diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index 94ddcb6a..9977ec00 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -994,8 +994,40 @@ premise was wrong.**
 * 🎯 **PROBE TARGET:** `CScriptInterpreter::ChangePhase` (`sub_822FF330`, opcode
   995) writes a runtime phase mirror at **`[*(0x828F35F8) + 236]`** — readable
   from `/dev/shm` with **no gdb**.
-* 🔴 **Not settled: the script bytecode is not on the disc under any obvious
-  name.** No `GP_SCRIPT.pak`; grepping the extraction for `MISSION_START_PRT`
+* ✅✅ **(2026-08-25) SCRIPT BYTECODE FOUND — `Stage\StageNN.ssb`** in
+  `dat/GP_MAIN_GAME_<L>.pak`. See `structures/mission-script-ssb.md`. The earlier
+  grep failed only because every pak entry is `Z1`+zlib. The loader resolves
+  **table keys, not a filename**: GamePart name → `GP_SCRIPT` → `script.tbl`
+  (`name_hash 0x75FE4656`), whose `SCRIPTS` record is a 40-field manifest
+  `MISSION1..MISSION29 → StageNN.ssb`. **28 scripts; S17 is the missing one** —
+  agreeing with the table sweep *and* with the loader guard
+  `if (n==16 || n>32) return` (so mission numbers there are **0-based**): three
+  independent routes to the same conclusion. Header decoded from
+  `ScriptMission::Load` itself. Stage02 = 226,596 B, md5 `aff69b5a…`, identical
+  in all 6 language paks. Symtab1 326 syms (197 messages, **119 route names**,
+  10 subobjectives), symtab2 122 (**111 unit ids** = exactly the 111
+  `UnitGroup_S02` squadrons). 🔑 **The route names are SCRIPT SYMBOLS** — which is
+  why nothing in the executable parses `Route_*_p<N>*`; the `_pN` convention is
+  the script's, resolved at compile time.
+* 🔴 **Refuted:** the 7 `.embsec_` sections are **code** (32,368 instructions,
+  108 functions with real prologues), not script; `MiscBin.pak` and
+  `DefTables.pak` have **zero** hits.
+* ❔ **NEXT, and it is the one that pays:** decode the **25 ISL opcodes**
+  (dispatcher `0x822635D4`, low byte of a BE u32, jump table `0x822635FC`) and
+  the **147 built-ins** (`0x8227226C`) against `Stage02.ssb`, hunting calls to
+  built-ins **6**/**62** — the two that set `[ScriptPhase+196]` and end a phase.
+  That gives the **actual per-phase clear condition for every stage**. The
+  mission-level stream at `+0x24` is partly read (3 groups, one per phase, each
+  ending in a pair of plausible ISL entry offsets) but `1883`'s operand is not
+  uniformly a pointer — two land on IEEE floats.
+* 🐛 **(2026-08-25) The nav fix is NOT fully reliable.** `dialog_up.py` works on
+  the saved frame (mean 34.3 vs threshold 45), and one boot went
+  readyroom-in-9 s — but a later boot logged "load dialog not up yet, retrying"
+  and still ended `NO readyroom within 300s`. So the retry loop can desynchronise
+  (a shot taken before the dialog renders reads as absent, and the *next* A then
+  answers NO). Needs a settle-and-recheck rather than one shot per attempt.
+* ~~🔴 **Not settled: the script bytecode is not on the disc under any obvious
+  name.**~~ No `GP_SCRIPT.pak`; grepping the extraction for `MISSION_START_PRT`
   returns nothing. Loader `sub_8225EE20` matches section names
   `MISSION1..MISSION33` + 5 `*_PRT`; `sub_8225EC78` gates `if (n==16 || n>32)`.
   Candidates: the **7 `.embsec_` sections** (VAs 0x84D0000–0x86AC000, ~129 KB