StageMessageSet_S02.tbl is resolved. stage-mission-tables.md had recorded it as absent from the pak; it is present, and the archive prefix is message\ rather than stage\ like its siblings. Sweeping prefix candidates over the full 16630 entry TOC found it immediately. It holds a voice mapping, a unit message set pointer, and a list of 31 message tables including ScriptMessage_S02_msg.tbl and the per-character PresetMessage sets. message\UnitMessageSet_S02.tbl then gives an independent confirmation of the phase structure. Its 26 records have exactly four named fields: CrewCount and PresetMessage_Phase1, Phase2 and Phase3. Every message set carries a different preset table per phase, so phases now appear in three unrelated table families -- the stage record, the route names, and the message sets. They are not a quirk of one file. The promising lead did not survive. ScriptMessage_S02_msg.tbl has 149 records whose third positional field takes values like Killed and None, which looked like a trigger. Enumerated across S01 and S02 it is a small closed vocabulary of None, Emergency, Killed and Noise -- delivery categories for radio chatter, meaning how a line is played rather than mission control flow -- and the fourth field is 1 in every record, so it is not an argument either. Rejected. That leaves no table anywhere carrying a phase-advance condition. Everything found is a consequence of the phase and never its cause, which points at the advance logic living in code. The only place left is the executable, and default.xex is encrypted on disc, so the decrypted image exists only in guest RAM and reaching it needs a run plus function-level work. Recorded as the honest end of the static search rather than continuing to guess at table names.