diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index 733b08e..288ba83 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -233,6 +233,22 @@ unknown, what evidence exists, and what the first step would be. Move an item in
   **A and B stay unnamed** — the second tidy reading rejected for them, after
   previous/current-position.
 
+* ✅🔴 **(2026-08-27) `read_freg` READS THE TIMELINE'S CLOCK ARRAY — and my "six
+  clocks" framing is corrected.** Built-in 9 is inline in its stub (no vtable slot):
+  it bounds-checks **`0 <= local[0] < 32`** then `lwz r10, 88(r31)` /
+  `rlwinm i,2,0,29` / **`lfsx`** — a FLOAT from **`[phase+88][i]`**, which
+  `isl-builtins.md` already recorded. 🔑 **That is exactly the array the TIMELINE's
+  `kind` indexes**, so `kind` is not a selector over six private clocks but an index
+  into **the same 32-entry float register file the script reads with `read_freg(i)`**
+  — `read_freg(0) < 1200` in a clear condition and a timeline entry with `kind = 0`
+  read the same register. 🟡 **NUANCE, not asserted as a correction:** `clear_flag`
+  (93) clears a DIFFERENT 32-entry array — `[phase+120]`, looping to 128 in steps of
+  4 — not `[phase+88]`; `set_flag` (8) does bounds-check against `[phase+88]`, but
+  only its first 13 instructions were read. 🟡 **This does NOT settle the unit.**
+  `read_freg` returns a float from a register file; that seconds is the unit is still
+  INFERRED from the 210/300/600/1200 gate values, exactly as before. 🟡 Also open:
+  what writes `[phase+88]` — 73 writers in the ISL region alone.
+
 ## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
 
 `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the
diff --git a/docs/re/structures/isl-schedule.md b/docs/re/structures/isl-schedule.md
index b2a9adb..9b2a080 100644
--- a/docs/re/structures/isl-schedule.md
+++ b/docs/re/structures/isl-schedule.md
@@ -106,6 +106,24 @@ confirmed by the engine's own reader rather than by my structural inference.
 
 ### ✅ `kind` is a CLOCK INDEX, not a flag
 
+🔑 **(2026-08-27) And the array it indexes is the one `read_freg` exposes.**
+Built-in 9's stub bounds-checks `0 <= local[0] < 32` and then
+
+```
+822725E8  lwz  r10, 88(r31)          ; [phase+88]
+822725EC  rlwinm r11, r11, 2, 0, 29  ; i * 4
+822725F0  lfsx f0, r11, r10          ; a FLOAT
+```
+
+— exactly the array and the indexing the timeline walker uses. So `kind` is not a
+selector over some small private set of clocks: **it is an index into the same
+32-entry float register file the script reads with `read_freg(i)`.** A clear
+condition like `read_freg(0) < 1200` and a timeline entry with `kind = 0` read
+the same register.
+
+🔴 The "six clocks" framing below was mine and is too narrow — the file has **32**
+slots; the timeline data merely never uses more than indices 0 and 5.
+
 `rlwinm r11, r11, 2, 0, 29` then `lfsx` — `kind` is multiplied by 4 and used to
 index **float arrays at `[phase+104]` and `[phase+88]`**. So `kind` selects
 *which timer* the entry is scheduled against, and 0 / 5 are two of at least six.