re: builtin80 is a command -- and finding that exposed an 11.75% bug in my tracker

Reading builtin80's body (0x82268460) to name it: it is NOT a predicate.  It
allocates a 20-byte object, stamps vtable 0x820A8CB0, magic 0xAB0311BA and the
unit's live object into it, pushes it onto a queue via the same helper push.i uses,
and returns 1 -- or 0 when the unit is absent.  A command.

That made the conditions listing impossible: it showed a six-way switch
`if builtin80(TCT206) == 0 … == 5` on a function returning 1 or 0.  Disassembling the
site shows two unconditional `jmp`s between the call and the compare, so 0x1B6C0 is
reached ONLY by a branch and its special[0] has nothing to do with builtin80.

op12 is unconditional -- the next instruction is never reached by fall-through -- and
the tracker walked through it exactly as it had walked through end_coroutine.  Last
iteration I fixed the instance and not the class, leaving 22x more bad sites in place
than the fix removed.

A/B over all 28 stages, 7563 sites, resetting at jmp as well:
  sites whose operands change              889  (11.75%)
  LHS unresolved, before -> after     34 (0.45%) -> 756 (10.00%)

So the previous commit's headline "0.0% unresolved" was a MISSING CHECK, not a strong
result: the linear walk always had some value to report, and reporting it was the bug.
10% is the honest figure and the other 90% is trustworthy for a reason.

Also corrected: isl-unit-args.md illustrated its diff with 0x1B6C0, which is one of
the bogus sites.  The UNIT_ARG result itself stands -- it came from reading
implementations, not from this listing -- but the example was picked from bad output.

Not done, and said so: recovering the 756 needs a dataflow join over each block's
actual predecessors, a CFG fixpoint rather than a linear pass.  The branch targets are
all known so the CFG is available; the analysis is not written.

calls and phase-ends regenerate byte-identical; conditions changes on 187 lines.

docs/re/BACKLOG.md

@@ -1434,9 +1434,17 @@ premise was wrong.**
   over 28 stages: exactly **34 of 7563** sites change, **34 → 0** with an
   `end_coroutine` LHS, and the two counts being equal proves the leak was
   confined to them — the other 7529 were never affected. They now print an
-  explicit unknown. 🟡 Recoverable but not recovered: the RHS of each is still
-  exact, and seeding the tracker at coroutine ENTRIES (`start_coroutine`'s target
-  is staged slot 0) would resolve the LHS. ▶️ **Still open:** the 35 unnamed built-ins (`builtin16` 132
+  explicit unknown.
+  🔴 **(2026-08-27) THAT FIX WAS TOO NARROW — I fixed the instance, not the class.**
+  `op12 jmp` is unconditional, so the next instruction is never reached by
+  fall-through either, and the tracker walked through it exactly as it had walked
+  through `end_coroutine`. Exposed by another impossible output: a six-way switch
+  on `builtin80`, which returns only 1 or 0. A/B over 28 stages: **889 of 7563
+  sites (11.75 %) change**, and unresolved goes **34 (0.45 %) → 756 (10.00 %)**.
+  The earlier "0.0 % unresolved" was a MISSING CHECK, not a strong result.
+  🟡 Recovering the 756 needs a real dataflow **join over each block's actual
+  predecessors** (a CFG fixpoint) — the branch targets are all known, the analysis
+  is not written. ▶️ **Still open:** the 35 unnamed built-ins (`builtin16` 132
   sites, `builtin105` 117, `builtin103` 115 — each now a vtable-slot lookup);
   ✅ **(2026-08-27) partial — [structures/isl-unit-args](structures/isl-unit-args.md):**
   reading the implementations shows **55** built-ins take a unit at `local[4]`,
@@ -1448,7 +1456,13 @@ premise was wrong.**
   `slot0 == 1` in 100.0 % / 100.0 % / **2.5 %**. Artefacts: calls + phase-ends
   byte-identical, conditions changes on 28 sites (raw number → unit name).
   Still unnamed: all 24. `builtin103` is a predicate over `[phase+10152]` and
-  `[phase+10156]` (no unit arg); `builtin105` tests a unit record's `+16` == 4.
+  `[phase+10156]` (no unit arg); `builtin105` tests a unit record's `+16` == 4
+  (`isl-builtins.md` documents `rec+16` as the unit STATE, 2 = active).
+  🔴 **(2026-08-27) `builtin80` is a COMMAND, not a predicate** (`0x82268460`):
+  it allocates a 20-byte object, stamps vtable `0x820A8CB0` + magic `0xAB0311BA`
+  + the unit's live object, pushes it on a queue via the `push.i` helper, and
+  returns 1 (or 0 if the unit is absent). Finding that **exposed a much bigger
+  bug in my own condition tracker** — see the entry below.
   which condition guards each `END_PHASE` (needs the control flow between them);
   the vtable's length. The condition lives in the `op10`/`op13` poll loop upstream of
   the outro — e.g. phase 3 polls `unit_state(ADT308)` and branches back to