Recovery execution — 2026-09-10

Final build update: OLE owner fix f1b91444 resolves the intermediate handler-checker failure described below. Clean committed main 90503599 now passes the full canonical/compatibility build at 1,160,121 / 1,160,589 bytes, layout 9c6027bce1d500a1; the 24 native x87 isolation checks and 11 pipeline differential cases pass. The full test suite was not run. Broad recovery remains isolated pending newer-main reconciliation and coordinated handling of active overlapping edits.

User authorized active-owner checks, review, benchmarks, and integration of useful recovered work. No deployment or cleanup of old worktrees is included.

Ownership decisions

Process presence alone does not prove a specific task is active; session quotations of old board messages were excluded as ownership evidence. The ownership snapshot is time-specific, not a permanent abandonment label.

Review integration

b703d8b6 reconciles the 24-commit review branch with main ff5badf6; 4a1771b4 additionally incorporates main through 10b0f53e. Original branch and worktree are preserved.

Integration decisions, beyond removing conflict markers:

• Preserve main's one browser build identity and automatic test discovery; add the five new page dependencies and two Worker dependencies to those mechanisms.
• Preserve D3D render waits/tokens alongside Help pending work. Native Help interrupts only eligible runnable/object-wait/message-idle contexts, not render yield 16.
• Preserve main's guest wait clock (_waitNow) separately from elapsed-time budget measurement.
• Preserve positional fs_read_file_at alongside the atomic pending-preserving read bridge.
• Preserve memory-font record states while requiring full-path equality for file-backed face cache hits.
• Actual browser validation found main's pure decoder-configuration exports were sealing font startup before load_pe. a155afe8 admits those two non-executing setters while preserving monotonic sealing; real-Worker tests cover NEW and already-SEALED states.
• Use main's shared guest_strdup rather than restoring a removed private clone.
• Adapt the newly added ImageList file-loading consumer to retained A/W identity, lazy retries, and unchanged 32-byte public call frames. Added actual-thunk zero-cache A/W success/failure coverage.
• Update the symbolic region owner after the run implementation split and regenerate maps/signatures; retain the measured combined silent-handler inventory.

Independent review found no additional blocking semantic gap in host/thread scheduling, Worker replies, or file/memory font identity. This is a bounded review, not proof that all compatibility paths are covered.

Validation ledger

Initial reconciled canonical/compatibility build passed at 1,158,848 / 1,159,316 bytes, layout e88d62e3294c01bf. Combined runtime/screensaver candidate 40193154 subsequently passed at 1,174,169 / 1,174,637 bytes, layout 5ce9dee2c36e697e, with 1,085 discovered tests and all build gates passing. This does not mean the full 1,085-test suite was executed.

Focused passing checks include:

• Actual x87 opcode isolation across two shared-memory instances, save/restore, and raw integers beyond double precision.
• Real Node Worker queue/heap stress; shared-ring reset before publishing recycled thread IDs.
• Full-path TrueType collision regression; existing direct glyph-index and memory-font behavior.
• Worker/CLI/browser font startup barriers, catalog publication/exclusions, malformed/whiteout overlays, and retained remote leases.
• Native deadline polling and callback context save/restore; object waits, Win16 Help macros, cancellation and lazy DLL/data paths.
• CRT, LZ, MMIO and LoadImage lazy reads, including zero/tiny caches and failure/retry semantics.
• Sparse writes, immutable read leases, overlay lifecycle, range publication, and cache-budget accounting.
• Real Chrome OPFS: concurrent stores preserve 26 files across reloads; pinned exact-commit snapshots survive cross-tab overwrite/delete/scope removal and release their leases.
• Save-bundle/sync: 112 checks pass after granting the test's required local-server permission.

Invalid intermediate runs were not treated as product failures: tests launched while a generated merge conflict remained could not load that map. A first full guest-worker browser run was also invalidated by fixture HTTP 403 responses: the shared static server correctly rejects symlinks outside its root. Required corpus assets were then copied into the isolated tree without weakening server policy. The replaced symlinks were retained under /private/tmp/wa-recovery-asset-links-5hcvsm; the shared checkout was not modified. The next run exposed the genuine decoder-configuration/startup-gate conflict described above, which was fixed rather than explained away as fixture trouble.

Measurements and limits

Machine load was initially above 50 and stayed above the repository's threshold of 4 during benchmark runs. Browser functional tests were headless. No current-main speedup, interactive FPS improvement, or peak-RSS reduction is claimed. The x87 fusion and other runtime performance experiments are not accepted on these numbers. The SMAC harness was corrected to share the traversal/symlink-safe static server, clean up failed Chrome launches, reject malformed reports, select the actual cooperative executing instance, and suppress speedup on mismatched pixels. Its later frame skip still prevents treating it as a deterministic oracle; its branch is retained, not merged here.

September 11 follow-up

After the startup fix, the full browser Worker run passed Notepad and Calculator, including font/catalog readiness, late-publication rejection, and window parity. Rodent reached its initial window/slice gate but timed out waiting for its green board; the run did not reach the later Winamp/COM checks. This is an unresolved acceptance failure, not a passing full matrix.

The bounded post-layout Rodent probe also timed out, but its screenshot and guest log identify a missing fixture dependency: "Cannot find 'weputil.dll'. Please install Entertainment Pack again." Evidence: /private/tmp/wa-rodent-recovery-failure-1.png. This run cannot establish a renderer/layout regression or validate a layout fix. A complete selected WEP package is being materialized for one bounded retry; server path policy remains unchanged.

With all 49 WEP2 package files materialized and verified byte-identical to the source corpus, the retry passes: 8 windows, 16,576 green pixels, 221 changed pixels under held-arrow input, 19,596 Worker slices, no missing imports/problems, all five stock fonts ready and catalog generation 1. Browser/server cleanup completed normally. The missing DLL was a fixture blocker. The final full Chrome Worker matrix passes, exit 0: Notepad/Calculator Worker/cooperative parity, both Rodents' rendering and held-arrow gameplay, Winamp's three actual Workers/live playback, and COM DLL success plus failed-fetch recovery. Browser/server cleanup completed normally. These are functional checks, not throughput/FPS claims.

Review then found the screensaver allocation had been inserted before existing canonical regions. Commit bf35c96b moves it to the end of the declaration list. Every pre-screensaver region retains its prior base; canonical/compatibility builds pass at 1,174,169 / 1,174,637 bytes, layout c13c64dbeb5ad950. Native x87 isolation and real-Worker ownership stress pass again. A focused real-browser Rodent probe is pending; preserving the layout alone does not prove the failure resolved.

The broad candidate is based on main through 10b0f53e, not all subsequent main changes. Main has active, uncommitted edits overlapping host, browser, filesystem, and test-runner integration. No overlapping edits have been stashed, replaced, or committed by this recovery. A separately validated, three-file x87 correctness recovery is being prepared against newer main so it can land without disturbing those owners.

Remaining work

Atomic bitmap-font replacement and same-path content generations/live selected handles remain open even after integrating the review candidate. D3D breadth, completed multiplayer matches, and broader OLE compatibility retain their separate acceptance gates. Do not prune merged branches without checking dirty files, live processes, and retained commit references.

Merged correctness slice

Main merge f9465bc6 integrates 401b58a4, the standalone recovery of x87 fix 98151373, changing only src/01-header.wat, src/06-fpu.wat, and test/test-fpu-instance-isolation.js. Old version changes, manual test lists, host changes and optimization candidates were excluded. Newer fused handlers use the common FPU accessors; the four shared-bank accesses were confined to the replaced helpers/save paths.

The pre-merge isolated build based on 07cbd9c0 passed at 1,156,001 / 1,156,469 bytes, with 24 native isolation/save/raw-integer checks and 11 x87 pipeline differential cases passing. The native isolation regression also passes after merging into the shared main worktree. A clean isolated build of merged head f9465bc6 stops at the inherited handler-ESP gate: RegisterDragDrop and RevokeDragDrop wrappers introduced by parent a38c67e8 lack cleanup visible to the checker. The x87 merge did not modify those paths; the OLE owner was notified. The 24-check native x87 regression passes on the clean merged sources as well. The complete merged-main build is not green. The foreign uncommitted diff hash was identical before/after the merge; the index remained empty. No stash, push, deployment, or cleanup occurred.

Final main integration and combined browser/build results are recorded by the recovery coordinator after validation; candidate commits alone do not establish that main contains the work.

Final disposition: x87 correctness is merged; broad review/screensaver integration remains on its branch awaiting reconciliation with newer main and coordinated handling of overlapping active edits. SMAC and optimization experiments remain held. No branches or worktrees were deleted.