tdkpin/original/C_RECONSTRUCTION_FINAL_AUDIT.md

TDKPIN.EXE C reconstruction final audit

Audit target:

a9022f1894e3e6e21fc42e8f6c932f7c549ca77f63aaa0c488bb9d55d9d0174c  TDKPIN.EXE
987a47580ba5c92fa071c989bdaeddf138e285d2b07106c5909a4acbc3e27088  TDKPIN_GHIDRA_RAW.c

The vendor source is unavailable. “Faithful C” therefore means an address-traceable semantic reconstruction whose claims are closed by image bytes, disassembly, relocation/reference data, typed Win16/Borland behavior, and focused runtime evidence. It does not mean a byte-identical rebuild with the original Borland compiler.

Requirement audit

1. Immutable evidence: TDKPIN_GHIDRA_RAW.c retains its sealed hash. Regenerated complete raw evidence is separate and never used as readable C.
2. Executable bytes: all 93,064 executable-segment bytes are classified. 93,062 have non-overlapping Ghidra code/data units. The remaining two are individually explained in UNEXPLAINED.tsv as an overlapping-entry opcode at 1020:0666 and an alignment NOP at 1020:0dea; zero bytes are unclassified.
3. Functions: 391 ordinary in-image functions and all six overlapping/shared entries are verified. Every ordinary function row names its exact address, readable C symbol, source module, disassembly evidence, and semantic result. No row is raw, partial, restored, unknown, or blocked.
4. Readable C: the authoritative deliverable is the 63 strict-C11 units under reconstructed/. Historical partial TDKPIN_*_RESTORED.c files are explicitly marked superseded and are not completion artifacts.
5. Imports and ABI: all 292 NE import slots are verified. The 137 called slots have reviewed Win16 prototypes and call-site effects; 155 duplicate, data-only, or unused slots have explicit zero-CALL accounting. Segment/offset far pointers, PASCAL stack cleanup, 16-bit widths/wrap, and intentionally retained register bytes are represented in the C model.
6. Runtime library: every in-image Borland routine is reconstructed or identified through its exact implementation role. Real48 conversion, arithmetic, comparison, transcendental tables, rounding, overflow/error behavior, heap, files, strings, objects, and startup/shutdown paths are address-linked rather than silently omitted.
7. Data: all 19,770 DGROUP bytes are covered by 744 non-overlapping verified ranges and 219 verified semantic objects. All 455 referenced DGROUP addresses and all 18 code-embedded objects (282 bytes) are verified. The complete 175-record collision/rule table and all indirect dispatch/VMT/procedure tables are represented.
8. Callbacks and indirect control flow: all six callback registrations are verified with target, thunk/instance lifetime, and invocation behavior. All 301 NE entry points, 2,434 relocation sites, VMT dispatches, bound thunks, function pointers, and shared/overlapping entries are inventoried.
9. Resources: all 63 NE resources round-trip byte-for-byte from the target and have decoded derivatives where applicable. RESOURCE_RECONSTRUCTION.tsv has 63 verified rows. The semantic C catalog in tdkpin_resources.c records every type/ID, file offset, flags, allocated/meaningful size, dimensions or sample rate, disposition, and role. Four Borland File Open/Save templates are explicitly linked-unused; ICON 1 and VERSION 1 are Windows-resolved rather than falsely assigned image-code callers. WAV 2022 is loaded/freed by the generic loop but has no in-image playback selector.
10. Companion timer: MMTIMER.DLL is sealed as f1d9ac980c7bfba5dc53eaa9e7cb2c3cd9b82f879ee8962ad40bf863d641bb49. TDKPIN's sole ordinal-1 relocation/call, the DLL's timer callback, message 0x0580, returned timer ID, and timeKillEvent lifetime are mapped.
11. Behavioral validation: every reconstructed C unit is compiled with strict warnings by tools/test_reconstructed_c.sh; 89 focused harness units cover normal, boundary, error, ownership, ABI, rendering, persistence, resource, physics, callback, and lifecycle paths. The resource verifier proves all 63 raw hashes and derivatives. probe_real48_reference.sh matches a real 16-bit Borland reference stream bit-for-bit. Documented Wine 11.15 probes cover original startup/input, timer gravity/substeps, claw terminals, moving flippers, collision types 1..4, target/rule effects, multiball, and scoring. Static/host evidence is not mislabeled as Wine.
12. Phase boundary: no Rust source or Cargo manifest/lockfile was modified.

Post-audit evidence correction (2026-08-23): raw 1000:9b69 reads predicted DGROUP coordinates 1028:07db/07df, not current 07d3/07d7. The readable helper and its harness now reflect that distinction; the complete C test and ledger gates below still pass. Raw 1000:c79c also confirms that the response reads fixed candidate slot 1 at SS:...d8a2; later nearer candidates are stored in subsequent 0x34-byte slots but do not replace the applied record. A focused two-candidate harness now seals that record-order behavior. Raw 1000:531e further corrects the Pascal-order BitBlt interpretation: the DAT994 progress strip is drawn at (202,328) with height 13 and width (stage-1)*7, rather than the impossible historical 328x202 read from a 237x13 bitmap. The focused loading-stage harness seals stages 1, 35, and 0. Live one-substep rail/circle probes further correct the response projection: the tangential delta is normal_velocity * response_tangent, added to retained spin * 0.4; subtracting the bare coefficient incorrectly rounded it to zero. The documented horizontal drain transition (0,3015)->(-302,-1809) and the ordinary circle/bumper tangent transitions seal this correction.

Reproducible gates

bash original/tools/test_reconstructed_c.sh
bash original/tools/probe_real48_reference.sh
python3 original/tools/audit_reconstruction.py --require-complete
git diff -- '*.rs' Cargo.toml Cargo.lock

The final ledger gate requires every function, import, data range/object, resource, callback, and shared entry to be verified, plus zero unclassified executable ranges. At this audit all required incomplete-status counts are zero.