# The .vcxproj files request v145; we pass /p:PlatformToolset=v143 to MSBuild.
-# NuGet packages are restored automatically on first build.
-# Output: toolchain\pcsx-redux\vsprojects\x64\Debug\pcsx-redux.exe
-
 $url_armips     = 'https://github.com/Kingcom/armips.git'
 $url_pcsx_redux = 'https://github.com/grumpycoders/pcsx-redux.git'
 $url_psyq_iwyu  = 'https://github.com/johnbaumann/psyq_include_what_you_use.git'
@@ -114,6 +101,21 @@ push-location $path_lpeg
 &	gcc @lpeg_compile_args
 pop-location
 
+# ════════════════════════════════════════════════════════════════════════════
+# lfs (LuaFileSystem) — compiled from pcsx-redux's vendored luafilesystem source.
+# Used by word_count_eval.lua :: scan_dir for native directory enumeration (~2ms)
+# instead of spawning `dir /b /s` as a subprocess (~56ms).
+# Source: toolchain/pcsx-redux/third_party/luafilesystem/src/lfs.c
+# Output: toolchain/lfs/lfs.dll
+# ════════════════════════════════════════════════════════════════════════════
+
+$path_lfs = join-path $path_toolchain 'lfs'
+verify-path $path_lfs
+$lfs_src = join-path $path_pcsx_redux 'third_party\luafilesystem\src\lfs.c'
+$lfs_dll = join-path $path_lfs 'lfs.dll'
+$lfs_dll_import = join-path $luajit_lib_dir 'libluajit-5.1.dll.a'
+& gcc -O2 -shared "-I$lua_inc_dir" -o $lfs_dll $lfs_src $lfs_dll_import
+
 # ════════════════════════════════════════════════════════════════════════════
 # OpenBIOS — built from the PCSX-Redux source tree via make + mipsel-none-elf
 #