fix(canary): point the launchers at a binary that exists and is instrumented

`/sylph-canary` was dead at both ends, measured rather than assumed:

  * `run-canary-safe.sh` runs the Wine build and defaults to
    `xenia_canary_i2d.exe`, which DOES NOT EXIST. The `xenia_canary.exe` that
    does (2026-06-19) has ZERO strings for `audit_61_branch_probe_pcs` and zero
    for `RE-INPUT`/`RE-DRAW` -- it predates all our instrumentation, and
    refreshing it needs the clang-cl + xwin toolchain on `cross-build-wine`.
  * both native launchers defaulted to
    `xenia-canary-native/build/bin/Linux/Release/xenia_canary`. That directory
    does not exist on this workspace -- the checkout is `xenia-canary/` -- and
    Release is not even a target in that build tree (`ninja -n` lists 0 steps),
    so its binary is frozen at 2026-08-28, before the probe.

Native launchers now default to
`xenia-canary/build/bin/Linux/Checked/xenia_canary`: the config this tree can
actually build, rebuilt today with the audit_61 probe (Canary PR #2), verified
by `strings` -- audit_61 8 hits, RE-INPUT/RE-DRAW 4. `Checked` is optimised WITH
assertions, which is what a behavioural reference should be: a bad state stops
loudly rather than being sampled.

The Wine launcher now ABORTS with the reason and points at the native one,
instead of failing somewhere downstream on a missing file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -221,7 +221,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -232,7 +232,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -2507,7 +2507,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3824,7 +3824,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4818,7 +4818,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5116,7 +5116,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5197,7 +5197,7 @@ dependencies = [
  "colored",
  "image",
  "indicatif",
- "sylpheed-formats 0.1.0",
+ "sylpheed-formats",
  "texpresso",
  "tokio",
  "tracing",
@@ -5213,7 +5213,7 @@ dependencies = [
  "image",
  "serde",
  "serde_json",
- "sylpheed-formats 0.1.0 (git+https://git.mc02.dev/fabi/Sylpheed.git?tag=formats-pin-2026-09-01)",
+ "sylpheed-formats",
 ]
 
 [[package]]
@@ -5234,25 +5234,6 @@ dependencies = [
  "xdvdfs",
 ]
 
-[[package]]
-name = "sylpheed-formats"
-version = "0.1.0"
-source = "git+https://git.mc02.dev/fabi/Sylpheed.git?tag=formats-pin-2026-09-01#1cd5b8b1cb1f02eefc0865e1a1fe280e44831c9d"
-dependencies = [
- "anyhow",
- "binrw",
- "flate2",
- "futures",
- "rayon",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "tracing",
- "ttf-parser 0.24.1",
- "xdvdfs",
-]
-
 [[package]]
 name = "sylpheed-ppc"
 version = "0.1.0"
@@ -5276,7 +5257,7 @@ dependencies = [
  "image",
  "rfd",
  "rodio",
- "sylpheed-formats 0.1.0",
+ "sylpheed-formats",
  "thiserror 2.0.18",
  "tracing",
  "tracing-subscriber",
@@ -5417,7 +5398,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5776,7 +5757,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6294,7 +6275,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]

crates/sylpheed-export/Cargo.toml

@@ -55,33 +55,19 @@ license.workspace = true
 # a squash-merge can orphan, and no way for the exporter to be built against a
 # decoder it was never tested with. A decoder change and the exporter change it
 # requires now land in the same commit or not at all.
-# PINNED BY TAG, which is what MISSION section 2 prescribes and what the tagging
+# ✅ UNPINNED 2026-09-20. The pin above was deliberate and carried its own exit
-# rule exists for: "the RE agent tags when it lands something you need and tells
+# condition -- "revert to the path dependency the day the tag is an ancestor of
-# you over the message channel -- that is how you stay current without floating."
+# `main`" -- because while it held, `sylpheed-cli` built from the WORKSPACE crate
-# That is exactly what happened here.
+# and the exporter from the tag, so `tools/port/verify-screen` compared two eras
+# instead of detecting drift. `formats-pin-2026-09-01` is now an ancestor of
+# `main` (measured), so the two read one decoder again.
 #
-# The tag carries the CORRECTED keyframe association: a placement group is an
+# 🔴 AND THE PIN HAD A COST NOBODY PRICED IN: it made this repository depend on
-# 8-byte header then `frames` x {u32 time; 36-byte pose}, so pose 0's time is the
+# its OWN history by tag. The issue-#49 history rewrite replaced every commit,
-# group's lead-in word and EVERY POSE IS TIMED, including the last. The working
+# the locked rev vanished, and the build broke for every clean checkout while
-# tree's copy still has the retired `SYLPHEED_KF_TIME_SHIFT` knob -- a superseded
+# still working on the machine that did the rewrite, because its `~/.cargo/git`
-# partial fix that got the association right but left pose 0 untimed, which is
+# still held the old object (PR #60). A path dependency cannot fail that way.
-# why testing it moved the untimed frame from last to first instead of removing
+sylpheed-formats = { path = "../sylpheed-formats" }
-# it. The old reading is behind `SYLPHEED_KF_TIME_LEGACY=1` here.
-#
-# 🔴 THE COST, STATED: `sylpheed-cli` builds from the WORKSPACE crate, so until
-# this lands on `main` the exporter and the reference renderer read DIFFERENT
-# decoders and `tools/port/verify-screen` is comparing two eras rather than
-# detecting drift. `tools/port/verify-capture` is unaffected -- it compares the
-# port against oracle CAPTURES and never touches the CLI -- and it is the check
-# that matters. Revert to the path dependency the day the tag is an ancestor of
-# `main`.
-# Bumped c -> d 2026-08-29. What I wanted from the new state: `d` carries parser
-# and `audio.rs` changes on top of `c`. ⚠️ Its headline change -- Reborn's
-# renderer drawing `rotation_deg`, and `compose` drawing a leaf that carries
-# geometry -- does NOT reach this port from here: `sylpheed-cli` builds from the
-# WORKSPACE crate, so the reference renderer stays unrotated until the tag lands
-# on `main`. This bump is for the parser, not for the renderer.
-sylpheed-formats = { git = "https://git.mc02.dev/fabi/Sylpheed.git", tag = "formats-pin-2026-09-01" }
 
 serde      = { version = "1", features = ["derive"] }
 serde_json = "1"

docker/decoder/sylph-decoder

@@ -122,11 +122,19 @@ docker_args() {
     # (file offset = VA - 0x82000000), which removes the need to boot the
     # emulator and scrape /dev/shm to get at it. An earlier belief that this
     # file was STALE was tested and refuted -- it is current.
-    -v "${SYLPH_XENIA_RS:-$PROJECT/xenia-rs}:/xenia-rs:ro"
     -v "${SYLPH_PE:-$PROJECT/Project Sylpheed - Arc of Deception (USA, Europe) (En,Ja).pe}:/image/sylpheed.pe:ro"
     -e "SYLPHEED_DB=/xenia-rs/sylpheed.db"
     -e "SYLPHEED_PE=/image/sylpheed.pe"
     -e "SYLPHEED_IMAGE_BASE=0x82000000"
+    # 🔴 EVIDENCE IS SHARED, NOT COMMITTED (issue #49). Each agent works in its
+    # OWN clone, so a gitignored capture written in one container is invisible to
+    # the other and to the human -- git used to be the transport and no longer is.
+    # One host directory, bind-mounted into both agents, is: all three see the
+    # same files live, every `docs/re/captures/...` citation resolves everywhere,
+    # and nothing can reach git history. Read-write on purpose -- showing each
+    # other a screenshot is the point.
+    -v "${SYLPH_CAPTURES:-$PROJECT/Sylpheed/docs/re/captures}:/work/docs/re/captures"
+
     # The shared exchange: transient files with provenance, outside git history.
     -v "sylpheed-exchange:/exchange"
     -e "PROJECT_DIR=/work"

docker/port/sylph-port

@@ -67,6 +67,14 @@ docker_args() {
     -v "sylpheed-port-claude:/sylph-home/port/.claude"
     -v "${SYLPH_CLAUDE_HOME:-$HOME/.claude}:/sylph-home/port/.claude.seed:ro"
     -v "${SYLPH_CLAUDE_JSON:-$HOME/.claude.json}:/sylph-home/port/.claude.host.json:ro"
+    # 🔴 EVIDENCE IS SHARED, NOT COMMITTED (issue #49). Each agent works in its
+    # OWN clone, so a gitignored capture written in one container is invisible to
+    # the other and to the human -- git used to be the transport and no longer is.
+    # One host directory, bind-mounted into both agents, is: all three see the
+    # same files live, every `docs/re/captures/...` citation resolves everywhere,
+    # and nothing can reach git history. Read-write on purpose -- showing each
+    # other a screenshot is the point.
+    -v "${SYLPH_CAPTURES:-$WORKSPACE/Sylpheed/docs/re/captures}:/work/docs/re/captures"
     -v "sylpheed-exchange:/exchange"
     -e "PROJECT_DIR=/work"
     # Same guardrail as the decoder, added the same day and for its reason: the

docs/agents/CONSOLIDATION.md

@@ -1,3 +1,27 @@
+# ✅ CLOSED 2026-09-20 — every phase done, and the two human decisions taken
+
+Nothing on this page is outstanding. It is kept as the record of how the two-repo
+layout was reached; **where it describes the repository's present state it is
+now out of date on purpose**, and the notes below say how.
+
+| the page says | what is true now |
+|---|---|
+| "**Still open, for the human**: the history fork" | **Taken: full purge.** `git filter-repo` stripped 182 assets from every commit; force-pushed 2026-09-19. `main` `2a93be99` → `e16556dc`, `.git` **217 MB → 114 MB**, **0** assets anywhere in history, verified from an independent fresh clone. Backups + runbook: `~/sylph-repo-backup-2026-09-19/` |
+| "`docs/re/captures/` is 118 MB of game screenshots inside a public repository" | **Decided (#49): no game assets in the repos.** Captures live on disk, gitignored, shared between the host and both agents by bind mount; derived measurements (csv/tsv/txt/log/json/npy) stay tracked. PR #59 |
+| "all six repos are `private=False`" | Still true, and now deliberate — there is nothing game-derived in them |
+| "`ai-agent-*.md`, `scratch/`, `_voice_span.rs` — keep or drop" | `scratch/` and `_voice_span.rs` dropped in the 2026-09-18 cleanup; the `ai-agent-*.md` files are the human's and stay |
+| the four archived repos | unchanged: `Sylpheed-Godot`, `xenia-rs`, `xex2tractor` archived read-only, `Syplheed-Reborn` deleted. ⚠️ Their local clones are **gone from this machine** too, and `sylph-decoder` no longer mounts `xenia-rs` |
+
+🔴 **The one thing this page got right and nobody acted on.** It named
+`crates/sylpheed-export`'s dependency on **this repository by tag** as the hard
+blocker for a rewrite. It was not re-checked before the purge, the locked rev
+vanished, and the build broke for every clean checkout while still working on the
+machine that did the rewrite — its `~/.cargo/git` still held the old object.
+Fixed in PR #60 (re-lock) and PR #61 (path dependency, which removes the class).
+**Before any future history rewrite, grep for a dependency on the repo's own URL.**
+
+---
+
 # Consolidating six repositories into two
 
 **Set by the human, 2026-09-13.** The end state is **two** repositories:

docs/agents/CONTAINERS-AND-AGENTS.md

@@ -88,6 +88,42 @@ sylph-agent-canary-build                         the warm 235 MB Canary build tr
 sylpheed-exchange                                agent -> agent files, read-only in
 ```
 
+**Plus one bind mount, which is not a volume on purpose** — the host's
+`Sylpheed/docs/re/captures/`, mounted read-write into both agents at
+`/work/docs/re/captures`:
+
+```
+-v "${SYLPH_CAPTURES:-<workspace>/Sylpheed/docs/re/captures}:/work/docs/re/captures"
+```
+
+🔴 **Why it has to exist.** Each agent works in its OWN clone, so before issue
+#49 the transport for evidence was *git*: commit the screenshot, the other agent
+pulls it. #49 removed that — captures are gitignored now — and without a
+replacement a capture written in one container is invisible to the other agent,
+to the human, and to `check-capture-citations`, which would call every citation
+dangling. One host directory shared by all three restores it: the same file is
+live everywhere, every `docs/re/captures/...` citation resolves, and nothing can
+reach git history. Read-write on both, because showing each other a screenshot
+is the point.
+
+Verified rather than assumed: container A wrote a `.png` there, a **separate**
+container B read it back, the host saw it, and `git status` reported **0**
+changes.
+
+⚠️ **Evidence that must cross MACHINES still cannot go this way** — a bare clone
+on the other desktop has no captures at all. Attach it to the issue or PR; that
+is the only channel that travels.
+
+⚠️ **The agent volumes were all deleted in the 2026-09-18 cleanup** and Docker
+recreates them empty on next launch. Nothing was lost — both agent clones were
+verified clean with nothing unpushed, and the exchange held only spent artefacts.
+One side effect is welcome: the empty `*-claude` volumes mean the next launch
+starts a **fresh** session, which is the documented workaround for the
+"resumes the old brief" defect below.
+
+⚠️ **`sylph-decoder` used to mount `xenia-rs` read-only. That repo is retired and
+the directory is gone**, so the mount pointed at nothing; removed.
+
 **Credentials** — three files on the host, `chmod 600`, mounted read-only:
 
 ```

docs/agents/PROTOCOL.md

@@ -129,10 +129,18 @@ exchange volume carries the working artefacts.
 | kind | where | why |
 |---|---|---|
 | code, decoded knowledge | **git** | history, review, permanence |
-| evidence cited by a finding | **git** | it is the proof |
+| evidence cited by a finding — a screenshot, a frame, a savegame | **`docs/re/captures/`, present but NEVER committed** | it is the proof, but it is game content. The directory is gitignored and shared between the host and both agents, so all three see the same file; `tools/re/check-capture-citations` fails if a citation has no file, and fails again if an asset is tracked |
+| a measurement you derived — csv, tsv, txt, log, json | **git** | our own numbers, not game content, and most findings rest on them |
+| evidence that must cross machines | **attached to the issue or PR** | captures are local-only now, so a bare clone has none of them. Attaching is the only channel that reaches the other desktop or a reviewer |
 | **evidence a human must look at** — the screenshot or film behind a `state/needs-human` item | **attached to that issue** | it travels *with* the item, a person sees it in a browser, and it cannot be orphaned from the claim it supports |
 | exploratory captures, work in progress, "look at this" | **`share`** → `/exchange` | no history; would bloat the repo forever |
 
+⚠️ **This table's first row used to say "git", and that is how 76 MB of
+screenshots accumulated** — directly above the rule forbidding exactly that. The
+two contradicted each other for months and the table won, because it was the one
+that told you what to *do*. Issue #49 settled it and the history was rewritten;
+if you find yourself reaching for `git add -f` on a capture, the answer is no.
+
 🔴 **Never commit game content.** Not sprites, not audio, not transcoded video,
 not a capture of the running game — under *any* directory name. On 2026-09-04
 this rule was live, and freshly tightened, while **545 MB of extracted disc

tools/re/check-capture-citations

@@ -235,6 +235,21 @@ def main() -> int:
     print("  cited by a page or a tool : %d" % (len(files) - len(orphans)))
     print("  cited by nothing          : %d  (reported, not failed —" % len(orphans))
     print("                               an orphan may be evidence a page owes)")
+    # 🔴 A BARE CLONE HAS NO CAPTURES AT ALL, and that is not a defect.
+    # Since #49 the assets are never committed, so a fresh clone, a worktree or
+    # a CI checkout legitimately has none — and the naive check calls all 134
+    # citations dangling and exits 1. A gate that is red on every clean checkout
+    # is one people learn to ignore, which is how the last wrong-by-default
+    # check in this file cost a session. Distinguish "none here" from "this one
+    # is missing": with some assets present, a gap is real and still fails.
+    assets_here = sum(1 for f in files if f.lower().endswith(ASSET_SUFFIXES))
+    if assets_here == 0 and dangling:
+        print("  ⓘ no captures on this checkout: %d citations unresolved" % len(dangling))
+        print("     Expected — captures are local-only (#49) and a fresh clone has none.")
+        print("     Copy them in, or read the evidence on the issue it is attached to.")
+        print("  🔴 game assets TRACKED    : %d" % len(stowaways))
+        return 1 if stowaways else 0
+
     rc = 0
     if dangling:
         print("  🔴 cited but NOT present  : %d" % len(dangling))

tools/run-canary-native-safe.sh

@@ -32,7 +32,18 @@ export ALSA_CONFIG_PATH="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/asound-nu
 # Paths derive from where this script sits — see the note in run-canary-safe.sh.
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WORKSPACE="$(cd "$HERE/../.." && pwd)"
-BIN_DEFAULT="$WORKSPACE/xenia-canary-native/build/bin/Linux/Release/xenia_canary"
+# 🔴 THE INSTRUMENTED BINARY IS THE `Checked` ONE, and it is the only config this
+# build tree can produce: `ninja -n bin/Linux/Release/xenia_canary` lists ZERO
+# steps, so Release is not a target here and its binary still dates from
+# 2026-08-28, before the audit_61 probe existed. Pointing at Release therefore
+# runs an oracle with no probe and no way to refresh it.
+#
+# The old default named `xenia-canary-native/`, a directory that does not exist
+# on this workspace at all -- the checkout is `xenia-canary/`.
+#
+# `Checked` is optimised WITH assertions, which is what you want from a
+# behavioural reference: a bad state stops loudly instead of being sampled.
+BIN_DEFAULT="$WORKSPACE/xenia-canary/build/bin/Linux/Checked/xenia_canary"
 BIN_EXE="${CANARY_BIN:-$BIN_DEFAULT}"
 ISO="${SYLPHEED_ISO:-$WORKSPACE/Project Sylpheed - Arc of Deception (USA, Europe) (En,Ja).iso}"
 [ -f "$ISO" ] || { echo "ABORT: no ISO at '$ISO' — set \$SYLPHEED_ISO"; exit 4; }

tools/run-canary-native.sh

@@ -24,7 +24,18 @@ set -u
 # Paths derive from where this script sits — see the note in run-canary-safe.sh.
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 WORKSPACE="$(cd "$HERE/../.." && pwd)"
-BIN_DEFAULT="$WORKSPACE/xenia-canary-native/build/bin/Linux/Release/xenia_canary"
+# 🔴 THE INSTRUMENTED BINARY IS THE `Checked` ONE, and it is the only config this
+# build tree can produce: `ninja -n bin/Linux/Release/xenia_canary` lists ZERO
+# steps, so Release is not a target here and its binary still dates from
+# 2026-08-28, before the audit_61 probe existed. Pointing at Release therefore
+# runs an oracle with no probe and no way to refresh it.
+#
+# The old default named `xenia-canary-native/`, a directory that does not exist
+# on this workspace at all -- the checkout is `xenia-canary/`.
+#
+# `Checked` is optimised WITH assertions, which is what you want from a
+# behavioural reference: a bad state stops loudly instead of being sampled.
+BIN_DEFAULT="$WORKSPACE/xenia-canary/build/bin/Linux/Checked/xenia_canary"
 BIN_EXE="${CANARY_BIN:-$BIN_DEFAULT}"
 ISO="${SYLPHEED_ISO:-$WORKSPACE/Project Sylpheed - Arc of Deception (USA, Europe) (En,Ja).iso}"
 [ -f "$ISO" ] || { echo "ABORT: no ISO at '$ISO' — set \$SYLPHEED_ISO"; exit 4; }

tools/run-canary-safe.sh

@@ -57,7 +57,22 @@ rm -f xenia.log
 
 # Binary is overridable (default keeps the historical _i2d snapshot); extra
 # cvars pass through via CANARY_EXTRA_ARGS (space-separated, values w/o spaces).
+# ⚠️ THIS WINE BUILD HAS NO INSTRUMENTATION AND CANNOT BE REFRESHED HERE.
+# Measured 2026-09-20: `xenia_canary_i2d.exe` does not exist at all, and the
+# `xenia_canary.exe` that does (2026-06-19) has ZERO hits for both
+# `audit_61_branch_probe_pcs` and `RE-INPUT`/`RE-DRAW`. Rebuilding it needs the
+# clang-cl + xwin cross toolchain on the `cross-build-wine` branch.
+#
+# 🔴 FOR PROBE RUNS USE `run-canary-native-safe.sh` INSTEAD -- same hard Vulkan
+# gate, same headless behaviour, and it runs the Checked native binary, which
+# carries audit_61 and the RE-INPUT/RE-DRAW logging.
 BIN_EXE="${CANARY_BIN:-xenia_canary_i2d.exe}"
+if [ ! -f "$BIN/$BIN_EXE" ]; then
+  echo "ABORT: no Wine binary at $BIN/$BIN_EXE" >&2
+  echo "  This build is stale and uninstrumented; use run-canary-native-safe.sh" >&2
+  echo "  for anything needing audit_61 or the RE-* logging." >&2
+  exit 4
+fi
 args=(--log_level=3 --mute=true)
 [ -n "$PROBES" ] && args+=("--audit_61_branch_probe_pcs=$PROBES")
 if [ -n "${CANARY_EXTRA_ARGS:-}" ]; then