BQ: probe 1 run - the load->turn pair is not the continuation's, and turn 40 varies by COMBAT, not by the research pick

Both committed predictions are wrong, in different and useful ways.

1b FALSIFIED: ar-oracle-A-pre.sav + load + one End Turn gives 4c356f59...,
not 7a8b3d5e... - and gives it byte-for-byte in two fresh hooks=off
processes. 23 leaves apart from AR's continuation, 17 of them one AI fleet
(Zeta Fleet V moved in the continuation and stayed put after a load). So
AR's second hash may NOT enter determinism-hashes.txt as a load->turn pair;
the load form is certified instead. The resave canonicalisation is
exonerated: the pre-turn round trip differs in exactly one leaf,
/CD[1]/NPrvVa, +5.00 per load - which also corrects determinism-oracle.md's
"nothing else varies".

Probe 1: the two files DIFFER, and /Sim/RNG, /Sim/trdmgr and every player-0
fleet are identical as predicted - but ZERO TechTree and ZERO ResTNm leaves
differ. Both processes picked BIO_GrvAdpt. The 144 leaves are a combat at
Venkman: Auto Resolve Peacefully means the human commits no ships, not that
no combat occurs, and the planet's defences killed two raiders in one
process and one in the other.

The producer run (config already on the guest, no build) names why the pick
agreed: producers A and B both returned null, Player[32] reached the
candidate walk, and candidatesTried=1. The outcome set is a singleton by
COUNT, not by producer gate - so ResTNm == '' is necessary for research
exposure, not sufficient.

VM145 restored byte-for-byte and released.

findings/control-flow/seed-exposure-forward-test.md

@@ -210,14 +210,384 @@ game         not running
 
 *(added after the runs; nothing above this line is edited)*
 
+### 4.0 What was run
+
+Five fresh processes on VM145, all with `C:\SOTS\shimdist-l4\binkw32.dll` (`BUILD_ID
+l4r-20260908T2208Z`) and `SavedGames` reset to exactly one file before each launch. The Load dialog
+was screenshotted every time and the row re-derived: with one file it sits at **(400, 262)**, and it
+sat there for all five runs. Main menu verified from a `qm monitor` screendump before every click
+path; no run was driven by sleeping.
+
+**Instrument armed and verified from `shim.log`, not assumed** (rule 1). For all four `hooks=off`
+runs the log reads exactly `config: hooks=off` / `hook: disabled by config` — nothing installed, no
+`ignoring unknown key` lines.
+
+| run | input | config | End Turn | encounter | `(Autosave EndTurn).sav` | `(Autosave).sav` |
+|---|---|---|---|---|---|---|
+| **1b-A** | `ar-oracle-A-pre` (F38) | `l4off` | 1 | none | 107,477 `33e30092…` | 107,732 `4c356f59…` |
+| **1b-B** | `ar-oracle-A-pre` (F38) | `l4off` | 1 | none | 107,477 **`33e30092…`** | 107,732 **`4c356f59…`** |
+| **1-A** | `ar-oracle-A-post` (F39) | `l4off` | 1 | Venkman, **peaceful** | 107,661 `1a9d937b…` | 108,580 `56980aa0…` |
+| **1-B** | `ar-oracle-A-post` (F39) | `l4off` | 1 | Venkman, **peaceful** | 107,661 **`1a9d937b…`** | 108,541 **`b36ac0ec…`** |
+| **1-R** | `ar-oracle-A-post` (F39) | `l4research` | 1 | Venkman, **peaceful** | 107,661 **`1a9d937b…`** | 108,571 **`28bbd9b5…`** |
+
+Run **1-R** is the producer-gate run the resolution names (§4.4); it is the only instrumented run and
+it was taken *after* the two `hooks=off` processes, not instead of them.
+
+### 4.1 Part 1b — P1b is **FALSIFIED**, and the load→turn procedure is nonetheless a valid pair
+
+`ar-oracle-A-pre.sav` + load + one End Turn does **not** reproduce `7a8b3d5e…`. It produces
+`4c356f5916f0e6e4…` — and it produces it **in two fresh processes, byte for byte**, at both snapshot
+points.
+
+> **The load→turn procedure agrees with itself and disagrees with the continuation.** That is not
+> non-determinism; it is a different procedure with a different, reproducible answer.
+
+`state_checksum --floats bits --mask none` against AR's `ar-oracle-A-post.sav`: **23 leaves**, and
+they are not the research leaves at all.
+
+| leaves | what |
+|---|---|
+| 1 | `/CD[1]/NPrvVa` 501.13 → 506.13 — the load-boundary counter (§4.3) |
+| 2 | `/Summary/Checksum` (derived), `/Sim/ModCount` 2147 → 2145 |
+| **17** | **`Flt[1570 "Zeta Fleet V"]` (PID 32)** — `FPlan` only-in-A, `HFPlan` True→False, `FtFlg` 13→12, `LocID` 0→432, `Pos`/`FtOrig`/`PrvPos` all three components, both ships' `Range` 7.0 → 9.0 |
+| 2 | `Sys[432 "Alpha Centauri"]` `NumFlts` 0→1, `Flt` only-in-B, `FFlags` 0→2 |
+| 1 | `Flt[914 "Nu Fleet III"]` `HLay` False→True, `Lay` only-in-B |
+
+Read off `ar-oracle-A-pre.sav`: `Zeta Fleet V` enters turn 39 parked at Alpha Centauri (`LocID 432`,
+`HFPlan False`, both ships at full `Range 9.0`).
+
+- **In AR's continuation** the AI issued it a move order — a `FPlan` with one waypoint (`Wpt 320`,
+  `FPsp2 2.0`, `FPeta2 3`, `pnd 432`), the fleet left the system, `FtFlg` went to 13 and the ships
+  burned 2 ly of range.
+- **In both of my loads** the AI issued nothing: the fleet is still at Alpha Centauri with full
+  range, and the system's `NumFlts` records it as present.
+
+**This is an AI fleet-task decision — the exact consumer class the resolution lists as
+unidentified — and it came out differently across the load boundary while coming out identically in
+two processes on each side of it.** Two `hooks=off` processes from turn 37 agree (AR, plus AR's
+instrumented third); two `hooks=off` processes from a load of turn 38 agree (this lane). They do not
+agree with each other.
+
+So the honest statement, and it is the one that matters for the standalone:
+
+> **`ar-oracle-A-pre.sav → 7a8b3d5e…` is NOT a load→turn pair and must not enter
+> `determinism-hashes.txt` as one.** What *is* certified, by two fresh processes, is a different
+> pair: `ar-oracle-A-pre.sav` → **(load, one End Turn)** → `(Autosave EndTurn).sav`
+> `33e3009254f5acd1…`, `(Autosave).sav` `4c356f5916f0e6e4…`.
+
+The single-turn pair still exercises the trade-raid roll (four raiders parked, no encounter), so the
+standalone gets its first trade-raid calibration pair — with the load→turn hashes, not AR's.
+
+### 4.2 The resave canonicalisation is **not** the cause — and the round-trip rule needs one addition
+
+The resolution named the resave canonicalisation as the first suspect if P1b failed. It is
+exonerated, and the measurement that exonerates it is P1b-aux.
+
+**Pre-turn form** (`ar-oracle-A-pre.sav` vs its own resave, my `(Autosave EndTurn).sav`): **1 leaf**.
+Not `Status`, not `Checksum` — those are already 0/consistent in a pre-turn file, exactly as
+`determinism-oracle.md` says. The one leaf is `/CD[1]/NPrvVa`, +5.00.
+
+**Post-turn form** (`ar-oracle-A-post.sav` vs my run 1-A `(Autosave EndTurn).sav`): **6 leaves** —
+`Summary/Checksum`, the four `Player.Status` 4 → 0, and `/CD[1]/NPrvVa` +5.00. Applying the
+campaign's documented rule (`--mask resave`, "mask every `Player.Status` and `Summary.Checksum`;
+**nothing else varies**") leaves **exactly one leaf standing**:
+
+```
+policy: floats=bits mask=resave  [masked: Checksumx1, Statusx8]
+DIVERGED: 1 leaf difference(s)
+  /CD[1]/NPrvVa: 501.13360595703125 -> 506.13360595703125
+```
+
+> **Correction to `determinism-oracle.md`, "Round-trip stability" / "Recommended canonicalization
+> rule" (rule 11):** *"Nothing else varies"* is **false** on this save. `/CD[1]/NPrvVa` advances by
+> exactly **+5.00** across a load, in both the pre-turn and the post-turn form, and `--mask resave`
+> does not cover it. The rule was derived on `ref-turn2` / `turn2-state`, three-player early-game
+> saves; this is a two-empire turn-38 save with a populated `CD[1]` diplomacy block, and the ratchet
+> broke on new content exactly as rule 27 describes.
+
+What `NPrvVa` is, measured rather than assumed: it sits in the `CD[1]` custom-data block next to
+`NPrv` (a count) and `NPrvId` (a player id, 16 here), so it reads as a per-player provocation /
+threat value. Its observed behaviour: **+5.00 per turn boundary crossed, plus +5.00 across the load**
+(496.13 at F38 → 501.13 at F39 in AR's process; 496.13 loaded → 501.13 at the End Turn press →
+506.13 at F39 in mine). It is **not** a monotone counter: on turn 40 it *fell*, to 461.48 in run 1-A
+and 476.65 in run 1-B, tracking that turn's combat.
+
+Because it advances on the load itself, **no load→turn run can ever reproduce a continuation's hash
+on this leaf**, independently of anything the AI does. P1b was unsatisfiable on `NPrvVa` alone; the
+other 22 leaves are the substantive result.
+
+### 4.3 Part 1 — P1 is **half right, and wrong about the mechanism**
+
+The two `hooks=off` processes **differ**: `56980aa086e1a145…` (108,580 B) vs `b36ac0ec2986f3a8…`
+(108,541 B). `state_checksum`: **144 leaf differences**.
+
+**But the `(Autosave EndTurn).sav` is identical in all three turn-39 loads** (`1a9d937b…`, 107,661 B,
+runs 1-A, 1-B and 1-R). The load is perfectly reproducible; the divergence is entirely inside the
+turn.
+
+And the divergence is **not** the research pick. Where the 144 leaves live:
+
+| leaves | subtree |
+|---|---|
+| 50 | `/Sim/crep[29]/*` — the combat report (per-ship damage, weapon rows, `cpk`, `cdt`) |
+| 41 | `Flt[2274 "Sigma Fleet VII"]` (PID **32**) — the AI fleet in the fight: `NShips` 5 vs 6, three different ship ids, hull health, 16 `TH`/`THM` pairs on one ship |
+| 8 | `Sys[224 "Venkman"]` — `Pop`, `PopC`, `Infra`, `Res`, `Suit`, `RepCur`, `RepMax`, `pbon` |
+| 6 | `/CD[1]/CmbR[2]/…/TacReports` |
+| 4 | `/Sim/turnstats/history/…` |
+| 20 | `Player[16 "re"]`: `BnkPr`, `BnkEl`, `otch`×6, `owep`×4, `odes`×2, `ShipRecs`, `preps`, the turn-40 `EvMsg` |
+| 13 | `Player[32]`: `Maint`, `ShipRecs`×8, `odes`, `owep`×2, `otch`×2, the turn-40 `EvMsg` |
+| 2 | `/Sim/ShipIDs[]`, `/Summary/Checksum` |
+| 1 | `/CD[1]/NPrvVa` |
+
+The two `EvMsg` strings say what happened in one sentence each:
+
+```
+A: "...147,834,923 Imperial citizens were killed. ... 2 enemy ships were destroyed."
+B: "... 78,818,284 Imperial citizens were killed. ... 1 enemy ship was destroyed."
+```
+
+**The AI's `Sigma Fleet VII` attacked player 16's colony Venkman, the human committed no ships
+("No ships available", `Auto Resolve Peacefully` in both runs), and the planetary defences killed
+two raiders in one process and one in the other.** Ship deltas confirm it exactly: both runs
+completed the *same* two ships for PID 32 (`+8848, +8864`); run A lost `7744` and `7952`, run B lost
+`8000`. Nothing else about the turn moved.
+
+**Now the leaf-by-leaf verdict on what P1 named:**
+
+| P1 clause | verdict |
+|---|---|
+| the two files **differ** | **CONFIRMED** |
+| `/Sim/RNG` identical | **CONFIRMED** — the 2,503-byte raw block is byte-equal (`a689d7a3…`) in both |
+| `/Sim/trdmgr` identical | **CONFIRMED** — no `trdmgr` leaf in the diff |
+| **every player-0 fleet** identical | **CONFIRMED** — all five PID-16 fleets (3744, 6544, 33, 49, 81) match on id, `LocID`, `Pos` and ship count |
+| difference confined to `Player[32]`'s `TechTree/*`, `ResTNm`, `otch`, `Events`, `turnstats`, `Checksum` | **FALSIFIED** — no `TechTree` leaf and no `ResTNm` leaf differs at all, and the difference reaches a colony's population, both players' banks and the combat reports |
+| **every `Player[16]` leaf** identical | **FALSIFIED** — twenty `Player[16]` leaves moved |
+
+**The research pick did not vary.** Both processes set Player[32]'s `ResTNm` to **`BIO_GrvAdpt`**,
+`otch` 47 in both, `NumDes` 47, `NumOwn` 18. The predicate's own signature — `ResTNm == ''` at turn
+start for the one player that can research — fired, a pick *was* made, and it was the **same pick in
+both processes**.
+
+### 4.4 The producer gate, run — and the answer is better than "a producer supplied it"
+
+The resolution's follow-up for exactly this outcome: *"a producer supplied the target … and the
+predicate needs a producer gate. One run with lane L4's `airesearch=on` dump names which producer
+returned non-null."* That config is on the guest already (`shimdist-l4\shim.cfg.l4research`), so it
+cost one run and no build. Run **1-R**, same input, same procedure, same peaceful resolution.
+
+`verify/results/shim/bq/bq-res-aiorders.txt`, the whole research record for the turn:
+
+```
+---- airesearch sel=1 agent=0x32446560 ... curTarget=0x00000000 species=2 ----
+aicand   sel=1 idx=0 agent=0x32446560 slot=0x3244669c w0=0x00000002(2) w1=0x00000001(1)
+airesult sel=1 candidatesTried=1 chose='BIO_GrvAdpt' (ptr=0x0463fd3c)
+---- airesearch sel=2 ... curTarget=0x04707c50 species=0 ----      (PID 496, target held)
+---- airesearch sel=3 ... curTarget=0x0d6c34a8 species=2 ----      (PID 512, target held)
+
+aiprobe idx=16 AIResearch::ProducerA     turn=3 total=3
+aiprobe idx=17 AIResearch::ProducerB     turn=3 total=3
+aiprobe idx=18 AIResearch::FallbackIndex turn=0 total=0
+aiprobe idx=19 AIResearch::FallbackArm   turn=0 total=0
+```
+
+> **It was not a producer short-circuit. Player[32] reached producer C — the candidate walk — and the
+> candidate list had length ONE.** Producers A and B were entered once per AI player and both
+> returned null for the `curTarget == 0` agent; `SelectResearchTarget` ran; `TryResearchCandidate`
+> was offered exactly one candidate and accepted it; the `0x006b36e0 & 7` fallback rotation was never
+> reached (`FallbackIndex` / `FallbackArm` both 0).
+
+`candidatesTried = 1` is the whole explanation. **The outcome set of that pick is a singleton because
+the candidate vector holds one element**, and no draw on any stream can change a one-element choice.
+
+That is a *different* mechanism from the one the resolution guessed, and it is strictly more useful,
+because it is a **counting** criterion rather than a code-path one. It also reconciles the three
+lanes without special pleading:
+
+| state | `ResTNm == ''`? | path | outcome set | control |
+|---|---|---|---|---|
+| `turn1-state`, PID 32 (lane L4) | yes | producers A/B, no walk | 1 | (varies — for other reasons; see below) |
+| `turn1-state`, PID 512 (lane L4) | yes | walk, **1 candidate** | 1 | — |
+| `as-turn15 → 16`, PID 32 (lane AS) | yes | not measured | **> 1** (A chose 64, B chose 62) | **varies**, 22 leaves |
+| **`ar-oracle-A-post → 40`, PID 32 (this lane)** | **yes** | **walk, 1 candidate** | **1** | **pick agrees** |
+
+**So `ResTNm == ''` is a necessary condition for research exposure, not a sufficient one.** The
+sufficient condition is `|candidates accepted by TryResearchCandidate| > 1`, and that is not readable
+from the pre-turn save — it needs the walk. §5 states the corrected predicate.
+
+### 4.5 What actually varies on turn 40, and why it is the warning already on the books
+
+The varying decision is **combat resolution**, and resolution 09-08 §6 already carries the warning:
+*"combat turns are not yet known to be cross-process reproducible."* AR added one datum against it —
+a turn-38 encounter auto-resolved peacefully that reproduced across three processes — and explicitly
+declined to treat that as discharging the warning, on the reasoning that "peacefully" probably
+bypasses `RunCombatRound`.
+
+**AR was right to decline, and the reason is now measured: `Auto Resolve Peacefully` does not
+bypass combat when the defender is a colony.** The human committed no ships; the *planet* fought,
+`RunCombatRound` ran, and it is per-process. Three processes on the same input produced three
+different kill counts (2 / 1 / — run 1-R gives a third distinct file, `28bbd9b5…`, whose 48-leaf diff
+against run 1-A is again wholly inside `crep`, `Sigma Fleet VII`, `Venkman` and the two `EvMsg`s).
+
+> **`Auto Resolve Peacefully` is not a determinism-preserving resolution.** It means "I commit no
+> ships", not "no combat occurs". A procedure that contains a peaceful auto-resolve is reproducible
+> only if the *other* side also has nothing to fight with — which is why AR's turn-38 encounter
+> reproduced and this turn-40 one does not.
+
+**One consequence for rule 26 (c), and it is the sharp one.** Rule 26 says a control must agree with
+itself before it exonerates anything. Here the control varies, so nothing on turn 40 can be measured
+off a single run — and the *sub-tree* discipline lane AD used is what saves the turn: `/Sim/RNG`,
+`/Sim/trdmgr` and every player-0 fleet **are** identical across the two processes, so a lane
+measuring the trade half on this turn has a valid sub-tree, and a lane measuring anything downstream
+of Venkman does not.
+
 ---
 
 ## 5. Verdicts on the committed predictions
 
-*(added after the runs)*
+| # | prediction | verdict |
+|---|---|---|
+| **P1b** | `ar-oracle-A-pre.sav` + load + one End Turn → `7a8b3d5e…` | **FALSIFIED.** It produces `4c356f59…`, reproducibly, in two fresh processes. 23 leaves apart from AR's continuation; 17 of them one AI fleet that the continuation moved and the load did not |
+| **P1b-aux** | the same run's `(Autosave EndTurn).sav` = `15b99255…` (the input's own hash) | **FALSIFIED by exactly one leaf** — `/CD[1]/NPrvVa`, +5.00. Every other leaf of the pre-turn round trip is byte-exact, so this lands in the fourth branch P1b-aux enumerated: *"the resave is not byte-exact but is behaviourally equivalent"*. **The resave canonicalisation is exonerated as the cause of P1b's failure**, and `determinism-oracle.md`'s "nothing else varies" is corrected (§4.2) |
+| **P1** | the two turn-40 files **differ** | **CONFIRMED** |
+| **P1**, clause: `/Sim/RNG`, `/Sim/trdmgr`, every player-0 fleet identical | **CONFIRMED**, all three |
+| **P1**, clause: difference confined to `Player[32]`'s `TechTree/*`, `ResTNm`, `otch`, `Events`, `turnstats`, `Checksum` | **FALSIFIED.** **Zero** `TechTree` leaves and **zero** `ResTNm` leaves differ. The difference is a combat at Venkman and its consequences |
+| **P1**, clause: every `Player[16]` leaf identical | **FALSIFIED** — twenty of them moved |
+
+**The prediction was right for the wrong reason, and that is the result.** P1 said the files would
+differ *because the research pick is exposed*. The files differ, the research pick is **not**
+exposed, and the exposed decision is one the predicate does not mention at all.
+
+### 5.1 The predicate, corrected
+
+Rule 26 corollary (c) currently reads *"`ResTNm == ''` names a pick turn"*. Measured here:
+
+1. **`ResTNm == ''` at turn start is necessary, not sufficient.** It names a turn on which a pick
+   will be *made*. Whether that pick is *exposed* is `|candidates| > 1`, and on this state
+   `|candidates| = 1` (§4.4, `candidatesTried=1`). A pick with one candidate is a decision with
+   outcome set 1 — the resolution's own criterion, satisfied.
+2. **The predicate has a false-positive class that was visible before the run** (§1.4): four NPC
+   players carry `ResTNm == ''` on every turn of this lineage, including the turns whose controls
+   agree. All four have `NumOwn == 0`. The predicate must be read only for a non-eliminated AI player
+   with `NumOwn > 0`.
+3. **The predicate is incomplete on the other side: it has no combat term.** Turn 40 was exposed
+   through `RunCombatRound`, and the pre-turn save *does* name the condition — an AI fleet
+   (`Sigma Fleet VII`, PID 32) standing at an enemy colony (`Venkman`, PID 16). That is as readable
+   from the save as `ResTNm` is, and it belongs in the predicate.
+4. **A fourth term, and it is not a predicate on the save at all: the load boundary.** Turn 39 ran
+   one way in a process that had just run turn 38 and another way in a process that loaded turn 38's
+   autosave — with both sides reproducible. So the pre-turn save does **not** fully determine the
+   next turn's AI fleet-task decisions. Whatever `Zeta Fleet V`'s move order depended on was **not in
+   the file**. That is a bigger claim than exposure and it is the one this lane would send back to
+   the resolver.
+
+---
+
+## 6. Coverage, and what was not done (rule 15)
+
+* **Two processes per pair, not three.** Rule 26's bar, matching AR's. Run 1-R is a third process on
+  the part-1 input but it is instrumented, so it counts as corroboration of *variability*, not as a
+  third control.
+* **Rule 19 cannot be run on turn 40, and it is worth saying why.** The `hooks=off` control varies
+  here, so an instrumented run agreeing with either arm would be a `1/k` coincidence with `k ≥ 3`
+  (rule 26). Run 1-R produced a third distinct file; that is consistent with neutrality and proves
+  nothing about it. **No neutrality claim is made for `l4research` on this state.**
+* **The 1b divergence is localised but not explained.** This lane measured *that* the load boundary
+  changes an AI fleet-task outcome; it did not identify the input that is missing from the save. That
+  needs probe 3's per-client draw ledger with `this` recorded, on `ar-oracle-A-pre → 39`, taken twice
+  — once by continuation from turn 37 and once from a load. The site that fires in one and not the
+  other is the answer, and the resolution has already queued exactly that instrument.
+* **`|candidates| = 1` is one observation on one turn.** It explains this agreement; it is not a
+  claim that the candidate list is usually 1 (lane AS's state clearly had more). Rule 20: do not fit
+  a constant to one observation.
+* **The combat was measured, not decoded.** Three kill counts (2, 1, and run 1-R's own) on one
+  encounter. No draw site is attributed — `hooks=off` throughout for the two controls, and this lane
+  makes no claim about which consumer inside `RunCombatRound` varies.
+* **The `0x0069dbb0` fuse cannot have fired** in any of these runs (earliest fire is 3 turns after
+  the load that draws it), so nothing here bears on it in either direction.
+* **`/CD[1]/NPrvVa` is named, not decoded.** Its neighbours (`NPrv`, `NPrvId = 16`) read as a
+  per-player provocation record and its behaviour is +5.00 per turn boundary and per load, falling on
+  a combat turn. No writer was looked for. It is a one-line watchpoint for whoever wants it (rule 18).
+
+---
+
+## 7. Artefacts
+
+| what | where |
+|---|---|
+| this document | `findings/control-flow/seed-exposure-forward-test.md` |
+| **1b pair**, two fresh `hooks=off` processes, byte-identical | `verify/results/saves/bq/bq-1b{A,B}-{endturn,post}.sav` (`33e30092…` / `4c356f59…`) |
+| **part 1**, two fresh `hooks=off` processes, **differ** | `verify/results/saves/bq/bq-1{A,B}-post.sav` (`56980aa0…` / `b36ac0ec…`), shared `bq-1{A,B}-endturn.sav` (`1a9d937b…`) |
+| producer-gate run (instrumented, `l4research`) | `verify/results/saves/bq/bq-res-post.sav` (`28bbd9b5…`) |
+| **the research record** — `candidatesTried=1 chose='BIO_GrvAdpt'` | `verify/results/shim/bq/bq-res-aiorders.txt` |
+| shim log (install status for all 20 aiprobes + 3 airesearch detours) | `verify/results/shim/bq/bq-res-shim.log` |
+| inputs (unchanged) | `verify/results/saves/ar-oracle-A-{pre,post}.sav` |
+
+`verify/results/saves/bq/` is a subdirectory, so it is invisible to the corpus scan
+(`find_saves()` uses a non-recursive `os.listdir` on `*.sav`) and **the coverage ratchet is not
+touched** (rule 27). None of these files should be promoted into the corpus without deciding that
+question deliberately.
+
+---
+
+## 8. VM145 as left
+
+**Hold released. Guest restored and verified byte-for-byte against the as-found snapshot** (§3):
+
+```
+SavedGames   the same 9 files, every sha256 identical to as-found
+binkw32.dll  15,527,327 B  903527f4a698eea9…   (= shimdist-recap, recap-7584bad-20260908T0615Z)
+shim.cfg     0ae410cc72fe1558…  hooks=trace     (lane R's recapture config)
+game         stopped, as found
+```
+
+Left in place, all additive: `C:\SOTS\ui\preBQ\` (the as-found SavedGames snapshot),
+`C:\SOTS\ui\bq\` (the two input saves and this lane's outputs), and
+`C:\SOTS\ui\bq{deploy,grab,click}.ps1`. **`click_helper.ps1` is unmodified.**
+
+**Four things for the next holder of VM145.**
+
+* **Startup is ~2 minutes if you drive it**, confirming lane AR's correction on VM141: `fg` +
+  `key {ESC}` ×3 spaced ~2.5 s, then ~90 s, and the main menu is up. Loading a turn-38/39 save is a
+  further **3–4 minutes** and is not compressible. Verify both from a screendump; `tools/vmshot.py
+  --one 145` is one call and does not touch the guest.
+* **Chained clicks in one `cmd.txt` are unreliable through the Load dialog.** A three-click chain
+  (`Load Game` → `Single Player` → `OK`) landed only the first click, twice. **One `bqclick.ps1`
+  call per click, with a screenshot between**, is the only thing that worked reliably —
+  independent confirmation of lane M's gotcha, on a different guest.
+* **Reset `SavedGames` to exactly one file — the run's input.** The Load dialog then has one row at
+  **(400, 262)** and there is nothing to re-derive. `bqdeploy.ps1 -Save <name>` does it, prints the
+  input's sha256, and re-verifies the config.
+* **`C:\Windows\system32\cmd.exe` windows appear over the game** as a side effect of the SOTSUI
+  scheduled task and will cover the map. `fg` raises the game again; screenshot before believing a
+  click landed.
+* **The `Done` pixel test works exactly as documented** and is worth keeping: (233, 673) read
+  **(183, 18, 0)** with the Venkman query up and **(0, 0, 0)** on the map (AR's "≈(8,8,8)" — same
+  thing, the map is near-black there). `Auto Resolve Peacefully` (667, 641) shows a tooltip and the
+  dove fills the centre panel, so the selection is confirmable from a screenshot before `Done`.
 
 ---
 
 ## Proposed board rows
 
-*(added after the runs)*
+New rows:
+
+```
+| PROBE 1: the load->turn pair is NOT the continuation's - AR's second hash does not survive a load, and the load form is its own reproducible pair | meta | verified | high | 100% | 2026-09-09 | **Lane BQ**, VM145, `findings/control-flow/seed-exposure-forward-test.md`, probe 1b of the 09-09 resolution. Prediction committed before the run (commit be14266): `ar-oracle-A-pre.sav` (Frame 38, `15b99255...`) + LOAD + one End Turn reproduces `7a8b3d5e...`. **FALSIFIED.** It produces `4c356f5916f0e6e4...` (107,732 B), and it produces it in TWO FRESH `hooks=off` PROCESSES BYTE FOR BYTE, at both snapshot points (`(Autosave EndTurn).sav` `33e3009254f5acd1...` in both). So the load->turn procedure AGREES WITH ITSELF and DISAGREES WITH THE CONTINUATION. 23 leaves apart from AR's file and **17 of them are ONE AI FLEET**: `Flt[1570 "Zeta Fleet V"]` (PID 32) enters turn 39 parked at Alpha Centauri with full range; in AR's continuation the AI issued it a move order (FPlan Wpt 320, FtFlg 12->13, LocID 432->0, both ships Range 9.0->7.0) and in BOTH loads it issued nothing. Plus `Sys[432]` NumFlts 0->1 and `Flt[914 "Nu Fleet III"]` HLay True/False. **RULING: `ar-oracle-A-pre.sav -> 7a8b3d5e...` MUST NOT enter determinism-hashes.txt as a load->turn pair.** What IS certified, two processes: `ar-oracle-A-pre.sav -> (load, one End Turn) -> 33e30092.../4c356f59...` - and that is still the standalone's first trade-raid pair (four raiders parked, no encounter). **THE RESAVE CANONICALISATION IS EXONERATED**: the pre-turn round trip is byte-exact but for ONE leaf, `/CD[1]/NPrvVa` (+5.00 across a load). CONSEQUENCE: **the pre-turn save does not fully determine the next turn's AI fleet-task decisions** - something `Zeta Fleet V`'s order depended on is not in the file. Resolver case; probe 3's ledger on `ar-oracle-A-pre -> 39` taken BOTH by continuation and by load names the site |
+```
+
+```
+| PROBE 1: turn 40 varies - but NOT by the research pick. `Auto Resolve Peacefully` does NOT bypass combat, and a pick with ONE candidate is not exposed | control-flow | verified | high | 100% | 2026-09-09 | Lane BQ, VM145. `ar-oracle-A-post.sav` (`7a8b3d5e...`, Player[32] `ResTNm == ''`) in two fresh `hooks=off` processes, one End Turn, `Auto Resolve Peacefully` in both. **The files DIFFER** (`56980aa0...` vs `b36ac0ec...`, 144 leaves) - the committed prediction's first clause holds, and so do `/Sim/RNG` identical (2,503-B block byte-equal), `/Sim/trdmgr` identical and every player-0 fleet identical. **THE MECHANISM CLAUSE IS FALSIFIED: ZERO TechTree leaves and ZERO ResTNm leaves differ.** Both processes picked **BIO_GrvAdpt**. The 144 leaves are a COMBAT: the AI's `Sigma Fleet VII` (PID 32) hit player 16's colony Venkman, the human committed no ships, and the PLANET's defences killed 2 raiders in one process and 1 in the other (50 leaves `crep`, 41 the AI fleet, 8 `Sys[224 "Venkman"]`, 20 `Player[16]` - the prediction's "every Player[16] leaf identical" is also FALSIFIED). Both runs completed the SAME two ships (+8848,+8864); only the losses differ (7744+7952 vs 8000). **So `Auto Resolve Peacefully` means "I commit no ships", NOT "no combat occurs" - it is not a determinism-preserving resolution, and resolution 09-08 §6's combat warning is now measured, not just retained.** AR's turn-38 peaceful auto-resolve reproduced because the other side had nothing to fight with. **WHY THE PICK DID NOT VARY - the producer run, `shim.cfg.l4research` already on the guest, no build**: producers A and B were entered once per AI player and BOTH RETURNED NULL for Player[32]; it reached producer C, the candidate walk; `TryResearchCandidate` was offered **ONE** candidate and took it - `airesult sel=1 candidatesTried=1 chose='BIO_GrvAdpt'` - and the `0x006b36e0 & 7` fallback rotation was never reached (FallbackIndex/FallbackArm both 0). **The outcome set is a singleton because the CANDIDATE LIST HAS LENGTH ONE.** Not the producer gate the resolution guessed - a COUNTING criterion, and a better one |
+```
+
+```
+| Rule 26 (c) needs four corrections, all measured on one lineage in one session | meta | verified | high | 100% | 2026-09-09 | Lane BQ, from probe 1. (1) **`ResTNm == ''` is NECESSARY, NOT SUFFICIENT** for research exposure: it names a turn on which a pick is MADE; exposure needs `|candidates accepted by TryResearchCandidate| > 1`, and on `ar-oracle-A-post -> 40` it is 1, so the pick agreed across two processes. Lane AS's varying pick (64 vs 62) had a longer list. The sufficient condition is NOT readable from the pre-turn save. (2) **The predicate has a false-positive class, and it was visible BEFORE the run**: four NPC players (528 Alien Menace, 544 Peacekeeper Enforcer, 560 Von Neumann, 576 Independent Colony) carry `ResTNm == ''` on EVERY turn of this lineage INCLUDING the turns whose controls agree; all four have `NumOwn == 0`. Read the predicate only for a non-eliminated AI player with NumOwn > 0. (3) **The predicate has no COMBAT term and needs one** - turn 40 was exposed through `RunCombatRound`, and the pre-turn save names the condition as plainly as it names ResTNm: an AI fleet standing at an enemy colony. (4) **A fourth term is not a predicate on the save at all**: turn 39 ran one way by continuation and another way after a load, BOTH reproducibly, so exposure is a property of (save, procedure, LOAD HISTORY), not of (save, turn). Rule 26 (c)'s instruction "record the pair as (save, procedure, hashes)" was already right and is now load-bearing for a reason it did not anticipate |
+```
+
+Edits to existing rows:
+
+- **Row 426** (the resolution's row) — append: `PROBE 1 RUN 2026-09-09 (lane BQ, VM145). 1b FALSIFIED: ar-oracle-A-pre + LOAD + one End Turn gives 4c356f59..., not 7a8b3d5e..., reproducibly in two processes - the AI moved Zeta Fleet V in the continuation and not after a load, so the pair may NOT enter determinism-hashes.txt in AR's form; the LOAD form (33e30092.../4c356f59...) is certified instead. The resave canonicalisation is EXONERATED (pre-turn round trip differs in one leaf, /CD[1]/NPrvVa +5.00 per load). Probe 1 CONFIRMED "the files differ" and CONFIRMED /Sim/RNG + /Sim/trdmgr + player-0 fleets identical, but FALSIFIED the mechanism: the research pick AGREED (both chose BIO_GrvAdpt) and the variation is a COMBAT at Venkman. Producer run: producers A and B both returned null, Player[32] reached the CANDIDATE WALK, and candidatesTried=1 - the outcome set is a singleton by COUNT, not by producer gate.`
+- **Row 424** (AR's oracle pair) — append: `LOAD-BOUNDARY SCOPE 2026-09-09 (lane BQ): this pair is certified ONLY as the two-turn continuation from ar-turn37-816raiders.sav. Its second half does NOT survive being reached by load: ar-oracle-A-pre.sav + load + one End Turn gives 4c356f59..., twice, and differs from 7a8b3d5e... in 17 leaves of ONE AI fleet's movement (Zeta Fleet V moved in the continuation, stayed put after a load). Use the load->turn hashes for the standalone.`
+- **Row 62** — `VM145 = FREE (lane BQ released 2026-09-09; guest RESTORED and verified byte-for-byte to as-found: SavedGames = the same 9 files with identical sha256, binkw32.dll = shimdist-recap 15,527,327 B 903527f4..., shim.cfg = 0ae410cc... hooks=trace, game stopped).` Lane BQ left `C:\SOTS\ui\preBQ\` + `C:\SOTS\ui\bq\` + `ui\bq{deploy,grab,click}.ps1`; `click_helper.ps1` unmodified. **GOTCHA (confirms lane AR's startup correction on a second guest): `fg` + `key {ESC}` x3 spaced ~2.5 s then ~90 s puts the main menu up in about TWO minutes; loading a turn-38/39 save is a further 3-4 min and is NOT compressible.** **GOTCHA (confirms lane M on a second guest): chained clicks through the Load dialog DROP - a three-click chain landed only the first click, twice. ONE click per helper call with a screenshot between.** **TIP: reset SavedGames to EXACTLY ONE file (the run's input) and the Load dialog is one row at (400,262) with nothing to re-derive.** **GOTCHA: `C:\Windows\system32\cmd.exe` windows from the SOTSUI task appear OVER the game and cover the map - `fg` raises the game; screenshot before believing a click landed.** **CONFIRMED: the `Done` pixel at (233,673) reads (183,18,0) with a query up and (0,0,0) on the map; `Auto Resolve Peacefully` (667,641) shows a tooltip and fills the centre panel with the dove, so the selection is confirmable from a screenshot before `Done`.**
+- **`determinism-oracle.md` "Recommended canonicalization rule" / row for the oracle** — append: `CORRECTED 2026-09-09 (lane BQ, rule 11): "mask Player.Status and Summary.Checksum; NOTHING ELSE VARIES" is FALSE on ar-oracle-A-pre/post. `--mask resave` leaves ONE leaf standing - `/CD[1]/NPrvVa`, which advances by exactly +5.00 across a load (and per turn boundary), and FALLS on a combat turn. The old rule was derived on three-player early-game saves with an empty CD[1] diplomacy block. Any load->turn comparison must mask it too, or no load->turn run can ever reproduce a continuation's hash.`
+- **Row 326 / the seed rows** — append: `SHARPENED 2026-09-09 (lane BQ): a research pick is exposed only when the CANDIDATE LIST has more than one entry. Measured on ar-oracle-A-post -> 40: Player[32] entered with ResTNm == '', producers A and B returned null, the candidate walk ran, `candidatesTried=1`, and the pick AGREED across two fresh processes. `ResTNm == ''` predicts a pick, not a divergence.`
+