# E01 — Static reference mapping

Date: 2026-10-21. Status: **source-only, reproduced static analysis**. Reference code was not executed.

## Inputs and procedure

All five original ZIP identities are pinned in `config/references.json`. Every archive is rechecked against its original size/SHA-256 and member CRCs; all extracted files are compared to archive-member hashes before indexing. Source paths and full hashes remain in the generated report. The report also records the generator's own SHA-256.

From the repository root:

```sh
nix develop --command python3 scripts/map_references.py
nix develop --command python3 scripts/map_references.py --check
nix develop --command python3 scripts/test_setup.py
```

The indexer tokenizes IXPL strings/comments, collects include candidates, evaluates a restricted integer-expression subset, associates interrupt wrappers with source signatures, resolves unambiguous tool-name concatenations, and inventories config declarations, grammar rules, shader sections/uniforms, batch text and resource candidates. Adjacent builds are compared by file hashes. No parser/compiler/plugin/EXE is launched.

## Outputs and observations

- `assets/analysis/source-map.json`: reproducible full per-build evidence and initial file coverage ledger; Xet payload.
- `docs/API_INDEX.md`: latest 408 Core endpoints and source wrapper anchors; ordinary authored/generated documentation.
- `docs/PLUGIN_INDEX.md`: 201 literal-resolved plugin `initTool` call sites; ordinary documentation.
- Five builds, 560 regular-member occurrences, 47 latest IXPL files, 487 include directives across all builds; no missing/ambiguous include candidate sets under the documented search policy.
- Latest host intervals resolve to 0–248, 249–333, 334–404, and 405–407. Every Core interrupt wrapper has a matching same-line function signature; no unresolved Core constant expression remains.
- 40 literal typed CFG declaration records are indexed. This is not a complete consumer config-key inventory: scope-derived/dynamic keys and string tables require further work.

## Controls and limitations

Synthetic tests cover fake dependencies in comments/ordinary/delimiter strings, nested call arguments, overload/source anchors, restricted constant evaluation, ambiguous/cyclic string bindings, long literal blocks, missing/ambiguous includes, modified input hashes, and copy/rename distinctions. They run without original assets.

The mapper is a lexical index, not an IXPL compiler, whole-program type/call analysis, runtime tracer, or format decoder. Parenthesis/array/brace argument structure is recognized; generic angle-bracket type expressions are not a full grammar. Include ordering, callback reachability, implicit host paths, dynamic strings and source/runtime discrepancies remain open.

No runtime oracle is available in this experiment. Historical reports, source comments, writer implementations and measured host behavior retain separate labels as defined in REVERSE_ENGINEERING.md. “Unavailable here” does not establish that an executable cannot be made to run.