phase12: match func_8006BB88 (688 bodies / 697 regions)

config/regions.tsv

@@ -340,6 +340,7 @@
 0x8006B7C0	0x8006B964	src/func_8006B7C0.c
 0x8006B964	0x8006B9E0	src/func_8006B964.c
 0x8006B9E0	0x8006BA3C	src/func_8006B9E0.c
+0x8006BB88	0x8006BC08	src/func_8006BB88.c
 0x8006BC08	0x8006BC34	src/func_8006BC08.c
 0x8006BC34	0x8006BC74	src/func_8006BC34.c
 0x8006BC74	0x8006BF30	src/func_8006BC74.c

phase-ends/CURRENT_PHASE.md

@@ -6,18 +6,18 @@
 
 ## STATE — SOLO CONTINUATION, 2026-09-24 (current)
 
-**687 bodies / 696 regions**, from 685 / 694 at the last session stop — **+2 bodies / +2 regions**.
-The Phase 12 milestone remains 750 bodies, so **+63 remains**. The promoted whole-binary gate is green:
-`c_regions=696`, `differing_bytes=0`, SHA-1
+**688 bodies / 697 regions**, from 685 / 694 at the last session stop — **+3 bodies / +3 regions**.
+The Phase 12 milestone remains 750 bodies, so **+62 remains**. The promoted whole-binary gate is green:
+`c_regions=697`, `differing_bytes=0`, SHA-1
 `e173426c157384ebf1b6caf8c6fea18a85a14af9`; 344 synthetic tests pass and extents report
-`regions=696 disagreements=0 result=AGREE`.
+`regions=697 disagreements=0 result=AGREE`.
 
-Tasks 1–2/10 completed `0x80102F58` (60 bytes, plus three proven gp symbol rows) and `0x80027BE8`
-(92 bytes, first spelling). No harness parser change was needed for the first: the existing comma
-grammar `gp=-A,-B,-C` expresses the required per-site exclusions on the already-registered
-`0x800FFF60` row. Worklist regeneration remains at 984 rows; its `excluded_already_registered=694`
-continues the already-characterised two-row registry lag and is not a correctness issue because the
-696-region gate proves the registry simultaneously.
+Tasks 1–3/10 completed `0x80102F58` (60 bytes, plus three proven gp symbol rows), `0x80027BE8`
+(92 bytes, first spelling), and `0x8006BB88` (128 bytes). The third required two byte-required GNU C
+register bindings and a source-order flip: v0 is reused for 6/the old word, while v1 carries the split
+0x80000001 flag. Worklist regeneration is now 983 rows; `excluded_already_registered=695` continues
+the already-characterised two-row registry lag and is not a correctness issue because the 697-region
+gate proves the registry simultaneously.
 
 ## STATE — SESSION STOP, 2026-09-24 23:35 (historical; superseded by the state above, kept for provenance)
 

phase-ends/logs/Phase12.md

@@ -1869,3 +1869,41 @@ The full protocol remains in force; only concurrency and the copied charter/ledg
   `excluded_already_registered=694`, preserving the known two-row lag.
 
 **Count after task 2: 687 bodies / 696 regions (+85 bodies from the Phase 12 open baseline).**
+
+### Bounded attempts before task 3 — three rows stopped, none registered
+
+* `0x8006EBA0` (244 B): the prior best was 248 B. Reordering the initial negate chain and named `t`
+  pointer reached 244 B but remained at 37–57 differing bytes. A distinct nested/comma-expression
+  call schedule also reached 244 B / 50 differing bytes. Both root-cause dimensions failed; the
+  residual spans the initial load/negate delays and the second call's argument schedule.
+* `0x800238BC` (264 B): direct helper-written comparison state removed the duplicate `slt` but sank
+  the load and produced 268 B. Ternary and volatile-local forms also produced 268–284 B. The prior
+  264 B / 5-byte form remains the floor: early load versus one shared post-merge `slt` is a cc1
+  scheduling boundary.
+* `0x80029054` (124 B): the natural field-add source and corrected offset layout both produced
+  128 B. Named return values at entry, immediately before the third add, and comma-expression return
+  did not change the extra load/nop. The original reserves v0 for the return and uses v1/a0 for the
+  third add; this is a one-instruction allocator/scheduler floor.
+
+No staging source from these rows was promoted. Their exact work directories and spellings remain
+under `.run/p12/solo/`.
+
+### Task 3/10 — `0x8006BB88` (128 B) MATCH
+
+* Exact extent: `0x8006BB88..0x8006BC08`, 128 bytes, grade `exact`, no duplicate group.
+* A byte-address overlay avoids inventing unobserved structure gaps. The first two structural drafts
+  exposed exactly why: a partial struct shifted fields, while the overlay matched every instruction
+  from 0x8006BBA8 onward and reduced the residual to the first six setup instructions.
+* Two GNU C register-name bindings are byte-required. A v0-bound local carries 6 through both stores
+  and is then overwritten by the old +0x40 word. A v1-bound local carries 0x80000001. Computing the
+  flag before `value = 6`, while delaying the flag store until after the +0x40 load, reproduces the
+  original's `lui v1` / `li v0,6` order and the later `ori v1,v1,1`.
+* Tracked source md5: `318744a041fcc238714344029abf8d39`. Fresh tracked range: 128 bytes,
+  `differing_bytes=0 result=MATCH`.
+* `sf3_merge` accepted the claim. Candidate whole-binary gate: 697 regions, 0 differing bytes, both
+  SHA-1 values `e173426c157384ebf1b6caf8c6fea18a85a14af9`, exit 0.
+* Promoted `make check`: 344 tests OK; extents `regions=697 disagreements=0`; gate
+  `c_regions=697 differing_bytes=0 result=MATCH`. Worklist is now 983 rows and reports
+  `excluded_already_registered=695`, preserving the known two-row lag.
+
+**Count after task 3: 688 bodies / 697 regions (+86 bodies from the Phase 12 open baseline).**

src/func_8006BB88.c

@@ -0,0 +1,64 @@
+/*
+ * func_8006BB88 — 128 bytes at 0x8006BB88..0x8006BC08
+ *
+ * Initializes selected words in the object supplied as the second argument. The first two
+ * initialized words receive 6; an existing word at +0x40 is masked with
+ * 0xfffffffb, 0xfffffff7, 0xffffffef and 0xffffffdf, then ORed with 0xc0 and stored
+ * back. The object words at +0x08/+0x0c/+0x10, +0x18/+0x1c/+0x20,
+ * +0x28/+0x2c/+0x30, +0xec/+0xf0, and +0x104/+0x108/+0x10c are cleared. A word at
+ * +0x170 receives 0x80000001. The final masked value is returned.
+ *
+ * The overlay names only offsets proved by the instruction stream. The gaps between
+ * fields are not modelled: no claim is made about the complete structure or the
+ * semantics of the fields.
+ *
+ * REGISTER BINDING IS BYTE-REQUIRED. The original reuses v0 first for the constant 6,
+ * then overwrites it with the old +0x40 value. It builds 0x80000001 in v1, splitting the
+ * constant into `lui v1,0x8000` before the two 6-stores and `ori v1,v1,1` after the
+ * +0x40 load. The GNU C register-name bindings reproduce those two allocations. The
+ * flag assignment precedes `value = 6` in source but its store remains after the +0x40
+ * load; that order is required to hoist the flag's LUI before the LI while preserving
+ * the observed dataflow. Reversing the two assignments produces the same body with the
+ * first two instructions swapped.
+ *
+ * LIMITS: the first argument is unused in the observed body. Field meanings, object
+ * size, the omitted gaps, and the reason for the mask bits are hypotheses only where
+ * described as such; the offsets, constants, stores, return value, and instruction
+ * order are byte evidence.
+ */
+
+#define F(off) (*(int *)((char *)p + (off)))
+
+int func_8006BB88(int unused, char *p)
+{
+    register int value __asm__("$2");
+    register int flag __asm__("$3");
+
+    flag = 0x80000001;
+    value = 6;
+    F(0x38) = value;
+    F(0x3C) = value;
+    value = F(0x40);
+    F(0x170) = flag;
+    F(0x08) = 0;
+    F(0x0C) = 0;
+    F(0x10) = 0;
+    F(0x18) = 0;
+    F(0x1C) = 0;
+    F(0x20) = 0;
+    F(0x28) = 0;
+    F(0x2C) = 0;
+    F(0x30) = 0;
+    F(0xEC) = 0;
+    F(0xF0) = 0;
+    F(0x104) = 0;
+    F(0x108) = 0;
+    F(0x10C) = 0;
+    value &= -5;
+    value &= -9;
+    value &= -17;
+    value &= -33;
+    value |= 0xC0;
+    F(0x40) = value;
+    return value;
+}