phase12: match func_80095CF8 (695 bodies / 704 regions)

config/regions.tsv

@@ -451,6 +451,7 @@
 0x80093A64	0x80093A84	src/func_80093A64.c
 0x80094370	0x800943C4	src/func_80094370.c
 0x800943C4	0x800943E0	src/func_800943C4.c
+0x80095CF8	0x80095D74	src/func_80095CF8.c
 0x80096324	0x80096364	src/func_80096324.c
 0x80099024	0x80099078	src/func_80099024.c
 0x80099078	0x8009916C	src/func_80099078.c

docs/MATCHING_COOKBOOK.md

@@ -3340,3 +3340,23 @@ honest for the next coordinator, who will also write prose.
 
 **Cost, honestly:** one rejected merge, four correction messages, and roughly ten minutes. The phase's
 first successful merge followed immediately. The defect was cheap because the tool refuses to guess.
+
+### 191. A five-argument call can preserve incoming registers; do not infer arguments from copied locals (solo, Phase 12)
+
+The 124-byte `0x80095CF8` body copies two four-word records and then calls
+`func_80095820`. The target's first two call registers are the original incoming `a0` and the
+record pointer loaded from `a0+12`; they are **not** the first two words copied from that record.
+The correct source dataflow is:
+
+```c
+func_80095820(a0, p, &second, &first, 0);
+```
+
+with `p` bound to a1. The zero is the fifth argument and is emitted in the outgoing stack slot.
+Passing `p[0], p[1]` instead produces the right frame and local copies but adds an early address
+calculation and reloads, yielding 128 bytes. The named fixed object and the `second`-then-`first`
+declaration order are likewise required for the address form and sp+24/sp+40 local placement.
+
+> **When a call follows a batch copy, reconstruct the live values at the call from the register
+> dataflow, not from the values that happen to be copied first. A five-argument prototype can
+> preserve incoming registers while its final argument travels on the stack.**

phase-ends/CURRENT_PHASE.md

@@ -6,17 +6,17 @@
 
 ## STATE — SOLO CONTINUATION, 2026-09-24 (current)
 
-**694 bodies / 703 regions**, from 685 / 694 at the last session stop — **+9 bodies / +9 regions**.
-The Phase 12 milestone remains 750 bodies, so **+56 remains**. The promoted whole-binary gate is green:
-`c_regions=703`, `differing_bytes=0`, SHA-1
+**695 bodies / 704 regions**, from 685 / 694 at the last session stop — **+10 bodies / +10 regions**.
+The Phase 12 milestone remains 750 bodies, so **+55 remains**. The promoted whole-binary gate is green:
+`c_regions=704`, `differing_bytes=0`, SHA-1
 `e173426c157384ebf1b6caf8c6fea18a85a14af9`; 344 synthetic tests pass and extents report
-`regions=703 disagreements=0 result=AGREE`.
+`regions=704 disagreements=0 result=AGREE`.
 
-The ninth successful body is `0x800B2488` (100 bytes), completing the requested ten-function work
-attempt set with one additional successful body still needed to reach ten *matches*. Worklist
-regeneration is now 979 rows; `excluded_already_registered=701` continues the already-characterised
-two-row registry lag and is not a correctness issue because the 703-region gate proves the registry
-simultaneously.
+The requested ten successful matches are complete. The tenth is `0x80095CF8` (124 bytes), which
+closes the two-vector copy/call row by preserving the original's five-argument dataflow: incoming
+`a0`, record pointer, two local-vector addresses, and stack zero. Worklist regeneration is now 978
+rows; `excluded_already_registered=702` continues the already-characterised two-row registry lag and
+is not a correctness issue because the 704-region gate proves the registry simultaneously.
 
 ## STATE — SESSION STOP, 2026-09-24 23:35 (historical; superseded by the state above, kept for provenance)
 

phase-ends/logs/Phase12.md

@@ -2034,3 +2034,23 @@ confirmed.
   `excluded_already_registered=701`, preserving the known two-row lag.
 
 **Count after task 10: 694 bodies / 703 regions (+92 bodies from the Phase 12 open baseline).**
+
+### Final tenth successful body — `0x80095CF8` (124 B) MATCH
+
+* Exact extent: `0x80095CF8..0x80095D74`, 124 bytes, grade `exact`, no duplicate group.
+* The fixed object at `0x8010D760` is named `D_8010D760` so the compiler emits the target's
+  `lui`/`addiu` address materialization. The record pointer is loaded from `a0+12` into a1-bound
+  `p`; the two four-word copies are placed at sp+24 and sp+40 by the declaration order.
+* The call is five arguments: incoming `a0`, record pointer `p`, `&second`, `&first`, and zero.
+  The zero is the outgoing stack argument. Correcting an earlier four-argument draft that passed
+  `p[0]`/`p[1]` was the final root cause: the target leaves the original a0 and p in the first
+  two argument registers and only then overwrites a2/a3 with the local addresses.
+* Tracked source md5: `28a8c980426895a4c5778bd9d0fe6f29`. Fresh tracked range: 124 bytes,
+  `differing_bytes=0 result=MATCH`.
+* `sf3_merge` accepted the claim. Candidate whole-binary gate: 704 regions, 0 differing bytes, both
+  SHA-1 values `e173426c157384ebf1b6caf8c6fea18a85a14af9`, exit 0.
+* Promoted `make check`: 344 tests OK; extents `regions=704 disagreements=0`; gate
+  `c_regions=704 differing_bytes=0 result=MATCH`. Worklist is now 978 rows and reports
+  `excluded_already_registered=702`, preserving the known two-row lag.
+
+**Final count after the tenth successful body: 695 bodies / 704 regions (+93 bodies from the Phase 12 open baseline).**

src/func_80095CF8.c

@@ -0,0 +1,37 @@
+/*
+ * func_80095CF8 — 124 bytes at 0x80095CF8..0x80095D74
+ *
+ * Copies the four-word object at the fixed address D_8010D760 to the first local vector,
+ * copies the four-word record reached through a0+12 to the second local vector, and calls
+ * func_80095820 with the incoming a0, the record pointer, the two vector addresses, and a
+ * stack-passed zero.
+ *
+ * The source shape is byte-required. The fixed object is named so the compiler emits the
+ * original's two-instruction address materialization (lui/addiu); the locals are declared in
+ * second/first order to place them at sp+24 and sp+40; and the record pointer is bound to a1
+ * so the call keeps the incoming a0 and record pointer in the first two argument registers.
+ * The fifth zero argument is intentionally passed even though it is placed in the outgoing
+ * stack argument area by the target calling sequence.
+ *
+ * LIMITS: the meanings of D_8010D760, the record at a0+12, the two vector arguments, and the
+ * callee are not inferred here. The address materialization, pointer load at a0+12, four-word
+ * copies, local offsets, argument registers, stack zero, frame, and return path are byte
+ * evidence from the USA executable.
+ */
+
+typedef struct { int x0, x1, x2, x3; } V4;
+
+extern V4 D_8010D760;
+extern void func_80095820(int *, int *, V4 *, V4 *, int);
+
+void func_80095CF8(int *a0)
+{
+    V4 second;
+    V4 first;
+    register int *p __asm__("$5");
+
+    first = D_8010D760;
+    p = *(int *)((char *)a0 + 12);
+    second = *(V4 *)p;
+    func_80095820(a0, p, &second, &first, 0);
+}