tdkpin/original/C_RECONSTRUCTION_FINAL_AUDIT.md

# TDKPIN.EXE C reconstruction final audit

Audit target:

```text
a9022f1894e3e6e21fc42e8f6c932f7c549ca77f63aaa0c488bb9d55d9d0174c  TDKPIN.EXE
987a47580ba5c92fa071c989bdaeddf138e285d2b07106c5909a4acbc3e27088  TDKPIN_GHIDRA_RAW.c
```

The vendor source is unavailable. “Faithful C” therefore means an
address-traceable semantic reconstruction whose claims are closed by image
bytes, disassembly, relocation/reference data, typed Win16/Borland behavior,
and focused runtime evidence. It does not mean a byte-identical rebuild with
the original Borland compiler.

## Requirement audit

1. **Immutable evidence:** `TDKPIN_GHIDRA_RAW.c` retains its sealed hash.
   Regenerated complete raw evidence is separate and never used as readable C.
2. **Executable bytes:** all 93,064 executable-segment bytes are classified.
   93,062 have non-overlapping Ghidra code/data units. The remaining two are
   individually explained in `UNEXPLAINED.tsv` as an overlapping-entry opcode
   at `1020:0666` and an alignment NOP at `1020:0dea`; zero bytes are
   unclassified.
3. **Functions:** 391 ordinary in-image functions and all six overlapping/shared
   entries are `verified`. Every ordinary function row names its exact address,
   readable C symbol, source module, disassembly evidence, and semantic result.
   No row is raw, partial, restored, unknown, or blocked.
4. **Readable C:** the authoritative deliverable is the 63 strict-C11 units
   under `reconstructed/`. Historical partial `TDKPIN_*_RESTORED.c` files are
   explicitly marked superseded and are not completion artifacts.
5. **Imports and ABI:** all 292 NE import slots are verified. The 137 called
   slots have reviewed Win16 prototypes and call-site effects; 155 duplicate,
   data-only, or unused slots have explicit zero-CALL accounting. Segment/offset
   far pointers, PASCAL stack cleanup, 16-bit widths/wrap, and intentionally
   retained register bytes are represented in the C model.
6. **Runtime library:** every in-image Borland routine is reconstructed or
   identified through its exact implementation role. Real48 conversion,
   arithmetic, comparison, transcendental tables, rounding, overflow/error
   behavior, heap, files, strings, objects, and startup/shutdown paths are
   address-linked rather than silently omitted.
7. **Data:** all 19,770 DGROUP bytes are covered by 744 non-overlapping verified
   ranges and 219 verified semantic objects. All 455 referenced DGROUP addresses
   and all 18 code-embedded objects (282 bytes) are verified. The complete
   175-record collision/rule table and all indirect dispatch/VMT/procedure
   tables are represented.
8. **Callbacks and indirect control flow:** all six callback registrations are
   verified with target, thunk/instance lifetime, and invocation behavior. All
   301 NE entry points, 2,434 relocation sites, VMT dispatches, bound thunks,
   function pointers, and shared/overlapping entries are inventoried.
9. **Resources:** all 63 NE resources round-trip byte-for-byte from the target
   and have decoded derivatives where applicable. `RESOURCE_RECONSTRUCTION.tsv`
   has 63 verified rows. The semantic C catalog in `tdkpin_resources.c` records
   every type/ID, file offset, flags, allocated/meaningful size, dimensions or
   sample rate, disposition, and role. Four Borland File Open/Save templates are
   explicitly `linked-unused`; ICON 1 and VERSION 1 are Windows-resolved rather
   than falsely assigned image-code callers. WAV 2022 is loaded/freed by the
   generic loop but has no in-image playback selector.
10. **Companion timer:** `MMTIMER.DLL` is sealed as
    `f1d9ac980c7bfba5dc53eaa9e7cb2c3cd9b82f879ee8962ad40bf863d641bb49`.
    TDKPIN's sole ordinal-1 relocation/call, the DLL's timer callback, message
    `0x0580`, returned timer ID, and `timeKillEvent` lifetime are mapped.
11. **Behavioral validation:** every reconstructed C unit is compiled with
    strict warnings by `tools/test_reconstructed_c.sh`; 89 focused harness
    units cover normal, boundary, error, ownership, ABI, rendering, persistence,
    resource, physics, callback, and lifecycle paths. The resource verifier
    proves all 63 raw hashes and derivatives. `probe_real48_reference.sh`
    matches a real 16-bit Borland reference stream bit-for-bit. Documented
    Wine 11.15 probes cover original startup/input, timer gravity/substeps,
    claw terminals, moving flippers, collision types 1..4, target/rule effects,
    multiball, and scoring. Static/host evidence is not mislabeled as Wine.
12. **Phase boundary:** no Rust source or Cargo manifest/lockfile was modified.

Post-audit evidence correction (2026-08-23): raw `1000:9b69` reads predicted
DGROUP coordinates `1028:07db/07df`, not current `07d3/07d7`. The readable
helper and its harness now reflect that distinction; the complete C test and
ledger gates below still pass.

## Reproducible gates

```sh
bash original/tools/test_reconstructed_c.sh
bash original/tools/probe_real48_reference.sh
python3 original/tools/audit_reconstruction.py --require-complete
git diff -- '*.rs' Cargo.toml Cargo.lock
```

The final ledger gate requires every function, import, data range/object,
resource, callback, and shared entry to be `verified`, plus zero unclassified
executable ranges. At this audit all required incomplete-status counts are zero.