re: the win-the-mission route is not converging; poke the state instead

Two more attempts. Recording three things rather than another flat negative.

The pilot's gun-fire rate is 1.6% (81 of 4986 frames), but that is not the
blocker: the nose gun is Power 15 unguided while the main mount is Power 200
guided, and ~70 missiles went out in ~500s. The log's fire= field tracks only
the gun and invites the wrong conclusion.

SYLPH_KILL_TURRETS=1 was tried to align DEFEND with the objective and is
REFUTED as an improvement: 3387 of 11112 samples (30%) chased targets over
20,000 units away, because turrets are static and spread out, so the pilot
commits to distant ones and defends nothing. Escort still fell to 48.5% and no
additional objective squadron died.

The bounded scan delays freezes but does not remove them -- one run clean to
694s, one frozen at ~682s, against 3-of-3 inside 4 minutes unbounded. So 'the
sweeps were the cause' is too strong; they were a cost.

Six attempts, no phase advance. Names the cheaper experiment: guest memory is
writable, so set the two surviving squadrons' +16 to 4 with gpoke and watch
whether finished goes to 1 and the ordinal steps to 2. That tests the condition
directly, and a null result is equally informative.

docs/re/script-runtime-probe.md

@@ -181,3 +181,47 @@ the `else` branch is the only way to reach phase 2, and it requires
 
 **Still not observed: a phase ADVANCE.** Five attempts. The obstacle is no longer
 the freeze or the instrument — it is keeping the escort alive long enough to win.
+
+## 🔴 2026-08-25 — the "win the mission" route is not converging
+
+Two more attempts, and the honest summary is that flying to a phase *clear* is
+the expensive way to test the prediction.
+
+**The pilot's gun-fire rate is 1.6 %** — 81 fire frames in 4986 samples — but
+that is *not* the blocker it looks like. The nose gun is Power 15 unguided; the
+main mount is Power 200 **guided**, and the pilot fired ~70 missiles in ~500 s.
+The damage is coming from missiles, and `fire=` in the log only tracks the gun.
+Worth writing down because the log invites the wrong conclusion.
+
+**`SYLPH_KILL_TURRETS=1` made things worse, not better.** The idea was to align
+DEFEND with the objective by letting it kill turrets attacking the escort.
+Measured: **3387 of 11112 samples (30 %) chased a target more than 20 000 units
+away** — turrets are static and spread across the map, so the pilot commits to
+distant ones and stops defending anything. The escort still fell to 48.5 %, and
+**no additional objective squadron died**. Refuted as an improvement.
+
+**Both runs ended the same way as before:** `ADN111` destroyed (again — it is
+evidently the one closest to the action), `ADN110` and `ADN112` untouched at
+state 2, no phase advance. **Six attempts now.**
+
+### 🟡 The bounded scan delays freezes but does not remove them
+
+| bounded-scan run | outcome |
+|---|---|
+| 1 | clean to 694 s, ended by the mission's own lose branch |
+| 2 | **froze at ~682 s** |
+
+Against 3-of-3 frozen inside ~4 minutes with the unbounded sweep, that is still a
+large improvement — but "the sweeps were the cause" is too strong. They were *a*
+cost; something else also freezes runs at ~11 minutes.
+
+### The cheaper experiment to run instead
+
+Stop trying to win. The prediction is that `finished` goes to 1 with
+`[phase+300] != 2` when ADN110/111/112 all reach state 4. Guest memory is
+writable (`tools/re-capture/gpoke.py`), so **set the two surviving squadrons'
+`+16` to 4 directly and watch whether the phase ends and the ordinal steps to
+2.** That tests the condition in seconds rather than fighting a mission the
+autopilot is not good enough to win, and a wrong answer is as informative as a
+right one — if nothing happens, the condition is not what the bytecode reading
+says.