re: the trigger-queue pending count verified live -- 0 -> 1 -> 2

Read from a running Stage 02 mission: the container at ScriptPhase+272 has +20
moving 0 -> 1 -> 2 over the first two minutes while the phase ordinal stays 1.
So +20 is a real count of currently registered triggers -- the script arming
watches as it goes, and Stage 02 has 12 push_trigger sites -- and it is readable
from /dev/shm with no debugger. First direct view of what the script is waiting
for.

Corrects one field from the static reading: +12 is not (only) a list head. It
reads 0x000A0009, which is not a pointer, even though the push's
'addi r31, r30, 12' made list-head the obvious interpretation. Recorded as
unresolved rather than kept quietly.

docs/re/structures/isl-builtins.md

@@ -270,4 +270,26 @@ readable from `/dev/shm` with no debugger. Watching it alongside
 which is exactly the moment the condition coroutines get started, and the thing
 every phase experiment so far has been blind to.
 
-**Not yet verified live.** The layout above is read off the disassembly only.
+### ✅ Verified live
+
+Read from a running Stage 02 mission (`ScriptPhase 0xBE14DD80`, container at
+`0xBE14DE90`):
+
+```
++272+12 = 0x000A0009      +272+16 = 0xBC28E620   (a node pointer)
++272+20 = 0                +272+24 = 0
+
+[   0.0s] pending=0  phase=1 finished=0
+[  68.0s] pending=1  phase=1 finished=0
+[ 108.1s] pending=2  phase=1 finished=0
+```
+
+**`+20` moves, 0 → 1 → 2**, while the phase ordinal stays 1. So it is a real
+counter of **currently registered triggers** — the script arming watches as it
+goes (Stage 02 has 12 `push_trigger` sites) — and it is readable live with no
+debugger. That is the first direct view of *what the script is waiting for*.
+
+🟡 **`+12` is not a list head after all**, or not only that: it reads
+`0x000A0009`, which is not a pointer. The `addi r31, r30, 12` in the push made
+"list head" the obvious reading and the value does not support it. Recorded as
+unresolved rather than quietly kept.