diff --git a/findings/control-flow/tail-rng-ledger.md b/findings/control-flow/tail-rng-ledger.md index aaee3a2..0c1775e 100644 --- a/findings/control-flow/tail-rng-ledger.md +++ b/findings/control-flow/tail-rng-ledger.md @@ -273,9 +273,9 @@ Static: the image has one persistent strategic `Mars::RNG`, at `S+0x16c`, constr turn roots; three more are stack temporaries in map generation. **The combat resolver draws from the same `S+0x16c` object** — all three RNG entry points in its 750-node direct-call closure load `[reg+0x16c]`. -Behavioural: across 32 ledger observations in four turns, **every** state resolved on a single forward chain -— no `words: null`, no second chain. If a second generator had been in play, the ledger would have said so -by construction. +Behavioural: across **64 ledger observations over eight turns on two saves**, every state resolved on a +single forward chain — no `words: null`, no second chain. If a second generator had been in play, the ledger +would have said so by construction rather than by anyone noticing. --- @@ -295,15 +295,15 @@ by construction. hook family should do, and it needs a workload nobody has built yet: a save where two hostile fleets actually meet. * **Node-line expiry did not fire.** See §9 for the quantified distance rather than an absence. -* **A turn with a genuinely empty encounter vector was not observed** (§3). Every turn of `ref-turn2` in - contact produces exactly one sighting encounter. The tail-runs-every-turn claim is settled; the - no-encounters variant is still an inference, now a much narrower one. +* **A turn with a genuinely empty encounter vector was not observed** (§4). Both saves produce exactly one + sighting encounter on every turn. The tail-runs-every-turn claim is settled; the no-encounters variant is + still an inference, now a much narrower one. * **`players` reads 8 on a 2-player save.** `(S+0x54)` enumerated as a `ServerPlayer*` vector gives 8 on every record of a game the lobby shows as 2 players. Either the server always allocates a fixed slot count, or this offset enumerates something else (spare capacity is the failure this campaign has already paid for once, at `S+0x64`). **Nothing in the ledger depends on it** — it is decoration on the argument record — but it should not be reused until someone resolves it. -* **Which of the twelve-to-fourteen `S+0x8` increments per turn come from where** (§5). +* **Which of the 12-to-44 `S+0x8` increments per turn come from where** (§5), and what they scale with. * The direct-call sweeps behind "node-line decay's only RNG site is the `Chance(0.5f)`", "its downstream pair draws nothing" and "`ProcessNodeSpaceTravel` draws nothing" are **worth less than they look**, and method rule 16 (landed by lane J while this run was in flight) says why: an inlined draw leaves no