backlog: phase-advance solved, hashes located, nav bug fixed, tooling corrections

docs/re/BACKLOG.md

@@ -974,7 +974,55 @@ premise was wrong.**
   to the save list, then reopens it — a 300 s oscillation. Driving `step up` →
   `A` by hand reached the ready room in **18 s**. `launch_mission.sh` should not
   pass `--tap A` while a YES/NO dialog can be on screen.
-* ❔ **What ADVANCES a phase is still unknown** and is not in the data: swept the
+* ✅✅ **(2026-08-25) WHAT ADVANCES A PHASE — SOLVED: a compiled script VM.**
+  See `mission-phase-advance.md`. `[ScriptMission+40]` is the 1/2/3 ordinal,
+  init at `0x822606B0`, and **incremented at exactly one site** `0x822609F8`–
+  `0x82260A00` (checked: only one `stw` to `40(rN)` in the whole state machine
+  `sub_82260710`). Its guard is `[ScriptPhase+196] != 0`; that flag has only two
+  writers — vtable slots 0/1 at `0x82264058`/`0x822640F8` — reached ONLY from
+  built-ins **6** and **62** of the phase-script VM's 147-entry table
+  (`sub_82272220`, jump table `0x8227226C`). Built-in **39** sets
+  `[phase+300]=2` = "last phase", ending the mission instead of advancing.
+  🔴 **All four candidate triggers refuted as direct causes** — no kill counter,
+  timer, trigger volume or message event is on the path; those conditions live
+  *inside* the per-mission script, which is why the static sweep found nothing
+  and why three phases of one stage can differ. ✅ `sub_8230D1F8` reads
+  `"Phase_%1d"` for map/background only — confirms the executable never consults
+  `Phase_N` for a trigger, and **nothing parses `Route_*_p<N>*`** (the 3 such
+  literals at `0x820AEA38` are debug defaults) — the route-name phase map is our
+  convention, not the game's.
+* 🎯 **PROBE TARGET:** `CScriptInterpreter::ChangePhase` (`sub_822FF330`, opcode
+  995) writes a runtime phase mirror at **`[*(0x828F35F8) + 236]`** — readable
+  from `/dev/shm` with **no gdb**.
+* 🔴 **Not settled: the script bytecode is not on the disc under any obvious
+  name.** No `GP_SCRIPT.pak`; grepping the extraction for `MISSION_START_PRT`
+  returns nothing. Loader `sub_8225EE20` matches section names
+  `MISSION1..MISSION33` + 5 `*_PRT`; `sub_8225EC78` gates `if (n==16 || n>32)`.
+  Candidates: the **7 `.embsec_` sections** (VAs 0x84D0000–0x86AC000, ~129 KB
+  total, executable) or a hashed record in `hidden/MiscBin.pak`. **Finding it
+  gives the actual per-phase clear condition for every stage.**
+* ✅ **(2026-08-25) Both guest hash routines located** — `sub_82447DF0` (IDXD)
+  and `sub_82447E70` (IXUD), transcribed instruction-for-instruction into Python
+  and Rust; `cargo test -p sylpheed-formats --lib hash` 10/10. **IXUD SOLVED:**
+  it chains **two** exact moduli (loop mod `2^32-153` in 64-bit, then fold mod
+  `2^24-33`), which is why no single-modulus search could ever find it —
+  86/86 keys and 108,261/108,261 tags verified. 🔴 **Two of my claims corrected:**
+  `tag_hash` must **sign-extend** (`extsb`) — the unsigned version matched all
+  1.27M disc names because every one is ASCII, but differs on 18,096/20,000
+  random high-byte inputs; and **`name_hash`'s reduction is EXACT, not lossy**
+  (0 wrong at every quotient boundary over the full 32-bit domain).
+* ✅ **(2026-08-25) BOOT-NAV BUG FIXED and verified by artifact.** `dialog_up.py`
+  detects the dim the game draws behind a modal (mean 34 vs 59–62), and
+  `wait_screen.sh --tap-if-dialog` only presses while one is up;
+  `launch_mission.sh` now verifies the "Load game?" dialog is actually open
+  before selecting YES. Next boot: **readyroom at 9 s, IN FLIGHT at 37 s**
+  (against three prior 300 s failures).
+* ✅ **Tooling:** `.pe` is **NOT stale** — it is a flat VA image
+  (offset = VA − 0x82000000), verified 7/7 against the DB. And
+  `instructions.raw` in `sylpheed.db` is an **INTEGER**, not a hex string —
+  decoding it as hex silently compares nothing and nearly recorded this
+  correction backwards.
+* ~~❔ **What ADVANCES a phase is still unknown**~~ and is not in the data: swept the
   stage record and every table it names plus the `message\` family for
   `interval|time|phase|delay|wave|spawn|arrival|trigger|start|appear|event|condition`
   — only `FrameCount` and `PresetMessage_Phase1/2/3` hit. It is in the executable.