re: poking all three squadrons to state 4 does NOT end phase 1

Ran the direct test instead of a seventh attempt at winning. All three objective
squadrons were live (state 2); the write to +16 sticks, and 60s later with all
three reading 4 -- the value a naturally-destroyed squadron takes, measured on
ADN111 -- [ScriptPhase+196] is still 0 and the ordinal still 1.

So 'phase 1 clears when ADN110/111/112 are destroyed' is not confirmed and its
simplest form is refuted. The bytecode reading (three unit_state polls then
set_flag(8)) stands; what does not follow is that flipping the field equals the
kill.

The persistence is the clue: built-in 69 normalises +16 when it polls, so a
running condition coroutine should have overwritten the poke within a frame. It
did not, which points at the condition being evaluated only when a trigger fires.

Also corrects the per-unit record layout: +4 is 26/27/28 for the three
squadrons -- small consecutive integers, NOT the 'live object pointer' the
built-in summary describes (an undeployed squadron has +4=0). +20 = 9 is exactly
their member count n from the roster, so the record is per-squadron and carries
its strength. My own probe printed 'obj=yes' by testing that word for non-zero
rather than pointer-ness, which made an index look like an object.

docs/re/script-runtime-probe.md

@@ -225,3 +225,58 @@ writable (`tools/re-capture/gpoke.py`), so **set the two surviving squadrons'
 autopilot is not good enough to win, and a wrong answer is as informative as a
 right one — if nothing happens, the condition is not what the bytecode reading
 says.
+
+## 🔴 2026-08-25 — poking all three squadrons to "destroyed" does NOT end the phase
+
+The direct test, run instead of a seventh attempt at winning. All three
+objective squadrons were live (state 2) when the poke went in.
+
+```
+ADN110 rec=0xBCA48BC0  +4=0x0000001A  +16=2
+ADN111 rec=0xBCA48C60  +4=0x0000001B  +16=2
+ADN112 rec=0xBCA48D00  +4=0x0000001C  +16=2
+STICK TEST on ADN110 +16: was=2 wrote=4 after2s=4 -> STICKS
+poked all 3
+  [+ 5s .. +60s]  phase=1 finished=0  states={ADN110:4, ADN111:4, ADN112:4}
+```
+
+**The write sticks — and nothing happens.** Sixty seconds with all three reading
+state 4 (the value a naturally-destroyed squadron takes, measured earlier on
+ADN111), and `[ScriptPhase+196]` stayed 0 and the ordinal stayed 1.
+
+**So "phase 1 clears when ADN110/111/112 are destroyed" is not confirmed, and
+the simplest form of it is refuted.** The bytecode reading — three `unit_state`
+polls then `set_flag(8)` — is solid; what does not follow is that flipping this
+field is equivalent to the kill.
+
+### 🟡 Why it probably did nothing: the poll was not running
+
+That the poke **persisted for 60 s** is itself the clue. Built-in 69 is
+documented as *normalising* `+16` when it polls, so if the condition coroutine
+were running its `unit_state` polls, it should have overwritten the value within
+a frame. It did not — which points at the condition being evaluated **only when
+a trigger fires**, not on every frame. Poking state without firing the trigger
+changes a value nobody reads.
+
+### 🔴 The per-unit record layout is not what the built-in summary says
+
+Dumping `ADN110`'s record contradicts *"+4 live object (NULL = absent)"*:
+
+```
++0  = 2          +12 = 0x42480000 (50.0f)     +20 = 9
++4  = 26         +16 = 4  (state)             +128 = 0x3F733333 (0.95f)
+```
+
+`+4` is **26/27/28 for the three squadrons — small consecutive integers, not
+pointers** (an undeployed squadron, `ADN201`, has `+4 = 0` and `+16 = 0`). And
+**`+20 = 9` is exactly these squadrons' member count `n`**, which the roster
+gives independently — so the record is per-squadron and carries its strength.
+
+Earlier readings printed `obj=yes` because the probe tested that word for
+non-zero, not for pointer-ness. That is a reporting bug in my own tool, and it
+made a small index look like a live object.
+
+**Not settled:** what `+4` indexes (a route or symtab-1 index is the obvious
+guess, given the values), and how to make the condition actually re-evaluate.
+Firing the trigger — built-in 100 pushes onto `[phase+272]` — is the next thing
+to look at.