diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index 02e14e4..52f8a33 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -660,6 +660,38 @@ unknown, what evidence exists, and what the first step would be. Move an item in
   🟡 Still open: who CONSUMES `[phase+356]`/`[phase+360]`, and whether
   `Stage30`–`Stage33` exist on disc.
 
+* ✅🔴 **(2026-08-27) THE SECTION READER IS NOT INI-ONLY — it is a generic
+  accessor over the IDXD tables — and `UNIT_MAX`'s absence now has a REAL control.
+  [structures/isl-condition-builtins](structures/isl-condition-builtins.md),
+  artefact `data/config-keys.txt`.**
+  🔴 **Correction to yesterday's label.** Resolving the `r4` string at *every*
+  call site of `sub_82448AA0` and `sub_824482D0` yields **65 section names and 54
+  int keys** — `MISSIONS`, `FONTS`, `StageResource`, `EPILOGUE_MOVIES`, `WEAPONS`,
+  `UNITS`, `SOUNDS`, `ACHIEVEMENTS_REQUIREMENTS`, `LINE_PITCH`, `MSG_FONT_SIZE`,
+  `SUBTITLE_Y`, … far more than the 400-byte `config.ini` holds. Decisive:
+  **`BASE_INFO`, `SYSTEM`, `MISSIONS`, `FONTS` are all present as IDXD record keys
+  on the disc.** So the pair is a **generic named-section accessor over the IDXD
+  `.tbl` containers**, with `config.ini` as one small extra input — not "the INI
+  reader".
+  ⚠️ **My first re-test was INVALID and only its control caught it.** IDXD record
+  keys are **`tag_hash`**, not `name_hash` (case-sensitive, modulus `0x00FFFFDF`;
+  `unitgroup.py` documents the difference). Scanning 190 782 records with
+  `name_hash` returned 0 for `STAGENN_UNIT_MAX` **and 0 for every control name** —
+  which is exactly how a bad test announces itself.
+  ✅ **Redone with `tag_hash`:** 7 750 / 7 750 IDXD entries parsed (matches the
+  corpus census), **190 782 records, 3 496 distinct keys**, controls
+  `BASE_INFO`/`SYSTEM`/`MISSIONS`/`FONTS` **found**, and
+  **`STAGE01…33_UNIT_MAX` → 0 records**. With the literal search (0 in 26 443
+  entries) and `config.ini` printed in full, the section exists **nowhere on the
+  disc**. The `GP_HANGAR_ARSENAL` word-hit that worried me is settled — not a
+  record key. ⇒ **`PLANE = 200` / `VESSEL = 20` for every stage**, now on a
+  controlled test.
+  📎 `data/config-keys.txt` lists the whole vocabulary — a lower bound (literal
+  `addis`/`addi` keys only), but it is the engine's own configuration surface and
+  directly useful to the port.
+  🟡 Still open: who CONSUMES `[phase+356]`/`[phase+360]`; whether `Stage30`–`Stage33`
+  exist; and the fallbacks behind the other 64 sections.
+
 ## ✅✅ SOLVED — the mission freeze was a modal sign-in dialog (2026-08-26)
 
 `XamShowSigninUI` opens a modal dialog and `xeXamDispatchDialog` blocks the
diff --git a/docs/re/data/config-keys.txt b/docs/re/data/config-keys.txt
new file mode 100644
index 0000000..dff6383
--- /dev/null
+++ b/docs/re/data/config-keys.txt
@@ -0,0 +1,129 @@
+# The named-section / int-key vocabulary the engine asks for
+
+Resolved by back-tracking the r4 string argument at every call site of
+sub_82448AA0 (find a named section/record) and sub_824482D0 (read an int).
+Only sites whose key is a literal addis/addi string are listed, so these are
+LOWER BOUNDS, not the complete set.
+
+## sub_82448AA0 -- named section / record  (65 distinct)
+     1  ACHIEVEMENTS_REQUIREMENTS
+     3  AUTO_SETTINGS
+     1  ArmsItem
+     1  ArmsItemFile
+    19  BASE_INFO
+     1  COMMON_RESOURCE
+     1  COMMON_XPR
+     1  CUSTOM_KEY_LOCATE
+     1  Camera
+     1  ControlTweak
+     4  CorrespondingTable
+     3  EPILOGUE_MOVIES
+     2  EnumCharacter
+     2  EnumUnit
+     1  EnumWeapon
+     1  Enumerate_ObjectiveMarkers
+     1  FILE
+     2  FILES
+     4  FONTS
+     2  FONT_SET
+     1  Faces
+     1  Files
+     1  GP_MAIN_GAME
+     2  GP_SCRIPT
+     1  Generic
+     3  IGNORE
+     2  LANGUAGE
+     4  LOCATE
+     2  LocalStringFiles
+     5  MISSIONS
+     1  MotionResource
+     1  Number
+     1  OFFSET
+     1  OPEN_PAK
+     1  Parameters
+     5  Path
+     2  PrefetchPaks
+     1  RADIO_WINDOW
+     1  Rendering
+     1  ResourceID
+     1  ResourceTable
+     1  Rule
+     2  SCRIPTS
+     1  SETTINGS
+     1  SE_main_arm1_attach
+     1  SE_main_arm1_detach
+     1  SE_main_arm2_attach
+     1  SE_main_arm2_detach
+     1  SE_main_arm3_attach
+     1  SE_main_arm3_detach
+     1  SE_nose_attach
+     1  SE_nose_detach
+     1  SOUND
+     1  SOUNDS
+     1  SQUADRON_ORDER_OBJECT
+     2  STAGE
+     1  STAGES
+     1  SUB_OBJECTIVE
+    11  SYSTEM
+     4  StageResource
+     1  TEXTS
+     2  UNITS
+     1  UnitMessageSetTable
+     2  WEAPONS
+     1  WeaponChangeFrame
+
+## sub_824482D0 -- read an int  (54 distinct)
+     1  ADJUST_X
+     1  ADJUST_Y
+     1  BlinkCycle
+     1  BulletLimit
+     1  ColorEmphasis1
+     1  ColorEmphasis2
+     1  ColorNormal
+     4  Count
+     1  CrewCount
+     1  DOF_Enable
+     1  ENTRY_POINT_PARAM
+     1  EXIT_VALUE
+     2  FINAL_LINE_PITCH
+     1  FinalPassType
+     1  GlareType
+     1  GuidanceType
+     1  HPGauge
+     1  HPGaugeSub
+     1  HP_CLASS
+     1  HP_ID
+     4  LINE_PITCH
+     3  LINE_SPACE
+     2  MISSION_ID
+     2  MSG_FONT_SIZE
+     1  MSG_LINE_PITCH
+     1  MSG_TEXT_LINE
+     1  MegaTons
+     1  NAME_FONT_SIZE
+     1  PLANE
+     1  PREPARE_WAIT
+     1  SPEAKER_HEIGHT
+     1  SUBTITLE_HEIGHT
+     1  SUBTITLE_Y
+     1  SpiralType
+     1  Stage
+     1  Straight1Type
+     1  Straight2Type
+     3  TEXT_HEIGHT
+     2  TEXT_LINE_SPACE
+     1  TEXT_SPEED_PER_LETTER
+     1  VESSEL
+     1  WEAPON_CATEGORIES
+     1  eye_stick_play
+     1  main_arm1_attach
+     1  main_arm1_detach
+     1  main_arm2_attach
+     1  main_arm2_detach
+     1  main_arm3_attach
+     1  main_arm3_detach
+     1  mov_stick_play
+     1  mov_trigger_play
+     1  nose_attach
+     1  nose_detach
+     1  pitch0
diff --git a/docs/re/structures/isl-condition-builtins.md b/docs/re/structures/isl-condition-builtins.md
index fc8a1e0..6511845 100644
--- a/docs/re/structures/isl-condition-builtins.md
+++ b/docs/re/structures/isl-condition-builtins.md
@@ -389,6 +389,41 @@ entry: `name_hash("STAGE01…33_UNIT_MAX")`, `name_hash("PLANE")`,
 appear as 4-byte words *inside* entries, seven of them in the 1.1 GB `sound.pak`;
 that is the chance rate for a 32-bit needle in a blob that size, not a finding.
 
+### ✅ (2026-08-27) The absence re-tested properly — and the reader is NOT INI-only
+
+🔴 **Correction to the label above.** `sub_82448AA0` is not "the INI config
+reader". Resolving the `r4` string at **every** call site of it and of
+`sub_824482D0` (artefact `data/config-keys.txt`) gives **65 section names and 54
+int keys** — `MISSIONS`, `FONTS`, `StageResource`, `EPILOGUE_MOVIES`, `WEAPONS`,
+`UNITS`, `SOUNDS`, `ACHIEVEMENTS_REQUIREMENTS`, `LINE_PITCH`, `MSG_FONT_SIZE`,
+`SUBTITLE_Y` … far more than the 400-byte `config.ini` holds. And the decisive
+check: **`BASE_INFO`, `SYSTEM`, `MISSIONS` and `FONTS` are all present as IDXD
+record keys on the disc.** So this pair is a **generic named-section accessor
+over the IDXD `.tbl` containers**, with `config.ini` as one small extra input.
+
+⚠️ **My first re-test was invalid, and only its control showed it.** IDXD record
+keys are **not** `name_hash` — they are **`tag_hash`** (case-sensitive, modulus
+`0x00FFFFDF`; `unitgroup.py` documents it). Searching 190 782 records with
+`name_hash` returned 0 for `STAGENN_UNIT_MAX` *and* 0 for every control name,
+which is what exposed it.
+
+Redone with `tag_hash`:
+
+| | |
+|---|---|
+| IDXD entries parsed | **7 750 / 7 750** (matches the corpus census) |
+| records scanned | **190 782**, 3 496 distinct keys |
+| control names found as record keys | **`BASE_INFO`, `SYSTEM`, `MISSIONS`, `FONTS`** ✅ |
+| `STAGE01…33_UNIT_MAX` records | **0** |
+
+With the literal search (0 in 26 443 decompressed entries) and `config.ini`
+printed in full, the section exists **nowhere on the disc** — not as an INI
+section, not as an IDXD record. The earlier worry that the `GP_HANGAR_ARSENAL`
+word-hit might be real is settled: it is not a record key.
+
+> ⇒ **`PLANE = 200` / `VESSEL = 20` for every stage** — now on a controlled test
+> rather than a scan whose reader had never been checked.
+
 🟡 Its neighbours belong to the same cluster: `builtin103` reads
 `[phase+10156]` and `[phase+10152]` (9 and 7 writers), and a sibling vtable stub
 clears `[phase+10152]`. The shape is an engine→script status trio, but that is a