# The spy program's remaining draws — `P`'s branch split, the counter-mission roll, and the deploy's own `NextFloat`

- **Type:** subsystem (static decode + live measurement)
- **Owner / date:** lane AP · 2026-09-09 · guest **VM144** (`sots-re-win10-144`, `re@192.168.10.144`)
- **Instrument:** lane Z's `draw_sites` return-address ledger at **`probes=8`** (the byte-neutral set;
  never `probes=11` — lane H bisected 11 as not byte-neutral)
- **Continues:** lane AS's `findings/subsystems/spy-detection-roll.md`, whose §6 named this workload
  from its own failed conjunct; lane AG's `findings/control-flow/gate-indexed-rng-audit.md` §3.2
- **Inputs:** `verify/results/saves/as-turn15-spydeployed.sav` (target 1),
  `verify/results/saves/as-turn14-predeploy.sav` (target 2)

*(Sections 0–3 were written and committed **before** the build and before any measurement, in their
own commit. Sections 4 onward are the measurement. Rule 2.)*

---

## 0. Headline of the predictions

> **The brief that created this lane asks for "`P`'s three draws". There are three sites but they are
> two mutually exclusive branches, and the branch selector is the spy owner's *species*.** From
> `as-turn15-spydeployed.sav` **exactly one** of the three can ever fire — `0x00840a3c` — because the
> spy's owner is player 0 (`re`), `Species = 0` (Human). `0x00840929` and `0x008409c7` are gated on
> `spyOwner->Species == 6`, i.e. **Morrigi**, and are unreachable from this save, from every save in
> the 22-save corpus, and from any workload that does not start a *Morrigi* empire.
>
> Predicted, before the run: `0x00840a3c` fires once, for one word, on the End Turn that produces
> `Frame == sdet + 3`; and two sites nobody expected fire on the way — the spy **counter-mission**
> roll `0x0088dc43` (lane AG §3.2, corpus 0 of 22, never fired) starting at **Frame 19**, and the
> deploy's own `NextFloat` `0x0078c97f` on a separate one-turn run.

---

## 1. `P` decoded — `SpyManager::Slot13RngCallee` `0x008408e0`, complete

Program `sots` / "Sword of the Stars.exe", ImageBase `0x00400000`, all addresses VAs. Body
disassembled from its start **to the next function start** (rule 17): `0x008408e0 .. 0x00840a5a`,
followed by `int3` padding. The ReVa MCP server is down (`CONNECTION_CLOSED`) for this lane too, so
this is instruction stream only.

### 1.1 How `P` is reached, and that there is no further gate

The chain in `ServerSpyManager::vslot13` `0x008877b0` from lane AS's §1, extended past the point AS
stopped at. **Between the last gate and the call to `P` there is no branch at all** — the whole span
`0x00887897 .. 0x00887af2` is two `EVENT_SPY_DESTROYED_OWNER`-shaped string builds, a `push_back`,
and an event post:

```
0088781d  je  0x887e92   G1   spy.deat (+0x10) == 0                    -> next spy
00887856  je  0x887c5b   G2   spy.sdet (+0x40) == -1                   -> BRANCH D (the detection roll)
00887867  jl  0x887e92   G3   (server.Frame - sdet) < 3                -> next spy
0088787a  je  0x887c4f   G4   ServerSystem_GetOwner(sysA) == NULL      -> sdet := -1, next spy
00887891  je  0x887c4f   G5   ServerSystem_GetOwner(sysA) == ownerO    -> sdet := -1, next spy
008878a1  call 0x59f1a0       push_back spy.sid into a LOCAL vector<int> at [ebp-0xdc]
008879dd  call 0x8862b0       PostEvent "EVENT_SPY_DESTROYED_OWNER"
00887ae3  call 0x7437e0       eax = ServerSystem_GetOwner(sysA)
00887aee  push eax            ; arg2 = the TARGET system's owner
00887aef  push edx            ; arg1 = ownerO, the SPY's owner   ([ebp-0xc0])
00887af0  mov  ecx,edi        ; this = the spy manager
00887af2  call 0x8408e0  P    <-- the false-flag draw
00887af7  ...
00887b07  cmp eax,ebx
00887b09  je  0x887b5b        ; P returned NULL -> the "unknown empire" event string
```

so **once `sdet` is stamped and three turns have passed, `P` is called unconditionally** (given a
target system that is owned and not owned by the spy's own empire). `P`'s arguments are two
`Game::ServerPlayer*`, not ids — `P` compares them by pointer against entries of the player vector.

### 1.2 The species branch — and why "three draws" is one draw

```
00840909  mov esi,[ebp+8]                  ; esi = arg1 = the SPY'S OWNER (a ServerPlayer*)
0084090c  cmp dword ptr [esi+0x5c], 0x6    ; +0x5c = ServerPlayer::Species
00840910  jne 0x840a29                     ; NOT species 6 -> BRANCH B

; ---- BRANCH A, species == 6 only --------------------------------------------------------------
00840919  fld  dword ptr ds:0x9e5ac4       ; 0.75f  (bytes 00 00 40 3f)
0084091f  mov  ecx,[eax+0x16c]             ; THE STRATEGIC GENERATOR (the object, not +4)
00840929  call 0x8e6dd0             A1     ; Mars::RNG::Chance(strategic, 0.75f)   ret 0x0084092e
00840930  je   0x840a45                    ; roll failed -> return NULL
          ; build a candidate list over StrategyServer +0x54..+0x58 (the player vector):
          ;   skip p if p->+0xfb != 0, p->+0xf8 != 0, p == arg1, or p == arg2
008409ac  je   0x840a07                    ; list EMPTY -> free it, return NULL   (no NextInt)
008409ae  eax = count - 1
008409b0  mov  ecx,[...+0x16c]; add ecx,4  ; the +4 SUB-OBJECT (the NextInt convention)
008409c7  call 0x4271c0             A2     ; Mars::RNG::NextInt(&(count-1))        ret 0x008409cc
008409cf  esi = list[eax]                  ; the blamed empire
          return esi

; ---- BRANCH B, every other species ------------------------------------------------------------
00840a2c  fld  dword ptr ds:0x9e5ac0       ; 0.25f  (bytes 00 00 80 3e)
00840a32  mov  ecx,[edx+0x16c]             ; the strategic generator
00840a3c  call 0x8e6dd0             B1     ; Mars::RNG::Chance(strategic, 0.25f)   ret 0x00840a41
00840a43  jne  0x8409f2                    ; roll SUCCEEDED -> return esi == arg1 (the true owner)
00840a45  xor  eax,eax                     ; else return NULL
```

Both float constants were read as the **four bytes in the image** (rule 23): `0x009e5ac0` is
`00 00 80 3e` = `0.25f` and `0x009e5ac4` is `00 00 40 3f` = `0.75f`. `0x009e5ac4` is the *same* word
lane AS read as the species-5 multiplier in `SpyCraft_AccumulateDetectionOdds` — one constant, two
uses.

**So `P` is the attribution roll for a destroyed spy, and it has two completely different shapes:**

| spy owner | draw sites reached | semantics |
|---|---|---|
| `Species == 6` | `0x00840929` (`Chance` 0.75f), then `0x008409c7` (`NextInt`) **only if the roll succeeds and the candidate list is non-empty** | 75 % of the time a **random third empire** is blamed — a false flag. The true owner is *never* returned. |
| every other species | `0x00840a3c` (`Chance` 0.25f) | 25 % of the time the **true owner** is returned; otherwise nobody is blamed. |

### 1.3 The species table, decoded from the corpus

`Game::ServerPlayer +0x5c` is the field `objects/layouts.md` names **`Species`** (Write
`0x008563e0`). The `sim/species` node lists seven `ISsp` names in index order, identical in every
save read:

| 0 | 1 | 2 | 3 | 4 | 5 | 6 |
|---|---|---|---|---|---|---|
| Human | Hiver | Tarkas | Liir | **_NPC** | Zuul | **Morrigi** |

Cross-checked against lane V's `zuul-turn5-species5.sav`, whose three real players all carry
`Species = 5` — and lane V's hook independently reported `species=5` on the Zuul double-roll. The
four NPC empires (`Alien Menace`, `Peacekeeper Enforcer`, `Von Neumann`, `Independent Colony`) carry
`Species = 4` in every save.

That also **names lane AS's two unexplained multipliers**: `SpyCraft_AccumulateDetectionOdds`
multiplies the per-turn detection odds by `0.75f` for **Zuul** and `0.5f` for **Morrigi**, and by
`1.0f` for everyone else. Morrigi are the stealth species on both sites — half the detection odds,
and a false flag when they are caught.

### 1.4 What happens to the spy on that turn

The local `vector<int>` filled at `0x008878a1` is drained after the spy loop:

```
00887eb0..00887ee8   for each collected sid, back to front:
                       [[manager]+0x28](sid)      ; vtable slot 10 = 0x00838480
```

and `0x00838480` looks the `SpyCraft` up by `sid`, calls **`ServerSystem::RemoveSpy 0x0074f550`** on
the `deat` system (which clears `spy.deat` and erases `sid` from `spies2`), clears the tender's
`atto` back-pointer (`spy+0xc`, `ship+0xa8`), erases the craft from the manager's vector at `+0x10`,
and invokes the scalar deleting destructor. **The spy is gone at the end of `vslot13`**, which is
phase 23 — *before* `vslot14` runs at phase 33.

### 1.5 The deploy's `NextFloat` — `0x0078c97f`, re-read

`SHIPACTION_DEPLOYSPY` handler `0x0078c930`, body to the next function start `0x0078c9e0`. One gate,
then the draw, with no branch between them:

```
0078c93d..0078c964   build a 12-byte stack query object (vtable 0x00a09648) and ask it about the ship
0078c969  test al,al
0078c96b  jne 0x78c975                    ; FALSE -> return 0 with NO DRAW
0078c975  mov ecx,[esi+0x16c]; add ecx,4  ; the strategic generator's +4 sub-object
0078c97f  call 0x47d830                   ; Mars::RNG::NextFloat   ret 0x0078c984  <-- THE DRAW
0078c984  fld qword [0x009e21b0]          ; 6.2831854820251465 == 2*pi
0078c98a  fldz                            ; LO = 0.0
          angle = LO + (HI - LO) * r      ; the float-range idiom, stored through a float32 temp
0078c9ac  call 0x0080c860                 ; (ship, angle) -> eax
0078c9bb  call edx                        ; [[esi+0x15c]+0x1c] = ServerSpyManager::DeploySpy slot 7
```

Lane AS read this as `cbh = NextFloat() * 2pi`; that is right in value (`LO` is literally `fldz`) and
the expanded form is worth recording because it is the campaign's standard `lerp(LO, HI, r)` shape,
not a bare multiply. **The draw is unconditional once the validator passes, so it is exactly one
strategic word per applied Deploy Spy order**, in the `ProcessTurn` bracket
(`ApplyAllTurnCommands`), not the tail's.

**Its predicate is on the command stream**, not on save fields: *"a `SHIPACTION_DEPLOYSPY` command in
this turn's command stream"*. Lane AG's gate-indexed audit has two kinds of cell — a measured firing,
or a predicate over the save — and this is neither.

### 1.6 A complete RNG scan of all four bodies

Every `call`/`jmp` in each body decoded to a real instruction boundary and matched against the seven
RNG entry points (`NextFloat 0x0047d830`, `NextInt 0x004271c0`, `Chance 0x008e6dd0`,
`Twist 0x00426e00`, `Seed 0x0049fdf0`, `0x005876c0`, `0x0057da00`):

| body | range | RNG sites |
|---|---|---|
| `ServerSpyManager::vslot13` | `0x008877b0 .. 0x00887f30` | `0x00887c8a` only |
| `SpyManager::Slot13RngCallee` (`P`) | `0x008408e0 .. 0x00840a5a` | `0x00840929`, `0x008409c7`, `0x00840a3c` |
| `SHIPACTION_DEPLOYSPY` handler | `0x0078c930 .. 0x0078c9e0` | `0x0078c97f` only |
| `ServerSpyManager::vslot14` | `0x0088db80 .. 0x0088dd2c` | `0x0088dc43` only |

No inlined draw is present in any of them (rule 16's tempering immediates do not appear).

---

## 2. The corpus and the state, counted before building (rule 28 practice 5)

`as-turn15-spydeployed.sav`, read with `verify/save-reader/save_reader.py`:

| field | value | consequence |
|---|---|---|
| `sim/Frame` | 15 | |
| spy `sid` | 1 | |
| spy `sown` | 16 | player 0, `re` |
| **`re`'s `Species`** | **0 (Human)** | **`P` takes branch B; `0x00840929` and `0x008409c7` are unreachable** |
| spy `deat` | 400 (Kepler) | G1 satisfied — lane AS's contribution |
| spy `sdet` | **−1** | **the failed conjunct; G2 sends us to branch D every turn** |
| spy `sdo` | 0.00839999970048666 | |
| spy `tdep` | **15** | `vslot14`'s `Frame − tdep ≥ 3` first holds at **Frame 18** |
| spy `cm`, `cmo`, `spyon`, `ncp` | all 0 | `vslot14` G4 fails today; it bootstraps itself at Frame 18 |
| spy `cbh` | 5.033599376678467 | `= 2π × 0.8011207…`, i.e. `0x0078c97f` already fired once, unmeasured |
| players | 7 — `re`(0), `Revenge Fleet`(0), `Spengler`(0), 4 × `_NPC`(4) | branch A's candidate list would be non-empty, if it were reachable |

**Corpus count for `P`, on the predicate `∃ spy with deat != 0 && sdet != -1 && Frame − sdet ≥ 3`:
0 of 22 before this lane, and 0 of 23 including `as-turn15-spydeployed.sav`.** The failed conjunct is
`sdet == -1`, exactly as lane AS handed it over — and it is not a conjunct any amount of clicking can
satisfy directly. It is satisfied by *waiting*, at a probability the code fixes.

**Corpus count for `0x0078c97f`:** not expressible over save fields at all (§1.5). The nearest
save-side witness is `cbh != 0`, which holds in **1 of 23** saves — `as-turn15-spydeployed.sav`,
because the site fired on the turn that produced it.

**No save needs to be manufactured for either target.** Lane AS built both states. This lane
generates no map and plays no new game.

---

## 3. Predictions

Committed before the build, before the deploy of any binary to VM144, and before any End Turn.

### 3.1 The static claims

| | prediction | how it is wrong |
|---|---|---|
| **PA1** | `P` reaches **at most one** draw site per call, selected by `spyOwner->Species (+0x5c) == 6`. From this save, only `0x00840a3c`. | a `draw_sites` row at `ret_rva 0x0044092e` or `0x004409cc` on any turn of this workload falsifies it outright |
| **PA2** | Species indices are `0 Human, 1 Hiver, 2 Tarkas, 3 Liir, 4 _NPC, 5 Zuul, 6 Morrigi`; therefore `AccumulateDetectionOdds`'s `0.75f` is **Zuul** and its `0.5f` is **Morrigi** | a save whose `sim/species` list is ordered differently, or a Zuul save with `Species != 5` |
| **PA3** | `0x00840a3c` is `Chance(0.25f)` — a widened `float`, not the decimal 0.25 read from a decompiler | the four bytes at `0x009e5ac0` are not `00 00 80 3e` |
| **PA4** | the spy is **destroyed** at the end of `vslot13` on the turn `P` runs: `nspy` 1 → 0, `spies2` at Kepler 1 → 0, and no spy record survives in the autosave | the post-`P` autosave still carries a `spy` record |

### 3.2 Target 1 — the wait, and the per-turn word trajectory

Let `T` be the `Frame` on which `sdet` is stamped. `sdo` grows by **0.0084 per turn** and the roll on
the End Turn producing `Frame f` uses `sdo = 0.0084 × (f − 14)`, because `AccumulateDetectionOdds`
runs *before* the gate. `Chance` costs one word for `0 < p < 1` (board row 367).

| | prediction |
|---|---|
| **PB1** | `sdo` in the autosave after the End Turn producing `Frame f` is exactly `0.0084 × (f − 14)` as a float32, for every `f` until detection: 0.0168, 0.0252, 0.0336, 0.0420, 0.0504, … |
| **PB2** | `OnAllCombatDone_Tail` costs **1** word on Frames 16, 17, 18 (`vslot13`'s detection roll alone) |
| **PB3** | **`0x0088dc43` fires for the first time in this campaign on Frame 19**, one call, one word, `ret_rva 0x0048dc48`, `strategic = true` — because `vslot14` bootstraps its counter-mission at Frame 18 (`Frame − tdep = 3`, `ncp` empty), setting `spyon`, `cm := 1`, `cmo := 0.2f`, **without drawing on Frame 18 itself** |
| **PB4** | from Frame 19 the tail costs **2** words per turn (`vslot13` 1 + `vslot14` 1), and drops to 1 on any turn where `cmo` has accumulated to ≥ 1.0 or where `cm` has just cycled back to 0 |
| **PB5** | save-side: `cm` moves off its corpus-constant 0 on **Frame 18**, `spyon` moves to the Kepler owner's id on Frame 18, and `cmo` starts stepping by `0.2f` per failed counter-mission roll from Frame 19 |
| **PB6** | on the detection turn `T`: `vslot13` still costs 1 word (the roll that *succeeds*), `sdet := T` |
| **PB7** | on `T+1` and `T+2`: **`vslot13` costs ZERO words** — `sdet != -1` skips branch D, and `Frame − sdet < 3` skips the destruction path. A zero at `0x00487c8f` on those two turns is a *positive* result about a third arm and must not be read as "the roll did not fire" (rule 28 practice 6) |
| **PB8** | on `T+3`: one row at `ret_rva 0x00440a41`, `entry = Chance`, `calls = 1`, `words = 1`, `no_draw_calls = 0`, `strategic = true`; `vslot13`'s own `0x00487c8f` row **absent**; `vslot14` contributes **0** because the spy was destroyed at the end of phase 23 |
| **PB9** | the entry probe on **`Game::SpyManager::Slot13RngCallee 0x008408e0` reads 1** on Frame `T+3` — its first non-zero in the campaign, and the complement of lane AS's demonstration that its zero said nothing about the subtree |
| **PB10** | cumulative detection probability: **11 % by +4 turns, 43 % by +10, 70 % by +15, 87 % by +20** — computed from `p_k = 0.0084(k+1)`. *(Lane AS's brief quoted 38/65/85; that is the same model evaluated one turn late, using `p_k = 0.0084k`. Minor, and stated so the difference is on the record before the run.)* |
| **PB11** | the tail bracket total over the whole run equals the per-site sum: **residual 0** on every turn |

**PB12 — the tail case, stated in advance.** At +20 turns there is a 13 % chance `sdet` is still −1.
If that happens, the result reported is the **`sdo` trajectory against PB1** plus the `0x0088dc43`
series, and `P` stays a decoded-not-measured site. That is a real measurement of the accumulator and
it will be reported as such rather than ground out.

### 3.3 Target 2 — the deploy order

From `as-turn14-predeploy.sav`, one Deploy Spy order, one End Turn, `probes=8`:

| | prediction |
|---|---|
| **PC1** | one `draw_sites` row at `ret_rva 0x0038c984`, `entry = NextFloat`, `calls = 1`, `words = 1`, `no_draw_calls = 0`, `strategic = true` |
| **PC2** | it lands in the **`ProcessTurn`** bracket, not `OnAllCombatDone_Tail`'s, because `ApplyAllTurnCommands` runs first |
| **PC3** | the same turn's `OnAllCombatDone_Tail` costs **exactly 1** — the first detection roll at `sdo = 0.0084` |
| **PC4** | the resulting `spy.cbh` reproduces lane AS's value **exactly**: `5.033599376678467`, i.e. `2π × 0.80112…`. The strategic generator is seeded from the save and the per-process AI client seed does not feed it, so the same input plus the same order must draw the same word. **This is the sharpest single prediction in the document**: it says the deploy draw is reproducible across processes, sessions and lanes |
| **PC5** | `spies2` at Kepler goes 0 → `[1]`, `deat` 0 → 400, `tdep := 15`, `sdo := 0` then `0.0084` — reproducing lane AS's §4.2 from a different process |

### 3.4 The control

| | prediction |
|---|---|
| **PD1** | two fresh `hooks=off` processes on the **same** input will produce a byte-identical *pre*-turn `(Autosave EndTurn).sav` and **differing** post-turn autosaves |
| **PD2** | the differences localise to **one AI player's research pick plus `Summary/Checksum` and the `turnstats` `tch` cell** — the per-process `StrategyClient` seed of `2026-09-08-ai-seed-per-process.md`. Nothing of my empire, the spy, `deat`, `sdet`, `sdo`, `cm`, `cmo` or `spies2` moves |
| **PD3** | therefore **this is not a calibration pair and must not enter `determinism-hashes.txt`** — stated in advance so it cannot be a post-hoc excuse (rule 26) |
| **PD4** | the leaves this lane's numbers depend on — the `spymgr` sub-tree and the `systems` sub-tree — **do** reproduce across the control pair, and that is the claim that will be checked by sub-tree rather than by whole-file hash |

### 3.5 How the whole model could be wrong

* **`countC` is not stable.** `sdo`'s per-turn increment is `0.7 × (0.01 + 0.001 × countC)` with
  `countC = 2` inferred, not observed. If a fleet moves in or out of Kepler the increment changes and
  PB1 breaks — **and that would be the most interesting failure available**, because it would
  identify `countC` from the delta. Symptom: an `sdo` step that is not 0.0084.
* **`vslot14` might not bootstrap.** AG's `ncp` check is on a container this lane has only seen as
  the integer 0. If `ncp` is a count and non-empty means something else, PB3 fires late or not at
  all. Symptom: Frame 19 tail costs 1, not 2, and `cm` stays 0.
* **The stage machine consults `owner->+0xff` (`CnTrd`, FTL Economics) at 1 → 2/3.** This game has no
  FTL Economics, so the 1 → 3 arm is the one that runs; that changes which stage sequence is
  exercised but not any word count.
* **PB7's two zero turns are the polarity trap in a new place.** `vslot13` will be *entered* on
  `T+1`/`T+2` (the probe reads 1) and cost 0. If this lane reported that as "the roll stopped
  working", it would repeat exactly the mistake rule 28 exists for.
* **PC4 can fail benignly.** If AI orders applied before mine consume strategic words, `cbh` differs
  and the deploy draw is still 1 word. That falsifies *reproducibility*, not the site.

---

*(End of the pre-registered section. Everything below is measurement.)*

---

## 4. What was run

Shim build **`ap-989c692-20260909T0425Z`**, cross-built on CT111 in this lane's own directory
`/srv/re-lab/build/sots-engine-ap` after `rm -rf` of the whole tree, from a lane-private
`git worktree` at `~/sots-engine-ap` with no local `build*` shipped (rules 21 and 24). `binkw32.dll`
sha256 `ae084ed4774caf24ea7927fcb012d1999633f10556c7c99f0209f66067416a17`. Staged to
`/srv/re-lab/shim/dist-ap`, deployed to `C:\SOTS\shimdist-ap` on VM144. **This lane wrote no engine
code**; `shim.cfg.hp8` and `shim.cfg.hoff` were used unmodified.

| run | config | input | End Turns | purpose |
|---|---|---|---|---|
| **W** | `shim.cfg.hp8` (`probes=8`) | `MyGameas1spydep.sav` (Frame 15) | **11** (15 → 26) | target 1 |
| **D** | `shim.cfg.hp8` | `MyGameas1predeploy.sav` (Frame 14) + one `Deploy Spy` order | 1 | target 2 |
| **OA / OB** | `shim.cfg.hoff` | `MyGameas1spydep.sav` | 1 each, two fresh processes | control (§7) |

**Instrument armed and verified from `shim.log`, not assumed** (rule 1). Both instrumented runs:
seven `drawsite:` detours `create=MH_OK enable=MH_OK`; `config: probes=8 -> 8 lane-H entry probes`
and all eight `create=MH_OK enable=MH_OK`; **zero** `COVERAGE:` lines; **zero**
`config: ignoring unknown key` lines; `draw_site_overflow = 0` on every turn. Probe indices 8–11
report **NOT INSTALLED**, never 0. The one `MH_ERROR_ALREADY_CREATED` line is the `fpu` module
losing the race for `BeginProcessTurn` to the ledger; it is present verbatim in lanes AC, AD, AR and
AS's logs, so this is the same instrument those lanes ran.

**`probes=11` was not used anywhere in this lane.** No number here is comparable to lane AC's turn
totals.

### 4.1 The wait cost eleven minutes, not an evening

The brief budgeted "~20 End Turns, expensive in wall-clock". On this state an End Turn under
`probes=8` completes in **6 seconds**; the eleven turns took **11 minutes** including the load. The
expensive part is the launch (~2 min through the intro movies) and the load (~3 min). Turn 27 hit a
Von Neumann encounter dialog at Rigel and the driver stopped on it exactly as designed; by then the
question was answered and the run was ended there rather than clicked through.

The driver is worth carrying forward: a scheduled task (`SOTSAP`) running an in-guest loop that
clicks End Turn, then **polls the autosave's mtime** — never a button colour, which is lane AS's
lesson — snapshots `(Autosave).sav` per turn, and stops on the first stall with a screenshot. It is
left at `C:\SOTS\ui\ap\ap_loop.ps1`.

---

## 5. Target 1 — the wait, measured turn by turn

Detection landed on **Frame 22**, seven turns in. `P` therefore ran on **Frame 25**.

### 5.1 The per-turn ledger

Every row is `draw_sites` at the post-turn autosave marker, which the shim resets at the pre-turn
marker — so these are **per-turn** figures, not cumulative.

| Frame | `0x00887c8a` spy 13 | `0x0088dc43` spy 14 | `0x00840a3c` `P` B1 | `0x00820e1d` trade raid | tail bracket | probe `vslot13` | probe `Slot13RngCallee` |
|---|---|---|---|---|---|---|---|
| 16 | **1** | — | — | — | **1** | 1 | 0 |
| 17 | **1** | — | — | — | **1** | 1 | 0 |
| 18 | **1** | — | — | — | **1** | 1 | 0 |
| 19 | **1** | **1** ← first ever | — | — | **2** | 1 | 0 |
| 20 | **1** | **1** | — | 2 | **4** | 1 | 0 |
| 21 | **1** | **1** | — | 4 | **6** | 1 | 0 |
| **22** | **1** ← succeeds, `sdet := 22` | **1** | — | 7 | **9** | 1 | 0 |
| 23 | **—** | **1** | — | 7 | **8** | **1** | 0 |
| 24 | **—** | **1** | — | 8 | **9** | **1** | 0 |
| **25** | **—** | **—** | **1** ← first ever | 7 | **8** | **1** | **1** ← first ever |
| 26 | — | — | — | 8 | **8** | 1 | 0 |

Every cell is `calls = words`, `no_draw_calls = 0`, `strategic = true`. **The tail bracket equals the
sum of its rows on all eleven turns: residual 0 every turn**, and `draw_site_overflow = 0`.

Three lines of that table are the lane:

> **Frame 25:** `entry = Chance`, `ret_rva = 0x0044_0a41` (VA `0x00840a41`, the instruction after
> `call 0x8e6dd0` at `0x00840a3c`), `calls = 1`, `words = 1`, `no_draw_calls = 0`,
> `strategic = true`. **`0x00840a3c` had never fired in this campaign.**
>
> **Frames 23 and 24:** no row at `0x0048_7c8f` at all, while the entry probe on
> `ServerSpyManager::vslot13` reads **1** on both. That is "entered and gated", not "did not run" —
> rule 28 practice 1, in a third distinct arm of the same function.
>
> **Frame 25, the probe column:** `Game::SpyManager::Slot13RngCallee 0x008408e0` reads **1**. Lane AS
> demonstrated that this probe's **zero** said nothing about the subtree. This is the other half:
> the same probe, on the one turn the callee is actually entered, reads one.

### 5.2 `0x00840929` and `0x008409c7` did not fire, and could not have

Neither site appears in any of the eleven turns, including Frame 25 — the one turn `P` ran. **PA1
held.** The reason is not a state we failed to build: `P`'s first instruction pair is
`cmp [spyOwner+0x5c], 6` / `jne`, the spy's owner is player 16 `re` with `Species = 0` (Human), and
the launch card confirms it in the UI. Branch A is a **Morrigi-only** path.

> The brief that created this lane, lane AS's §6, board row 207 and lane AG's §6 all list
> `0x00840929` / `0x008409c7` / `0x00840a3c` as three sites behind one gate. They are **two
> mutually exclusive branches selected by species**, and no workload can fire more than one of them
> per call. To reach the other two, a lane must play a **Morrigi** empire, deploy a spy, and lose it.

### 5.3 `sdo` — the accumulator, exact to the float32

Read from the eleven autosaves. Prediction PB1 was `sdo(f) = 0.0084 × (f − 14)` as a float32.

| Frame | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 |
|---|---|---|---|---|---|---|---|---|---|
| `sdo` | 0.016800 | 0.025200 | 0.033600 | 0.042000 | 0.050400 | 0.058800 | 0.067200 | 0.067200 | 0.067200 |
| bits | `3c89a027` | `3cce703a` | `3d09a027` | `3d2c0831` | `3d4e703b` | `3d70d845` | `3d89a027` | frozen | frozen |

Seven consecutive exact steps of 0.0084, then **frozen** the moment `sdet` stamps — because branch D
is the only writer of `sdo` and `sdet != -1` skips it. The freeze is a second, save-side proof that
the branch stopped running on Frames 23 and 24, independent of the ledger's zero.

Lane AS measured two points of this line (0 → 0.0084 → 0.0168) and derived the rest. **Nine points
now lie on it**, and `countC` stayed at 2 for the whole window, so `sdo`'s per-turn increment is a
constant on this state rather than a fitted one.

### 5.4 The counter-mission machine, measured for the first time

`0x0088dc43` (lane AG §3.2) had **corpus count 0 of 22** and had never fired. It fires here from
Frame 19, one call and one word per turn, and the save-side state machine is fully visible:

| Frame | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 |
|---|---|---|---|---|---|---|---|---|
| `spyon` | **32** | 32 | 32 | 32 | 32 | 32 | 32 | — |
| `cm` | **1** | 1 | **2** | 2 | **3** | 3 | **4** | — |
| `cmo` | 0.2 | 0.4 | 0.2 | 0.4 | 0.2 | 0.4 | 0.2 | — |
| `ncp` | 0 | 0 | **1** | 1 | **2** | 2 | **3** | — |
| words at `0x0088dc43` | **0** | 1 | 1 | 1 | 1 | 1 | 1 | **0** |

Everything AG decoded statically is confirmed, and four things are added:

1. **The bootstrap turn costs nothing.** Frame 18 is `Frame − tdep == 3`; `vslot14` sets `spyon`,
   runs the stage machine `cm: 0 → 1` and `cmo := 0.2f`, and **does not draw**. The first draw is
   Frame 19. PB3 predicted exactly this and it held.
2. **`cmo` steps by `0.2f` on failure and resets to `0.2f` on success**, as decoded. The stage
   advanced on Frames 20, 22 and 24 — always on the second try, at `p = 0.4`. Six rolls, three
   successes; expectation at (0.2, 0.4) alternating is 2.4. Consistent, not validated.
3. **`ncp` is a scalar counter of completed stages, not a container.** It is a plain `int` item in
   the stream and it increments by exactly 1 on each stage completion (0,0,1,1,2,2,3), in lock-step
   with `cm`. AG's decode reads the `cm == 0` branch as gated on "`ncp` non-empty"; that gate was
   **never reached** here, because `cm` never returned to 0 before the spy was destroyed. It stays a
   rule-6 hypothesis — and a sharper one now that `ncp`'s values are known.
4. **The `CnTrd` the stage machine consults is the TARGET's, not the spy owner's.** AG's caution to
   lane AS was that a spy program run without FTL Economics takes the `1 → 3` arm. This run took
   `1 → 2`, and in the save **my player (16) has `CnTrd = False` while Kepler's owner (32) has
   `CnTrd = True`**. So `owner->+0xff` at that branch is the **victim** empire's FTL Economics. The
   caution as written would have mispredicted this run.

`cm`, `cmo`, `spyon` and `ncp` are four of the 234 fields the value-domain census lists as having
only ever held one value. **All four are now off zero**, with a measured trajectory each.

### 5.5 The spy is destroyed at `sdet + 3`, and `vslot13` does it

`nspy` goes **1 → 0** between the Frame-24 and Frame-25 autosaves, `spies2` at Kepler returns to
`count = 0`, and the `spymgr` record loses its only `spy` child. That is `vslot13`'s drain loop at
`0x00887eb0` calling manager vtable slot 10 `0x00838480`, which calls `ServerSystem::RemoveSpy
0x0074f550`. **PA4 held.**

It also settles the ordering question in §1.4 behaviourally: `0x0088dc43` costs **0** on Frame 25
although `vslot14`'s entry probe still reads 1. Phase 23 destroys the spy before phase 33 walks the
list.

---

## 6. Target 2 — `0x0078c97f`, the site in no inventory, measured

Run D: `MyGameas1predeploy.sav` (Frame 14) in a fresh process under `probes=8`; Kepler selected on
the map; `Special → Deploy Spy → OK`; one End Turn.

```
draw_sites, post-turn autosave marker, the row verbatim:

  entry           = NextFloat
  ret_rva         = 0x0038_c984        (VA 0x0078c984 -- after `call 0x47d830` at 0x0078c97f)
  calls           = 1
  words           = 1
  no_draw_calls   = 0
  strategic       = true

boundary ledger, same turn:

  BeginProcessTurn        326 -> 326    0
    ProcessTurn           326 -> 344   18      <-- the deploy draw is in here
    OnAllCombatDone_Tail  344 -> 345    1      <-- the first detection roll, sdo = 0.0084
  Autosave                345 -> 345    0
```

**PC1, PC2 and PC3 all held exactly.** The site fires once per applied `SHIPACTION_DEPLOYSPY`
command, for one word, on the strategic generator, inside the `ProcessTurn` bracket — and the same
turn's tail costs exactly 1, because `ApplyAllTurnCommands` runs before `OnAllCombatDone_Tail` and
the freshly deployed spy is immediately eligible for its first detection roll.

It appears in **no other turn of this lane**: eleven turns of run W carry no row at `0x0038c984`.
That is the stream predicate showing its shape — the site's cost is not a function of the save at
all, it is a function of what the player ordered.

### 6.1 The sharpest prediction held: the deploy draw is reproducible across processes

**PC4.** Lane AS's `as-turn15-spydeployed.sav` was written by a different process, on a different
day, from a different build. This lane's Frame-15 autosave was written by run D.

```
lane AS   spy.cbh = 5.033599376678467      (float32 0x40A11333)
lane AP   spy.cbh = 5.033599376678467      identical
                    cbh / 2pi = 0.8011222000
```

The same input state plus the same order drew the same word, in two processes separated by hours and
by a rebuild. Together with `deat = 400`, `tdep = 15`, `sdo = 0.0084`, `sdet = -1` and `spies2 = [1]`
at Kepler reproducing exactly (**PC5**), this says the **strategic** generator's consumption up to
`ApplyAllTurnCommands` is deterministic given the save — the per-process AI client seed does not
reach it. It is a much stronger statement than a whole-file hash comparison, because it isolates one
word to one site.

### 6.2 A correction to lane AS's reading of the same bytes

AS gives the site as `cbh = NextFloat() * 2*pi`. The value is right; the expression is the
campaign's standard range idiom with `LO` supplied by an `fldz`:

```
0078c984  fld qword [0x009e21b0]   ; HI = 6.2831854820251465
0078c98a  fldz                     ; LO = 0.0
0078c994  fsub st(1),st            ; HI - LO
0078c99b  fmulp st(1),st           ; (HI - LO) * r
0078c99d  fstp [ebp+8]             ; through a FLOAT32 temp
0078c9a0  fadd [ebp+8]             ; LO + that
```

so it is `lerp(0.0, 2*pi, r)` **rounded to float32 mid-expression**, not a `double` multiply. A
reimplementation that computes `r * 6.2831854820251465` in double and stores at the end can differ in
the last bit.

The other half of the sequence is worth writing down because it reads wrong at first glance:

```
0078c998  push ecx                 ; reserve DeploySpy's SECOND argument slot
0078c9a9  fstp [esp]               ; slot := the angle
0078c9ac  call 0x0080c860          ; __thiscall getter, `mov eax,[ecx+0xa8]; ret` -- NO stack args,
                                   ;   so it leaves the angle slot untouched. eax = the spy's id.
0078c9ba  push eax                 ; the FIRST argument
0078c9bb  call edx                 ; ServerSpyManager::DeploySpy(spyId, angle)
```

`0x0080c860` looks like it consumes the float and does not; the compiler built the argument list out
of order and called a zero-argument getter across the half-built frame. **`DeploySpy` takes two
arguments**, and `0x008874b0 fld [ebp+0xc]` / `0x008874c0 fstp [esi+0x18]` is where `cbh` is
written. Lane AS's *"`spy->cbh (+0x18) := <the float argument>`"* is exactly right; this only names
which argument and shows why an eye following `eax` misses it.

---

## 7. The control — a truthful non-pair, and the exposure predicate checked against it

Two fresh `hooks=off` processes (**OA**, **OB**) on the same input, one End Turn each, plus this
lane's instrumented run **W** and lane AS's three runs from the day before. Six processes, one
input, one End Turn.

### 7.1 The hashes

```
input      MyGameas1spydep.sav       854a10fa1ea602f0f7909f9bf9154942e56ea5fa1db4cce47d6d32bf53952e08
```

| run | lane | config | pre-turn `(Autosave EndTurn).sav` | post-turn `(Autosave).sav` | size |
|---|---|---|---|---|---|
| A | AS | `hoff` | `98e45d3745b91450…` | `262f8bda97c9511d…` | 77,685 |
| B | AS | `hoff` | `98e45d3745b91450…` | `e34775a757e6fb3d…` | 77,649 |
| M | AS | `probes=8` | `98e45d3745b91450…` | `262f8bda97c9511d…` | 77,685 |
| **W** | **AP** | `probes=8` | — | **`262f8bda97c9511d…`** | 77,685 |
| **OA** | **AP** | `hoff` | **`98e45d3745b91450…`** | **`e296394f578b3a56…`** | 77,677 |
| **OB** | **AP** | `hoff` | *(§7.4)* | *(§7.4)* | |

**The pre-turn save is byte-identical across four processes, two lanes and two builds** — including
this lane's own, which is not lane AS's binary. That is the strongest statement available about the
input, and it is what makes the post-turn comparison meaningful.

**The post-turn saves are not.** Five processes have produced **three** distinct outcomes:
`262f8bda` (three times: AS's A, AS's M, this lane's W), `e34775a7` (once: AS's B), `e296394f`
(once: this lane's OA).

> **This is not a calibration pair and must not enter `determinism-hashes.txt`.** Said in advance as
> PD3, and it is the honest verdict rather than a post-hoc excuse.

### 7.2 What varies, localised by sub-tree

`state_checksum --no-audit --floats bits --mask none`, OA against W:

```
DIVERGED: 15 leaf difference(s)
  /Summary/Checksum                                                 985948923 -> 985948837
  /Sim/turnstats/history/hist[1]/stats[15]/tch                             45 -> 46
  /Sim/players/Player[32 "Revenge Fleet"]/TechTree/St[60]                   3 -> 2
  /Sim/players/Player[32 "Revenge Fleet"]/TechTree/TResDone[60]         22469 -> 0
  /Sim/players/Player[32 "Revenge Fleet"]/TechTree/Tbd[60]                  2 -> 1
  /Sim/players/Player[32 "Revenge Fleet"]/TechTree/St[64]                   2 -> 4
  /Sim/players/Player[32 "Revenge Fleet"]/TechTree/TResDone[64]             0 -> 22469
  /Sim/players/Player[32 "Revenge Fleet"]/TechTree/TAcq[64]                -1 -> 16
  /Sim/players/Player[32 "Revenge Fleet"]/TechTree/TiAcq[64]               -1 -> 45
  /Sim/players/Player[32]/Events/…/EvDsc  'Research Over Budget' -> 'Research Complete'
  /Sim/players/Player[32]/Events/…/EvMsg  'Research for Micro-Fusion Drives has gone overbudget.'
                                       -> 'Tech Overthrusting has been acquired'
  /Sim/players/Player[32]/Events/…/EvImg  'EVENT_RESEARCH_OVERBUDGET' -> 'EVENT_RESEARCH_COMPLETE'
  /Sim/players/Player[32 "Revenge Fleet"]/ResTNm             'DRV_McroFus' -> ''
  /Sim/players/Player[32 "Revenge Fleet"]/otch/.[34]                          only-in-B
  /Sim/players/Player[32 "Revenge Fleet"]/otch/.[0]                         33 -> 34
```

**And the sub-tree digests say which halves of the save are affected**, which is the form the claim
should take (PD4):

| sub-tree | OA | W | |
|---|---|---|---|
| `Sim/spymgr` | `9c3f224cf954aa54` | `9c3f224cf954aa54` | **identical** |
| `Sim/systems` | `3227b08124339fe2` | `3227b08124339fe2` | **identical** |
| `Sim/fleets` | `26a640cdfc597869` | `26a640cdfc597869` | **identical** |
| `Sim/trdmgr` | `ed99071bdc121694` | `ed99071bdc121694` | **identical** |
| `Sim/players` | `2d1c0cad92679606` | `46ddf6778ef36e0b` | differs |
| `Summary` | `66db5e1055c9fe37` | `cb8a4c8e22480af0` | differs (the derived checksum) |

> **Every leaf this lane's numbers depend on reproduces across the pair. `spymgr` — the spy's
> `deat`, `sdet`, `sdo`, `cm`, `cmo`, `ncp`, `cbh` — is byte-identical between an instrumented run
> and an un-instrumented one, as is every system's `spies2`.** What does not reproduce is one AI
> empire's research pick and the two derived values downstream of it.

**Three distinct picks across five processes** is worth stating plainly, because it is the first
time this outcome set has been sampled more than twice: A/M/W completed `Overthrusting` (tech 64),
B was part-way through `DRV_NodFoc`, OA went over budget on `DRV_McroFus`. AS observed A and M
agreeing and correctly flagged it as a `1/k` coincidence rather than evidence about the instrument.
With five samples the set has at least three members and the modal outcome took 3 of 5 — so the
coincidence AS refused to lean on was about a 1-in-3 event, not a 1-in-2 one, and refusing to lean
on it was right.

### 7.3 The seed-exposure predicate, checked (rule 26 corollary (c))

The coordinator's instruction is to record the exposure fields next to every control hash. Here they
are for the **pre-turn** save of the control pair, and for every turn this lane played, so the
predicate can be checked rather than asserted. `Species = 4` (NPC) players are omitted; they never
decide. Net ids: player 16 is `re` (human), 32 is `Revenge Fleet` (the AI), 48 is `Spengler`.

| pre-turn save | Frame | Player[32] `ResTNm` | `NDes` | `NOwn` | ships | exposure |
|---|---|---|---|---|---|---|
| `as-turn14-predeploy` | 14 | **`''`** | 15 | 10 | 146 | **pick** |
| **`as-turn15-spydeployed`** (the control input) | **15** | **`''`** | **15** | **10** | **146→148** | **pick + colonise + 2 ships** |
| `w-16` | 16 | `''` | 15 | 11 | 157 | pick + 9 ships |
| `w-17` | 17 | `''` | 16 | 12 | 161 | pick + design + colonise + 4 ships |
| `w-18` | 18 | `''` | 20 | 12 | 169 | pick + 4 designs + 8 ships |
| `w-19` | 19 | `''` | 20 | 12 | 181 | pick + 12 ships |
| `w-20` | 20 | `'WEP_AmWhd'` | 20 | 12 | 185 | 4 ships |
| `w-21` | 21 | `'WEP_AmWhd'` | 23 | 12 | 201 | 3 designs + 16 ships |
| `w-22` | 22 | `'WEP_AmWhd'` | 27 | 12 | 218 | 4 designs + 17 ships |
| `w-23` | 23 | `'WEP_AmWhd'` | 27 | 12 | 236 | 18 ships |
| `w-24` | 24 | `'WEP_AmWhd'` | 27 | 14 | 235 | colonise ×2 |
| `w-25` | 25 | `''` | 28 | 15 | 244 | pick + design + colonise + 9 ships |
| `w-26` | 26 | `''` | 28 | 15 | 251 | pick + 7 ships |

**The predicate held, and it held in its strong direction.** The control input carries
`Player[32].ResTNm == ''` — a pick turn — and the control varied, in exactly the research-pick leaves
the predicate names and nothing else. Two independent lanes have now produced that signature on this
input.

**And the state says something the predicate did not anticipate: on this map exposure is
*saturated*.** Every one of the thirteen pre-turn states above carries at least one exposure
signature; nine of thirteen carry a research pick, and every single turn adds ships. There is **no
quiet turn anywhere in this lineage** to attempt an agreeing control on — so no rung-A oracle pair is
obtainable from `as-turn15-spydeployed.sav` at any horizon by waiting, and a lane that wants one on
this map must pin the client seeds instead. That is a fact about a 2-empire game where the AI runs a
146 → 251-ship war economy, and it is the opposite end of the same axis from lane AR's quiet
turns 38–39.

**One nuance that cuts against a naive reading of the predicate.** Exposure is necessary for
variation, not sufficient *per process pair*: W (`probes=8`) and AS's A and M (two different
configurations, two different builds, three different processes) landed on the **same** post-turn
bytes on this exposed pick turn. A single agreeing pair on an exposed turn therefore proves nothing —
which is rule 26's original point, now with a measured outcome-set size behind it.

### 7.4 OB, and the verdict

```
OB   (Autosave EndTurn).sav   98e45d3745b914506fc4c409ad5a5ad0938a2003ab4c845421a99a8065149c3a  76,706
OB   (Autosave).sav           262f8bda97c9511d8d2b41e6a8a0582d6f5364c2b01b1caf99e639d0e4f53ebe  77,685
```

* **OA ≠ OB.** The two `hooks=off` processes of *this* lane's own control disagree, in **15 leaves,
  all of them** `Player[32]`'s research pick plus `/Summary/Checksum` and the `turnstats` `tch` cell.
  Nothing of my empire, the spy, `deat`, `sdet`, `sdo`, `cm`, `cmo`, `ncp`, `spies2`, the systems,
  the fleets or `trdmgr` moved between them.
* **OB is byte-identical to W**, the instrumented run: `state_checksum` prints **IDENTICAL** over
  **44,438 leaves**. Both are `fc85c4228b9973fa159c1ed6aa851ae0`.

So the honest three-part statement, which is all the evidence supports:

1. **Not a calibration pair.** Two fresh un-instrumented processes on this input do not agree, so
   nothing here may enter `determinism-hashes.txt` as a rung-A pair. **PD1 and PD3 held.**
2. **The instrument is neutral on everything this lane measured.** `probes=8` reproduced an
   un-instrumented run leaf for leaf, and the sub-trees carrying the spy state are identical across
   all three of this lane's processes. **PD4 held.** That is a stronger neutrality statement than
   lane AS could make, because AS's instrumented run agreed with only one of two controls; here it
   agrees with one control *exactly and completely* while the two controls differ from each other in
   a leaf class the instrument provably does not touch.
3. **The divergence is the known one, and it was predicted.** **PD2 held**, and it held with the
   pre-turn exposure fields recorded in advance (§7.3) rather than diagnosed afterwards.

**A note for whoever certifies pairs.** Lane AS reported A ≠ B and called the class "one AI player's
research pick plus the derived checksum". Two more processes, taken independently, land in the same
class and add a third member to the outcome set. That is a second lane reproducing the *class* while
failing to reproduce the *value* — which is exactly what a per-process seed feeding a small
discrete choice should look like, and it is now measured rather than asserted.

---

## 8. Predictions scored — including the one that was wrong

| | prediction | verdict |
|---|---|---|
| **PA1** | `P` reaches at most one draw site per call, selected by `Species == 6`; only `0x00840a3c` from this save | **HELD.** No row at `0x0044092e` or `0x004409cc` on any of the twelve measured turns, including the turn `P` ran |
| **PA2** | species table `0 Human … 4 _NPC, 5 Zuul, 6 Morrigi`; `0.75f` is Zuul, `0.5f` is Morrigi | **HELD** (corpus-wide; the launch card independently shows `re` = Human) |
| **PA3** | `0x00840a3c` is `Chance` on a widened `0.25f` | **HELD** — `0x009e5ac0` is `00 00 80 3e` |
| **PA4** | the spy is destroyed at the end of `vslot13` on the `P` turn | **HELD** — `nspy` 1 → 0, `spies2` emptied, no `spy` record at Frame 25 |
| **PB1** | `sdo(f) = 0.0084 × (f − 14)` exactly, until detection | **HELD** — seven exact float32 steps, then frozen |
| **PB2** | tail costs 1 on Frames 16, 17, 18 | **HELD** |
| **PB3** | `0x0088dc43` first fires on Frame 19; Frame 18 bootstraps without drawing | **HELD exactly** |
| **PB4** | **the tail costs 2 words/turn from Frame 19** | **WRONG.** It costs 2 on Frame 19 and then 4, 6, 9, 8, 9, 8, 8 |
| **PB5** | `cm`, `spyon` move on Frame 18; `cmo` steps by `0.2f` | **HELD** |
| **PB6** | on the detection turn `vslot13` still costs 1 and `sdet := T` | **HELD** — Frame 22 |
| **PB7** | `vslot13` costs **zero** on `T+1`, `T+2` while still being entered | **HELD** — Frames 23, 24: no row, probe reads 1 |
| **PB8** | `T+3`: one row at `0x0044_0a41`, 1/1/0/strategic; no `0x0048_7c8f`; `vslot14` contributes 0 | **HELD in all three parts** |
| **PB9** | the `Slot13RngCallee` probe reads 1 on `T+3` | **HELD** — its first non-zero in the campaign |
| **PB10** | 11 % by +4, 43 % by +10, 70 % by +15, 87 % by +20 | **not tested.** Detection landed at +7, where the model says 26 %. One sample is consistent with the model and does not test it |
| **PB11** | residual 0 on every turn | **HELD** on all eleven turns of W and on run D |
| **PB12** | the +20 tail case | **not reached** |
| **PC1** | `0x0038c984`, `NextFloat`, 1/1/0, strategic | **HELD exactly** |
| **PC2** | in the `ProcessTurn` bracket | **HELD** |
| **PC3** | the same turn's tail costs exactly 1 | **HELD** |
| **PC4** | `cbh` reproduces `5.033599376678467` exactly | **HELD** |
| **PC5** | `spies2` 0 → `[1]`, `deat` → 400, `tdep := 15`, `sdo := 0.0084` | **HELD** |
| **PD1** | the control pair's pre-turn saves agree, post-turn saves differ | **HELD** |
| **PD2** | the divergence is one AI's research pick + checksum + `tch`, and nothing of mine | **HELD** — 15 leaves, localised |
| **PD3** | not a calibration pair; must not enter `determinism-hashes.txt` | **HELD**, and stated in advance |
| **PD4** | the sub-trees this lane's numbers depend on reproduce | **HELD** — `spymgr`, `systems`, `fleets`, `trdmgr` digests identical; and W is byte-identical to OB over 44,438 leaves |

### 8.1 PB4, the one that was wrong, and why it was wrong

I predicted the **tail bracket** would cost 2 words per turn from Frame 19, on the reasoning that
`vslot13` contributes 1 and `vslot14` contributes 1. Both halves of that were right on every single
turn. The prediction was still wrong, because **the tail has a third contributor and I treated it as
a constant zero.**

```
Frame          16  17  18  19  20  21  22  23  24  25  26
vslot13         1   1   1   1   1   1   1   0   0   0   0     <- predicted exactly
vslot14         0   0   0   1   1   1   1   1   1   0   0     <- predicted exactly
0x00820e1d      0   0   0   0   2   4   7   7   8   7   8     <- NOT PREDICTED
tail bracket    1   1   1   2   4   6   9   8   9   8   8
```

`0x00820e1d` is the **trade-raid roll** in `TradeManager::Slot13RngCalleeA` — lane AC's site, priced
per fleet by lane AD. It was at zero on Frames 16–19 and entered the tail on Frame 20, growing to 8.
That is the AI's raider fleets arriving on trade-sector nodes as its navy went from 157 to 251
ships: **`calls == words == the number of qualifying fleets`, exactly lane AD's per-fleet model**,
now reproduced on a different map, a different lineage and an AI-owned fleet rather than a
player-owned one. AD measured 2; this run measured 2, 4, 7, 7, 8, 7, 8 on seven consecutive turns.

The lesson is rule 20's, in the direction nobody watches: I checked that my *sites* were priced, and
then quoted a *bracket* total as if the bracket contained only my sites. A bracket is a sum over
subsystems, and predicting one requires predicting all of them. The correct form of PB4 was "the
**spy** contribution to the tail is 2 words per turn from Frame 19", which is what was measured and
what should have been written.

**It is also the most useful failure available**, because a wrong bracket prediction that decomposes
cleanly into "my model was right, an unmodelled neighbour moved" is a free confirmation of the
neighbour's model. The residual was 0 on every turn, so nothing is unaccounted for.

---

## 9. Coverage — what this did not touch, said as loudly as what it did

* **`0x00840929` and `0x008409c7` remain unfired, and are now known to need a Morrigi empire.**
  That is a *stronger* negative than "not reached in the states measured": the gate is decoded, the
  branch was taken twelve times in the other direction, and the predicate is a single field on the
  spy's owner. **The workload that closes them, named from the failed conjunct:** a Morrigi
  single-player game, four spy techs, a spy deployed at a foreign colony with a belt, and ~7 turns of
  waiting. `0x008409c7` needs one more thing on top — the roll at `0x00840929` must *succeed* (75 %)
  **and** the candidate list must be non-empty, which needs a **third** non-eliminated empire that is
  neither the spy's owner nor the target's. This map has one (`Spengler`), so a 3-empire Morrigi game
  reaches both.
* **`P` ran exactly once.** Everything about its cost is a single observation. The loop is over the
  spy vector, so two spies detected three turns apart should give two calls on different turns and
  two spies detected on the *same* turn should give two calls on one turn — **that is a reading, not
  a measurement** (rule 20: do not fit a constant to one observation).
* **The `sdo` arithmetic is still validated only in its first and third terms.** `countA`, `countB`
  and the species multiplier were 0 / 0 / 1.0 for all eleven turns. `countC` held at 2 throughout,
  which is why the line is straight; nothing here identifies *what* `countC` counts, only that it did
  not change while one fleet of one ship sat at Kepler.
* **The auto-detect arm `(TerrFl & 1) == 0` was never taken.** Lane AS flagged it as the most
  load-bearing unmeasured branch in the chain and it still is. Nothing in this lane touched it.
* **The `ncp`-blocks-rebootstrap gate was never reached** (§5.4 item 3). `cm` never wrapped 4 → 0
  because the spy was destroyed at Frame 25 with `cm = 4`. Two more turns of survival would have
  tested it; a second spy deployed later than the first would too.
* **`P`'s return value was not traced.** The Frame-25 roll's outcome (whether `re` was named in
  Kepler's `EVENT_SPY_DESTROYED` event, a 25 % chance) was not read out of the event text. The
  ledger prices the site; the semantics in §1.2 are from the instruction stream.
* **One turn, one process for the eleven-turn series.** W is a single process. The control pair
  covers only its **first** turn. Frames 17–26 have no two-process control at all, and by §7.3 every
  one of them is an exposed turn, so they should not be assumed reproducible.
* **Turn 27 was not played.** The driver stopped on a Von Neumann encounter dialog at Rigel, which is
  where the series ends. Nothing after Frame 26 is measured.
* **`probes=11` was not used anywhere in this lane**, and no number here is comparable to lane AC's
  turn totals.
* **No `Guard` region is declared by any hook in this family** — the same gap lanes Z, H, AS and AR
  reported. `undeclared = 0` in these traces is vacuous.
* **The species table is read from the save's own `ISsp` list**, cross-checked on one Zuul save and
  one hook report. No Morrigi, Hiver, Liir or Tarka save exists in the corpus, so indices 1, 2, 3 and
  6 are named but not exercised.

---

## 10. Corrections to earlier findings (rule 11)

* **Lane AS §6, board row 207, lane AG §6 and this lane's own brief: "`P`'s three draws".**
  `0x00840929`, `0x008409c7` and `0x00840a3c` are **not three sites behind one gate**. They are two
  mutually exclusive branches selected by `spyOwner->Species == 6`, and no call can reach more than
  one of them. Every inventory that lists them as a group of three should say so. §1.2.
* **Lane AG §3.2's caution to lane AS: "a spy program run without FTL Economics takes a different
  branch of the machine".** The `CnTrd` the stage machine consults at `cm 1 → 2/3` is the **target
  system owner's**, not the spy owner's. My empire has `CnTrd = False` and the machine still took the
  `1 → 2` arm, because Kepler's owner has `CnTrd = True`. §5.4 item 4.
* **Lane AG §3.2's `ncp` reading.** `ncp` is a scalar `int` in the stream, and it behaves as a
  **counter of completed counter-mission stages** (0,0,1,1,2,2,3 in lock-step with `cm`). "Non-empty"
  is therefore `!= 0`, and the branch that consults it was never reached here. §5.4 item 3.
* **Lane AS §1.4 / §6.1: "`cbh = NextFloat() * 2*pi`".** Correct in value; the code is
  `lerp(0.0, 2*pi, r)` with a float32 round in the middle, and the angle is `DeploySpy`'s **second**
  argument, set up before `0x0080c860` (a zero-argument getter) is called across the half-built
  frame. AS's "`spy->cbh := <the float argument>`" is right; §6.2 only names which argument.
* **Lane AS §6's detection-probability table** (38 % / 65 % / 85 % at +10 / +15 / +20) is the right
  model evaluated one turn late. `AccumulateDetectionOdds` runs *before* the gate, so the roll on the
  End Turn producing Frame `f` uses `sdo = 0.0084 × (f − 14)`, not `0.0084 × (f − 15)`. The corrected
  figures are 43 % / 70 % / 87 %. Measured `sdo` (§5.3) settles it: the Frame-16 autosave already
  holds 0.0168, so the Frame-16 roll was at 0.0168.
* **Lane AG's audit and lane V2's inventory have a column they need.** `0x0078c97f`'s predicate is
  *"a `SHIPACTION_DEPLOYSPY` command in this turn's command stream"*. It is now **measured**, so the
  gate-indexed audit's two cell kinds (a firing, or a save predicate) become three: a firing, a save
  predicate, or a **stream** predicate. This is the first entry in that column.

---

## 11. Artifacts

| what | where |
|---|---|
| the instrumented eleven-turn trace (per-turn `draw_sites` + `probe_entries` + brackets) | `verify/traces/ap-probes8-turn16-turn26.jsonl.gz` |
| the deploy-turn trace | `verify/traces/ap-probes8-deploy-turn15.jsonl.gz` |
| shim log for the eleven-turn run | `verify/results/shim/ap/ap-probes8-w.shim.log` |
| shim log for the deploy run | `verify/results/shim/ap/ap-probes8-d.shim.log` |
| **the detected-spy save** — first `sdet != -1`, first non-zero `cm`/`cmo`/`ncp`/`spyon` in the corpus | `verify/results/saves/ap-turn22-spydetected.sav` (83,188 B, `--strict` 0 errors / 0 warnings) |
| **the post-`P` save** — the spy destroyed, `nspy` back to 0, `spies2` emptied | `verify/results/saves/ap-turn25-spydestroyed.sav` (84,487 B, `--strict` clean) |
| the deploy run's Frame-15 autosave (`cbh` reproduced) | `verify/results/saves/ap-deploy-turn15.sav` |
| the two control post-turn saves | `verify/results/saves/ap-oa-turn16.sav`, `ap-ob-turn16.sav` |
| addresses this lane mints | `ghidra/addresses.d/ap.json` |
| predictions, committed before the build | this file §0–§3, commit `f8ff1b6` |
| instrument | `sots-engine` `src/shim/shim.cfg.hp8` and `shim.cfg.hoff`, **both unchanged** — this lane wrote no engine code |

### 11.1 The hashes, for the record

```
input      MyGameas1spydep.sav        854a10fa1ea602f0f7909f9bf9154942e56ea5fa1db4cce47d6d32bf53952e08
A/B/M/OA/OB  (Autosave EndTurn).sav   98e45d3745b914506fc4c409ad5a5ad0938a2003ab4c845421a99a8065149c3a
W  (probes=8)  turn 16                262f8bda97c9511d8d2b41e6a8a0582d6f5364c2b01b1caf99e639d0e4f53ebe
OB (hooks=off) turn 16                262f8bda97c9511d8d2b41e6a8a0582d6f5364c2b01b1caf99e639d0e4f53ebe
OA (hooks=off) turn 16                e296394f578b3a5668e5934b9eec8d6c4638ca7411200078f97de1abd346f4c5
   turn 22 (detection)                91381bd7e722ac3847795a402d78ebb31d74dbb5d2909f33d243aec3ef8abaf8
   turn 25 (P ran; spy destroyed)     46380fcf4498d67507e4471eb9ee3762647c53ee5473be142fe5c34e37344bc3
deploy run, turn 15                   844f2b746060dc2c4e2099cdc6ceffd5f55ef858c9e347df28c8aca3041f7165
shim binkw32.dll  ap-989c692-…        ae084ed4774caf24ea7927fcb012d1999633f10556c7c99f0209f66067416a17
```

**None of these is a calibration pair.** §7.

---

## 12. VM144 as left

**Restored and verified by screenshot at the main menu**, profile `re`, 2026-09-09.

* `C:\SOTS\binkw32.dll` restored to lane L3's build from `C:\SOTS\shimdist-l3\binkw32.dll`
  (sha256 `479B8614D2417603…`, byte-identical to what this lane found in place).
* `C:\SOTS\shim.cfg` restored from `C:\SOTS\ui\preAS-shim.cfg` (L3's `shim.cfg.l3probe`,
  `probes=11`).
* The three autosaves restored **byte-identical** from `C:\SOTS\ui\preAS-SavedGames`
  (`1985E6F4…` / `24B2E072…` / `5EC80C1E…`). This lane's eleven turns had overwritten their contents;
  lane AS's snapshot is what made the restore possible and it is worth keeping.
* `C:\SOTS\shim.trace.jsonl` and `shim.log` removed before the relaunch.

**`SavedGames` is still 15 files** — this lane added none and removed none, so **lane AS's row
positions still hold**: `MyGameas1predeploy` at **(400, 347)**, `MyGameas1spydep` at **(400, 376)**,
`OK` at (682, 624). Verified by screenshot twice this session. All fifteen files hash as AS left
them.

Left in place, all harmless: `C:\SOTS\shimdist-ap\` (build `ap-989c692-20260909T0425Z`, 63 files),
`C:\SOTS\ui\apgo.ps1`, `C:\SOTS\ui\aphash.ps1`, `C:\SOTS\ui\ap\` (the End-Turn driver, its per-turn
saves and screenshots), and the scheduled task **`SOTSAP`**. `click_helper.ps1` was **not touched** —
this lane needed no new verbs either.

### 12.1 Guest notes worth carrying forward

* **The End-Turn driver is the reusable part.** `C:\SOTS\ui\ap\ap_loop.ps1`, run through the
  `SOTSAP` scheduled task (an `InteractiveToken` clone of `SOTSUI`), reads `C:\SOTS\ui\ap\job.txt`
  (`turns=`, `tag=`, `first=`, `maxwait=`), clicks End Turn, **polls the autosave's mtime** until it
  moves, snapshots `(Autosave).sav` to `ap\saves\<tag>-<NN>.sav`, and **stops on the first stall with
  a screenshot**. Eleven turns cost 11 minutes unattended. Set `job.txt`, `schtasks /Run /TN SOTSAP`,
  then watch `ap\loop.log` from outside.
* **Nine minutes of this lane went into a screenshot-lag artefact, and the lesson is general.**
  Four consecutive clicks appeared to select the wrong Load-dialog rows, which read exactly like a
  coordinate offset and nearly produced a "the click helper is 87 px out on this guest" note. It was
  not: the click task takes ~3 s to start and ~3 s to run, and a screenshot taken 4 s after
  `schtasks /Run` shows the state **before** the click. **Wait ≥ 9 s between triggering the click
  task and screenshotting.** Every documented coordinate on this guest is correct.
* **The first click after `fg` is swallowed** by the focus activation. Send `fg`, then `move`, then
  `sleep`, then `click` — or spend a throwaway click.
* **A `wheel` zoom on the star map separates systems that overlap at the default zoom.** Lane AS lost
  a run to Kepler and Midway sharing a hit test; six notches at the cluster centre and then eight more
  at the target spread them to ~120 px apart, and the labels render. No affine fit was needed.
* **Selecting the system, not the fleet, is what enables `Special`.** With Kepler selected the left
  panel grows a `Fleets at Kepler` list and `Manage Fleets` / `Move` / `Special` light up;
  `Special → Deploy Spy` then opens a ship picker whose ship is already selected, so `OK` is the only
  further click. The whole deploy is four clicks once the right star is under the cursor.
* **The pixel test for "is the main menu up" must sample the button, not its label.** (511, 536) is
  inside the white text of `Load Game` and reads ~(195,191,191) on a bright frame; (470, 530) is the
  button itself and reads (184, 0, 0). A test on the first point passes only by luck on a dark frame.
* **An End Turn on this state costs 6 seconds** under `probes=8` with ~150–250 AI ships. The
  campaign's "30–45 s per End Turn" figure is from a different guest and a different config.
* Turn 27 raised a **Von Neumann encounter at Rigel** ("No ships available", `Done` at (233, 673)).
  A driver that polls the autosave rather than the screen stalls on it cleanly instead of clicking
  through something it cannot see.

---

## Proposed board rows

New row:

```
| THE SPY ATTRIBUTION ROLL FIRES - and P's "three draws" are TWO SPECIES BRANCHES, only one reachable per game | verify | verified | high | 100% | 2026-09-09 | **Lane AP, VM144, build `ap-989c692-20260909T0425Z`, `probes=8` (never 11), own build dir /srv/re-lab/build/sots-engine-ap rm -rf'd first.** Continues lane AS from `as-turn15-spydeployed.sav`: **11 End Turns, 6 SECONDS EACH** (the brief budgeted an evening; the cost is the launch and the load, not the turns). **DETECTION AT FRAME 22, `P` RAN AT FRAME 25.** `Mars::RNG::Chance` at **0x00840a3c** fired **1 call / 1 word / no_draw_calls=0 / strategic=true** at `ret_rva 0x00840a41` - a site that had never fired. **CORRECTION TO EVERY INVENTORY (row 207, lane AG 6, lane AS 6, and this lane's own brief): 0x00840929 / 0x008409c7 / 0x00840a3c ARE NOT THREE SITES BEHIND ONE GATE.** `SpyManager::Slot13RngCallee 0x008408e0` opens `cmp [spyOwner+0x5c], 6; jne` - `Species == 6` (MORRIGI) takes `Chance(0.75f)` at 0x00840929 and then `NextInt` at 0x008409c7 to blame a RANDOM THIRD EMPIRE (a false flag; the true owner is never named); every other species takes `Chance(0.25f)` at 0x00840a3c and on success returns the TRUE owner. **No call can reach more than one.** Species table decoded from the save's own ISsp list and cross-checked on lane V's Zuul save: **0 Human, 1 Hiver, 2 Tarkas, 3 Liir, 4 _NPC, 5 Zuul, 6 Morrigi** - which also NAMES lane AS's two unexplained multipliers in `AccumulateDetectionOdds` (0.75f = ZUUL, 0.5f = MORRIGI). Constants read as the four bytes (rule 23): 0x009e5ac0 = 0.25f, 0x009e5ac4 = 0.75f (the same word AS read as the Zuul multiplier). **0x008409c7 needs BOTH the 0.75f roll to succeed AND a third non-eliminated empire** that is neither the spy's owner nor the target's. **SECOND SITE CLOSED: 0x0088dc43** (the counter-mission roll, lane AG 3.2, corpus 0 of 22, never fired) fires 1 word/turn from **Frame 19**; the bootstrap turn (Frame == tdep+3) sets spyon/cm:=1/cmo:=0.2f and DRAWS NOTHING. `cm`, `cmo`, `spyon`, `ncp` - four of the value-domain census's 234 single-valued fields - are all OFF ZERO with a measured trajectory. **TWO CORRECTIONS TO AG 3.2:** the `CnTrd` the stage machine consults at cm 1->2/3 is the TARGET OWNER's not the spy owner's (my player has CnTrd=False and it still took 1->2, because Kepler's owner has CnTrd=True), and `ncp` is a SCALAR COUNTER of completed stages (0,0,1,1,2,2,3 in lock-step with cm), not a container. **THIRD SITE CLOSED: 0x0078c97f**, the deploy `NextFloat` in the SHIPACTION_DEPLOYSPY handler that is in NO inventory - 1 call / 1 word / strategic, in the **ProcessTurn** bracket, and **spy.cbh came out 5.033599376678467 BIT-IDENTICAL to lane AS's** from a different process, build and session. **Its predicate is on the COMMAND STREAM, and this is the first measured entry in a column the gate-indexed audit does not have.** THE POLARITY CASE, MEASURED: on Frames 23 and 24 (sdet+1, sdet+2) `vslot13` is ENTERED (probe = 1) and costs **ZERO** - a third arm of the same function, and `sdo` FREEZES at 0.0672 in the save, proving branch D stopped independently of the ledger. On Frame 25 the entry probe on `SpyManager::Slot13RngCallee 0x008408e0` reads **1** - ITS FIRST NON-ZERO EVER, the complement of lane AS's demonstration that its zero said nothing about the subtree. The spy is DESTROYED at the end of phase 23 on sdet+3 by manager vtable slot 10 `0x00838480` -> `ServerSystem::RemoveSpy`, so vslot14 costs 0 that turn: nspy 1->0, spies2 emptied. `sdo` measured on NINE points, exactly `0.0084*(f-14)` as float32 (`3c89a027 3cce703a 3d09a027 3d2c0831 3d4e703b 3d70d845 3d89a027`), which also corrects AS's detection-probability table by one turn: **43%/70%/87%** at +10/+15/+20, not 38/65/85. Residual **0 on all 12 measured turns**, overflow 0. **ONE PREDICTION WRONG AND NAMED: PB4** said the tail costs 2 words/turn from Frame 19; it costs 2,4,6,9,8,9,8,8 because the TRADE-RAID roll 0x00820e1d entered the tail at Frame 20 and grew 2,4,7,7,8,7,8 as the AI's navy went 157->251 ships - an independent live re-confirmation of lane AD's per-fleet model on a different map and an AI-owned fleet. The spy halves were predicted exactly; quoting a BRACKET total requires modelling every subsystem in it. Saves `ap-turn22-spydetected.sav`, `ap-turn25-spydestroyed.sav`, `ap-deploy-turn15.sav`; findings `findings/subsystems/spy-program-draws.md` |
```

```
| CONTROL ON as-turn15: THREE OUTCOMES IN SIX PROCESSES, and exposure is SATURATED on this map | verify | verified | high | 100% | 2026-09-09 | Lane AP, VM144. Two fresh `hooks=off` processes (OA, OB) on `MyGameas1spydep.sav` + 1 End Turn, added to lane AS's A/B/M and this lane's `probes=8` run W. **Pre-turn `(Autosave EndTurn).sav` is byte-identical across four processes, two lanes and TWO DIFFERENT BUILDS** (`98e45d3745b91450...`). Post-turn: **three distinct outcomes in six processes** - `262f8bda` x4 (AS's A and M, AP's W and OB), `e34775a7` x1 (AS's B), `e296394f` x1 (AP's OA). **OA != OB, so this is NOT a calibration pair and must not enter `determinism-hashes.txt`** - stated in advance as PD3. OA vs OB diverge in **15 leaves, ALL of them Player[32]'s research pick plus /Summary/Checksum and one turnstats `tch` cell**; three distinct picks were sampled (Overthrusting completed / DRV_NodFoc in progress / DRV_McroFus over budget). **`probes=8` IS BYTE-NEUTRAL, PROVEN PROPERLY THIS TIME: W is IDENTICAL to OB over 44,438 leaves** (`state_checksum --floats bits --mask none`), while the two un-instrumented controls differ from each other - so the instrument agrees exactly with a control in a leaf class it provably does not touch. Sub-tree digests: `Sim/spymgr`, `Sim/systems`, `Sim/fleets`, `Sim/trdmgr` all IDENTICAL across the pair; only `Sim/players` and the derived `Summary` move. **RULE 26(c) EXPOSURE FIELDS RECORDED NEXT TO THE HASHES** (coordinator's request): the control input carries `Player[32].ResTNm == ''` - a pick turn - and it varied in exactly the leaves the predicate names. **AND THE PREDICATE IS SATURATED ON THIS MAP: all 13 pre-turn states from Frame 14 to Frame 26 carry at least one exposure signature** (9 of 13 a research pick, every single one a batch of ship completions, four a design, four a colonisation; Player[32]'s navy goes 146 -> 251 ships in twelve turns). **There is NO quiet turn anywhere in this lineage**, so no rung-A pair is obtainable from `as-turn15-spydeployed.sav` by waiting - the opposite end of the axis from lane AR's turns 38-39, and a lane that wants a pair on this map must pin the client seeds. Counter-nuance: exposure is necessary for variation, not sufficient per pair - W, A and M (three processes, two configurations, two builds) landed on the SAME bytes on this exposed turn, so a single agreeing pair on an exposed turn proves nothing. Saves `ap-oa-turn16.sav`, `ap-ob-turn16.sav` |
```

Edits to existing rows:

- **Row 62** (guest holders) — `VM144 = FREE (lane AP released 2026-09-09; restored to L3's build 479B8614… + L3's shim.cfg (probes=11) + the three pre-AS autosaves BYTE-IDENTICAL from ui\preAS-SavedGames, main menu verified by screenshot). SavedGames is STILL 15 FILES and lane AS's row positions STILL HOLD - MyGameas1predeploy (400,347), MyGameas1spydep (400,376), OK (682,624), verified by screenshot twice. AP added C:\SOTS\shimdist-ap, ui\ap{go,hash}.ps1, ui\ap\ (an END-TURN DRIVER worth reusing: ap_loop.ps1 + the SOTSAP scheduled task clicks End Turn, POLLS THE AUTOSAVE MTIME, snapshots (Autosave).sav per turn and stops on the first stall with a screenshot - 11 turns unattended in 11 minutes). click_helper.ps1 untouched. GOTCHA THAT COST THIS LANE NINE MINUTES: the click task takes ~6 s end to end, so a screenshot taken 4 s after `schtasks /Run /TN SOTSUI` shows the state BEFORE the click - four such shots read exactly like an 87 px coordinate offset and nearly became a false gotcha. WAIT >= 9 s. GOTCHA: the first click after `fg` is swallowed by the focus activation. GOTCHA: the main-menu pixel test must sample the BUTTON (470,530) = (184,0,0), not the white label at (511,536). TIP: `wheel` zoom separates stars that share a hit test at the default zoom (Kepler vs Midway, which cost lane AS a run) - no affine fit needed. An End Turn on this state costs 6 SECONDS under probes=8.`
- **Row 207** (V2's eight sites) — append: `CORRECTED AND ADVANCED 2026-09-09 by lane AP. 0x00840a3c FIRED (1 word, Frame sdet+3 from as-turn15-spydeployed.sav). 0x00840929 and 0x008409c7 are NOT two more sites behind the same gate - they are the MORRIGI branch of SpyManager::Slot13RngCallee (`cmp [spyOwner+0x5c],6`), mutually exclusive with 0x00840a3c, and unreachable in any Human/Hiver/Tarka/Liir/Zuul game. Closing them needs a MORRIGI empire (and, for 0x008409c7, a third surviving empire). Of V2's eight, only 0x0082cdb8 (trade 15) is now both reachable and unfired.`
- **Row 418** (lane AS's detection-roll row) — append: `EXTENDED 2026-09-09 by lane AP: the roll fired on seven consecutive turns and SUCCEEDED on Frame 22; `sdo` is exactly 0.0084*(f-14) as float32 over NINE points and FREEZES the moment sdet stamps. AS's probability table is one turn late - the corrected figures are 43%/70%/87% at +10/+15/+20. AS's 0x0078c97f is now MEASURED (1 word, ProcessTurn bracket) and `cbh` reproduced bit-identically across processes and builds.`
- **The `0x0088dc43` row of lane AG's audit (§3.2)** — `FIRED 2026-09-09 by lane AP, 1 word/turn from Frame 19 (= tdep + 4). The bootstrap turn draws nothing. TWO CORRECTIONS: the CnTrd consulted at cm 1->2/3 is the TARGET OWNER's, and `ncp` is a scalar counter of completed stages, not a container.`
- **The gate-indexed audit's cell taxonomy** — `A THIRD CELL KIND EXISTS AND NOW HAS ITS FIRST MEASURED ENTRY: a STREAM predicate. 0x0078c97f fires once per SHIPACTION_DEPLOYSPY command applied; no predicate over the save can express it, and no call-graph sweep can find it (stack-built ship-action table, lane B6's class).`