phase12: match func_8001AAA8 (718 bodies / 727 regions)

config/regions.tsv

@@ -77,6 +77,7 @@
 0x80019B6C	0x80019B94	src/func_80019B6C.c
 0x80019C04	0x80019C10	src/func_80019C04.c
 0x8001AA9C	0x8001AAA8	src/func_8001AA9C.c
+0x8001AAA8	0x8001AB24	src/func_8001AAA8.c
 0x8001AE3C	0x8001AE50	src/func_8001AE3C.c
 0x8001CE40	0x8001CE70	src/func_8001CE40.c
 0x80021C64	0x80021CDC	src/func_80021C64.c

phase-ends/CURRENT_PHASE.md

@@ -6,11 +6,11 @@
 
 ## STATE — SOLO CONTINUATION, 2026-09-24 (current)
 
-**717 bodies / 726 regions**, from 685 / 694 at the last session stop — **+32 bodies / +32 regions**.
-The Phase 12 milestone remains 750 bodies, so **+33 remains**. The promoted whole-binary gate is green:
-`c_regions=726`, `differing_bytes=0`, SHA-1
+**718 bodies / 727 regions**, from 685 / 694 at the last session stop — **+33 bodies / +33 regions**.
+The Phase 12 milestone remains 750 bodies, so **+32 remains**. The promoted whole-binary gate is green:
+`c_regions=727`, `differing_bytes=0`, SHA-1
 `e173426c157384ebf1b6caf8c6fea18a85a14af9`; 348 synthetic tests pass and extents report
-`regions=726 disagreements=0 result=AGREE`.
+`regions=727 disagreements=0 result=AGREE`.
 
 The requested second batch of 20 is complete. Twenty additional bodies are now matched:
 `0x800BC9C4`, `0x800BC8C4`, `0x8006BB0C`, `0x8002D17C`, `0x801029A0`, `0x80055958`,
@@ -23,8 +23,8 @@ not a correctness issue because the 724-region gate proves the registry simultan
 Final clean verification (2026-09-25): `make clean && make all`, `make worklist`,
 `make extents-verify`, and `make check` all exited 0. Both clean assembly and code rebuilds
 matched the USA executable byte-for-byte; each is 1,886,208 bytes with SHA-1
-`e173426c157384ebf1b6caf8c6fea18a85a14af9`. The final worklist is 956 rows and the extents
-check reports `regions=726 disagreements=0 result=AGREE`.
+`e173426c157384ebf1b6caf8c6fea18a85a14af9`. The final worklist is 955 rows and the extents
+check reports `regions=727 disagreements=0 result=AGREE`.
 ## STATE — SESSION STOP, 2026-09-24 23:35 (historical; superseded by the state above, kept for provenance)
 
 **685 bodies / 694 regions**, from 602 / 611 at the Phase 11 close — **+83 bodies**. **Milestone 750 was NOT

phase-ends/logs/Phase12.md

@@ -2431,5 +2431,17 @@ Additional fresh rows were attempted without promotion:
 * `0x8005BF44`: the state transitions are identified, but the candidate is 132 bytes against 140;
   the original preserves a distinct negative-path flag and delayed store that the direct C form folds.
 
-No new source, registry row, or milestone count resulted from this autonomous continuation.
-Authoritative count: **717 bodies / 726 regions; 33 remain**.
+### Batch task 23 — `0x8001AAA8` (124 B) MATCH
+
+* Exact extent: `0x8001AAA8..0x8001AB24`, 124 bytes, grade `exact`.
+* The decisive correction was decoding the masks as `0x00400000` and `0x02000000`, then spelling
+  each guard as a separate early return. The combined positive conjunction produced the wrong branch
+  polarity; the corrected five early returns reproduce the original `beqz`/`bnez` chain and call.
+* Tracked source: `src/func_8001AAA8.c`, md5 `5d8ee8aff76ff973d9fe7d3b2e40d9d4`. Fresh range:
+  `candidate_bytes=124 differing_bytes=0 result=MATCH`. Candidate whole-binary gate passed at
+  `c_regions=727`, `differing_bytes=0`, SHA-1
+  `e173426c157384ebf1b6caf8c6fea18a85a14af9`, exit 0. `make check` passed with 348 tests and
+  extents `regions=727 disagreements=0`; worklist regeneration reports 955 rows.
+
+**Count after task 23: 718 bodies / 727 regions (+116 bodies from the Phase 12 open baseline;
++32 remain to milestone 750).**

src/func_8001AAA8.c

@@ -0,0 +1,31 @@
+/*
+ * func_8001AAA8 — 124 bytes at 0x8001AAA8..0x8001AB24
+ *
+ * Dispatch only when the nested state and three payload conditions pass. The
+ * original tests the 0x00400000 and 0x02000000 state masks with lui/and pairs
+ * and returns through one shared frame epilogue.
+ *
+ * The helper address and structure field offsets are address-based working
+ * hypotheses; the byte match is the evidence for this region.
+ */
+
+extern void func_8001AB24(void);
+
+void func_8001AAA8(char *a0)
+{
+    int state = *(int *)(a0 + 16);
+    int flags = *(int *)(state + 40);
+
+    if ((flags & 0x400000) == 0)
+        return;
+    if (*(int *)(a0 + 24) == 0)
+        return;
+    if (*(int *)(a0 + 36) == 0)
+        return;
+    if ((*(unsigned char *)(a0 + 8) & 8) != 0)
+        return;
+    if ((flags & 0x2000000) != 0)
+        return;
+
+    func_8001AB24();
+}