49b5892df5
Probing pak entry names with name_hash across all 41 paks: UnitGroup_SNN.tbl exists for exactly S01-S16 and S18-S29 = 28 stages. S17 and S30-S33 are absent, so the 33-entry STAGENN_UNIT_MAX table is headroom over a 28-stage game. Control is built in: 28 hits from 33 probes shows the loop resolves entry names. Corroboration that fell out of it: AIParams_SNN.tbl exists for S01-S16 and S24-S29 but is missing for exactly S18-S23 -- the six stages the corpus identified as tutorials by a completely different route (their lone guard is request_next() != 1). Two unrelated methods, same six. Stage_SNN.tbl probes find 0, which is expected: stagetbl.py documents that the per-stage record is not name-addressed. Drops the [phase+356]/[phase+360] consumer question: 243 non-stack lwz reads from those offsets image-wide, and the only ISL-region hits are the two writers plus two vtable calls. Not a cheap static question. Docs only; artefacts byte-identical.