From e3098f73161de3092aa929869bb37c2d28671e4c Mon Sep 17 00:00:00 2001 From: Sylpheed RE agent Date: Thu, 27 Aug 2026 00:23:22 +0000 Subject: [PATCH] re: LOCATE REMAINING OB at 0xbdb69668, and refine the ...9668 pattern Ran this file's own transition filter on a guarded Stage 02 run (stage asserted), reading the HUD from a crop taken at the same instant as each memory sample: scan at HUD 004 -> 41537 candidates; filter at HUD 008 -> 8; verify across the 008 -> 012 transition, which was NOT selected on -> exactly ONE survivor. That survivor, 0xbdb69668, tracked 4 -> 8 -> 12 against the HUD's 004 -> 008 -> 012. The other seven collapsed into noise at the first unselected transition, which is precisely what that rule exists to catch. The file's "try 0xbdb59668 first, re-scan when it reads 0" rule worked verbatim: it read a hard 0 here, and the re-scan cost about the predicted five minutes. The ...9668 page-offset pattern is REFINED, not reinstated: the three located addresses (0xbdb49668, 0xbdb59668, 0xbdb69668) are three ADJACENT 64 KB pages at one offset, and in this run exactly one of 8192 probed pages held 12 -- the counter -- making it a one-step lookup. But the 2026-08-26 refutation stands as measured (zero ...9668 VAs held the HUD value in that run), so this is a fast heuristic to be HUD-checked, not a law. --- docs/re/captures/ob-012-located.png | Bin 0 -> 12211 bytes .../structures/mission-objective-counter.md | 43 ++++++++++++++++++ 2 files changed, 43 insertions(+) create mode 100644 docs/re/captures/ob-012-located.png diff --git a/docs/re/captures/ob-012-located.png b/docs/re/captures/ob-012-located.png new file mode 100644 index 0000000000000000000000000000000000000000..525839fb854953884ad8093ebf30ccb6de6e3254 GIT binary patch literal 12211 zcmV;kFHF#hP)004R> z004l5008;`004mK004C`008P>0026e000+ooVrmw00006VoOIv0RI600RN!9r;`8x z00(qQO+^Rl2pa$vC7b_fivR#GDM>^@RCwCGeR<4e*;U^;=ic{f{i?qD_TFZCrf2Ed zY-7d{GmP!n7zL0F!InZC$rgXa7DSN~!lsDGM1YVGAt8YTC9zN>6oMlDzyhLRlLUJP zY|q%^8PC$w(>*=i)BW|=-&%Xsd+*+R^2dGe)qP9V_q8E;>ZR({eRnzc+_U`7x%Z(I z5(<|fQL8kxiKgKcm^rzR0DuVK-aF<>A1OYAW#t740MJGk>%kK=jrK1C#Q&7HvZ#i* zv+)NgwidS$_vG06Iq5kt5Fr2erFv_vv(agFJg+jDj!eP<2tY(JaZh%Y z(tH7F5Ydy~>hfBn)=)~BEMFeG2r#L|t={d!NxF`Rgfx4=tt|O0h4iH#uMNaZnZno* zfRKa`_A3E0Fej|0A*J z0z_IbW{!+-K?FytEs%4FSg+JqI_oQ|%f|3DoCZ-)9N_}8aw5BO-8eZ@5~3iIBn_KT ztGKG%!a``&ny1g))9oJKzH=-7B^gk@{&?z8AR>|0MuACxlq3N_8BKr&**3sQQ@)g) zwa)sf)ziJx+xt6~jmyY**LX1>JPVXZ~K+X`qpL`hT52FwF<+2 zZe+=t;AC3M$&9n&WhBa$lZYTl5RqXvS~I|4)T3SSz3Nf_FjRrdJ;oSwLVX?g7X=As zPPH%s5D5S zN@iWDR^onV2W_=a{DlDk446O}r!htVfubViQoR9yJKckX2mrAVLV@D&;PBbMc;@={ z4bJq@844dSCNoCYoC2Np^7{H(zuVKmzF&!|kv8V&=;(#7eVqhW{px=Ah!70}LOgG2 zXAntPjzloVa9(g`dT~r=8Bhu-h>(blG0Z7>rI5g&jDq7XE5mt?nJ9!{j_tx$v)QOM zwK0?Fcr+g79zaAy1ZE*T0Ekq07yLB8*xkwyL4=6fm~t}_5di9y+ETMM9Q8-ji97CM zL!3U7xnb>8Y*ebiJPM|Ho-R-rvYd|#nv4~6Y#X?x$}J^8A!wz&ytcY}czC#bc(B@8 zky0ES9EMuun@fk_R3M1#>eXguXqJ%;+e>X=?hSggS_=XWOFf&DT!=^jh{(*o?*qUj z2y(Q``39|Kb8Bm>*X2RVNouv6AOkJ^Bj3N=bj(|kaEe~vQ}L)^K!EZ0KMS|5hW1-BpjLAi|(`{Sl^~Z z0+cj`01rO&SgYL;LiBq_ufP5>0C2W%_PT3!Bt#;?%!nWn8Nje1#LcxerPS`>K@dfd zQCV?^+Domab~^~dFbwTTgb-GDTO|d+44gW-^;)gbXl!h5NGaaFd5eflGJw?Nl|nGH z*7|S2n1ZAWCz|n@ZB%rB3y-k1wVdM2oN)}&N_a*(Mz=;lEB2DlSso~KQIM#5zS3Hm znW`xrNa`_nhokgHq;>3n3yvtJ%8n(Btc;&)#_RvL24kow{f5aQFJnYrV<9oshehk%kQcF*5^$ zF+gCEs=;_fglr0Cfg>y*6ynp3x;FZEhNCM+L+S?GtwB+U;DoGZkmWqyYwi zP^)hbkH002y0gCuijSH-+Z%C>A5t|x>xS{Ig$ zg)oibkR#?3zzHYRRjx929&A*rlEgTe8pE1RilU^x6dzYBqQi@2gJ1Z|@gs9SXRyKe zv+ZVz>t(5dWmVZPK@>*a{Z75Ti@S%t!(P7^Dx^~m`j;}w-6?PX(NU@%9c z?!o8?bNGJp+_&M`5CCY7oeWP(-}4b5jKWe25*#kcQJZIVA^Fu-6?8c?5Hmc(L1Pmw!EsOg7*2DYSN?bcGH)aYO=V%NJI&d7h|Sn4C9AkxOv ztMyK6c{CagIV6 z6(BTVU}RXNkD29_H^kMez^n%&ZH!^IBZA_>F9LlGV2r%rO-l$k;Dw3E=gW&3d(d>8;o9 z)-O)0oArtl-cLIjgW^sRcc{6>67?SY>O2$pITksFBXiFX;;Hq`t*ukLckYa*V?;!v z{%{lqQvfh!Ao&6#CJu-&E3E|y-}hsX9Dsqhe&7c$KK(v=;RQH6q{$Sb2u$9mwgD_4 z0wJhcrQO~0XV11j`!8Smm0xD13QRe-CsqjI!2#ac1!iis%M0b~_?cQm0LIanCKJ4K zhoY$XECHEBu^8KD&lB}pZDaG@|M(yM)vx?&v~$~$BZ=Pz48Tg8P^rYvwTpz4qU@TK z>F6{Y!F=uZn~~PVb+kZnrIr0GI{=1VNg~GP86M5U}c3m^p~@(U%+v7=VqwwY$Bue@7c_ zrQ^k?-zP3z!u>sn6c9qi2NIb86(S1(LKv+{DVPQr?$LD8x$nY-pZJM4{@uSV;>nAr zq4cK`2{0o@78Y#Ox!HsuFe=ZHNW>Q2G7QY1G)Ex?0rUqHgc9)`|Ku~z|J=_BqBCn- zYn@d@+&etDxqmweHe}`^hrbj-P-~(otr(abA{RmaGJ?1&m$S|dxVE4Be=bUtGgAu5 zIjPm0evT7R06_lzO7-`Hsjc@ZDL>k%|KVu-OcZ^l(KzpUKhx{^0RMcc1pxngI6Pzy zqA-ZUUv9OS`CknB0Prp$K3cCgDAVkJ8V+AK>`6}wfdEs7DP7XIbTQ0ED*zzrUHsvX z(Ce4sU>}%qX~{I3+-N|x0#2q9lVIORPlD2>-^YUk=yq{1q?>P_dE)V#7ap8my)sWs zB9d#yG+qT3_uv z{dD)4XS6m!6m9QrcSku`Bx9S+qJm|iI0hi1v!~7~rSI(Cwz8uvTC?a%0eO?Gfl^`Y zqP)wErK8b+VmI8(t2hS#9h}IO#PU7W>er*_^2|QN+~}V2{H72H@QHf;-;9O;Gbo!G zRtZ1RY!rve0QG9MQL8Jha%-fh%CkJmtMC0Dzc&!wZpHKDN+(!dyFHz5zxpamnahQX z27`kye;EKaKm6f`-u<0bL_9de!2ovdY(DipZ(Vr<5KCqv&Ns7mSvu1txYeThN;;i3 z@aix9l6JvSH=xRS_N;7fz5C-IZz0g`9!^GhaJcr)cN{+Rl*!zgb^j|4)+$m4&H_!04B(j8_Jb$H_rCY(TCM*24pG=h=_ZC{^!Ft zuf6x9Kgy%Ahyof7&pz?QwX(#R*a=}n1+N9D_aC%AfXvU5iE$onz5S7-_^ARza zOoS916Uveb1QGx!tqeoK1}I)=V+V$f*2dBY(`Afkr$CaZ)T$RAdAPN@}OY?2QE0Ltr8^r-KPAkg!tKp?&th41w%@0Rk5S);Iq z2mm*h_uah^g2K9QaUW3C41fdTg z8ciOLi*4CJVJ^oLk>Y&h@|5JP_2f`DSHh;!Ad=ELQch-C;kSQ2Bfq zeyq{>TT(s~MHy?o!%lMs z%0@~?5hIN*uoYL0m|5KmaT^3+Fu+PHLK==o1~O8LV`GcMC?c)2HgF7Do*;zGQH(S* z&(;+?1wga8{Ko4$w{A(_BP4;Sne&}X9w5Y}di|)|d+wXxY`0oMiWD0H0QpQ5e!x^e zP^&%@IcgWdN(_5P8xFPkU*pL~8}+9=@7W@{ksZm$tF`#ZPq+|XJffYSPK*vE2m&FEljIOq=!2ZK->Ux=JWB?SC>7;Z}M z;bbF-T?aGh$c_i#D=Hcpe$w|#;$m4^#(qy30?Nm%bc??kHU^oQFt=&ODOW;J%X|r9 z%$UNPd3u*u$jrv^@SL$7C!ewtAI8c$euU<*(lMS>T$>HEr}*-GyT_rdVN=A08GvKU zbZ&N&FXT$Ib>ZB(d$&%z_a%u|wchZn7Ud&A&-0KWn2fAhlB5a7HK&aeTDca>`*cTA zsCA$;GY3iq*3M4MB?5#mhoLs+N#BFm4+X=l;wl>@z3+jIRtEqCkt9Mw zi)kZ*VjYFyXxtwZGIw&^zR_9P=&U+p1q3kQqz|T4x4e!Z0dPv<1*P6ot?i9Q2p|xP zb{hj!q`gy+v+7>|Z` z_I64O%%i@Qc{z?`fO@5h0OMd<7-DJVIp7gpI%4u`X%-U9)=X&wj4HAil#Qj9w4EOi z&#TL!mlZ2$OgUf97x?_>qmP_Bb4FJDrRDbX&wc%1*heB|v^F|PT8QDGn>*Lt{kr+C zC;5fr>9}62H!GEK7+Cm+IZod!j?n;+jUv`6)t9vX4$u2wy+)YvY8@Sqk=EPH*CX|w zN+q?RCJX>@kD$w1+XQ-F$S0QCK5ITs(b;`u1h9Y|Z9J`3uK}>%^~198&x7agTU%MV z{N~j}^dq>`%8q@#)!EqCB%-%(z1<%VOVwA=Q7Z&!z?X7!V{>g|{pR)S2S-Px6Tgrf zxU#;EgCQsdLa-1fv6^P_j{>Y-ZB2CF@=S@Mt{xCcqDQazjW; z#D1>RI?jy6zX&Fu@FXyY%m8pnD**Vxdi@9Mah;wJ68XwBP{5eS+cR{rAbTO1C&Lkh zC`b@O6oxrd-S%*^v)bt_$MMrxS(ghnCIwSxoL}ztX zMQSh{7J*d&HUJCOWcAeP$3F5AIy}TEVkx;^@87;{rymhLDFum8g^||f&$}VLEHLE> z&y!xO*%Bo7kM=A_E>PBKY$j0AcshOIr5A_6)TX2mAtJJYL^eC{YZ;-OKE+pmJb^4; zfJtmY5ZMeHWwWt)7T1o8{^5B1>E_a2q`na;gc&TCdO-GiAyV%SrjPmlm!?xhJYe{p z!SJKC+PV;ojDV3bFO5dOKOWDE%O%GlEV@!3)-XpZdhOC{TI_PU3WQY*`yD9HkJ zps$i@`{QB%`p}X$zp`^gcQLnIPC24LI@sM+Nyq^baSjXyO!d^6wWprC??WG?$pmvr zddv`n*ze=s9vvNlG09pF-#!{=*+S%FJ>+T}pg1K`2mnwyeN|>;%r! z5;EC!1+Q!KPkUX6?GX6Q(a3h-3sLliUe{TP__@gh#uFO^V1Ua;|EeP=oLR-32#TG6 zg&3XtF|~QMR`beg=EFhnXwb{%t}fEW2{=}CM&o>|)Eh!Kh?npt0y6V(IvGu;kVQpn zUPTITJ2~i?yC#6H$dW8_im~ABKCc5 zwe_j3;Ov(*{bzHyRjq+6eYNV7+)U8!&E6c0HQGYNR z<}ySDApitX1k7pjV_HHRb9(Faa5%iPzn7z}#maf+(_n4}lO+vFBr4PY)DRFt)IDz+ zhN0Gk3=A@jk0KI4NxsHB-|nOUoim0-kCa+|v9vlVm(BQcep5K_Yi!%b@ZTI~i*rx7 z7Lq6A=^y>!t>t#*$~AR#6ow&GtL%A3O3dPAj0m1*8Vz1wJJ9--U;DN2&W@aw;UEf9 z)3sFR7M%atC57;WeBi-Hq>yjC{^~fK7&g^f4G?<6JXoWR(P3mqYYjUggw{GtvP=Dn z|J1vm4uar~*Dk$v<9e82hgKRPf{FVOBhZ+bK1nI@*`*R&lXvm=l45P!@_#)FG`5c zcf9lH8{d#SJJV>&%N@P8#w#6DtzzOw$Bz?nwYqoh+U+lVVeiXdLO@AGae8c~k%b;f z`RbBFKK}SS9(nwoVHh+Tm9KpDuc9d2-@jvw5k&5xa~Pu>acs~qZ>?^$+sij^y-gSd zDnbA@EJ)UC(yvzSejOnMA?Eh(BosoY@A(y*qZ3Vv2kcn}iOFY-aiaUV9LCl_&O7-F+PqbQ{ufOnBNkVCT z>5VsrgTa|or+SA+zL4!^TN~XU4GGDxf#ht2q(U};l#9bUc_V4J1)wLy{^7xLyIrf+ zZrr@l9mnSv$fu-yf3>uzBwJuYK+LueBR(066R) z&Z)#PjjgCa=y!Wpue^SEbl`|2xVf{ly}Lt52x!kB(MD%-_R=jsmhS0(uvEe%M{~J+ z85tdF{qp5Yx$emy-`E_E$IJ!*LZ#gV!N>f{V}9iajQQ2UV3dN3C!k7$@MDd}lacz( z(a7DOrXBH^%DvddO)u9aE{RrVM9Daqj)SSzI*v!jY+q`8riRVj5eQF8DG?!zRHQNy`gOS7XySUqLL}M-W@p>#|)BRF!e@jV~o;jbhtMjjhw8DJhG9v6zGa& zuU3W01dL%pT=Apf@c4uDzWoa!0f|dDSQ<7)&-GIacZ%jri9@T6k!gGx5tvIin8zJR zYC$Ki<2q!iTb7*t7gt1kT0N^GqBu2U_6OmQrj`r&ao;bF#@e0Irnx%TEn}Vw0=Ha& zSbU616@)_YqUoGHZVabch?rneh{!W2u?#A8zFVPc-C<*lJ+LbXg3#T-HA|X_t7L$D z2943EbxdA5xkNkBm8(t=p4~XrX|{do`$7_?2}U{BJol%BfSCbi9?r(?*o0b*!l_|{ zsWx(_uH;O=Jn&&=kVY&x4djY|G_h-w?;++zI}%_P>P>2LFjco2K_n4N1Br88BL)B% z_4-RvAPHkMC=G~G2t+g{JsA~CJ8dEbS_3m9fe>miDA<1`S+;@%APQ;ESv4swQ^>7M z!vQ$1aYj@+6#sv8NfMs)?m2tDRxl@O|)l){0ll35)O22iboCrK$BkA&}Ut*zdF@3~H^nMZ0Mv;G^+ z2HLH<(gV*oHj;@Y17YWjVFr6R?8%v^C=Q(JNqAD+<%#Wg(K0fF*6Q}ot?78uZZB_b zZY{NzDwv{mtcTLack0rFx_4`7v^k3HZc|)~2n`p>urq zF3z;b>Do^=o1aXZO<3RM+CS(IUIt^2FSBKgF+bl}dIP7wH=ZycFi0YY72WB0{b?T|LM|I9P+;qQZ;9o|2H-TjB3eDcoC5G3M&8E3PA?&Imq#$oCCtITqb&AxNp9H3F012=&-z^Td|B+3b$@ssF%bYjkod3T(F8LIPby+CgOA$(Bw#R-#e_HMbD!9o?xK!{O< zd;8z>BR|5cE2dVn0h>iaiO8(14kzPp{Nzs-^Na1}9$}Xb#~#~~J#rke@N9Ayt@~=q z&RPbviEuGYlcNu3mNFs$5vC?1GZ-+4n7$Y#>0&ai7~7Nvm{14=PQn?^I$;1nfig!a zn?jqNvO-7*002CqrHUU!5t~3eEAJ+oSEBI!q6!Fg%sp6QTa{Qnh}VDb_f|jq*`?E` z<<4yykIZG(phG3Q#%mb%e~lt$ebQ2@JpEJYfiE)FxUK?uFIi5u&RjgOglW7_A7LVT*({Hb0q z>q}?YFT3#A0cPW~w9WkEgDDlzg(OtY&kDiJBINK&Ykc8+35xUdAdX26Q)OA_br zz4x)lp167At*^iEJkIvDK}C8?wT9#@z0+4_EY>#Kn5j~ODAXoR7N6C!=KB>X18Yka zk!ptcl#}F7F_O+v^sV3e?RWp|&ot^a+TVw6Pme~R6=;KQHgO!qLi8k5E8J?EGiMKd zdF5aIde*__*%@MmWpP5ingcU!VuUg#W|{=DU^Yf8(12kGFvyKQ<#^w(RI8ORQq$># z1%VJ)s}=YFEgM;Ogv{cxQ=Y=iZa1CH-V6+ekd|t-!DNhx<(nfhZj6~t;Y@+-N{)YA zYA#1AnoLKaO!j%C`Jm6&UAYyZANv;bK zZ+JxzB&3kqXl*nb{*gFZh_6IpPDJ=p2%<1h*)TT)z@t*WL&``S1lUiJLIeWT%%7<@ zt||5TATa6rEuDYFaOd`OpZ)CppZw&RM<0bdyU^>wbb?A}&tzo)1R;#?W2b|sPu;qH z{qnE>Hfu#hZnjuDbMYRO%!$QGnYC5Z+YmzH#yY$*mo*8gQLDFFOQYeSKN<-Vf+$qV zowqNI4d8+7^S&crtlSFh{XOI@&wBV>cO^nf)3U z_oXL=R9Z0`Z44zES`cZ&H?F<4y0XH+FTeb)?Sp-Rv%Q*;R&Tz2T>`+z8jX+Hh3k3E zMne#d#^Xs4zguZ!%%6uLLb@Fe0GNn=yxsbHK~##nS@YtpD7>t7YP^yZrwQ+?_-jIZ zJ_xKWlAO%x&UdoW7*P)gmw)TGt~Q#hPk-;)#f$5YJ&Iuj#)#zYg3LffMv8#>tuKDD z_uu|teDj7N^gKV(=@AT;sOj3kIK?SV+)HVG@uFB=m7X*!EAYSnPdPs#A`vqWhXbuO z0IqjdHr6+fx?Sm4q6aRBwN;q+Zh$z`1Qc-O`Lf~%lZi2g5zWdfOvaF^NCZSsh94sO z@oF_+4*&x!HZFH}Dc=^)n!{Ol0{vE{F z?zFpYtOCIgRI2v~@t$fG5j`OqjfRwRG9FKY;HByGwJ3VlrWPkHf5i9SU#$uu1Y)GL zDdWg}ZT@09eI|-r{n%+O)#}wxM(Wk!=#PQ`?VEWBwVv%njGgY{UgOy&V9To{gkUyW zYs+AE9ZKO50x~0!N_L{<7k&C(h+GrEQc9akq_xpnBLmHW6a|virxoelckcZ8`|k&& z*Is+&%G+<1EYY&yB_RfgXb@tJ$J6%YG1i}^~G0TOxu$}7-LMV3bVi^ zq9F2wXU{xIPdatWU6kU}jV3rU3;=$**LSC6saD@Qb$WkycN$J7VVEaeQmiT^B2A;H z2%nU$IM=^U@Su`k7Z68EY3${+XqTEvgaX7z9y7&8UEG`yL{2z6&faz37hCLZTx0Sn zjcbGRAtf&%lHHGkIGIewlZnj$z#Q&>mshh|TWv1~L3r5jj)GATg(k`VcB7g}hvR>< z9GO3KiUB5*>3BR2!mw1ny5EElzVr;6e!n*zk9T)>Z|`i|P`Ds*YIWDGHB{_(S*-4a?-z0$J)9jbov8^Sc0bvGR+DM`rZ6I8 zRK}d7l`;wg0PO7T?(FSGS}}u;+yDtCdw(*A3Ojp979oS$Xl-VYN2Y1SieCYMAPfM& z?yF}8rPZz79h-lUMs$ra#%P8(3#3eMgOd~hXI9tOS68-ob_npSG5@epFYRTDtfU%9 zu_@QJP9w%$` zq0;<@Vvquyr2y_xpV_Ix#r)!2nzc?2{m6ACk^`dt9A;A@fPrTmkt*A;iYo zx)fp@OjAk1_VhoDhf0VH#uLI5et&Q@4ySH~f<)D;5TYxC5nwPGv(gB-83vzjG#x#Y z{0D%5e-;ET2JxEAGAXNL?S`< zJ&O6hWhF+j`v}l%G}`Uuiti0al_P;l>FhJPNC3caA0$G%J)2AWLLDKEF+vrAP||%oylJucdg!XIISKNe6`3 zX|6DEZ`fln=n2`V)f>%56h*_~aDh30l8c>4M1GXn(WjR$#QN%br_eQycm`9Jj` z%MT@IfYsJoXL(f!xxas>Kki0a2|*O8Xfz&Ar&IH7*>>(_k@M1nJm)ch5MpJyv)ow@ zf}lSbc%HY^Xd;5r+WJprX3{ZB}=SC z%zZEEwzchqgJnX2A@iJx?kCrL#9||unBzK98(Uji>%mb^E0rK_i)Lh@k%!9Y@wgub z({V7-M&q~f?pS*XLPFGrvw#yWHJ6%=B^8+<>gHp8iAj-yk@iwrcZYo#4J>-4wK2wo zW%x@#Cj!Hi9mML+kn=fP zSIQbidxHT5dPIPrw9#cvBxVahS(cF7)7i=?Bk|7u?q7cSOHz6}dpjyVk~p@kVol-< zw(eJ}wfcB69tV>-Ql1eYh(dP*$+sgT5y6*I3ev_fgNX4?Fvj@OL&W}YP(a8K0E7@V zzv7-2$+3?!~G9HZwqd}=fTk-sQr7nfkCtxqO*b^iv;&b@`l8ojt`LY{t0A zw}}qIlpgMrxL^PP!|`Y^8i12DkeVzGs18K5y0*Ttb&3$incAjPKxnR>0!Ug|J&dM2vdS8dFAGD+EyFyk;V8!0^o z2vt}nESwY5}m9FJ_f zQV1!?xbIVqM?^#713^@b)bT|?3kfwhT#l@$s`@-$2f->u=ESUT;54!p(BYg zo?l5K1~w59v9;7%YPG{KoQ_AHbugHZwO)iEF{?RYL>r4S^G#A4BUgHMAZ1J|dth!7 zs0NGA=7OYmL>Fm8Ir#v)&qvl2alOx7Ih$p1UUqrf*!knr0aJLR5SYm~AY; z)w-5-Qn?!|bYrrPxg)-cI=DpRmK=JTb$jN@mz?}fxgn)!#w1N{yVZ4;mL7TVLakOi zIO^I$3=oCE{@(7O-;*RfL6pe8#T%N?6Ejm17n*2NNB~g!MDS46696!cGyqgRDTJ5= zQM!#GUCq`g6oRUr7ep#lCAzq%P2CC0O+#sj{KPm90Dx5*IRx8YE3M^Ir_Oe}-J@RD z7(ERqsh+bNudK||iR3GG@3@}KKLcbQiiYLC!^|q>#b?V90zhnF#L+*Cc9D=$D5aFv zd3BT_E^e)?bUMpROU=W>?v?A;U9#J%2*8)p09fU@IC`An$OV@a(wEXOM@ngP7u%ZZ z6|Y&XXv3o*n1l*4xWEj ## ✅ 2026-08-27 — the counter LOCATED again, at `0xbdb69668`, and the `…9668` pattern is *refined* +> +> A sixth located run, by this file's own transition filter, on a guarded Stage 02 +> run (stage asserted). Every step's HUD value was read from a crop taken at the +> same instant as the memory sample. +> +> | step | HUD | candidates | +> |---|---|---| +> | scan | `004` | 41 537 | +> | filter | `008` | **8** | +> | verify (not selected on) | `008 → 012` | **1** | +> +> The single survivor is **`0xbdb69668`**, which tracked `4 → 8 → 12` against the +> HUD's `004 → 008 → 012` ([capture](../captures/ob-012-located.png)). The other +> seven collapsed into noise (`1040511`, `3211282537`, …) at the first transition +> they were not selected on — which is exactly why that rule is in this file. +> +> ### ✅ The "try it first, re-scan when it reads 0" rule worked verbatim +> +> `0xbdb59668` read a **hard 0** here — the documented failure mode, not garbage — +> so the re-scan was the right move and cost the five minutes the file predicts. +> +> ### 🟡 The `…9668` page offset: a fast HEURISTIC, not a law +> +> The three located addresses are **three adjacent 64 KB pages at one offset**: +> +> | run | address | +> |---|---| +> | run 1 | `0xbdb5``9668` | +> | run 2 | `0xbdb4``9668` | +> | this run | `0xbdb6``9668` | +> +> And in this run the offset probe is *decisive on its own*: of 8192 pages, exactly +> **one** VA at offset `0x9668` held `12`, and it was the counter. That is a +> one-step lookup where the full scan costs five minutes. +> +> ⚠️ This **refines rather than reverses** the refutation immediately below. That +> refutation stands as measured: in that run, zero `…9668` VAs held the HUD value. +> So the pattern recurs but is not universal — the same shape as the address +> itself. **Practical order:** try `0xbdb59668`; if it is 0 or garbage, probe the +> `…9668` pages (seconds); only then run the full scan. Check every candidate +> against the HUD before believing it. + > ## ❌ REFUTED 2026-08-26 — the page-offset `…9668` prediction does not hold > > The reading below — *"the counter lives at a fixed offset inside an allocation