re: widen the OB scan to seven encodings; run inconclusive, probe lacked a witness

ob_by_hud.py now scans seven readings of the same bytes and keeps a separate
candidate set for each, as byte offsets: u32 big and little endian, u16 both
endiannesses at both alignments, and u8. The big-endian u32 reading had been
refuted, so widening rather than assuming is the point.

u32le is much the tightest at 154 candidates against u32be's 4452. That is a
hint about the encoding rather than a result, since a rarer bit pattern narrows
faster regardless of meaning.

The run is inconclusive. The HUD read 4 at every sample, so there was no second
value to collapse the sets against, and from t=136 the candidate counts are
byte-identical across five samples in all seven encodings, which is what a
frozen guest looks like -- nothing in 32 MB changed at all. The probe had no
stall witness, so the run cannot prove it either way. One is added now.

Worth stating plainly: this is the fourth probe written without a witness and
the third whose flat output could not be distinguished from a freeze. Each time
the fix gets applied to that one script. The durable fix is the shared probe
harness already noted in this file, and the lesson recurring four times is
itself the argument for building it.

What the hunt needs is unchanged: two HUD readings at different values in
non-stalled samples. The counter moves on kills, which lands back on the combat
limit, though the earlier 4 to 11 observation shows it does move.

docs/re/BACKLOG.md

@@ -620,6 +620,16 @@ search cannot find a *schedule*.
   (template strip covers only **0 1 2 4 8**; most samples read `00?`/`???`), or a
   counter that can rise. **Next: widen the scan to u16/u8 and LE, and beyond the
   heap** — one function, no combat cost. Also extend `ob_digits.png`.
+* 🔴 **(2026-08-24) Widened to 7 encodings; run inconclusive.** `ob_by_hud.py`
+  now keeps a candidate set per encoding (`u32be/le`, `u16be/le` at both
+  alignments, `u8`) as byte offsets. **`u32le` is tightest at 154** vs u32be's
+  4452 — a hint, not a result. 🔴 HUD read **4 at every sample**, so nothing
+  collapsed; and counts were **byte-identical across five samples in all seven
+  encodings** from t=136 s, which is what a freeze looks like. The probe had **no
+  witness** — now added. ⚠️ **Fourth probe written without one, third flat run
+  that cannot be told from a freeze**; the recurring fix is the shared harness
+  noted earlier. Needs two HUD readings at *different* values in non-stalled
+  samples.
 * ~~🚧 BLOCKER: t=210/240 unreachable in one turn~~ — **superseded, see above**;
   it rested on an untested assumption that a turn is one shell call. 595 s shell cap − ~220 s boot (a ~190 s title movie that cannot be
   tapped through) − ~25 s startup = **~350 s observation ≈ 193 game-seconds**.