Attribute the 0xc0 immediate sites to functions: 410 candidates

The decomp's functions.tsv makes this cheap -- 3,835 level-0 functions with start
and size, so each immediate-bearing instruction is attributable to its container.

410 of 3,835 functions (10.7%) contain one; sizes 20 to 34,316, median 808.

Ten per cent is what a common small immediate buys, so this confirms 56b00fb
rather than narrowing anything. 410 is not a shortlist. What it does establish is
that the attribution works and the decomp's extents are usable for it.

The loader hunt now has a concrete next step: of those 410, the ones that also
touch a class span. That is dataflow, not counting, and it is where this resumes.

Caveat recorded: a 20-byte 'function' holding the immediate is a mis-bound extent
whose tail happens to include another function's instruction. Sizes need a floor
before the set is used.

No test -- an attribution count with no assertion behind it would only make the
410 look like a finding.

docs/plan/level-assets.md

@@ -1979,6 +1979,27 @@ filtering on opcode, which costs nothing and needs no capstone.
 
 **Result: still no signal.** Nothing in the immediate stream points at
 `moby_classes` more than at the other small offsets the program uses. The loader
-is not findable this way, and the remaining route is structural -- finding
-functions that touch both the chunk offset and a class span, which means real
-dataflow rather than a frequency count.
+is not findable by frequency.
+
+### Mapping the sites to functions: 410 candidates, which is not a narrowing
+
+The next step the decomp makes cheap. `functions.tsv` gives 3,835 level-0
+functions with start and size, so each `0xc0` immediate-bearing instruction can be
+attributed to its containing function.
+
+**410 of 3,835 functions (10.7%) contain one.** Sizes run 20 bytes (extent
+tail, effectively a mis-bound) to 34,316, median 808.
+
+Ten per cent is what a common small immediate buys, so this confirms the previous
+commit rather than narrowing anything -- 410 candidates is not a shortlist. What
+it does establish is that the attribution machinery works and that function
+extents from the decomp are usable for exactly this.
+
+The loader hunt now has a concrete next step rather than a vague one: of those
+410, find the ones that *also* touch a class span -- a tie or moby class base --
+and those are the constructors. That is dataflow rather than counting, and it is
+where this should resume.
+
+Note the one caution this measurement earns: a 20-byte "function" containing the
+immediate is not a real candidate, it is a function whose extent ends just after
+some other function's instruction. Sizes need a floor before the set is used.