9f2692eadd
Last iteration ended with 'what reads the flag file is unknown' after an offset search failed. The framing was wrong: I was hunting an engine-side reader, but the consumer is the script itself, through built-in 9 (read_freg), which loads [phase+88][i] into the double result register. Stage02.ssb calls read_freg 12 times -- the same count as set_flag (12) and clear_flag (12) -- so the latch is symmetric and entirely inside the VM. That closes the middle of the set_flag -> ... -> END_PHASE chain: one coroutine latches, another reads it back and branches. Also records an unconfirmed observation: op10 + op13 pairs with consecutive small immediates and their own code offsets look like a case/branch dispatch. Flagged as a pattern, not named -- neither handler has been read.