diff --git a/docs/re/mission-phase-advance.md b/docs/re/mission-phase-advance.md
index 8f66c727..935d294d 100644
--- a/docs/re/mission-phase-advance.md
+++ b/docs/re/mission-phase-advance.md
@@ -115,6 +115,60 @@ in `hidden/MiscBin.pak`.
 **Finding it would give the actual per-phase clear condition for every stage** —
 which is the thing the port needs.
 
+### 🔴 2026-08-27 — the `.embsec_` candidate is REFUTED, and the pak route narrowed
+
+Both named candidates were tested statically, from the flat-VA `.pe` and the
+extracted paks. No emulator.
+
+**The seven `.embsec_` sections hold PPC CODE, not bytecode.** Parsed from the
+section table (they begin at file offset 592, forty bytes apart):
+
+| RVA | VirtSize |
+|---|---|
+| `0x84e800` | 39 340 |
+| `0x858200` | 42 168 |
+| `0x862800` | 7 436 |
+| `0x864600` | 23 680 |
+| `0x86a400` | 4 944 |
+| `0x86b800` | 3 272 |
+| `0x86c600` | 8 632 |
+
+Total **129 472 bytes** — matching this file's own "~130 KB" estimate, so these
+are the right sections. Their contents are unambiguous machine code: six of the
+seven begin `7d8802a6` (`mflr r12`) and every one contains the standard prologue
+(`9421ff??` `stwu r1,-N(r1)`, `fbc1fff0` `std r30,-16(r1)`, `4b??????` `bl`).
+**Script bytecode for a 147-builtin VM does not look like this.** ❌ Candidate
+eliminated.
+
+⚠️ A false lead recorded so it is not chased: `strings` reports `.embsec_P`,
+which looks like a longer truncated name. It is not — the name field is exactly
+`.embsec_` and the `P` is byte `0x50` of the following `VirtualSize` (`0x1350` =
+4 944, the fifth section's size).
+
+**The `MISSION_*_PRT` names ARE in the executable.** This file says grepping
+"returns nothing", but that grep was over the *disc extraction*; all five
+(`START`/`END`/`UPDATE`/`FAILED`/`RESTART`) are present in the image, in an
+`.rdata` string table that reads:
+
+```
+"SCRIPTS" "GP_SCRIPT" "script load cancel\n" "MISSION1" … "MISSION33"
+```
+
+So the loader's vocabulary is intact and includes a `GP_SCRIPT` archive name.
+
+**But the scripts are not pak records under any obvious name.** The paks are
+name-hash addressed (`unitgroup.name_hash`), so candidate names can be probed
+directly against every index rather than guessed at by eye: **616 distinct
+hashes** — `MISSION1..33` and the five `MISSION_*_PRT`, each under the prefixes
+`SCRIPTS\`, `GP_SCRIPT\`, `scripts\`, `script\`, `SCRIPT\` and none, with
+the suffixes `.prt`, `.PRT`, `.scr`, `.bin` and none — across **all 35 paks** in
+`dat/` and `hidden/`. **Zero hits.**
+
+❔ What is left: the payload is in the XEX's compressed/encrypted region (this
+file notes the retail `default.xex` was never decrypted), or under a name none of
+those 616 guesses covered. The `GP_SCRIPT` string is the strongest remaining
+thread — a pak of that name is referenced by the code but absent from the disc.
+
 ## ✅ Tooling correction: the `.pe` is NOT stale
 
 A standing note said "`.pe` STALE vs `sylpheed.db` — DB only". Wrong, and the