phase11: cookbook 89-91 + gp symbol row D_80122464 — 531 bodies / 540 regions

Worker D's most transferable finding yet: the ADDRESS SYMBOL is what selects the addiu form.
A literal (int)0x8013F9B8 gives lui+ori; &D_8013F9B8 gives lui+addiu. So 'ori where the
original has addiu' means the source used a literal where it should reference the address
symbol -- a 40-byte error that presents as a LENGTH mismatch, which is why it reads like a
codegen problem. Extends findings 4/46.

90: a (gp)-relative access to an unregistered address is a SYMBOL REQUEST, not a source
problem -- the harness derives gp-ness only from config/symbols.tsv and no CLI option adds
it. Worker D verified its row by pointing --symbols at a scratch copy of the registry.

91: a real source-order quirk (two successive call addresses swapped) is preserved in a
match and is not a transcription error.

config/symbols.tsv

@@ -246,6 +246,7 @@ D_801223D0	0x801223D0	gp
 D_80122440	0x80122440	gp
 D_80122444	0x80122444	gp
 D_80122448	0x80122448	gp
+D_80122464	0x80122464	gp
 D_80122468	0x80122468	gp
 D_8012246C	0x8012246C	gp
 D_80122474	0x80122474	gp

docs/MATCHING_COOKBOOK.md

@@ -1412,3 +1412,31 @@ is 784 B — one instruction extra, same allocation mismatch.
 
 Worker A, on adopting the ranker: *"I have not attempted a tie-break-dense row since adopting the
 ranker and I do not intend to."* That is the correct use of the measurement.
+
+### 89. THE ADDRESS SYMBOL SELECTS `addiu`; A LITERAL GIVES `ori` (worker D)
+
+**`ori` where the original has `addiu` ⇒ the source used a literal constant where it should
+reference the address symbol.** Worker D's `0x80044D78`:
+
+    literal  (int)0x8013F9B8   ->  lui v1,0x8013 / ori   v1,v1,-1608     (40 bytes of length error)
+    symbol   &D_8013F9B8       ->  lui v1,0x8013 / addiu v1,v1,-1608     (416 -> 456 against 480)
+
+So the address-symbol convention (findings 4/46) is **not only about naming — it is what selects
+the `addiu` form.** This is checkable at a glance, and it presents as a **LENGTH MISMATCH, not an
+immediate mismatch**, which is why it reads like a codegen problem. Extends 4/46.
+
+### 90. A `(gp)`-relative access to an unregistered address is a SYMBOL REQUEST (worker D)
+
+The harness derives gp-ness **only** from `config/symbols.tsv`; there is no CLI option that *adds*
+it (`--no-gp` only removes). So if a row has a `lw`/`sw`/`lb`/`sb` with a `(gp)` base whose address
+is not in the registry, **the row cannot be matched until a row is added** — it is a symbol request,
+not a source problem.
+
+Worker D verified this without touching `config/` by pointing `--symbols` at a **scratch copy** of
+the registry plus the one row. That is the correct technique and worth copying.
+
+### 91. A real source-order quirk can be preserved in a match (worker D)
+
+`0x80044D78` makes ten repeated calls to `func_800460AC` with successive addresses, and **entries 7
+and 8 are swapped** (0x80116C50 before 0x80116C10). That is a genuine quirk in the original source
+order, not a transcription error — worth stating because it looks like one.