e8fb9a41a6
Closes the open question from mission-phase-membership.md. The static sweep found no trigger because there is none in the data: each phase ends when its own per-mission script says so. [ScriptMission+40] is the 1/2/3 phase ordinal -- initialised at 0x822606B0 and incremented at exactly one site, 0x822609F8-0x82260A00 (checked: only one stw to 40(rN) in the whole state machine). Its guard is [ScriptPhase+196] != 0, and that flag has only two writers, vtable slots 0 and 1, reached only from built-ins 6 and 62 of the phase-script VM's 147-entry command table. Built-in 39 sets [phase+300]=2, which ends the mission instead of advancing. Refutes all four candidate triggers: no kill counter, timer, trigger volume or message event appears on the path. Any such condition lives inside the script, which is why three phases of one stage can have three different clear conditions. CScriptInterpreter::ChangePhase (sub_822FF330, opcode 995) is the consumer, not the cause; it writes a second phase mirror at [*(0x828F35F8)+236] -- a probe target. Not settled: the script bytecode is not on the disc under any obvious name. Tooling correction: the .pe is not stale, it is a flat VA image (offset = VA - 0x82000000), verified 7/7 against the DB. Also: instructions.raw is an INTEGER, and decoding it as a hex string silently compares nothing -- that nearly got this correction recorded backwards.