Sylpheed/docs/re/isl-coroutine-spawner.md

✅ sub_822737C8 is the coroutine spawner — and its seven callers name the whole start-up path

Asking who calls the thing the timeline calls turns out to enumerate every way an ISL routine can begin.

sub_822737C8(phase, base, offset) — add r9, r4, r28 computes base + offset early on, so the third argument is a phase-relative code offset.

The seven call sites

site	in	what it starts
0x82271030	sub_82270DF8 — the phase initialiser	the phase's main entry (the 0x1883 record's third word)
0x822724D0	the built-in stub region	start_coroutine's target
0x82274934	sub_822748D0 — the timeline walker	a scheduled routine
0x8226D8D0	sub_8226D740 — the per-frame engine→script drain	an offset from [node+112]
0x8226DA10	the same drain, second path	the same [node+112]
0x82273938	sub_82273910	not read
0x82264080	sub_82264058	not read

✅ The phase's main entry — a correction

isl-stream-entry-points.md called the record's third word a size. It is not: the initialiser hands it to the spawner as an offset.

• 44 of 44 records land on the instruction stream — 100 %, against a 25.0 % control.
• All three of Stage 02's targets begin with the same prologue, special[0] = 0 ; local[0] = 0 ; call builtin116(0), which is a routine entry and not a length.

So the record reads 0x1883, base, MAIN_ENTRY, 0, code_end, force_end_handler.

🟡 Seeding it changes nothing measurable — every main entry was already among the CFG's entry points by another route — so this corrects the meaning of a field without moving any coverage number.

🔑 The drain spawns from [node+112]

The two calls inside sub_8226D740 both do

lwz  r5, 112(r31)      ; the routine offset, out of the node
lwz  r4, 232(r29)      ; the phase's code base
bl   0x822737C8

isl-builtins.md describes sub_8226D740 as the per-frame engine→script drain, and here it is spawning routines from a code offset carried in the drained node at +112. That is the first field of a trigger-style node to be located, and it is the most promising remaining lead on the routines nothing else starts.

🟡 Not settled

• +112 is a field of some node — this does not show the node comes from the trigger queue at phase+272. That link is exactly the over-reach isl-builtins.md already recorded and withdrew once; it is not asserted here.
• Two callers unread: sub_82273910 and sub_82264058.
• Whether the drain's nodes explain the unreached routines is untested. It is a lead, not a result.