diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md
index cb8bacb..5db7370 100644
--- a/docs/re/BACKLOG.md
+++ b/docs/re/BACKLOG.md
@@ -6912,3 +6912,32 @@ kind from `CHALLENGE` in the game's own vocabulary.
 ⚠️ **Boundary**: `EXTRA = 3` is established at `+144` of the stage-loader class;
 the word tested here is at `+184` of `[obj+4]`. Same constant, two offsets —
 **that they are the same field is not shown**.
+
+---
+
+## 🔴❌ 2026-08-28 — the `+184` writer is blocked; and `xrefs.ind_call` is a CROSS PRODUCT
+
+Item (a). Two routes to "what supplies the `EX_` mode word", both measured to
+have no power.
+
+❌ **Offset route dead**: `stw …,184(rN)` occurs **301×**, `lwz` from `+184`
+**351×**, and **115 functions touch both `+144` and `+184`**. `+184` is an
+ordinary small offset — the same trap the corpus already paid for three times.
+
+❌❌ **`xrefs.ind_call` IS A CROSS PRODUCT — NEVER READ IT AS "X CALLS Y".**
+Callers of the two screens come back as **633 sources each, identical lists**.
+The relation itself: **1 827 297 `ind_call` rows** over **1 710 targets** ×
+**6 992 sources**, and **236 targets have *exactly* 633 sources**. That is an
+unresolved-indirect-call cross product. ⚠️ Any past or future reading that treats
+an `ind_call` edge as a real caller is void. Control: `sub_82286BC8` has exactly
+**1** caller of kind `call`, so the direct kinds are sound; both `EX_` screens
+have **0** non-`ind_call` edges.
+
+✅ **What did come out**: scanning the 1 150 vtables' entries in the flat `.pe`,
+**both `EX_` screens are slot 1 of their own class** — `sub_822814D8` in
+`ANON_Class_271D5F25`, `sub_8227A3A0` in `ANON_Class_CAA8AD62` — while
+`sub_82286BC8` is in no catalogued vtable at all. The 2/0/0/1 partition reflects
+a structural difference, not a coincidence.
+
+🔴 **Blocked**: the `+184` writer. Next route with power = the RTTI behind those
+two anonymous classes, or a runtime watch — **not** another static offset search.
diff --git a/docs/re/structures/result-screens.md b/docs/re/structures/result-screens.md
index d6a69f0..fd85265 100644
--- a/docs/re/structures/result-screens.md
+++ b/docs/re/structures/result-screens.md
@@ -131,3 +131,56 @@ at **`+144`** of the stage-loader class, while the word tested here is at
 **`+184`** of `[object + 4]`. Same constant, same `EX`/`EXTRA` naming, two
 different offsets in what may be two different objects — **that the two fields
 are the same field is not shown**, only that both compare a mode word against 3.
+
+## 🔴 Who writes `+184` — blocked, by two independent instrument failures
+
+The next question after the selector is what *supplies* the mode. Two routes
+were tried and both are measured to have no power here.
+
+**The offset route has no power.** `stw …, 184(rN)` occurs **301 times** in the
+image, `lwz` from `+184` **351 times**, and **115 functions touch both `+144`
+and `+184`**. `+184` is an ordinary small offset shared by many unrelated
+classes — the same shape that the corpus already recorded as failing three
+times. Nothing here narrows to a writer.
+
+**❌ The `xrefs` `ind_call` edges are a cross product — do not use them as
+callers.** Asking for the callers of the two screens returns **633 sources for
+each, and the two lists are identical**, which cannot be right. Measuring the
+relation itself:
+
+| | |
+|---|---|
+| `ind_call` rows | **1 827 297** |
+| distinct targets | 1 710 |
+| distinct sources | 6 992 |
+| **targets with *exactly* 633 sources** | **236** |
+
+236 different functions sharing the identical source count is the signature of
+an unresolved-indirect-call cross product, not of a call graph. ⚠️ **Any reading
+that treats an `ind_call` edge as "X calls Y" is void**, here and elsewhere in
+the corpus.
+
+⚠️ The control shows the *other* kinds are fine: `sub_82286BC8` has exactly
+**one** caller, kind `call`. And both `EX_` screens have **zero** non-`ind_call`
+edges — they are reached only through function pointers, which is why the direct
+graph is empty for them.
+
+### ✅ What did come out: both `EX_` screens are slot 1 of their own class
+
+Scanning the 1 150 catalogued vtables' entries in the flat `.pe`:
+
+| function | vtable | slot |
+|---|---|---|
+| `sub_822814D8` (debriefing) | `ANON_Class_271D5F25` | **1** |
+| `sub_8227A3A0` (career) | `ANON_Class_CAA8AD62` | **1** |
+| `sub_82286BC8` (save) | *in no catalogued vtable* | — |
+
+So each `EX_`-selecting screen is a class whose **slot-1 virtual** is its
+key-list builder, and the third — which selects nothing — is not a vtable method
+at all. That is consistent with the 2 / 0 / 0 / 1 partition above arriving from a
+structural difference rather than a coincidence.
+
+🔴 **Still not settled: what writes `+184`.** Both the offset sweep and the call
+graph are exhausted for it. A route with actual power would be the RTTI class
+behind `ANON_Class_271D5F25` / `_CAA8AD62`, or a runtime watch on the field —
+not another static offset search.