feat: model ADV coroutines and retained effect teardown

docs/superpowers/plans/2026-07-09-re-tooling-handler-labels-and-iat.md

@@ -240,7 +240,7 @@ Expected: named imports carry parameter types.
 
 - [ ] **Step B8: Save, verify annotations intact, update docs, commit**
 
-Confirm a sample of pre-existing renames/plate comments still present (`get_function_by_address` on `gfx_op_0x215_register_query`, `sleep_op_0xc8`). Run `mcp__ghidra__save_program`.
+Confirm a sample of pre-existing renames/plate comments still present (`get_function_by_address` on `gfx_op_0x215_query_source_slot`, `sleep_op_0xc8`). Run `mcp__ghidra__save_program`.
 Edit `docs/engine-re.md` (runbook: IAT reconstruction is done; note graft vs fallback) and `docs/tools-reference.md` (`apply_imports.py`).
 
 ```bash

docs/superpowers/plans/2026-07-09-stl-crt-naming.md

@@ -71,21 +71,18 @@ Expected: an explicit STRONG/WEAK verdict with the number.
 
 - [ ] **Step 1: Seed `vm-map/lib-functions.toml` with the known library functions**
 
-Include the library functions we've identified in RE (grep `engine-re.md` for `std::map`, `FUN_0047f280`, `FUN_0042cf70`, hash insert/find, `operator new`, etc.). Start conservative — only addresses we're confident about:
+Include only actual library functions identified in RE. **Correction (2026-07-09): do not seed
+`0x47f280` or `0x42cf70` here** — later caller/field analysis proved they are engine-purpose-specific
+`gfx_object_query_source_slot` and `vm_lvalue_descriptor_hash_insert`, not generic STL helpers.
+Start conservative — only addresses and roles we're confident about:
 ```toml
 # vm-map/lib-functions.toml -- CANONICAL registry of identified statically-linked library functions.
 # Generated: build/lib-functions.json + docs/lib-functions-reference.md via tools/lib_functions_build.py --build.
 # Applied to /v2 via run_script_inline (rename; never clobbers USER_DEFINED). Grows as we identify more.
 [[func]]
-address = 0x47f280
-name = "std_map_find"
-note = "std::map::find over the gfx object registry (op 0x215 handler calls it; returns value or 0xffffffff)"
-source = "native-RE"
-confidence = "high"
-[[func]]
-address = 0x42cf70
-name = "gfx_registry_hash_insert"
-note = "open-addressing hash insert into the op-0x215 query registry (op 0x1a2 handler calls it)"
+address = 0x5502be
+name = "operator_new"
+note = "VC9 operator new; malloc + new-handler retry + bad_alloc"
 source = "native-RE"
 confidence = "high"
 ```
@@ -111,7 +108,8 @@ Expected: N renamed (or skipped if we'd already named them), 0 clobbers.
 
 - [ ] **Step 6: Validate + commit**
 
-`decompile_function 0x42a0b0` (`gfx_op_0x215_register_query`) — its registry-find call should read `std_map_find(...)`.
+`decompile_function 0x42a0b0` (`gfx_op_0x215_query_source_slot`) — verify its purpose-specific
+`gfx_object_query_source_slot(...)` call was not clobbered by the library pass.
 ```bash
 git add vm-map/lib-functions.toml tools/lib_functions_build.py tools/test_lib_functions.py docs/lib-functions-reference.md
 git commit -m "re: curated library-function registry (lib-functions.toml) + apply"

docs/superpowers/specs/2026-07-09-re-tooling-handler-labels-and-iat-design.md

@@ -35,7 +35,7 @@ where `disp = 0x9b24c + op*4` (word index `0x26c93 + op`; e.g. `ctx[0x26e3f]=0x4
 3. For each real `(op, handler_va)`:
    - `create_function` at `handler_va` if none exists.
    - **Preserve good names:** if the function already has a non-`FUN_`/`LAB_` name (e.g.
-     `gfx_op_0x215_register_query`, `sleep_op_0xc8`), do **not** rename — only ensure a plate comment
+     `gfx_op_0x215_query_source_slot`, `sleep_op_0xc8`), do **not** rename — only ensure a plate comment
      records the opcode. Rename only raw `FUN_xxxx`/`LAB_xxxx` → `op_0xNN_handler`.
    - `set_plate_comment`: `opcode 0xNN dispatch handler; resolved via ctx[0x26c93+op] in FUN_00413860`.
 4. Emit `build/op-handler-map.json` (`{ "0x1ac": {"handler": "0x427fb0", "name": "..."}, ... }`).

docs/superpowers/specs/2026-07-09-stl-crt-naming-design.md

@@ -51,8 +51,9 @@ is a known library function." **Small by design** (a handful to low-dozens), not
 
 - Task 1: report the newly-named count; spot-check 2–3 (e.g. does `FUN_0047f280` now carry a
   `std::map`-family name? does a known `operator new` site read named?).
-- Task 2 (if taken): decompile `gfx_op_0x215_register_query` — its `gfx_registry_map_find(...)` /
-  `FUN_0047f280` call should read as the curated `std_map_find`; `--lint` clean; 0 clobbers.
+- Task 2 (if taken): do not classify `0x47f280` or `0x42cf70` as generic STL helpers. Later RE proved
+  they are purpose-specific `gfx_object_query_source_slot` and `vm_lvalue_descriptor_hash_insert`;
+  decompile `gfx_op_0x215_query_source_slot` to verify the former remains named; `--lint` clean; 0 clobbers.
 - `save_program` succeeds.
 
 ## Scope & boundaries