From 7e89249f46aa9ed0d649e6ae3437c9b95d3c6577 Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Wed, 26 Aug 2026 23:57:25 +0000 Subject: [PATCH] re: refute the "counter sits at page offset 0x9668" prediction The file proposed that the counter lives at a fixed offset inside an allocation whose base moves by whole 64 KB pages, and stated the test itself: "a third scan should again land on ...9668". Ran it on a fresh guarded Stage 02 run. Probing all 8192 pages of the form 0x????9668 across 0xa0000000-0xbfffffff: with the HUD at 004, exactly two VAs held 4 (0xbc3f9668, 0xbe3f9668); with the HUD at 012, ZERO held 12. Both candidates also failed the file's own transition rule -- over 252 s 0xbc3f9668 held a flat 4 and 0xbe3f9668 flickered 4/0 while the HUD went 004 -> 012. Both arms were sampled at the same instant (cropped HUD digits beside each memory read), after a stale-screenshot comparison earlier in this session produced a spurious 13-vs-004 mismatch. Scope kept narrow: this refutes the page-offset prediction, not the confirmed finding that 0xbdb59668 carries the counter in some runs. The counter's address in THIS run remains unknown -- no transition filter was run. --- docs/re/captures/remaining-ob-012-crop.png | Bin 0 -> 12307 bytes .../structures/mission-objective-counter.md | 31 ++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 docs/re/captures/remaining-ob-012-crop.png diff --git a/docs/re/captures/remaining-ob-012-crop.png b/docs/re/captures/remaining-ob-012-crop.png new file mode 100644 index 0000000000000000000000000000000000000000..137bd4c307a4ba33c2f37d70c50e703a8a5f26b3 GIT binary patch literal 12307 zcmV+uFznBXP)004R> z004l5008;`004mK004C`008P>0026e000+ooVrmw00006VoOIv0RI600RN!9r;`8x z00(qQO+^Rl2pShS7LNVWApig`iAh93RCwCGeR<4f$yMJur|RCfzxVA+PtWx1-FDB| zcx-H7?6HY)0*+)8%pU|qOr(Gul*kAOBodN?0!c(df)YDX7C=!DAqs!Q2@nMv1=(X^ zb-Q~USYZK*8PxpKG)ve{!sk8jfsk$hIgwiEQG-^$y zqad0A11I+}{vVj(j92=ITTk{=Rnq{VjV>3%Gc+AH$F{+_t<39y+uQ6zWr3t83+jio zCPV;WW}8Rr+nId>3&kN_AN5R*T)KvKvP(w9Cn$5bp-hsBx+ zNszFVBR~_gY1X2%>~eE^CZov+0Rb!7Y%!7T2(pLgki}W}h@O;$*lo49 zwzn=n{BXD39uJ4JFwBY+Xnls>;KI^r=OpB10U`<^TkRGAgdx`ax|)u%8W9muYjvuK z#H_-cbR+}-FjdbZLbKLfURqmTS!QEq;Vg^-JcFn!UR?Z!RYfW*Bt#Cun6!(DLNEl#$n1z62JnSkU0Ye(THPLO z-#pm44aHP3)L|jW7K|k8ex=p5><;brMCyY_%#AQmh{m8^8($Pk2&DW?ie-0bFj( zR9R*`FaUr76Y7i+ZB+tAU3%?C6A^d%hw)FbT1EsU5{HLJdtd$9+qbUGU6xgJ!D5k2 zI8;^u088E8`uf`7q;D8}-;e4wZOl>s_?ai3B0)93cG&MDBHQ6Ho5Y3!079}HNeJ2) zK8@s+>Ll(W14<$75@F`pz5xILNdf?rW6v#U01Mrhc1wz_hBbi8|fw6?S?r8qb`PNty5 z;l;<%u3lwQ`CjTE0s{6rT`+ty8l>Gp<^qYZ(z7|sg)t8yFnGQP0J9*pwvoxJuyh2S zR(oq>b1*nLJU(VNW}zCYdEPyD-#wj9Z|&>=K%~@yo_yOwILnwX~QS5v;AQnFZj++Nx4||L7=C5#&@>+`De4-R<%Qn||Ofd}uaH#_@>{gdOP&@gusfe=6n0l=Xy=$1+`dBzI?*g*xd zzPMNv17KcuT7ah8>fC$r^4iw9Yj3`$$KyM<@7h1yzk1`%lj+DUe%mtAupxtNwFnz9 zWEhOm!^xP45}>V`!uJdDnP$^y^KZxF*9weVl26p{TU}+PW0^~=WMwvR1~p2E0?9DD zU{;}kB;iRJDW#0!Q|lMcDR*ZR~GZ+R8wVJp5&WuM| z7DN|N#vG2C`b-Ehw{n7&B^?7`W(Mew1}}c=$TRvKpQq3W3G%DKzJ$j(?( zoS&JIi(X9;M`u1BpB#<)n6{H|xIoPZ< zmb**GgZ^kXvCUacz5N3p@7{Ii)7!B=)f9G z5JgbMHw>`$*oQBD_Oo>JCbH4n+pqujZ}0rk9}%4OVt{x4(l4!EyeRhfL94}u+r3_E zWo74;*WUQEKfC%r{|Ba1&czU4>f*$4NC)jP#+puS!xo%}-vkMdWZkO?62sZZdd+83 zV=mhlBFHY36T4f8neHY>dluJW3ikp)y7DWu5zDgz$Z5wA>V6#&C$p(xLqxq!S1C1_ zP6(0njm*>Ki5{?$4Twk^)2ug_y1mI{JW9H|_Sj>Wf8hbNyzrNNkTRp@yu zzQ6p?JI(if^y&*Qy!l(d>6jKyNoMVIt|%&)I7rrojOaysFH!>dA2gp^5@3NW~1J?^7fTVzj)zvXFyM^(3lyKE!vj^YY<98I;G0ONM(Vk z-0Su{8$#S#+uYjR-rL)q%%(Q9Fc^-)D1^j-o!?>+vVg>b1g!;$n&(jxH)rOpANcsC z4?RXtJq<@kG@U}EfK4HiW+gu(fe^U2k9+%fpFiLGhrj&Xul@?(rocu-Iy|J^Jz(Z; zubP}`4nzW3yWOGjn5I+O-Nh)Zs67RP5exv3K;M%)JB`iFNB-{L`TDQ^lW^x2C9W(3 z5Fh|D7ywqwg8emlblF?3e>3LLx=D)iUii1R<)ZKxj;&Vr&dBgHjwt6ofDsQV>eOhkxd?-~7d2 zlqAlrZmce^AmYLC;q`;vq_xsIbQ)l1o-q+^h!|)uGhfLR1(C#kDdog!C**-hj84-;fStZyW{dh*YAH| z_WEn{+7d{dm+5D+u?nls@#dHT1VtAw%GFg)>`2FvbP`S&FbHrk;Jtl1KEg1h-QCXm z>dJ>c)PMYOV{{lrxAtxwCkZZ<%#z9~yXZ_wdm_^LbLX|vJNvh^sRq0%y}UuCJrzZ-7!$ksP7keX^{DT4 zNC3i*H=DmP8iCc$i8Nm${2Q%SCG8sZdaKb?DndvNj(B?Jx$3s^mGAy;e=wl_aozL8 z%2K$tc552keCb6NvLN)L!RX*?UjcxvkNxEb9(kmWNQXx_9Khc0=A+;9=4-E3CeIOK z;wUTvtxkbplGsv`V+Jq&qhE=VxLAyvq?SwpYecATZocfQNC5bw>EugclzRjLr?c^NiY3|>{WpgY_WSBX4@18% z!br9nu)6y8!Qu12^_wX{OYB92xc?_#9=-9#cYW$pJRZv^r19{MhaY}pj-9}1khpTr z7jR<9j!#KO2nH>b)dpX>w@=*0KC8d;vfFu2R`u$IzEOVq{*av;eufn z@e(=}lq`%btD6v&R-Wf0LNJ>ODI7upA`%h+C~czve44w11So|tYy*;*(vOqeLK|H0 z8}<9&@nCOt>GdmDj-GoqjeO=XJj^WcJ2$u1S6AP&qTqazW<06UkY80Lq$42`2|{9A7$r~r*%F$TGN(m69TlRwp+x4hx_3kA{Q(a57FaEd+uf zfrOs)1ko(C2?mQsnGuJO4KbJ$FTh+t5kjqQUB6bZ`A7Yu>({PoDB44*b7Z0Yw(qSi zFFp9c{VQv$fBwxU_J_lCLghE3;D^1|2c-O3ln**N@=LRMAqXBo`f$BbkcDZZoY%Z5 zik6bBYAqJfxA<4j_d!LV4S1euw`RLL0!zqX3G7FNlfAvV@1tR!&R{wft(KaMajvc_ zRER(}I=ZkJyTeRzj+}OqBndH4;XDH_8LKf;a%w;n@<`%136-g~sCUdtD?}Pj#|1yt zFd!Q+$Wcf{TI<5Bl|az=M*|#2Dy}`#RGb!I0By{b*Iv1G^M>?1A`*Z)(Ly%Dlo>A! zgwSa=k55jXc=p+Drz?bTi6|eBqVHw%y^Y4#qG8rI1QDkd0{|Ff0&V_eI{D#d>ru~p zJc?lc#mqm}XuQw&e_=3C&LHP80+g7wwX_6pyvb~U1b806nVn|e2c?*qwPvMcr=#}w z<_Z47Wegjwa{-dFBU*9+l9_XFBeRK&(QFvZqIN5nzoS?%S=FW-^R^|5fiSzEkbniE zDsrS@oh{E;i{`tN$Z|})8Mc_C0fUH=Y+?XNqH~*fZme$~9`5YyUQ4_eZb*4i2zPMS{7>CU1Mu}ojhWx)`KPW~ zlcX9a6)p$^ar!B%RvR`3ZBpyJXEQs#crP(?7!a_Mm#eE}W{wefbSo?}5HB3RVH2n* z(mM4}aUlujcPb9a7?Z%Bm~8uDuz&J>%lc=Swc&F24Y1+(PvzYBLawws_nkj~_vW_S zElHwRYc{=_RSSgROAi5p=_Jycla&P4rhhJmD9^u zHH+xdF^&J_5H9<->v@zKU{WC(1ptgdf=cb=gDecdrZ|lyszRdQn7K01vr7HPQuZB} z-f{li9bVn<^mpm&uRT0>3y`>kc5?*4go@CZUA3Z>iso84W~^Q0N^e`SF~0}BcLb5 zL!GW?PETxQHp-ZMbhJWGB4WMK0Dzk32ju`Az=P-SUR_>(^{qFub$@|Bw0Hwfu}V{5m1A;ZTQejs?!sDhvQHp3RB`t$88@$R$VHpCmJnrjuuY|Eed~g+xSS*g!F1RVSG0 zp9Zr}dmb~}My_ZD03UBOKi-IG?h7FRUJHW=m;g(-UuyeWW3#+L$qf4WLqApik-B$iiJRHTNJan2Y{ z#%o|vE_!|Y+&e$<2|7B$C}Js1voW}J3jh!h2|XbNQDp7WQeRTyL5f{Ez4L|iq}OS6 zg%F3w2bLo%mz!hOFaQKfO@i4o-}=@#476cD5LP;wbdOKU_*M1Ab>)5zdM;!x(ArW406_5m0b@ApqZ6YFTL`z*1GZ-hrN^INUN3Jl2WJS zfZ19HlhNSnXzuYCCAQ2@ck&aWAUfRJS1KZB$q^DWXyE$xxwS_hz2~DJrRfBe$_rSA zAfUkj_xI`e7>wa|mseL0zVs!#k#42kZM8eyPG@&_cQ4sBTjC;Toin?OCems=8&89o zJwk(%xvL%&fE0Fvm|^Bo7^Dgk8GxYXNv%1u=t>ObecUNK_)ox)^ly(b2~V)Q>A<%6*KY-4ap zm;inWVwvz*DrIsG4#Y*1y8d0Dv9I-SlcCc`-w;cL90~x*X#-ef4+hrSXfOsClKeF{l{x20Ao)T{DT6Q!RFpZI ziNM43iFBqo+t-i-kDUANRJlfG`m1JUrL3@&h}y}OmX@`J5GLNY=J*P3o?A{{Cn!^* zCg;J0Ir9Q7isTHBa~-dW=b%gexvb`%1#vdua?w>r>Pmx(dtKbJgP!!?{khMrG#bnwczBx z#fsK(15=hwm!sRRg`W^XkZAh;EC@rbtt5~f+wB<&UEzz(otuS>lAppHAb};OghH!{ z&5$8_u$bw%>Ywtp02)pHE@3}&oca81^n~30Yd^TT+^fI#hB-co!iej2_Ix7+<_}k5 zMDRS*YMb@7BdwqRwSN}u?s!QV1`eVS0Igia>Sl|2Grc?#o|O09e^CnWwO3x8gj2&@ zt2Y36Fdi1_GR6cZvi7bZ6hxAQHYP~2OMTye_Xj^11i`B>UwP}=Ro5!zgef6Wa%p@K z9paRc!c<#s^p-c)*4ypYQNRDj)wivmAZ<-?+#LY{jUyu#vgU#xbGz3dSw1;lukh7! ztHI_eCG3$U0amjIXPj8X74x)Md{xz4&<~X(M*vVlEIsn>{!>rOot+?>nWbgDw#F+< zrrto2-?T$y>b3nh-`e@om-fE;6$JD%uqBN{-ej9}Q(eZvT#T7I70D&-0H`7Mzj42BdT^Czg6ppmzYPCk>`$@BIierVW zOn)&9z02gl^LJpJV_?|tLzg-#S)0f{7&bgv@QEg*1V@jBH;QRGP> zCGYJV3`etbTX$Z)`Bqsvx~q#4ty`(_2x>&H1UEI%mahwJqdLvQTt-rU<0hzO{SVg}9G#5lHD!kn43DK_fPV5Ci`^$V|FDfCMI#QMf~ zIT)pALuP`H_+G)k6H?X6t=X^c#~&Ivobs`eRl$7>B;a z4Hxz{X2yKp0ncW563iw+ptLe3_3AJ-iHn`hJoGs>AxM%^N<@kx6-ANN9+hKuR7a*; z>#J)N1gJDi37u~L`gMVLTkPo0S=pM$s-9QYu8bz6!FW)4TtdmPL0~Y*0B|_$AHCSm zjgaHrv5e60yf6%BQRIXP-LAT!22Q~l%$JOrfwTB3B><$oR>)%+ij!^p7%jdel1dY0Q%{Y^B+#JkO~{cO3La(I_KP}aFj{_k2Xe-NC$-pX6%xc9gio)AqjJ1NpZh~ z6&X0&CPDjJJ+2}f%Xa@D!WV-WeYouVP+Fsy#Ng8`Aw(d=8-~9bgxOdS3WH5^S?11- z5GVxa@_%!oO}7H$(B7J_F}$A{1I36Dl)fV(5&^I_+McBm20@_mD%&+|8Oot1Fb1^( zW=4v$tE=VOw{sP05rlWFZ>_YuHR*Xm5aPU&XRWw28Z7W6L#Wj_oM|>LJC>_*HcYZx zH$!%oYl=)ehoHunWamtUs>w=Q!!++Qy_dk27OBncqyz*ak}=wh1re9uK<5Zc1_T%l z23;wT$QX@EA)*jOfF?T%JCBgPc^qze4ytZSB2RjEp1-TvXukf&tD2S3x<44?@XNWixk}9eoSn&Y@ES}t zstqj{YUBI|iucpmo3T-!c=S1VaZc|TZR@9!4`bC(&<<>@o?~XVTdA2DRtVo;^DW`V zk{Z4*2mwGKHGJ8s`GU||4>c)0B3Ja;Ycd={y$+s-O2K4GzQ4V;cJGBdm)dPg)-D2r zD~1pNpw(_c5CAhsk3C;cCb=*|(u_M2>pmeuk~DZWRzg>{w+*;stl{A*j?+s``c__G65o}*Fr)y8VamDD23gLFl>wh zqtnDOt|&c^CRI~MZ1^le_HXlI&7ifqzI*fF=uk=_rDS7fRasF_L0=1%NSt@W zAepr>wYVS~X3H-WAJrSj822Cl>cx+JAMNbG!6EGJU3~9*Z!GotFT60kwQDMoaE9%V zeeB-vcn{sWg|iv>KKHu&Z@o3&TPRO}O{L7@N-hdh37gxbVr#5AI}(Y6;7FO{KFk6q za~2DoD9n9g=Hr5shJNnk#HDhiwKh`-;pyqpJ8HqVht>7CZUp+y;JDEJCm1d5VaoXp*Nc?!K zwNCUtzxHCJo^g(48f*Q_{gbrIk=FJTWhemvfF2Cre(qa$Z*J0PMB@p(ef7@ujq^Wr ziJMK3lCw+*1^`xyW&xh`@#anF_W^*rJ+rxe?LYo|cOlM`3ROJopqdLWcfWSrA-gL+ z3Tgk~(I5OIudbLz6XR6e`C^I4tgMcvlc#?Ar{_WV4m)NYPu3?IhwoD^bXm@_y9LGU z)K;g~j~3BY11v}gaJIQ+Sy&7JBuHY3re!Hzi3v-h zj^7BQXk^0l98(0iX3UFG_~CjT8CvKn002P1;`%GG3j)H`-}#-j&wZ|Q?i}sxh{;$_ zCa}NH(gQ#yj8P$**J?CsjZuhE1OTShHg}x6aqGt9_17rf$XB%B3pyXF!&7;37NlHp z&LMWt*cea>%s@sn-a7y(s*n}OC1hYJ%;qL;tVe9boI?UHO7T;zb|qgrUvdH+6I+o} zXKX&ofrwbCK&q^mx>qM6WfUPrTE&@Ji6;}EQvpSx%7At0Ng*!Wb>Z?mFJHg*_ES$k zMUWbGP?KJ}(Ud8Gl=dufs4LRi(!MEUW=ajhP-m(0sp#ib->*p-sPwRr-0Y?SbW0=? zFG?3pU=u~pef|rN{KDUBH=DS>PbVjOJVvcS8*ou;yCVk?Jdf)&==S*h`6Exh`s@GP zJrKbjX_v0)f_OO1vajGv%)QIP5m(m7(+af0AV3)AYsi$c@7HSeS`IOXD8;sV895XR;@9dPLL8Gbq-T919Sek*P{Iy&nkD=P;_N9i6tKxlV5a!rU2CL3O*5R#;3 zt&L^_pRCs`<2o52GKgwzO?PrUCkcJe)5hGx{FB)^Ht9SdBKSfY<}kmh*Zyv~ z#22)_vU2$y?}&on*%w|MOegMP9_SQiW^=|9))AD6_K$b%RzG8`P_R>hfKZd36hdjm z#%O!+09dS=ls4DidTV86g_)m!;rSbfhtdMu00^M8e&gy@2>_pJwLS%mfWGuvt)?Iv zPp7jWu!$jK!+#QnG5f^(-9ZTYn@hbP38Koliv^kAilQr8rwAlTagONTT5VmZF9rd| z$$4nvck(29KUQUc2x>HZ_4A*9z13R#(1+G8U0S>RP6{J1#zIE+_#q-RQijZLe)-G& z-}}AE^=pFA_q<5wo%n>05kVjsU?=dHT$e71)fFLxUR#6z^QVP@rFIDt0`q7*(pmxF z`qJ|H`sVRTU;4G^{`=(Gnoc%J<+(XIY=|KO4m{th`Qdb`jbTKyvI^7e_zk=5P#g0g z(NENKSp?|{UTU>_-EO(#}ned#^)u6Lb3x4m=Y=GNxM$(wH$9XB_r zAjzVh!-z>71~6$$WfH^@6D!Lr>+9<`Z(N^Frz#2nfjE}s+US1&_|=!MjK-tg{XIl9 z%)$muAa--{BenWnLVRbvPJmL1cB?6boKB}f5Ij4Zy%a?@(;~IAKI!|9)#{!gL{!>T z9)Y#5%~xi#$D_#I`oG+5HyZU%EB)eV{NIBBAxkw%GJmtwy25c4ane+(+>zpwXtcHg zCTsnA!XpG^M#4zzavUu-t(NJarm?aqDo-PdR~`^U$( zZr(T?3<{dY+JzU+oxkJU*7fT*-rl)YBn6!P$|*DV7|Zgt(&?_QZ=Cdx_KuDU4O#z1 zAbCO<0BtlI6U)dXE{C3w=`mRdAcgQfU#TdH)4TE!5Bv97A`+OwV2A*|CtHoi+WPv@ z(a}-=#Ke)P!pp+gJ&4v}fO6e%|Al+H-R{d*UapDSN_Tnx!H=UhyELJuxf!1I$V*lbxnobZ$~H69*QPvkHCzF{rI#tf>ja)hvA>|@d!7(VGa+7*vdoSE@V|oqozaDnIypHBR8)LvO&<5MZ@hG| zfm9cj4bT$!f#rXTMtJ^WYqnKrq1!=4$7|KC0X?2+>tzcf z!{8kKmMcGZp!pwe9qjEK?1fqb!;FKZ>(-aF_8zB@j}uj`m<9KiG8#7?XOy*2q25R52vbMIma%*RoV0PZCXnBdk1(80SStkB3WJ|&wVWfDa@Uuv zj7+<{z8jzloKAWJnIPiSM0Wc> z|D9zn1Ldh!l81R6mW5YJRKoeRKh^F;z~#;|1NTQK0F1tntwyueY(`NunvA0}qzI&J zP`0Ewk0;D|+IkhC`dykYTh19H}Y*Wbb%V`cg(pMM@Q7=m`rz^7eEtbfV~BF6g?;>X>Tc z$|uSUbIR(x=Z-s@jpogpHwM$Oacq+ET%a?Sc}je>ySlWrB1s+`?hVE#kx{~)<}sR1 zW_$mxCY}j7FaHI?a~d(lK8RoTeOHXAP?sPhs-# zl&aY#2m%CQ=$<{4z;TfC=(2vt36_~jXH2A&Hj4`W}*EJQ^9Lf_yBXN=Q|_^v1o6R=w`BF{*!Zq>VPr!oErQEb4zT zm)SF@+RbLW*^HE$f4pqb+$2O`o=zq~7>=gn?X9hQ@4Z`VGZ>A|1Tz)MnPrrS_~306 zL}g;7X6IsdB+L#e(MIQASDihAIp4{(wX%ar&ped;Crs;~GhhIl$1f5rvtZa^#S;al zbog@4ftyy^=}2vCZfawO{S&SAa9VMwwtMj@QVf(alkp%7XOm#6+2E=9k@K7*A{2<) zWPp>^*PT|Y)#@l^!svu^)uj3;P1BA?9%+3t8lH?tc0Zxf#%L3TbB|0;6+xwe;@&iD z(4Gk>1R7witMqyGs1xCbQV2k)wKBk)Ft@4g11F#KCA77VS|403k%ftJx4u z@(=@H@{(Z$faz>H8Bd3kQKdy&lYXP#kV5Ly-aQCOR)^hIq|G8tN%4uD#Tc6uHXl}7 zu(J}KiaphM&NCB%hzN75CVl-OAxSAxv`7je1p#B(Aj?D}W^ENG2>}=c5huGos(_Dl zejJIYa~kWH8M}v)f(*VLaCc?Jng48D z0LYXO+M*Iof2!gXu3*%{;}w1pKn3@?tAMMD6pyV0Sn0Gc-G5)B(KtLlNq-1~*}?w) za5(TtNFj)XWyZzw5`E#Ak_)jT8CxnEPV;gApza9(m_-@@>Yfxt(@+^Umc!CWZhRaT ziJC8iNJUC7uDK9zxUH*%jZ_z~;Am>a=IP$s-oB&X@An4-WArSXCR!CeA<`&jvL>?# z%N#IhK_Bx9y8J*Xd!y1SO*&Am?cEwA5hp!QGaNi2l~R$>oTs@$_Szcc1bvm7+ zD_rFBqAw<&N80j4a+H}USw<+>H)OJI=E)&9a~%7ZttYuk5n|9O((ONHe6mKglGWl tF<0R5bb)9WFI@zHS6;pXdH1S({a@gCCMuamZkqrA002ovPDHLkV1jY ## ❌ REFUTED 2026-08-26 — the page-offset `…9668` prediction does not hold +> +> The reading below — *"the counter lives at a fixed offset inside an allocation +> whose base moves by whole 64 KB pages"* — came with its own test: **"a third +> scan should again land on `…9668`."** That test has now been run, on a fresh +> guarded Stage 02 run (stage asserted), and it fails. +> +> Probing **8192** pages, every VA of the form `0x????9668` across +> `0xa0000000`–`0xbfffffff`: +> +> | HUD | VAs at offset `0x9668` holding that value | +> |---|---| +> | `004` | **2** — `0xbc3f9668`, `0xbe3f9668` | +> | `012` | **0** | +> +> Both candidates then failed the file's own transition rule. Watched for 252 s: +> `0xbc3f9668` held a flat **4** and `0xbe3f9668` flickered 4/0, while the HUD +> went **004 → 012** ([capture](../captures/remaining-ob-012-crop.png)). A value +> that does not move when the counter moves is not the counter, and at `012` +> nothing at that page offset holds `12` at all. +> +> Both arms were read at the same instant (cropped HUD digits beside each memory +> sample), because comparing a stale screenshot against a later memory read is +> exactly how the earlier `13`-vs-`004` confusion in this session arose. +> +> ⚠️ **Scope, stated so this is not over-read:** this refutes the page-offset +> prediction *for this run*. It does not touch the confirmed finding that +> `0xbdb59668` carries the counter in some runs — that address is simply not at a +> reachable `…9668` page here. Nor was the counter located in this run: no +> transition filter was run, so where it actually lives this time is ❔. + **The survivor of interest is `0xbdb49668`** — the run-1 address `0xbdb59668` **minus exactly `0x10000`**, at the identical page offset `0x9668`.