re: read_freg reads the timeline's clock array -- "six clocks" was my mislabel

Built-in 9 is inline in its stub, with no vtable slot.  It bounds-checks
0 <= local[0] < 32 and then:

    822725E8  lwz    r10, 88(r31)          ; [phase+88]
    822725EC  rlwinm r11, r11, 2, 0, 29    ; i * 4
    822725F0  lfsx   f0, r11, r10          ; a FLOAT

isl-builtins.md already recorded read_freg(i) -> [phase+88][i].  What is new is that
this is exactly the array, and exactly the indexing, that the TIMELINE walker uses for
its `kind` field.  So kind is not a selector over six private clocks -- it is an index
into the same 32-entry float register file the script reads with read_freg(i).  A
clear condition like `read_freg(0) < 1200` and a timeline entry with kind = 0 read the
same register.  My "six clocks" framing came from the data only ever using indices 0
and 5, and it is corrected in isl-schedule.md.

Recorded as a nuance rather than a correction, because it is half-read: clear_flag
(93) clears a DIFFERENT 32-entry array, [phase+120], looping to 128 in steps of 4 --
not [phase+88].  set_flag (8) does bounds-check against [phase+88], but only its first
13 instructions were read, so the corpus's grouping of 8/9/93 as one "32-entry file"
family is neither confirmed nor overturned here.

This does NOT settle what the item actually asked: read_freg returns a float out of a
register file, and that the unit is seconds remains INFERRED from the 210/300/600/1200
gate values, exactly as it was before.  Also still open: what writes [phase+88], which
has 73 writers in the ISL region alone.

All artefacts regenerate byte-identical; documentation only.

docs/re/BACKLOG.md

@@ -233,6 +233,22 @@ unknown, what evidence exists, and what the first step would be. Move an item in
   **A and B stay unnamed** — the second tidy reading rejected for them, after
   previous/current-position.
 
+* ✅🔴 **(2026-08-27) `read_freg` READS THE TIMELINE'S CLOCK ARRAY — and my "six
+  clocks" framing is corrected.** Built-in 9 is inline in its stub (no vtable slot):
+  it bounds-checks **`0 <= local[0] < 32`** then `lwz r10, 88(r31)` /
+  `rlwinm i,2,0,29` / **`lfsx`** — a FLOAT from **`[phase+88][i]`**, which
+  `isl-builtins.md` already recorded. 🔑 **That is exactly the array the TIMELINE's
+  `kind` indexes**, so `kind` is not a selector over six private clocks but an index
+  into **the same 32-entry float register file the script reads with `read_freg(i)`**
+  — `read_freg(0) < 1200` in a clear condition and a timeline entry with `kind = 0`
+  read the same register. 🟡 **NUANCE, not asserted as a correction:** `clear_flag`
+  (93) clears a DIFFERENT 32-entry array — `[phase+120]`, looping to 128 in steps of
+  4 — not `[phase+88]`; `set_flag` (8) does bounds-check against `[phase+88]`, but
+  only its first 13 instructions were read. 🟡 **This does NOT settle the unit.**
+  `read_freg` returns a float from a register file; that seconds is the unit is still
+  INFERRED from the 210/300/600/1200 gate values, exactly as before. 🟡 Also open:
+  what writes `[phase+88]` — 73 writers in the ISL region alone.
+
 ## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
 
 `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the

docs/re/structures/isl-schedule.md

@@ -106,6 +106,24 @@ confirmed by the engine's own reader rather than by my structural inference.
 
 ### ✅ `kind` is a CLOCK INDEX, not a flag
 
+🔑 **(2026-08-27) And the array it indexes is the one `read_freg` exposes.**
+Built-in 9's stub bounds-checks `0 <= local[0] < 32` and then
+
+```
+822725E8  lwz  r10, 88(r31)          ; [phase+88]
+822725EC  rlwinm r11, r11, 2, 0, 29  ; i * 4
+822725F0  lfsx f0, r11, r10          ; a FLOAT
+```
+
+— exactly the array and the indexing the timeline walker uses. So `kind` is not a
+selector over some small private set of clocks: **it is an index into the same
+32-entry float register file the script reads with `read_freg(i)`.** A clear
+condition like `read_freg(0) < 1200` and a timeline entry with `kind = 0` read
+the same register.
+
+🔴 The "six clocks" framing below was mine and is too narrow — the file has **32**
+slots; the timeline data merely never uses more than indices 0 and 5.
+
 `rlwinm r11, r11, 2, 0, 29` then `lfsx` — `kind` is multiplied by 4 and used to
 index **float arrays at `[phase+104]` and `[phase+88]`**. So `kind` selects
 *which timer* the entry is scheduled against, and 0 / 5 are two of at least six.