diff --git a/docs/plan/level-assets.md b/docs/plan/level-assets.md
index 28d7792..a6a19a8 100644
--- a/docs/plan/level-assets.md
+++ b/docs/plan/level-assets.md
@@ -1979,6 +1979,27 @@ filtering on opcode, which costs nothing and needs no capstone.
 
 **Result: still no signal.** Nothing in the immediate stream points at
 `moby_classes` more than at the other small offsets the program uses. The loader
-is not findable this way, and the remaining route is structural -- finding
-functions that touch both the chunk offset and a class span, which means real
-dataflow rather than a frequency count.
+is not findable by frequency.
+
+### Mapping the sites to functions: 410 candidates, which is not a narrowing
+
+The next step the decomp makes cheap. `functions.tsv` gives 3,835 level-0
+functions with start and size, so each `0xc0` immediate-bearing instruction can be
+attributed to its containing function.
+
+**410 of 3,835 functions (10.7%) contain one.** Sizes run 20 bytes (extent
+tail, effectively a mis-bound) to 34,316, median 808.
+
+Ten per cent is what a common small immediate buys, so this confirms the previous
+commit rather than narrowing anything -- 410 candidates is not a shortlist. What
+it does establish is that the attribution machinery works and that function
+extents from the decomp are usable for exactly this.
+
+The loader hunt now has a concrete next step rather than a vague one: of those
+410, find the ones that *also* touch a class span -- a tie or moby class base --
+and those are the constructors. That is dataflow rather than counting, and it is
+where this should resume.
+
+Note the one caution this measurement earns: a 20-byte "function" containing the
+immediate is not a real candidate, it is a function whose extent ends just after
+some other function's instruction. Sizes need a floor before the set is used.