Independent native resource/layout review
=========================================

Scope: static reconstruction of the current candidate GEOS1 binaries from
actual linked GEOS2 engine bytes. No build-tool or release-source edits made.
The JSON report binds this review to exact input/output and build-tool hashes.
Rerun audit_resources.py after a rebuild; earlier hashes do not validate it.

Canonicalization
----------------
The actual 55-resource intermediate is mapped into the 59 canonical resource
slots by linker name. Exact source size/relocation-count correspondence was
independently checked against the refreshed linker map. The build tool now
also rejects a stale map whose size/relocation rows do not match its binary.
Absent split-data resources become 16-byte zero fixed placeholders. They are
not replacement storage for surviving data: all surviving resource operands
are rewritten to their actual new canonical destinations.

The independent audit reconstructs complete expected bytes and relocation
records for all 48 retained engine resources, including original padding. It
checks every imported call against the explicit allowed runtime entry map,
every movable call against the actual GCT1 target table, and every raw segment
against the prohibition on movable-code raw pointers. No other engine byte
changes are accepted. DGROUP is reconstructed separately, preserving its
original initialized bytes except the documented 64-byte native TPD prefix.

Resource relocation source 2 kinds 0/2/3/4 are handled differently from library
source 1 and kernel source 0. A synthetic permutation test covers all four:
far-pointer kind 0 changes only the resource word at operand+2; segment kind 2,
handle kind 3 and call kind 4 change the resource word at the operand. Entry
words and kernel/library ordinals remain unchanged. Actual final binaries
contain resource SEGMENT/HANDLE records; engine CALLs become fixed far-pointer
instructions with segment relocations. They do not rely on 1.x movable-call
transformation. Native kernel calls use the previously audited 1.x ordinal
far-pointer form, while the UI superclass retains separate library 0 OFFSET
and SEGMENT records. The synthetic test is not a new runtime claim for unused
resource FAR_PTR records.

DGROUP and artwork
-------------------
The engine initialized-data size plus declared BSS, excluding the intermediate
49,152-byte stack, ends before the new class. BSS is explicitly zero-filled.
Class capacity, state buffers through ART_SEG, 128 six-byte call contexts,
far jump/return words and 16 guard bytes have disjoint ranges. All unused
state/context/guard bytes are initially zero. The loader TPD stack-bottom word
matches the native initialized DGROUP end; initialized DGROUP plus the retained
49,152-byte stack stays below 64 KiB. The exact offsets are in resource-audit.json.

Artwork resource 62 bytes match the emitted artwork file exactly and have no
relocations. Flags 0x0850 mean read-only, shared, swappable, movable, preloaded,
and nondiscardable. Source review confirms MemLock precedes all bitmap reads,
its segment is held through the complete synchronous paint, and the common
exit calls MemUnlock once. The not-ready path does not acquire that lock.
GrDrawBitmap pointer use restores DS before returning to the shell. The source
keeps the old 1.x restriction against discarding blocks that MemLock cannot
reload. Actual loader/graphics execution remains a separate native-runtime
validation obligation.

Result: no static content, relocation, layout-overlap or artwork-flag blocker
found in the reviewed candidate. Native emulator tests are separate evidence.
