phase10: ledger — within-worker size-band confirmation, harness-classification model, per-access gp pair

474 distinct bodies / 483 regions, +74 of +75, one from the milestone.

phase-ends/logs/Phase10.md

@@ -648,3 +648,49 @@ that its finding inverted an earlier broadcast.
 **Family lever working as advertised:** `0x800B67B8` is the caller of the registered `func_80082750`, and
 the callee's source supplied the `D_80121C00` spelling directly — it holds a base **pointer**, not the
 table address — so the argument map transferred with zero guessing.
+
+## Cycle 1 — merge 23 and the harness classification (2026-09-24)
+
+**474 distinct bodies / 483 regions** (from 400 / 409) — **+74 of the +75 milestone; ONE to go.**
+
+### The size-band result is now overwhelming, and it is within-worker
+
+Two independent measurements, one controlled and one within a single worker:
+
+| source | ≤200 B | 200 B–800 B |
+|---|---|---|
+| worker C (same worker/levers/day, band the only variable) | **1, 1, 1, 2** attempts | **1-in-12** |
+| worker B2 (within one session) | **1, 2, 2** attempts (claims 5-7) | the two >200 B rows it spent the *most* time on produced **1 deferred + 1 harness row, zero matches** |
+
+This is the phase's most reproducible finding and goes in the cookbook and the PhaseEnd record as the
+headline methodological result: **the matched corpus median is 48 bytes and 454/459 are ≤200 B, so size is
+the strongest predictor of yield left in the pool.**
+
+### A harness classification that is a proof rather than a give-up (worker B2, `0x80023D40`)
+
+5 differing bytes in 2 instructions, and B2's reasoning settles the class: cc1 duplicates the `slti` into
+the `bgez` delay slot, and **the duplication is CORRECT code** — the taken path has the un-negated `a0`, so
+the slot copy is valid, and the fall-through path re-tests the negated one. Therefore the original's `nop`
+is a **fill decision by a compiler that chose not to duplicate**, not a property of the source, and no
+source shape can prevent it. B2 tried the named lever first (two more spellings, 5 total, confirming cc1
+coalesces the local back onto `a0` every time) and *then* classified. **One attempt on a named lever, then
+classify** — recorded as the model for this kind of call.
+
+### Two more per-site gp confirmations, and a per-ACCESS pair inside one batch
+
+`gp=-D_80121BFC` was granted on `0x80048128`. The evidence is the strongest for that lever yet: the same
+symbol is read **gp-relatively** in B2's claim 7 row (`lw v1,708(gp)`) and **absolutely** in claim 5's row
+(`lui v1,0x8012` + `lw v1,7164(v1)`) — one symbol, two regions, opposite forms, one worker. That settles
+that the override is a **region** property, not a symbol property.
+
+### Levers recorded (all with controls)
+
+- **Scoping lever** (`0x8008BA80`): a local shared by two guard blocks gets its live ranges coalesced;
+  brace-scoping each block separately reproduces the original. Distinct from the named-locals family — it
+  is about *scope*, not naming.
+- **Evaluation order of two scaled terms** (`0x800504E4`): `base + a1*3072 + a0*384` scales `a1` first.
+  Extends the commutative-operand lever from the operands of one `+` to the order of two index computations.
+- **`sltiu` vs `slti` = unsigned loop counter**, one byte (opcode 0x0b vs 0x0a) — the loop-test form of the
+  signedness trap, which now has four instances.
+- **Mirror pair recorded:** B2's `0x800B67B8` needed conditions **combined** into one `&&` chain, while
+  `0x801008DC` is the inverse — the original keeps two `return 0` blocks **separate**. Two-sided rule.