diff --git a/campaign/board.md b/campaign/board.md
index 92f1a3e..be86f18 100644
--- a/campaign/board.md
+++ b/campaign/board.md
@@ -387,3 +387,10 @@ Status flow: `backlog → in-progress → mapped → verified` (or `blocked`).
 | ID's falsified prediction, with the probe named | verify | backlog | — | 0% | 2026-09-08 | Its prediction that client counters restart at 0 on load is **falsified by a corpus save**: lane CB's reloaded run produced fleet **34**, not 18. Either something restores the counter (six IDMap/InitGame functions read, no such write found) or **the client makes one earlier unsaved allocation per turn** - the second fits everything and implies the id collision has already happened harmlessly in CB's run. One hook on 0x008b8ae0 logging (map, node, id, return address) separates them |
 | LAB TRAP: cmd.exe eats parentheses in save names | meta | verified | high | 100% | 2026-09-08 | `ssh ... certutil -hashfile "...(Autosave).sav"` fails with **"Check the spelling"**, which reads exactly like a missing file. Lane ID's first attempt **reported the three oracle saves as absent, and they were never absent** - a false alarm about the campaign's most important bytes |
 | MY ERROR: over-corrected rule 24, poisoned a remote build | meta | verified | high | 100% | 2026-09-08 | Implementing "fresh build dir per measurement" I **dropped `--exclude 'build*'` from the gate rsync**, which shipped a LOCAL `build-host` to CT111. A CMakeCache records **the absolute path it was created in**, so the remote build failed with "is different than the directory /home/alex/sots-engine where CMakeCache.txt was created" and **0% of 48 tests passed**. THE CORRECT FORM IS BOTH HALVES: exclude local build dirs from the transfer AND `rm -rf` the remote ones. **AND THE SIGNATURE TELLS YOU WHICH FAILURE YOU HAVE**: a real regression changes the PASS count (57/58); a broken configure changes the TOTAL (0% of 48 where healthy is 58). If the denominator moved, stop reading failures and fix the build. Re-gated clean: 58/58, shim OK. Rule 24 amended |
+| composer WORD-COST MODEL, and it held under pinned seeds | verify | verified | high | 90% | 2026-09-09 | Lane SD. One call to AIComposeShipBlueprint 0x006ad700 costs **W = A+B+C+D+E+F+G+H** across eight sites (cl_RandFloat once; three cl_RandRange whose cost is the rejection-loop expectation (mask+1)/n; four cl_Chance at 0.5/0.8/0.3/0.2). **All four Chance probabilities are strictly inside (0,1), so NEITHER of RNG_Chance's zero-word early-outs is reachable anywhere in this function** - only the three RandRange sites can cost more than one word. The loop-carried draw's trip count: `f = 1.00/0.75/0.50` by flags and a coin, `M = (int)(N*f)`, `D' = max(1,(N+1)/M)`, `L = #{bank j : PointDefence or j mod D' == 0}` - **not monotone** (at f=0.75, N=4 costs 4 words but N=5 costs 3) and at N=1 with f<1 the loop is entered and draws nothing. **HELD UNDER PINNED SEEDS**: two runs at the same pin in fresh processes are identical field for field on every composer row |
+| the seven words decomposed BEFORE the probe existed | verify | verified | high | 100% | 2026-09-09 | From two `push` literals at 0x006cda9a/0x006cdb17: **two composer calls, the first a costOnly=1 PRICE QUERY costing 3 words and the second the real build costing 4**. And the bank counts 3/1/2 match the Tarkas section catalog's `bank{}` counts exactly - **a hooked pointer walk and a parsed data file agreeing from opposite directions** |
+| THE PRICE QUERY IS NOT FREE | verify | verified | high | 100% | 2026-09-09 | New, beyond the brief, and it matters for any AI model: **0x006cda40 runs the composer TWICE per request, and the first pass draws 3 words it DISCARDS.** On turn 15 **every** composer call was a price query - **10 words computed and thrown away, zero designs built**. Also on turn 15 the composer is 10 of 16 words, not all of them: the task system's coin at 0x0069086a fires 4x and never fired on turn 1 |
+| PINNING AT BRACKET ENTRY DOES NOT PIN THE AI | meta | verified | high | 100% | 2026-09-09 | Two pinned runs with identical draws produced **different autosaves**, because **Prepare-Turn draws happen BEFORE the bracket** (`life_in` 10/435/422 vs 9/412/437). A lane wanting byte-identical AI runs needs lane CB's **construction-time `l1seed` pin**, not a bracket-entry pin. Anyone reusing SD's instrument should read this first |
+| corrections to lane PAR | verify | verified | high | 100% | 2026-09-09 | (1) PAR's site table **omits a live draw site**, 0x00691e9b - which PAR itself measured live at 0x00691ea0 - so the AI turn has **22 live sites, not 21**. (2) "Six of client 32's seven turn-1 words come from the composer" is **five from its body and two from a helper it calls**; all seven are in its subtree. Also: player 512's single cl_RandRange has now cost **1, 2 and 3 words across four observations** - the rejection loop, visible |
+| the composer's loop has NEVER RUN | verify | backlog | — | 0% | 2026-09-09 | Stated plainly by the lane: `H_obs = 0` on all six composer calls of all four runs, for two different reasons - on turn 1 the weapon lookups gate it, on turn 15 all three calls were price queries returning nine steps earlier. **Four of eight live sites have never fired; two of nine exits have ever been taken.** D/E/G/H are read, not measured. **THE WORKLOAD: a turn where the AI BUILDS (not prices) a design, on hull size > 0, with a point-defence weapon researched.** SD pushed human-turn15-spyprogram at it and still got only price queries; a follow-up should play that game forward until the AI commits a cruiser. **The instrument for it is already committed and cross-built (`w_alt`/`w_def`) but NO RUN HAS USED IT** |
+| SD self-reported a rule-21 shaped error | meta | verified | high | 100% | 2026-09-09 | Twice it ran `verify/design-rules/stock_designs.py` inside the **shared** sots-re clone to identify a save's players; **the script writes stock_designs.json as a side effect** and it restored the file with `git checkout -- <path>`. Clean afterwards, but that is exactly rule 21's shape - **and it would not have known if another lane had work in flight there.** Worth generalising: a read-only-looking script can have write side effects, so run analysis tools against a copy, not the shared tree |