re: the Time/Points record is not on the debriefing path - and a ring drainer matches the message bus

Read 0x821A0AD0, the debriefing, end to end, resolving every call and string in
code order. The word-B bit-setter sub_8219F2E8 is its FIRST call, before anything
else; the function makes 44 calls and references exactly two strings, DEBRIEFING
and BASE_INFO.

No Time and no Points anywhere on this path - not in the debriefing, not in the
bit-setter. Section 5.3's expectation that clearing a challenge stage records its
metric alongside the bit is not supported by the code that clears it. The reach of
that negative: the debriefing function and its directly-called bit-setter, both
read whole; it does not rule out a store deeper inside one of the other 43
callees.

0x8219F670 turns out to be an online-state predicate: 88 bytes, no strings, reads
the singleton, tests bit 1 of [0]+60, and if set passes [0]+64 to 0x824A9C90 and
returns whether the result is 2. A connection or sign-in check, not a record
store.

The useful find is 0x8219F460, 368 bytes and self-recursive, which drains a ring
based at r29+320 with element base +4, capacity +8, head +12 and count +16. Those
are the corpus's documented message-bus offsets exactly - BACKLOG records
sub_82175C20(bus+4, &msg) as a ring-buffer append with capacity +8, head +12,
count +16 - and sub_82175C20 is the very notifier section 5.6 found the word-B
writer calling with bit + 64. So the open question "ring-buffer PUSH, no handler"
now has a candidate drainer with a byte-for-byte matching field layout, reached
from the debriefing.

What is NOT shown is that these are the same ring instance. The push targets
bus+4, this drain targets r29+320. Matching offsets prove a shared container
shape, not a shared object, and the identity needs the two base pointers tied
together.

All seventeen artefacts byte-identical.

docs/re/BACKLOG.md

@@ -7120,3 +7120,29 @@ after B) before/after the setter and loops its 32 bits calling `0x82175C20` with
 ⚠️ **Against §5.3's prediction:** neither the writer nor its caller references
 `Time` or `Points` (0 both). It is the **bit-setter only**; the Time/Points record
 store is still unlocated.
+
+---
+
+## ❌🔑 2026-08-28 — the Time/Points record is not on the debriefing path; a ring drainer matches the message bus
+
+Read `0x821A0AD0` (the debriefing) end to end. **The word-B bit-setter
+`sub_8219F2E8` is its FIRST call**; the function makes 44 calls and references
+exactly two strings, `DEBRIEFING` and `BASE_INFO`.
+
+❌ **No `Time` or `Points` anywhere on this path** — so §5.3's expectation that the
+metric is recorded alongside the clear bit is not supported by the clearing code.
+**Reach:** the debriefing and its bit-setter, read whole; a store deeper inside one
+of the other 43 callees is not excluded.
+
+✅ **`0x8219F670` is an online-state predicate** — tests bit 1 of singleton
+`[0]+60`, passes `[0]+64` to `0x824A9C90`, returns `result == 2`.
+
+🔑 **`0x8219F460` (368 B, self-recursive) drains a ring based at `r29+320`** with
+element base `+4`, capacity `+8`, head `+12`, count `+16` — **the corpus's
+documented message-bus offsets exactly** (`sub_82175C20(bus+4, &msg)` is the
+append, capacity `+8`, head `+12`, count `+16`), and `sub_82175C20` is the same
+notifier §5.6 found the word-B writer calling. The open 🟡 "ring-buffer PUSH, no
+handler" now has a **candidate drainer with a matching layout**.
+
+🟡 **Not shown: same ring INSTANCE.** Push targets `bus+4`, drain targets
+`r29+320`. Matching offsets prove a shared container *shape*, not a shared object.

docs/re/challenge-mission-gate.md

@@ -626,3 +626,47 @@ announced one at a time — an unlock-notification loop.
 caller references **`Time`** or **`Points`** (0 for both). §5.3 expected word B's
 writer to also store the stage's Time/Points record. **It does not — this is the
 bit-setter only.** The record store is still unlocated.
+
+### 5.7 ❌ The Time/Points record is NOT on the debriefing path — and a ring drainer turns up
+
+Reading `0x821A0AD0` (the debriefing) end to end, resolving every call and string
+in code order:
+
+* **The word-B bit-setter `sub_8219F2E8` is its FIRST call** (`0x821A0B1C`),
+  before anything else.
+* **44 calls, and exactly two strings in the whole function: `DEBRIEFING` and
+  `BASE_INFO`.**
+
+❌ **No `Time`, no `Points`, anywhere on this path** — not in the debriefing, not
+in the bit-setter. §5.3's expectation that clearing a challenge stage records its
+metric alongside the bit is **not supported by the code that clears it**. Reach of
+this negative: the debriefing function and its directly-called bit-setter, read
+whole; it does not rule out a store further down one of the other 43 callees.
+
+✅ **`0x8219F670` is an online-state predicate.** 88 bytes, no strings: reads the
+singleton, tests bit 1 of `[0]+60`, and if set passes `[0]+64` to `0x824A9C90`
+and returns `result == 2`. A connection/sign-in check, not a record store.
+
+#### 🔑 `0x8219F460` drains a ring with the message bus's exact field layout
+
+`0x8219F460` (368 B, self-recursive) pops from a ring based at `r29+320`:
+
+| offset from the ring base | role, from the code |
+|---:|---|
+| `+4` | element array base (`lwzx r10, r10, r8`) |
+| `+8` | capacity (compared against head) |
+| `+12` | head (incremented, wrapped to 0) |
+| `+16` | count (`addic. r10, r10, -1`) |
+
+⚠️ **Those are the corpus's documented message-bus offsets, exactly**: `BACKLOG`
+records `sub_82175C20(bus+4, &msg)` as "a ring-buffer append (capacity `+8`, head
+`+12`, count `+16`)". And **`sub_82175C20` is the very notifier §5.6 found the
+word-B writer calling** with `bit + 64`.
+
+So the corpus's open 🟡 "ring-buffer PUSH, no handler" now has a **candidate
+drainer with a byte-for-byte matching field layout**, reached from the debriefing.
+
+🟡 **Not shown: that these are the same ring *instance*.** The push targets
+`bus+4`; this drain targets `r29+320`. Matching offsets prove a shared *shape* —
+the same container template — not a shared object. **Same layout ≠ same
+instance**, and the identity needs the two base pointers tied together.