re: both trigger kinds watch a ROUTE -- the unit-reaches-route mechanism

The kind-0 condition tester sub_8226DAF8 resolves a symbol as well, but from
payload+4 rather than +28:

    8226DB14  rlwinm r10, r5, 2, 0, 29   ; r5 = payload+4, x4
    8226DB24  lwz    r11, 244(r30)       ; [phase+244] = symbol table 1
    8226DB3C  lwzx   r10, r10, r11
    8226DB50  addi   r4, r11, 4          ; -> the name string

Both appenders write local[12] into whichever slot their own path reads -- built-in 19
into +4, built-in 25 into +4 and +28 -- so the same operand is the symbol either way,
and it resolves cleanly:

    built-in 19   local[12] -> symtab 1   79 / 79   all symbol type 1
    built-in 25   local[12] -> symtab 1   25 / 25   all symbol type 1

isl-builtins.md records symtab-1 type 1 as the Route_* names, and the samples agree:
Route_ADN106_p1F, Route_ADN1xxe1_p1F, Route_ADS101_p1F, Route_TCN004_p1S.

So both built-ins register a trigger on a UNIT reaching a ROUTE -- payload+0 is the
unit, local[12] the route.  They differ only in the payoff: built-in 19 additionally
carries a handler routine (local[32] -> payload+28, kind 0 -> spawn) while built-in 25
carries none (kind 1 -> no spawn).  That is a third independent agreement with
isl.py's SYM1_SLOTS, which lists slot 12 for both and was derived from operand ranges
alone.

It also joins up with the closed REMAINING OB work, where the counter was measured to
rise at a squadron's route arrival time -- route triggers are the mechanism that would
do that.  Recorded as a connection, not a demonstration: nothing here traces a trigger
to that counter.

All artefacts regenerate byte-identical; documentation only.

Still unread: what the conditions actually COMPARE -- only sub_8226DAF8's first ~34
instructions are read, up to the name lookup, and sub_8226DC80 not at all -- and
payload+8, a computed value passed to both testers.  A waypoint index would fit it,
which is exactly why it is not being called one.

docs/re/BACKLOG.md

@@ -170,6 +170,24 @@ unknown, what evidence exists, and what the first step would be. Move an item in
   testers, what the kind-1 path does with the route, and the drain's second spawn
   site `0x8226DA10`.
 
+* ✅ **(2026-08-27) BOTH trigger kinds watch a ROUTE.
+  [structures/isl-trigger-node](structures/isl-trigger-node.md).** The kind-0
+  condition `sub_8226DAF8` resolves a symbol from **`payload+4`** through
+  `[phase+244]` = symtab 1 (`rlwinm r10,r5,2,0,29; lwz r11,244(r30); lwzx`), and
+  both appenders write `local[12]` into the slot their own path reads. **`local[12]`
+  resolves 79/79 (built-in 19) and 25/25 (built-in 25), every one symbol TYPE 1 =
+  `Route_*`** (`Route_ADN106_p1F`, `Route_ADS101_p1F`, `Route_TCN004_p1S`). So both
+  register **a trigger on a UNIT reaching a ROUTE** (`payload+0` = the unit); they
+  differ only in the payoff — built-in 19 also carries a **handler routine**
+  (`local[32]`→`+28`, kind 0 → spawn), built-in 25 carries none (kind 1 → no spawn).
+  Third independent agreement with `SYM1_SLOTS`, which lists slot 12 for both.
+  🔑 Joins up with the closed `REMAINING OB` result (the counter rises **at a
+  squadron's route arrival time**) — 🟡 stated as a connection, not a demonstration.
+  🟡 Still unread: what the conditions COMPARE (only `sub_8226DAF8`'s first ~34
+  instructions are read, up to the name lookup; `sub_8226DC80` entirely), and
+  `payload+8` (a computed value passed to both testers — waypoint-index shaped,
+  which is why it is not being called one).
+
 ## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
 
 `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the