phase9: P9-T5 bounded investigation — route (a) closed, gap census + library-code evidence recorded

phase-ends/CURRENT_PHASE.md

@@ -202,3 +202,46 @@ excluded_no_extent=0             excluded_trapping_arith=50
 - P9-T5's trapping-arithmetic lead (worker B handoff) verified: 275 trapping
   words in un-extented gaps vs 661 inside extents — the finding-26 census is
   under-measured; the gap population is a bounded P9-T5 target.
+
+## P9-T5 — Trapping-arithmetic investigation (bounded, complete)
+
+**Route (a): can any available cc1 produce the trapping forms? → CLOSED as negative, with byte evidence.**
+Probe `neg_fun(x){return -x;} sub_fun(a,b){return a-b;}` compiled by all ten
+open cc1s (2.5.7, 2.6.0, 2.6.3, 2.7.2, 2.7.2-psx, 2.7.2-cdk, 2.8.0, 2.8.1,
+2.91.66, 2.95.2) at both -O0 and -O2: **zero** trapping `add`/`sub`/`neg`
+instructions anywhere. Every build prints `subu $3,$0,$2` for negation and
+`subu`/`addu` for arithmetic — none emit the `neg` macro GNU as would expand to
+the trapping `sub`. The original's trapping `sub` (funct 0x20/0x22 at
+0x8001F4E4-family) is NOT C from any available compiler. Finding 26's matrix
+is now confirmed independently with direct .s inspection.
+
+**Census corrected and widened (worker B's gap lead verified):**
+| Population | Trapping words |
+|---|---|
+| In extents (finding 26's 50 bodies) | 661 |
+| In un-extented gaps | 281 |
+| **Total** | **942** |
+| Inside registered regions | **0** |
+
+The class is fully disjoint from the matched corpus. Concentrated in
+`0x80010000..0x80030000` (480 words; runs at 0x8001FDA0 27 words and the
+repeated 4-word 0x8001F4F4 pattern) and scattered later bands. The code is
+REAL — coherent fixed-point/GTE-loader routines mixing trapping `sub` with
+`addu` (`0x8001FD40` region loads GTE regs through 0x1f800010). This is
+library code from a different (likely hand-assembled or SN32/PsyQ-3.x-era)
+toolchain — the best current evidence for part of the unresolved
+library-versus-game boundary.
+
+**Route (b): per-region transform.** The remaining path is a documented
+harness transform that rewrites a matched assembly stub's `sub`/`neg` (or a
+`sf3_match` post-pass emitting the trapping encodings) into the original
+bytes. This is a CONVENTION DECISION FOR THE DEVELOPER, not the coordinator's
+to take (plan P9-T5 route b is explicit): **report, do not implement
+unilaterally.** Recommended shape if approved: an assembly-authored region
+with an explicit per-region marker (analogous to maspsx=off), never a C
+source lying about `addu`. The class stays excluded from the worklist until
+then (46-trapping exclusion count).
+
+**Deliverable for P9-T8:** cookbook finding 26 updated with the gap census
+(942 vs 661), the direct probe evidence, and the 0x8001FDA0/0x8001F4F4
+cluster addresses as the class's strongest members.