From 28afb3c49c8b18d9162adf5cd351f89e98da9f0b Mon Sep 17 00:00:00 2001
From: Drew T <50529377+Druthulu@users.noreply.github.com>
Date: Tue, 23 Jun 2026 11:12:15 -0600
Subject: [PATCH] =?UTF-8?q?docs(phase-21):=20distill=20=E2=80=94=20per-acc?=
 =?UTF-8?q?ess=20(volatile=20T*)=20field-reload=20idiom=20from=20func=5F80?=
 =?UTF-8?q?1424E4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/matching-cookbook.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/docs/matching-cookbook.md b/docs/matching-cookbook.md
index 227fe691b..59ffdefcc 100644
--- a/docs/matching-cookbook.md
+++ b/docs/matching-cookbook.md
@@ -1589,6 +1589,21 @@ byte-matched evidence fn. (Pins/array-decay/statement-order/shared-ret0/for-vs-d
   whenever the target re-reads a global it just stored a literal into. *fixes a folded-away `lhu` reload + merged
   double `sh` to one global; evidence func_801806D8 (`volatile u16 D_80126B96; D_x=2; D_x=D_x|0x4000;` →
   `sh 2; lhu; ori 0x4000; sh`, byte-gated 56 ins).*
+- **force ONE specific field/pointer load to RELOAD (target re-emits `lw K(base)` where gcc -O2 CSEs it across
+  intervening calls/non-field stores) → cast THAT access `*(volatile T*)`, NOT a global `__asm__` fence:** when the
+  target reads a struct field through a pointer twice (`lw 0x64($s0)` … other code (calls, stores to *unrelated*
+  addresses) … `lw 0x64($s0)` again) but gcc -O2 keeps the first load cached in a register (a single `lw`, the
+  field reused via regalloc — so neither statement-order nor a constant store-forward defeats it), wrap **each
+  reload site** in a volatile pointer cast: `iVar = *(volatile int *)(param_1 + 0x32);` (and reuse it for the
+  follow-on field reads off `iVar`). The `volatile` makes that ONE access a non-CSE-able memory reference, so gcc
+  re-emits `lw 0x64($s0)` there, while leaving all other scheduling untouched. This is the SURGICAL reload lever —
+  distinct from the §21 non-volatile `__asm__("":::"memory")` clobber (a function-wide fence, for a *derived-index*
+  CSE), the statement-order reload (needs an *unrelated field store* to fall between the two reads), and the §22
+  `volatile`-qualified GLOBAL (defeats *constant store-forwarding* of a known literal): here the CSE'd thing is a
+  *runtime field load* reused via register, the intervening ops are calls/foreign stores (not a usable field-store),
+  and you must NOT add a global barrier (it perturbs the rest of the schedule). *fixes a folded-away 2nd/3rd `lw <field>`
+  reload of a pointer-reached struct field across intervening calls; evidence func_801424E4 (`*(volatile int*)(param_1+0x32)`
+  ×2 → `lw 0x64($s0)` re-emitted at each use, byte-gated 58 ins).*
 
 > **⚠ CANDIDATE (unverified) — the next two bullets are from `func_801775E0`, a NEAR-MISS (closeness 2, NOT
 > byte-banked)**, appended directly by a wave-13 drafter (that drafter→cookbook path is now blocked, `commit:0219`).