re: builtin80 is a command -- and finding that exposed an 11.75% bug in my tracker

Reading builtin80's body (0x82268460) to name it: it is NOT a predicate.  It
allocates a 20-byte object, stamps vtable 0x820A8CB0, magic 0xAB0311BA and the
unit's live object into it, pushes it onto a queue via the same helper push.i uses,
and returns 1 -- or 0 when the unit is absent.  A command.

That made the conditions listing impossible: it showed a six-way switch
`if builtin80(TCT206) == 0 … == 5` on a function returning 1 or 0.  Disassembling the
site shows two unconditional `jmp`s between the call and the compare, so 0x1B6C0 is
reached ONLY by a branch and its special[0] has nothing to do with builtin80.

op12 is unconditional -- the next instruction is never reached by fall-through -- and
the tracker walked through it exactly as it had walked through end_coroutine.  Last
iteration I fixed the instance and not the class, leaving 22x more bad sites in place
than the fix removed.

A/B over all 28 stages, 7563 sites, resetting at jmp as well:
  sites whose operands change              889  (11.75%)
  LHS unresolved, before -> after     34 (0.45%) -> 756 (10.00%)

So the previous commit's headline "0.0% unresolved" was a MISSING CHECK, not a strong
result: the linear walk always had some value to report, and reporting it was the bug.
10% is the honest figure and the other 90% is trustworthy for a reason.

Also corrected: isl-unit-args.md illustrated its diff with 0x1B6C0, which is one of
the bogus sites.  The UNIT_ARG result itself stands -- it came from reading
implementations, not from this listing -- but the example was picked from bad output.

Not done, and said so: recovering the 756 needs a dataflow join over each block's
actual predecessors, a CFG fixpoint rather than a linear pass.  The branch targets are
all known so the CFG is available; the analysis is not written.

calls and phase-ends regenerate byte-identical; conditions changes on 187 lines.

docs/re/structures/isl-conditions.md

@@ -47,10 +47,13 @@ the stack, then reports each compare with its branch:
 | | all 28 stages |
 |---|---|
 | condition sites | **7 563** |
-| **either side left unresolved as `special[N]`** | **0 — 0.0 %** |
-| LHS is a resolved built-in call | 6 292 — 83.2 % |
+| **LHS honestly unresolved** | **756 — 10.0 %** |
 | RHS is a plain number | 7 544 — 99.7 % |
 
+🔴 **The first version of this table claimed 0.0 % unresolved. That was wrong** —
+see *The correction* below. ~11.75 % of the operands it reported were derived
+from state that leaked across an unconditional jump.
+
 **Most-tested predicates disc-wide:** `hp_pct_test` 1955, `unit_state` 1257,
 `unit_relation` 796, `dist_lt` 450, `request_script_message` 425,
 `unit_alive` 413, `read_freg` 187.
@@ -128,3 +131,55 @@ done.
   flow between them, which this listing does not follow.
 * Only Stage 02's artefact is committed; the other 27 generate from the same
   command but are not in the tree.
+
+
+## 🔴 The correction — I fixed the instance, not the class
+
+The `end_coroutine` fix above was **too narrow**, and the giveaway was again an
+impossible output: the listing showed
+
+```
+if builtin80(TCT206) == 0 … == 1 … == 2 … == 3 … == 4 … == 5
+```
+
+a six-way switch on a built-in that returns only **1 or 0**. Reading
+`builtin80`'s body (`0x82268460`) settles that it is not a predicate at all — it
+allocates a 20-byte object, stamps a vtable `0x820A8CB0`, a magic `0xAB0311BA`
+and the unit's live object into it, pushes it onto a queue via the same helper
+`push.i` uses, and returns 1, or 0 when the unit is absent. **It is a command.**
+
+Disassembling the site explains it:
+
+```
+01B698  call builtin80(TCT206)
+01B6A4  set.i global[76] = 0
+01B6B0  jmp -> 0x1B738
+01B6B8  jmp -> 0x1B738
+01B6C0  cmp.i …        <- reached ONLY by a branch from elsewhere
+```
+
+Two unconditional jumps sit between the call and the compare. **`op12` is
+unconditional, so the next instruction is never reached by fall-through** — and
+the tracker walked straight through it, exactly as it had walked through
+`end_coroutine`. One is a thread boundary and the other a block boundary, but
+they are the same defect: a linear walk cannot carry state across a point where
+control does not flow.
+
+| A/B over all 28 stages, 7563 sites | |
+|---|---|
+| sites whose operands change once `jmp` also resets | **889 — 11.75 %** |
+| LHS unresolved, before → after | 34 (0.45 %) → **756 (10.00 %)** |
+
+So the earlier "0.0 % unresolved" was not a strong result, it was a **missing
+check**: the walk always had *some* value to report, and reporting it was the
+bug. 10 % is the honest figure, and the remaining 90 % is now trustworthy for a
+reason — the state reaching those sites really does flow there.
+
+🟡 **Recovering the 756 needs real dataflow.** Each is a block entered only by a
+branch, so its state is the *join* over its actual predecessors — a fixpoint over
+the CFG, not a linear pass. The branch targets are all known (`[phase+232] +
+word@+4`), so the CFG is available; the analysis is not written.
+
+**Method note worth keeping:** when the same defect appears twice, fix the class.
+Patching `end_coroutine` alone left 22× more bad sites in place than it removed,
+and only another impossible-looking output exposed them.

docs/re/structures/isl-unit-args.md

@@ -76,9 +76,16 @@ A 40× separation, and the additions sit exactly on the positive class.
 raw number becoming a unit name:
 
 ```
-- 0x01B6C0  if builtin80(0x8B) == 0   ->  + 0x01B6C0  if builtin80(TCT206) == 0
+- 0x01B6C0  if builtin80(1, 117) == 0   ->  + 0x01B6C0  if builtin80(TCT206) == 0
 ```
 
+⚠️ **That example was itself a bogus site** — see
+[isl-conditions](isl-conditions.md#-the-correction--i-fixed-the-instance-not-the-class).
+`0x1B6C0` is reached only by a branch, so attributing its comparison to
+`builtin80` was wrong, and `builtin80` is a command rather than a predicate. The
+UNIT_ARG result is unaffected — it was derived by reading implementations, not
+from this listing — but the illustration was picked from bad output.
+
 ## 🟡 Not settled
 
 * **The 24 are still unnamed.** Knowing an argument is a unit is not knowing what