diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index e12a8c2..6240efe 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -228,6 +228,36 @@ See [`structures/ui-composable-bundles.md`](structures/ui-composable-bundles.md)
 The investigation that got here follows, kept in full because most of it is
 refutations that were worth the cost.
 
+## Where the wave / spawn scheduler lives — the counter is not a roster
+
+**Raised by the user 2026-08-24, and it reframes the whole `REMAINING OB` line of
+work.** A mission does **not** have a fixed enemy count: the number rises as
+waves arrive and falls as they are destroyed. So the thing to find is not a list
+of objectives but an **algorithm with parameters** — what spawns, where, when,
+and on what trigger. That also explains every negative so far: a per-entity flag
+search cannot find a *schedule*.
+
+**Places searched so far:**
+
+* ✅ **`hidden/MiscBin.pak` — new to the corpus.** 11 `REGN` + 11 `MCOL` objects,
+  none name-resolved. `REGN`'s header is now decoded: a per-map **uniform spatial
+  grid** (bbox, cell size, 5³ or 10³ cells), self-checked 11/11. Its four data
+  sections are unread — the 49 KB object is the cheapest way in.
+  See [`structures/regn-map-grid.md`](structures/regn-map-grid.md).
+* 🟡 **`hidden/DefTables.pak`** — 1 465 entries, 804 name-resolved and mostly
+  `LOD_Frame_*`/`LOD_Parts_*` model tables. The **661 unresolved** ones fall into
+  three schemas: `7e66225f` (283), `634a80ae` (183), `a6d68fa1` (138), plus 40
+  XML. Three unnamed schemas with hundreds of objects each is the most
+  table-shaped unexplored thing on the disc.
+* 🔴 **`STAGES = Static.slb` is a false lead.** It is a field of the *sound*
+  table; `.slb` is an XACT sound bank ([`structures/sound-slb.md`](structures/sound-slb.md)).
+* ❔ **Not yet searched:** the ~800 unnamed objects in `GP_MAIN_GAME_<lang>.pak`,
+  and the executable itself.
+
+**First step:** dump the smallest `REGN` object's four sections (counts
+`8, 6, 18`) and the three unnamed `DefTables` schemas — both are pure static
+work, and either could carry per-map trigger or spawn records.
+
 ## The dynamic-RE state is not in git, and it was gone
 
 **Found 2026-08-23.** Everything the oracle runs on — the baseline emulator