72e24acdfe
Tracing Stage 02 phase 1 by control flow (following op 12 jumps and the six conditional branches) gives the whole chain: timer5 @ 4.0s -> trigger 0x2D30 (which also does timer_set/timer_resume) -> start_coroutine at 0x2FE8 -> coroutine 0xBB9C, whose body is wait_s(0.2) ; yield -> ... -> 0xF524, the ADN110/111/112 polls that latch set_flag(8). Exactly one of phase 1's 79 coroutine entries reaches 0xF524 under a real control-flow walk, and it is a 0.2s polling loop. So the condition is checked at 5 Hz from 4 seconds into the phase, and my 'the condition coroutine is not polling' explanation -- which I had promoted to real evidence after the poke experiments -- is withdrawn. Two weaker methods gave wrong answers first and are named: linear decode fell through into unrelated code and implicated 30-odd entries; 'nearest preceding entry' implicated the right one only by proximity luck, 0x3988 bytes away. And I matched start_coroutine operands across phases at first, which is meaningless since the operand is relative to [phase+232] -- the same per-phase base trap that broke isl.py's jump targets, hit again three iterations later. The poke results now need a different explanation. The likeliest is that neither poke produced the tested state: +16 is never read by built-in 69, and +4 = 0 takes the early-exit path an UNDEPLOYED unit also takes. Recorded as a hypothesis with the experiment that would settle it.