diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index c9fef6d1..ca5bcc9a 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -170,6 +170,24 @@ unknown, what evidence exists, and what the first step would be. Move an item in
   testers, what the kind-1 path does with the route, and the drain's second spawn
   site `0x8226DA10`.
 
+* ✅ **(2026-08-27) BOTH trigger kinds watch a ROUTE.
+  [structures/isl-trigger-node](structures/isl-trigger-node.md).** The kind-0
+  condition `sub_8226DAF8` resolves a symbol from **`payload+4`** through
+  `[phase+244]` = symtab 1 (`rlwinm r10,r5,2,0,29; lwz r11,244(r30); lwzx`), and
+  both appenders write `local[12]` into the slot their own path reads. **`local[12]`
+  resolves 79/79 (built-in 19) and 25/25 (built-in 25), every one symbol TYPE 1 =
+  `Route_*`** (`Route_ADN106_p1F`, `Route_ADS101_p1F`, `Route_TCN004_p1S`). So both
+  register **a trigger on a UNIT reaching a ROUTE** (`payload+0` = the unit); they
+  differ only in the payoff — built-in 19 also carries a **handler routine**
+  (`local[32]`→`+28`, kind 0 → spawn), built-in 25 carries none (kind 1 → no spawn).
+  Third independent agreement with `SYM1_SLOTS`, which lists slot 12 for both.
+  🔑 Joins up with the closed `REMAINING OB` result (the counter rises **at a
+  squadron's route arrival time**) — 🟡 stated as a connection, not a demonstration.
+  🟡 Still unread: what the conditions COMPARE (only `sub_8226DAF8`'s first ~34
+  instructions are read, up to the name lookup; `sub_8226DC80` entirely), and
+  `payload+8` (a computed value passed to both testers — waypoint-index shaped,
+  which is why it is not being called one).
+
 ## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
 
 `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the
diff --git a/docs/re/structures/isl-trigger-node.md b/docs/re/structures/isl-trigger-node.md
index 332a01a8..9606cd44 100644
--- a/docs/re/structures/isl-trigger-node.md
+++ b/docs/re/structures/isl-trigger-node.md
@@ -167,13 +167,57 @@ conclusion**.
 **The two built-ins register two kinds of trigger:** built-in 19 a trigger whose
 payload is a *handler routine*, built-in 25 one whose payload is a *route*.
 
+## ✅ BOTH trigger kinds watch a ROUTE
+
+The kind-0 condition tester `sub_8226DAF8` resolves a symbol too — from
+`payload+4`, not `+28`:
+
+```
+8226DB14  rlwinm r10, r5, 2, 0, 29   ; r5 = payload+4, x4
+8226DB24  lwz    r11, 244(r30)       ; [phase+244] = SYMBOL TABLE 1
+8226DB3C  lwzx   r10, r10, r11       ; resolve it
+8226DB50  addi   r4, r11, 4          ; -> the name string
+8226DB54  bl     0x8217FA08
+```
+
+Both appenders write `local[12]` into the slot their path reads — built-in 19
+into `+4`, built-in 25 into `+4` *and* `+28`. So the same operand is the symbol
+in both cases, and it resolves:
+
+| | `local[12]` through symbol table 1 | symbol type |
+|---|---|---|
+| built-in 19 | **79 / 79** | **all type 1** |
+| built-in 25 | **25 / 25** | **all type 1** |
+
+`isl-builtins.md` records symtab-1 **type 1 as the `Route_*` names** (1362
+entries), and the samples bear it out: `Route_ADN106_p1F`, `Route_ADN1xxe1_p1F`,
+`Route_ADS101_p1F`, `Route_TCN004_p1S`.
+
+**So both built-ins register a trigger on a UNIT reaching a ROUTE** — `payload+0`
+is the unit, `local[12]` the route. They differ only in what happens when it
+fires: built-in 19 additionally carries a **handler routine** (`local[32]` →
+`payload+28`, kind 0 → spawn); built-in 25 carries none (kind 1 → no spawn).
+
+This also confirms `isl.py`'s `SYM1_SLOTS`, which lists slot 12 for **both** 19
+and 25 and was derived from operand ranges alone — a third independent agreement
+with that table.
+
+🔑 It joins up with the closed `REMAINING OB` result, where the counter was
+measured to rise **at a squadron's route arrival time**. Route triggers are the
+mechanism that would do that. 🟡 Stated as a connection, not a demonstration —
+nothing here traces a trigger to that counter.
+
 ## 🟡 Not settled
 
 * ~~What the drain actually spawns.~~ ✅ Resolved above: built-in 19's nodes carry
   a real routine offset at `+28`.
 * ~~Whether `+24` selects between the two node kinds~~ ✅ It does — see above.
-* **The two condition testers are unread**: `sub_8226DAF8` (kind 0) and
-  `sub_8226DC80` (kind 1), each gating its path on a `== 1` result.
+* **What the conditions actually TEST.** Only `sub_8226DAF8`'s first ~34
+  instructions are read — up to the route-name lookup. What it compares the route
+  against, and the whole of `sub_8226DC80` (kind 1), are unread.
+* **`payload+8`** is a computed value in both appenders (`r29-1` in built-in 19)
+  and is passed to both testers; a waypoint index would fit, which is exactly why
+  it is not being called one.
 * **What the kind-1 path DOES with the route** past `sub_8217FA08` /
   `sub_8218CC88` / `sub_8225FEA0` is unread.
 * **The drain's second spawn site** (`0x8226DA10`) is in a later block and was