Fixes atom component gdb stepping. New phase/ctx annotations for atoms. Attempt at type views on registers (gdb pretty print failures).

Needs heavy curation and problably simplicication.

.vscode/launch.json

@@ -4,7 +4,7 @@
 	// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
 	"version": "0.2.0",
 	"configurations": [
-		{
+{
 			"name": "Debug: Hello Psy-Q!",
 			"type": "gdb",
 			"request": "attach",
@@ -12,6 +12,10 @@
 			"remote": true,
 			"cwd": "${workspaceRoot}/build",
 			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
 			"stopAtConnect": true,
 			"gdbpath": "gdb-multiarch",
 			"windows": {
@@ -20,10 +24,17 @@
 			"osx": {
 				"gdbpath": "gdb"
 			},
-			"executable": "${workspaceRoot}/build/hello_psyq.elf",
+			"executable": "${workspaceRoot}/build/hello_gte.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
 			"autorun": [
 				"monitor reset shellhalt",
-				"load hello_psyq.elf",
+				"load hello_gte.elf",
+				"source scripts/gdb/gdb_tape_atoms.gdb",
 				"tbreak main",
 				"continue"
 			]
@@ -36,6 +47,10 @@
 			"remote": true,
 			"cwd": "${workspaceRoot}/build",
 			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
 			"stopAtConnect": true,
 			"gdbpath": "gdb-multiarch",
 			"windows": {
@@ -44,10 +59,16 @@
 			"osx": {
 				"gdbpath": "gdb"
 			},
-			"executable": "${workspaceRoot}/build/hello_gpu.elf",
+			"executable": "${workspaceRoot}/build/hello_gte.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
 			"autorun": [
 				"monitor reset shellhalt",
-				"load hello_gpu.elf",
+				"load hello_gte.elf",
 				"tbreak main",
 				"continue"
 			]
@@ -60,6 +81,10 @@
 			"remote": true,
 			"cwd": "${workspaceRoot}/build",
 			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
 			"stopAtConnect": true,
 			"gdbpath": "gdb-multiarch",
 			"windows": {
@@ -69,12 +94,55 @@
 				"gdbpath": "gdb"
 			},
 			"executable": "${workspaceRoot}/build/hello_gte.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
 			"autorun": [
 				"monitor reset shellhalt",
 				"load hello_gte.elf",
 				"tbreak main",
 				"continue"
 			]
+		},
+		{
+			"name": "Debug: Hello GTE Psy-Q! (atoms debug — DWARF-injected)",
+			"type": "gdb",
+			"request": "attach",
+			"target": "localhost:3333",
+			"remote": true,
+			"cwd": "${workspaceRoot}",
+			"valuesFormatting": "parseText",
+			"registerLimit": "1-32",
+			"frameFilters": false,
+			"showDevDebugOutput": false,
+			"printCalls": false,
+			"stopAtConnect": true,
+			"gdbpath": "gdb-multiarch",
+			"windows": {
+				"gdbpath": "gdb-multiarch.exe"
+			},
+			"osx": {
+				"gdbpath": "gdb"
+			},
+			"executable": "${workspaceRoot}/build/hello_gte.dwarf-injected.elf",
+			"setupCommands": [
+				{ "text": "set mi-async off" },
+				{ "text": "set remotetimeout 0" },
+				{ "text": "set logging file build/gen/hello_gte.gdb.log" },
+				{ "text": "set logging redirect on" }
+			],
+			"autorun": [
+				"monitor reset shellhalt",
+				"load build/hello_gte.dwarf-injected.elf",
+				"source scripts/gdb/gdb_tape_atoms.gdb",
+				"source build/gen/hello_gte.gdbinit",
+				"tbreak main",
+				"continue"
+			]
 		}
 	]
 }
+

code/duffle/atom_dsl.h

@@ -3,34 +3,18 @@
  * ============================================================================
  *
  * ATOM DSL: Annotation layer for tape atoms (lottes_tape.h).
+ * The metaprogram (scripts/passes/annotation.lua) reads source-as-written and validates:
+ *   - atom_info(...) shape: up to three sub-calls (atom_bind(Binds_X), atom_reads(...), atom_writes(...)) in any order and are optional.
+ *   - rbind atoms (atom_info(..., atom_bind(Binds_X), ...)) reference a real Binds_* struct declaration.
+ *   - atom word-counts in word_counts.metadata.h match the body's actual .word count.
  *
- *   WHAT THIS HEADER IS
+ * Pure macro anntation.
- *   -------------------
+ * ---------------
- *   The metaprogram (scripts/passes/annotation.lua) reads source-as-written
+ * Don't want to constraint the macro usage to some attribute placment constraint, etc, don't want ot dela with the compiler.
- *   and validates:
+ * atom_info, atom_bind, atom_reads, atom_writes, atom_label, atom_dbg_skip_over each expand to a C comment or to nothing
- *     - atom_info(...) shape: up to three sub-calls (atom_bind(Binds_X),
+ * (C preprocessor strips them to whitespace).
- *       atom_reads(...), atom_writes(...)) in any order. All optional.
- *       (No phase token for now; phases may be reintroduced later.)
- *     - rbind atoms (atom_info(..., atom_bind(Binds_X), ...)) reference a
- *       real Binds_* struct declaration.
- *     - wave-context positions only reference the canonical 4-register
- *       set: R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase.
- *     - atom word-counts in word_counts.metadata.h agree with the body's
- *       actual .word count.
- *
- *   WHY A PURE MACRO (atom_info, atom_bind, atom_reads, atom_writes, atom_label)
- *   -----------------------------------------------------------------
- *   Each of these expands to a C comment or to nothing. The C preprocessor
- *   strips them to whitespace. The metaprogram reads the literal token from
- *   source-as-written, NOT from the preprocessed output. This means:
- *     - the C compiler does no work for them (no __attribute__, no
- *       _Pragma, no asm side-effects)
- *     - they can never silently drift from the metaprogram's view
- *       (the metaprogram re-reads the source on every build)
- *     - the annotation is invisible to the linker, debugger, and IDE
  *
  * ============================================================================
- *
  *  Usage:
  *      MipsAtom_(cube_tri) atom_info(
  *         atom_reads (R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
@@ -60,30 +44,15 @@
  *
  *  Annotation rules
  *  ----------------
- *      1. atom_info(...) is OPTIONAL. Most atoms have no annotation.
+ *      1. atom_info(...) is OPTIONAL. Atoms without atom_info are silently skipped by the metaprogram.
- *         Atoms without atom_info are silently skipped by the metaprogram.
+ *      2. If present, atom_info takes up to three sub-calls, all order-independent within the arg list:
- *
+ *           - atom_bind(Binds_X)
- *      2. If present, atom_info takes up to three sub-calls, all
+ *           - atom_reads(...)
- *         order-independent within the arg list:
+ *           - atom_writes(...)
- *           - atom_bind(Binds_X) (optional; only for rbind atoms)
+ *      3. atom_bind(Binds_X): metaprogram cross-references Binds_X against the `typedef struct Binds_X { ... } Binds_X;` declaration.
- *           - atom_reads(...) (optional; wave-context registers)
+ *      4. atom_reads(...) and atom_writes(...): Used to to check if registers are used correctly in macros: R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase.
- *           - atom_writes(...) (optional; wave-context registers)
+ *      5. atom_label(name: Utilize with atom_offset as a target location.
- *
+ *      6. atom_offset(F, T): Resolved by gen/atom_offsets.h, generated from the atom_label markers. Calculated during the offset pass of the lua  metaprogram.
- *      3. atom_bind(Binds_X) pins the ABI-struct shape -- the metaprogram
- *         cross-references Binds_X against the
- *         `typedef struct Binds_X { ... } Binds_X;` declaration.
- *
- *      4. atom_reads(...) and atom_writes(...) args are wave-context
- *         registers: R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase.
- *         Closed set. GTE / SP / DMA / I/O state is declared in source
- *         comments, not in atom_reads/atom_writes.
- *
- *      5. atom_label(name) is an anchor -- the macro is empty in C; the
- *         metaprogram records the marker at the current pos for offset
- *         calculation.
- *
- *      6. atom_offset(F, T) is resolved by gen/atom_offsets.h, generated
- *         from the atom_label markers.
  */
 
 #ifdef INTELLISENSE_DIRECTIVES
@@ -92,64 +61,69 @@
 #endif
 
 /* ============================================================================
- * WAVE-CONTEXT REGISTERS -- canonical register set for the tape wave model.
+ * atom_reads(...) / atom_writes(...)
- *
- *   R_PrimCursor  output pointer into the prim arena (next OT entry to write)
- *   R_FaceCursor  input pointer into the face array (next face to consume)
- *   R_VertBase    base pointer into the vertex arena (this wave's vertices)
- *   R_OtBase      base pointer into the ordering table (this wave's OT slot)
- *
- * Closed set. If your atom needs to touch GTE / SP / DMA / other side state,
- * declare it at the source level as you normally would -- but DO NOT put
- * those registers in atom_reads/atom_writes.
- *
- * ============================================================================*/
-
-/* ============================================================================
- * atom_reads(...) / atom_writes(...) -- wave-context register list
- *
- *   atom_reads(R_PrimCursor, R_FaceCursor)
- *         ->  (R_PrimCursor, R_FaceCursor)   // comma-evaluated, discarded
- *
- * The macro produces a comma-evaluated expression that the C compiler
- * silently discards (it sits in an unused arg position -- the result is
- * never bound). The Lua tool pattern-matches the "atom_reads(...)" /
- * "atom_writes(...)" token to extract the list.
- *
- * You can have at most one atom_reads(...) and at most one atom_writes(...)
- * in an atom_info(...) call. To declare multiple disjoint sets (rare), just
- * declare the union -- the metaprogram doesn't track which reads need which
- * writes at this granularity.
  *
+ * Used during the static analysis pass of the metaprogram to do
  * ============================================================================*/
 #define atom_reads(...)  (__VA_ARGS__)
 #define atom_writes(...) (__VA_ARGS__)
 
+/* ----------------------------------------------------------------------------
+ * atom_reg (per-enum opt-in marker for the DWARF register-alias registry)
+ *
+ * The bare `atom_reg` token adjacent to an enum entry in mips.h / lottes_tape.h flags that alias as debug-visible for scan_source's register_alias_registry.
+ * The C preprocessor strips it to a comment so no runtime symbol is created; the Lua scanner reads the bare token.
+ * ----------------------------------------------------------------------------*/
+#define atom_reg /* atom_reg: opt the preceding enum entry into the DWARF registry */
+
 /* ============================================================================
- * ATOM ANNOTATION MACROS
+ *   atom_info :
- *
- *   atom_info -- single unified annotation. OPTIONAL. Most atoms have none.
- *
  *      MipsAtom_(cube_tri) atom_info(
  *         atom_reads (R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
  *       , atom_writes(R_PrimCursor, R_FaceCursor)
  *      ){ ... };
  * 
- *   Shape (sub-args order-independent; all optional):
+ *  - atom_bind(Binds_X): metaprogram cross-references Binds_X against the `typedef struct Binds_X { ... } Binds_X;` declaration.
- *     - atom_bind(Binds_X):  at most one; pins the ABI-struct shape
+ *  - atom_reads(...):    comma-list of registers
- *     - atom_reads(...):     at most one; comma-list of wave-context registers
+ *  - atom_writes(...):   comma-list of registers
- *     - atom_writes(...):    at most one; comma-list of wave-context registers
- *
- *   No phase token for now. The metaprogram doesn't check ordering across
- *   atoms -- phases (init / bind / setup / work / commit / terminate) will
- *   be reintroduced when ordering checks are added.
- *
- *   The macro expands to a C comment (or to nothing). The C compiler does
- *   no work. The metaprogram reads the source-as-written directly.
- *
  * ============================================================================*/
 #define atom_info(...)  /* atom_info(__VA_ARGS__) */
 
+/* ----------------------------------------------------------------------------
+ * DEBUG SOURCE-STEP MARKERS
+ *
+ * Place atom_dbg_skip_over() before a MipsAtom_, MipsAtomComp_, or MipsAtomComp_Proc_.
+ * The following declaration kind determines whether the marker selects a whole atom or a component inline view.
+ * The source scanner associates the marker with that declaration; placement diagnostics are handled by the annotation pass.
+ * ----------------------------------------------------------------------------*/
+#define atom_dbg_skip_over() /* atom_dbg_skip_over: skip the following atom or component source view */
+
+/* ----------------------------------------------------------------------------
+ * Typed-view annotations (Registry for DWARF RR_<R_X> chain resolution)
+ *   atom_type(<T>) -- overloaded:
+ *      (a) enum-site default: `R_Foo = R_Tn, atom_reg atom_type(T)` 
+ *      Sets the per-alias default typed view in the register_alias_registry.
+ *      Consumed by the DWARF chain step (e) when no per-atom atom_ctx / atom_phase / atom_type callsite provides a stronger resolution.
+ *      (b) callsite override: `atom_reads(R_Foo atom_type(T), ...)` Overrides the per-alias default for THIS atom only.
+ *      Last-write-wins per R_Name; conflict -> error.
+ *   atom_ctx(<atom_name>) -- atom-info sub-call:
+ *       Propagate another atom's atom.rbind.fields (its Binds_* typed fields) into THIS atom's typed-view resolution.
+ *       The named atom must be an rbind atom (have `atom_bind(Binds_X)` in its `atom_info`).
+ *       Used as the escape hatch when atom_phase is not the natural correlation.
+ *   atom_phase(<label>) -- atom-info sub-call: 
+ *       Free-form C-identifier label for grouping atoms.
+ *       Within a phase, the FIRST atom in source-order that owns its own atom.rbind provides 
+ *       the Binds_* field types used by all other atoms in the same phase.
+ *       The preferred correlation mechanism; atom_ctx is the escape hatch for non-natural cases.
+ *
+ * All three expand to C comments
+ * (the bare-token convention matching `atom_reg` and `atom_dbg_skip_over`).
+ * The Lua scanner reads the bare tokens in source-as-written; the C preprocessor strips them.
+ * ----------------------------------------------------------------------------*/
+#define atom_type(T)        /* atom_type: associate <T> with the preceding enum entry (enum site) or this register (atom-info site) */
+#define atom_ctx(atom_name) /* atom_ctx: propagate <atom_name>'s Binds_* field types into this atom's typed views */
+#define atom_phase(label)   /* atom_phase: tag this atom with <label> for grouped typed-view resolution */
+
 /* ----------------------------------------------------------------------------
  * atom_bind(Binds_X) -- rbind sub-call of atom_info
  *
@@ -158,13 +132,7 @@
  *       , atom_writes(R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
  *   ){ ... };
  *
- * The Binds_X MUST be a typedef'd type (declared via
+ * The Binds_X MUST be a typedef'd type (declared via `typedef struct Binds_X { ... } Binds_X;` somewhere in the source).
- * `typedef struct Binds_X { ... } Binds_X;` somewhere in the source).
- * The Lua tool cross-references this. Missing struct = error.
- *
- * atom_bind is a SUB-CALL of atom_info, not a standalone annotation macro.
- *
- * The macro expands to a C comment. The metaprogram reads source-as-written.
  * ----------------------------------------------------------------------------*/
 #define atom_bind(binds_struct)  /* atom_bind(binds_struct) */
 
@@ -177,25 +145,11 @@
  *
  *   atom_offset(culling, bounds_chk)         ← resolved by gen/.offsets.h
  *
- * The metaprogram generates gen/atom_offsets.h with one
+ * The metaprogram generates gen/atom_offsets.h with one #define with the offset value per atom_offset(F, T) call.
- *   #define atom_offset__culling__bounds_chk  ((target - branch_pos - 1))
+ * The preprocessor then expands the call to the right immediate value.
- * per atom_offset(F, T) call. The preprocessor then expands your call to
- * the right immediate value.
- *
- * If gen/atom_offsets.h is stale (or atom_label(name) is undefined),
- * `atom_offset__F__T` becomes an undefined macro and the C build fails.
- * This catches:
- *   - typo in atom_label (no anchor → metaprogram doesn't emit the macro)
- *   - .offsets.h not regenerated after body edits
- *   - body edit that broke the offset math (recompile + retest picks it up
- *     in CPU emulator)
  *
+ * If gen/atom_offsets.h is stale (or atom_label(name) is undefined), `atom_offset_F_T` becomes an undefined macro and the C build fails.
  * ============================================================================*/
-
 #define atom_offset(F, T) atom_offset_ ## F ## _ ## T
-/* atom_label is a pure annotation for the metaprogram's offset calculations.
+// atom_label is a pure annotation for the metaprogram's offset calculations.
- * The macro expands to a C comment, so the C preprocessor strips it to
- * whitespace — NO instruction word is emitted in the asm. The metaprogram
- * still recognises the literal `atom_label(name)` token in source and
- * records the marker at the current pos. */
 #define atom_label(name) /* atom_label anchor: name */

code/duffle/gen/duffle.macs.h

@@ -23,7 +23,6 @@ WORD_COUNT(mac_yield, 4)
 ,	load_half_u(R_T2, R_FaceCursor, 2 * S_(S2))
 WORD_COUNT(mac_load_tri_indices, 3)
 
-/* Words: 18; Translates indices to vertex addresses and pushes them to GTE  */
 #define mac_gte_load_tri_verts(...) \
 	shift_lleft(R_AT, R_T0, v3s2_byteoff) \
 ,	add_u_self(R_AT, R_VertBase) \

code/duffle/gp.h

@@ -1,7 +1,6 @@
 /* ============================================================================
  *  duffle DSL Suffix Conventions
  *  ============================================================================
- *
  *  Every mnemonic in this header follows the same suffix grammar:
  *
  *  Primitive commands: gp0_cmd_poly_f3 = 0x20    (byte opcode)
@@ -26,8 +25,7 @@
  *    0. Opcode IDs             gp0_cmd_poly_f3 = 0x20
  *
  *  Vendor mnemonics (gte_mtc2, gte_mfc2, etc.) are NOT in this header.
- *  They live in the opt-in `gp_vendor_sym.h` for users who prefer the
+ *  They live in the opt-in `gp_vendor_sym.h` for users who prefer the PSYQ-style names.
- *  PSYQ-style names.
  * ============================================================================ */
 
 #ifdef INTELLISENSE_DIRECTIVES
@@ -41,15 +39,14 @@
 /* ============================================================================
  *  Hardware MMIO Addresses
  *  ============================================================================
- *
  *  PSX GPU has two 32-bit ports in the I/O register region at KSEG2
  *  0x1F800000+. GP0 (offset 0x10) is the data port (commands + params).
  *  GP1 (offset 0x14) is the control port (status, ctrl writes).
  * ============================================================================ */
 /* IO base address (KSEG2 0x1F800000+ for the I/O register region).
- * The 16-bit upper half `IO_BASE_ADDR_HI16` is the form used by
+ * The 16-bit upper half `IO_BASE_ADDR_HI16` is the form used by tape-side macros that pin a register
- * tape-side macros that pin a register to hold the IO base and access
+ * to hold the IO base and access ports via offsets:
- * ports via offsets — `lui $reg, 0x1F80` (1 word) then `sw $data, GPIO_PORT*_OFFSET($reg)` (1 word). 
+ *   `lui $reg, 0x1F80` (1 word) then `sw $data, GPIO_PORT*_OFFSET($reg)` (1 word). 
  * Mirrors the `IO_BASE_ADDR equ 0x1F80` + `gpio_port0 equ 0x1810` pattern from graphics_hello/gp.s. */
 enum {
     IO_BASE_ADDR      = 0x1F800000,  /* full 32-bit I/O region base */
@@ -75,10 +72,8 @@ enum {
 /* ============================================================================
  *  GP0 command byte constants + Layer 1 (GPU bitfield shifts)
  *  ============================================================================
- *
  *  8-bit GP0 opcodes (the upper byte of a primitive's first word). These are the BYTE only.
- *  The layer-1 bitfield-layout constants live in the same enum block
+ *  The layer-1 bitfield-layout constants live in the same enum block so the encoder can reference them by name. 
- *  so the encoder can reference them by name. 
  *  NO macro body past this point uses a raw shift or raw mask.
  *  Every shift/width/mask is named here, named once.
  *  Mirrors the OPCODE_SHIFT / RS_SHIFT / REG_MASK convention from mips.h.
@@ -143,9 +138,7 @@ enum {
 /* ============================================================================
  *  Layer 1.5 (per-field encoders) + Layer 2 (composite) + Layer 3 (semantic GP0 word builders)
  *  ============================================================================
- *
+ *  Layer 1.5 encoders take one field's value, mask it to its own width, and shift it to its own position. 
- *  Layer 1.5 encoders take one field's value, mask it to its own width,
- *  and shift it to its own position. 
  *  Mirrors `enc_op` / `enc_rs` / `enc_rt` in mips.h and `enc_gte_sf` / `enc_gte_mx` in gte.h. 
  *  Layer-2 composite encoders OR the per-field encoders together; layer-3 semantic macros delegate to the composites.
  *  No raw shifts or magic numbers in any macro body below this point.
@@ -186,10 +179,9 @@ enum {
 /* ============================================================================
  *  GP1 command byte constants + Layer 1 (display-mode + range + draw-area bitfield shifts)
  *  ============================================================================
- *
+ *  GP1 status bits are read from HW_GP1;
- *  GP1 status bits are read from HW_GP1; ctrl writes use GP1 commands
+ *  ctrl writes use GP1 commands packed into 32-bit words 
- *  packed into 32-bit words (cmd byte in the upper 8 bits via
+ *  (cmd byte in the upper 8 bits via `enc_gp0_cmd(cmd)`).
- *  `enc_gp0_cmd(cmd)` — never a raw shift).
  * ============================================================================ */
 enum {
     gp1_cmd_Reset                  = 0x00,
@@ -202,10 +194,9 @@ enum {
     gp1_cmd_VerticalDisplayRange   = 0x07,
     gp1_cmd_DisplayMode            = 0x08,
     /* Note: GP1 only has commands 0x00..0x08. 
-		 * The state-setter commands (SetTextureWindow, * SetDrawArea*, 
+		 * The state-setter commands (SetTextureWindow, * SetDrawArea*, SetDrawOffset, SetMaskBit) 
-		 * SetDrawOffset, SetMaskBit) live in the GP0 enum as * 0xE1..0xE6. 
+		 * live in the GP0 enum as * 0xE1..0xE6.
-		 * DrawArea word builders are below as GP0s * macros 
+		 * DrawArea word builders are below as GP0s * macros (since they emit GP0 commands). */
-		 * (since they emit GP0 commands). */
 
     /* ---- Display-mode payload flags (per PSX-SPX §"GP1 Display Mode").
      * Bit positions match the encoder shifts below; values are the
@@ -259,8 +250,7 @@ enum {
 #define enc_gp1_vrange_word(y1, y2)        (enc_gp0_cmd(gp1_cmd_VerticalDisplayRange)   | enc_gp1_vrange_y1(y1) | enc_gp1_vrange_y2(y2))
 
 /* ---- Layer 2: GP0 state-setter composite encoders ----
- * GP0(0xE3) SetDrawArea top-left and GP0(0xE4) SetDrawArea bottom-right
+ * GP0(0xE3) SetDrawArea top-left and GP0(0xE4) SetDrawArea bottom-right both use the same X/Y 10-bit signed payload as GP1 DisplayRange. */
- * both use the same X/Y 10-bit signed payload as GP1 DisplayRange. */
 #define enc_gp0_draw_area_tl_word(x, y)    (enc_gp0_cmd(gp0_cmd_SetDrawArea_TopLeft)  | enc_gp1_draw_x(x) | enc_gp1_draw_y(y))
 #define enc_gp0_draw_area_br_word(x, y)    (enc_gp0_cmd(gp0_cmd_SetDrawArea_BotRight) | enc_gp1_draw_x(x) | enc_gp1_draw_y(y))
 
@@ -282,7 +272,6 @@ enum {
 /* ============================================================================
  *  Pre-baked GPU state words
  *  ============================================================================
- *
  *  Common command words for boot-time GPU init and standard display configurations.
  * ============================================================================ */
 
@@ -356,7 +345,6 @@ enum {
 /* ============================================================================
  *  Primitive structs (8 polygon variants + tag)
  *  ============================================================================
- *
  *  Each struct follows the GPU-documented memory layout for the corresponding primitive command. 
  *  The PolyTag is the OT-link header; the rest of the struct is the primitive's body.
  *
@@ -390,8 +378,8 @@ typedef Struct_(PolyTag) {
  * No raw C-style casts. RHS values are assumed to be `U4` — caller passes a `U4` directly. */
 #define set_len(tag,v)  (C_(PolyTag_R,tag)->len  = u4_(v))
 #define set_addr(tag,v) (C_(PolyTag_R,tag)->addr = u4_(v))
-/* `set_code` is no longer in the new PolyTag design — the code byte lives
+/* `set_code` is no longer in the new PolyTag design — the code byte lives in the primitive body
- *  in the primitive body (e.g. `((Poly_F3*)(p))->code`), not in the tag.
+ * (e.g. `((Poly_F3*)(p))->code`), not in the tag.
  *  Use the typed primitive structs (Poly_F3, Poly_G4, etc.) and the `set_poly_*` setters,
  *  which set both the tag's length and the code. */
 #define get_len(tag)  C_(U4,C_(PolyTag_R,tag)->len)
@@ -511,7 +499,6 @@ typedef Struct_(Poly_GT4) {
 /* ============================================================================
  *  Texture Page (TPage) bit layout
  *  ============================================================================
- *
  *  The TPage data word sent via GP0(0x2X) has:
  *    bits  0..3   = texture page X    (4 bits, 64-px units, 0..16)
  *    bit   4      = texture page Y    (1 bit,  64-px units, 0/1)
@@ -575,7 +562,6 @@ typedef Struct_(TexturePage) { U4 raw; };
 /* ============================================================================
  *  CLUT (Color Look-Up Table) semantics
  *  ============================================================================
- * 
  *  CLUT is loaded into VRAM by sending a GP0 command whose payload is:
  *    bits  0..5   = Y in 16-px units (palette row)
  *    bits  6..14  = X in 16-px units (palette column)
@@ -608,7 +594,6 @@ enum {
 /* ============================================================================
  *  TIM file format constants and headers
  *  ============================================================================
- *
  *  TIM (Sony .TIM texture image) file structure:
  *    +0x00  U4 file_id (always 0x10 = TIM magic)
  *    +0x04  U4 version (always 0x00 for v1)
@@ -626,9 +611,8 @@ enum {
  *         +0x06 U2 px_height
  *         +0x08 ... pixel data
  *
- *  Future?: add `tim_load_to_vram(tim_ptr, vram_addr)` that
+ *  Future?: add `tim_load_to_vram(tim_ptr, vram_addr)` that emits the necessary GP0 commands.
- *  emits the necessary GP0 commands. Stoppped for now at the
+ *  Stoppped for now at the struct + enum level.
- *  struct + enum level.
  * ============================================================================ */
 enum {
     tim_file_id_magic = 0x10,
@@ -659,35 +643,24 @@ typedef Struct_(TIM_SectionHeader) {
  *  Tape-side GPU operations (NOT in this header)
  *  ============================================================================
  *
- *  No `mac_gp0_send` or related macros live in gp.h. Rationale: the
+ *  No `mac_gp0_send` or related macros live in gp.h.
- *  Lottes tape model uses OT-DMA for primitive submission, so atom bodies
+ *  Rationale: the Lottes tape model uses OT-DMA for primitive submission, so atom bodies write to main RAM (the OT/primitive buffer)
- *  write to main RAM (the OT/primitive buffer) and to GTE state — never
+ *  and to GTE state — never directly to the GPU ports at 0x1F801810 / 0x1F801814.
- *  directly to the GPU ports at 0x1F801810 / 0x1F801814. See
+ *  See `mac_format_f3_color`, `mac_insert_ot_tag`, `mac_gte_store_f3` in lottes_tape.h for the patterns atom bodies actually use.
- *  `mac_format_f3_color`, `mac_insert_ot_tag`, `mac_gte_store_f3` in
- *  lottes_tape.h for the patterns atom bodies actually use.
  *
- *  If a feature need arises requires tape-side GPU port writes (e.g. DMA-kick to
+ *  If a feature need arises requires tape-side GPU port writes 
- *  start GPU consumption of the OT, VBlank sync via GP1 status poll),
+ *  (e.g. DMA-kick to start GPU consumption of the OT, VBlank sync via GP1 status poll),
- *  the right home is `lottes_tape.h` alongside the rest of the `mac_*`
+ *  the right home is `lottes_tape.h` alongside the rest of the `mac_*` family:
- *  family — the encoder infrastructure is already in place:
+ *    1. The caller pins a register to hold the IO base, e.g. register U4 r_io rgcc(R_T4) = IO_BASE_ADDR;
+ *       The compiler emits `lui R_T4, IO_BASE_ADDR_HI16` outside the atom body (in the C prologue before tape_run).
+ *    2. The atom body uses `store_word(R_data, R_T4, GPIO_PORT0_OFFSET)` to write to GP0, and `store_word(R_data, R_T4, GPIO_PORT1_OFFSET)`
+ *       to write to GP1. Both are preprocessor-encodable because R_T4 is a fixed register and the GPIO_PORT*_OFFSET constants
+ *       fit in the `sw`'s 16-bit signed offset field. No placeholder-pun, no asm constraints, no hidden register choice.
+ *       Same pattern as the old graphics_hello/hello_gp_routines.s `reg_io_offset`/`gcmd_push` convention.
  *
- *    1. The caller pins a register to hold the IO base, e.g.
+ *  This mirrors the existing tape-side wave-context discipline: 
- *         register U4 r_io rgcc(R_T4) = IO_BASE_ADDR;
+ *  the caller binds the IO-base register via `rgcc()`, the macro assumes the binding is in effect,
- *       The compiler emits `lui R_T4, IO_BASE_ADDR_HI16` outside the
+ *  and the encoding falls out at preprocessor time. 
- *       atom body (in the C prologue before tape_run).
+ *  No additional GPU-domain macro layer required.
- *
- *    2. The atom body uses `store_word(R_data, R_T4, GPIO_PORT0_OFFSET)`
- *       to write to GP0, and `store_word(R_data, R_T4, GPIO_PORT1_OFFSET)`
- *       to write to GP1. Both are preprocessor-encodable because R_T4 is
- *       a fixed register and the GPIO_PORT*_OFFSET constants fit in the
- *       `sw`'s 16-bit signed offset field. No placeholder-pun, no asm
- *       constraints, no hidden register choice. Same pattern as the
- *       old graphics_hello/hello_gp_routines.s `reg_io_offset`/`gcmd_push`
- *       convention.
- *
- *  This mirrors the existing tape-side wave-context discipline: the
- *  caller binds the IO-base register via `rgcc()`, the macro assumes
- *  the binding is in effect, and the encoding falls out at preprocessor
- *  time. No additional GPU-domain macro layer required.
  * ============================================================================ */
 #pragma endregion Tape-Side Macros

code/duffle/gp_vendor_sym.h

@@ -2,10 +2,8 @@
  *  duffle DSL — GPU Vendor Mnemonics (opt-in)
  *  ============================================================================
  *
- *  Provides the PSYQ-style CamelCase aliases for the canonical duffle GPU
+ *  Provides the PSYQ-style CamelCase aliases for the canonical duffle GPU primitive setters and OT operations.
- *  primitive setters and OT operations. The duffle snake_case names are
+ *  The duffle snake_case names are primary; this header is for users who prefer the PSYQ SDK function names from the legacy C API.
- *  primary; this header is for users who prefer the PSYQ SDK function
- *  names from the legacy C API.
  *
  *  USAGE:   #include "duffle/gp_vendor_sym.h"   // after gp.h
  *
@@ -23,15 +21,11 @@
  *    OT operations:
  *      AddPrim(ot, p)  -> orderingtbl_add_primitive(ot, p)
  *
- *  The gp0_cmd_* / gp1_cmd_* byte constants are already short and
+ *  The gp0_cmd_* / gp1_cmd_* byte constants are already short and descriptive; no vendor alias is provided for them.
- *  descriptive; no vendor alias is provided for them.
- *
- *  The vendor mnemonics are NOT registered with the duffle word-count
- *  metadata (word_counts.metadata.h). They expand to the duffle canonical
- *  macros which DO have word-count entries (the ones emitted by
- *  mac_format_f3_color / mac_gte_store_f3 / etc.). Verification: V13
- *  (objdump byte-identical) holds.
  *
+ *  The vendor mnemonics are NOT registered with the duffle word-count metadata (word_counts.metadata.h).
+ *  They expand to the duffle canonical macros which DO have word-count entries
+ *  (the ones emitted by mac_format_f3_color / mac_gte_store_f3 / etc.). Verification: V13 (objdump byte-identical) holds.
  * ============================================================================ */
 
 #ifdef INTELLISENSE_DIRECTIVES

code/duffle/gte_vendor_sym.h

@@ -2,10 +2,8 @@
  *  duffle DSL — GTE Vendor Mnemonics (opt-in)
  *  ============================================================================
  *
- *  Provides the textbook MIPS assembly mnemonics for the GTE/COP2
+ *  Provides the textbook MIPS assembly mnemonics for the GTE/COP2 instructions as thin aliases to the canonical duffle macros in gte.h.
- *  instructions as thin aliases to the canonical duffle macros in gte.h.
+ *  The duffle names are primary; this header is for users who prefer the textbook mnemonics.
- *  The duffle names are primary; this header is for users who prefer
- *  the textbook mnemonics.
  *
  *  USAGE:   #include "duffle/gte_vendor_sym.h"   // after gte.h
  *

code/duffle/lottes_tape.h

@@ -14,16 +14,14 @@ typedef U4 const MipsCode;
 typedef Slice_(MipsCode);
 typedef Slice_MipsCode MipsAtom;
 
-#define MipsAtom_(sym) MipsCode tmpl(code,sym) [] align_(4) =
+#define MipsAtom_(sym) MipsCode sym [] align_(4) =
 
-// Bare form: file-scope declaration with hardcoded body.
 // Used for components with no args (e.g., ac_load_tri_indices) or identifier-args (hardcoded register names).
 //   MipsAtomComp_(ac_X) { body }
 // expands to:
 //   MipsCode ac_X[] align_(4) = { body };
 #define MipsAtomComp_(sym) MipsCode sym [] align_(4) =
 
-// Function form: function-body block that returns a MipsAtom slice.
 // Used for components with value-args (e.g., ac_format_f3_color).
 //   FI_ MipsAtom ac_X(args) MipsAtomComp_Proc_(ac_X, { body })
 // expands to:
@@ -34,16 +32,16 @@ typedef Slice_MipsCode MipsAtom;
 
 /* Register aliases */
 enum {
-	R_AtomJmp    = R_T9,
+	R_AtomJmp    = R_T9 atom_reg,  /* debug-visible; tape yield handshake scratch */
-	R_TapePtr    = R_T8,  /* The Instruction Stream Pointer */
+	R_TapePtr    = R_T8 atom_reg,  /* The Instruction Stream Pointer */
-	R_InCursor   = R_T4,  /* Input data cursor */
+	R_InCursor   = R_T4,
 
-	R_PrimCursor = R_T7,  /* VRAM output cursor (primitive buffer) */
+	R_PrimCursor = R_T7 atom_reg atom_type(U4 *),    /* VRAM output cursor (primitive buffer) */
-	R_FaceCursor = R_T4,  /* Input data cursor (indices/faces) */
+	R_FaceCursor = R_T4 atom_reg atom_type(V4_S2 *), /* Cube face-index cursor (V4_S2*); floor context switches to V3_S2* via atom_phase */
-	R_VertBase   = R_T5,  /* Base address of the vertex array */
+	R_VertBase   = R_T5 atom_reg atom_type(V3_S2 *), /* Base address of the vertex array */
-	R_OtBase     = R_T6,  /* Base address of the Ordering Table */
+	R_OtBase     = R_T6 atom_reg atom_type(U4 *),    /* Base address of the Ordering Table */
 
-/* Stringification codes for the GCC inline assembler clobber lists */
+/* Stringification codes for the GCC inline assembler clobber lists. */
 #define R_TapePtr_Code     R_T8_Code
 #define R_InCursor_Code    R_T4_Code
 
@@ -89,13 +87,13 @@ FI_ void        tb_init(TapeBuilder* tb, FArena* arena) { tb->ptr = arena->start
 FI_ TapeBuilder tb_make_old(             FArena* arena) { return (TapeBuilder){ arena->start, 0 }; }
 FI_ TapeBuilder tb_make(Slice mem) { return (TapeBuilder){ mem.ptr, mem.len, 0 }; }
 
-#define tb_emit_(tb, atom) tb_emit(tb, tmpl(code,atom))
+#define tb_emit_(tb, atom) tb_emit(tb, atom)
 FI_ void tb_emit(TapeBuilder* tb, MipsCode* atom) { u4_r(tb->ptr)[tb->used] = u4_(atom); ++ tb->used; }
 FI_ void tb_data(TapeBuilder* tb, U4        data) { u4_r(tb->ptr)[tb->used] = u4_(data); ++ tb->used; }
 
-FI_ Slice_U4 tb_end  (TapeBuilder* tb) { tb_emit(tb,code_tape_exit); return (Slice_U4){ C_(U4*,tb->ptr), tb->used }; }
+FI_ Slice_U4 tb_end  (TapeBuilder* tb) { tb_emit(tb,tape_exit); return (Slice_U4){ C_(U4*,tb->ptr), tb->used }; }
 FI_ Slice_U4 tb_slice(TapeBuilder  tb) {                             return (Slice_U4){ C_(U4*,tb.ptr),  tb.used }; }
-#define tb_scope(tb) for(U4 tbs_once=0;tbs_once==0;++tbs_once,tb_emit(tb,code_tape_exit))
+#define tb_scope(tb) for(U4 tbs_once=0;tbs_once==0;++tbs_once,tb_emit(tb,tape_exit))
 
 #pragma endregion Tape Drive
 
@@ -109,8 +107,7 @@ FI_ Slice_U4 tb_slice(TapeBuilder  tb) {                             return (Sli
 MipsAtomComp_(ac_yield) {
 	load_word(R_AtomJmp, R_TapePtr, 0),
 	add_ui_self(         R_TapePtr, S_(MipsCode)),
-	jump_reg( R_AtomJmp),
+	jump_reg( R_AtomJmp), nop,
-	nop,
 };
 
 /* Words: 3; Loads 3 S2 indices from the face array */
@@ -121,6 +118,7 @@ MipsAtomComp_(ac_load_tri_indices) {
 };
 
 /* Words: 18; Translates indices to vertex addresses and pushes them to GTE  */
+atom_dbg_skip_over()
 MipsAtomComp_(ac_gte_load_tri_verts) {
 	shift_lleft(R_AT, R_T0, v3s2_byteoff), add_u_self(R_AT, R_VertBase), load_word(R_V0, R_AT, O_(V3_S2,x)), load_word(R_V1, R_AT, O_(V3_S2,z)), gte_mv_to_data_r(R_V0, C2_VXY0), gte_mv_to_data_r(R_V1, C2_VZ0),
 	shift_lleft(R_AT, R_T1, v3s2_byteoff), add_u_self(R_AT, R_VertBase), load_word(R_V0, R_AT, O_(V3_S2,x)), load_word(R_V1, R_AT, O_(V3_S2,z)), gte_mv_to_data_r(R_V0, C2_VXY1), gte_mv_to_data_r(R_V1, C2_VZ1),
@@ -167,8 +165,7 @@ MipsAtomComp_Proc_(ac_pack_color_word, {
 })
 
 /* Words: 3; Emits the F3 command+color word (cmd byte | BLUE | GREEN | RED)
- * Args: _r, _g, _b are 8-bit RGB byte values (not raw 16-bit fields).
+ * Args: _r, _g, _b are 8-bit RGB byte values (not raw 16-bit fields). */
- * Migrated from hello_gte_tape.c; takes RGB form per the Phase 3 convention. */
 FI_ MipsAtom ac_format_f3_color(U1 r, U1 g, U1 b)
 MipsAtomComp_Proc_(ac_format_f3_color, { mac_pack_color_word(O_(Poly_F3,color), gp0_cmd_poly_f3, r, g, b) })
 
@@ -237,9 +234,8 @@ FI_ void atombuilder_unroll(MipsAtomBuilder_R ab, Slice_MipsCode_R code) {
 
 // When done authoring, utilize this to cap-off the atom
 FI_ void atombuilder_end(MipsAtomBuilder_R ab) {
-	LP_ MipsAtom_(yield) { mac_yield() };
+	mem_copy(ab->start, u4_(ac_yield), S_(ac_yield));
-	mem_copy(ab->start, u4_(code_yield), S_(code_yield));
+	mem_bump(ab->start, ab->capacity, & ab->used, S_(ac_yield));
-	mem_bump(ab->start, ab->capacity, & ab->used, S_(code_yield));
 }
 
 #define mipsatom_from_builder(ab) (MipsAtom){ab.start, ab.used}
@@ -269,8 +265,7 @@ internal MipsAtom_(mips_flush_icache) {
 	store_word(rret_addr, rstack_ptr, S_(U4)),           // sw  $ra,   4($sp) 
 	add_ui(rret_0, rdiscard, bios_flushcache),           // addiu $a0, $0, 0x44 
 	add_ui(rtmp_0, rdiscard, bios_table_addr),           // addiu $t0, $0, 0xA0 
-	jump_link(rtmp_0, rret_addr),                        // jalr  $t0, $ra 
+	jump_link(rtmp_0, rret_addr), nop,                   // jalr  $t0, $ra, BD slot
-	nop,                                                 // BD slot 
 	load_word(rret_addr, rstack_ptr, S_(U4)),            // lw   $ra, 4($sp) 
 	jump_reg(rret_addr),                                 // jr   $ra 
 	add_ui(rstack_ptr, rstack_ptr, MipsStackAlignment),  // sp += 8 (BD) 

code/duffle/mips.h

@@ -1,38 +1,28 @@
 /* ============================================================================
  *  duffle DSL Suffix Conventions
  *  ============================================================================
- *
  *  Every mnemonic in this header follows the same suffix grammar:
- *
+ *    _i: Immediate value (16-bit constant operand). 
- *    _i        Immediate value (16-bit constant operand). Combine with
+ *        Combine with _u or _s (single-letter modifier + type combined): add_ui, add_si.
- *              _u or _s (single-letter modifier + type combined): add_ui,
+ *        Examples: add_ui, add_si, and_i, or_i, xor_i, load_upper_i. and_i is sign-agnostic (andi zero-extends).
- *              add_si. Examples: add_ui, add_si, and_i, or_i, xor_i,
+ *        load_upper_i is a unique verb; _i is the immediate marker, not a modifier+type combination.
- *              load_upper_i. and_i is sign-agnostic (andi zero-extends).
+ *    _u: Unsigned (no-overflow, no-sign-extension).
- *              load_upper_i is a unique verb; _i is the immediate marker,
+ *        R-type arithmetic examples: add_u, sub_u, mult_u, div_u. I-type (combined with _i): add_ui.
- *              not a modifier+type combination.
+ *    _s: Signed (overflow-traps, sign-extends). 
- *
+ *        R-type: add_s, sub_s, mult_s, div_s, set_lt_s. I-type (combined with _i): add_si.
- *    _u        Unsigned (no-overflow, no-sign-extension). R-type
- *              arithmetic examples: add_u, sub_u, mult_u, div_u. I-type
- *              (combined with _i): add_ui.
- *
- *    _s        Signed (overflow-traps, sign-extends). R-type: add_s,
- *              sub_s, mult_s, div_s, set_lt_s. I-type (combined with _i):
- *              add_si.
  *
  *  --- Shift family (R-type): verb-modifier-direction ---
- *    The shift macros use `shift_<modifier><direction>`. Modifier is
+ *    The shift macros use `shift_<modifier><direction>`.
- *    the single letter `l` (logical) or `a` (arithmetic). Direction
+ *    Modifier is the single letter `l` (logical) or `a` (arithmetic).
- *    is the word `left` or `right`. Combined: `_lleft`, `_lright`,
+ *    Direction is the word `left` or `right`. Combined: `_lleft`, `_lright`, `_aright`.
- *    `_aright`. Examples: shift_lleft( rd, rt, shamt) (= sll)
+ *    Examples: shift_lleft( rd, rt, shamt) (= sll)
  *              shift_lright(rd, rt, shamt) (= srl)
  *              shift_aright(rd, rt, shamt) (= sra)
- *    (no `_aleft`; MIPS has no `sla` — arithmetic-left is bit-identical
+ *    (no `_aleft`; MIPS has no `sla` — arithmetic-left is bit-identical to logical-left, so use shift_lleft for that case)
- *    to logical-left, so use shift_lleft for that case)
  *
  *  --- Jump/Call family ---
- *    Simple jumps keep the original short names: jump (j), jump_reg
+ *    Simple jumps keep the original short names: jump (j), jump_reg (jr), jump_link (jalr rs, rd).
- *    (jr), jump_link (jalr rs, rd). The jump-and-link-to variants
+ *    The jump-and-link-to variants (jal, jalr rs with default $ra) get the `call_` verb instead:
- *    (jal, jalr rs with default $ra) get the `call_` verb instead:
  *    call_addr (jal), call_reg (jalr rs, default $ra).
  *    Examples: jump(off)         (= j)
  *              jump_reg(rs)      (= jr)
@@ -40,30 +30,20 @@
  *              call_reg(rs)      (= jalr rs, default $ra)
  *              call_addr(off)    (= jal)
  *
- *    _r        Register marker — used only when the register type needs
+ *    _r: Register marker — used only when the register type needs disambiguation (e.g., GTE data register vs control register).
- *              disambiguation (e.g., GTE data register vs control
+ *        NOT used in plain R-type arithmetic (the R-type is implicit). Examples: gte_mv_to_data_r, gte_mv_to_ctrl_r.
- *              register). NOT used in plain R-type arithmetic (the
+ *    _self:     Destination equals one source operand.
- *              R-type is implicit). Examples: gte_mv_to_data_r,
+ *               Examples: add_ui_self (I-type, to self), add_u_self (R-type, to self).
- *              gte_mv_to_ctrl_r.
+ *    _mv_to_:   Direction: data flows into X.
- *
- *    _self     Destination equals one source operand.
- *              Examples: add_ui_self (I-type, to self),
- *                        add_u_self (R-type, to self).
- *
- *    _mv_to_   Direction: data flows into X.
  *               Example: gte_mv_to_data_r, gte_mv_to_ctrl_r.
- *
+ *    _mv_from_: Direction: data flows out of X.
- *    _mv_from_ Direction: data flows out of X.
  *               Example: gte_mv_from_data_r, gte_mv_from_ctrl_r.
- *
+ *    _str:      String-form — emits inline-asm string instead of `.word`.
- *    _str      String-form — emits inline-asm string instead of `.word`.
  *               Example: gte_rtpt_asm_str.
- *
+ *    _2w / _1w: Word count of the emitted sequence.
- *    _2w / _1w Word count of the emitted sequence.
  *               Example: load_imm_2w.
  *
- *    _cop2     RESERVED — DO NOT USE in macro names. The `gte_` namespace
+ *    _cop2: RESERVED — DO NOT USE in macro names. The `gte_` namespace prefix already implies coprocessor 2. Use `c2` only in:
- *              prefix already implies coprocessor 2. Use `c2` only in:
  *      (a) integer opcode enums (op_lwc2 = 0x32, op_swc2 = 0x3A)
  *      (b) vendor-mnemonic macro aliases (gte_mtc2, gte_mfc2)
  *
@@ -80,9 +60,8 @@
  *            gte_lw_v0_xy(base) (gte + lw + v0 + xy)
  *            load_upper_i       (load-upper + immediate, unique verb)
  *
- *  Vendor mnemonics (sll, srl, sra, jr, j, jal, jalr) are NOT in this
+ *  Vendor mnemonics (sll, srl, sra, jr, j, jal, jalr) are NOT in this header.
- *  header. They live in the opt-in `mips_vendor_sym.h` for users who
+ *  They live in the opt-in `mips_vendor_sym.h` for users who prefer the textbook MIPS assembly mnemonics.
- *  prefer the textbook MIPS assembly mnemonics.
  * ============================================================================ */
 
 #ifdef INTELLISENSE_DIRECTIVES
@@ -98,19 +77,17 @@ enum {
 /* ============================================================================
  *  REGISTER INTEGER IDS (preprocessor-visible)
  * ============================================================================
- *  Every R_* enum below has a parallel R_*_Code `#define` so that the
+ *  Every R_* enum below has a parallel R_*_Code `#define` so that the preprocessor can stringify the integer
- *  preprocessor can stringify the integer (e.g. for asm clobber lists and
+ *  (e.g. for asm clobber lists and register-variable declarations via `rgcc(R_X)`).
- *  register-variable declarations via `rgcc(R_X)`). The enum value is
+ *  The enum value is bound to the `#define` so the two forms cannot drift apart.
- *  bound to the `#define` so the two forms cannot drift apart.
  *
- *  Only registers that get stringified need a `_Code` form; the rest are
+ *  Only registers that get stringified need a `_Code` form; the rest are plain enum values.
- *  plain enum values. If you need to add a new one, follow the pattern:
+ *  If you need to add a new one, follow the pattern:
  *      #define R_T7_Code 15
  *      R_T7 = R_T7_Code,     // in the enum
  *
- *  User code should always reference the enum form (`R_T4`) at arithmetic
+ *  User code should always reference the enum form (`R_T4`) at arithmetic sites and let
- *  sites and let `rlit(R_T4_Code)` / `rgcc(R_T4)` handle the stringify
+ *  `rlit(R_T4_Code)` / `rgcc(R_T4)` handle the stringify cases — never write the bare number `12`.
- *  cases — never write the bare number `12`.
  * ============================================================================ */
 #define R_0_Code    0
 #define R_AT_Code   1
@@ -225,7 +202,6 @@ enum {
 	/* 2F: N/A */
 	// , op_lwc0
 
-
 	// , op_load_addr  = op_la
 	// , op_load_imm   = op_li
 	, op_jump       = op_j
@@ -404,12 +380,9 @@ enum { _BitOffsets = 0
  * mult_s / mult_u → mult / multu   (writes HI/LO; result in LO)
  * div_s / div_u   → div / divu     (LO = quot, HI = rem)
  *
- * NOTE: dsl.h defines `add_s`/`sub_s`/`mut_s`/`gt_s`/etc. as
+ * NOTE: dsl.h defines `add_s`/`sub_s`/`mut_s`/`gt_s`/etc. as _Generic-based signed integer-arithmetic helpers for U1/U2/U4.
- * _Generic-based signed integer-arithmetic helpers for U1/U2/U4. Those
+ * Those live in a different conceptual layer (generic arithmetic on DSL types) and would collide with the instruction encoders here.
- * live in a different conceptual layer (generic arithmetic on DSL
+ * The `#undef` below lets the gas-style names below win; if a file needs both, the dsl.h versions can be reached via their long forms
- * types) and would collide with the instruction encoders here. The
- * `#undef` below lets the gas-style names below win; if a file needs
- * both, the dsl.h versions can be reached via their long forms
  * (e.g. `def_signed_op`-style or the underlying `add_s1/s2/s4`). */
 #undef add_s
 #undef sub_s
@@ -472,22 +445,18 @@ enum { _BitOffsets = 0
 
 /* load_imm_2w — unconditional 2-word `li` form: `lui` + (ori | addi).
  *
- * Granular companion to `load_imm`: skips the compile-time range checks
+ * Granular companion to `load_imm`: skips the compile-time range checks and always emits 2 .words. Use this when:
- * and always emits 2 .words. Use this when:
  *   - you know `imm` is > 0xFFFF (otherwise you're wasting a word), OR
  *   - `imm` is not a compile-time constant and you want predictable
  *     2-word emission without the `__builtin_constant_p` branches.
  *
  * The lo16 strategy is still chosen at expansion time on the lo half:
- *   lo16 in 0x0000..0x7FFF  →  addi (sign-ext is harmless, the lui
+ *   lo16 in 0x0000..0x7FFF  →  addi (sign-ext is harmless, the lui already cleared bits 15..0)
- *                              already cleared bits 15..0)
+ *   lo16 in 0x8000..0xFFFF  →  ori  (zero-extends to preserve the intended bit pattern)
- *   lo16 in 0x8000..0xFFFF  →  ori  (zero-extends to preserve the
- *                              intended bit pattern)
  *
- * For situations where you need to bypass even this choice (e.g. to
+ * For situations where you need to bypass even this choice 
- * force a specific encoding for a known discontiguous high/low pair),
+ * (e.g. to force a specific encoding for a known discontiguous high/low pair),
  * see `load_imm_2w_ori_forced` and `load_imm_2w_addi_forced` below.
- *
  * Statement-level (not expression-level): emits its own `asm volatile(...)`.
  */
 #define load_imm_2w(rt, imm) do {                         \
@@ -518,9 +487,8 @@ enum { _BitOffsets = 0
 } while (0)
 
 /* load_imm_2w_addi_forced — force the `lui` + `addi` form regardless of lo16 sign.
- * Use when you know sign-extension is fine (e.g. lo16 is treated as
+ * Use when you know sign-extension is fine (e.g. lo16 is treated as signed downstream) 
- * signed downstream) and you want a smaller effective instruction
+ * and you want a smaller effective instruction (the assembler/MIPS hardware will sign-extend the imm16). */
- * (the assembler/MIPS hardware will sign-extend the imm16). */
 #define load_imm_2w_addi_forced(rt, imm) do {   \
 	/*U4 _li2a_imm_ = (U4)(imm);*/                \
 	asm volatile(asm_words(                       \
@@ -532,23 +500,17 @@ enum { _BitOffsets = 0
 
 /* load_imm rt, imm — true `li` semantics (assembler `li` pseudo)
  *
- * Dispatches at compile time on the immediate's range, picking the
+ * Dispatches at compile time on the immediate's range, picking the smallest single-instruction form when possible:
- * smallest single-instruction form when possible:
- *
  *   imm in 0       .. 0x7FFF     →  addi  rt, $0, imm   (1 word)
  *   imm in 0x8000  .. 0xFFFF     →  ori   rt, $0, imm   (1 word; sign-bit must be zeroed)
  *   imm in 0x10000 .. 0xFFFFFFFF →  lui + (ori | addi)  (2 words)
  *
- * Statement-level (not expression-level): the macro emits its own
+ * Statement-level (not expression-level): the macro emits its own `asm volatile(...)` block with 1 or 2 .word constants.
- * `asm volatile(...)` block with 1 or 2 .word constants. Callers can
+ * Callers can group multiple `load_imm` calls in a single volatile by using the lower-level encoders directly:
- * group multiple `load_imm` calls in a single volatile by using the
- * lower-level encoders directly:
- *
  *      load_imm(R_T4, 0x12345678);          // emits 2 .words
  *
- * Falls back to a 2-word form if `imm` is not a compile-time constant,
+ * Falls back to a 2-word form if `imm` is not a compile-time constant, but that path is unusual
- * but that path is unusual (load_imm is most useful with literal
+ * (load_imm is most useful with literal addresses and magic numbers). */
- * addresses and magic numbers). */
 #define load_imm(rt, imm) do {                                     \
 	if (cexpr_(imm) && ((imm) <= 0x7FFFU)) {                         \
 		/* Small positive: addi rt, $0, imm */                         \
@@ -588,9 +550,8 @@ enum { _BitOffsets = 0
 
 
 /* Standard clobber list for pure-MIPS asm volatile blocks: caller-saved
- * GPRs that the kernel treats as volatile (v0/v1/t0/t1/ra) plus the
+ * GPRs that the kernel treats as volatile (v0/v1/t0/t1/ra) plus the "memory" barrier.
- * "memory" barrier. The register ids are passed through `rlit` so
+ * The register ids are passed through `rlit` so the R_*_Code `#define`s are stringified into "$N" at expansion time. */
- * the R_*_Code `#define`s are stringified into "$N" at expansion time. */
 #define clbr_volatile_gprs rlit(R_V0), rlit(R_T0), rlit(R_T1), rlit(R_RA), clb_mem_drain
 
 #define asm_mips_flush_icache() asm volatile( asm_words( \

code/duffle/mips_vendor_sym.h

@@ -2,9 +2,8 @@
  *  duffle DSL — MIPS Vendor Mnemonics (opt-in)
  *  ============================================================================
  *
- *  Provides the textbook MIPS assembly mnemonics as thin aliases to the
+ *  Provides the textbook MIPS assembly mnemonics as thin aliases to the canonical duffle macros in mips.h.
- *  canonical duffle macros in mips.h. The duffle names are primary; this
+ *  The duffle names are primary; this header is for users who prefer the textbook mnemonics.
- *  header is for users who prefer the textbook mnemonics.
  *
  *  USAGE:   #include "duffle/mips_vendor_sym.h"   // after mips.h
  *

code/duffle/word_count.metadata.h

@@ -5,11 +5,10 @@
 // Format: WORD_COUNT(MACRO_NAME, COUNT)
 // One line per macro that appears in your atom sources.
 //
-// This file is encoding-macros-only. The auto-generated component
+// This file is encoding-macros-only. 
-// macros (mac_X) live in duffle/gen/<dir>.macs.h (included separately
+// The auto-generated component macros (mac_X) live in duffle/gen/<dir>.macs.h (included separately by the unity build).
-// by the unity build). The unity build should include THIS file and
+// The unity build should include THIS file and the .macs.h file in the same TU, with both wrapped 
-// the .macs.h file in the same TU, with both wrapped (or the
+// (or the include guard order handled) to avoid WORD_COUNT redeclaration.
-// include guard order handled) to avoid WORD_COUNT redeclaration.
 //
 // To regenerate: hand-count the instructions in each macro definition.
 // (You'll only need to do this once per macro — they don't change often.)

code/gte_hello/hello_gte.c

@@ -259,9 +259,9 @@ void update(PrimitiveArena* pa, U4* ordering_buf)
 		U4 prim_base   = u4_(pa->buf[smem.active_buf_id]);
 		U4 prim_cursor = prim_base + pa->used;
 
-		LP_ U4 mem_temp_tape[512]; FArena tape_arena; farena_init(& tape_arena, slice_ut_arr(mem_temp_tape));
+		LP_ U4 mem_temp_tape[512];
-		TapeBuilder tb = tb_make_old(&tape_arena); tb_scope(& tb) {
+		TapeBuilder tb = tb_make(slice_ut_arr(mem_temp_tape)); tb_scope(& tb) {
-			tb_emit(& tb, code_rbind_cube_g4_face);
+			tb_emit(& tb, rbind_cube_g4_face);
 				tb_data(& tb, prim_cursor);
 				tb_data(& tb, u4_(smem.cube.faces));
 				tb_data(& tb, u4_(smem.cube.verts));
@@ -269,10 +269,10 @@ void update(PrimitiveArena* pa, U4* ordering_buf)
 
 			for (U4 i = 0; i < Cube_num_faces; i++) {
 				// Two triangles per quad face: (x,y,z) and (x,z,w)
-				tb_emit(& tb, code_cube_g4_face);
+				tb_emit(& tb, cube_g4_face);
 			}
 
-			tb_emit(& tb, code_sync_primitive_arena);
+			tb_emit(& tb, sync_primitive_arena);
 				tb_data(& tb, u4_(& pa->used));
 				tb_data(& tb, prim_base);
 		}
@@ -350,20 +350,20 @@ void update(PrimitiveArena* pa, U4* ordering_buf)
 		// Prepare the tape. (Push protocol to tape)
 		LP_ U4 mem_temp_tape[512];
 		TapeBuilder tb = tb_make(slice_ut_arr(mem_temp_tape)); tb_scope(& tb) {
-			tb_emit(& tb, code_set_gte_world);
+			tb_emit(& tb, set_gte_world);
 				tb_data(& tb, u4_(& smem.tform_world));
 
-			tb_emit(& tb, code_rbind_floor_f3_face);
+			tb_emit(& tb, rbind_floor_f3_face);
 			// TODO(Ed): Just use a single context struct ref
 				tb_data(& tb, prim_cursor);
 				tb_data(& tb, u4_(smem.floor.faces));
 				tb_data(& tb, u4_(smem.floor.verts));
 				tb_data(& tb, u4_(ordering_buf));
 			for (U4 i = 0; i < Floor_num_faces; i++) {
-				tb_emit(& tb, code_floor_f3_face);
+				tb_emit(& tb, floor_f3_face);
 			}
-			// After code_floor_f3_face iterations complete, the primitive arena's used counter needs updating.
+			// After floor_f3_face iterations complete, the primitive arena's used counter needs updating.
-			tb_emit(& tb, code_sync_primitive_arena);
+			tb_emit(& tb, sync_primitive_arena);
 				tb_data(& tb, u4_(& pa->used));
 				tb_data(& tb, prim_base);
 		}

code/gte_hello/hello_gte_tape.c

@@ -22,7 +22,7 @@ typedef Struct_(Binds_CubeTri) {
 	V3_S2* VertBase;
 	U4*    OtBase;
 };
-internal MipsAtom_(rbind_cube_g4_face) atom_info(atom_bind(Binds_CubeTri)
+internal MipsAtom_(rbind_cube_g4_face) atom_info(atom_bind(Binds_CubeTri), atom_phase(cube_g4)
 ,	atom_reads(R_TapePtr)
 ,	atom_writes(R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
 ){
@@ -35,14 +35,9 @@ internal MipsAtom_(rbind_cube_g4_face) atom_info(atom_bind(Binds_CubeTri)
 	mac_yield()
 };
 
-/* ============================================================================
+ // cube_g4_face — Draw one cube face (Gouraud-shaded quad) via the GTE tape pipeline
- *  cube_g4_face — Draw one cube face (Gouraud-shaded quad) via the GTE tape pipeline
- * ============================================================================
- *  Reads 4 indices from R_FaceCur (V4_S2 = 8 bytes), loads 4 vertices into
- *  the GTE, runs the PsyQ RotAverageNclip4 sequence, and renders a Poly_G4.
- */
 internal
-MipsAtom_(cube_g4_face) atom_info(
+MipsAtom_(cube_g4_face) atom_info(atom_phase(cube_g4),
 		atom_reads( R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase),
 		atom_writes(R_PrimCursor, R_FaceCursor)
 ){
@@ -95,7 +90,7 @@ typedef Struct_(Binds_FloorTri) {
 	U4*    OtBase;
 };
 internal
-MipsAtom_(rbind_floor_f3_face) atom_info(atom_bind(Binds_FloorTri)
+MipsAtom_(rbind_floor_f3_face) atom_info(atom_bind(Binds_FloorTri), atom_phase(floor_f3)
 	, atom_reads(R_TapePtr)
 	, atom_writes(R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
 ){
@@ -109,7 +104,8 @@ MipsAtom_(rbind_floor_f3_face) atom_info(atom_bind(Binds_FloorTri)
 };
 
 internal
-MipsAtom_(floor_f3_face) atom_info(
+atom_dbg_skip_over()
+MipsAtom_(floor_f3_face) atom_info(atom_phase(floor_f3)
 	, atom_reads( R_PrimCursor, R_FaceCursor, R_VertBase, R_OtBase)
 	, atom_writes(R_PrimCursor, R_FaceCursor)
 ) {

readme.md

@@ -27,6 +27,13 @@ scoop install luajit
 
 * Lua is slow (even jitted) so this helps.
 
+[lfs (LuaFileSystem)](https://github.com/lunarmodules/luafilesystem)
+
+* Native directory enumeration + `mkdir` for the build scripts.
+* Used by `passes/word_count_eval.lua :: scan_dir` (native walk vs. `dir /b /s` subprocess,
+  ~2ms vs. ~56ms) and by `duffle.lua :: ensure_dir` + `to_absolute_path` (avoids
+  `cmd.exe mkdir` + `cd` shell spawns, ~50ms each).
+
 [pscx-redux](https://github.com/grumpycoders/pcsx-redux/): A collection of tools, research, hardware design, and libraries aiming at development and reverse engineering on the PlayStation 1.
 
 * Used as the runtime sandbox emulated the ps1

scratch/gte_debug.lua

@@ -0,0 +1,30 @@
+-- gte_debug.lua — defensive version + prints error context.
+local ok, err = pcall(function()
+    print("[debug] PCSX exists:", PCSX ~= nil)
+    print("[debug] PCSX.WebServer exists:", PCSX and PCSX.WebServer ~= nil)
+    print("[debug] PCSX.WebServer.Handlers exists:", PCSX and PCSX.WebServer and PCSX.WebServer.Handlers ~= nil)
+    if not PCSX.WebServer then
+        print("[debug] creating PCSX.WebServer...")
+        PCSX.WebServer = {}
+    end
+    if not PCSX.WebServer.Handlers then
+        print("[debug] creating PCSX.WebServer.Handlers...")
+        PCSX.WebServer.Handlers = {}
+    end
+    print("[debug] type of Handlers:", type(PCSX.WebServer.Handlers))
+
+    PCSX.WebServer.Handlers.gte = function(req)
+        local r = PCSX.getRegisters()
+        local out = { "pc=0x" .. string.format("%x", r.pc) }
+        for i = 0, 31 do
+            out[#out + 1] = string.format("D[%d]=0x%08x C[%d]=0x%08x",
+                i, r.CP2D.r[i], i, r.CP2C.r[i])
+        end
+        return table.concat(out, "\n")
+    end
+    print("[debug] handler registered")
+end)
+
+if not ok then
+    print("[debug] ERROR: " .. tostring(err))
+end

scripts/audit_lua_nesting.lua

@@ -168,28 +168,18 @@ if arg and arg[1] then
 	end
 
 	-- Accept either a directory or a file path. Directory args are
-	-- expanded via `dir /b *.lua` (Windows) or `ls *.lua` (Unix).
+	-- expanded via lfs.dir (native, no subprocess).
+	local lfs = require("lfs")
 	local function is_dir(p)
-		local f = io.open(p, "r")
+		return lfs.attributes(p, "mode") == "directory"
-		if    f then f:close() return false end
-		return true
 	end
 	local function list_lua(dir)
 		local out = {}
-		local cmd
+		if not is_dir(dir) then return out end
-		if package.config:sub(1, 1) == "\\" then
+		for entry in lfs.dir(dir) do
-			cmd = 'dir /b "' .. dir .. '\\*.lua" 2>nul'
+			if entry:match("%.lua$") then
-		else
+				out[#out + 1] = dir .. "/" .. entry
-			cmd = 'ls -1 "' .. dir .. '"/*.lua 2>/dev/null'
 			end
-		local p = io.popen(cmd)
-		if p then
-			for line in p:lines() do
-				if line:match("%.lua$") then
-					out[#out + 1] = dir .. "/" .. line
-				end
-			end
-			p:close()
 		end
 		return out
 	end

scripts/build_psyq.ps1

@@ -321,11 +321,12 @@ function ps1-meta { param(
 		[Parameter(Mandatory=$true)][string[]]$sources,
 		[Parameter(Mandatory=$true)][string]$metadata,
 		[string]$out_root = (join-path $path_build 'gen'),
-		[string[]]$passes = @('--all')
+		[string[]]$passes = @('--all'),
+		[string[]]$extra_args = @()
 	)
 	$script = join-path $path_scripts 'ps1_meta.lua'
 	write-host "ps1-meta  $($sources.Count) source(s), passes=$($passes -join ',')" ` -ForegroundColor Magenta
-	$arg_list = @($passes) + @('--metadata', $metadata) + @('--out-root', $out_root)
+	$arg_list = @($passes) + @('--metadata', $metadata) + @('--out-root', $out_root) + @($extra_args)
 	foreach ($s in $sources) { $arg_list += @('--source', $s) }
 	& luajit $script @arg_list
 	if ($LASTEXITCODE -ne 0) {
@@ -383,6 +384,120 @@ function build-gte_hello {
 	)
 	link-modules $link_modules $elf $link_args
 	make-binary $elf $exe
+
+	# TODO(Ed): Do both -gdb-runtime and dwarf-injection passes in a single ps1-meta call.
+
+	# Post-link: emit ONLY build/gen/gdb_tape_atoms_runtime.gdb.
+	# The per-source *.atoms.sourcemap.txt was already generated by the pre-link --all call,
+	# so we skip --atoms-source-map here to avoid re-doing the work. 
+	# The gdb-runtime emission requires --elf (for nm-based address lookup) so it MUST happen post-link.
+	ps1-meta -sources $atom_sources -metadata $path_atom_metadata `
+		-out_root (join-path $path_build 'gen') `
+		-passes @('--gdb-runtime') `
+		-extra_args @('--elf', $elf)
+	# F' + G' consolidated: --dwarf-injection now emits 7 .bin blobs 
+	# (.debug_line, .debug_aranges, .debug_rnglists, .debug_info, .debug_abbrev, .debug_str, .debug_loc) all in one pass.
+	ps1-meta -sources $atom_sources -metadata $path_atom_metadata `
+		-out_root (join-path $path_build 'gen') `
+		-passes @('--dwarf-injection') `
+		-extra_args @('--elf', $elf)
+
+	#TODO(Ed): Move the below into ps-1 meta pass to reduce syscall latency?
+
+	# F' track: post-link DWARF injection. The new Lua pass writes build/gen/<basename>.dwarf_*.bin blobs; 
+	# we splice them into a COPY of the ELF via objcopy --update-section (works fine from PowerShell).
+	# The un-injected $elf + $exe are unchanged (shipping binary).
+	$dwarfLineBin    = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_line.bin'
+	$dwarfArangesBin = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_aranges.bin'
+	$dwarfRnglistsBin = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_rnglists.bin'
+	$injectElf       = Join-Path $path_build 'hello_gte.dwarf-injected.elf'
+	if ((Test-Path $dwarfLineBin) -and (Test-Path $dwarfArangesBin) -and (Test-Path $dwarfRnglistsBin)) 
+	{
+		Write-Host "[build] DWARF-injecting $elf -> $injectElf"
+		Copy-Item -LiteralPath $elf -Destination $injectElf
+		& $Objcopy --update-section ".debug_line=$dwarfLineBin"    $injectElf
+		$last_exit_code_error = $LASTEXITCODE -ne 0
+		if ($last_exit_code_error) {
+			Write-Warning "[build] objcopy .debug_line update failed (exit $LASTEXITCODE); removing $injectElf"
+			Remove-Item -LiteralPath $injectElf -ErrorAction SilentlyContinue
+			return;
+		} 
+		& $Objcopy --update-section ".debug_aranges=$dwarfArangesBin" $injectElf
+		$last_exit_code_error = $LASTEXITCODE -ne 0
+		if ($LASTEXITCODE -ne 0) {
+			Write-Warning "[build] objcopy .debug_aranges update failed (exit $LASTEXITCODE); removing $injectElf"
+			Remove-Item -LiteralPath $injectElf -ErrorAction SilentlyContinue
+			return;
+		}
+		& $Objcopy --update-section ".debug_rnglists=$dwarfRnglistsBin" $injectElf
+		if ($LASTEXITCODE -ne 0) {
+			Write-Warning "[build] objcopy .debug_rnglists update failed (exit $LASTEXITCODE); removing $injectElf"
+			Remove-Item -LiteralPath $injectElf -ErrorAction SilentlyContinue
+		} 
+		else 
+		{
+			# Baked atoms execute from RAM but are emitted as C data arrays, so their ELF sections lack SHF_EXECINSTR. 
+			# GDB discards line rows for non-code sections. 
+			# Mark only the debug-copy sections executable; the shipping ELF and PS-EXE remain byte/flag unchanged.
+			& $Objcopy `
+				--set-section-flags ".rodata=alloc,load,readonly,code,contents" `
+				--set-section-flags ".data=alloc,load,data,code,contents" `
+				$injectElf
+			if ($LASTEXITCODE -ne 0) {
+				Write-Warning "[build] objcopy atom-section flag update failed (exit $LASTEXITCODE); removing $injectElf"
+				Remove-Item -LiteralPath $injectElf -ErrorAction SilentlyContinue
+			} else {
+				Write-Host "[build] DWARF-injected ELF: $injectElf"
+			}
+		}
+	}
+
+	# G' (atom locals) is now part of --dwarf-injection.
+	# The F' splice block above already covered .debug_line / .debug_aranges / .debug_rnglists;
+	# we extend the same Copy-Item + objcopy chain to splice the G' 4 sections
+	# (.debug_info, .debug_abbrev, .debug_str via --update-section; .debug_loc via --add-section since it doesn't exist in the source ELF).
+	$dwarfInfoBin      = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_info.bin'
+	$dwarfAbbrevBin    = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_abbrev.bin'
+	$dwarfStrBin       = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_str.bin'
+	$dwarfLocBin       = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_loc.bin'
+	$dwarfLoclistsBin  = Join-Path (Join-Path $path_build 'gen') 'hello_gte.dwarf_loclists.bin'
+	if ((Test-Path $dwarfInfoBin) -and (Test-Path $dwarfAbbrevBin) -and (Test-Path $dwarfStrBin) -and (Test-Path $dwarfLocBin) -and (Test-Path $dwarfLoclistsBin))
+	{
+		Write-Host "[build] G' atom-locals: splicing .debug_info/.debug_abbrev/.debug_str/.debug_loc/.debug_loclists into $injectElf"
+		& $Objcopy --update-section ".debug_info=$dwarfInfoBin"     $injectElf
+		$last_exit_code_error = ($LASTEXITCODE -ne 0)
+		if ($last_exit_code_error) {
+			Write-Warning "[build] objcopy .debug_info update failed (exit $LASTEXITCODE)"
+			return;
+		}
+		& $Objcopy --update-section ".debug_abbrev=$dwarfAbbrevBin" $injectElf
+		if ($LASTEXITCODE -ne 0) {
+			Write-Warning "[build] objcopy .debug_abbrev update failed (exit $LASTEXITCODE)"
+			return;
+		}
+		& $Objcopy --update-section ".debug_str=$dwarfStrBin"      $injectElf
+		if ($LASTEXITCODE -ne 0) {
+			Write-Warning "[build] objcopy .debug_str update failed (exit $LASTEXITCODE)"
+		}
+		else
+		{
+			# .debug_loc doesn't exist in the source ELF; --add-section creates it.
+			& $Objcopy --add-section ".debug_loc=$dwarfLocBin"     $injectElf
+			if ($LASTEXITCODE -ne 0) {
+				Write-Warning "[build] objcopy .debug_loc add-section failed (exit $LASTEXITCODE)"
+			} 
+			else 
+			{
+				# .debug_loclists doesn't exist in the source ELF; --add-section creates it.
+				& $Objcopy --add-section ".debug_loclists=$dwarfLoclistsBin" $injectElf
+				if ($LASTEXITCODE -ne 0) {
+					Write-Warning "[build] objcopy .debug_loclists add-section failed (exit $LASTEXITCODE)"
+				} else {
+					Write-Host "[build] G' atom-locals-injected: $injectElf"
+				}
+			}
+		}
+	}
 }
 build-gte_hello
 

scripts/duffle.lua

@@ -8,23 +8,17 @@
 ---   - **C-language scanner** (`skip_ws_and_cmt`, `skip_str_or_cmt`, `read_ident`, `read_parens`, `read_braces`, `read_brackets`, `read_balanced`, `scan_to_char`, `split_top_level_commas`).
 ---   - **Word-count loader** (`load_word_counts` for `WORD_COUNT(...)` metadata files).
 ---   - **Line lookup** (`LineIndex` returns an O(log N) `line_of(pos)` closure for source-mapping).
----   - **Domain tables** (`WAVE_CONTEXT_REGS`, `TAPE_ATOM_MACROS`, `GTE_PIPELINE_LATENCY`, `GP0_CMD_SIZE`, `GP0_CMD_BY_SHAPE`, `GP0_MACRO_CONTRIB`, `INSTRUCTION_LATENCY`).
+---   - **Domain tables** (`TAPE_ATOM_MACROS`, `GTE_PIPELINE_LATENCY`, `GP0_CMD_SIZE`, `GP0_CMD_BY_SHAPE`, `GP0_MACRO_CONTRIB`, `INSTRUCTION_LATENCY`).
 ---   - **Process-bootstrap helper** (`setup_package_path`replaces the 8-line `arg[0]`-resolution boilerplate duplicated across 7 entry scripts)
 ---
 --- **Conventions**: tabs (1/level), EmmyLua annotations, no regex.
---- Lua 5.3 compatible; no `<close>`/`<toclose>`, no `continue`, no
---- 5.4 string.dump improvements. LuaJIT 5.1+extensions model is the primary target.
----
---- **No `:match` / `:gmatch` regex use anywhere**; 
---- all delimiter-splitting is hand-rolled or via LPeg (the regex-free PEG library).
 
 local M = {}
 
--- Optional native extension: lfs (LuaFileSystem). When present, ensure_dir uses
+-- Required native extension: lfs (LuaFileSystem). Built by `update_deps.ps1` to
--- lfs.attributes + lfs.mkdir instead of spawning `cmd.exe mkdir` — saves ~55ms per
+-- `toolchain/lfs/lfs.dll` and wired into package.cpath by `scripts/duffle_paths.lua`.
--- unique directory on Windows. Built by `update_deps.ps1` to `toolchain/lfs/lfs.dll`
+-- If lfs is missing, `require` throws — fail loud per the build-tool convention.
--- and wired into package.cpath by `scripts/duffle_paths.lua`.
+local lfs = require("lfs")
-local lfs = pcall(require, "lfs") and require("lfs") or nil
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Cross-file type aliases
@@ -47,96 +41,48 @@ local lfs = pcall(require, "lfs") and require("lfs") or nil
 -- ASCII byte constants
 -- ════════════════════════════════════════════════════════════════════════════
 
-local BYTE_SPACE      = 32    -- ' '
+local BYTE_SPACE      = 0x20    -- ' '
-local BYTE_TAB        = 9     -- '\t'
+local BYTE_TAB        = 0x09    -- '\t'
-local BYTE_NEWLINE    = 10    -- '\n'
+local BYTE_NEWLINE    = 0x0A    -- '\n'
-local BYTE_CR         = 13    -- '\r'
+local BYTE_CR         = 0x0D    -- '\r'
-local BYTE_VT         = 11    -- '\v'
+local BYTE_VT         = 0x0B    -- '\v'
-local BYTE_FF         = 12    -- '\f'
+local BYTE_FF         = 0x0C    -- '\f'
 
-local BYTE_UNDERSCORE = 95    -- '_'
+local BYTE_UNDERSCORE = 0x5F    -- '_'
-local BYTE_DOT        = 46    -- '.'
+local BYTE_DOT        = 0x2E    -- '.'
-local BYTE_SLASH      = 47    -- '/'
+local BYTE_SLASH      = 0x2F    -- '/'
-local BYTE_BACKSLASH  = 92    -- '\\'
+local BYTE_BACKSLASH  = 0x5C    -- '\\'
-local BYTE_STAR       = 42    -- '*'
+local BYTE_STAR       = 0x2A    -- '*'
-local BYTE_DQUOTE     = 34    -- '"'
+local BYTE_DQUOTE     = 0x22    -- '"'
-local BYTE_SQUOTE     = 39    -- '\''
+local BYTE_SQUOTE     = 0x27    -- '\''
-local BYTE_COMMA      = 44    -- ','
+local BYTE_COMMA      = 0x2C    -- ','
-local BYTE_SEMI       = 59    -- ';'
+local BYTE_SEMI       = 0x3B    -- ';'
 
-local BYTE_OPEN_PAREN  = 40   -- '('
+local BYTE_OPEN_PAREN  = 0x28   -- '('
-local BYTE_OPEN_BRACE  = 123  -- '{'
+local BYTE_OPEN_BRACE  = 0x7B   -- '{'
-local BYTE_OPEN_BRACK  = 91   -- '['
+local BYTE_OPEN_BRACK  = 0x5B   -- '['
 
-local BYTE_LOWER_A = 97       -- 'a'
+local BYTE_LOWER_A = 0x61       -- 'a'
-local BYTE_LOWER_Z = 122      -- 'z'
+local BYTE_LOWER_Z = 0x7A       -- 'z'
-local BYTE_UPPER_A = 65       -- 'A'
+local BYTE_UPPER_A = 0x41       -- 'A'
-local BYTE_UPPER_Z = 90       -- 'Z'
+local BYTE_UPPER_Z = 0x5A       -- 'Z'
 
-local BYTE_DIGIT_0 = 48       -- '0'
+local BYTE_DIGIT_0 = 0x30       -- '0'
-local BYTE_DIGIT_9 = 57       -- '9'
+local BYTE_DIGIT_9 = 0x39       -- '9'
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section -1: Bootstrap (path-setup at module load)
 -- ════════════════════════════════════════════════════════════════════════════
 --
--- When duffle.lua is first loaded (via `dofile` from an entry script or via `require` from a passes script), 
+-- Path setup is done by `scripts/duffle_paths.lua`, which derives the repo root from `debug.getinfo(1, "S").source` (NO subprocess, ~0ms) and then calls `require("duffle")`.
--- the code below sruns and sets `package.path` + `package.cpath` so subsequent `require`s resolve.
+-- The prior `io.popen("git rev-parse ...")` approach in this section was removed during F'' because:
--- Idempotent: re-loads just re-set the same paths.
+--   1. Every entry script + every passes script now uses `dofile("duffle_paths.lua")` (14 call sites; verified via grep).
+--      The `find_repo_root` / `setup_package_path` defined here was dead code in practice.
+--   2. `git rev-parse` costs ~100-180ms per subprocess spawn on Windows.
+--      `debug.getinfo` is <1ms. There's no reason to keep the slow path even as a "fallback".
 --
--- **Entry scripts** trigger this with one line:
+-- If a future use case ever needs to load `duffle.lua` WITHOUT going through `duffle_paths.lua`, set `package.path` manually before `require`.
--- `local duffle = dofile(arg[0]:match("(.*[/\\])") .. "/../duffle.lua")` which runs this top-level + returns `M`.
+-- See `docs/guide_metaprogram_ssdl.md` §"I/O primitives" for the pattern.
---
--- **Passes scripts** are loaded via `require("passes.X")` from the entry script; by the time they run, 
--- the entry script has already triggered this bootstrap, so the paths are set.
-
---- Resolve the repo root via `git rev-parse --show-toplevel` (cached).
---- Returns a path with a trailing separator, or nil if not in a git repo.
---- @return string|nil
-local function find_repo_root()
-	-- Cached in `package.loaded` (process-global) so all 8 entry scripts + passes scripts share one git call.
-	-- Without this, git rev-parse runs once per script load.
-	if package.loaded.__duffle_repo_root__ then return package.loaded.__duffle_repo_root__ end
-	local p = io.popen("git rev-parse --show-toplevel 2>nul")
-	local root
-	if p then
-		root = p:read("*l")
-		p:close()
-	end
-	if not root or root == "" then return nil end
-	if not root:match("[/\\]$") then root = root .. "/" end
-	package.loaded.__duffle_repo_root__ = root
-	return root
-end
-
---- Set `package.path`  (for `require("duffle")` + `require("passes.X")`)
---- and `package.cpath` (for `lpeg.dll` on Windows).
-function M.setup_package_path()
-	local repo_root = find_repo_root()
-	if not repo_root then
-		io.stderr:write("[duffle] git rev-parse failed -- not in a git repo?\n")
-		os.exit(2)
-	end
-
-	-- From the repo root, derive both `scripts/` and `scripts/passes/` so `require("duffle")` AND `require("passes.annotation")` resolve.
-	local scripts_dir = repo_root .. "scripts/"
-	local passes_dir  = repo_root .. "scripts/passes/"
-	package.path = scripts_dir .. "?.lua;"
-		.. scripts_dir .. "?/init.lua;"
-		.. passes_dir .. "?.lua;"
-		.. passes_dir .. "?/init.lua;"
-		.. package.path
-
--- cpath: only needed on Windows for the bundled lpeg.dll. 
--- (LPeg is optional -- duffle.lua's `pcall(require, "lpeg")` falls back to hand-rolled scanners if the .dll isn't loadable.)
-	if package.config:sub(1, 1) == "\\" then
-		package.cpath = repo_root .. "toolchain/luajit-2.1/lib/lua/5.1/?.dll;"
-			.. package.cpath
-	end
-end
-
--- NOTE: `M.setup_package_path()` is NOT auto-called here. The entry scripts explicitly `dofile("duffle_paths.lua")` first, which calls `M.setup_package_path()`. 
--- The function exists for the helper to use (so the path-setup logic is centralized in duffle.lua).
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section 0: LPeg patterns (compiled once at module load)
@@ -191,11 +137,9 @@ local lpeg_scan_to_target_pat = function(target) return (P(1) - P(target))^0  en
 -- ════════════════════════════════════════════════════════════════════════════
 -- Section 1: character classification (byte-based for hot loops)
 -- ════════════════════════════════════════════════════════════════════════════
---
 -- Two APIs:
 --   is_space(c), is_alpha(c), etc. — accept a single-char STRING (legacy)
 --   is_space_byte(b), is_alpha_byte(b), etc. — accept a single-byte INTEGER
---
 -- The byte-based versions are 5-10x faster in tight loops because they avoid the string allocation per s:sub(pos, pos) call.
 
 -- Whitespace characters per C locale.
@@ -215,8 +159,8 @@ function M.is_digit_byte(b) return b and b >= BYTE_DIGIT_0 and b <= BYTE_DIGIT_9
 -- Letter OR digit OR underscore.
 function M.is_alnum_byte(b) return M.is_alpha_byte(b) or M.is_digit_byte(b) end
 
--- String-based wrappers (kept for callers that already have a single-char
+-- String-based wrappers (kept for callers that already have a single-char string;
--- string; the byte versions are what the hot loops should call).
+-- the byte versions are what the hot loops should call).
 function M.is_space(c)
 	if type(c) == "number" then return M.is_space_byte(c) end
 	return c == " "  or c == "\t" or c == "\n" or c == "\r" or c == "\v" or c == "\f"
@@ -246,7 +190,6 @@ function M.trim(s)
 end
 
 -- Linear-search for a single-byte target in a string.
--- (Phase 3 retained this for places where LPeg is overkill.)
 -- @param haystack string
 -- @param target integer  -- byte value
 -- @param start integer   -- optional 1-indexed start (default 1)
@@ -311,11 +254,27 @@ function M.write_file_lf(path, content)
 	f:write(content); f:close()
 end
 
+-- Return `{path, ...}` for files in `out_root` whose basename matches `pattern` (Lua pattern, NOT regex — `%.` not `\.`).
+-- Empty list if `out_root` doesn't exist or matches nothing.
+-- @param out_root Path
+-- @param pattern string  -- Lua pattern matched against basename only
+-- @return string[]
+function M.list_dir(out_root, pattern)
+	local files = {}
+	if lfs.attributes(out_root, "mode") ~= "directory" then return files end
+	for entry in lfs.dir(out_root) do
+		if entry:match(pattern) then
+			files[#files + 1] = out_root .. "\\" .. entry
+		end
+	end
+	return files
+end
+
 -- Convert a (possibly relative) path to an absolute path, using CWD if needed.
 -- Normalizes forward slashes to backslashes on Windows.
 -- Used for byte-identical emit: the // Source: comment line uses the absolute path.
 --
--- The CWD is memoized (one `io.popen("cd")` per process — ~50ms on Windows).
+-- The CWD is memoized on first call (one lfs.currentdir() per process — ~0ms).
 -- Without the cache, calling this per-source in the components pass added ~1.5s to a 30-source build.
 -- @param path string
 -- @return string
@@ -329,16 +288,8 @@ function M.to_absolute_path(path)
 		_absolute_path_cache[path] = result
 		return result
 	end
-	-- Native: lfs.currentdir() is ~0ms vs io.popen("cd") at ~50ms per call.
+	-- lfs.currentdir() is ~0ms vs io.popen("cd") at ~50ms per call on Windows.
-	local cwd
+	local cwd = lfs.currentdir()
-	if lfs then
-		cwd = lfs.currentdir()
-	else
-		local p = io.popen("cd")
-		if not p then _absolute_path_cache[path] = path; return path end
-		cwd = p:read("*l")
-		p:close()
-	end
 	if not cwd then _absolute_path_cache[path] = path; return path end
 	cwd = cwd:gsub("/", "\\")
 	local tail = (path:gsub("/", "\\"))
@@ -348,23 +299,14 @@ function M.to_absolute_path(path)
 end
 
 -- Cache of directories already verified to exist in this process.
--- Each ensure_dir() call may otherwise spawn a `cmd.exe mkdir` (50-100ms per call on Windows) — calling it inside per-source loops added 1.5+
--- seconds to the report pass. Cache makes ensure_dir idempotent within the process lifetime.
--- (safe across passes; the dir state doesn't change).
 local _ensured_dirs = {}
 
 function M.ensure_dir(path)
 	if _ensured_dirs[path] then return end
 	_ensured_dirs[path] = true
-	if lfs then
+	-- lfs.attributes + lfs.mkdir: ~0ms when dir exists, ~2ms when creating. No shell spawn.
-		-- Native: ~0ms when dir exists (the common case). lfs.mkdir on a new dir is ~2ms (no shell spawn).
 	-- Falls through silently if lfs.mkdir fails (e.g. permission denied); the subsequent write_file will surface the error.
 	if lfs.attributes(path, "mode") ~= "directory" then lfs.mkdir(path) end
-	else
-		-- Fallback: shell mkdir. Slow (~55ms per call on Windows due to cmd.exe spawn) but works without lfs.
-		local is_win = package.config:sub(1, 1) == "\\"
-		os.execute(is_win and ('if not exist "' .. path .. '" mkdir "' .. path .. '"') or ('mkdir -p "' .. path .. '" 2>/dev/null'))
-	end
 end
 
 -- Test helper: clear the cache (used by tests + between process runs).
@@ -390,7 +332,7 @@ end
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Skip a string or C-style comment starting at position `pos`.
--- Returns the position just past the construct, or `pos` unchanged if no string/comment starts there. LPeg-backed.
+-- Returns the position just past the construct, or `pos` unchanged if no string/comment starts there.
 function M.skip_str_or_cmt(s, pos) return lpeg.match(lpeg_str_or_cmt_pat, s, pos) or pos end
 
 -- Skip whitespace AND C-style comments starting at position `pos`.
@@ -398,7 +340,7 @@ function M.skip_str_or_cmt(s, pos) return lpeg.match(lpeg_str_or_cmt_pat, s, pos
 function M.skip_ws_and_cmt(s, pos) return lpeg.match(lpeg_ws_and_cmt_pat, s, pos) or pos end
 
 -- Read a C-style identifier (alpha followed by zero+ alnum) starting at position `pos`. 
--- Returns the identifier string + the position just past it, or nil + pos if no identifier starts here. LPeg-backed.
+-- Returns the identifier string + the position just past it, or nil + pos if no identifier starts here.
 function M.read_ident(s, pos)
 	local result = lpeg.match(lpeg_ident_pat, s, pos)
 	if    result then return result, pos + #result end
@@ -485,12 +427,11 @@ function M.skip_preprocessor_line(s, pos)
 	return scan + 1
 end
 
--- Split a brace-body into top-level comma-separated tokens. Honors nested
+-- Split a brace-body into top-level comma-separated tokens. Honors nested parens/braces/brackets and skips strings/comments.
--- parens/braces/brackets and skips strings/comments.
 --
 -- FIX (2026-07-09): split at top-level NEWLINES and SEMICOLONS too, AND emit a token break after a top-level comment/string. 
 -- Previous behavior glued the macro call after a comment into the same token, so `word_count_of_token` only saw the 
--- leading ident (often nil after stripping the comment), undercounting the body. See Phase 1 of the branch-offset regression  investigation. 
+-- leading ident (often nil after stripping the comment), undercounting the body.
 -- Pure-comment / pure-string chunks (which now appear between real statements) are filtered out so they contribute 0 words instead of 1.
 function M.split_top_level_commas(body)
 	local tokens      = {}
@@ -582,10 +523,8 @@ end
 -- Section 4b: tokenize_body + build_body_line_index (shared, memoized)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Moved here from passes/static_analysis.lua so all passes can share the memoized
--- per-body tokenization. The memoization key is the body string (immutable per pass).
-
 local _tokenize_body_cache        = {}
+local _tokenize_body_simple_cache = {}
 local _body_line_index_cache      = {}
 
 --- Tokenize the body inner-text into a flat list of `{tok, rel}` pairs.
@@ -606,13 +545,19 @@ function M.tokenize_body(body)
 		local scan = rel
 		while scan <= len do
 			local c = body:byte(scan)
-			if     c == 44            then break end               -- ','
+			-- Terminator bytes (delimit a token at the top level): ',' = 0x2C, '\n' = 0x0A, ';' = 0x3B.
-			if     c == 10            then break end               -- '\n'
+			-- These also appear as separators between argument lists inside the parens/braces/brackets, 
-			if     c == 59            then break end               -- ';'
+			-- so we stop the scan when we hit any of them.
-			if     c == 40            then local _, a = M.read_parens   (body, scan); scan = a -- '('
+			if     c == BYTE_COMMA   then break end
-			elseif c == 123           then local _, a = M.read_braces   (body, scan); scan = a -- '{'
+			if     c == BYTE_NEWLINE then break end
-			elseif c == 91            then local _, a = M.read_brackets (body, scan); scan = a -- '['
+			if     c == BYTE_SEMI    then break end
-			elseif c == 34 or c == 39 then scan       = M.skip_str_or_cmt(body, scan) + 1     -- '"' or '\''
+			-- Group opener bytes (consume the balanced group via the matching reader): '(' = 0x28, '{' = 0x7B, '[' = 0x5B.
+			if     c == BYTE_OPEN_PAREN then local _, a = M.read_parens   (body, scan); scan = a
+			elseif c == BYTE_OPEN_BRACE then local _, a = M.read_braces   (body, scan); scan = a
+			elseif c == BYTE_OPEN_BRACK then local _, a = M.read_brackets (body, scan); scan = a
+			-- String-literal byte ('"' = 0x22 or '\'' = 0x27): skip past the quoted region in one shot.
+			elseif c == BYTE_DQUOTE or c == BYTE_SQUOTE then
+				scan = M.skip_str_or_cmt(body, scan) + 1
 			else
 				scan = scan + 1
 			end
@@ -633,12 +578,15 @@ end
 --- Tokenize the body into a flat list of trimmed string tokens (preserves comments).
 --- Uses `split_top_level_commas` (which appends trailing comments to the previous token)
 --- so the components pass can emit `/* Words: ... */` comments in the .macs.h output.
+--- Memoized on body string (R7 lift; mirror of M.tokenize_body's memoization).
 --- @param body string
 --- @return string[]
 function M.tokenize_body_simple(body)
+	if _tokenize_body_simple_cache[body] ~= nil then return _tokenize_body_simple_cache[body] end
 	local tokens = M.split_top_level_commas(body)
 	local out = {}
 	for i = 1, #tokens do out[i] = M.trim(tokens[i]) end
+	_tokenize_body_simple_cache[body] = out
 	return out
 end
 
@@ -655,7 +603,9 @@ function M.build_body_line_index(body)
 		if pos > 1 then
 			index[pos] = newline_count + 1
 		end
-		if body:byte(pos) == 10 then
+		-- Newline byte = 0x0A (BYTE_NEWLINE). Counts line boundaries so the
+		-- index maps each source-byte offset → its 1-based line number.
+		if body:byte(pos) == BYTE_NEWLINE then
 			newline_count = newline_count + 1
 		end
 	end
@@ -707,8 +657,6 @@ function M.load_word_counts(metadata_path)
 	return counts
 end
 
-
--- ════════════════════════════════════════════════════════════════════════════
 -- ══════════════════════════════════════════════════
 -- Section 6: LineIndex (perf fix — replaces the per-call rescan line_of)
 -- ══════════════════════════════════════════════════
@@ -738,19 +686,11 @@ end
 -- Section 7: domain tables
 -- ════════════════════════════════════════════════════════════════════════════
 
-M.WAVE_CONTEXT_REGS = {
-	["R_PrimCursor"] = { alias = "R_T7", size = 4, role = "output cursor (prim arena)" },
-	["R_FaceCursor"] = { alias = "R_T4", size = 4, role = "input cursor (face array)" },
-	["R_VertBase"]   = { alias = "R_T5", size = 4, role = "base pointer (vertex array)" },
-	["R_OtBase"]     = { alias = "R_T6", size = 4, role = "base pointer (ordering table)" },
-}
-
 -- The annotation DSL has been reduced to a single annotation macro:
 --   atom_info(atom_bind(Binds_X), atom_reads(...), atom_writes(...))
--- All phase / region / cadence / async / resource / group tokens have
+-- All phase / region / cadence / async / resource / group tokens have been dropped.
--- been dropped. They may be reintroduced later as optional sub-calls
+-- They may be reintroduced later as optional sub-calls of atom_info; 
--- of atom_info; for now, the parser only recognizes atom_info + its
+-- for now, the parser only recognizes atom_info + its three sub-calls (atom_bind, atom_reads, atom_writes).
--- three sub-calls (atom_bind, atom_reads, atom_writes).
 M.TAPE_ATOM_MACROS = {
 	["atom_info"] = { kind = "info", binds = false },
 }
@@ -758,18 +698,18 @@ M.TAPE_ATOM_MACROS = {
 -- GTE pipeline-fill latency table.
 --
 -- For each `gte_cmdw_*` macro in code/duffle/gte.h, the minimum number of consecutive COP2 "nop" words that MUST appear
--- before the command issues so that any preceding `lwc2`/`swc2`/C2 state writes have retired before the GTE starts
+-- before the command issues so that any preceding `lwc2`/`swc2`/C2 state writes have retired before the GTE starts reading its input registers.
--- reading its input registers.
 --
 -- The check (`scripts/passes/static_analysis.lua :: check_gte_pipeline_fill`) walks each atom body,
 -- counts the consecutive nop words before every `gte_cmdw_*` invocation, and reports a finding if the count is below this minimum.
 --
--- PRE-FILL vs POST-FILL: this table models PRE-cmdw nops (retiring preceding C2 writes), NOT the post-cmdw input-latch
+-- PRE-FILL vs POST-FILL: this table models PRE-cmdw nops (retiring preceding C2 writes),
--- window. The PSX-SPX pipeline timings doc (`docs/psx-spx/docs/gtepipelinetimings.md`) measures a DIFFERENT number:
+-- NOT the post-cmdw input-latch window. 
--- the smallest N nops between `cop2` and `mtc2` to a specific input register at which the write no longer affects
+-- The PSX-SPX pipeline timings doc (`docs/psx-spx/docs/gtepipelinetimings.md`) measures a DIFFERENT number:
--- the output. For nearly all instructions, inputs latch in the first 0-4 cycles — the GTE snapshots its input
+-- the smallest N nops between `cop2` and `mtc2` to a specific input register at which the write no longer affects the output.
--- register file early and works from internal pipeline storage afterward. The documented total cycle count is
+-- For nearly all instructions, inputs latch in the first 0-4 cycles — the GTE snapshots its input register file early and works
--- NOT the "do not touch inputs" window; the actual read window is much shorter.
+--  from internal pipeline storage afterward. The documented total cycle count is NOT the "do not touch inputs" window;
+-- the actual read window is much shorter.
 --
 -- The `gte_rtpt()` / `gte_nclip()` wrapper macros in gte.h emit the pre-cmd nops internally (asm_words(nop, nop, ...)),
 -- but THOSE WRAPPERS ARE NOT USED INSIDE ATOM BODIES in this codebase.

scripts/duffle_paths.lua

@@ -30,18 +30,18 @@ local CACHE_KEY = "__duffle_repo_root__"
 --- Replaces the prior `io.popen("git rev-parse --show-toplevel")` approach, which cost ~100-180ms per
 --- LuaJIT process on Windows due to git's CLI startup. The path-derive approach costs <1ms.
 ---
---- If this script's path can't be parsed (shouldn't happen — dofile/debug.getinfo always populates source),
+--- If `debug.getinfo` can't parse this script's path (shouldn't happen — dofile always populates source),
---- fall back to a defensive walk: starting from this script's directory, walk UP until we find a parent that
+--- return nil and let `M.setup()` fail loud.
---- contains a `scripts/` directory. The first match is the repo root.
 --- @return string|nil
 local function find_repo_root()
 	if package.loaded[CACHE_KEY] then return package.loaded[CACHE_KEY] end
 
 	local source = debug.getinfo(1, "S").source
 	-- Strip the leading `@` (Lua's dofile marker) and the trailing `/duffle_paths.lua` filename.
-	-- What remains is the directory containing this script, i.e. `<repo>/scripts/` (with trailing slash or not).
+	-- What remains is the directory containing this script, i.e. `<repo>/scripts/`.
 	local scripts_dir = source and source:match("^@?(.*)[/\\]duffle_paths%.lua$")
-	if scripts_dir then
+	if not scripts_dir then return nil end
+
 	-- The repo root is the parent of `scripts/`. Strip the trailing `scripts/` (with or without trailing slash).
 	local root = scripts_dir:gsub("scripts[\\/]?$", "")
 	root = root:gsub("\\", "/")
@@ -49,28 +49,6 @@ local function find_repo_root()
 	if not root:match("/$") then root = root .. "/" end
 	package.loaded[CACHE_KEY] = root
 	return root
-	end
-
-	-- Defensive fallback: walk UP from this script's directory until we find a parent that contains `scripts/`.
-	-- In practice this branch never fires — debug.getinfo always returns a source for dofile()'d chunks.
-	local lfs = pcall(require, "lfs") and require("lfs") or nil
-	if lfs then
-		local dir = source and source:match("^@?(.*[/\\])") or "./"
-		dir = dir:gsub("\\", "/")
-		while dir and dir ~= "" do
-			local candidate_scripts = dir .. "scripts"
-			if lfs.attributes(candidate_scripts, "mode") == "directory" then
-				dir = dir:gsub("/$", "")
-				package.loaded[CACHE_KEY] = dir .. "/"
-				return dir .. "/"
-			end
-			local parent = dir:match("^(.*)/[^/]+/$")
-			if not parent then break end
-			dir = parent .. "/"
-		end
-	end
-
-	return nil
 end
 
 --- Set `package.path` (for `require("duffle")` + `require("passes.X")`) and

scripts/gdb/gdb_tape_atoms.gdb

@@ -0,0 +1,105 @@
+# scripts/gdb/gdb_tape_atoms.gdb
+#
+# Wrapper for the tape-atom step-debug helpers.
+# The 9 user commands are defined here as STUBS (degraded-state messages). 
+# The real implementations + the per-atom data tables are emitted by `passes/atoms_source_map.lua` 
+# (post-link invocation: `ps1_meta.lua --atoms-source-map --gdb-runtime --elf <elf>`) into `build/gen/gdb_tape_atoms_runtime.gdb`.
+# Sourcing that file RE-DEFINES the commands with real implementations.
+#
+# If `build/gen/gdb_tape_atoms_runtime.gdb` is missing or stale, the stubs remain (E1: no source map).
+# The user just needs to re-run `build_psyq.ps1` to regenerate.
+
+# ── Stub commands (defined here so they're always present, even if the runtime file is missing). The runtime file overrides these if sourced. ──
+
+define tape_atoms
+  echo "[gdb_tape_atoms] STUB: runtime file build/gen/gdb_tape_atoms_runtime.gdb not found."
+  echo "[gdb_tape_atoms] STUB: run .\\build_psyq.ps1 to regenerate, then re-source this file."
+end
+document tape_atoms
+  List every tape atom symbol in the loaded ELF (code_<name>) with its .rodata address and word count.
+  STUB state: runtime file not sourced. Run build_psyq.ps1 to regenerate.
+end
+
+define break_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document break_atom
+  Set a breakpoint at the start of tape atom <name>. STUB state.
+end
+
+define step_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document step_atom
+  Resume execution until the next atom boundary. STUB state.
+end
+
+define next_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document next_atom
+  Alias for step_atom. STUB state.
+end
+
+define where_in_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document where_in_atom
+  Report current atom name, .rodata addr, word offset, and source line (if known). STUB state.
+end
+
+define stepi_inside_atom
+  echo "[gdb_tape_atoms] STUB: build/gen/gdb_tape_atoms_runtime.gdb not sourced. Run build_psyq.ps1."
+end
+document stepi_inside_atom
+  One MIPS-instruction step, then where_in_atom. STUB state.
+end
+
+define show_c2
+  printf "C2[ 0]   0x%08x\n", $c2_data[0]
+  printf "C2[ 7]   0x%08x  [otz]\n", $c2_data[7]
+  printf "C2[12]   0x%08x  [sxy0]\n", $c2_data[12]
+  printf "C2[13]   0x%08x  [sxy1]\n", $c2_data[13]
+  printf "C2[14]   0x%08x  [sxy2]\n", $c2_data[14]
+  printf "C2[24]   0x%08x  [mac0]\n", $c2_data[24]
+  printf "...\n"
+   echo "(STUB state: only 7 representative regs shown. Run build_psyq.ps1 for full dump.)"
+end
+document show_c2
+  Pretty-print all 32 C2 data registers as hex + named alias. STUB state (7 reg subset).
+end
+
+define show_c2ctl
+  printf "C2CTL[ 0]  0x%08x\n", $c2_control[0]
+  printf "...\n"
+  echo "(STUB state: only 1 reg shown. Run build_psyq.ps1 for full dump.)"
+end
+document show_c2ctl
+  Pretty-print all 32 C2 control registers. STUB state (1 reg subset).
+end
+
+define wave_ctx
+  printf "$t4 = R_FaceCursor     0x%08x\n", $t4
+  printf "$t5 = R_VertBase       0x%08x\n", $t5
+  printf "$t6 = R_OtBase         0x%08x\n", $t6
+  printf "$t7 = R_PrimCursor     0x%08x\n", $t7
+end
+document wave_ctx
+  Pretty-print the 4 wave-context GPRs ($t4..$t7). (wave_ctx works in stub state too.)
+end
+
+
+# ── Source the runtime file (re-defines commands with real impls + data). ──
+
+# Try to source from project-root-relative path first (the typical case).
+# If the user is in a different CWD, the source will fail and stubs remain.
+# The runtime file path is computed relative to the ELF's source map convention (build/gen/gdb_tape_atoms_runtime.gdb).
+echo [gdb_tape_atoms] Wrapper loaded. Sourcing runtime file...
+# Suppress the "Redefine command" prompts that would otherwise appear when the runtime file overrides the 9 stub commands defined above.
+# The runtime's `define` blocks are intended to overwrite — there's no ambiguity to confirm.
+set confirm off
+
+# Source the runtime file (re-defines commands with real impls + data).
+source build/gen/gdb_tape_atoms_runtime.gdb
+set confirm on
+echo [gdb_tape_atoms] Runtime sourced successfully (9 commands now have real implementations).

scripts/launch_pcsx_debug.ps1

@@ -0,0 +1,99 @@
+# scripts/launch_pcsx_debug.ps1
+#
+# One-shot launcher for debug sessions: starts pcsx-redux with the .ps-exe
+# loaded, the gdb stub enabled, AND the pcsx_debug_helper Lua plugin loaded
+# so external CLI tools (gdb's `shell` command, etc.)
+# can read GTE state via http://localhost:8080/api/v1/lua/gte
+# (the gdb stub doesn't expose COP2 at all).
+#
+# usage:
+#   .\scripts\launch_pcsx_debug.ps1
+#   .\scripts\launch_pcsx_debug.ps1 -ExePath build\hello_gte.ps-exe
+#   .\scripts\launch_pcsx_debug.ps1 -HelperZip scripts\pcsx_debug_helper.zip
+#
+# After launch:
+#   - gdb: target remote localhost:3333
+#   - web: curl http://localhost:8080/api/v1/lua/gte
+#
+# Companion: scripts/debug_psyq.ps1 (bare launch — no .ps-exe, no helper).
+
+[CmdletBinding()]
+param(
+    [string]$PcsxPath = (Join-Path $PSScriptRoot '..\toolchain\pcsx-redux\vsprojects\x64\Release\pcsx-redux.exe'),
+    [string]$ExePath  = (Join-Path $PSScriptRoot '..\build\hello_gte.ps-exe'),
+    [string]$HelperZip = (Join-Path $PSScriptRoot 'pcsx_debug_helper.zip'),
+    [int]   $GdbPort  = 3333,
+    [int]   $WebPort  = 8080
+)
+
+$ErrorActionPreference = 'Stop'
+
+$gdbInitPath = [System.IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..\build\gen\hello_gte.gdbinit'))
+if (-not (Test-Path -LiteralPath $gdbInitPath -PathType Leaf)) {
+    Write-Warning "Generated GDB skip sidecar missing (non-fatal): $gdbInitPath. Run the GTE build to regenerate it; debugger launch will continue without generated skip-over commands."
+}
+
+# ── Pre-checks ──
+foreach ($p in @($PcsxPath, $ExePath, $HelperZip)) {
+    if (-not (Test-Path $p)) {
+        Write-Error "Missing: $p"
+        exit 1
+    }
+}
+
+# Kill any existing pcsx-redux so the archive file isn't locked.
+Get-Process pcsx-redux -ErrorAction SilentlyContinue | Stop-Process -Force
+Start-Sleep -Seconds 2
+
+# ── Launch ──
+$absExe  = [System.IO.Path]::GetFullPath($ExePath)
+$absZip  = [System.IO.Path]::GetFullPath($HelperZip)
+
+$args = @(
+    '-gdb', '-run'
+    '-loadexe', "`"$absExe`""
+    '-archive', "`"$absZip`""
+)
+
+Write-Host "Launching pcsx-redux..." -ForegroundColor Cyan
+Write-Host "  ps-exe    : $absExe"
+Write-Host "  helper zip: $absZip"
+Write-Host "  gdb       : localhost:$GdbPort"
+Write-Host "  web       : localhost:$WebPort/api/v1/lua/gte"
+Write-Host ""
+
+Start-Process -FilePath $PcsxPath -ArgumentList $args | Out-Null
+
+# ── Wait for both endpoints to come up ──
+$deadline = (Get-Date).AddSeconds(15)
+while ((Get-Date) -lt $deadline) {
+    $gdbUp = $false
+    $webUp = $false
+    try {
+        $tcp = New-Object System.Net.Sockets.TcpClient
+        $tcp.BeginConnect('localhost', $GdbPort, $null, $null) | Out-Null
+        Start-Sleep -Milliseconds 100
+        $gdbUp = $tcp.Connected
+        $tcp.Close()
+    } catch { $gdbUp = $false }
+    try {
+        $r = Invoke-WebRequest -Uri "http://localhost:$WebPort/" -UseBasicParsing -TimeoutSec 1 -ErrorAction SilentlyContinue
+        $webUp = $r.StatusCode -ne 0
+    } catch { $webUp = $false }
+    if ($gdbUp -and $webUp) { break }
+    Start-Sleep -Milliseconds 500
+}
+
+# ── Smoke-test the gte handler ──
+try {
+    $r = Invoke-WebRequest -Uri "http://localhost:$WebPort/api/v1/lua/gte" -UseBasicParsing -TimeoutSec 5
+    $firstLine = ([System.Text.Encoding]::UTF8.GetString($r.Content) -split "`n")[0]
+    Write-Host "GTE handler OK: $firstLine" -ForegroundColor Green
+} catch {
+    Write-Warning "GTE handler NOT responding: $_"
+    Write-Host "Check the pcsx-redux Lua Console for debug cli messages." -ForegroundColor Yellow
+}
+
+Write-Host ""
+Write-Host "pcsx-redux running. PIDs:" -ForegroundColor Cyan
+Get-Process pcsx-redux | Select-Object Id, ProcessName | Format-Table

scripts/passes/annotation.lua

@@ -3,21 +3,17 @@
 --- Validates `MipsAtom_(name) atom_info(atom_bind(Binds_X), atom_reads(...), atom_writes(...)) { ... }` declarations in source files.
 --- Also reads: `Binds_*` struct declarations (`typedef Struct_(Binds_X) { ... };`)
 ---
---- Source scanning: done ONCE upstream by `duffle.scan_source()` (ps1_meta.lua pre-scans each
+--- Source scanning: done ONCE upstream by `duffle.scan_source()` (ps1_meta.lua pre-scans each source and stashes the result in `src.scan`).
---- source and stashes the result in `src.scan`). This pass is pure: read from the scan, run
---- checks, emit findings. No source re-walking.
 ---
 --- Writes:
 ---   - `<ctx.out_root>/<dir_basename>.errors.h` — one per module, with `#error` directives on findings (the C compile will surface the error)
 ---   - The annotations.txt report is rendered by `passes/report.lua` from the per-module results stashed in `ctx.flags._annot_results`
 ---
---- **Conventions**: tabs (1/level), EmmyLua annotations, no regex,
+--- **Conventions**: tabs (1/level), EmmyLua annotations, no regex, Lua 5.3 compatible
---- Lua 5.3 compatible
 
 -- Bootstrap: same as entry scripts. See `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
--- Uses `debug.getinfo` to find this file's own directory, so it works
+-- Uses `debug.getinfo` to find this file's own directory, so it works both standalone and when require'd from the orchestrator.
--- both standalone and when require'd from the orchestrator.
 -- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` (works both standalone + when require'd).
 -- duffle_paths.lua sets package.path then returns `require("duffle")` at the bottom, so the dofile value IS the duffle module.
 local _bootstrap_dir = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
@@ -25,11 +21,9 @@ local duffle        = dofile(_bootstrap_dir .. "../duffle_paths.lua")
 local write_file     = duffle.write_file
 local ensure_dir     = duffle.ensure_dir
 
--- Domain tables (single source of truth in duffle.lua).
+-- The annotation pass now consults the source-derived registries built by scan_source:
-local WAVE_CONTEXT_REGS = duffle.WAVE_CONTEXT_REGS
+--   * pipe_ctx.register_alias_registry — for atom_dbg_reg_default(R_X, ...) and atom_reg_types(R_X, ...) member-identity checks
-local TAPE_ATOM_MACROS  = duffle.TAPE_ATOM_MACROS
+--   * pipe_ctx.type_name_registry      — for atom_dbg_reg_default(<T>, ...) and atom_reg_types(<T>, ...) type-identity checks
-
-local function is_wave_context_reg(n) return WAVE_CONTEXT_REGS[n] ~= nil  end
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Type declarations
@@ -68,11 +62,37 @@ local function is_wave_context_reg(n) return WAVE_CONTEXT_REGS[n] ~= nil  end
 --- @field binds   string|nil    -- Binds_X name if any
 --- @field reads   string[]      -- R_* names (read targets)
 --- @field writes  string[]      -- R_* names (write targets)
+--- @field errors  string[]|nil  -- parse-time errors from scan_source (atom_info body malformed)
+
+--- @class SkipOverMarker  -- sub-shape of scan_source.lua's @class SkipOverMarker
+--- @field marker_kind    string                 -- exact marker ident (always "atom_dbg_skip_over")
+--- @field marker_line    integer
+--- @field args           string|nil             -- trimmed text inside the parens (nil when has_parens is false)
+--- @field has_parens     boolean
+--- @field pending        boolean                -- true while awaiting the following declaration
+--- @field superseded_by_marker_line integer|nil -- set on a marker that was bumped out of the pending slot
+--- @field target_kind    string|nil             -- "atom" | "comp_bare" | "comp_proc" | "unrelated" once observed
+--- @field declaration_line integer|nil
 
 --- @class Finding
 --- @field line integer -- source line (or 0 for pass-level)
 --- @field msg  string  -- finding message
 
+--- @class Findings
+--- @field errors   Finding[]
+--- @field warnings Finding[]
+--- @field info     Finding[]
+
+--- @class PipeCtx
+--- @field atom_index     table<string, AtomAnnotation> -- name -> AtomAnnotation (only kind=="atom")
+--- @field binds_index    table<string, BindsStruct>    -- name -> BindsStruct
+--- @field annot_counts   table<string, integer>        -- name -> annotation count (for unique_annotation check)
+--- @field types          table<string, RegTypeDefault> -- from scan_source
+--- @field atom_views     table<string, AtomViewEntry>  -- from scan_source
+--- @field seen_defaults  table<string, integer>        -- duplicate atom_dbg_reg_default detection
+--- @field seen_field     table<string, integer>        -- Binds_* -> count of fields (set/checked by check_binds_no_duplicate_fields)
+--- @field _scan          SourceScan                    -- full scan payload (typed-view sub-calls live here) 
+
 --- @class AnnotatedResult
 --- @field atoms    AtomEntry[]
 --- @field annots   AtomAnnotation[]
@@ -82,6 +102,347 @@ local function is_wave_context_reg(n) return WAVE_CONTEXT_REGS[n] ~= nil  end
 --- @field warnings Finding[]
 --- @field info     Finding[]
 
+-- ════════════════════════════════════════════════════════════════════════════
+-- Per-check functions (the CHECK_RULES table's payload)
+-- ════════════════════════════════════════════════════════════════════════════
+--
+-- Each check has a uniform `append_to_findings` shape (errors[] / warnings[] / info[]).
+-- The dispatcher in `validate()` decides which findings list each check writes to — by convention,
+-- "existence" checks (declaration must exist, struct must exist) write errors[]; "shape" checks
+-- (writes/reads must be wave-context) write warnings[].
+-- The `macro_word_drift` check writes both errors[] (missing/mismatch) and info[] (match).
+
+--- Check: every annotated atom must have a matching MipsAtom_(name) declaration.
+--- @param a AtomAnnotation
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_atom_decl_exists(a, pipe_ctx, findings)
+	if not pipe_ctx.atom_index[a.name] then
+		findings.errors[#findings.errors + 1] = {
+			line = a.line,
+			msg  = string.format("annotation for '%s' has no matching MipsAtom_(%s) { ... }", a.name, a.name),
+		}
+	end
+end
+
+--- Check: every atom may have AT MOST ONE annotation.
+--- Post-loop: needs full-corpus `annot_counts` from pipe_ctx.
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_unique_annotation(pipe_ctx, findings)
+	for name, n in pairs(pipe_ctx.annot_counts) do
+		if n > 1 then
+			findings.errors[#findings.errors + 1] = {
+				line = pipe_ctx.atom_index[name] and pipe_ctx.atom_index[name].line or 0,
+				msg  = string.format("MipsAtom_(%s) has %d annotations (expected at most 1)", name, n),
+			}
+		end
+	end
+end
+
+--- Check: BIND atoms must reference a real Binds_* struct.
+--- Emitting a warning here keeps the annotation pass from being stop-on-error for the common test-fixture case,
+--- while still surfacing the issue in the report.
+--- The static-analysis report remains the source of truth for build-stopping errors.
+--- @param a AtomAnnotation
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_binds_struct_exists(a, pipe_ctx, findings)
+	if not a.binds then return end
+	if pipe_ctx.binds_index[a.binds] then return end
+	findings.warnings[#findings.warnings + 1] = {
+		line = a.line,
+		msg  = string.format("'%s' binds '%s' but no Struct_(%s) { ... } " 
+			.. "declaration found (also flagged as an error by check_abi_handoff in the static-analysis pass)"
+			, a.name, a.binds, a.binds),
+	}
+end
+
+--- Check: TAPE_WORDS(mac_X, N) ↔ WORD_COUNT(mac_X, N) drift.
+--- Three outcomes: missing (error), mismatch (error), match (info).
+--- @param m MacroEntry
+--- @param wc table<string, integer> -- the shared word-count table (from ctx.shared.word_counts)
+--- @param findings Findings
+local function check_macro_word_drift(m, wc, findings)
+	local declared = wc[m.name]
+	if not declared then
+		findings.errors[#findings.errors + 1] = {
+			line = m.line,
+			msg  = string.format("TAPE_WORDS(%s, %d) but '%s' is not in metadata.h", m.name, m.words, m.name),
+		}
+		return
+	end
+	if declared ~= m.words then
+		findings.errors[#findings.errors + 1] = {
+			line = m.line,
+			msg  = string.format("DRIFT: TAPE_WORDS(%s, %d) but metadata.h declares WORD_COUNT(%s, %d)", m.name, m.words, m.name, declared),
+		}
+		return
+	end
+	findings.info[#findings.info + 1] = {
+		line = m.line,
+		msg  = string.format("OK: %s = %d words", m.name, m.words),
+	}
+end
+
+--- Check: atom_dbg_reg_default(R_X, <type>) must target a register declared as a debug-visible alias in `pipe_ctx.register_alias_registry`,
+--- with a type name found in `pipe_ctx.type_name_registry`.
+--- Pointer depth is still bounded to 0 or 1. Duplicate defaults are still detected.
+--- @param _src SourceFile        -- unused (kept for the per_source shape)
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_semantic_reg_defaults(_src, pipe_ctx, findings)
+	-- Detect duplicate defaults using the ordered occurrence list (the out.types hash only retains the last declaration).
+	local seen_first_line = {}
+	for _, occ in ipairs(pipe_ctx.type_occurrences or {}) do
+		if seen_first_line[occ.reg] == nil then
+			seen_first_line[occ.reg] = occ.source_line
+		else
+			findings.errors[#findings.errors + 1] = {
+				line = occ.source_line,
+				msg  = string.format(
+					"duplicate atom_dbg_reg_default for %q at line %d (first declared at line %d); one default per register",
+					occ.reg, occ.source_line, seen_first_line[occ.reg]),
+			}
+		end
+	end
+	local reg_registry  = pipe_ctx.register_alias_registry or {}
+	local type_registry = pipe_ctx.type_name_registry      or {}
+	for reg, def in pairs(pipe_ctx.types or {}) do
+		if not reg_registry[reg] then
+			findings.errors[#findings.errors + 1] = {
+				line = def.source_line,
+				msg  = string.format(
+					"atom_dbg_reg_default at line %d references unknown register %q (not in register_alias_registry)",
+					def.source_line, reg),
+			}
+		end
+		if def.pointer_depth == nil or def.pointer_depth < 0 or def.pointer_depth > 1 then
+			findings.errors[#findings.errors + 1] = {
+				line = def.source_line,
+				msg  = string.format(
+					"atom_dbg_reg_default at line %d for %q has unsupported pointer depth %d (expected 0 or 1)",
+					def.source_line, reg, def.pointer_depth or -1),
+			}
+		end
+		if not def.type_name or not type_registry[def.type_name] then
+			findings.errors[#findings.errors + 1] = {
+				line = def.source_line,
+				msg  = string.format(
+					"atom_dbg_reg_default at line %d for %q uses unknown type %q (not in type_name_registry)",
+					def.source_line, reg, tostring(def.type_name)),
+			}
+		end
+	end
+end
+
+--- Check: atom_reg_types(R_X, <type>) entries must point to a register declared in `pipe_ctx.register_alias_registry`, with a type name found in `pipe_ctx.type_name_registry`. 
+--- The alias ident `R_<n>` now encodes the GPR identity only for entries that are explicitly opted in via the bare `atom_reg` marker.
+--- R_T0..R_T3 are intentionally NOT auto-included (per the prototype principle: no auto-include of wave-context; explicit opt-in only). 
+--- The check fires for any R_T0..R_T3 reference that hasn't been opted in via `#define atom_reg`.
+--- @param _src SourceFile
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_atom_reg_types(_src, pipe_ctx, findings)
+	local reg_registry  = pipe_ctx.register_alias_registry or {}
+	local type_registry = pipe_ctx.type_name_registry      or {}
+	for _, ai in ipairs(pipe_ctx.atom_infos_list or {}) do
+		if ai.reg_type_overrides then
+			for reg, ov in pairs(ai.reg_type_overrides) do
+				if not reg_registry[reg] then
+					findings.errors[#findings.errors + 1] = {
+						line = ai.info_line,
+						msg  = string.format(
+							"atom '%s' has atom_reg_types for %q; compute-register types are restricted to opt-in aliases (%q not in register_alias_registry)",
+							ai.atom_name, reg, reg),
+					}
+				end
+				if not ov.type_name or not type_registry[ov.type_name] then
+					findings.errors[#findings.errors + 1] = {
+						line = ai.info_line,
+						msg  = string.format(
+							"atom '%s' atom_reg_types for %q uses unknown compute type %q (not in type_name_registry)",
+							ai.atom_name, reg, tostring(ov.type_name)),
+					}
+				end
+			end
+		end
+	end
+end
+
+--- Check: atom_view(Binds_X) entries must reference a real Binds_* struct and that struct must declare at least one field.
+--- @param _src SourceFile
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_atom_view_layout(_src, pipe_ctx, findings)
+	for atom_name, view in pairs(pipe_ctx.atom_views or {}) do
+		if not view.binds_name then
+			-- The atom had atom_reg_types but no atom_view; no layout check needed.
+		else
+			local bs = pipe_ctx.binds_index[view.binds_name]
+			if not bs then
+				findings.errors[#findings.errors + 1] = {
+					line = view.info_line,
+					msg  = string.format(
+						"atom '%s' has atom_view(%s) but no Struct_(%s) { ... } declaration was found",
+						atom_name, view.binds_name, view.binds_name),
+				}
+			elseif not bs.fields or #bs.fields == 0 then
+				findings.errors[#findings.errors + 1] = {
+					line = bs.line,
+					msg  = string.format(
+						"atom '%s' has atom_view(%s) but that struct declares zero typed fields",
+						atom_name, view.binds_name),
+				}
+			end
+		end
+	end
+end
+
+--- Check: Binds_* structs may not have duplicate field names
+--- (they would defeat the typed-field name lookup that atom_view exposes in gdb).
+--- @param _src SourceFile
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_binds_no_duplicate_fields(_src, pipe_ctx, findings)
+	for _, bs in ipairs(pipe_ctx.binds_list or {}) do
+		local seen = {}
+		for _, f in ipairs(bs.fields or {}) do
+			seen[f.name] = (seen[f.name] or 0) + 1
+		end
+		for name, count in pairs(seen) do
+			if count > 1 then
+				findings.errors[#findings.errors + 1] = {
+					line = bs.line,
+					msg  = string.format(
+						"%s has duplicate field name %q (count %d); the typed-view contract requires unique field names",
+						bs.name, name, count),
+				}
+			end
+		end
+	end
+end
+
+-- Check: skip-over markers must satisfy shape + placement constraints.
+--- Walks the priority list once; at most one error is appended per marker so that a single source-level defect does not cascade into multiple findings.
+--- Priority order (first defect wins):
+---   1. has_parens == false         -> requires parentheses: marker()
+---   2. args  ~= ""                 -> takes no arguments
+---   3. superseded_by_marker_line   -> duplicate marker (cite superseding line)
+---   4. pending + no target_kind    -> dangling (no following declaration)
+---   5. unsupported target_kind     -> marker precedes an unrelated declaration
+--- Valid markers before whole-atom / bare-component / proc-component declarations emit no error and remain in src.scan.skip_over.atoms / .components.
+--- @param marker SkipOverMarker
+--- @param _pipe_ctx PipeCtx     -- unused today; kept for plex-shape consistency with per_annot
+--- @param findings Findings
+local function check_skip_marker(marker, _pipe_ctx, findings)
+	local kind = marker.marker_kind
+	local line = marker.marker_line
+
+	if not marker.has_parens then
+		findings.errors[#findings.errors + 1] = {
+			line = line,
+			msg  = string.format("%s marker at line %d requires parentheses: marker()", kind, line),
+		}
+		return
+	end
+
+	if marker.args ~= nil and marker.args ~= "" then
+		findings.errors[#findings.errors + 1] = {
+			line = line,
+			msg  = string.format("%s marker at line %d takes no arguments; found %q", kind, line, marker.args),
+		}
+		return
+	end
+
+	if marker.superseded_by_marker_line then
+		findings.errors[#findings.errors + 1] = {
+			line = line,
+			msg  = string.format("duplicate %s marker at line %d; superseded by another %s marker at line %d"
+				, kind, line, kind, marker.superseded_by_marker_line),
+		}
+		return
+	end
+
+	if marker.pending and not marker.target_kind then
+		findings.errors[#findings.errors + 1] = {
+			line = line,
+			msg  = string.format("dangling %s marker at line %d: no following MipsAtom_/MipsAtomComp_/MipsAtomComp_Proc_ declaration"
+				, kind, line),
+		}
+		return
+	end
+
+	if marker.target_kind
+		and marker.target_kind ~= "atom"
+		and marker.target_kind ~= "comp_bare"
+		and marker.target_kind ~= "comp_proc" then
+		findings.errors[#findings.errors + 1] = {
+			line = line,
+			msg  = string.format("%s marker at line %d must precede MipsAtom_, MipsAtomComp_, or MipsAtomComp_Proc_; found an unrelated declaration"
+				, kind, line),
+		}
+	end
+end
+
+--- Migration warning emitted alongside the new registry-membership check.
+---
+--- R_TapePtr / R_AtomJmp / R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase
+--- are the wave-context aliases opted in via `#define atom_reg` in lottes_tape.h (Task 21).
+--- Any source referencing an R_X that's NOT in the registry will trip the new check; a single pass-level info entry
+--- (emitted only when at least one such rejection lands in this source) tells users where to look.
+---
+--- Track A Task 13 added the proper `enum_alias_membership` per_source rule;
+--- this is the stop-gap until users migrate off raw C-ABI register names.
+--- @param _src SourceFile
+--- @param pipe_ctx PipeCtx
+--- @param findings Findings
+local function check_wave_context_migration(_src, pipe_ctx, findings)
+	if not (pipe_ctx.types and next(pipe_ctx.types)) then return end
+	if not (pipe_ctx.atom_infos_list) then return end
+	local reg_registry = pipe_ctx.register_alias_registry or {}
+	for _, ai in ipairs(pipe_ctx.atom_infos_list) do
+		if ai.reg_type_overrides then
+			for reg, _ in pairs(ai.reg_type_overrides) do
+				if not reg_registry[reg] then
+					findings.warnings[#findings.warnings + 1] = {
+						line = 0,
+						msg  = "wave-context removed; opt in via #define atom_reg in mips.h "
+							.. "(every R_<alias> that should be visible to the annotation pass "
+							.. "must be enum-declared with the bare atom_reg marker; see Track A Task 21)",
+					}
+					return
+				end
+			end
+		end
+	end
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- CHECK_RULES — data-driven check dispatch (the plex pattern)
+-- ════════════════════════════════════════════════════════════════════════════
+--
+-- Each rule entry picks one of four "shapes" of dispatch:
+--   per_annot(annot, pipe_ctx, findings)        -- runs once per AtomAnnotation
+--   post(pipe_ctx, findings)                    -- runs once after all per_annot calls complete (full-corpus aggregation)
+--   per_macro(macro, wc, findings)              -- runs once per TAPE_WORDS / _Pragma macro declaration
+--   per_skip_marker(marker, pipe_ctx, findings) -- runs once per src.scan.skip_over.markers entry
+--
+-- Adding a new check = 1 row here + 1 function above. The `validate()` dispatch loop never needs editing.
+
+local CHECK_RULES = {
+	{ name = "atom_decl_exists",          per_annot       = check_atom_decl_exists          },
+	{ name = "binds_struct_exists",       per_annot       = check_binds_struct_exists       },
+	{ name = "unique_annotation",         post            = check_unique_annotation         },
+	{ name = "macro_word_drift",          per_macro       = check_macro_word_drift          },
+	{ name = "skip_marker_validation",    per_skip_marker = check_skip_marker               },
+	{ name = "semantic_reg_defaults",     per_source      = check_semantic_reg_defaults     },
+	{ name = "atom_reg_types",            per_source      = check_atom_reg_types            },
+	{ name = "atom_view_layout",          per_source      = check_atom_view_layout          },
+	{ name = "binds_no_duplicate_fields", per_source      = check_binds_no_duplicate_fields },
+	{ name = "wave_context_migration",    per_source      = check_wave_context_migration    },
+}
+
 -- ════════════════════════════════════════════════════════════════════════════
 -- Validation
 -- ════════════════════════════════════════════════════════════════════════════
@@ -115,138 +476,102 @@ local function validate(ctx, src)
 			binds  = info.binds,
 			reads  = info.reads or {},
 			writes = info.writes or {},
-			errors = {},
+			errors = info.errors,
 		}
 	end
 
-	-- Index atoms by name for lookup.
+	-- Build pipe_ctx (Fleury: expose structure). Pre-compute everything the per-check functions need.
-	local atom_index = {}
+	-- Single source of truth for atom / binds / annotation-count lookups.
-	for _, a in ipairs(atoms) do atom_index[a.name] = a end
+	-- pipe_ctx.types / pipe_ctx.atom_views / pipe_ctx.seen_defaults are projected from the scan payload so per_source check rules can iterate.
+	local seen_defaults = {}
+	for reg, _ in pairs(scan.types or {}) do
+		seen_defaults[reg] = (seen_defaults[reg] or 0) + 1
+	end
+	local atom_infos_list = {}
+	for _, ai in ipairs(scan.atom_infos or {}) do
+		atom_infos_list[#atom_infos_list + 1] = ai
+	end
 
-	-- Index binds by name for lookup.
+	local pipe_ctx = {
-	local binds_index = {}
+		atom_index               = {},
-	for _, b in ipairs(scan.binds) do binds_index[b.name] = b end
+		binds_index              = {},
-
+		annot_counts             = {},
-	local errors   = {}
+		types                    = scan.types or {},
-	local warnings = {}
+		type_occurrences         = scan.type_occurrences or {},
-	local info     = {}
+		atom_views               = scan.atom_views or {},
-
+		seen_defaults            = seen_defaults,
-	-- 1. Every annotated atom must exist as a real MipsAtom_ declaration.
+		atom_infos_list          = atom_infos_list,
-	for _, a in ipairs(annots) do
+		binds_list               = scan.binds or {},
-		if not atom_index[a.name] then
+		-- Project the source-derived registries from the scan payload so per_source checks consult them instead of the deleted
-			errors[#errors + 1] = {
+		-- SEMANTIC_DEFAULT_REGS / KNOWN_REG_DEFAULT_TYPES / etc.
-				line = a.line,
+		register_alias_registry  = scan.register_alias_registry or {},
-				msg  = string.format("annotation for '%s' has no matching MipsAtom_(%s) { ... }", a.name, a.name),
+		type_name_registry       = scan.type_name_registry or {},
 	}
-		end
+	for _, a in ipairs(atoms)      do pipe_ctx.atom_index [a.name] = a end
-		if a.errors then
+	for _, b in ipairs(scan.binds) do pipe_ctx.binds_index[b.name] = b end
-			for _, msg in ipairs(a.errors) do
-				errors[#errors + 1] = {line = a.line, msg = string.format("'%s': %s", a.name, msg)}
-			end
-		end
-	end
-
-	-- 2. Every atom may have AT MOST ONE annotation (no duplicates).
-	-- (Atoms with ZERO annotations are valid in the new minimal shape.)
-	local count_per_atom = {}
 	for _, a in ipairs(annots)     do
 		if a.name then
-			count_per_atom[a.name] = (count_per_atom[a.name] or 0) + 1
+			pipe_ctx.annot_counts[a.name] = (pipe_ctx.annot_counts[a.name] or 0) + 1
-		end
-	end
-	for name, n in pairs(count_per_atom) do
-		if n > 1 then
-			errors[#errors + 1] = {
-				line = atom_index[name] and atom_index[name].line or 0,
-				msg  = string.format("MipsAtom_(%s) has %d annotations (expected at most 1)", name, n),
-			}
 		end
 	end
 
-	-- 3. (Phase validity check DROPPED. Phases were removed from the annotation DSL.)
+	-- Findings live in a single struct with three lists (errors / warnings / info).
+	-- Each check writes to the list appropriate for its severity.
+	local findings = { errors = {}, warnings = {}, info = {} }
 
-	-- 4. BIND atoms must reference a real Binds_* struct.
+	-- Propagate parse-time errors from scan_source's atom_info parsing.
+	-- These are errors found in the atom_info(...) body itself (e.g., malformed args).
+	-- They are pre-existing in the scan payload — we just lift them into our findings list.
 	for _, a in ipairs(annots) do
-		if a.binds then
+		if a.errors then
-			if not binds_index[a.binds] then
+			for _, msg in ipairs(a.errors) do
-				-- Demoted from error to warning (2026-07-10): the same condition is now caught by passes/static_analysis.lua's
+				findings.errors[#findings.errors + 1] = {
-				-- check_abi_handoff() as an error. Emitting a warning here keeps the annotation pass from being stop-on-error
-				-- for the common test-fixture case, while still surfacing the issue in the report.
-				-- The static-analysis report remains the source of truth for build-stopping errors.
-				warnings[#warnings + 1] = {
 					line = a.line,
-					msg  = string.format("'%s' binds '%s' but no Struct_(%s) { ... } declaration found (also flagged as an error by check_abi_handoff in the static-analysis pass)", a.name, a.binds, a.binds),
+					msg  = string.format("'%s': %s", a.name, msg),
 				}
 			end
 		end
 	end
 
-	-- 5. BIND writes must be wave-context registers that match Binds_ fields.
+	-- THE per-annotation pipeline. ONE loop. CHECK_RULES dispatches per_annot rules.
 	for _, a in ipairs(annots) do
-		if a.binds and binds_index[a.binds] then
+		for _, rule in ipairs(CHECK_RULES) do
-			local bs = binds_index[a.binds]
+			if rule.per_annot then rule.per_annot(a, pipe_ctx, findings) end
-
-			for _, f in ipairs(bs.fields) do
-				local candidate = "R_" .. f.name
-				if not is_wave_context_reg(candidate) then
-					warnings[#warnings + 1] = {
-						line = bs.line,
-						msg  = string.format("%s field '%s' doesn't match a known wave-context register (candidate '%s')", a.binds, f.name, candidate),
-					}
 		end
 	end
 
-			for _, w in ipairs(a.writes) do
+	-- Post-loop rules (one-shot checks that need full-corpus aggregation in pipe_ctx).
-				if not is_wave_context_reg(w) then
+	for _, rule in ipairs(CHECK_RULES) do
-					warnings[#warnings + 1] = {
+		if rule.post then rule.post(pipe_ctx, findings) end
-						line = a.line,
-						msg  = string.format("%s writes '%s' which is not a known wave-context register", a.name, w),
-					}
-				end
 	end
+
+	-- Per-skip-marker rules. 
+	-- Each raw marker recorded by scan_source (in scan.skip_over.markers) is validated independently; 
+	-- the check emits at most one error per marker.
+	-- Valid markers stay attached to scan.skip_over.atoms /.components for dwarf_injection.lua consumer.
+	local skip_markers = scan.skip_over and scan.skip_over.markers or {}
+	for _, marker in ipairs(skip_markers) do
+		for _, rule in ipairs(CHECK_RULES) do
+			if rule.per_skip_marker then rule.per_skip_marker(marker, pipe_ctx, findings) end
 		end
 	end
 
-	-- 6. INFO reads should be wave-context registers (or R_TapePtr for rbind).
+	-- Per-macro rules (TAPE_WORDS vs WORD_COUNT drift).
-	for _, a in ipairs(annots) do
+	local wc = ctx.shared.word_counts
-		for _, r in ipairs(a.reads) do
-			if not is_wave_context_reg(r) and r ~= "R_TapePtr" then
-				warnings[#warnings + 1] = {
-					line = a.line,
-					msg  = string.format("atom '%s' reads '%s' which is not a known wave-context register", a.name, r),
-				}
-			end
-		end
-	end
-
-	-- 7. TAPE_WORDS(mac_X, N) ↔ WORD_COUNT(mac_X, N) drift.
-	--    Three outcomes: missing (error), mismatch (error), match (info).
-	local function check_macro_drift(m, declared)
-		if not declared then
-			errors[#errors + 1] = {
-				line = m.line,
-				msg  = string.format("TAPE_WORDS(%s, %d) but '%s' is not in metadata.h", m.name, m.words, m.name),
-			}
-			return
-		end
-		if declared ~= m.words then
-			errors[#errors + 1] = {
-				line = m.line,
-				msg  = string.format("DRIFT: TAPE_WORDS(%s, %d) but metadata.h declares WORD_COUNT(%s, %d)", m.name, m.words, m.name, declared),
-			}
-			return
-		end
-		info[#info + 1] = {
-			line = m.line,
-			msg  = string.format("OK: %s = %d words", m.name, m.words),
-		}
-	end
 	for _, m in ipairs(scan.macros) do
-		check_macro_drift(m, ctx.shared.word_counts[m.name])
+		for _, rule in ipairs(CHECK_RULES) do
+			if rule.per_macro then rule.per_macro(m, wc, findings) end
+		end
 	end
 
-	-- 8. Information summary.
+	-- Per-source rules (reg defaults, atom_view layout, compute-register type overrides, Binds_* field uniqueness).
-	info[#info + 1] = {
+	-- Each per_source rule sees the full scan payload via pipe_ctx.
+	for _, rule in ipairs(CHECK_RULES) do
+		if rule.per_source then rule.per_source(src, pipe_ctx, findings) end
+	end
+
+	-- Information summary (always emitted).
+	findings.info[#findings.info + 1] = {
 		line = 0,
 		msg  = string.format("scanned: %d atom(s), %d annotation(s), %d macro-word-decl(s), %d binds struct(s)",
 			#atoms, #annots, #scan.macros, #scan.binds),
@@ -257,9 +582,9 @@ local function validate(ctx, src)
 		annots   = annots,
 		macros   = scan.macros,
 		binds    = scan.binds,
-		errors   = errors,
+		errors   = findings.errors,
-		warnings = warnings,
+		warnings = findings.warnings,
-		info     = info,
+		info     = findings.info,
 	}
 end
 
@@ -327,14 +652,12 @@ function M.run(ctx)
 	local errors   = {}
 	local warnings = {}
 
-	-- Per-DIRECTORY (per-module) aggregation. Group sources by `src.dir`,
+	-- Per-DIRECTORY (per-module) aggregation. Group sources by `src.dir`, validate every source in the dir, then emit ONE errors.h per dir.
-	-- validate every source in the dir, then emit ONE errors.h per dir.
 	-- `ctx.by_dir` is pre-computed in build_ctx (shared across all passes).
 	local by_dir = ctx.by_dir or duffle.group_sources_by_dir(ctx.sources)
 
 	for dir, dir_sources in pairs(by_dir) do
 		local dir_basename = dir:match("([^/\\]+)$") or dir
-
 		local dir_atoms    = 0
 		local dir_errors   = {}
 		local dir_warnings = {}
@@ -348,11 +671,11 @@ function M.run(ctx)
 			dir_atoms = dir_atoms + #result.atoms
 			for _, e in ipairs(result.errors) do
 				dir_errors[#dir_errors + 1] = { line = e.line, msg = e.msg, source = src.path }
-				errors[#errors + 1] = { line = e.line, msg = e.msg }
+				errors    [#errors     + 1] = { line = e.line, msg = e.msg }
 			end
 			for _, w in ipairs(result.warnings) do
 				dir_warnings[#dir_warnings + 1] = { line = w.line, msg = w.msg }
-				warnings[#warnings + 1] = { line = w.line, msg = w.msg }
+				warnings    [#warnings     + 1] = { line = w.line, msg = w.msg }
 			end
 		end
 

scripts/passes/atoms_source_map.lua

@@ -0,0 +1,814 @@
+--- passes/atoms_source_map.lua — Per-.word source-line map emitter for tape atoms.
+---
+--- Reads the pre-scanned SourceScan payload (produced once upstream by `duffle.scan_source`)
+--- for `MipsAtom_(name)` (kind="atom"), `MipsAtomComp_` / `MipsAtomComp_Proc_` (kind="comp_*"),
+--- and `MipsCode code_<name>` (kind="raw_atom") declarations. 
+--- Walks each atom's pre-tokenized body (`{{tok=string, rel=integer}, ...}` from `duffle.tokenize_body`), 
+--- counts per-token word contributions via `ctx.shared.word_counts`, and emits one
+--- `WORD N LINE L TEXT T` line per `.word` to `<out_root>/<basename>.atoms.sourcemap.txt`.
+---
+--- **Two output forms** (per the workspace's per-emission-form pattern from
+--- `guide_metaprogram_ssdl.md`):
+---   1. **Canonical text form** — `<out_root>/<basename>.atoms.sourcemap.txt`.
+---      Format-version-tagged for forward-compat. 
+---      Lives in `<out_root>/` (build/gen).
+---      Matches the convention used by `annotation.lua` (`<out_root>/<basename>.errors.h`) + `static_analysis.lua` (`<out_root>/<basename>.static_analysis.txt`).
+---      Compile artifacts (`*.macs.h`, `*.offsets.h`) stay in `<source_dir>/gen/`.
+---   2. **gdb-runtime form** — `<ctx.out_root>/gdb_tape_atoms_runtime.gdb`
+---      (pure gdb command script; addresses pre-computed via `nm`; the 9 user commands defined as `define ... end` blocks).
+---      Emitted ONLY when `ctx.flags.gdb_runtime` is true AND `ctx.flags.elf_path` points to an existing ELF.
+---      The gdb runtime form lets `gdb-multiarch --without-python` users (the common case on Windows MinGW builds)
+---      load the source-map data via `source <path>` — no Python/Tcl/Guile required.
+---
+--- **Output format** (canonical text form):
+---   ```
+---   # FORMAT_VERSION 1
+---   # auto-generated by ps1_meta.lua (passes/atoms_source_map.lua) — DO NOT EDIT
+---   ATOM <name> "<abs-source-path>" <total_words>
+---   WORD 0  LINE 49  TEXT load_half_u(R_T0, R_FaceCursor, 0 * S_(S2)),
+---   WORD 1  LINE 49  TEXT load_half_u(R_T0, R_FaceCursor, 0 * S_(S2)),
+---   ... (one WORD line per .word emitted by the atom body) ...
+---   ENDATOM
+---   ATOM <next-name> "<abs-source-path>" <total_words>
+---   ...
+---   ENDATOM
+---   ```
+---
+--- Marker calls (`atom_label(...)`, `atom_offset(...)`) emit 0 `.word`s. 
+--- They share the same walking convention as `passes/offsets.lua :: scan_atom_body`: 
+--- markers do NOT advance the word-offset counter, but if a marker is bundled on the same token with a
+--- trailing instruction (e.g. `atom_label(foo) load_half_u(...)`), 
+--- the trailing instruction's word count is added. This matches `offsets.lua :: count_marker_rest`.
+---
+--- **Conventions:** tabs (1/level), EmmyLua annotations, no regex,
+--- Lua 5.3 compatible.
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Module-scope requires + package.path setup
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` 
+-- (works both standalone + when require'd). `duffle_paths.lua` sets package.path then returns `require("duffle")` 
+-- at the bottom, so the dofile value IS the duffle module.
+local _bootstrap_dir = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
+local duffle           = dofile(_bootstrap_dir .. "../duffle_paths.lua")
+local elf_dwarf        = require("elf_dwarf")
+local word_count_eval  = require("word_count_eval")
+local count_token_words = word_count_eval.count_token_words
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Constants
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Format version emitted as the first line. Bump + add a migration test if the format changes; 
+-- the gdb runtime loader rejects mismatches (E2).
+local FORMAT_VERSION = 1
+
+-- Marker-call identifiers (mirrors offsets.lua:33-34).
+local LABEL_MARKER  = "atom_label"
+local OFFSET_MARKER = "atom_offset"
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Type declarations
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- @class AtomSourceMapCtx
+--- @field sources            table[] -- SourceScan payload per source (from `ctx.sources`)
+--- @field shared             table   -- `ctx.shared`
+--- @field shared.word_counts table   -- macro name -> word count (populated by word-counts + components passes)
+--- @field out_root           string  -- output root (e.g. "build/gen")
+--- @field dry_run            boolean -- if true, compute but don't write
+--- @field flags              table   -- `ctx.flags`; reads `flags.gdb_runtime` + `flags.elf_path`
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Helpers
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- True iff the leading identifier of `tok` is a marker call (`atom_label` / `atom_offset`).
+--- Mirrors `passes/offsets.lua :: is_marker_token` (which is file-local there).
+--- @param tok string
+--- @return boolean
+local function is_marker_token(tok)
+	local leading = duffle.read_ident(tok, 1)
+	return leading == LABEL_MARKER or leading == OFFSET_MARKER
+end
+
+--- Count words contributed by the non-marker portion of `tok` (after the marker's closing `)`).
+--- Mirrors offsets.lua:182 `count_marker_rest`. 
+--- Returns 0 if there's no trailing content after the marker call.
+--- @param tok string
+--- @param wc table
+--- @return integer
+local function count_marker_rest(tok, wc)
+	local marker_end = duffle.find_marker_call_end(tok)
+	if not marker_end or marker_end >= #tok then return 0 end
+	local rest = duffle.trim(tok:sub(marker_end))
+	if rest == "" then return 0 end
+	return count_token_words(rest, wc)
+end
+
+--- Compute per-word entries for an atom. 
+--- Shared between the canonical text form and the gdb-runtime form.
+---
+--- Returns a list of `{pos, line, text}` entries + the total word count.
+--- Markers contribute 0 entries (the marker call emits 0 `.word`s).
+--- @param atom table   -- one entry of scan.atoms / scan.raw_atoms
+--- @param src  table   -- SourceFile (has .scan with .line_of(), .path)
+--- @param wc   table   -- shared.word_counts
+--- @return table[], integer
+local function compute_word_entries(atom, src, wc)
+	local entries = {}
+	local pos     = 0
+	for _, t in ipairs(atom.body_tokens) do
+		local tok = t.tok
+		local rel = t.rel
+
+		local words
+		if is_marker_token(tok) then
+			words = count_marker_rest(tok, wc)
+		else
+			words = count_token_words(tok, wc)
+		end
+
+		if words > 0 then
+			-- Source line for THIS token = line containing byte offset `atom.body_off + rel`.
+			-- `src.scan.line_of(...)` is O(log N) via LineIndex.
+			local line = src.scan.line_of(atom.body_off + rel)
+			-- Flatten newlines + tabs in TEXT to spaces so each WORD entry fits on one physical line.
+			-- The gdb Python parser (or our pure-gdb parser) does line-based splits; multi-line TEXT would break it.
+			local text = duffle.trim(tok):gsub("[\t\r\n]+", " ")
+			for _ = 1, words do
+				entries[#entries + 1] = { pos = pos, line = line, text = text }
+				pos = pos + 1
+			end
+		end
+	end
+	return entries, pos
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Provenance emission
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Component-macro invocation prefix (mirrors components.lua's MAC_PREFIX).
+local MAC_PREFIX     = "mac_"
+local MAC_PREFIX_LEN = 4
+
+--- Strip the `mac_` prefix from a token's leading identifier.
+--- Returns nil if the identifier doesn't start with `mac_` 
+--- (so non-component tokens like `load_half_u`, `nop2`, `gte_cmdw_*` fall through cleanly).
+--- @param tok string
+--- @return string|nil
+local function strip_mac_prefix_from_token(tok)
+	local leading = duffle.read_ident(tok, 1)
+	if not leading then return nil end
+	if leading:sub(1, MAC_PREFIX_LEN) == MAC_PREFIX then
+		return leading:sub(MAC_PREFIX_LEN + 1)
+	end
+	return nil
+end
+
+--- Compute per-word provenance entries for an atom. Mirrors `compute_word_entries` but additionally classifies each emitted `.word` as either:
+---   - `RAW`     — emitted by a direct instruction token (no component provenance)
+---   - `MACRO X` — emitted by a `mac_X(...)` component invocation, with the component's definition file:line resolved from `ctx.shared.components`.
+---
+--- Returns a list of `{pos, line, text, comp_name, comp_line, comp_path, body_line}` entries + the total word count.
+--- `comp_name` is nil for RAW rows. `body_line` is the line of THIS specific word in the macro body (component source file, not the caller's source);
+--- it differs from `comp_line` (= the macro signature line) for every body word whose macro-body token is on a different physical line.
+--- `body_line` is `nil` for RAW rows and for component words whose component declaration could not be indexed (older pass combinations / external macros).
+---
+--- The per-word body-line lookup mirrors `passes/dwarf_injection.lua :: compute_invocation_body_lines`:
+--- walk the component's pre-tokenized body in lockstep with `count_token_words` and attribute the source line via `src.scan.line_of(...)` to each emitted `.word`.
+--- Atom labels (`atom_label(...)`) emit 0 `.word`s and are skipped to stay aligned with the macro-side word-counting contract.
+--- @param atom table  -- one entry of scan.atoms / scan.raw_atoms
+--- @param src  table  -- SourceFile (has .scan with .line_of(), .path)
+--- @param wc   table  -- shared.word_counts
+--- @param comp table  -- shared.components map: bare_name -> {name=, line=, path=, kind=}
+--- @param comp_body_index table  -- per-source component body index: bare_name -> {body_off, body_tokens, line_of}
+--- @return table[], integer
+local function compute_provenance_entries(atom, src, wc, comp, comp_body_index)
+	local entries = {}
+	local pos     = 0
+	for _, t in ipairs(atom.body_tokens) do
+		local tok = t.tok
+		local rel = t.rel
+
+		local words
+		if is_marker_token(tok) then
+			words = count_marker_rest(tok, wc)
+		else
+			words = count_token_words(tok, wc)
+		end
+
+		-- Resolve component provenance for this token (if any).
+		local comp_name = nil
+		local comp_line = nil
+		local comp_path = nil
+		local comp_kind = nil
+		local bare      = strip_mac_prefix_from_token(tok)
+		if bare and comp and comp[bare] then
+			comp_name = bare
+			comp_line = comp[bare].line
+			comp_path = comp[bare].path
+			comp_kind = comp[bare].kind
+		end
+
+		-- Per-word body lines: lazily allocate from the indexed component body the first time we see a `mac_X(...)` call to a given component.
+		-- We allocate ONE full body_lines vector per (call) and consume it sequentially; 
+		-- if a single atom calls the same component more than once, each call refetches its own vector. 
+		-- (Today no atom calls the same `mac_X(...)` twice, but the refetch keeps the semantics correct even if that changes.)
+		local body_lines = nil
+		local function fetch_body_lines()
+			if not (bare and comp_body_index) then return nil end
+			local idx = comp_body_index[bare]
+			if not (idx and idx.body_tokens and idx.line_of) then return nil end
+			local lines = {}
+			for _, bt in ipairs(idx.body_tokens) do
+				local bt_tok = duffle.trim(bt.tok or "")
+				if bt_tok ~= "" then
+					local leading = duffle.read_ident(bt_tok, 1)
+					local bt_words
+					if leading == "atom_label" or leading == "atom_offset" then
+						bt_words = 0
+					else
+						bt_words = count_token_words(bt_tok, wc)
+					end
+					if bt_words > 0 then
+						local body_line = idx.line_of(idx.body_off + bt.rel)
+						for _ = 1, bt_words do lines[#lines + 1] = body_line end
+					end
+				end
+			end
+			return lines
+		end
+
+		if words > 0 then
+			local line = src.scan.line_of(atom.body_off + rel)
+			local text = duffle.trim(tok):gsub("[\t\r\n]+", " ")
+			-- Fetch body_lines ONCE per token (one mac_X(...) call exhausts N body words).
+			if comp_name then body_lines = fetch_body_lines() end
+			for i = 1, words do
+				entries[#entries + 1] = {
+					pos       = pos,
+					line      = line,
+					text      = text,
+					comp_name = comp_name,
+					comp_line = comp_line,
+					comp_path = comp_path,
+					comp_kind = comp_kind,
+					body_line = body_lines and body_lines[i],
+				}
+				pos = pos + 1
+			end
+		end
+	end
+	return entries, pos
+end
+
+--- Render one atom's provenance stanza. Format:
+---   `WORD N  CALL <src-path>:<src-line>  MACRO <name> "<def-path>:<def-line>"  [BODY <line>]`  (for component words)
+---   `WORD N  CALL <src-path>:<src-line>  RAW`                                                  (for direct instructions)
+--- `BODY <line>` is the source line of THIS specific word within the macro body
+--- (lottes_tape.h:N where N is the per-word body line).
+--- Absent for RAW rows and for component rows whose component declaration could not be indexed (older pass combinations / external macros).
+--- Downstream consumers (dwarf_injection, tests) fall back to DefLine / comp_line when BODY is absent.
+--- Returns (lines, total_words).
+--- @param src    table
+--- @param atom   table
+--- @param wc     table
+--- @param comp   table  -- shared.components map
+--- @param comp_body_index table  -- per-source component body index: bare_name -> {body_off, body_tokens, line_of}
+--- @return string[], integer
+local function emit_provenance_stanza(src, atom, wc, comp, comp_body_index)
+	local lines    = {}
+	local rel_path = src.path:gsub("\\", "/")
+	local entries, total = compute_provenance_entries(atom, src, wc, comp, comp_body_index)
+
+	-- ATOM header line with placeholder total (patched after we know it).
+	lines[#lines + 1] = string.format('ATOM %s "%s" 0', atom.raw_name or atom.name, rel_path)
+
+	for _, pe in ipairs(entries) do
+		if pe.comp_name then
+			local body_suffix = ""
+			if pe.body_line then
+				body_suffix = "  BODY " .. tostring(pe.body_line)
+			end
+			lines[#lines + 1] = string.format('WORD %d  CALL %s:%d  MACRO %s "%s:%d"%s',
+				pe.pos, rel_path, pe.line, pe.comp_name, pe.comp_path, pe.comp_line, body_suffix)
+		else
+			lines[#lines + 1] = string.format("WORD %d  CALL %s:%d  RAW", pe.pos, rel_path, pe.line)
+		end
+	end
+
+	-- Patch the placeholder total in the ATOM header line.
+	lines[1] = lines[1]:gsub(" 0$", " " .. tostring(total))
+	lines[#lines + 1] = "ENDATOM"
+	return lines, total
+end
+
+--- Build a per-source component body index keyed by the bare component name (e.g. `gte_load_tri_verts`).
+--- Each entry holds the data we need to map each emitted `.word` to its actual source line within the macro body:
+---   body_off    -- byte offset of the `{` (start of body) in the component's source file.
+---   body_tokens -- list of {tok, rel} pairs; `rel` is the byte offset within the body.
+---   line_of     -- closure resolving byte offsets in the component's source file to lines.
+--- Only `comp_bare` + `comp_proc` declarations contribute (a macro invocation can only resolve to one of those).
+--- First declaration wins (subsequent redeclarations would collide; today's sources declare each component exactly once).
+--- Render the full provenance file content for one source (one `.atoms.provenance.txt` per source).
+--- @param src table
+--- @param wc table
+--- @param comp table  -- shared.components map
+--- @param comp_body_index table  -- cross-source component body index (built once in M.run; may be empty)
+--- @return string
+local function render_provenance(src, wc, comp, comp_body_index)
+	local lines = {}
+	lines[#lines + 1] = "# FORMAT_VERSION 1"
+	lines[#lines + 1] = "# auto-generated by ps1_meta.lua (passes/atoms_source_map.lua) — DO NOT EDIT"
+	lines[#lines + 1] = "# Per-.word provenance: maps each emitted .word to its call site (atom body"
+	lines[#lines + 1] = "# file:line) and, when the word was emitted by a `mac_X(...)` component invocation,"
+	lines[#lines + 1] = "# the component's definition file:line + the per-word BODY line. Used by"
+	lines[#lines + 1] = "# dwarf_injection to synthesize DW_TAG_inlined_subroutine instances + per-word"
+	lines[#lines + 1] = "# line program rows for native source-level step into component bodies."
+
+	-- The cross-source component body index is passed in from M.run (one global lookup shared across every source's provenance file).
+	-- A per-source lookup would miss every component whose declaration is in another source (e.g. `gte_load_tri_verts` is declared in `lottes_tape.h` but invoked from `hello_gte_tape.c`).
+
+	for _, atom in ipairs(src.scan.atoms or {}) do
+		local stanza = emit_provenance_stanza(src, atom, wc, comp, comp_body_index)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+	for _, atom in ipairs(src.scan.raw_atoms or {}) do
+		local stanza = emit_provenance_stanza(src, atom, wc, comp, comp_body_index)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+
+	return table.concat(lines, "\n") .. "\n"
+end
+
+--- Render one atom's stanza for the canonical text form (ATOM header line, N WORD lines, ENDATOM marker).
+--- Returns (lines, total_words).
+--- @param src    table
+--- @param atom   table
+--- @param wc     table
+--- @return string[], integer
+local function emit_atom_stanza(src, atom, wc)
+	local lines              = {}
+	local rel_path           = src.path:gsub("\\", "/")
+	local entries, total     = compute_word_entries(atom, src, wc)
+
+	-- ATOM header line with placeholder total (patched after we know it).
+	lines[#lines + 1] = string.format('ATOM %s "%s" 0', atom.raw_name or atom.name, rel_path)
+	for _, we in ipairs(entries) do
+		lines[#lines + 1] = string.format("WORD %d  LINE %d  TEXT %s",
+			we.pos, we.line, we.text)
+	end
+
+	-- Patch the placeholder total in the ATOM header line.
+	lines[1] = lines[1]:gsub(" 0$", " " .. tostring(total))
+	lines[#lines + 1] = "ENDATOM"
+	return lines, total
+end
+
+--- Render the full source map file content for one source (one .atoms.sourcemap.txt per source).
+--- Mirrors offsets.lua's `project_atoms` shape: scan.atoms + scan.raw_atoms, no kind filter.
+--- @param src table
+--- @param wc table
+--- @return string
+local function render_source_map(src, wc)
+	local lines = {}
+	lines[#lines + 1] = "# FORMAT_VERSION " .. FORMAT_VERSION
+	lines[#lines + 1] = "# auto-generated by ps1_meta.lua (passes/atoms_source_map.lua) — DO NOT EDIT"
+
+	for   _, atom in ipairs(src.scan.atoms or {}) do
+		local stanza = emit_atom_stanza(src, atom, wc)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+	for   _, atom in ipairs(src.scan.raw_atoms or {}) do
+		local stanza = emit_atom_stanza(src, atom, wc)
+		for _, line in ipairs(stanza) do lines[#lines + 1] = line end
+	end
+
+	return table.concat(lines, "\n") .. "\n"
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- gdb-runtime emission (post-link, addresses via nm)
+-- ════════════════════════════════════════════════════════════════════════════
+
+--- Escape a string for embedding in a gdb `set $var = "..."` literal.
+--- gdb uses C-style escaping; we escape `\` and `"` (newlines were flattened earlier).
+--- @param s string
+--- @return string
+local function gdb_escape(s)
+	return (s:gsub("\\", "\\\\"):gsub('"', '\\"'))
+end
+
+--- Build the list of atoms with addresses + word entries.
+--- Shared helper for the gdb-runtime file emission.
+--- @param ctx PassCtx
+--- @return table[] -- list of {idx, name, src_path, file_base, addr, size_bytes, words, entries}
+local function build_atom_table(ctx)
+	local wc    = (ctx.shared and ctx.shared.word_counts) or {}
+	local addrs = elf_dwarf.read_nm(ctx.flags.elf_path)
+
+	local matched = {}
+	for _, src in ipairs(ctx.sources) do
+		if src.scan then
+			local file_base = src.path:match("([^/\\]+)$") or src.path
+			for _, atom in ipairs(src.scan.atoms or {}) do
+				if atom.kind == nil or atom.kind == "atom" then
+					local name    = atom.raw_name or atom.name
+					local info    = addrs[name]
+					if info then
+						local entries, total = compute_word_entries(atom, src, wc)
+						matched[#matched + 1] = {
+							name       = name,
+							src_path   = src.path,
+							file_base  = file_base,
+							addr       = info[1],
+							size_bytes = info[2],
+							words      = total,
+							entries    = entries,
+						}
+					end
+				end
+			end
+			for _, atom in ipairs(src.scan.raw_atoms or {}) do
+				local name = atom.name
+				local info = addrs[name]
+				if info then
+					local entries, total = compute_word_entries(atom, src, wc)
+					matched[#matched + 1] = {
+						name       = name,
+						src_path   = src.path,
+						file_base  = file_base,
+						addr       = info[1],
+						size_bytes = info[2],
+						words      = total,
+						entries    = entries,
+					}
+				end
+			end
+		end
+	end
+
+	-- Deterministic order: sort by address (matches `nm` output ordering).
+	table.sort(matched, function(a, b) return a.addr < b.addr end)
+	for i, a in ipairs(matched) do
+		a.idx = i - 1
+	end
+	return matched
+end
+
+--- Append the 9 gdb command definitions to `lines`. Pure gdb scripting no Python, no Tcl, no Guile required. 
+--- **Fully hardcoded per-atom** because gdb doesn't do nested `$` substitution in var names
+--- `$__atom_name_$__i` inside a `while` loop is treated as one literal identifier, not a concat.
+---
+--- Each command is a static sequence of `printf` / `tbreak` / `if ... end` blocks.
+--- The Lua pass emits N atoms' worth of lines — no runtime iteration. 
+--- With 7 atoms + ~200 word entries, the runtime file is ~2000 lines, all auto-generated, no human edit ever.
+--- @param lines   table  -- output line buffer (mutated in place)
+--- @param matched table  -- list of atom records from `build_atom_table`
+local function append_gdb_commands(lines, matched)
+	-- ── tape_atoms ──
+	-- Hardcoded one printf per atom. No loop.
+	lines[#lines + 1] = "define tape_atoms"
+	for _, a in ipairs(matched) do
+		-- gdb 12.1 quirk: literals in printf args require an attached target.
+		-- Use the per-atom convenience vars set above as printf args.
+		lines[#lines + 1] = string.format('  printf "  code_%%-32s @ 0x%%08x  %%4d words\\n", $__atom_name_%d, $__atom_addr_%d, $__atom_words_%d',
+			a.idx, a.idx, a.idx)
+	end
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document tape_atoms"
+	lines[#lines + 1] = "  List every tape atom symbol in the loaded ELF (code_<name>) with .rodata addr + word count."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── break_atom (generic) + per-atom break_atom_X ──
+	lines[#lines + 1] = "define break_atom"
+	lines[#lines + 1] = '  echo "Usage: break_atom_<exact_name>  (pick from the list below)"'
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format('  printf "  break_atom_%%-32s\\n", $__atom_name_%d', a.idx)
+	end
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document break_atom"
+	lines[#lines + 1] = "  Generic help: lists the per-atom break_atom_<name> commands."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format("define break_atom_%s", a.name)
+		lines[#lines + 1] = string.format("  break *$__atom_addr_%d", a.idx)
+		lines[#lines + 1] = string.format('  printf "  Breakpoint set at code_%s (0x%%08x)\\n", $__atom_addr_%d', a.name, a.idx)
+		lines[#lines + 1] = "end"
+		lines[#lines + 1] = string.format("document break_atom_%s", a.name)
+		lines[#lines + 1] = string.format("  Set a breakpoint at code_%s.", a.name)
+		lines[#lines + 1] = "end"
+		lines[#lines + 1] = ""
+	end
+
+	-- ── step_atom / next_atom ──
+	-- Hardcoded one tbreak per atom. No loop.
+	lines[#lines + 1] = "define step_atom"
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format("  tbreak *$__atom_addr_%d", a.idx)
+	end
+	lines[#lines + 1] = "  continue"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document step_atom"
+	lines[#lines + 1] = "  Set one-shot BPs at every atom + continue. Stops at the next atom boundary."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	lines[#lines + 1] = "define next_atom"
+	lines[#lines + 1] = "  step_atom"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document next_atom"
+	lines[#lines + 1] = "  Alias for step_atom."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── where_in_atom ──
+	-- Hardcoded one outer-if per atom; inside, one inner-if per WORD entry.
+	lines[#lines + 1] = "define where_in_atom"
+	lines[#lines + 1] = "  set $__pc = (unsigned int)$pc"
+	lines[#lines + 1] = "  set $__matched = 0"
+	for _, a in ipairs(matched) do
+		-- Precompute end_addr (gdb 12.1's expression evaluator chokes on `addr + words*4`).
+		lines[#lines + 1] = string.format("  set $__end_%d = $__atom_addr_%d + $__atom_words_%d * 4", a.idx, a.idx, a.idx)
+		lines[#lines + 1] = string.format("  if $__pc >= $__atom_addr_%d && $__pc < $__end_%d", a.idx, a.idx)
+		lines[#lines + 1] = string.format('    printf "atom:    code_%%s\\n", $__atom_name_%d', a.idx)
+		lines[#lines + 1] = '    printf "addr:    0x%08x\\n", $__pc'
+		lines[#lines + 1] = string.format("    set $__word = ($__pc - $__atom_addr_%d) / 4", a.idx)
+		lines[#lines + 1] = string.format('    printf "word:    %%d/%%d\\n", $__word, $__atom_words_%d', a.idx)
+		-- One inner-if per WORD entry. Each word's line + text hardcoded.
+		for _, we in ipairs(a.entries) do
+			lines[#lines + 1] = string.format("    if $__word == %d", we.pos)
+			-- Escape TEXT for printf format string.
+			local escaped_text = we.text:gsub("%%", "%%%%"):gsub('"', '\\"')
+			lines[#lines + 1] = string.format('      printf "source:  %%s:%%d  %%s\\n", $__atom_file_%d, %d, "%s"', a.idx, we.line, escaped_text)
+			lines[#lines + 1] = "    end"
+		end
+		-- Fallback for words beyond the source map (shouldn't happen if nm matches).
+		local max_word = 0
+		if #a.entries > 0 then max_word = a.entries[#a.entries].pos end
+		lines[#lines + 1] = string.format('    if $__word > %d', max_word)
+		lines[#lines + 1] = '      printf "source:  (no source-map entry for word %%d; map may be stale)\\n", $__word'
+		lines[#lines + 1] = "    end"
+		lines[#lines + 1] = "    set $__matched = 1"
+		lines[#lines + 1] = "  end"
+	end
+	lines[#lines + 1] = "  if !$__matched"
+	lines[#lines + 1] = '    echo PC is not inside any known atom (in .text or unmapped region).'
+	lines[#lines + 1] = "  end"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document where_in_atom"
+	lines[#lines + 1] = "  Report current atom name, .rodata addr, word offset, and source line."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── stepi_inside_atom ──
+	-- Hardcoded one if-containment-check per atom (no loop).
+	-- Precompute end_addr in Lua so we don't ask gdb to evaluate `addr + words*4` inside the if condition
+	-- (gdb 12.1's expression evaluator chokes on the `*` and emits a misleading 'function malloc' error in some gdb builds).
+	lines[#lines + 1] = "define stepi_inside_atom"
+	lines[#lines + 1] = "  set $__in_atom = 0"
+	lines[#lines + 1] = "  set $__did_step = 0"
+	lines[#lines + 1] = "  set $__pc = (unsigned int)$pc"
+	for _, a in ipairs(matched) do
+		-- Precompute end_addr in the convenience var (single expression gdb handles).
+		lines[#lines + 1] = string.format("  set $__end_%d = $__atom_addr_%d + $__atom_words_%d * 4", a.idx, a.idx, a.idx)
+		lines[#lines + 1] = string.format("  if $__pc >= $__atom_addr_%d && $__pc < $__end_%d", a.idx, a.idx)
+		lines[#lines + 1] = "    set $__in_atom = 1"
+		lines[#lines + 1] = "    stepi"
+		lines[#lines + 1] = "    set $__did_step = 1"
+		lines[#lines + 1] = "  end"
+	end
+	lines[#lines + 1] = "  if !$__did_step"
+	lines[#lines + 1] = '    echo [gdb_tape_atoms] stepi_inside_atom: PC is not inside any atom; refusing to step.'
+	lines[#lines + 1] = "  end"
+	lines[#lines + 1] = "  where_in_atom"
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document stepi_inside_atom"
+	lines[#lines + 1] = "  One MIPS-instruction step, then where_in_atom. The step-and-see-source-line workflow."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── show_c2 ──
+	-- GTE data regs (COP2). pcsx-redux's gdb stub doesn't expose COP2 (only
+	-- 72 regs: 32 GPR + COP0 + FPR).
+	--   curl http://localhost:8080/api/v1/lua/gte
+	-- We keep the command definition as a stub that points the user at the plugin.
+	lines[#lines + 1] = "define show_c2"
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] show_c2: gdb stub does not expose COP2 in this build."'
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] Use scripts/pcsx_debug_helper.zip + curl http://localhost:8080/api/v1/lua/gte"'
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] (or pcsx-redux Debug > Registers window for a native view)"'
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document show_c2"
+	lines[#lines + 1] = "  Stub. The gdb stub in this pcsx-redux build does not expose COP2 regs."
+	lines[#lines + 1] = "  For GTE data + control state, use the pcsx_debug_helper Lua plugin or the"
+	lines[#lines + 1] = "  pcsx-redux Debug > Registers window."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── show_c2ctl ──
+	lines[#lines + 1] = "define show_c2ctl"
+	lines[#lines + 1] = '  echo "[gdb_tape_atoms] show_c2ctl: see show_c2 for the same workaround."'
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document show_c2ctl"
+	lines[#lines + 1] = "  Stub. Same workaround as show_c2."
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = ""
+
+	-- ── wave_ctx ──
+	lines[#lines + 1] = "define wave_ctx"
+	lines[#lines + 1] = '  printf "$t4 = R_FaceCursor     0x%08x\\n", $t4'
+	lines[#lines + 1] = '  printf "$t5 = R_VertBase       0x%08x\\n", $t5'
+	lines[#lines + 1] = '  printf "$t6 = R_OtBase         0x%08x\\n", $t6'
+	lines[#lines + 1] = '  printf "$t7 = R_PrimCursor     0x%08x\\n", $t7'
+	lines[#lines + 1] = "end"
+	lines[#lines + 1] = "document wave_ctx"
+	lines[#lines + 1] = "  Pretty-print the 4 wave-context GPRs ($t4=R_FaceCursor, $t5=R_VertBase, $t6=R_OtBase, $t7=R_PrimCursor). Requires target attached."
+	lines[#lines + 1] = "end"
+end
+
+--- Emit the gdb-runtime file (post-link). Pure gdb scripting — no Python.
+--- Reads ELF addresses via `mipsel-none-elf-nm -S`, embeds them in `<ctx.out_root>/gdb_tape_atoms_runtime.gdb`
+--- so gdb loads the data via `set $var = ...` + `define ... end` blocks at source-time.
+--- @param ctx PassCtx
+local function emit_gdb_runtime(ctx)
+	if not (ctx.flags and ctx.flags.gdb_runtime) then return end
+	local  elf_path = ctx.flags.elf_path
+	if not elf_path or elf_path == "" then
+		io.stderr:write("[atoms_source_map] --gdb-runtime requires --elf <elf>\n")
+		return
+	end
+	if lfs.attributes(elf_path, "mode") ~= "file" then
+		io.stderr:write(string.format(
+			"[atoms_source_map] --gdb-runtime: ELF not found at %s\n", elf_path))
+		return
+	end
+
+	local matched = build_atom_table(ctx)
+	if #matched == 0 then
+		io.stderr:write("[atoms_source_map] --gdb-runtime: no atoms matched against nm symbols (stale scan?).\n")
+		return
+	end
+
+	local lines = {}
+	lines[#lines + 1] = "# Auto-generated by ps1_meta.lua (passes/atoms_source_map.lua)"
+	lines[#lines + 1] = "# DO NOT EDIT — re-run ps1_meta.lua --atoms-source-map --gdb-runtime to regenerate"
+	lines[#lines + 1] = "# Sourced by scripts/gdb/gdb_tape_atoms.gdb (the wrapper)."
+	lines[#lines + 1] = "# Pure gdb scripting — no Python, no Tcl, no Guile required."
+	lines[#lines + 1] = "# Commands are FULLY HARDCODED per-atom because gdb doesn't do nested"
+	lines[#lines + 1] = "# `$` substitution in var names (`$foo_$i` is one literal identifier)."
+	lines[#lines + 1] = "# Per-atom convenience vars ($__atom_name_<i> etc.) are set so gdb's"
+	lines[#lines + 1] = "# `printf` has valid expression args (gdb 12.1 quirks: literals in"
+	lines[#lines + 1] = "# printf args require an attached target; convenience-var args do not)."
+	lines[#lines + 1] = string.format("# %d atoms from ELF: %s", #matched, elf_path)
+	lines[#lines + 1] = ""
+
+	-- Format version + count + ELF path (the latter is referenced by the load-line).
+	lines[#lines + 1] = "set $__atom_format_version = " .. FORMAT_VERSION
+	lines[#lines + 1] = string.format("set $__atom_count = %d", #matched)
+	lines[#lines + 1] = string.format('set $__elf_path = "%s"', gdb_escape(elf_path))
+	lines[#lines + 1] = ""
+
+	-- Per-atom convenience vars (used as printf args; literals aren't accepted
+	-- without an attached target on gdb 12.1).
+	for _, a in ipairs(matched) do
+		lines[#lines + 1] = string.format('set $__atom_name_%d = "%s"', a.idx, gdb_escape(a.name))
+		lines[#lines + 1] = string.format("set $__atom_addr_%d = 0x%x", a.idx, a.addr)
+		lines[#lines + 1] = string.format("set $__atom_words_%d = %d", a.idx, a.words)
+		lines[#lines + 1] = string.format('set $__atom_file_%d = "%s"', a.idx, gdb_escape(a.file_base))
+	end
+	lines[#lines + 1] = ""
+
+	-- The 9 commands (each `define ... end` overrides the wrapper's stub).
+	lines[#lines + 1] = "# ── 9 user commands (overrides wrapper stubs) ──"
+	append_gdb_commands(lines, matched)
+	lines[#lines + 1] = ""
+
+	-- Confirmation line for the source operator.
+	lines[#lines + 1] = 'printf "[gdb_tape_atoms] runtime loaded %d atoms from %s\\n", $__atom_count, $__elf_path'
+
+	local out_path = ctx.out_root .. "/gdb_tape_atoms_runtime.gdb"
+	if not ctx.dry_run then
+		duffle.ensure_dir(duffle.dirname(out_path))
+		duffle.write_file_lf(out_path, table.concat(lines, "\n") .. "\n")
+	end
+	io.stderr:write(string.format(
+		"[atoms_source_map] wrote %s (%d atoms)\n", out_path, #matched))
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- M — module exports
+-- ════════════════════════════════════════════════════════════════════════════
+
+local M = {}
+
+--- Build the cross-source component body index used by `render_provenance` to attribute each emitted `.word` to its actual line within the macro body.
+---
+--- Components are declared in one source (the header that contains `MipsAtomComp_(ac_X)` / `MipsAtomComp_Proc_(ac_X, ...)`) 
+--- but invoked from many source files (every atom body that calls `mac_X(...)`).
+--- The body_offset + body_tokens + line_of live with the declaration source, so a per-source index would miss invocations from other sources.
+---
+--- The cross-source index is keyed by the bare component name (`gte_load_tri_verts`, NOT `ac_gte_load_tri_verts`) — `strip_mac_prefix_from_token` strips the `mac_` prefix
+--- from call-site identifiers and yields that exact bare name; matching it here keeps the lookup aligned with the `ctx.shared.components` map's keying convention.
+--- First declaration wins (subsequent redeclarations would collide; today's sources declare each component exactly once).
+--- @param ctx PassCtx
+--- @return table<string, table>  -- {[comp_name] = {body_off, body_tokens, line_of}}
+local function build_cross_source_component_body_index(ctx)
+	local index = {}
+	for _, src in ipairs(ctx.sources or {}) do
+		if src.scan and src.scan.atoms then
+			local line_of = src.scan.line_of
+			for _, atom in ipairs(src.scan.atoms) do
+				if atom.kind == "comp_bare" or atom.kind == "comp_proc" then
+					-- Prefer `atom.name` (stripped of `ac_` prefix); fall back to `raw_name`
+					-- only if the stripped name is absent (defensive — current scan-source always sets both).
+					local name = atom.name or atom.raw_name
+					if name and not index[name] then
+						index[name] = {
+							body_off    = atom.body_off,
+							body_tokens = atom.body_tokens,
+							line_of     = line_of,
+						}
+					end
+				end
+			end
+		end
+	end
+	return index
+end
+
+--- Pass entry: emit one `<out_root>/<basename>.atoms.sourcemap.txt` per source file that contains at least one `MipsAtom_(name)` / `MipsCode code_<name>` declaration.
+--- Also emits `<out_root>/<basename>.atoms.provenance.txt`:
+--- per-.word provenance with `mac_X(...)` component resolution back to the component's definition file:line + the per-word body line.
+--- Optionally also emit `<ctx.out_root>/gdb_tape_atoms_runtime.gdb` when `ctx.flags.gdb_runtime` is true.
+--- @param ctx PassCtx
+--- @return PassResult
+function M.run(ctx)
+	local outputs  = {}
+	local errors   = {}
+	local warnings = {}
+
+	-- word-counts + components passes must have populated shared.word_counts.
+	-- If absent, the orchestrator wired the deps wrong — fail loud.
+	local wc = (ctx.shared and ctx.shared.word_counts) or {}
+	if not wc or not next(wc) then
+		warnings[#warnings + 1] = {
+			line = 0,
+			msg  = "atoms_source_map: ctx.shared.word_counts is empty; the word-counts + components passes may not have populated it. Check the PASSES dep edges.",
+		}
+	end
+
+	-- shared.components map is populated by `passes/components.lua`.
+	-- Used to attribute each emitted `.word` to either a component macro or the enclosing atom body.
+	-- If absent, all words fall through as RAW (correct behavior — provenance is additive).
+	local comp = (ctx.shared and ctx.shared.components) or {}
+
+	-- Cross-source component body index.
+	-- Built ONCE so every source's provenance writer can resolve `mac_X(...)` invocations back to the macro's body tokens (regardless of which source declared the component).
+	-- Per-source copies were insufficient — the atom file (`hello_gte_tape.c`) does not contain the `MipsAtomComp_(...)` declarations, 
+	-- so the body data would be missing for every component invocation the atom file emitted.
+	local comp_body_index = build_cross_source_component_body_index(ctx)
+
+	-- Always emit the canonical text form (per-source).
+	for _, src in ipairs(ctx.sources) do
+		if src.scan then
+			local n_atoms     = src.scan.atoms and #src.scan.atoms or 0
+			local n_raw_atoms = src.scan.raw_atoms and #src.scan.raw_atoms or 0
+			if n_atoms + n_raw_atoms > 0 then
+				local basename = duffle.basename_no_ext(src.path)
+
+				-- (1) atoms.sourcemap.txt — per-.word line map (unchanged contract).
+				local sourcemap_path = ctx.out_root .. "/" .. basename .. ".atoms.sourcemap.txt"
+				local sourcemap_body = render_source_map(src, wc)
+
+				-- (2) atoms.provenance.txt — per-.word provenance with `mac_X(...)` component resolution back to the component's definition file:line.
+				--     Consumed by `passes/dwarf_injection.lua` to synthesize `DW_TAG_inlined_subroutine` instances for source-level Step Into on component invocations.
+				local prov_path = ctx.out_root .. "/" .. basename .. ".atoms.provenance.txt"
+				local prov_body = render_provenance(src, wc, comp, comp_body_index)
+
+				if not ctx.dry_run then
+					duffle.ensure_dir(duffle.dirname(sourcemap_path))
+					duffle.write_file_lf(sourcemap_path, sourcemap_body)
+					duffle.write_file_lf(prov_path,    prov_body)
+				end
+
+				outputs[#outputs + 1] = { kind = "report", path = sourcemap_path }
+				outputs[#outputs + 1] = { kind = "report", path = prov_path }
+			end
+		end
+	end
+
+	-- Optionally emit the gdb-runtime form (post-link, one file per build).
+	if ctx.flags and ctx.flags.gdb_runtime then
+		emit_gdb_runtime(ctx)
+	end
+
+	return { outputs = outputs, errors = errors, warnings = warnings }
+end
+
+return M

scripts/passes/components.lua

@@ -1,12 +1,12 @@
 --- passes/components.lua — Component-macro header generator.
 ---
 --- Reads the pre-scanned SourceScan payload (produced once upstream by `duffle.scan_source`)
---- for `MipsAtomComp_(ac_X)` and `MipsAtomComp_Proc_(ac_X, { body })` declarations, then does
+--- for `MipsAtomComp_(ac_X)` and `MipsAtomComp_Proc_(ac_X, { body })` declarations, then does per-source backward lookups
---- per-source backward lookups for the function-args string (from the preceding `FI_ MipsAtom ac_X(...)`
+--- for the function-args string (from the preceding `FI_ MipsAtom ac_X(...)` function declaration)
---- function declaration) and the preceding comment block (for LSP/IntelliSense signature docs).
+--- and the preceding comment block (for LSP/IntelliSense signature docs).
 ---
---- Emits a per-directory `<dir_basename>.macs.h` containing one `#define mac_X(sig) \` macro per component
+--- Emits a per-directory `<dir_basename>.macs.h` containing one `#define mac_X(sig) \` macro per component + `WORD_COUNT(mac_X, N)`
---- + `WORD_COUNT(mac_X, N)` entries for downstream offset computation.
+--- entries for downstream offset computation.
 ---
 --- **Conventions**: tabs (1/level), EmmyLua annotations, no regex,
 --- Lua 5.3 compatible.
@@ -26,8 +26,7 @@
 
 -- Bootstrap: same as entry scripts. See `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
--- Uses `debug.getinfo` to find this file's own directory, so it works
+-- Uses `debug.getinfo` to find this file's own directory, so it works both standalone and when require'd from the orchestrator.
--- both standalone and when require'd from the orchestrator.
 -- Bootstrap: load `duffle_paths.lua` via `debug.getinfo(1, "S").source` (works both standalone + when require'd).
 -- duffle_paths.lua sets package.path then returns `require("duffle")` at the bottom, so the dofile value IS the duffle module.
 local _bootstrap_dir  = debug.getinfo(1, "S").source:match("^@?(.*[/\\])") or "./"
@@ -107,13 +106,14 @@ local M = {}
 -- @param before_pos integer
 -- @return integer|nil
 local function find_last_name_open_paren(source, name, before_pos)
-	local search     = source:sub(1, before_pos)
 	local name_open  = name .. "("
 	local last_idx   = nil
 	local scan_pos   = 1
 	while true do
-		local found = search:find(name_open, scan_pos, true)  -- plain (no regex)
+		-- Pass `before_pos + 1` so string.find only returns positions < before_pos + 1
-		if not found then break end
+		-- (string.find's 4th arg `plain` is true; we use the 3rd arg `init` for the upper bound).
+		local found = source:find(name_open, scan_pos, true)
+		if not found or found >= before_pos then break end
 		last_idx = found
 		scan_pos = found + #name_open
 	end
@@ -126,8 +126,8 @@ end
 --- Convention: function form is
 ---   `FI_ MipsAtom ac_X(args) MipsAtomComp_Proc_(ac_X, { body })`
 --- We find the LAST occurrence of `"ac_X("` before `before_pos` and extract the args from inside the parens.
---- We then verify the preceding context ends with `MipsAtom` (the function-decl keyword
+--- We then verify the preceding context ends with `MipsAtom` 
---- with possible qualifiers between).
+--- (the function-decl keyword with possible qualifiers between).
 ---
 --- @param source string
 --- @param name string
@@ -282,8 +282,8 @@ end
 -- Argument-name extraction
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Walk `trimmed` backward from `pos` over trailing whitespace / asterisks / brackets, returning the position of the first
+-- Walk `trimmed` backward from `pos` over trailing whitespace / asterisks / brackets, 
--- non-trailer character (i.e. the end of the identifier).
+-- returning the position of the first non-trailer character (i.e. the end of the identifier).
 -- @param trimmed string
 -- @param pos integer
 -- @return integer
@@ -322,9 +322,6 @@ end
 ---   `"U4 off, U4 code, U1 r, U1 g, U1 b"`  ->  `{"off", "code", "r", "g", "b"}`
 ---   `"U4 *ptr"`                            ->  `{"ptr"}`
 ---   `""`                                   ->  nil
----
---- No regex — uses `duffle.is_alnum` + plain string ops.
----
 --- @param args_str string|nil
 --- @return string[]|nil
 local function extract_arg_names(args_str)
@@ -350,8 +347,7 @@ end
 
 -- Project pre-scanned MipsAtomComp_ / MipsAtomComp_Proc_ entries into Component shape.
 -- Does per-source backward lookups for args (preceding function decl) and comment (preceding comment block).
--- Carries `body_tokens` forward from scan-source so word_count_rec reads from the precomputed table
+-- Carries `body_tokens` forward from scan-source so word_count_rec reads from the precomputed table instead of calling duffle.tokenize_body again.
--- instead of calling duffle.tokenize_body again.
 -- @param source string  -- the full source text (needed for backward lookups)
 -- @param scan  table   -- SourceScan from duffle.scan_source
 -- @return Component[]
@@ -368,6 +364,7 @@ local function project_components(source, scan)
 				body_tokens = a.body_tokens,
 				args        = args,
 				comment     = comment,
+				kind        = a.kind,  -- "comp_bare" | "comp_proc"; provenance emitter reads this.
 			}
 		end
 	end
@@ -379,7 +376,6 @@ end
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Convert `//` line comments to `/* */` block comments in a token.
---
 -- C macros use `\` line-continuations; a `//` comment before `\` would consume the continuation,
 -- breaking the macro. We convert `//` to `/* */` so the multi-line macro structure is preserved.
 --
@@ -422,8 +418,9 @@ end
 -- Word-count computation (memoized recursive lookup)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Strip the `mac_` prefix from a component-call ident so we can look it up against the components-by-name table. Returns the ident unchanged
+-- Strip the `mac_` prefix from a component-call ident so we can look it up against the components-by-name table. 
--- if it doesn't start with the prefix (so a non-component ident like `mask_upper` falls through to the wc-table branch).
+-- Returns the ident unchanged if it doesn't start with the prefix 
+-- (so a non-component ident like `mask_upper` falls through to the wc-table branch).
 -- @param ident string|nil
 -- @return string|nil
 local function strip_mac_prefix(ident)
@@ -475,11 +472,9 @@ end
 
 --- Compute word counts for every component in `components` in a single pass.
 --- The name-lookup table + memoization cache are built ONCE (per source) instead of per-component,
---- so the cache survives across siblings and a component's recursive `mac_Y(...)` references hit memoized values
+--- so the cache survives across siblings and a component's recursive `mac_Y(...)` 
---- instead of re-walking the body. Previously each call rebuilt both tables (O(N) tables per call → O(N^2)).
+--- references hit memoized values instead of re-walking the body.
----
 --- Cycle detection (A -> B -> A) is preserved via the in-progress `-1` sentinel in `cache`.
----
 --- @param components Component[]
 --- @param wc table<string, integer>
 --- @return table<string, integer>  -- map of component name (without `mac_`) -> word count
@@ -610,8 +605,8 @@ local function header_boilerplate(src)
 		"// Component atoms (MipsAtomComp_(ac_*)) -> macro variants (mac_*)",
 		"",
 		-- Self-contained: define WORD_COUNT if not already defined.
-		-- We use the same definition here so the auto-generated entries below expand to compile-time constants whether
+		-- We use the same definition here so the auto-generated entries below expand 
-		-- the metadata file is included first or not.
+		-- to compile-time constants whether the metadata file is included first or not.
 		"#ifndef WORD_COUNT",
 		"#define WORD_COUNT(name, count)  enum { words_##name = (count) };",
 		"#endif",
@@ -632,11 +627,9 @@ local function compute_macs_h_path(src)
 	return out_dir, out_path
 end
 
---- Emit a per-source `.macs.h` header with the `mac_X` macros + `WORD_COUNT` entries. Writes in BINARY mode so LF line endings are
+--- Emit a per-source `.macs.h` header with the `mac_X` macros + `WORD_COUNT` entries. 
---- preserved (the git blob is LF; Windows text-mode would emit CRLF and break the byte-identical diff).
+--- Writes in BINARY mode so LF line endings are preserved (the git blob is LF; Windows text-mode would emit CRLF and break the byte-identical diff).
----
 --- Honors `ctx.dry_run`: prints the intended path but does not write the file.
----
 --- @param ctx PassCtx
 --- @param src SourceFile
 --- @param components Component[]
@@ -644,7 +637,6 @@ end
 --- @return string|nil  -- path to the written file (nil if no components)
 local function emit_component_macros_h(ctx, src, components, counts)
 	if #components == 0 then return nil end
-
 	local out_dir, out_path = compute_macs_h_path(src)
 	local lines             = header_boilerplate(src)
 
@@ -655,7 +647,6 @@ local function emit_component_macros_h(ctx, src, components, counts)
 	end
 
 	local content = table.concat(lines, "\n") .. "\n"
-
 	if ctx.dry_run then
 		print(string.format("  -> %s (dry-run)", out_path))
 		return out_path
@@ -671,8 +662,7 @@ end
 -- Pass entry
 -- ════════════════════════════════════════════════════════════════════════════
 
--- (internal) Extend `ctx.shared.word_counts` with this source's component macros
+-- (internal) Extend `ctx.shared.word_counts` with this source's component macros so offsets sees them without re-reading the file.
--- so offsets sees them without re-reading the file.
 -- @param ctx PassCtx
 -- @param components Component[]
 -- @param counts table<string, integer>  -- precomputed word counts (from count_all_components)
@@ -683,6 +673,33 @@ local function update_shared_word_counts(ctx, components, counts)
 	end
 end
 
+--- @class ComponentDef
+--- @field name    string  -- bare name (without ac_/mac_ prefix)
+--- @field line    integer -- definition source line (line of `MipsAtomComp_(ac_X)` / `MipsAtomComp_Proc_(ac_X, ...)`)
+--- @field path    string  -- absolute source path of the definition
+--- @field kind    string  -- "comp_bare" | "comp_proc"
+
+--- (internal) Extend `ctx.shared.components` with this source's components-by-name map so downstream passes
+--- (atoms_source_map, dwarf_injection) can resolve `mac_X(...)` invocations back to their component definition file:line.
+--- provenance emission uses this to attribute each emitted `.word` to either a component macro or the enclosing atom body.
+-- @param ctx PassCtx
+-- @param src SourceFile
+-- @param components Component[]
+local function update_shared_components(ctx, src, components)
+	ctx.shared.components         = ctx.shared.components or {}
+	local rel_path = src.path:gsub("\\", "/")
+	for _, c in ipairs(components) do
+		-- Keyed by bare name (e.g. `yield`, `load_tri_indices`). 
+		-- The atoms_source_map pass strips the `mac_` prefix from the call site identifier before lookup.
+		ctx.shared.components[c.name] = {
+			name = c.name,
+			line = c.line,
+			path = rel_path,
+			kind = c.kind or "comp_bare",
+		}
+	end
+end
+
 --- @param ctx PassCtx
 --- @return PassResult
 function M.run(ctx)
@@ -690,6 +707,11 @@ function M.run(ctx)
 	local errors   = {}
 	local warnings = {}
 
+	-- Initialize shared component map.
+	-- The atoms_source_map and dwarf_injection passes consume `ctx.shared.components` to resolve `mac_X(...)` 
+	-- invocations back to the component's definition file:line.
+	ctx.shared.components = ctx.shared.components or {}
+
 	for _, src in ipairs(ctx.sources) do
 		-- project_components reads from src.scan + does backward lookups on src.text
 		local components = project_components(src.text, src.scan)
@@ -700,6 +722,9 @@ function M.run(ctx)
 			if macs_path then
 				outputs[#outputs + 1] = { macs_h = macs_path }
 				update_shared_word_counts(ctx, components, counts)
+				-- share component definitions with downstream passes.
+				-- `mac_X(...)` invocations in atom bodies resolve back to (path, line) via this map.
+				update_shared_components(ctx, src, components)
 			end
 		end
 	end

scripts/passes/offsets.lua

@@ -132,6 +132,14 @@ local function record_offset_marker(branches, args, at_pos)
 	end
 end
 
+-- MARKER_TO_HANDLER — data-driven marker dispatch (the plex pattern).
+-- Maps the marker ident to its recorder function. Each handler takes (out_table, args, at_pos).
+-- Adding a new marker type = 1 row + 1 recorder function.
+local MARKER_TO_HANDLER = {
+	[LABEL_MARKER]  = record_label_marker,
+	[OFFSET_MARKER] = record_offset_marker,
+}
+
 --- Scan a single token for atom_label/atom_offset markers, walking through balanced groups transparently (so nested calls are found).
 --- @param token string
 --- @param at_pos integer    -- the branch-free word position of this token in the body
@@ -146,13 +154,13 @@ local function scan_for_atom_markers(token, at_pos, labels, branches)
 		local ch = token:sub(pos, pos)
 		if duffle.is_alpha(ch) then
 			local ident, after = duffle.read_ident(token, pos)
-			if ident == LABEL_MARKER then
+			local handler = MARKER_TO_HANDLER[ident]
+			if handler then
 				local args, after_paren = extract_ident_args(token, after)
-				record_label_marker(labels, args, at_pos)
+				-- Marker found — dispatch to its recorder. markers share labels and branches as
-				pos = after_paren or after
+				-- out-tables; the recorder picks which one(s) to write to based on its semantics.
-			elseif ident == OFFSET_MARKER then
+				-- (record_label_marker writes to labels; record_offset_marker writes to branches.)
-				local args, after_paren = extract_ident_args(token, after)
+				handler(ident == LABEL_MARKER and labels or branches, args, at_pos)
-				record_offset_marker(branches, args, at_pos)
 				pos = after_paren or after
 			else
 				pos = after
@@ -223,8 +231,7 @@ end
 -- Offset computation + header generation
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Compute branch offsets as `target_word - branch_word - 1`
+-- Compute branch offsets as `target_word - branch_word - 1` (the standard MIPS branch-immediate encoding).
--- (the standard MIPS branch-immediate encoding).
 -- @param labels table<string, integer>
 -- @param branches table[]
 -- @return BranchOffset[]

scripts/passes/report.lua

@@ -16,7 +16,7 @@
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Resolve `arg[0]` to an absolute-ish script directory so that `require("duffle")` resolves against `scripts/` regardless of CWD.
--- Note: this boilerplate is duplicated in 6 other entry scripts; a Phase-6 extraction target (`duffle.setup_package_path()`).
+-- Note: this boilerplate is duplicated in 6 other entry scripts; extraction target (`duffle.setup_package_path()`).
 -- Bootstrap: see `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
 -- Uses `debug.getinfo` to find this file's own directory, so it works
@@ -261,6 +261,28 @@ local function render_module_warnings_section(add, results, total_warnings)
 	add("")
 end
 
+-- ════════════════════════════════════════════════════════════════════════════
+-- SECTION_RENDERERS — data-driven section dispatch (the plex pattern)
+-- ════════════════════════════════════════════════════════════════════════════
+--
+-- Each entry maps a section to its (header, render_fn). The render_fn signature:
+--   render_fn(add, results, totals)
+--     add    -- the `add(line)` closure from the surrounding report renderer
+--     results -- AnnotationResult[] (per-source results)
+--     totals -- {atoms, annots, binds, macros, errors, warnings} counts
+--
+-- Sections that need to render "(none)" vs iterate use totals.errors / totals.warnings;
+-- other sections ignore the totals arg.
+-- Adding a new section = 1 row here + 1 render_<thing>_section function.
+local SECTION_RENDERERS = {
+	{ header = SECTION_HEADER_ATOMS,    render = render_module_atoms_section     },
+	{ header = SECTION_HEADER_ANNOTS,   render = render_module_annots_section    },
+	{ header = SECTION_HEADER_BINDS,    render = render_module_binds_section     },
+	{ header = SECTION_HEADER_MACROS,   render = render_module_macros_section    },
+	{ header = SECTION_HEADER_ERRORS,   render = function(add, results, totals) return render_module_errors_section(add, results, totals.errors)   end },
+	{ header = SECTION_HEADER_WARNINGS, render = function(add, results, totals) return render_module_warnings_section(add, results, totals.warnings) end },
+}
+
 --- Render the per-MODULE annotation report (one `<dir_basename>.annotations.txt`).
 --- @param dir string                  -- module directory path
 --- @param sources SourceFile[]        -- sources in this module
@@ -282,12 +304,22 @@ local function render_module_report(dir, sources, results)
 		total_atoms, total_annots, total_binds, total_macros))
 	add("")
 
-	render_module_atoms_section(add, results)
+	-- Bundle the totals so the section renderers don't need separate parameter lists.
-	render_module_annots_section(add, results)
+	-- Errors/warnings sections need their total count to decide "(none)" vs iterate.
-	render_module_binds_section(add, results)
+	-- Sections without totals (atoms/annots/binds/macros) ignore this arg.
-	render_module_macros_section(add, results)
+	local totals = {
-	render_module_errors_section(add, results, total_errors)
+		atoms    = total_atoms,  annots = total_annots,  binds  = total_binds,
-	render_module_warnings_section(add, results, total_warnings)
+		macros   = total_macros, errors = total_errors,  warnings = total_warnings,
+	}
+
+	-- THE per-section dispatch. ONE loop over SECTION_RENDERERS.
+	-- Each renderer writes its header + content via the `add` closure (pre-bound above).
+	-- Adding a new section = 1 row here + 1 render_<thing>_section function.
+	for _, section in ipairs(SECTION_RENDERERS) do
+		add(section.header)
+		section.render(add, results, totals)
+		add("")
+	end
 
 	return table.concat(lines, "\n") .. "\n"
 end
@@ -347,7 +379,8 @@ end
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- (internal) Pull per-source validate() results from the annotation pass's stash.
--- The annotation pass runs first in the dep chain and caches results in `ctx.flags._annot_source_results`; we read from there instead of re-validating each source.
+-- The annotation pass runs first in the dep chain and caches results in `ctx.flags._annot_source_results`;
+-- we read from there instead of re-validating each source.
 -- Returns the list of module results + the flat list of all results (for the project-wide summary).
 -- @param ctx PassCtx
 -- @param dir_sources SourceFile[]

scripts/passes/static_analysis.lua

@@ -1,6 +1,7 @@
 --- passes/static_analysis.lua — Per-atom static-analysis checks.
 ---
---- The 5 checks currently shipped:
+--- The 9 checks currently shipped:
+---   Per-atom rules:
 ---     1. **GTE pipeline-fill** — every `gte_cmdw_*` invocation must be preceded by the minimum number of `nop` words
 ---        (per `duffle.GTE_PIPELINE_LATENCY`) so the COP2 pipeline latency is fully retired before the command issues.
 ---     2. **mac_yield uniformity** — every atom body must contain exactly one `mac_yield()` call (control transfer pattern).
@@ -8,13 +9,20 @@
 ---     4. **GPU port-store shape** — per-shape (`f3`/`f4`/`g4`/etc.) the sum of `mac_format_X_color` + `mac_gte_store_X_*` +
 ---        `mac_insert_ot_tag_X` words must equal the GP0 cmd's expected packet size.
 ---     5. **per-atom cycle budget** — sum each atom body's instruction latencies (per `duffle.INSTRUCTION_LATENCY`); report total.
+---   Per-source rules (registry-driven, added 2026-07-16):
+---     6. **enum_alias_membership** — every `R_X` referenced from `atom_dbg_reg_default`, `atom_reg_types`,
+---        `atom_rtype(...)`, `atom_reads`, or `atom_writes` must be in `scan.register_alias_registry`. Missing -> warning.
+---     7. **atom_rtype_consistency** — every `reg_type_overrides[R_X].type_name` must resolve in `scan.type_name_registry`. Missing -> error.
+---     8. **binds_no_substruct_deref** — every `load_word(R_A, R_B, O_(Type, Field))` and `store_word(...)` in every atom body
+---        must reference a leaf scalar (pointer-to-struct counts as leaf; nested struct members do NOT). Missing -> warning (build continues).
+---     9. **reads_writes_alias_membership** — distinct check name duplicating #6's reads/writes coverage so the report can
+---        attribute failures to a precedence class. Missing -> warning (build continues).
 ---
---- The orchestrator (`ps1_meta.lua`) wires this module in via the
+--- The orchestrator (`ps1_meta.lua`) wires this module in via the PASSES table:
---- PASSES table:
 ---   `["static-analysis"] = { module = "passes.static_analysis", kind = "validation", deps = {"word-counts", "components"},
 ---     out = { { kind = "report", path_template = "<out_root>/<basename>.static_analysis.txt" } } }`
 ---
---- **Conventions**: tabs (1/level), EmmyLua annotations, no regex, Lua 5.3 compatible. See `lua.md` in the ps1-ai styleguides.
+--- **Conventions**: tabs (1/level), EmmyLua annotations, no regex, Lua 5.3 compatible.
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Module-scope requires + package.path setup
@@ -114,25 +122,6 @@ local OUTPUT_EXTENSION = ".static_analysis.txt"
 --- @field findings   Finding[] -- findings for this atom
 --- @field total_cycles integer -- sum of token cycle costs
 
--- ════════════════════════════════════════════════════════════════════════════
--- Source scanning — delegated to duffle.scan_source (ps1_meta.lua pre-scans)
--- ════════════════════════════════════════════════════════════════════════════
---
--- The orchestrator calls duffle.scan_source once per source and stashes the fat SourceScan in src.scan.
--- validate() below reads from src.scan — no source walking in this pass.
-
--- ════════════════════════════════════════════════════════════════════════════
--- Body tokenizer (top-level comma splitter + per-token classification)
--- ════════════════════════════════════════════════════════════════════════════
-
---- Build a map: `body_relative_char_offset` -> `body_relative_line`.
---- Used by the checks to convert per-token offsets in the body to lina numbers relative to the start of `body`. 
---- The atom's source-line of the body-start is added by the caller.
----
--- NOTE: `tokenize_body` and `build_body_line_index` moved to `duffle.lua` as shared
--- memoized utilities (`duffle.tokenize_body`, `duffle.build_body_line_index`).
--- The local copies were deleted; all callers now use the duffle versions.
-
 -- ════════════════════════════════════════════════════════════════════════════
 -- classify_tokens — per-token classification (the plex's pre-computed data layer)
 -- ════════════════════════════════════════════════════════════════════════════
@@ -166,6 +155,20 @@ local OUTPUT_EXTENSION = ".static_analysis.txt"
 --- @field branch_label       string|false|nil -- for branch_*(..., atom_offset(F, label))
 --- @field is_load_word       boolean
 --- @field is_store_word      boolean
+--- @field mac_format_shape   string|nil      -- "f3" / "g4" etc. for mac_format_X_color; nil otherwise
+--- @field is_gte_store       boolean         -- ident matches `mac_gte_store_<shape>`
+--- @field is_ot_tag          boolean         -- ident matches `mac_insert_ot_tag_<shape>`
+--- @field writes_r_prim_cursor boolean       -- store_word targeting R_PrimCursor
+--- @field reads_r_tape_ptr   boolean         -- any token referencing R_TapePtr
+--- @field o_arg1             string|nil      -- first arg of O_(<a>, <b>) captures; nil for non-O_ tokens
+--- @field o_arg2             string|nil      -- second arg of O_(<a>, <b>) captures
+--- @field s_arg1             string|nil      -- arg of S_(<a>) captures; nil for non-S_ tokens
+
+-- Patterns for O_(<arg1>, <arg2>) and S_(<arg>) captures.
+-- UNANCHORED, the substring can appea anywhere in the token (e.g., `load_word(R_T0, R_TapePtr, O_(Binds_X, field))` matches at position ~24).
+-- The binds_name match is deferred to check_abi_handoff (which compares tc.o_arg1 == atom.info.binds).
+local O_PATTERN = "O_%(([%w_]+),%s*([%w_]+)%s*%)"
+local S_PATTERN = "S_%(([%w_]+)%s*%)"
 
 local function classify_tokens(tokens)
 	local n       = #tokens
@@ -186,6 +189,16 @@ local function classify_tokens(tokens)
 		local is_load_word  = ident == "load_word"
 		local is_store_word = ident == "store_word"
 
+		-- Per-check pre-computes (R3 lift).
+		-- Each pre-compute eliminates one per-token regex/string-find call from check_abi_handoff / check_gpu_portstore_shape.
+		local mac_format_shape     = nil
+		local is_gte_store         = false
+		local is_ot_tag            = false
+		local writes_r_prim_cursor = false
+		local reads_r_tape_ptr     = false
+		local o_arg1, o_arg2       = nil, nil
+		local s_arg1               = nil
+
 		if ident == "atom_label" then
 			is_atom_label = true
 			label_name    = tok:match("^atom_label%s*%(%s*([%w_]+)%s*%)")
@@ -194,6 +207,21 @@ local function classify_tokens(tokens)
 			branch_label = tok:match("atom_offset%s*%([^,]+,%s*([%w_]+)%s*%)") or false
 		end
 
+		-- mac_format_X_color / mac_gte_store_<shape> / mac_insert_ot_tag_<shape> (used by check_gpu_portstore_shape).
+		local shape = ident:match("^mac_format_([%w_]+)_color$")
+		if shape then mac_format_shape = shape end
+		if ident:match("^mac_gte_store_[%w_]+$")  then is_gte_store = true end
+		if ident:match("^mac_insert_ot_tag_[%w_]+$") then is_ot_tag    = true end
+
+		-- O_(<arg1>, <arg2>) / S_(<arg>) captures (used by check_abi_handoff).
+		-- Cheap pattern match — anchored, fails fast on non-matching tokens.
+		o_arg1, o_arg2 = tok:match(O_PATTERN)
+		if not o_arg1 then s_arg1 = tok:match(S_PATTERN) end
+
+		-- R_TapePtr + R_PrimCursor references (used by check_abi_handoff / check_gpu_portstore_shape).
+		if tok:find("R_TapePtr", 1, true) then reads_r_tape_ptr = true end
+		if is_store_word and tok:find("R_PrimCursor", 1, true) then writes_r_prim_cursor = true end
+
 		tc[tok_idx] = {
 			ident                = ident,
 			nop_words            = nop_words,
@@ -205,12 +233,18 @@ local function classify_tokens(tokens)
 			branch_label         = branch_label,
 			is_load_word         = is_load_word,
 			is_store_word        = is_store_word,
+			mac_format_shape     = mac_format_shape,
+			is_gte_store         = is_gte_store,
+			is_ot_tag            = is_ot_tag,
+			writes_r_prim_cursor = writes_r_prim_cursor,
+			reads_r_tape_ptr     = reads_r_tape_ptr,
+			o_arg1               = o_arg1,
+			o_arg2               = o_arg2,
+			s_arg1               = s_arg1,
 		}
 		-- Advance the nop run for the NEXT token.
-		if nop_words > 0 then
+		if nop_words > 0 then nop_run = nop_run + nop_words
-			nop_run = nop_run + nop_words
+		else                  nop_run = 0
-		else
-			nop_run = 0
 		end
 	end
 	return tc
@@ -406,17 +440,18 @@ local function check_abi_handoff(atom, pipe_ctx, findings)
 	local tc             = atom.paths.tok_class
 	local found_field_set = {}
 	local found_advance   = false
-	local bind_re         = "O_%(" .. binds_name .. ",%s*([%w_]+)%s*%)"
+
-	for tok_idx, t in ipairs(tokens) do
+	-- Reads from tc_entry fields pre-computed by classify_tokens (R3 lift). 
-		local tok = t.tok
+	-- Eliminates 3 per-token string-find/match calls (R_TapePtr + O_(binds_name,...) + bind_re) → 3 O(1) field reads.
-		if tc[tok_idx].is_load_word then
+	for tok_idx = 1, #tokens do
-			if tok:find("R_TapePtr", 1, true) and tok:find("O_(" .. binds_name .. ",", 1, true) then
+		local tc_entry = tc[tok_idx]
-				local field = tok:match(bind_re)
 		-- scan: load_word(R_*, R_TapePtr, O_(<Binds_X>, <field>))
+		if tc_entry.is_load_word and tc_entry.reads_r_tape_ptr and tc_entry.o_arg1 == binds_name then
+			local field = tc_entry.o_arg2
 			if field then
 				found_field_set[field] = true
 			else
-					local body_line = atom.line + line_in_body[t.rel]
+				local body_line = atom.line + line_in_body[tokens[tok_idx].rel]
 				findings[#findings + 1] = {
 					atom  = atom.name, line = body_line,
 					check = "abi_handoff", kind = "error",
@@ -425,10 +460,8 @@ local function check_abi_handoff(atom, pipe_ctx, findings)
 				}
 			end
 		end
-		end
-		if tok:find("R_TapePtr", 1, true)
-		   and tok:find("S_(" .. binds_name .. ")", 1, true) then
 		-- scan: add_ui_self(R_TapePtr, S_(<Binds_X>))
+		if tc_entry.reads_r_tape_ptr and tc_entry.s_arg1 == binds_name then
 			found_advance = true
 		end
 	end
@@ -449,7 +482,7 @@ local function check_abi_handoff(atom, pipe_ctx, findings)
 			atom  = atom.name, line = atom.line,
 			check = "abi_handoff", kind = "error",
 			msg   = string.format("%s at line %d binds %s but never advances R_TapePtr by S_(%s) (= %d bytes / %d words)",
-				atom.name, atom.line, binds_name, binds_name, binds.bytes, binds.bytes / 4),
+				atom.name, atom.line, binds_name, binds_name, binds.bytes, binds.bytes / 0x04),
 		}
 	end
 end
@@ -468,7 +501,6 @@ end
 ---   - Atoms containing a `mac_<name>(...)` call whose name is not in duffle.GP0_MACRO_CONTRIB emit a "new macro; update duffle.GP0_MACRO_CONTRIB" advisory.
 ---
 --- Applies only to `kind = "atom"` (baked atoms). Components don't emit full primitives.
---- Stage 2: signature uniformized to `(atom, pipe_ctx, findings)` — pipe_ctx is ignored here.
 local function check_gpu_portstore_shape(atom, pipe_ctx, findings)
 	if atom.kind ~= "atom" then return end
 	local tokens = atom.paths.tokens
@@ -479,31 +511,30 @@ local function check_gpu_portstore_shape(atom, pipe_ctx, findings)
 	local contrib = 0
 	local saw_format = false
 	local saw_prim_write = false
-	for tok_idx, t in ipairs(tokens) do
+
-		local tok = t.tok
+	-- Reads from tc_entry fields pre-computed by classify_tokens (R3 lift).
-		local ident = tc[tok_idx].ident
+	-- Eliminates 4 per-token string matches (mac_format_X_color + mac_gte_store_<shape> + mac_insert_ot_tag_<shape> + R_PrimCursor)
-		-- Match `mac_format_<shape>_color(...)` and strip `_color`
+	for tok_idx = 1, #tokens do
-		-- to get the bare shape suffix (f3 / g4 / etc).
+		local tc_entry = tc[tok_idx]
-		local shape = ident:match("^mac_format_([%w_]+)_color$")
+		local shape    = tc_entry.mac_format_shape
 		if shape and duffle.GP0_CMD_BY_SHAPE[shape] then
 			if not cmd_byte then
 				cmd_byte = duffle.GP0_CMD_BY_SHAPE[shape]
-				cmd_line = atom.line + line_in_body[t.rel]
+				cmd_line = atom.line + line_in_body[tokens[tok_idx].rel]
 			end
 			saw_format = true
-			local contrib_key = "mac_format_" .. shape .. "_color"
+			local n = duffle.GP0_MACRO_CONTRIB["mac_format_" .. shape .. "_color"]
-			local n = duffle.GP0_MACRO_CONTRIB[contrib_key]
 			if    n then contrib = contrib + n end
 		end
-		if ident:match("^mac_gte_store_[%w_]+$") then
+		if tc_entry.is_gte_store then
-			local n = duffle.GP0_MACRO_CONTRIB[ident]
+			local n = duffle.GP0_MACRO_CONTRIB[tc_entry.ident]
 			if    n then contrib = contrib + n end
 		end
-		if ident:match("^mac_insert_ot_tag_[%w_]+$") then
+		if tc_entry.is_ot_tag then
-			local n = duffle.GP0_MACRO_CONTRIB[ident]
+			local n = duffle.GP0_MACRO_CONTRIB[tc_entry.ident]
 			if    n then contrib = contrib + n end
 		end
-		if tc[tok_idx].is_store_word and tok:find("R_PrimCursor", 1, true) then
+		if tc_entry.writes_r_prim_cursor then
 			saw_prim_write = true
 		end
 	end
@@ -536,10 +567,6 @@ end
 -- Check #5: per-atom cycle budget (uses analyze_atom_paths's unknown_macros)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- NOTE: `token_cycles`, `find_atom_labels`, `find_branch_targets` were removed
--- when `classify_tokens` (the pre-computed per-token classification) replaced them.
--- The classification lives on `atom.paths.tok_class`; analyze_atom_paths reads it.
-
 --- Walk all paths through an atom body and return per-path cycle sums.
 --- Builds a tiny CFG: each token has a "next" pointer; branches have two (fall-through + taken).
 --- The BD-slot nop after a branch is absorbed into the branch's cost (MIPS-accurate: BD slot always runs), 
@@ -586,14 +613,10 @@ local function analyze_atom_paths(atom)
 	end
 
 	-- A token is a terminator if it's `mac_yield`.
-	local function is_terminator(tok_idx)
+	local function is_terminator(tok_idx) return tc[tok_idx].is_yield end
-		return tc[tok_idx].is_yield
-	end
 
 	-- A token is a "branch" if the classification says so.
-	local function is_branch(tok_idx)
+	local function is_branch(tok_idx) return tc[tok_idx].is_branch end
-		return tc[tok_idx].is_branch
-	end
 	local function successors(tok_idx)
 		local tok = tokens[tok_idx].tok
 		if is_terminator(tok_idx) then
@@ -614,13 +637,11 @@ local function analyze_atom_paths(atom)
 				end
 			end
 			-- For literal-offset branches (label == false), the taken path would jump to a non-tracked address; conservatively omit.
-			-- Return (succ, nil) -- the second value is the terminator marker (nil = not a terminator).
+			-- Return (succ, nil), the second value is the terminator marker (nil = not a terminator).
 			return succ, nil
 		end
 		-- Normal token: just the next one
-		if tok_idx + 1 <= n then
+		if tok_idx + 1 <= n then return { tok_idx + 1 }, nil end
-			return { tok_idx + 1 }, nil
-		end
 		return {}, nil
 	end
 
@@ -701,14 +722,9 @@ end
 
 --- Per-source check that emits one finding per unknown macro seen
 --- (deduplicated across atoms so the warning section doesn't get spammed with N copies of "macro X not in duffle.INSTRUCTION_LATENCY").
---- Reuses `analyze_atom_paths`'s per-atom unknown_macros discovery (it's the canonical place that walks tokens
+--- Per-atom: emit one finding per unknown macro seen, deduplicated across atoms 
---- and computes per-token cycle costs). We just sort + emit.
+--- (so the warning section doesn't get spammed with N copies of "macro X not in duffle.INSTRUCTION_LATENCY").
---- Per-atom: emit one finding per unknown macro seen, deduplicated across atoms (so the warning
+--- Reuses `analyze_atom_paths`'s per-atom unknown_macros discovery (it's the canonical place that walks tokens and computes per-token cycle costs).
---- section doesn't get spammed with N copies of "macro X not in duffle.INSTRUCTION_LATENCY").
---- Reuses `analyze_atom_paths`'s per-atom unknown_macros discovery (it's the canonical place that walks tokens
---- and computes per-token cycle costs). We just sort + emit.
---- Signature changed in Stage 1B: `(atom, pipe_ctx, findings)` — the `unknown_seen` dedup table lives on
---- `pipe_ctx` so it persists across the per-atom loop in validate().
 local function check_per_atom_cycle_budget(atom, pipe_ctx, findings)
 	local p = atom.paths or {}
 	for _, name in ipairs(p.unknown_macros or {}) do
@@ -725,13 +741,261 @@ local function check_per_atom_cycle_budget(atom, pipe_ctx, findings)
 	end
 end
 
+-- ════════════════════════════════════════════════════════════════════════════
+-- Check #6: enum_alias_membership (Track A Task 13)
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Every R_X referenced from a debug-visible surface — atom_dbg_reg_default, atom_reg_types, atom_rtype sub-entries, atom_reads, atom_writes;
+-- MUST be present in `pipe_ctx.register_alias_registry`.
+-- The registry is the source-derived answer to "is this R_X a real, opt-in alias?"
+-- (populated by scan_source's `parse_enum_aliases` from `enum { R_X = N atom_reg }` declarations).
+-- Per-source rule (called once per source via the CHECK_RULES dispatch).
+-- Signature matches the per_source shape established by check_semantic_reg_defaults.
+--
+-- Severity: WARNING (build continues).
+-- The rule is intentionally permissive because the production `code/duffle/` and `code/gte_hello/`
+-- sources use R_* aliases in atom_reads / atom_writes that may not yet be opted in via the 
+-- bare `atom_reg` marker. R_TapePtr / R_AtomJmp / R_PrimCursor / R_FaceCursor / R_VertBase / R_OtBase ARE opted in (lottes_tape.h Task 21).
+-- Raw C-ABI aliases like R_T0..R_T3 are intentionally NOT auto-included (per the prototype principle:
+-- no auto-include of wave-context; explicit opt-in only). Warnings keep the build green
+-- and surface the migration gap so users see which atoms still need opt-in registration.
+local function check_enum_alias_membership(_src, pipe_ctx, findings)
+	local reg_registry = pipe_ctx.register_alias_registry or {}
+
+	-- (a) atom_dbg_reg_default(R_X, T) -- pipe_ctx.types.
+	--     source_line is on every entry; emit the diagnostic against the default declaration's own line so the report's
+	--     "Findings by atom" section can attribute the failure to the marker location.
+	for reg, def in pairs(pipe_ctx.types or {}) do
+		if not reg_registry[reg] then
+			findings[#findings + 1] = {
+				atom  = "", line = def.source_line or 0,
+				check = "enum_alias_membership", kind = "warning",
+				msg   = string.format(
+					"atom_dbg_reg_default at line %d references unknown register %q (not in register_alias_registry)",
+					def.source_line or 0, reg),
+			}
+		end
+	end
+
+	-- (b) atom_reg_types(R_X, T) + (c) atom_rtype(R_X, T) sub-entries both populate `ai.reg_type_overrides` (Track A Task 5 merge).
+	--     (d) atom_reads(R_X) + (e) atom_writes(R_X) populate the reads/writes arrays.
+	--     All four are checked against the same registry; the per-rule dispatch iterates `ai` once and covers all three locations
+	--     so we don't re-walk atom_infos for each sub-check.
+	for _, ai in ipairs(pipe_ctx.atom_infos_list or {}) do
+		local info_line = ai.info_line or 0
+		local atom_name = ai.atom_name or ""
+		if ai.reg_type_overrides then
+			for reg in pairs(ai.reg_type_overrides) do
+				if not reg_registry[reg] then
+					findings[#findings + 1] = {
+						atom  = atom_name, line = info_line,
+						check = "enum_alias_membership", kind = "warning",
+						msg   = string.format(
+							"atom '%s' at line %d has reg_type_overrides for %q; the alias is not in register_alias_registry",
+							atom_name, info_line, reg),
+					}
+				end
+			end
+		end
+		for _, reg in ipairs(ai.reads or {}) do
+			if not reg_registry[reg] then
+				findings[#findings + 1] = {
+					atom  = atom_name, line = info_line,
+					check = "enum_alias_membership", kind = "warning",
+					msg   = string.format(
+						"atom '%s' at line %d has atom_reads for %q; the alias is not in register_alias_registry",
+						atom_name, info_line, reg),
+				}
+			end
+		end
+		for _, reg in ipairs(ai.writes or {}) do
+			if not reg_registry[reg] then
+				findings[#findings + 1] = {
+					atom  = atom_name, line = info_line,
+					check = "enum_alias_membership", kind = "warning",
+					msg   = string.format(
+						"atom '%s' at line %d has atom_writes for %q; the alias is not in register_alias_registry",
+						atom_name, info_line, reg),
+				}
+			end
+		end
+	end
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Check #7: atom_type_consistency (Track A Task 13; legacy alias atom_rtype_consistency)
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- Every `reg_type_overrides[R_X].type_name` (populated by BOTH `atom_reg_types(R_X, <type>)`
+-- and `atom_type(R_X, <type>)` sub-entries inside atom_reads/atom_writes — legacy `atom_rtype` is
+-- accepted as a transparent alias) MUST resolve to a `type_name_registry` entry.
+-- The registry is the source-derived answer to "is this type name declared in this translation unit?"
+-- (populated by `typedef Struct_(...)`, `typedef Enum_(...)`, `typedef ... TSet_(...)` declarations).
+-- Missing type names are errors (the build stops) so the user adds the typedef before re-running.
+-- Per-source rule.
+local function check_atom_rtype_consistency(_src, pipe_ctx, findings)
+	local type_registry = pipe_ctx.type_name_registry or {}
+	for _, ai in ipairs(pipe_ctx.atom_infos_list or {}) do
+		local info_line = ai.info_line or 0
+		local atom_name = ai.atom_name or ""
+		if ai.reg_type_overrides then
+			for reg, ov in pairs(ai.reg_type_overrides) do
+				if not ov.type_name or not type_registry[ov.type_name] then
+					findings[#findings + 1] = {
+						atom  = atom_name, line = info_line,
+						check = "atom_rtype_consistency", kind = "error",
+						msg   = string.format(
+							"atom '%s' at line %d reg_type_overrides[%q] uses unknown type %q (not in type_name_registry)",
+							atom_name, info_line, reg, tostring(ov.type_name)),
+					}
+				end
+			end
+		end
+	end
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Check #8: binds_no_substruct_deref (Track A Task 13)
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- For every `load_word(R_A, R_B, O_(<Type>, <Field>))` and matching `store_word(...)` call in every atom body,
+-- the `<Field>` MUST resolve to a leaf scalar of `<Type>`. A "leaf scalar" is:
+--   * a non-struct field with `pointer_depth >= 1` (pointer-to-struct IS a leaf — the field is a pointer; the pointee is unrelated), OR
+--   * a non-struct field whose type_name resolves to a typedef / enum / builtin in `type_name_registry`.
+-- A nested struct member (pointer_depth == 0 AND type_name resolves to a `kind = "struct"` registry entry) is NOT a leaf scalar and is flagged.
+-- The check also flags fields whose Type has no `fields` table (typedefs and enums don't have fields — any Field reference against them is bogus)
+-- and fields whose name doesn't appear in the resolved Type's fields array.
+--
+-- Walks every atom's pre-computed `paths.tok_class`
+-- (set by `classify_tokens` once per atom in validate()) and uses the `o_arg1` / `o_arg2` captures instead of re-matching the token string.
+-- Resolution consults `pipe_ctx.type_name_registry`
+-- (Binds_* structs are registered there by scan_source's `register_struct_type`, so a unified lookup works for both Binds_* and non-Binds structs).
+--
+-- Severity: warning (build continues) — this catches a category of bugs
+-- (passing a struct by value through the tape payload) where the symptom is runtime corruption, not a compile error.
+-- Look up a field by name in a type's `fields` array. Returns the matching field entry, or nil if not found.
+-- Extracted to keep check_binds_no_substruct_deref's nesting depth <= 5 (the project convention; this is the 5th nesting level:
+-- function -> for-atom -> for-token -> if-load/store -> if-type-resolves -> [helper]).
+local function find_field_by_name(type_entry, field_name)
+	for _, f in ipairs(type_entry.fields or {}) do
+		if f.name == field_name then return f end
+	end
+	return nil
+end
+
+-- True iff a (field, type_registry) pair is a leaf scalar (safe to dereference as a tape-payload field).
+-- Pointer-to-X is always leaf; non-pointer struct members are NOT leaf.
+local function is_field_leaf(field, type_registry)
+	if field.pointer_depth and field.pointer_depth > 0 then
+		return true
+	end
+	local ftype_entry = type_registry[field.type_name]
+	if ftype_entry and ftype_entry.kind == "struct" then
+		return false
+	end
+	return true
+end
+
+local function check_binds_no_substruct_deref(_src, pipe_ctx, findings)
+	local type_registry = pipe_ctx.type_name_registry or {}
+	for _, a in ipairs(pipe_ctx.atoms or {}) do
+		local tc           = a.paths and a.paths.tok_class or {}
+		local tokens       = a.paths and a.paths.tokens or {}
+		local line_in_body = a.paths and a.paths.line_in_body or {}
+		for ti = 1, #tokens do
+			local tc_entry = tc[ti]
+			if (tc_entry.is_load_word or tc_entry.is_store_word)
+				and tc_entry.o_arg1 and tc_entry.o_arg2 then
+				local type_name  = tc_entry.o_arg1
+				local field_name = tc_entry.o_arg2
+				local body_line  = a.line + (line_in_body[tokens[ti].rel] or 0)
+
+				local type_entry = type_registry[type_name]
+				if not type_entry or not type_entry.fields then
+					findings[#findings + 1] = {
+						atom  = a.name, line = body_line,
+						check = "binds_no_substruct_deref", kind = "warning",
+						msg   = string.format(
+							"atom '%s' at line %d O_(%s, %s) refers to type %q which has no fields table in type_name_registry",
+							a.name, body_line, type_name, field_name, type_name),
+					}
+				else
+					local field = find_field_by_name(type_entry, field_name)
+					if not field then
+						findings[#findings + 1] = {
+							atom  = a.name, line = body_line,
+							check = "binds_no_substruct_deref", kind = "warning",
+							msg   = string.format(
+								"atom '%s' at line %d O_(%s, %s) does not resolve to a field of %s",
+								a.name, body_line, type_name, field_name, type_name),
+						}
+					elseif not is_field_leaf(field, type_registry) then
+						findings[#findings + 1] = {
+							atom  = a.name, line = body_line,
+							check = "binds_no_substruct_deref", kind = "warning",
+							msg   = string.format(
+								"atom '%s' at line %d O_(%s, %s) dereferences a non-pointer struct field of type %q; nested struct members are forbidden",
+								a.name, body_line, type_name, field_name, field.type_name),
+						}
+					end
+				end
+			end
+		end
+	end
+end
+
+-- ════════════════════════════════════════════════════════════════════════════
+-- Check #9: reads_writes_alias_membership (Track A Task 13)
+-- ════════════════════════════════════════════════════════════════════════════
+
+-- For every `atom_reads(R_X)` and `atom_writes(R_X)` entry in every `atom_infos` entry, the `R_X` MUST be present in `pipe_ctx.register_alias_registry`.
+-- This DUPLICATES `enum_alias_membership`'s coverage of the reads/writes arrays;
+-- the distinct check name is intentional so the report can attribute the failure to a precedence-class (warnings vs errors) — the production reads/writes
+-- paths are intentionally permissive at the warning level even when the registry-driven check is strict at the error level.
+-- Per-source rule. Severity: warning (build continues).
+local function check_reads_writes_alias_membership(_src, pipe_ctx, findings)
+	local reg_registry = pipe_ctx.register_alias_registry or {}
+	for _, ai in ipairs(pipe_ctx.atom_infos_list or {}) do
+		local info_line = ai.info_line or 0
+		local atom_name = ai.atom_name or ""
+		for _, reg in ipairs(ai.reads or {}) do
+			if not reg_registry[reg] then
+				findings[#findings + 1] = {
+					atom  = atom_name, line = info_line,
+					check = "reads_writes_alias_membership", kind = "warning",
+					msg   = string.format(
+						"atom '%s' at line %d atom_reads for %q; the alias is not in register_alias_registry",
+						atom_name, info_line, reg),
+				}
+			end
+		end
+		for _, reg in ipairs(ai.writes or {}) do
+			if not reg_registry[reg] then
+				findings[#findings + 1] = {
+					atom  = atom_name, line = info_line,
+					check = "reads_writes_alias_membership", kind = "warning",
+					msg   = string.format(
+						"atom '%s' at line %d atom_writes for %q; the alias is not in register_alias_registry",
+						atom_name, info_line, reg),
+				}
+			end
+		end
+	end
+end
+
 -- ════════════════════════════════════════════════════════════════════════════
 -- CHECK_RULES — data-driven check dispatch (Muratori: data over control flow)
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Each rule is a table entry: { name, per_atom }.
+-- Each rule is a table entry: { name, <dispatch> }.
--- `per_atom(atom, pipe_ctx, findings)` runs once per atom inside validate()'s single loop.
+-- Dispatch shapes:
--- Adding a new check = 1 row here + 1 check_* function. No validate() edit required.
+--   per_atom(atom, pipe_ctx, findings)          — runs once per atom inside validate()'s single loop
+--   post(pipe_ctx, findings)                    — runs once after all per-atom calls complete
+--   per_macro(macro, wc, findings)              — runs once per TAPE_WORDS / _Pragma macro declaration
+--   per_skip_marker(marker, pipe_ctx, findings) — runs once per src.scan.skip_over.markers entry
+--   per_source(src, pipe_ctx, findings)         — runs once per source AFTER the per-atom loop completes
+--                                                 (added for the registry-driven rule set; same CHECK_RULES table — no parallel dispatch)
+-- Adding a new check = 1 row here + 1 check_* function. validate() is updated only to invoke the per_source dispatch loop (the per_atom dispatch loop never changes).
 -- This is the plex pattern: the iteration is in ONE place (validate), the variation is in DATA (this table).
 
 local CHECK_RULES = {
@@ -740,6 +1004,10 @@ local CHECK_RULES = {
 	{ name = "abi_handoff",                  per_atom   = check_abi_handoff                  },
 	{ name = "gpu_portstore_shape",          per_atom   = check_gpu_portstore_shape          },
 	{ name = "per_atom_cycle_budget",        per_atom   = check_per_atom_cycle_budget        },
+	{ name = "enum_alias_membership",        per_source = check_enum_alias_membership        },
+	{ name = "atom_rtype_consistency",       per_source = check_atom_rtype_consistency       },
+	{ name = "binds_no_substruct_deref",     per_source = check_binds_no_substruct_deref     },
+	{ name = "reads_writes_alias_membership",per_source = check_reads_writes_alias_membership},
 }
 
 -- ════════════════════════════════════════════════════════════════════════════
@@ -761,11 +1029,17 @@ local function validate(ctx, src)
 	end
 
 	-- pipe_ctx: the cross-atom shared state for the per-atom pipeline (Fleury "expose structure").
-	-- Pre-allocated here, mutated by each per-atom check call below. Replaces the per-check
+	-- Pre-allocated here, mutated by each per-atom check call below.
-	-- local tables that used to live inside each check_* function body.
+	-- Replaces the per-check local tables that used to live inside each check_* function body.
 	--   info_by_atom             — atom_name -> atom_info (built once; check_abi_handoff reads it)
 	--   binds_index              — Binds_X -> binds struct (built once; check_abi_handoff reads it)
 	--   unknown_seen             — macro_name -> first atom line (accumulated across atoms; check_per_atom_cycle_budget dedups)
+	--   atoms                    — full atom list (used by check_binds_no_substruct_deref's per-source body walk)
+	--   types                    — R_X -> default-type info from atom_dbg_reg_default (check_enum_alias_membership source a)
+	--   atom_infos_list          — flat list of atom_info entries (checks #6/#7/#9 iterate it)
+	--   register_alias_registry  — R_X -> {name, code, has_atom_reg, source_line} from parse_enum_aliases
+	--   type_name_registry       — T -> {name, kind, fields, ...} from parse_typedef_binds
+	-- All registry fields are READ from src.scan (the dep-closed scan-source payload); this pass never re-parses.
 	local info_by_atom = {}
 	for _, info in ipairs(atom_infos) do
 		info_by_atom[info.atom_name] = info
@@ -774,6 +1048,11 @@ local function validate(ctx, src)
 		info_by_atom            = info_by_atom,
 		binds_index             = binds_index,
 		unknown_seen            = {},
+		atoms                   = atoms,
+		types                   = scan.types or {},
+		atom_infos_list         = atom_infos or {},
+		register_alias_registry = scan.register_alias_registry or {},
+		type_name_registry      = scan.type_name_registry or {},
 	}
 
 	-- THE per-atom pipeline. ONE iteration of atoms; the 5 check_* functions + analyze_atom_paths
@@ -781,6 +1060,7 @@ local function validate(ctx, src)
 	-- Plex move: every piece of state derived from an atom body lives on `atom.paths` (the per-atom mega-struct);
 	-- readers (analyze_atom_paths, the 5 checks, the renderers) all consume `atom.paths`, not the raw `atoms` list.
 	-- Stage 1B: each check_* now takes `(atom, ...)` instead of `(atoms, findings)` — no more single-atom `{a}` shim.
+	-- Per-source rules run once after this loop completes (no parallel dispatch table).
 	local findings = {}
 	for _, a in ipairs(atoms) do
 		a.paths                  = a.paths or {}
@@ -791,13 +1071,20 @@ local function validate(ctx, src)
 		-- analyze_atom_paths fills the *cycles / branches / has_loops / unknown_macros* fields of a.paths.
 		analyze_atom_paths(a)
 
-		-- Run all checks on this one atom via the CHECK_RULES data table (Muratori: data over control flow).
+		-- Run all per-atom checks on this one atom via the CHECK_RULES data table (Muratori: data over control flow).
 		-- Adding a new check = 1 row in CHECK_RULES; this loop never needs editing.
 		for _, rule in ipairs(CHECK_RULES) do
-			rule.per_atom(a, pipe_ctx, findings)
+			if rule.per_atom then rule.per_atom(a, pipe_ctx, findings) end
 		end
 	end
 
+	-- Per-source dispatch. Run once per source AFTER the per-atom loop;
+	-- consults pipe_ctx's cross-atom registries (register_alias_registry, type_name_registry).
+	-- Same CHECK_RULES table; no parallel dispatch table.
+	for _, rule in ipairs(CHECK_RULES) do
+		if rule.per_source then rule.per_source(src, pipe_ctx, findings) end
+	end
+
 	local errors   = {}
 	local warnings = {}
 	local info     = {}
@@ -1045,9 +1332,9 @@ function M.run(ctx)
 	local errors   = {}
 	local warnings = {}
 
-	-- Aggregate per-DIRECTORY (per-module). One static_analysis.txt per source-directory, emitted only if the directory contains at least one atom. 
+	-- Aggregate per-DIRECTORY (per-module).
+	-- One static_analysis.txt per source-directory, emitted only if the directory contains at least one atom. 
 	-- Empty-source directories (e.g. duffle headers with no atoms) produce no report.
-	--
 	-- Group sources by `src.dir`. The first component of `dir` is the module name (e.g. "code/duffle" -> "duffle", "code/gte_hello" -> "gte_hello").
 	-- Output path is `<out_root>/<module_basename>.static_analysis.txt`.
 	local by_dir = ctx.by_dir or duffle.group_sources_by_dir(ctx.sources)

scripts/passes/word_count_eval.lua

@@ -15,7 +15,7 @@
 -- ════════════════════════════════════════════════════════════════════════════
 
 -- Resolve `arg[0]` to an absolute-ish script directory so that `require("duffle")` resolves against `scripts/` regardless of CWD.
--- Note: this boilerplate is duplicated in 6 other entry scripts; a Phase-6 extraction target (`duffle.setup_package_path()`).
+-- Note: this boilerplate is duplicated in 6 other entry scripts; extraction target (`duffle.setup_package_path()`).
 -- Bootstrap: see `ps1_meta.lua` for the rationale.
 -- Bootstrap: load `scripts/duffle_paths.lua` (sets package.path + package.cpath).
 -- Uses `debug.getinfo` to find this file's own directory, so it works both standalone and when require'd from the orchestrator.
@@ -28,17 +28,13 @@ local duffle        = dofile(_bootstrap_dir .. "../duffle_paths.lua")
 -- Constants
 -- ════════════════════════════════════════════════════════════════════════════
 
--- Windows separator chars — used to convert `dir` output (which uses `\`) into POSIX paths (which our scripts expect).
+-- Windows separator char — used by `fname:match` to recognize `.macs.h` files.
 local PATH_SEP_BACKSLASH = "\\"
-local PATH_SEP_FORWARD   = "/"
 
--- Fallback glob command (subprocess). Used when `lfs` (LuaFileSystem) is not available.
+-- Required native extension: lfs (LuaFileSystem). Built by `update_deps.ps1` to
--- Scoped to `code\` to avoid walking `.git/`, `toolchain/`, `build/`, etc.
+-- `toolchain/lfs/lfs.dll` and wired into package.cpath by `scripts/duffle_paths.lua`.
-local DIR_GLOB_CMD = 'dir /b /s "%s\\code\\%s" 2>nul'
+-- If lfs is missing, `require` throws — fail loud per the build-tool convention.
-
+local lfs = require("lfs")
--- Try to load lfs (LuaFileSystem). If available, scan_dir uses native directory enumeration (~2ms)
--- instead of spawning `dir /b /s` as a subprocess (~56ms). Built by update_deps.ps1 into toolchain/lfs/lfs.dll.
-local lfs = pcall(require, "lfs") and require("lfs") or nil
 
 -- ════════════════════════════════════════════════════════════════════════════
 -- Type declarations
@@ -84,7 +80,6 @@ local M = {}
 --- For most tokens (regular MIPS instructions) this returns 1.
 --- For `mac_X(...)` calls, this returns the resolved word count from `wc` (recursively if needed). For `nop2` etc., returns wc[name].
 --- For unknown macros, returns 1 and (optionally) warns.
----
 --- @param token string        -- a single token from split_top_level_commas
 --- @param wc WordCounts       -- the shared word-count table
 --- @return integer
@@ -105,28 +100,13 @@ end
 -- │ Shared utility: scan_dir                                           │
 -- └────────────────────────────────────────────────────────────────────┘
 
---- Recursively scan a directory for files matching a glob suffix.
---- No regex per the no_regex constraint — uses plain byte matching via `dir /b /s` on Windows.
----
---- The `.macs.h` files produced by the components pass always live at `<project_root>/<module>/gen/`.
---- We can shortcut the `dir /b /s` walk by listing modules first (one `dir /b /ad`), then walking each `<module>/gen/`
---- (one `dir /b` per module, no recursion). 
---- For projects with 2 modules and 0 .macs.h files, this drops the cost from ~52ms 
---- (full recursive walk of the entire project tree) to ~5ms.
----
---- @param dir string        -- directory to scan (absolute or relative)
---- @param suffix string     -- file pattern, e.g. "*.macs.h"
---- @return string[]
 -- Cache the scan_dir result per (dir, suffix) in package.loaded.
--- Each `io.popen` call on Windows is ~50-100ms of subprocess overhead, so caching the result saves a fixed cost on every build.
 -- The cache persists for the lifetime of the Lua process (cleared when ps1_meta.lua exits).
 -- If a build removes/creates .macs.h files mid-process, the caller can invalidate by calling `M._invalidate_scan_cache()`.
 local SCAN_CACHE_KEY = "__word_count_eval_scan_cache__"
 
 --- Scan `code/` for files matching `suffix` (e.g. `*.macs.h`).
---- Uses `lfs` (LuaFileSystem) when available — native directory enumeration at ~2ms.
+--- Native directory enumeration via lfs (~2ms). Zero subprocess spawns.
---- Falls back to `dir /b /s` subprocess (~56ms) when `lfs` is not compiled.
----
 --- @param dir string        -- project root directory
 --- @param suffix string     -- file pattern, e.g. "*.macs.h"
 --- @return string[]
@@ -137,9 +117,6 @@ function M.scan_dir(dir, suffix)
 	if    cache and cache[key] then return cache[key] end
 
 	local results = {}
-
-	if lfs then
-		-- Native walk: list code/<module>/gen/ for matching files. Zero subprocess spawns.
 	local code_dir = dir .. "/code"
 	if lfs.attributes(code_dir, "mode") == "directory" then
 		for mod_name in lfs.dir(code_dir) do
@@ -155,16 +132,6 @@ function M.scan_dir(dir, suffix)
 			end
 		end
 	end
-	else
-		-- Fallback: single `dir /b /s` subprocess scoped to code\.
-		local pipe = io.popen(DIR_GLOB_CMD:format(dir, suffix))
-		if pipe then
-			for raw_line in pipe:lines() do
-				results[#results + 1] = raw_line:gsub(PATH_SEP_BACKSLASH, PATH_SEP_FORWARD)
-			end
-			pipe:close()
-		end
-	end
 
 	-- Cache the result (including empty results).
 	cache      = cache or {}
@@ -183,7 +150,6 @@ function M._invalidate_scan_cache() package.loaded[SCAN_CACHE_KEY] = nil end
 
 --- Load metadata.h + scan for existing *.macs.h files into ctx.shared.word_counts.
 --- Loading the .macs.h files is idempotent: entries from later (current-build) .macs.h files override metadata.h entries of the same name.
----
 --- @param ctx PassCtx
 --- @return PassResult
 function M.run(ctx)

scripts/pcsx_debug_helper/autoexec.lua

@@ -0,0 +1,51 @@
+-- autoexec.lua - pcsx_debug_helper plugin entry point.
+-- Packaged in scripts/pcsx_debug_helper.zip. Loaded by pcsx-redux via the -archive CLI flag (see scripts/launch_pcsx_debug.ps1).
+--
+-- Registers two web handlers for external CLI tools:
+--   /api/v1/lua/gte - full GTE state (32 data + 32 control regs + PC)
+--   /api/v1/lua/gp  - GP state summary (screenshot endpoint + VRAM endpoint refs)
+--
+-- The GTE handler reads COP2 regs via PCSX.getRegisters().CP2D/CP2C.
+-- The pcsx-redux gdb stub doesn't expose COP2, so this is the only way for external tools to see GTE state.
+--
+-- The GP handler is a thin pointer: 
+-- pcsx-redux's Lua API exposes only PCSX.GPU.takeScreenShot() (no GPUSTAT, no GP0/GP1 command log, no display state). For richer GP state, the existing web endpoints are the practical path:
+--   /api/v1/state/still      - PNG screenshot
+--   /api/v1/gpu/vram/raw     - VRAM raw bytes (1MB)
+--
+-- Companion: scripts/gdb/gdb_tape_atoms.gdb (covers GPRs + atom-aware stepping).
+
+local function register_handlers()
+    if not PCSX.WebServer then PCSX.WebServer = {} end
+    if not PCSX.WebServer.Handlers then PCSX.WebServer.Handlers = {} end
+
+    -- ── GTE state ──
+    PCSX.WebServer.Handlers.gte = function(req)
+        local r = PCSX.getRegisters()
+        local out = { "pc=0x" .. string.format("%x", r.pc) }
+        for i = 0, 31 do
+            out[#out + 1] = string.format("D[%d]=0x%08x C[%d]=0x%08x",
+                i, r.CP2D.r[i], i, r.CP2C.r[i])
+        end
+        return table.concat(out, "\n")
+    end
+
+		-- ── GP state (pointer to existing endpoints) ──
+		-- pcsx-redux's Lua GPU API exposes only takeScreenShot(); no GPUSTAT / GP0 / GP1 command log / display state.
+		-- We point to the existing web endpoints that DO expose those (when the emulator is actually rendering. Paused-at-BP frames won't have a fresh frame).
+    PCSX.WebServer.Handlers.gp = function(req)
+        local out = {
+            "gpu_screenshot_png=http://localhost:8080/api/v1/state/still",
+            "vram_raw=http://localhost:8080/api/v1/gpu/vram/raw (1MB VRAM)",
+            "gpustat=NOT_AVAILABLE_VIA_LUA",
+            "gp_command_log=NOT_AVAILABLE_VIA_LUA (use pcsx-redux Debug > GPU Logger)",
+            "hint_run_emulator_unpaused_for_screenshot",
+        }
+        return table.concat(out, "\n")
+    end
+end
+
+local ok, err = pcall(register_handlers)
+if ok then print("[pcsx_debug_helper] handlers registered: gte, gp")
+else       print("[pcsx_debug_helper] registration failed: " .. tostring(err))
+end

scripts/ps1_meta.lua

@@ -1,8 +1,6 @@
---- ps1_meta.lua — Orchestrator entry point for the tape-atom metaprogram pipeline.
+--- ps1_meta.lua — Orchestrator entry point for the tape-atom metaprogram.
 ---
---- Dispatches to pass modules under `scripts/passes/`, resolving
+--- Dispatches to pass modules under `scripts/passes/`, resolving dependencies topologically (Kahn's algorithm + cycle detection).
---- dependencies topologically (Kahn's algorithm + cycle detection).
---- Single CLI surface (`--<pass>` flags + auto-dep expansion + --dry-run).
 ---
 --- **Architecture**:
 ---   - **PASSES table** — declarative dep graph (data, not code).
@@ -10,7 +8,7 @@
 ---   - **parse_args** → **build_ctx** (just opens + reads source files; no inline scanning) → **topo_sort** → **dispatch_passes**.
 ---   - The first pass in the dep graph is `scan-source` (see `passes/scan_source.lua`).
 ---     It calls `duffle.scan_source` once per source to produce the fat `SourceScan` payload, which is attached to each `src.scan`. 
----     Every other pass that reads source structure depends on `scan-source` and consumes `src.scan` as a read-only payload. 
+---     Every other pass that reads source structure depends on `scan-source` and consumes `src.scan` as a read-only. 
 ---
 --- **Conventions**: tabs (1/level), EmmyLua annotations, no regex,
 --- Lua 5.3 compatible.
@@ -148,6 +146,32 @@ local PASSES = {
 		desc   = "[FUTURE] GTE pipeline-fill, mac_yield uniformity, etc.",
 		out    = { { kind = "report", path_template = "<out_root>/<basename>.static_analysis.txt" } },
 	},
+	["atoms-source-map"] = {
+		module = "passes.atoms_source_map",
+		kind   = "header-output",
+		deps   = {"word-counts", "components"},
+		desc   = "Emit gen/<basename>.atoms.sourcemap.txt (per-.word C source line map for gdb debugging) AND gen/<basename>.atoms.provenance.txt (per-.word provenance; each word tagged with its call-site file:line and, when emitted by a mac_X(...) component invocation, the component's definition file:line). Consumed by passes/dwarf_injection.lua to synthesize DW_TAG_inlined_subroutine instances for source-level Step Into on component invocations.",
+		out    = {
+			{ kind = "report", path_template = "<out_root>/<basename>.atoms.sourcemap.txt"   },
+			{ kind = "report", path_template = "<out_root>/<basename>.atoms.provenance.txt" },
+		},
+	},
+	["dwarf-injection"] = {
+		module = "passes.dwarf_injection",
+		kind   = "shared",
+		deps   = {"scan-source", "atoms-source-map"},
+		desc   = "Inject per-atom .debug_line + .debug_aranges (F') + per-atom .debug_info subprogram + per-wave-context-reg .debug_info variables (G') into the ELF (post-link; writes 7 section .bin blobs plus one deterministic .gdbinit sidecar). (rbind composite) reads ctx.sources[i].scan to find atom_bind(Binds_X) atoms + their Binds_X struct fields; emits per-Binds_X DW_TAG_structure_type DIEs + per-rbind-atom DW_TAG_variable 'bind_args' DIEs with piece-chain DW_OP_bregN/DW_OP_piece location expressions.",
+		out    = {
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_line.bin"     },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_aranges.bin"  },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_rnglists.bin" },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_abbrev.bin"   },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_info.bin"     },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_str.bin"      },
+			{ kind = "report", path_template = "<out_root>/<basename>.dwarf_loc.bin"      },
+			{ kind = "report", path_template = "<out_root>/<basename>.gdbinit"            },
+		},
+	},
 	report = {
 		module = "passes.report",
 		kind   = "report",
@@ -172,14 +196,23 @@ local PASS_FLAG_TO_NAME = {
 	["--validate"]          = "annotation",
 	["--offsets"]           = "offsets",
 	["--static-analysis"]   = "static-analysis",
+	["--atoms-source-map"]  = "atoms-source-map",
+	["--dwarf-injection"]   = "dwarf-injection",
 	["--report"]            = "report",
 	["--scan-source"]       = "scan-source",
 	["--all"]               = ALL_PASSES_SENTINEL,
 }
 
 local ALL_PASS_NAMES = {
-	"scan-source", "word-counts", "components", "annotation",
+	"scan-source",
-	"offsets", "static-analysis", "report",
+	"word-counts",
+	"components",
+	"annotation",
+	"offsets",
+	"static-analysis",
+	"atoms-source-map",
+	"dwarf-injection",
+	"report",
 }
 
 --- Append every pass name to args.requested_set. Used by --all and by the "default to --all if no pass flags were given" fallback.
@@ -191,8 +224,8 @@ local function request_all_passes(args)
 end
 
 -- Per-flag handlers. Each handler takes (args, argv, arg_idx) and returns the new arg_idx (so multi-arg flags like --source FILE advance it). 
--- Returning nil + os.exit() handles termination flags (--help). This replaces the 8-way `if/elseif/elseif...` chain that nested 4 levels deep 
+-- Returning nil + os.exit() handles termination flags (--help). 
--- and made the dispatch logic hard to scan.
+-- This replaces the 8-way `if/elseif/elseif...` chain that nested 4 levels deep  and made the dispatch logic hard to scan.
 local FLAG_HANDLERS = {}
 
 -- ════════════════════════════════════════════════════════════════════════════
@@ -212,6 +245,8 @@ PASS_FLAGS (pick one or more, or use --all):
   --components          Generate <module>/gen/<basename>.macs.h
   --validate            Run atom annotation DSL validation
   --offsets             Generate <module>/gen/<basename>.offsets.h
+  --atoms-source-map    Generate <basename>.atoms.sourcemap.txt per source
+  --dwarf-injection     Inject per-atom .debug_line + .debug_aranges (post-link, requires --elf)
   --static-analysis     [FUTURE] GTE pipeline-fill, mac_yield uniformity
   --report              Render per-project summary
   --all                 Equivalent to all 6 flags above (default)
@@ -221,6 +256,9 @@ COMMON_FLAGS:
   --metadata PATH       Path to metadata.h (required)
   --out-root DIR        Output root for reports (default: build/gen)
   --project-root DIR    Project root for .macs.h scan (default: dirname(metadata))
+  --gdb-runtime         Also emit <out_root>/gdb_tape_atoms_runtime.gdb (post-link, requires --elf)
+  --dwarf-injection     Opt in to DWARF injection (writes <basename>.dwarf_*.bin blobs for objcopy splice; requires --elf)
+  --elf PATH            Path to linked .elf (for --gdb-runtime / --dwarf-injection)
   --dry-run             Print dep order + ASCII graph; exit 0 without running
   --verbose             Print per-pass debug output
   --help                Show this help and exit
@@ -253,7 +291,21 @@ FLAG_HANDLERS["--metadata"]     = function(args, argv, arg_idx) args.metadata
 FLAG_HANDLERS["--out-root"]     = function(args, argv, arg_idx) args.out_root                   = argv[arg_idx + 1]; return arg_idx + 1 end
 FLAG_HANDLERS["--project-root"] = function(args, argv, arg_idx) args.project_root               = argv[arg_idx + 1]; return arg_idx + 1 end
 
--- Pass-flag handler. Reads the closed-set table, expands --all, appends to requested_set. Single-statement, no nesting.
+-- Per-pass stash flags. Read by `passes/atoms_source_map.lua` to opt into the post-link gdb-runtime emission.
+-- Same shape as the existing per-flag handlers:
+-- mutates `args.flags` (which propagates into `ctx.flags`).
+FLAG_HANDLERS["--gdb-runtime"]  = function(args) args.flags                       = args.flags or {}; args.flags.gdb_runtime = true end
+FLAG_HANDLERS["--elf"]          = function(args, argv, arg_idx) args.flags       = args.flags or {}; args.flags.elf_path  = argv[arg_idx + 1]; return arg_idx + 1 end
+-- F' track: enable DWARF injection (default OFF; opt-in via .vscode/launch.json or ps1_meta CLI).
+FLAG_HANDLERS["--dwarf-injection"] = function(args)
+	args.flags = args.flags or {}
+	args.flags.dwarf_injection = true
+	args.requested_set[#args.requested_set + 1] = "dwarf-injection"
+end
+
+-- G' (atom locals) is now consolidated into --dwarf-injection; no separate flag.
+
+-- Pass-flag handler. Reads the closed-set table, expands --all, appends to requested_set.
 FLAG_HANDLERS[PASS_FLAG_DISPATCH_KEY] = function(args, a)
 	local name = PASS_FLAG_TO_NAME[a]
 	if name == ALL_PASSES_SENTINEL then
@@ -264,7 +316,6 @@ FLAG_HANDLERS[PASS_FLAG_DISPATCH_KEY] = function(args, a)
 end
 
 --- Parse argv into a structured table. Validates against a closed enum.
----
 --- @param argv string[]
 --- @return ParsedArgs
 local function parse_args(argv)
@@ -324,7 +375,6 @@ end
 
 --- Build the PassCtx from parsed args. Reads each source file once at startup;
 --- passes consume `src.text`, not the path (path is preserved for error reporting).
----
 --- @param args ParsedArgs
 --- @return PassCtx
 local function build_ctx(args)
@@ -344,9 +394,8 @@ local function build_ctx(args)
 			dir = dir:sub(1, -2)
 		end
 
-		-- src.scan is populated by the "scan-source" pass (the first pass in the
+		-- src.scan is populated by the "scan-source" pass (the first pass in the dep graph).
-		-- dep graph). build_ctx just opens + reads the files; the scan itself
+		-- build_ctx just opens + reads the files; the scan itself happens in the pass module, not inline in the orchestrator.
-		-- happens in the pass module, not inline in the orchestrator.
 		sources[#sources + 1] = {
 			path     = path,
 			text     = text,
@@ -368,7 +417,7 @@ local function build_ctx(args)
 		upstream      = {},
 		out_root      = args.out_root,
 		project_root  = args.project_root,
-		flags         = {},
+		flags         = args.flags or {},
 		dry_run       = args.dry_run,
 		verbose       = args.verbose,
 	}
@@ -379,7 +428,6 @@ end
 -- ════════════════════════════════════════════════════════════════════════════
 
 --- Compute the dep-closure of `requested_set`: include every pass name transitively required by the requested set.
----
 --- @param passes table<string, PassDescriptor>
 --- @param requested_set string[]
 --- @return table<string, boolean>  -- set of pass names needed (including transitive deps)
@@ -415,7 +463,6 @@ local function count_entries(t)
 end
 
 --- Compute in-degrees for the Kahn sort: for each pass in `needed`, the number of its deps that are also in `needed`.
----
 --- @param passes table<string, PassDescriptor>
 --- @param needed table<string, boolean>
 --- @return table<string, integer>
@@ -433,8 +480,7 @@ local function compute_in_degrees(passes, needed)
 end
 
 --- Seed the Kahn ready queue with passes whose in-degree is 0, sorted alphabetically for deterministic execution order.
----
+-- @param in_degree table<string, integer>
---- @param in_degree table<string, integer>
 --- @return string[]
 local function seed_ready_queue(in_degree)
 	local ready = {}
@@ -472,7 +518,6 @@ end
 
 --- Topologically sort the requested pass set, augmented with all transitive deps.
 --- Detects cycles and errors out with details.
----
 --- @param passes table<string, PassDescriptor>
 --- @param requested_set string[]
 --- @return string[]  -- execution order
@@ -486,9 +531,9 @@ local function topo_sort(passes, requested_set)
 		process_next_ready(passes, needed, in_degree, ready, order)
 	end
 
-	-- Cycle detection: if order doesn't include all needed passes, some are stuck with in_degree > 0 (the cycle closed on itself
+	-- Cycle detection: if order doesn't include all needed passes, some are stuck with in_degree > 0
-	-- before Kahn could process them). Without this check, a fully-closed cycle (e.g. A -> B -> A) would silently return an emspty order list, 
+	-- (the cycle closed on itself before Kahn could process them).
-	-- leaving the orchestrator to dispatch nothing.
+	-- Without this check, a fully-closed cycle (e.g. A -> B -> A) would silently return an emspty order list, leaving the orchestrator to dispatch nothing.
 	if #order ~= count_entries(needed) then
 		for name, deg in pairs(in_degree) do
 			if deg > 0 then
@@ -506,7 +551,6 @@ end
 
 --- Render the dep graph as ASCII art. Output width capped at 78 columns.
 --- Falls back to the simpler "Resolved dependency order" list only if graph width exceeds terminal width.
----
 --- @param passes table<string, PassDescriptor>
 --- @param requested string[]  -- originally-requested passes (subset of closed)
 --- @param closed string[]     -- dep-closed execution order
@@ -526,8 +570,7 @@ local function render_dep_graph(passes, requested, closed)
 	add("")
 
 	-- Data-driven ASCII graph built from the actual PASSES table.
-	-- Shows the source -> scan_source -> pass chain. Each pass is
+	-- Shows the source -> scan_source -> pass chain. Each pass is shown once; edges are "feeds into" arrows based on deps.
-	-- shown once; edges are "feeds into" arrows based on deps.
 	add("[ps1_meta] Pass graph (read top-to-bottom; edges = 'feeds into'):")
 	add("")
 
@@ -565,7 +608,7 @@ local function render_dep_graph(passes, requested, closed)
 	add("   |<base>.macs.h |   |<base>.errors |   |<base>.offsets|   |<base>.static  |")
 	add("   |   (header)   |   |  .h          |   |  .h          |   |  _analysis    |")
 	add("   +------+-------+   |  +annot.txt  |   |  (header)    |   |  .txt         |")
-	add("          |           +------+-------+   +--------------+   +------+--------+")
+	add("          |           +--+-----------+   +--------------+   +------+--------+")
 	add("          v              v                                         v")
 	add("   +------+----------------+  +------+-------+                     |")
 	add("   |offsets|static-analysis|  |report|       |<--------------------+")
@@ -612,7 +655,6 @@ local function report_validation_errors(pass_name, pass, result)
 end
 
 -- (internal) Run each pass in `order` in topological sequence.
---
 -- @param ctx PassCtx
 -- @param order string[]
 -- @return boolean  -- true if any validation errors were reported