diff --git a/ghidra/addresses.d/ar.json b/ghidra/addresses.d/ar.json
index d1c5a6c..d730924 100644
--- a/ghidra/addresses.d/ar.json
+++ b/ghidra/addresses.d/ar.json
@@ -44,7 +44,7 @@
       "name": "StarFleet_GetCrewSpeciesForIntercept",
       "addr": "0x0081a2d0",
       "convention": "cdecl",
-      "prototype": "int __cdecl (StarFleet* fleet)  // returns the fleet owner's species (FUN_0071e280(fleet)->+0x5c) on the default path; only when that species is 4 does it scan the fleet's ship vector (+0xa4..+0xa8) for a ship whose design->+0x14->+0xac..+0xb4 slot is non-null and return THAT record's +0x4 instead. Called TWICE from FUN_00820af0 (0x00820bcf, 0x00820bdd) -- once compared against 1, once used as the index into SpeciesDef_Table",
+      "prototype": "int __cdecl (StarFleet* fleet)  // returns the fleet owner's species (FUN_0071e280(fleet)->+0x5c) on the default path; only when that species is 4 does it scan the fleet's ship vector (+0xa4..+0xa8) for a ship whose design->+0x14->+0xac..+0xb4 slot is non-null and return THAT record's +0x4 instead. Called TWICE from FUN_00820af0 (0x00820bcf, 0x00820bdd) -- once compared against 1, once used as the index into g_SpeciesDefTable via SpeciesDef_Get",
       "status": "verified",
       "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-09)"
     }
diff --git a/ghidra/generated/sots_addresses.h b/ghidra/generated/sots_addresses.h
index cf48a86..57b2f2f 100644
--- a/ghidra/generated/sots_addresses.h
+++ b/ghidra/generated/sots_addresses.h
@@ -1,5 +1,5 @@
 // GENERATED — do not edit. Facts about Sword of the Stars.exe (GOG 1.8.1).
-// Source: sots-re ghidra/addresses.json @ f8ff1b6, generated 2026-09-09 by tools/gen_addresses.py
+// Source: sots-re ghidra/addresses.json @ db4fda2, generated 2026-09-09 by tools/gen_addresses.py
 // Runtime address = (uintptr_t)GetModuleHandle(NULL) + RVA (the exe is ASLR-relocated).
 #pragma once
 #include <cstdint>
@@ -1291,7 +1291,7 @@ constexpr uint32_t Vector_ResizePtr = 0x00059f70;
 constexpr uint32_t SpeciesDef_InterceptFlagWord = 0x00710b44;
 // thiscall bool __thiscall (SpeciesDef* this)  // 12 B: `xor eax,eax; cmp [ecx+0x144],eax; setne al; ret`. TRUE for HUMAN (species 0) and ZUUL (species 5) only. This is the third disjunct of FUN_00820af0's short-circuit, so a HUMAN raider intercepts at frac = 1.0 and the NextFloat at 0x00820c1b IS NOT DRAWN -- correcting lane AG section 3.3's committed `3 words on a success` and section 5.2's `B costs 2 on a success`, both of which hold only for a raider whose species does not set this flag  [verified]
 constexpr uint32_t SpeciesDef_HasInterceptFlag = 0x0013baf0;
-// cdecl    int __cdecl (StarFleet* fleet)  // returns the fleet owner's species (FUN_0071e280(fleet)->+0x5c) on the default path; only when that species is 4 does it scan the fleet's ship vector (+0xa4..+0xa8) for a ship whose design->+0x14->+0xac..+0xb4 slot is non-null and return THAT record's +0x4 instead. Called TWICE from FUN_00820af0 (0x00820bcf, 0x00820bdd) -- once compared against 1, once used as the index into SpeciesDef_Table  [verified]
+// cdecl    int __cdecl (StarFleet* fleet)  // returns the fleet owner's species (FUN_0071e280(fleet)->+0x5c) on the default path; only when that species is 4 does it scan the fleet's ship vector (+0xa4..+0xa8) for a ship whose design->+0x14->+0xac..+0xb4 slot is non-null and return THAT record's +0x4 instead. Called TWICE from FUN_00820af0 (0x00820bcf, 0x00820bdd) -- once compared against 1, once used as the index into g_SpeciesDefTable via SpeciesDef_Get  [verified]
 constexpr uint32_t StarFleet_GetCrewSpeciesForIntercept = 0x0041a2d0;
 // __thiscall void (Game::ServerSystem* this, Game::SpyCraft* spy)  /* 48 B, complete: `if (!spy) return; spy->deat(+0x10) = this ? this->[+4] : 0; push_back(&this->spies2(+0x1cc), &spy->sid(+0x4))` via lane AI3's 0x0059f1a0. THE ONLY WRITER THAT EVER MAKES `deat` NON-ZERO AT RUNTIME (the other stores to SpyCraft+0x10 are the zero-init in CreateSpyCraft, the deserializer, and three field copies). Exactly one caller, 0x008874d4 inside ServerSpyManager_DeploySpy, and no vtable slot. THIS SETTLES `spies2`: ServerSystem+0x1cc is the per-system vector of DEPLOYED spy ids, written in the same two instructions as `deat`, which is why it is 0 in every save whose only spy is docked to its tender */  [verified]
 constexpr uint32_t ServerSystem_AddSpy = 0x003514c0;