diff --git a/campaign/board.md b/campaign/board.md
index 727bcba..ae01ac8 100644
--- a/campaign/board.md
+++ b/campaign/board.md
@@ -279,3 +279,8 @@ Status flow: `backlog → in-progress → mapped → verified` (or `blocked`).
 | NEW BLIND SPOT: stack-built function-pointer tables | meta | verified | high | 100% | 2026-09-08 | A third way this binary hides call edges, after inlining and vtables. The ship-borne build-queue wrapper 0x00789500 has **zero call sites AND no vtable slot** - its address is written into a **STACK-BUILT function-pointer table** at 0x007b9c4b. `tools/vtable_map.py` cannot see that class, so **"no vtable caller" is ALSO a lower bound**, not just "no direct caller". (Related: the base BuildQueue is pure from slot 4-10 and SystemBuildQueue binds slot 10 to the function that is literally the "next function start" bounding ProcessTurn - which is why the fleet half looked absent) |
 | AN ORACLE THE CAMPAIGN ALREADY OWNED | verify | verified | high | 100% | 2026-09-08 | Lane B6 noticed that **zuul-turn16-noderoute -> zuul-turn17-rollpending is a real CONSECUTIVE-TURN PAIR** - six completions and one partial advance across two systems - which nobody had used. Its test **SOLVES** for the point total (0..200,000) rather than assuming it, and **asserts the solution is UNIQUE** (4182 and 9782): a per-order budget, a non-FIFO drain, or skip-instead-of-stop each make the solution set come back EMPTY. The completions then reproduce the ShipRecs deltas both files carry. That refutes its falsification hypothesis 3 AND independently confirms lane B4's ProcessBuildQueue on all four rules the corpus can reach |
 | build-queue hypotheses (unexercised) | verify | backlog | — | 0% | 2026-09-08 | Labelled by lane B6: the slot-9 MONEY CHARGE (no design in the corpus costs money), a ship-borne queue WITH an order, srl/srk/sri (all zero in 11 saves), the four non-default routing handlers, and a corrected colony rule (**with points <= 0 the original skips the removal sweep too**) that is unobservable in this corpus. THE WORKLOAD THAT CLOSES ALL OF IT: load zuul-turn16-noderoute.sav on VM140, End Turn, keep the AUTOSAVE - that converts the fitted point totals into a full before/after oracle for the pass, the ship birth and the fleet birth at once |
+| treaty turn stamps (H02) - 26 leaves | engine | verified | high | 95% | 2026-09-08 | Lane T2. **Reference pair 157 -> 131 (closed 52 -> 78), pair 2 86 -> 72 (closed 22 -> 36), regressed 0** - +26 and +14, **EXACTLY the numbers predicted in writing before building**. Three further pairs the model was NEVER FITTED TO - a different game, species 5, turns 2/15/16 - each closed **+12, regressed 0**, which is PRECISELY the number of ordered treaty pairs each save holds. **76 leaves closed, 0 regressed, 0 RNG words, across five pairs**, and the deltas are identical against both 0f1c007 and 2fd0852 so it is orthogonal to C3's and B6's work. StampTreatyTurns 0x007898c0, instruction-verified: the diplomacy ledger's "this treaty was last in force on turn N" stamp over every ordered player pair, creating the entry on demand; sole caller is ApplyTurnCommands so it is a HOST STEP, before both drivers. Reproduces the ledger of 10 of 11 saves ENTRY-FOR-ENTRY INCLUDING ORDER (the 11th is turn1-state, whose ledger no turn has written) |
+| THREE corrections to strategic-turn-internals 5.2 | subsystems | verified | high | 100% | 2026-09-08 | All flagged in place by lane T2: (1) relation codes are **3 = ally, 2 = NAP, 1 = cease-fire**, NOT the reverse - and 5.2 had self-labelled MEDIUM on exactly this point while combat-done-tail.md 2A implied the right answer independently; (2) the stamped value is **Frame, not ModCount** (`mov eax,[edi+0xc]`), and the stamp equals the save's own Frame on 10 of 11 saves while ModCount runs 0/12/24; (3) the bit is the **PlyrIdx field, not the vector position** - THE OPPOSITE CONVENTION from the shared-vision mask two files away, and no save separates them |
+| rule 17, seventh instance - a clipped sweep would call it DEAD | meta | verified | high | 100% | 2026-09-08 | Lane T2's sole-caller claim EXISTS ONLY because it disassembled past Ghidra's function end. ApplyTurnCommands is sized 2965 B ending 0x007b2445; **its real body runs to `ret 0x10` at 0x007b248d and the call sits at 0x007b2461**. A sweep clipped at fva+size finds NO CALLER AND CALLS THE FUNCTION DEAD. Seven functions, seven lanes |
+| ROADMAP ITEM 6 WAS WRONG: there is no such writer | verify | verified | high | 100% | 2026-09-08 | backlog item 6 had Player.Status blocked on "the writer between tail 31 and the autosave - watchpoint". **THERE IS NO SUCH WRITER.** A whole-image scan for immediate stores to ServerPlayer+0x164 finds THREE: ProcessTurn's encounter loop writes 1; ResumePlaying writes 0 on load (the 4->0 the determinism note recorded); and StrategyServer_MarkPlayerTurnEnded 0x00821a40 writes 4 from the three End-Turn SUBMISSION paths, BEFORE the turn runs. **Item 6 needs one predicate, not a VM.** Lane T2 did NOT write it: only two corpus saves carry a non-zero Status at all, and `Species != 4` fits 8 observations on a 1-BIT PREDICATE THAT NINE SAVES DO NOT EXERCISE - rule 20. An entry probe on that function names the set directly |
+| the tail's own list is correct and UNACTIONABLE | meta | verified | high | 100% | 2026-09-08 | Lane T2 ranked the tail by leaves-closed-per-effort against the 158-leaf residual and found **every tail phase that moves a leaf in this corpus is blocked on someone else**: T24 (Maint/ShipRecs, 9+5 leaves) waits on ship construction; T31 and T36 are already Blocked on the budget; T05 writes deadhome/bty* and **NO BATTLE OCCURS ON EITHER PAIR** (every encounter result has res->+0x4 != 0); T02/T30 move no leaf at all; the SvSctOb cluster is the tail's tier-4 vtable blind spot; TShn/rcex are lane E3's named residual with a watchpoint already specified. So it took a HOST STEP instead and said so plainly. The ranked table is in findings/subsystems/treaty-turn-stamp.md 5 |