re: phase-guards for all 28 stages, and a 6/6 cross-check from an unrelated method

isl_report.py now accepts a directory, so the dominance analysis runs over the whole
disc: data/isl-phase-guards-all.txt, 177 phase exits, of which only 5 (2.8%) are
reachable from no static entry.  CFG reach ranges 69.5% (S26) to 95.8% (S25), median
about 4 dominating conditions per exit.

The lopsided number in the per-stage table was the six TUTORIAL stages, S18-S23, each
with exactly ONE exit and exactly ONE dominating condition.  That could have been a
degenerate result, so I looked: it is the same condition in all six,

    END_PHASE  <-  builtin104() != 1

and isl-builtins.md reached built-in 104 from call-site USAGE alone -- "S18-S23 only,
followed by wait_s 39/39, preceded by end_coroutine 37/39, a textbook poll loop".
Usage said 104 is the tutorial's polled test; dominance says it is the tutorial's
clear condition.  Two unrelated methods, six for six.

Stage 16 -- the corpus outlier whose script may be compiled C++ -- resolves as well:
read_freg(0) < 600, player_gauge0_test, player_gauge1_test, and two builtin141 calls
differing in a single argument (0 vs -4000), which is the shape of a position or zone
test.  builtin141 is unread, so it is not named.

Stage 02's separate artefact regenerates byte-identical.

Also added: an RLIMIT_AS cap in isl_report's entry point.  The dominator pass
OOM-killed a run earlier on this 15 GB box; a bad input should now fail the process
rather than the machine.

Still not settled and stated in the doc: dominance gives necessary, not sufficient,
conditions; the 5 unreachable exits need the trigger queue at phase+272; builtin104,
builtin141 and builtin7 all appear in clear conditions and are unread.

docs/re/BACKLOG.md

@@ -1486,6 +1486,15 @@ premise was wrong.**
   phase 3's requires `ADT301`/`ADT302`, and `read_freg(0)` gates at 210/300/1200.
   🟡 Dominance gives NECESSARY not sufficient conditions. 🟡 2 of 15 exits are
   reachable from NO static entry — consistent with the trigger queue at `phase+272`.
+  ✅ **(2026-08-27) EXTENDED TO ALL 28 STAGES** — `data/isl-phase-guards-all.txt`
+  (`isl_report.py <dir> phase-guards`). **177 exits, only 5 (2.8 %) unreachable**;
+  CFG reach 69.5 % (S26) to 95.8 % (S25), ~4 conditions per exit. 🔑 **Independent
+  cross-check, 6/6:** all six TUTORIAL stages (S18–S23) have exactly one exit with
+  exactly one dominating condition, `builtin104() != 1` — and `isl-builtins.md`
+  derived built-in 104 from usage alone as "S18–S23 only, a textbook poll loop".
+  Two unrelated methods agree. S16 (the compiled-C++-script outlier) resolves too:
+  `read_freg(0) < 600`, `player_gauge0/1_test`, and two `builtin141` calls differing
+  only in one argument (`0` vs `-4000`) — a position/zone shape, unread so unnamed.
   the vtable's length. The condition lives in the `op10`/`op13` poll loop upstream of
   the outro — e.g. phase 3 polls `unit_state(ADT308)` and branches back to
   `0xFEB4` until it passes. Artefact: `data/isl-stage02-phase-ends.txt`.