re: read the three built-ins that appear inside clear conditions -- none named

isl-phase-guards produced the per-phase clear conditions, but three of the built-ins
in them were unread, leaving the conditions half-readable.  All three are read now
via the vtable at 0x820A84BC (control: 69 unit_state -> slot 184 -> 0x8226ADF0).
NONE is named: the corpus has withdrawn two names taken from usage shape, and what I
read does not support naming these.

builtin104 (slot 288, 0x8226BFE0) is a THREE-INSTRUCTION PURE GETTER:
    lwz r11, 10160(r3) ; stw r11, 164(r3) ; blr
So all six tutorial stages S18-S23 end on the value of a single engine-written word,
which is why their exits each have exactly one dominating condition and why
isl-builtins.md only ever saw 104 inside a poll loop.  That word has EXACTLY ONE
writer in the image -- sub_821AA1B0 at 0x821AAD9C, gated on a kind field being in
(16, 32] -- and r29 there is the return of a preceding call, so the meaning of the
value and of the gate are both unestablished.

builtin7 (slot 40) indexes [phase+324] by local[4], bails when rec+16 (the documented
unit state) is 1, 3 or 4, and resolves local[12] through [phase+244] -- symbol table 1.
isl.py's SYM1_SLOTS already listed slot 12 for built-in 7, derived from operand ranges
alone; reading the implementation shows the mechanism behind that.  Two independent
methods agreeing.  What it asks ABOUT the route is still unread.

builtin141 (slot 428) has the same unit-array entry and returns 0 when the unit is
gone; everything past 0x8226CA0C is unread.  Stage 16 calls it twice with arguments
differing in one position (0 vs -4000), which looks like a coordinate -- and looking
like one is exactly the evidence this corpus does not accept.

No artefact changes: the listings already printed builtin104/7/141 and still do.
All four Stage 02 artefacts regenerate byte-identical.

docs/re/BACKLOG.md

@@ -1464,6 +1464,20 @@ premise was wrong.**
   in neither set also score 99.3 %. The control that works is the **tag word**:
   `slot0 == 1` in 100.0 % / 100.0 % / **2.5 %**. Artefacts: calls + phase-ends
   byte-identical, conditions changes on 28 sites (raw number → unit name).
+  ✅ **(2026-08-27) The three built-ins that appear INSIDE clear conditions are
+  READ — [structures/isl-condition-builtins](structures/isl-condition-builtins.md)
+  — but none is NAMED.** `builtin104` (slot 288, `0x8226BFE0`) is a **three-
+  instruction pure getter for `[phase+10160]`**, so all six tutorial stages end on
+  one engine-written word; that word has **exactly one writer** in the image
+  (`sub_821AA1B0` @`0x821AAD9C`, gated on a kind field in `(16, 32]`) and `r29`
+  there is a call result, so its meaning is unestablished. `builtin7` (slot 40)
+  indexes the unit array by `local[4]`, bails when `rec+16` (the unit state) is
+  1/3/4, and resolves **`local[12]` through `[phase+244]` = symbol table 1** —
+  independently confirming `isl.SYM1_SLOTS[12] ∋ 7`, which was derived from
+  operand ranges alone. `builtin141` (slot 428) has the same unit-array entry and
+  returns 0 when the unit is dead; the rest is unread. Its Stage-16 call pair
+  differs in one argument (`0` vs `-4000`) which LOOKS like a coordinate — exactly
+  the evidence this corpus does not accept.
   Still unnamed: all 24. `builtin103` is a predicate over `[phase+10152]` and
   `[phase+10156]` (no unit arg); `builtin105` tests a unit record's `+16` == 4
   (`isl-builtins.md` documents `rec+16` as the unit STATE, 2 = active).