re: builtin80 is a command -- and finding that exposed an 11.75% bug in my tracker

Reading builtin80's body (0x82268460) to name it: it is NOT a predicate.  It
allocates a 20-byte object, stamps vtable 0x820A8CB0, magic 0xAB0311BA and the
unit's live object into it, pushes it onto a queue via the same helper push.i uses,
and returns 1 -- or 0 when the unit is absent.  A command.

That made the conditions listing impossible: it showed a six-way switch
`if builtin80(TCT206) == 0 … == 5` on a function returning 1 or 0.  Disassembling the
site shows two unconditional `jmp`s between the call and the compare, so 0x1B6C0 is
reached ONLY by a branch and its special[0] has nothing to do with builtin80.

op12 is unconditional -- the next instruction is never reached by fall-through -- and
the tracker walked through it exactly as it had walked through end_coroutine.  Last
iteration I fixed the instance and not the class, leaving 22x more bad sites in place
than the fix removed.

A/B over all 28 stages, 7563 sites, resetting at jmp as well:
  sites whose operands change              889  (11.75%)
  LHS unresolved, before -> after     34 (0.45%) -> 756 (10.00%)

So the previous commit's headline "0.0% unresolved" was a MISSING CHECK, not a strong
result: the linear walk always had some value to report, and reporting it was the bug.
10% is the honest figure and the other 90% is trustworthy for a reason.

Also corrected: isl-unit-args.md illustrated its diff with 0x1B6C0, which is one of
the bogus sites.  The UNIT_ARG result itself stands -- it came from reading
implementations, not from this listing -- but the example was picked from bad output.

Not done, and said so: recovering the 756 needs a dataflow join over each block's
actual predecessors, a CFG fixpoint rather than a linear pass.  The branch targets are
all known so the CFG is available; the analysis is not written.

calls and phase-ends regenerate byte-identical; conditions changes on 187 lines.

tools/re-capture/isl.py

@@ -383,10 +383,15 @@ def conditions(b, sym1=None, sym2=None):
     push and pop balance at 1877 each with ZERO underflows, and in Stage 02
     all 319 `pop.i` sites are immediately followed by `cmp.i`.
 
-    The tracker resets at `end_coroutine`, which destroys the thread.  A/B over
-    all 28 stages: exactly 34 of 7563 sites change, and all 34 are the ones that
-    previously reported the impossible `end_coroutine` as a left-hand side.  They
-    become an explicit unknown rather than a wrong answer.
+    The tracker resets at every CONTROL-FLOW BOUNDARY: `end_coroutine` (returns 3,
+    destroying the thread) and `jmp` (unconditional, so the next instruction is
+    not reached by fall-through).  A linear walk cannot know a block's state when
+    that block is only ever entered by a branch, so those sites report an explicit
+    unknown instead of a stale value.
+
+    MEASURED over all 28 stages: resetting at `jmp` changes 889 of 7563 sites
+    (11.75%) and leaves 756 (10.00%) honestly unresolved.  Recovering those needs
+    a real dataflow join over each block's actual predecessors, not a linear walk.
     """
     bases = phase_bases(b)
     sp, loc, stack = {}, {}, []
@@ -439,6 +444,13 @@ def conditions(b, sym1=None, sym2=None):
                 # `end_coroutine` itself as the left-hand side of a comparison,
                 # which is impossible: it returns no value a script can test.
                 sp, loc, stack, pend = {}, {}, [], None
+        elif op == 12:
+            # An UNCONDITIONAL jump: execution never reaches the following
+            # instruction by fall-through, so whatever this walk is carrying is
+            # not that block's state.  Same bug class as `end_coroutine` below,
+            # and it is much bigger: 889 of 7563 sites (11.75%) had operands
+            # derived from state that leaked across a `jmp`.
+            sp, loc, stack, pend = {}, {}, [], None
         elif op == 21:
             stack.append(sp.get(1))
         elif op == 22:
@@ -452,7 +464,7 @@ def conditions(b, sym1=None, sym2=None):
             tgt = bases[ph - 1] + words[0] if words else None
             lhs = pend[1]
             if lhs.startswith('special['):
-                lhs = '<unknown: reached after a coroutine boundary>'
+                lhs = '<unknown: block entered by a branch, not by fall-through>'
             out.append({'off': pend[0], 'phase': ph, 'lhs': lhs,
                         'rel': REL[op], 'rhs': pend[2], 'branch': off,
                         'target': tgt})