lane BQ merged: load-boundary scope on AR's pair, peaceful auto-resolve is not combat-free, rule 26(c) marked as a screen not a decision procedure

campaign/DASHBOARD.md

@@ -1,16 +1,16 @@
 # SotS RE campaign — coverage dashboard
 
-Generated 2026-09-09 06:02 UTC · `sots-re` @ 371f789,2026-09-09 · `sots-engine` @ 1654785,2026-09-09 (241 commits) · regenerate with `tools/dashboard.py`
+Generated 2026-09-09 06:15 UTC · `sots-re` @ c43f638,2026-09-09 · `sots-engine` @ 1654785,2026-09-09 (241 commits) · regenerate with `tools/dashboard.py`
 
 > **North star:** A functional reimplementation of the engine — behavior-equivalent, NOT byte-for-byte
 
 ## 1. Map coverage (campaign/board.md)
 
-425 targets · mapped-or-better **378/425** `[█████████░] 89%` · verified **336/425** `[████████░░] 79%`
+428 targets · mapped-or-better **381/428** `[█████████░] 89%` · verified **339/428** `[████████░░] 79%`
 
 | Status | Count | % |
 |---|---:|---:|
-| verified | 336 | 79% |
+| verified | 339 | 79% |
 | mapped | 42 | 10% |
 | in-progress | 4 | 1% |
 | backlog | 41 | 10% |
@@ -19,12 +19,12 @@ Generated 2026-09-09 06:02 UTC · `sots-re` @ 371f789,2026-09-09 · `sots-engine
 | Type | verified | mapped | in-progress | backlog | blocked | total |
 |---|---:|---:|---:|---:|---:|---:|
 | objects | 46 | 6 | 0 | 3 | 1 | 56 |
-| control-flow | 33 | 2 | 0 | 0 | 0 | 35 |
+| control-flow | 34 | 2 | 0 | 0 | 0 | 36 |
 | subsystems | 4 | 8 | 0 | 2 | 1 | 15 |
 | engine | 31 | 0 | 0 | 0 | 0 | 31 |
 | verify | 104 | 15 | 3 | 35 | 0 | 157 |
 | phase2 | 13 | 3 | 1 | 0 | 0 | 17 |
-| meta | 86 | 6 | 0 | 1 | 0 | 93 |
+| meta | 88 | 6 | 0 | 1 | 0 | 95 |
 | other | 19 | 2 | 0 | 0 | 0 | 21 |
 
 ## 2. Binary understanding
@@ -133,11 +133,11 @@ Most recent open:
 
 ## 9. Delta since previous dashboard
 
-- verified targets: 333 → 336 (+3) · mapped-or-better: 375 → 378 (+3)
+- verified targets: 336 → 339 (+3) · mapped-or-better: 378 → 381 (+3)
 - engine LOC: 58,647 → 58,647 (+0) · test files: 122 → 122 (+0) · checks: 4,257 → 4,257 (+0)
 - addresses verified: 1,160 → 1,160 (+0) · recovered layouts: 384 → 384 (+0) · open questions: 26 → 26 (+0)
 - standalone leaves closed: 45 → 45 (+0) · leaves still diverging: 63 → 63 (+0)
 
 ---
 warnings: board.md: unknown types subsystems; mars-rng.md: no oracle total row parsed; mars-stream.md: no oracle total row parsed; mars-vfs.md: no oracle total row parsed
-<!-- dashboard-metrics {"verified": 336, "mapped_plus": 378, "targets": 425, "loc": 58647, "tests": 122, "checks": 4257, "addr_verified": 1160, "addr_total": 1291, "layouts": 384, "open_q": 26, "sa_closed": 45, "sa_left": 63} -->
+<!-- dashboard-metrics {"verified": 339, "mapped_plus": 381, "targets": 428, "loc": 58647, "tests": 122, "checks": 4257, "addr_verified": 1160, "addr_total": 1291, "layouts": 384, "open_q": 26, "sa_closed": 45, "sa_left": 63} -->

findings/subsystems/determinism-oracle.md

@@ -32,6 +32,19 @@ resets a per-player `Status` int (4 → 0) on load, which also moves the derived
 See "Round-trip stability" below for the canonicalization rule if a harness ever compares a loaded
 `(Autosave).sav` against a re-save of it.
 
+> **CORRECTED IN PLACE 2026-09-09 (lane BQ, rule 11).** "Mask `Player.Status` and `Summary.Checksum`;
+> **nothing else varies**" is **false** on the late-game saves. `--mask resave` leaves one more leaf
+> standing: **`/CD[1]/NPrvVa`, which advances by exactly +5.00 across a load** (and per turn
+> boundary), and falls on a combat turn. The old rule was derived on three-player early-game saves
+> whose `CD[1]` diplomacy block is empty, and it was true of those. **Any load → turn comparison must
+> mask `NPrvVa` too, or no load → turn run can ever reproduce a continuation's hash** — lane BQ's
+> probe 1b was unsatisfiable on that leaf alone before any AI behaviour entered the question.
+>
+> The canonicalisation itself is **exonerated**: the pre-turn round trip is byte-exact apart from
+> that one leaf. What is *not* safe is assuming a continuation's hash is reachable by load at all —
+> see the board's load-boundary scope row: an AI fleet was issued a move order in the continuation
+> and none after a load, **both reproducibly**.
+
 ## Revalidated 2026-09-08 (lane H)
 
 Lane N's End Turns overwrote the three autosave *contents* on VM140 (the file set was untouched).

guides/method-rules.md

@@ -400,6 +400,29 @@ mechanism.
 > decode which consumer was reached before reasoning from the leaves — "the AI varies per process"
 > is a fact about a turn, not about the engine.
 
+> **(c) is weaker than it was published as — read this before using it.** Written 2026-09-09 from
+> three states read after the fact; **its first forward test falsified it twice the same day**, and
+> the honest statement is now:
+>
+> * `ResTNm == ''` **predicts that a pick is made, not that it varies.** Exposure needs the candidate
+>   list to have **more than one entry**, and lane BQ measured `candidatesTried = 1` on a turn whose
+>   pick agreed across two processes. **That count is not readable from the pre-turn save.**
+> * There is a **false-positive class visible before any run**: players carrying the signature who
+>   have no AI client or `NumOwn == 0`. Read the predicate only for a non-eliminated AI player that
+>   actually runs.
+> * **There is no combat term and there needs to be one.** A turn was exposed through
+>   `RunCombatRound`, and the save names that condition as plainly as it names `ResTNm`: an AI fleet
+>   standing at an enemy colony. `Auto Resolve Peacefully` means *"I commit no ships"*, **not**
+>   *"no combat occurs"* — the defender's planet still fires, and its kill count varied.
+> * **A fourth term is not a predicate on the save at all.** The same turn ran one way by
+>   continuation and another way after a load, **both reproducibly** — so exposure is a property of
+>   `(save, procedure, load history)`, not of `(save, turn)`. The instruction to record a pair as
+>   `(save, procedure, hashes)` was already right, and is now load-bearing for a reason it did not
+>   anticipate.
+>
+> So (c) is a **useful screen, not a decision procedure**: it can tell you a control is *likely* to
+> vary, and it cannot certify that one will agree. A resolver holds the restatement.
+
 ## 27. A ratchet is meant to break when the corpus grows — do not move it, and scope your control
 
 The save corpus went from 11 to 19 in one evening as lanes finally manufactured workloads nobody had