feat(reconstruction): complete binary-backed C recovery

Replace the partial mechanics transcriptions with a separate, readable C11
reconstruction of the complete Win16 image while preserving the original raw
Ghidra export as immutable evidence. Cover all ordinary and overlapping entry
points, Borland runtime behavior, Win16 imports, segmented data, callbacks,
resources, indirect control flow, physics, rendering, persistence, and
startup/shutdown lifecycles.

Add deterministic extraction and audit tooling plus address-linked ledgers for
functions, imports, DGROUP ranges and objects, relocations, resources, and
callbacks. The final gate records zero raw, partial, restored, unknown,
blocked, or unclassified required units. Keep the semantic-fidelity boundary
explicit: the portable C is not claimed to reproduce a byte-identical Borland
NE build.

Add strict focused harnesses for every reconstructed C unit, exact resource
round-trip checks, and a 16-bit Borland Real48 reference probe. No Rust source
or Cargo metadata is changed in this phase.

Test Plan:
- `bash original/tools/test_reconstructed_c.sh` -- passed
- `bash original/tools/probe_real48_reference.sh` -- passed bit-for-bit
- `python3 original/tools/audit_reconstruction.py --require-complete` -- passed
- `git diff --cached --check` -- passed
- `git diff HEAD -- '*.rs' Cargo.toml Cargo.lock` -- empty
This commit is contained in:
2026-08-23 16:41:17 +02:00
parent aef404c834
commit 8b99e9607c
253 changed files with 79031 additions and 51 deletions
+85
View File
@@ -0,0 +1,85 @@
# TDKPIN.EXE C reconstruction final audit
Audit target:
```text
a9022f1894e3e6e21fc42e8f6c932f7c549ca77f63aaa0c488bb9d55d9d0174c TDKPIN.EXE
987a47580ba5c92fa071c989bdaeddf138e285d2b07106c5909a4acbc3e27088 TDKPIN_GHIDRA_RAW.c
```
The vendor source is unavailable. “Faithful C” therefore means an
address-traceable semantic reconstruction whose claims are closed by image
bytes, disassembly, relocation/reference data, typed Win16/Borland behavior,
and focused runtime evidence. It does not mean a byte-identical rebuild with
the original Borland compiler.
## Requirement audit
1. **Immutable evidence:** `TDKPIN_GHIDRA_RAW.c` retains its sealed hash.
Regenerated complete raw evidence is separate and never used as readable C.
2. **Executable bytes:** all 93,064 executable-segment bytes are classified.
93,062 have non-overlapping Ghidra code/data units. The remaining two are
individually explained in `UNEXPLAINED.tsv` as an overlapping-entry opcode
at `1020:0666` and an alignment NOP at `1020:0dea`; zero bytes are
unclassified.
3. **Functions:** 391 ordinary in-image functions and all six overlapping/shared
entries are `verified`. Every ordinary function row names its exact address,
readable C symbol, source module, disassembly evidence, and semantic result.
No row is raw, partial, restored, unknown, or blocked.
4. **Readable C:** the authoritative deliverable is the 63 strict-C11 units
under `reconstructed/`. Historical partial `TDKPIN_*_RESTORED.c` files are
explicitly marked superseded and are not completion artifacts.
5. **Imports and ABI:** all 292 NE import slots are verified. The 137 called
slots have reviewed Win16 prototypes and call-site effects; 155 duplicate,
data-only, or unused slots have explicit zero-CALL accounting. Segment/offset
far pointers, PASCAL stack cleanup, 16-bit widths/wrap, and intentionally
retained register bytes are represented in the C model.
6. **Runtime library:** every in-image Borland routine is reconstructed or
identified through its exact implementation role. Real48 conversion,
arithmetic, comparison, transcendental tables, rounding, overflow/error
behavior, heap, files, strings, objects, and startup/shutdown paths are
address-linked rather than silently omitted.
7. **Data:** all 19,770 DGROUP bytes are covered by 744 non-overlapping verified
ranges and 219 verified semantic objects. All 455 referenced DGROUP addresses
and all 18 code-embedded objects (282 bytes) are verified. The complete
175-record collision/rule table and all indirect dispatch/VMT/procedure
tables are represented.
8. **Callbacks and indirect control flow:** all six callback registrations are
verified with target, thunk/instance lifetime, and invocation behavior. All
301 NE entry points, 2,434 relocation sites, VMT dispatches, bound thunks,
function pointers, and shared/overlapping entries are inventoried.
9. **Resources:** all 63 NE resources round-trip byte-for-byte from the target
and have decoded derivatives where applicable. `RESOURCE_RECONSTRUCTION.tsv`
has 63 verified rows. The semantic C catalog in `tdkpin_resources.c` records
every type/ID, file offset, flags, allocated/meaningful size, dimensions or
sample rate, disposition, and role. Four Borland File Open/Save templates are
explicitly `linked-unused`; ICON 1 and VERSION 1 are Windows-resolved rather
than falsely assigned image-code callers. WAV 2022 is loaded/freed by the
generic loop but has no in-image playback selector.
10. **Companion timer:** `MMTIMER.DLL` is sealed as
`f1d9ac980c7bfba5dc53eaa9e7cb2c3cd9b82f879ee8962ad40bf863d641bb49`.
TDKPIN's sole ordinal-1 relocation/call, the DLL's timer callback, message
`0x0580`, returned timer ID, and `timeKillEvent` lifetime are mapped.
11. **Behavioral validation:** every reconstructed C unit is compiled with
strict warnings by `tools/test_reconstructed_c.sh`; 89 focused harness
units cover normal, boundary, error, ownership, ABI, rendering, persistence,
resource, physics, callback, and lifecycle paths. The resource verifier
proves all 63 raw hashes and derivatives. `probe_real48_reference.sh`
matches a real 16-bit Borland reference stream bit-for-bit. Documented
Wine 11.15 probes cover original startup/input, timer gravity/substeps,
claw terminals, moving flippers, collision types 1..4, target/rule effects,
multiball, and scoring. Static/host evidence is not mislabeled as Wine.
12. **Phase boundary:** no Rust source or Cargo manifest/lockfile was modified.
## Reproducible gates
```sh
bash original/tools/test_reconstructed_c.sh
bash original/tools/probe_real48_reference.sh
python3 original/tools/audit_reconstruction.py --require-complete
git diff -- '*.rs' Cargo.toml Cargo.lock
```
The final ledger gate requires every function, import, data range/object,
resource, callback, and shared entry to be `verified`, plus zero unclassified
executable ranges. At this audit all required incomplete-status counts are zero.