phase12: record second-batch checkpoint 4

docs/MATCHING_COOKBOOK.md

@@ -3408,3 +3408,20 @@ an unsigned global comparison and a `short` return to select `sltiu` and the fin
 
 These are the same structural-first discipline as finding 192, applied to rows small enough that
 a single mistaken offset or return edge dominates the entire comparison.
+
+### 195. Absolute bases and deliberate reloads are source-level facts (solo, Phase 12)
+
+The fourth checkpoint adds two useful confirmations. `0x8006F6F4` only matched after the absolute
+bases were corrected to `0x80133230/34/38` and `0x801332A0/A4/A8`; a nearby-looking `0x801323xx`
+reading produced a plausible 136-byte candidate with nine differing bytes. `0x800475CC` required
+repeated direct reads through `a1+0x0C` rather than reusing a pair pointer, and the three-element
+halfword array supplied the exact 8-byte frame and stack stores.
+
+> **When a direct candidate is close, re-derive every absolute address from the `lui` immediate
+> plus displacement, and preserve apparent reloads instead of letting ordinary C common-subexpression
+> elimination collapse them.** A large base-digit typo and a reused pointer can look like scheduler
+> noise, but both are source/dataflow errors.
+
+The explicit-label form used by `0x80066DA0` is a related control-flow lever: when an ordinary
+conditional emits the opposite branch polarity, a named label can preserve the target's basic-block
+order without inline assembly or a non-default compiler flag.

phase-ends/CURRENT_PHASE.md

@@ -6,18 +6,19 @@
 
 ## STATE — SOLO CONTINUATION, 2026-09-24 (current)
 
-**707 bodies / 716 regions**, from 685 / 694 at the last session stop — **+22 bodies / +22 regions**.
-The Phase 12 milestone remains 750 bodies, so **+43 remains**. The promoted whole-binary gate is green:
-`c_regions=716`, `differing_bytes=0`, SHA-1
+**711 bodies / 720 regions**, from 685 / 694 at the last session stop — **+26 bodies / +26 regions**.
+The Phase 12 milestone remains 750 bodies, so **+39 remains**. The promoted whole-binary gate is green:
+`c_regions=720`, `differing_bytes=0`, SHA-1
 `e173426c157384ebf1b6caf8c6fea18a85a14af9`; 344 synthetic tests pass and extents report
-`regions=716 disagreements=0 result=AGREE`.
+`regions=720 disagreements=0 result=AGREE`.
 
-The requested second batch of 20 is underway. Twelve additional bodies are now matched:
+The requested second batch of 20 is underway. Sixteen additional bodies are now matched:
 `0x800BC9C4`, `0x800BC8C4`, `0x8006BB0C`, `0x8002D17C`, `0x801029A0`, `0x80055958`,
-`0x80023A4C`, `0x8006BA3C`, `0x80086DBC`, `0x8007759C`, `0x800B6CB4`, and `0x80029E88`.
-Worklist regeneration is now 966 rows; `excluded_already_registered=714` continues the
-already-characterised two-row registry lag and is not a correctness issue because the 716-region
- gate proves the registry simultaneously.
+`0x80023A4C`, `0x8006BA3C`, `0x80086DBC`, `0x8007759C`, `0x800B6CB4`, `0x80029E88`,
+`0x800AC648`, `0x8006F6F4`, `0x80066DA0`, and `0x800475CC`. Worklist regeneration is now
+962 rows; `excluded_already_registered=718` continues the already-characterised two-row
+registry lag and is not a correctness issue because the 720-region gate proves the registry
+simultaneously.
 ## STATE — SESSION STOP, 2026-09-24 23:35 (historical; superseded by the state above, kept for provenance)
 
 **685 bodies / 694 regions**, from 602 / 611 at the Phase 11 close — **+83 bodies**. **Milestone 750 was NOT

phase-ends/logs/Phase12.md

@@ -2165,6 +2165,43 @@ confirmed.
 
 **Batch checkpoint: 12 additional bodies / 12 regions matched; current count 707 bodies / 716 regions.**
 
+### Batch task 13 — `0x800AC648` (76 B) MATCH
+
+* Exact extent: `0x800AC648..0x800AC694`, 76 bytes, grade `exact`.
+* Uses the sanctioned scratchpad-stack macros to call `func_800ABA28`, switch to
+  `0x1F8003DC`, call `func_800BBDF8` with the preserved s0 argument, and restore the original
+  stack pointer.
+* Tracked source md5: `3a5ae990da5c6b4d39291b2b3e95feae`; fresh range and candidate gate were
+  zero-difference. Promoted gate: 717 regions; `make check` passed.
+
+### Batch task 14 — `0x8006F6F4` (136 B) MATCH
+
+* Exact extent: `0x8006F6F4..0x8006F77C`, 136 bytes, grade `exact`.
+* Direct absolute globals at `0x80133230/34/38` and `0x801332A0/A4/A8` reproduce the V4 copy,
+  signed half-scaled corrections, and repeated address materializations. The temporary symbol
+  overlay used during validation was promoted by address-named source symbols without adding
+  registry rows.
+* Tracked source md5: `d854d91de96ca56f49853efcf7e3bc3b`; fresh range and candidate gate were
+  zero-difference. Promoted gate: 718 regions; `make check` passed.
+
+### Batch task 15 — `0x80066DA0` (140 B) MATCH
+
+* Exact extent: `0x80066DA0..0x80066E2C`, 140 bytes, grade `exact`.
+* The special index-23 arm uses an explicit nonzero-to-zero-store label, and the global halfword
+  is read as an absolute address rather than through its gp-marked registry alias.
+* Tracked source md5: `3da4e2503976d3fc597265c325ea3194`; fresh range and candidate gate were
+  zero-difference. Promoted gate: 719 regions; `make check` passed.
+
+### Batch task 16 — `0x800475CC` (116 B) MATCH
+
+* Exact extent: `0x800475CC..0x80047640`, 116 bytes, grade `exact`.
+* A three-halfword local array plus repeated `a1+0x0C` expressions reproduces the target's
+  deliberate pointer reloads, 8-byte frame, sign-extended output words, and sentinel return.
+* Tracked source md5: `23ef33015df4f8df0dadde8d7029d2dc`; fresh range and candidate gate were
+  zero-difference. Promoted gate: 720 regions; `make check` passed.
+
+**Batch checkpoint: 16 additional bodies / 16 regions matched; current count 711 bodies / 720 regions.**
+
 ### Bounded attempts in the second batch — stopped without registration
 
 * `0x800321F8`: explicit branch/goto and register-binding forms reached 80/88/92-byte variants but
@@ -2200,3 +2237,19 @@ confirmed.
   was promoted in this batch.
 * `0x80070454`: exact 72-byte initializer remained one call-block delay `nop` short after bounded
   goto and nested-call forms.
+* `0x80057E04`: the 120-byte linked-record updater was reduced to exact length but retained
+  frame/order differences after typed and raw-pointer forms; no source was promoted.
+* `0x800C110C`: pointer indirections and V4 loop were exact in structure, but the candidate
+  retained a four-byte tail scheduler gap; no source was promoted.
+* `0x800AA0A0`: the four-argument ABI and tree walk were reconstructed, but the target's
+  pre-branch v1 move and accumulator placement remained different; no source was promoted.
+* `0x800683E4`: the four-argument fallback shape was length-correct but retained branch polarity
+  and load-delay differences; no source was promoted.
+* `0x800AD068`: the interleaved 4/halfword insertion loop reached exact length but retained
+  count-copy and pointer-setup register-order differences; no source was promoted.
+* `0x800FECF8`: `/127` and `/16383` magic arithmetic was identified, but the fixed table base
+  still folded into a direct indexed load; no source was promoted.
+* `0x8010806C`: the 16-step clear loop had the right body but retained the alternate epilogue
+  shape and address split; no source was promoted.
+* `0x80072D0C`: the 60-byte node search was structurally reconstructed but retained frame and
+  loop-layout differences; no source was promoted.