lane BQ merged: load-boundary scope on AR's pair, peaceful auto-resolve is not combat-free, rule 26(c) marked as a screen not a decision procedure

BP has a per-PROCESS input (two pinned processes disagree); this lane has a
per-HISTORY input (two load processes agree with each other and disagree
with the continuation). One datum against the ASLR reading as stated: the
exe base was identical in all five VM145 processes (0x00f40000, delta
+11796480), so any image-base hypothesis has to name which allocation it
means. Probe 3's ledger taken twice on ar-oracle-A-pre - once by
continuation, once by load - now speaks to both.

campaign/DASHBOARD.md

@@ -1,16 +1,16 @@
 # SotS RE campaign — coverage dashboard
 
-Generated 2026-09-09 06:02 UTC · `sots-re` @ 371f789,2026-09-09 · `sots-engine` @ 1654785,2026-09-09 (241 commits) · regenerate with `tools/dashboard.py`
+Generated 2026-09-09 06:15 UTC · `sots-re` @ c43f638,2026-09-09 · `sots-engine` @ 1654785,2026-09-09 (241 commits) · regenerate with `tools/dashboard.py`
 
 > **North star:** A functional reimplementation of the engine — behavior-equivalent, NOT byte-for-byte
 
 ## 1. Map coverage (campaign/board.md)
 
-425 targets · mapped-or-better **378/425** `[█████████░] 89%` · verified **336/425** `[████████░░] 79%`
+428 targets · mapped-or-better **381/428** `[█████████░] 89%` · verified **339/428** `[████████░░] 79%`
 
 | Status | Count | % |
 |---|---:|---:|
-| verified | 336 | 79% |
+| verified | 339 | 79% |
 | mapped | 42 | 10% |
 | in-progress | 4 | 1% |
 | backlog | 41 | 10% |
@@ -19,12 +19,12 @@ Generated 2026-09-09 06:02 UTC · `sots-re` @ 371f789,2026-09-09 · `sots-engine
 | Type | verified | mapped | in-progress | backlog | blocked | total |
 |---|---:|---:|---:|---:|---:|---:|
 | objects | 46 | 6 | 0 | 3 | 1 | 56 |
-| control-flow | 33 | 2 | 0 | 0 | 0 | 35 |
+| control-flow | 34 | 2 | 0 | 0 | 0 | 36 |
 | subsystems | 4 | 8 | 0 | 2 | 1 | 15 |
 | engine | 31 | 0 | 0 | 0 | 0 | 31 |
 | verify | 104 | 15 | 3 | 35 | 0 | 157 |
 | phase2 | 13 | 3 | 1 | 0 | 0 | 17 |
-| meta | 86 | 6 | 0 | 1 | 0 | 93 |
+| meta | 88 | 6 | 0 | 1 | 0 | 95 |
 | other | 19 | 2 | 0 | 0 | 0 | 21 |
 
 ## 2. Binary understanding
@@ -133,11 +133,11 @@ Most recent open:
 
 ## 9. Delta since previous dashboard
 
-- verified targets: 333 → 336 (+3) · mapped-or-better: 375 → 378 (+3)
+- verified targets: 336 → 339 (+3) · mapped-or-better: 378 → 381 (+3)
 - engine LOC: 58,647 → 58,647 (+0) · test files: 122 → 122 (+0) · checks: 4,257 → 4,257 (+0)
 - addresses verified: 1,160 → 1,160 (+0) · recovered layouts: 384 → 384 (+0) · open questions: 26 → 26 (+0)
 - standalone leaves closed: 45 → 45 (+0) · leaves still diverging: 63 → 63 (+0)
 
 ---
 warnings: board.md: unknown types subsystems; mars-rng.md: no oracle total row parsed; mars-stream.md: no oracle total row parsed; mars-vfs.md: no oracle total row parsed
-<!-- dashboard-metrics {"verified": 336, "mapped_plus": 378, "targets": 425, "loc": 58647, "tests": 122, "checks": 4257, "addr_verified": 1160, "addr_total": 1291, "layouts": 384, "open_q": 26, "sa_closed": 45, "sa_left": 63} -->
+<!-- dashboard-metrics {"verified": 339, "mapped_plus": 381, "targets": 428, "loc": 58647, "tests": 122, "checks": 4257, "addr_verified": 1160, "addr_total": 1291, "layouts": 384, "open_q": 26, "sa_closed": 45, "sa_left": 63} -->

findings/control-flow/seed-exposure-forward-test.md

@@ -210,14 +210,412 @@ game         not running
 
 *(added after the runs; nothing above this line is edited)*
 
+### 4.0 What was run
+
+Five fresh processes on VM145, all with `C:\SOTS\shimdist-l4\binkw32.dll` (`BUILD_ID
+l4r-20260908T2208Z`) and `SavedGames` reset to exactly one file before each launch. The Load dialog
+was screenshotted every time and the row re-derived: with one file it sits at **(400, 262)**, and it
+sat there for all five runs. Main menu verified from a `qm monitor` screendump before every click
+path; no run was driven by sleeping.
+
+**Instrument armed and verified from `shim.log`, not assumed** (rule 1). For all four `hooks=off`
+runs the log reads exactly `config: hooks=off` / `hook: disabled by config` — nothing installed, no
+`ignoring unknown key` lines.
+
+| run | input | config | End Turn | encounter | `(Autosave EndTurn).sav` | `(Autosave).sav` |
+|---|---|---|---|---|---|---|
+| **1b-A** | `ar-oracle-A-pre` (F38) | `l4off` | 1 | none | 107,477 `33e30092…` | 107,732 `4c356f59…` |
+| **1b-B** | `ar-oracle-A-pre` (F38) | `l4off` | 1 | none | 107,477 **`33e30092…`** | 107,732 **`4c356f59…`** |
+| **1-A** | `ar-oracle-A-post` (F39) | `l4off` | 1 | Venkman, **peaceful** | 107,661 `1a9d937b…` | 108,580 `56980aa0…` |
+| **1-B** | `ar-oracle-A-post` (F39) | `l4off` | 1 | Venkman, **peaceful** | 107,661 **`1a9d937b…`** | 108,541 **`b36ac0ec…`** |
+| **1-R** | `ar-oracle-A-post` (F39) | `l4research` | 1 | Venkman, **peaceful** | 107,661 **`1a9d937b…`** | 108,571 **`28bbd9b5…`** |
+
+Run **1-R** is the producer-gate run the resolution names (§4.4); it is the only instrumented run and
+it was taken *after* the two `hooks=off` processes, not instead of them.
+
+### 4.1 Part 1b — P1b is **FALSIFIED**, and the load→turn procedure is nonetheless a valid pair
+
+`ar-oracle-A-pre.sav` + load + one End Turn does **not** reproduce `7a8b3d5e…`. It produces
+`4c356f5916f0e6e4…` — and it produces it **in two fresh processes, byte for byte**, at both snapshot
+points.
+
+> **The load→turn procedure agrees with itself and disagrees with the continuation.** That is not
+> non-determinism; it is a different procedure with a different, reproducible answer.
+
+`state_checksum --floats bits --mask none` against AR's `ar-oracle-A-post.sav`: **23 leaves**, and
+they are not the research leaves at all.
+
+| leaves | what |
+|---|---|
+| 1 | `/CD[1]/NPrvVa` 501.13 → 506.13 — the load-boundary counter (§4.3) |
+| 2 | `/Summary/Checksum` (derived), `/Sim/ModCount` 2147 → 2145 |
+| **17** | **`Flt[1570 "Zeta Fleet V"]` (PID 32)** — `FPlan` only-in-A, `HFPlan` True→False, `FtFlg` 13→12, `LocID` 0→432, `Pos`/`FtOrig`/`PrvPos` all three components, both ships' `Range` 7.0 → 9.0 |
+| 2 | `Sys[432 "Alpha Centauri"]` `NumFlts` 0→1, `Flt` only-in-B, `FFlags` 0→2 |
+| 1 | `Flt[914 "Nu Fleet III"]` `HLay` False→True, `Lay` only-in-B |
+
+Read off `ar-oracle-A-pre.sav`: `Zeta Fleet V` enters turn 39 parked at Alpha Centauri (`LocID 432`,
+`HFPlan False`, both ships at full `Range 9.0`).
+
+- **In AR's continuation** the AI issued it a move order — a `FPlan` with one waypoint (`Wpt 320`,
+  `FPsp2 2.0`, `FPeta2 3`, `pnd 432`), the fleet left the system, `FtFlg` went to 13 and the ships
+  burned 2 ly of range.
+- **In both of my loads** the AI issued nothing: the fleet is still at Alpha Centauri with full
+  range, and the system's `NumFlts` records it as present.
+
+**This is an AI fleet-task decision — the exact consumer class the resolution lists as
+unidentified — and it came out differently across the load boundary while coming out identically in
+two processes on each side of it.** Two `hooks=off` processes from turn 37 agree (AR, plus AR's
+instrumented third); two `hooks=off` processes from a load of turn 38 agree (this lane). They do not
+agree with each other.
+
+So the honest statement, and it is the one that matters for the standalone:
+
+> **`ar-oracle-A-pre.sav → 7a8b3d5e…` is NOT a load→turn pair and must not enter
+> `determinism-hashes.txt` as one.** What *is* certified, by two fresh processes, is a different
+> pair: `ar-oracle-A-pre.sav` → **(load, one End Turn)** → `(Autosave EndTurn).sav`
+> `33e3009254f5acd1…`, `(Autosave).sav` `4c356f5916f0e6e4…`.
+
+The single-turn pair still exercises the trade-raid roll (four raiders parked, no encounter), so the
+standalone gets its first trade-raid calibration pair — with the load→turn hashes, not AR's.
+
+### 4.2 The resave canonicalisation is **not** the cause — and the round-trip rule needs one addition
+
+The resolution named the resave canonicalisation as the first suspect if P1b failed. It is
+exonerated, and the measurement that exonerates it is P1b-aux.
+
+**Pre-turn form** (`ar-oracle-A-pre.sav` vs its own resave, my `(Autosave EndTurn).sav`): **1 leaf**.
+Not `Status`, not `Checksum` — those are already 0/consistent in a pre-turn file, exactly as
+`determinism-oracle.md` says. The one leaf is `/CD[1]/NPrvVa`, +5.00.
+
+**Post-turn form** (`ar-oracle-A-post.sav` vs my run 1-A `(Autosave EndTurn).sav`): **6 leaves** —
+`Summary/Checksum`, the four `Player.Status` 4 → 0, and `/CD[1]/NPrvVa` +5.00. Applying the
+campaign's documented rule (`--mask resave`, "mask every `Player.Status` and `Summary.Checksum`;
+**nothing else varies**") leaves **exactly one leaf standing**:
+
+```
+policy: floats=bits mask=resave  [masked: Checksumx1, Statusx8]
+DIVERGED: 1 leaf difference(s)
+  /CD[1]/NPrvVa: 501.13360595703125 -> 506.13360595703125
+```
+
+> **Correction to `determinism-oracle.md`, "Round-trip stability" / "Recommended canonicalization
+> rule" (rule 11):** *"Nothing else varies"* is **false** on this save. `/CD[1]/NPrvVa` advances by
+> exactly **+5.00** across a load, in both the pre-turn and the post-turn form, and `--mask resave`
+> does not cover it. The rule was derived on `ref-turn2` / `turn2-state`, three-player early-game
+> saves; this is a two-empire turn-38 save with a populated `CD[1]` diplomacy block, and the ratchet
+> broke on new content exactly as rule 27 describes.
+
+What `NPrvVa` is, measured rather than assumed: it sits in the `CD[1]` custom-data block next to
+`NPrv` (a count) and `NPrvId` (a player id, 16 here), so it reads as a per-player provocation /
+threat value. Its observed behaviour: **+5.00 per turn boundary crossed, plus +5.00 across the load**
+(496.13 at F38 → 501.13 at F39 in AR's process; 496.13 loaded → 501.13 at the End Turn press →
+506.13 at F39 in mine). It is **not** a monotone counter: on turn 40 it *fell*, to 461.48 in run 1-A
+and 476.65 in run 1-B, tracking that turn's combat.
+
+Because it advances on the load itself, **no load→turn run can ever reproduce a continuation's hash
+on this leaf**, independently of anything the AI does. P1b was unsatisfiable on `NPrvVa` alone; the
+other 22 leaves are the substantive result.
+
+### 4.3 Part 1 — P1 is **half right, and wrong about the mechanism**
+
+The two `hooks=off` processes **differ**: `56980aa086e1a145…` (108,580 B) vs `b36ac0ec2986f3a8…`
+(108,541 B). `state_checksum`: **144 leaf differences**.
+
+**But the `(Autosave EndTurn).sav` is identical in all three turn-39 loads** (`1a9d937b…`, 107,661 B,
+runs 1-A, 1-B and 1-R). The load is perfectly reproducible; the divergence is entirely inside the
+turn.
+
+And the divergence is **not** the research pick. Where the 144 leaves live:
+
+| leaves | subtree |
+|---|---|
+| 50 | `/Sim/crep[29]/*` — the combat report (per-ship damage, weapon rows, `cpk`, `cdt`) |
+| 41 | `Flt[2274 "Sigma Fleet VII"]` (PID **32**) — the AI fleet in the fight: `NShips` 5 vs 6, three different ship ids, hull health, 16 `TH`/`THM` pairs on one ship |
+| 8 | `Sys[224 "Venkman"]` — `Pop`, `PopC`, `Infra`, `Res`, `Suit`, `RepCur`, `RepMax`, `pbon` |
+| 6 | `/CD[1]/CmbR[2]/…/TacReports` |
+| 4 | `/Sim/turnstats/history/…` |
+| 20 | `Player[16 "re"]`: `BnkPr`, `BnkEl`, `otch`×6, `owep`×4, `odes`×2, `ShipRecs`, `preps`, the turn-40 `EvMsg` |
+| 13 | `Player[32]`: `Maint`, `ShipRecs`×8, `odes`, `owep`×2, `otch`×2, the turn-40 `EvMsg` |
+| 2 | `/Sim/ShipIDs[]`, `/Summary/Checksum` |
+| 1 | `/CD[1]/NPrvVa` |
+
+The two `EvMsg` strings say what happened in one sentence each:
+
+```
+A: "...147,834,923 Imperial citizens were killed. ... 2 enemy ships were destroyed."
+B: "... 78,818,284 Imperial citizens were killed. ... 1 enemy ship was destroyed."
+```
+
+**The AI's `Sigma Fleet VII` attacked player 16's colony Venkman, the human committed no ships
+("No ships available", `Auto Resolve Peacefully` in both runs), and the planetary defences killed
+two raiders in one process and one in the other.** Ship deltas confirm it exactly: both runs
+completed the *same* two ships for PID 32 (`+8848, +8864`); run A lost `7744` and `7952`, run B lost
+`8000`. Nothing else about the turn moved.
+
+**Now the leaf-by-leaf verdict on what P1 named:**
+
+| P1 clause | verdict |
+|---|---|
+| the two files **differ** | **CONFIRMED** |
+| `/Sim/RNG` identical | **CONFIRMED** — the 2,503-byte raw block is byte-equal (`a689d7a3…`) in both |
+| `/Sim/trdmgr` identical | **CONFIRMED** — no `trdmgr` leaf in the diff |
+| **every player-0 fleet** identical | **CONFIRMED** — all five PID-16 fleets (3744, 6544, 33, 49, 81) match on id, `LocID`, `Pos` and ship count |
+| difference confined to `Player[32]`'s `TechTree/*`, `ResTNm`, `otch`, `Events`, `turnstats`, `Checksum` | **FALSIFIED** — no `TechTree` leaf and no `ResTNm` leaf differs at all, and the difference reaches a colony's population, both players' banks and the combat reports |
+| **every `Player[16]` leaf** identical | **FALSIFIED** — twenty `Player[16]` leaves moved |
+
+**The research pick did not vary.** Both processes set Player[32]'s `ResTNm` to **`BIO_GrvAdpt`**,
+`otch` 47 in both, `NumDes` 47, `NumOwn` 18. The predicate's own signature — `ResTNm == ''` at turn
+start for the one player that can research — fired, a pick *was* made, and it was the **same pick in
+both processes**.
+
+### 4.4 The producer gate, run — and the answer is better than "a producer supplied it"
+
+The resolution's follow-up for exactly this outcome: *"a producer supplied the target … and the
+predicate needs a producer gate. One run with lane L4's `airesearch=on` dump names which producer
+returned non-null."* That config is on the guest already (`shimdist-l4\shim.cfg.l4research`), so it
+cost one run and no build. Run **1-R**, same input, same procedure, same peaceful resolution.
+
+`verify/results/shim/bq/bq-res-aiorders.txt`, the whole research record for the turn:
+
+```
+---- airesearch sel=1 agent=0x32446560 ... curTarget=0x00000000 species=2 ----
+aicand   sel=1 idx=0 agent=0x32446560 slot=0x3244669c w0=0x00000002(2) w1=0x00000001(1)
+airesult sel=1 candidatesTried=1 chose='BIO_GrvAdpt' (ptr=0x0463fd3c)
+---- airesearch sel=2 ... curTarget=0x04707c50 species=0 ----      (PID 496, target held)
+---- airesearch sel=3 ... curTarget=0x0d6c34a8 species=2 ----      (PID 512, target held)
+
+aiprobe idx=16 AIResearch::ProducerA     turn=3 total=3
+aiprobe idx=17 AIResearch::ProducerB     turn=3 total=3
+aiprobe idx=18 AIResearch::FallbackIndex turn=0 total=0
+aiprobe idx=19 AIResearch::FallbackArm   turn=0 total=0
+```
+
+> **It was not a producer short-circuit. Player[32] reached producer C — the candidate walk — and the
+> candidate list had length ONE.** Producers A and B were entered once per AI player and both
+> returned null for the `curTarget == 0` agent; `SelectResearchTarget` ran; `TryResearchCandidate`
+> was offered exactly one candidate and accepted it; the `0x006b36e0 & 7` fallback rotation was never
+> reached (`FallbackIndex` / `FallbackArm` both 0).
+
+`candidatesTried = 1` is the whole explanation. **The outcome set of that pick is a singleton because
+the candidate vector holds one element**, and no draw on any stream can change a one-element choice.
+
+That is a *different* mechanism from the one the resolution guessed, and it is strictly more useful,
+because it is a **counting** criterion rather than a code-path one. It also reconciles the three
+lanes without special pleading:
+
+| state | `ResTNm == ''`? | path | outcome set | control |
+|---|---|---|---|---|
+| `turn1-state`, PID 32 (lane L4) | yes | producers A/B, no walk | 1 | (varies — for other reasons; see below) |
+| `turn1-state`, PID 512 (lane L4) | yes | walk, **1 candidate** | 1 | — |
+| `as-turn15 → 16`, PID 32 (lane AS) | yes | not measured | **> 1** (A chose 64, B chose 62) | **varies**, 22 leaves |
+| **`ar-oracle-A-post → 40`, PID 32 (this lane)** | **yes** | **walk, 1 candidate** | **1** | **pick agrees** |
+
+**So `ResTNm == ''` is a necessary condition for research exposure, not a sufficient one.** The
+sufficient condition is `|candidates accepted by TryResearchCandidate| > 1`, and that is not readable
+from the pre-turn save — it needs the walk. §5 states the corrected predicate.
+
+### 4.5 What actually varies on turn 40, and why it is the warning already on the books
+
+The varying decision is **combat resolution**, and resolution 09-08 §6 already carries the warning:
+*"combat turns are not yet known to be cross-process reproducible."* AR added one datum against it —
+a turn-38 encounter auto-resolved peacefully that reproduced across three processes — and explicitly
+declined to treat that as discharging the warning, on the reasoning that "peacefully" probably
+bypasses `RunCombatRound`.
+
+**AR was right to decline, and the reason is now measured: `Auto Resolve Peacefully` does not
+bypass combat when the defender is a colony.** The human committed no ships; the *planet* fought,
+`RunCombatRound` ran, and it is per-process. Three processes on the same input produced three
+different kill counts (2 / 1 / — run 1-R gives a third distinct file, `28bbd9b5…`, whose 48-leaf diff
+against run 1-A is again wholly inside `crep`, `Sigma Fleet VII`, `Venkman` and the two `EvMsg`s).
+
+> **`Auto Resolve Peacefully` is not a determinism-preserving resolution.** It means "I commit no
+> ships", not "no combat occurs". A procedure that contains a peaceful auto-resolve is reproducible
+> only if the *other* side also has nothing to fight with — which is why AR's turn-38 encounter
+> reproduced and this turn-40 one does not.
+
+**One consequence for rule 26 (c), and it is the sharp one.** Rule 26 says a control must agree with
+itself before it exonerates anything. Here the control varies, so nothing on turn 40 can be measured
+off a single run — and the *sub-tree* discipline lane AD used is what saves the turn: `/Sim/RNG`,
+`/Sim/trdmgr` and every player-0 fleet **are** identical across the two processes, so a lane
+measuring the trade half on this turn has a valid sub-tree, and a lane measuring anything downstream
+of Venkman does not.
+
+### 4.6 Read next to lane BP's probe 2 — two lanes, one afternoon, the same layer
+
+Lane BP's `pinned-seed-rich-turn.md` landed on VM146 while these runs were in flight, and its result
+and this one point at the **same layer of the AI from opposite directions**. Neither lane knew the
+other's answer when it committed its prediction.
+
+| | lane BP (probe 2) | lane BQ (probe 1b) |
+|---|---|---|
+| what was held constant | the per-client **seed** (pinned), same process shape | the **save** (identical input, identical `hooks=off` config) |
+| what varied | the process | the **route to the state** — continuation from turn 37 vs load of turn 38 |
+| residue | newly allocated **fleet ids** paired differently with newly formed fleets | a fleet's **move order** issued in one route and not the other |
+| BP's reading | a per-process input that is not the seed; *inferred* to be a pointer-keyed container under ASLR | — |
+
+**One datum this lane can hand BP for free, and it is against the ASLR hypothesis as stated.**
+`shim.log` records the image base on every launch, and on VM145 it was **identical in every one of
+the five processes**: `exe base=0x00f40000 (link-time image base 0x00400000, ASLR delta
++11796480)`. Different pids, different sessions, same base. That does not touch heap addresses —
+BP's residue could still be a heap-pointer-ordered container — but it does mean *exe* ASLR is not
+varying on these guests, so any hypothesis that reaches for image-base randomisation needs to say
+which allocation it means.
+
+And the two results are not the same phenomenon: BP's two processes **disagreed** with each other,
+while this lane's two load processes **agreed** with each other and disagreed with the continuation.
+So BP has a per-process input and this lane has a **per-history** input. Both live in the fleet
+layer, and both are open. Probe 3's per-client draw ledger, taken on `ar-oracle-A-pre → 39`
+**twice — once by continuation from turn 37 and once from a load** — is now the single measurement
+that would speak to both.
+
 ---
 
 ## 5. Verdicts on the committed predictions
 
-*(added after the runs)*
+| # | prediction | verdict |
+|---|---|---|
+| **P1b** | `ar-oracle-A-pre.sav` + load + one End Turn → `7a8b3d5e…` | **FALSIFIED.** It produces `4c356f59…`, reproducibly, in two fresh processes. 23 leaves apart from AR's continuation; 17 of them one AI fleet that the continuation moved and the load did not |
+| **P1b-aux** | the same run's `(Autosave EndTurn).sav` = `15b99255…` (the input's own hash) | **FALSIFIED by exactly one leaf** — `/CD[1]/NPrvVa`, +5.00. Every other leaf of the pre-turn round trip is byte-exact, so this lands in the fourth branch P1b-aux enumerated: *"the resave is not byte-exact but is behaviourally equivalent"*. **The resave canonicalisation is exonerated as the cause of P1b's failure**, and `determinism-oracle.md`'s "nothing else varies" is corrected (§4.2) |
+| **P1** | the two turn-40 files **differ** | **CONFIRMED** |
+| **P1**, clause: `/Sim/RNG`, `/Sim/trdmgr`, every player-0 fleet identical | **CONFIRMED**, all three |
+| **P1**, clause: difference confined to `Player[32]`'s `TechTree/*`, `ResTNm`, `otch`, `Events`, `turnstats`, `Checksum` | **FALSIFIED.** **Zero** `TechTree` leaves and **zero** `ResTNm` leaves differ. The difference is a combat at Venkman and its consequences |
+| **P1**, clause: every `Player[16]` leaf identical | **FALSIFIED** — twenty of them moved |
+
+**The prediction was right for the wrong reason, and that is the result.** P1 said the files would
+differ *because the research pick is exposed*. The files differ, the research pick is **not**
+exposed, and the exposed decision is one the predicate does not mention at all.
+
+### 5.1 The predicate, corrected
+
+Rule 26 corollary (c) currently reads *"`ResTNm == ''` names a pick turn"*. Measured here:
+
+1. **`ResTNm == ''` at turn start is necessary, not sufficient.** It names a turn on which a pick
+   will be *made*. Whether that pick is *exposed* is `|candidates| > 1`, and on this state
+   `|candidates| = 1` (§4.4, `candidatesTried=1`). A pick with one candidate is a decision with
+   outcome set 1 — the resolution's own criterion, satisfied.
+2. **The predicate has a false-positive class that was visible before the run** (§1.4): four NPC
+   players carry `ResTNm == ''` on every turn of this lineage, including the turns whose controls
+   agree. All four have `NumOwn == 0`. The predicate must be read only for a non-eliminated AI player
+   with `NumOwn > 0`.
+3. **The predicate is incomplete on the other side: it has no combat term.** Turn 40 was exposed
+   through `RunCombatRound`, and the pre-turn save *does* name the condition — an AI fleet
+   (`Sigma Fleet VII`, PID 32) standing at an enemy colony (`Venkman`, PID 16). That is as readable
+   from the save as `ResTNm` is, and it belongs in the predicate.
+4. **A fourth term, and it is not a predicate on the save at all: the load boundary.** Turn 39 ran
+   one way in a process that had just run turn 38 and another way in a process that loaded turn 38's
+   autosave — with both sides reproducible. So the pre-turn save does **not** fully determine the
+   next turn's AI fleet-task decisions. Whatever `Zeta Fleet V`'s move order depended on was **not in
+   the file**. That is a bigger claim than exposure and it is the one this lane would send back to
+   the resolver.
+
+---
+
+## 6. Coverage, and what was not done (rule 15)
+
+* **Two processes per pair, not three.** Rule 26's bar, matching AR's. Run 1-R is a third process on
+  the part-1 input but it is instrumented, so it counts as corroboration of *variability*, not as a
+  third control.
+* **Rule 19 cannot be run on turn 40, and it is worth saying why.** The `hooks=off` control varies
+  here, so an instrumented run agreeing with either arm would be a `1/k` coincidence with `k ≥ 3`
+  (rule 26). Run 1-R produced a third distinct file; that is consistent with neutrality and proves
+  nothing about it. **No neutrality claim is made for `l4research` on this state.**
+* **The 1b divergence is localised but not explained.** This lane measured *that* the load boundary
+  changes an AI fleet-task outcome; it did not identify the input that is missing from the save. That
+  needs probe 3's per-client draw ledger with `this` recorded, on `ar-oracle-A-pre → 39`, taken twice
+  — once by continuation from turn 37 and once from a load. The site that fires in one and not the
+  other is the answer, and the resolution has already queued exactly that instrument.
+* **`|candidates| = 1` is one observation on one turn.** It explains this agreement; it is not a
+  claim that the candidate list is usually 1 (lane AS's state clearly had more). Rule 20: do not fit
+  a constant to one observation.
+* **The combat was measured, not decoded.** Three kill counts (2, 1, and run 1-R's own) on one
+  encounter. No draw site is attributed — `hooks=off` throughout for the two controls, and this lane
+  makes no claim about which consumer inside `RunCombatRound` varies.
+* **The `0x0069dbb0` fuse cannot have fired** in any of these runs (earliest fire is 3 turns after
+  the load that draws it), so nothing here bears on it in either direction.
+* **`/CD[1]/NPrvVa` is named, not decoded.** Its neighbours (`NPrv`, `NPrvId = 16`) read as a
+  per-player provocation record and its behaviour is +5.00 per turn boundary and per load, falling on
+  a combat turn. No writer was looked for. It is a one-line watchpoint for whoever wants it (rule 18).
+
+---
+
+## 7. Artefacts
+
+| what | where |
+|---|---|
+| this document | `findings/control-flow/seed-exposure-forward-test.md` |
+| **1b pair**, two fresh `hooks=off` processes, byte-identical | `verify/results/saves/bq/bq-1b{A,B}-{endturn,post}.sav` (`33e30092…` / `4c356f59…`) |
+| **part 1**, two fresh `hooks=off` processes, **differ** | `verify/results/saves/bq/bq-1{A,B}-post.sav` (`56980aa0…` / `b36ac0ec…`), shared `bq-1{A,B}-endturn.sav` (`1a9d937b…`) |
+| producer-gate run (instrumented, `l4research`) | `verify/results/saves/bq/bq-res-post.sav` (`28bbd9b5…`) |
+| **the research record** — `candidatesTried=1 chose='BIO_GrvAdpt'` | `verify/results/shim/bq/bq-res-aiorders.txt` |
+| shim log (install status for all 20 aiprobes + 3 airesearch detours) | `verify/results/shim/bq/bq-res-shim.log` |
+| inputs (unchanged) | `verify/results/saves/ar-oracle-A-{pre,post}.sav` |
+
+`verify/results/saves/bq/` is a subdirectory, so it is invisible to the corpus scan
+(`find_saves()` uses a non-recursive `os.listdir` on `*.sav`) and **the coverage ratchet is not
+touched** (rule 27). None of these files should be promoted into the corpus without deciding that
+question deliberately.
+
+---
+
+## 8. VM145 as left
+
+**Hold released. Guest restored and verified byte-for-byte against the as-found snapshot** (§3):
+
+```
+SavedGames   the same 9 files, every sha256 identical to as-found
+binkw32.dll  15,527,327 B  903527f4a698eea9…   (= shimdist-recap, recap-7584bad-20260908T0615Z)
+shim.cfg     0ae410cc72fe1558…  hooks=trace     (lane R's recapture config)
+game         stopped, as found
+```
+
+Left in place, all additive: `C:\SOTS\ui\preBQ\` (the as-found SavedGames snapshot),
+`C:\SOTS\ui\bq\` (the two input saves and this lane's outputs), and
+`C:\SOTS\ui\bq{deploy,grab,click}.ps1`. **`click_helper.ps1` is unmodified.**
+
+**Four things for the next holder of VM145.**
+
+* **Startup is ~2 minutes if you drive it**, confirming lane AR's correction on VM141: `fg` +
+  `key {ESC}` ×3 spaced ~2.5 s, then ~90 s, and the main menu is up. Loading a turn-38/39 save is a
+  further **3–4 minutes** and is not compressible. Verify both from a screendump; `tools/vmshot.py
+  --one 145` is one call and does not touch the guest.
+* **Chained clicks in one `cmd.txt` are unreliable through the Load dialog.** A three-click chain
+  (`Load Game` → `Single Player` → `OK`) landed only the first click, twice. **One `bqclick.ps1`
+  call per click, with a screenshot between**, is the only thing that worked reliably —
+  independent confirmation of lane M's gotcha, on a different guest.
+* **Reset `SavedGames` to exactly one file — the run's input.** The Load dialog then has one row at
+  **(400, 262)** and there is nothing to re-derive. `bqdeploy.ps1 -Save <name>` does it, prints the
+  input's sha256, and re-verifies the config.
+* **`C:\Windows\system32\cmd.exe` windows appear over the game** as a side effect of the SOTSUI
+  scheduled task and will cover the map. `fg` raises the game again; screenshot before believing a
+  click landed.
+* **The `Done` pixel test works exactly as documented** and is worth keeping: (233, 673) read
+  **(183, 18, 0)** with the Venkman query up and **(0, 0, 0)** on the map (AR's "≈(8,8,8)" — same
+  thing, the map is near-black there). `Auto Resolve Peacefully` (667, 641) shows a tooltip and the
+  dove fills the centre panel, so the selection is confirmable from a screenshot before `Done`.
 
 ---
 
 ## Proposed board rows
 
-*(added after the runs)*
+New rows:
+
+```
+| PROBE 1: the load->turn pair is NOT the continuation's - AR's second hash does not survive a load, and the load form is its own reproducible pair | meta | verified | high | 100% | 2026-09-09 | **Lane BQ**, VM145, `findings/control-flow/seed-exposure-forward-test.md`, probe 1b of the 09-09 resolution. Prediction committed before the run (commit be14266): `ar-oracle-A-pre.sav` (Frame 38, `15b99255...`) + LOAD + one End Turn reproduces `7a8b3d5e...`. **FALSIFIED.** It produces `4c356f5916f0e6e4...` (107,732 B), and it produces it in TWO FRESH `hooks=off` PROCESSES BYTE FOR BYTE, at both snapshot points (`(Autosave EndTurn).sav` `33e3009254f5acd1...` in both). So the load->turn procedure AGREES WITH ITSELF and DISAGREES WITH THE CONTINUATION. 23 leaves apart from AR's file and **17 of them are ONE AI FLEET**: `Flt[1570 "Zeta Fleet V"]` (PID 32) enters turn 39 parked at Alpha Centauri with full range; in AR's continuation the AI issued it a move order (FPlan Wpt 320, FtFlg 12->13, LocID 432->0, both ships Range 9.0->7.0) and in BOTH loads it issued nothing. Plus `Sys[432]` NumFlts 0->1 and `Flt[914 "Nu Fleet III"]` HLay True/False. **RULING: `ar-oracle-A-pre.sav -> 7a8b3d5e...` MUST NOT enter determinism-hashes.txt as a load->turn pair.** What IS certified, two processes: `ar-oracle-A-pre.sav -> (load, one End Turn) -> 33e30092.../4c356f59...` - and that is still the standalone's first trade-raid pair (four raiders parked, no encounter). **THE RESAVE CANONICALISATION IS EXONERATED**: the pre-turn round trip is byte-exact but for ONE leaf, `/CD[1]/NPrvVa` (+5.00 across a load). CONSEQUENCE: **the pre-turn save does not fully determine the next turn's AI fleet-task decisions** - something `Zeta Fleet V`'s order depended on is not in the file. Resolver case; probe 3's ledger on `ar-oracle-A-pre -> 39` taken BOTH by continuation and by load names the site |
+```
+
+```
+| PROBE 1: turn 40 varies - but NOT by the research pick. `Auto Resolve Peacefully` does NOT bypass combat, and a pick with ONE candidate is not exposed | control-flow | verified | high | 100% | 2026-09-09 | Lane BQ, VM145. `ar-oracle-A-post.sav` (`7a8b3d5e...`, Player[32] `ResTNm == ''`) in two fresh `hooks=off` processes, one End Turn, `Auto Resolve Peacefully` in both. **The files DIFFER** (`56980aa0...` vs `b36ac0ec...`, 144 leaves) - the committed prediction's first clause holds, and so do `/Sim/RNG` identical (2,503-B block byte-equal), `/Sim/trdmgr` identical and every player-0 fleet identical. **THE MECHANISM CLAUSE IS FALSIFIED: ZERO TechTree leaves and ZERO ResTNm leaves differ.** Both processes picked **BIO_GrvAdpt**. The 144 leaves are a COMBAT: the AI's `Sigma Fleet VII` (PID 32) hit player 16's colony Venkman, the human committed no ships, and the PLANET's defences killed 2 raiders in one process and 1 in the other (50 leaves `crep`, 41 the AI fleet, 8 `Sys[224 "Venkman"]`, 20 `Player[16]` - the prediction's "every Player[16] leaf identical" is also FALSIFIED). Both runs completed the SAME two ships (+8848,+8864); only the losses differ (7744+7952 vs 8000). **So `Auto Resolve Peacefully` means "I commit no ships", NOT "no combat occurs" - it is not a determinism-preserving resolution, and resolution 09-08 §6's combat warning is now measured, not just retained.** AR's turn-38 peaceful auto-resolve reproduced because the other side had nothing to fight with. **WHY THE PICK DID NOT VARY - the producer run, `shim.cfg.l4research` already on the guest, no build**: producers A and B were entered once per AI player and BOTH RETURNED NULL for Player[32]; it reached producer C, the candidate walk; `TryResearchCandidate` was offered **ONE** candidate and took it - `airesult sel=1 candidatesTried=1 chose='BIO_GrvAdpt'` - and the `0x006b36e0 & 7` fallback rotation was never reached (FallbackIndex/FallbackArm both 0). **The outcome set is a singleton because the CANDIDATE LIST HAS LENGTH ONE.** Not the producer gate the resolution guessed - a COUNTING criterion, and a better one |
+```
+
+```
+| Rule 26 (c) needs four corrections, all measured on one lineage in one session | meta | verified | high | 100% | 2026-09-09 | Lane BQ, from probe 1. (1) **`ResTNm == ''` is NECESSARY, NOT SUFFICIENT** for research exposure: it names a turn on which a pick is MADE; exposure needs `|candidates accepted by TryResearchCandidate| > 1`, and on `ar-oracle-A-post -> 40` it is 1, so the pick agreed across two processes. Lane AS's varying pick (64 vs 62) had a longer list. The sufficient condition is NOT readable from the pre-turn save. (2) **The predicate has a false-positive class, and it was visible BEFORE the run**: four NPC players (528 Alien Menace, 544 Peacekeeper Enforcer, 560 Von Neumann, 576 Independent Colony) carry `ResTNm == ''` on EVERY turn of this lineage INCLUDING the turns whose controls agree; all four have `NumOwn == 0`. Read the predicate only for a non-eliminated AI player with NumOwn > 0. (3) **The predicate has no COMBAT term and needs one** - turn 40 was exposed through `RunCombatRound`, and the pre-turn save names the condition as plainly as it names ResTNm: an AI fleet standing at an enemy colony. (4) **A fourth term is not a predicate on the save at all**: turn 39 ran one way by continuation and another way after a load, BOTH reproducibly, so exposure is a property of (save, procedure, LOAD HISTORY), not of (save, turn). Rule 26 (c)'s instruction "record the pair as (save, procedure, hashes)" was already right and is now load-bearing for a reason it did not anticipate |
+```
+
+Edits to existing rows:
+
+- **Row 426** (the resolution's row) — append: `PROBE 1 RUN 2026-09-09 (lane BQ, VM145). 1b FALSIFIED: ar-oracle-A-pre + LOAD + one End Turn gives 4c356f59..., not 7a8b3d5e..., reproducibly in two processes - the AI moved Zeta Fleet V in the continuation and not after a load, so the pair may NOT enter determinism-hashes.txt in AR's form; the LOAD form (33e30092.../4c356f59...) is certified instead. The resave canonicalisation is EXONERATED (pre-turn round trip differs in one leaf, /CD[1]/NPrvVa +5.00 per load). Probe 1 CONFIRMED "the files differ" and CONFIRMED /Sim/RNG + /Sim/trdmgr + player-0 fleets identical, but FALSIFIED the mechanism: the research pick AGREED (both chose BIO_GrvAdpt) and the variation is a COMBAT at Venkman. Producer run: producers A and B both returned null, Player[32] reached the CANDIDATE WALK, and candidatesTried=1 - the outcome set is a singleton by COUNT, not by producer gate.`
+- **Row 424** (AR's oracle pair) — append: `LOAD-BOUNDARY SCOPE 2026-09-09 (lane BQ): this pair is certified ONLY as the two-turn continuation from ar-turn37-816raiders.sav. Its second half does NOT survive being reached by load: ar-oracle-A-pre.sav + load + one End Turn gives 4c356f59..., twice, and differs from 7a8b3d5e... in 17 leaves of ONE AI fleet's movement (Zeta Fleet V moved in the continuation, stayed put after a load). Use the load->turn hashes for the standalone.`
+- **Row 62** — `VM145 = FREE (lane BQ released 2026-09-09; guest RESTORED and verified byte-for-byte to as-found: SavedGames = the same 9 files with identical sha256, binkw32.dll = shimdist-recap 15,527,327 B 903527f4..., shim.cfg = 0ae410cc... hooks=trace, game stopped).` Lane BQ left `C:\SOTS\ui\preBQ\` + `C:\SOTS\ui\bq\` + `ui\bq{deploy,grab,click}.ps1`; `click_helper.ps1` unmodified. **GOTCHA (confirms lane AR's startup correction on a second guest): `fg` + `key {ESC}` x3 spaced ~2.5 s then ~90 s puts the main menu up in about TWO minutes; loading a turn-38/39 save is a further 3-4 min and is NOT compressible.** **GOTCHA (confirms lane M on a second guest): chained clicks through the Load dialog DROP - a three-click chain landed only the first click, twice. ONE click per helper call with a screenshot between.** **TIP: reset SavedGames to EXACTLY ONE file (the run's input) and the Load dialog is one row at (400,262) with nothing to re-derive.** **GOTCHA: `C:\Windows\system32\cmd.exe` windows from the SOTSUI task appear OVER the game and cover the map - `fg` raises the game; screenshot before believing a click landed.** **CONFIRMED: the `Done` pixel at (233,673) reads (183,18,0) with a query up and (0,0,0) on the map; `Auto Resolve Peacefully` (667,641) shows a tooltip and fills the centre panel with the dove, so the selection is confirmable from a screenshot before `Done`.**
+- **`determinism-oracle.md` "Recommended canonicalization rule" / row for the oracle** — append: `CORRECTED 2026-09-09 (lane BQ, rule 11): "mask Player.Status and Summary.Checksum; NOTHING ELSE VARIES" is FALSE on ar-oracle-A-pre/post. `--mask resave` leaves ONE leaf standing - `/CD[1]/NPrvVa`, which advances by exactly +5.00 across a load (and per turn boundary), and FALLS on a combat turn. The old rule was derived on three-player early-game saves with an empty CD[1] diplomacy block. Any load->turn comparison must mask it too, or no load->turn run can ever reproduce a continuation's hash.`
+- **Row 326 / the seed rows** — append: `SHARPENED 2026-09-09 (lane BQ): a research pick is exposed only when the CANDIDATE LIST has more than one entry. Measured on ar-oracle-A-post -> 40: Player[32] entered with ResTNm == '', producers A and B returned null, the candidate walk ran, `candidatesTried=1`, and the pick AGREED across two fresh processes. `ResTNm == ''` predicts a pick, not a divergence.`
+

findings/subsystems/determinism-oracle.md

@@ -32,6 +32,19 @@ resets a per-player `Status` int (4 → 0) on load, which also moves the derived
 See "Round-trip stability" below for the canonicalization rule if a harness ever compares a loaded
 `(Autosave).sav` against a re-save of it.
 
+> **CORRECTED IN PLACE 2026-09-09 (lane BQ, rule 11).** "Mask `Player.Status` and `Summary.Checksum`;
+> **nothing else varies**" is **false** on the late-game saves. `--mask resave` leaves one more leaf
+> standing: **`/CD[1]/NPrvVa`, which advances by exactly +5.00 across a load** (and per turn
+> boundary), and falls on a combat turn. The old rule was derived on three-player early-game saves
+> whose `CD[1]` diplomacy block is empty, and it was true of those. **Any load → turn comparison must
+> mask `NPrvVa` too, or no load → turn run can ever reproduce a continuation's hash** — lane BQ's
+> probe 1b was unsatisfiable on that leaf alone before any AI behaviour entered the question.
+>
+> The canonicalisation itself is **exonerated**: the pre-turn round trip is byte-exact apart from
+> that one leaf. What is *not* safe is assuming a continuation's hash is reachable by load at all —
+> see the board's load-boundary scope row: an AI fleet was issued a move order in the continuation
+> and none after a load, **both reproducibly**.
+
 ## Revalidated 2026-09-08 (lane H)
 
 Lane N's End Turns overwrote the three autosave *contents* on VM140 (the file set was untouched).

guides/method-rules.md

@@ -400,6 +400,29 @@ mechanism.
 > decode which consumer was reached before reasoning from the leaves — "the AI varies per process"
 > is a fact about a turn, not about the engine.
 
+> **(c) is weaker than it was published as — read this before using it.** Written 2026-09-09 from
+> three states read after the fact; **its first forward test falsified it twice the same day**, and
+> the honest statement is now:
+>
+> * `ResTNm == ''` **predicts that a pick is made, not that it varies.** Exposure needs the candidate
+>   list to have **more than one entry**, and lane BQ measured `candidatesTried = 1` on a turn whose
+>   pick agreed across two processes. **That count is not readable from the pre-turn save.**
+> * There is a **false-positive class visible before any run**: players carrying the signature who
+>   have no AI client or `NumOwn == 0`. Read the predicate only for a non-eliminated AI player that
+>   actually runs.
+> * **There is no combat term and there needs to be one.** A turn was exposed through
+>   `RunCombatRound`, and the save names that condition as plainly as it names `ResTNm`: an AI fleet
+>   standing at an enemy colony. `Auto Resolve Peacefully` means *"I commit no ships"*, **not**
+>   *"no combat occurs"* — the defender's planet still fires, and its kill count varied.
+> * **A fourth term is not a predicate on the save at all.** The same turn ran one way by
+>   continuation and another way after a load, **both reproducibly** — so exposure is a property of
+>   `(save, procedure, load history)`, not of `(save, turn)`. The instruction to record a pair as
+>   `(save, procedure, hashes)` was already right, and is now load-bearing for a reason it did not
+>   anticipate.
+>
+> So (c) is a **useful screen, not a decision procedure**: it can tell you a control is *likely* to
+> vary, and it cannot certify that one will agree. A resolver holds the restatement.
+
 ## 27. A ratchet is meant to break when the corpus grows — do not move it, and scope your control
 
 The save corpus went from 11 to 19 in one evening as lanes finally manufactured workloads nobody had