diff --git a/findings/control-flow/tail-rng-ledger.md b/findings/control-flow/tail-rng-ledger.md index 83be8c3..c51f356 100644 --- a/findings/control-flow/tail-rng-ledger.md +++ b/findings/control-flow/tail-rng-ledger.md @@ -308,6 +308,15 @@ by construction. moved the generator by 0 words on **16** observations (twice per turn, eight turns) and node-line decay by 0 on **8**. That evidence is immune to both rules, because it does not ask which function drew — it asks whether the generator moved. +* **No Guard region is declared by any hook in this family, so nothing here can report an undeclared + write.** That is deliberate — these hooks make no claim about game state at all, and a guard over the + generator would only duplicate the Result region that already covers the whole object — but it means the + usual harness-audit safety net is absent by design. Both traces show `err = 0`, `undeclared = 0` on 32 + records each; the second number is vacuous and should be read that way. +* **The one record with no ledger position is the first pre-turn autosave of each session**, which runs + before any turn driver and therefore before the hooks know the server pointer. It declares no region at + all rather than declaring one it cannot fill. Every record that *did* declare the region resolved: 0 + `words: null` across 64 records. * **The ledger's block-chain machinery has never run live.** Every observation in both runs sat inside a single MT block — `left` walked 432 → 413 → 395 → 375 → 357 on `ref-turn2` and 263 → 243 → 223 → 201 → 181 on the Zuul save, never reaching 0. So every live word count reduces to `left_before − left_after`, and the