phase10: convention — inline asm sanctioned for shapes plain C provably cannot express

Developer decision (2026-09-24), extending Phase 8's coprocessor/kernel allowance.
Trigger conditions recorded: plain C attempted and mechanism identified; the
inexpressibility is structural rather than a scheduling/allocation tie-break;
integer logic stays in C and scheduling still comes from cc1/maspsx; per-file
header documents the sequence, the reason and the limit.

First accepted instance: the PSX scratchpad stack switch (lui at,0x1f80 /
sw sp,1020(at) / lui sp,0x1f80 / ori sp,sp,0x3dc ... / lw sp,1020(sp)), found
independently by workers A (0x800BC658) and B (0x800BC6EC). A stack-pointer READ
was already covered by the register-name binding and needs no exemption; only the
switch does.

Explicitly does NOT reopen trapping-arithmetic, rare-epilogue or primitive-init.

docs/MATCHING_CONVENTIONS.md

@@ -91,6 +91,28 @@ complete*, so `excluded_trapping_arith=0` does not mean a row is matchable.
 A **register-name binding is not inline assembly** and needs no exemption: `register int sp __asm__("$29")`
 is a documented GNU C extension and reproduces the stack accessor exactly.
 
+### Phase 10 extension: shapes plain C provably cannot express
+
+**Accepted, developer decision, 2026-09-24.** The boundary above is extended from "instructions C cannot
+*name*" to "shapes C provably cannot *express*". The trigger is narrow and must be demonstrated, not
+asserted:
+
+- plain C has been attempted and the mechanism is identified — not "I did not find a spelling";
+- the inexpressibility is structural, not a scheduling or allocation tie-break: the register the C
+  code would have to reassign is one cc1 controls for its own purposes;
+- the integer logic still stays in C, the scheduling still comes from `cc1`/`maspsx`, and no whole
+  function is written as assembly;
+- the file's header records the observed instruction sequence, why C cannot express it, and the limit.
+
+First accepted instance: the **PSX scratchpad stack switch** (`lui at,0x1f80` / `sw sp,1020(at)` /
+`lui sp,0x1f80` / `ori sp,sp,0x3dc` … / `lw sp,1020(sp)`). cc1 cannot emit a reassignment of `sp` from
+plain C, and two workers independently found bodies using the idiom (`0x800BC658`, `0x800BC6EC`), which
+is what made it worth a ruling. Note the sibling case already covered above: a *read* of the stack
+pointer is a register-name binding and needs no exemption; only the **switch** does.
+
+This extension does **not** reopen the trapping-arithmetic, rare-epilogue or primitive-init classes —
+those are compiler/harness limits with no C-inexpressibility, and they stay excluded.
+
 ## Duplicate bodies
 
 A body shared by several addresses is matched **once** and registered several times against the same