phase12: record second-batch checkpoint

docs/MATCHING_COOKBOOK.md

@@ -3360,3 +3360,19 @@ declaration order are likewise required for the address form and sp+24/sp+40 loc
 > **When a call follows a batch copy, reconstruct the live values at the call from the register
 > dataflow, not from the values that happen to be copied first. A five-argument prototype can
 > preserve incoming registers while its final argument travels on the stack.**
+
+### 192. Frame-pinned body matching: fix the missing guard before tuning registers (solo, Phase 12)
+
+Four consecutive second-batch matches show a repeatable order: derive the body from the exact
+instruction/dataflow, then add only the missing source construct. `0x800BC9C4` needed a do/while
+V4 assignment plus byte-offset arithmetic; `0x800BC8C4` needed both call pairs under the actual
+nonpositive-counter guard; `0x8006BB0C` needed its outer null check; and `0x8002D17C` needed the
+queue pointer bound to a1. In each case the frame/call structure made the remaining register
+residual small and local.
+
+> **When a candidate is a few instructions short, first search for a missing guard, loop shape,
+> or pointer level in the decoded control flow. Do not start with register-binding permutations
+> until the structural body and frame are reproduced.**
+
+This is a companion to findings 43/45/49: branch polarity, named liveness, and register allocation
+are still required, but they are the second line of attack after a structural omission is found.

phase-ends/CURRENT_PHASE.md

@@ -6,18 +6,16 @@
 
 ## STATE — SOLO CONTINUATION, 2026-09-24 (current)
 
-**695 bodies / 704 regions**, from 685 / 694 at the last session stop — **+10 bodies / +10 regions**.
-The Phase 12 milestone remains 750 bodies, so **+55 remains**. The promoted whole-binary gate is green:
-`c_regions=704`, `differing_bytes=0`, SHA-1
+**699 bodies / 708 regions**, from 685 / 694 at the last session stop — **+14 bodies / +14 regions**.
+The Phase 12 milestone remains 750 bodies, so **+51 remains**. The promoted whole-binary gate is green:
+`c_regions=708`, `differing_bytes=0`, SHA-1
 `e173426c157384ebf1b6caf8c6fea18a85a14af9`; 344 synthetic tests pass and extents report
-`regions=704 disagreements=0 result=AGREE`.
-
-The requested ten successful matches are complete. The tenth is `0x80095CF8` (124 bytes), which
-closes the two-vector copy/call row by preserving the original's five-argument dataflow: incoming
-`a0`, record pointer, two local-vector addresses, and stack zero. Worklist regeneration is now 978
-rows; `excluded_already_registered=702` continues the already-characterised two-row registry lag and
-is not a correctness issue because the 704-region gate proves the registry simultaneously.
+`regions=708 disagreements=0 result=AGREE`.
 
+The requested second batch of 20 is underway. Four additional bodies are now matched:
+`0x800BC9C4`, `0x800BC8C4`, `0x8006BB0C`, and `0x8002D17C`. Worklist regeneration is now 974
+rows; `excluded_already_registered=706` continues the already-characterised two-row registry lag and
+is not a correctness issue because the 708-region gate proves the registry simultaneously.
 ## STATE — SESSION STOP, 2026-09-24 23:35 (historical; superseded by the state above, kept for provenance)
 
 **685 bodies / 694 regions**, from 602 / 611 at the Phase 11 close — **+83 bodies**. **Milestone 750 was NOT

phase-ends/logs/Phase12.md

@@ -2054,3 +2054,65 @@ confirmed.
   `excluded_already_registered=702`, preserving the known two-row lag.
 
 **Final count after the tenth successful body: 695 bodies / 704 regions (+93 bodies from the Phase 12 open baseline).**
+
+## SECOND SOLO BATCH — 20-BODY REQUEST
+
+### Batch task 1 — `0x800BC9C4` (80 B) MATCH
+
+* Exact extent: `0x800BC9C4..0x800BCA14`, 80 bytes, grade `exact`.
+* A do/while V4 assignment supplies the four-load/four-store body; the end pointer is formed
+  through a byte pointer so 0x14F0 is not scaled as an int-pointer displacement. A source-bound
+  a3 pointer and the corrected destination displacement 0x30F4 close the register/address fields.
+* Tracked source md5: `b960c0bf2d79891843acebf2f220fcfe`; fresh range and candidate whole-binary
+  gate were both zero-difference. Promoted gate: 705 regions, SHA-1 unchanged; `make check` passed.
+
+### Batch task 2 — `0x800BC8C4` (156 B) MATCH
+
+* Exact extent: `0x800BC8C4..0x800BC960`, 156 bytes, grade `exact`.
+* The adjacent `0x800BC960` call pattern transfers with the counter increment and new callees. The
+  decisive semantic correction is that both call pairs are nested under `v <= 0`; a positive old
+  counter jumps to the epilogue.
+* Tracked source md5: `558981805f2a0503029e288e43ca6d7b`; fresh range and candidate gate were
+  zero-difference. Promoted gate: 706 regions; `make check` passed.
+
+### Batch task 3 — `0x8006BB0C` (124 B) MATCH
+
+* Exact extent: `0x8006BB0C..0x8006BB88`, 124 bytes, grade `exact`.
+* The missing outer null check on a0 was the only structural correction. A V4 assignment produces
+  the four-word copy, followed by the target's conditional flag clear and same-pointer callback.
+* Tracked source md5: `abe883e5d229df0ce40cf91534f2d923`; fresh range and candidate gate were
+  zero-difference. Promoted gate: 707 regions; `make check` passed.
+
+### Batch task 4 — `0x8002D17C` (124 B) MATCH
+
+* Exact extent: `0x8002D17C..0x8002D1F8`, 124 bytes, grade `exact`.
+* The queue loop is reproduced with item-counter decrement, callback clear, queue update, and
+  indirect call. The final correction is an explicit `$5` binding for the current queue link,
+  matching the target's a1 allocation through the loop-back branch.
+* Tracked source md5: `aa3f06f4b3409f426afdc3875d833ec9`; fresh range and candidate gate were
+  zero-difference. Promoted gate: 708 regions; `make check` passed.
+
+**Batch checkpoint: 4 additional bodies / 4 regions matched; current count 699 bodies / 708 regions.**
+
+### Bounded attempts in the second batch — stopped without registration
+
+* `0x800321F8`: explicit branch/goto and register-binding forms reached 80/88/92-byte variants but
+  did not reproduce the target's three-block 96-byte epilogue/delay shape.
+* `0x8006F6F4`: direct globals and a v0 destination pointer did not reproduce the target's batched
+  four-word copy plus repeated absolute-field address forms.
+* `0x8002D9E0`: frameless/global, literal-base, and register-bound forms changed the target's
+  compact byte-indexed table loop; no candidate matched.
+* `0x800A4F20`: loop and unsigned-byte forms were 112/116/124 bytes rather than 108.
+* `0x80052FF4`: reached the exact 112-byte length but retained a six-byte constant-materialization
+  residual; no inline instruction was forced.
+* `0x80026460`: frameless linked-list forms retained a shared-epilogue/register tie.
+* `0x80050674`: staged 112-byte source remained one register-field byte different after bounded
+  pointer-sum and binding variants.
+* `0x800801B4`: table/indirect-call forms differed in address materialization and length.
+* `0x8002DCA8`: reached 108 bytes and four differing bytes; the remaining `move v0,a1` branch-delay
+  copy resisted named-result and decrement live-range forms.
+* `0x8002FCD0`: goto/switch dispatcher forms did not preserve all three case exits.
+* `0x80023CAC`: six-product arithmetic matched its first 132 bytes; the target's dead-looking
+  `a1[0]`/`sltiu` tail was not reproduced by tested liveness forms.
+* `0x800801B4`, `0x8002D17C` source staging variants not promoted are ignored; only the four tracked
+  sources above are registered.