re: the trigger-queue appender found -- sub_8226EAB8, count at inner+8

The watchpoint plus Canary's source settle it. At the write, the guest context
(rsi, per x64_emitter.cc:881) holds 0x8226EAE0, inside sub_8226EAB8. That
function is a generic list-node insert: it reads the count at 8(r30), guards
against 0x3FFFFFFF overflow, does addi r11,r11,1 / stw r11,8(r30), then links the
node. It has 16 callers, so it is a shared container helper.

That explains why two static searches missed it. The trigger container at
phase+272 EMBEDS an inner list object at +12 -- which is why the push does
'addi r31, r30, 12' -- and the inner object keeps its count at its own +8. So
272 + 12 + 8 = 292 = the watched word, and the instruction is stw r11, 8(r30)
with r30 = phase+284. Searching for 'stw rN, 20(rM)' could never have found it.

Also resolves the earlier open item on +12: it is the embedded list object, not
a list head pointer, which is why it read 0x000A0009 instead of an address.

Method note kept: the static hunt assumed the field's offset in the OUTER object
would appear in the writing instruction. A watchpoint is indifferent to the
addressing form, which is why it was the right tool after two failed offset
searches.

tools/re-capture/trigger_watch.sh

@@ -31,6 +31,23 @@ for t in 1 2 3; do
   fi
 done
 
+# One run reached "IN FLIGHT" with the script NOT resident and the mission
+# unlocatable -- and it was frozen on a black screen soon after
+# (script-runtime-probe.md). A healthy run has the script resident at the first
+# sample, so a short poll separates "not loaded yet" from "this run is broken"
+# without waiting on a doomed one.
+ok=0
+for _ in 1 2 3 4 5 6; do
+  if python3 -c "
+import sys,os; sys.path.insert(0,'$SD')
+import squadron_state as S, isl, gmem
+ssb=isl.load('/tmp/Stage02.ssb'); p=gmem.mem_path()
+with open(p,'rb',buffering=0) as f:
+    sys.exit(0 if S._find(f, os.path.getsize(p), ssb[:20]) else 1)"; then ok=1; break; fi
+  echo "--- script not resident yet"; sleepfor 10
+done
+[ $ok = 1 ] || { echo "SCRIPT NEVER BECAME RESIDENT -- run is broken, not slow"; exit 3; }
+
 HOSTADDR=$(python3 "$SD/host_addr.py" 2>/tmp/tw-addr.err)
 echo "--- translation: $(cat /tmp/tw-addr.err)"
 echo "--- host addr: $HOSTADDR"