docs: close the flag hypothesis in the backlog, and name the bit-level follow-on

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE

docs/re/BACKLOG.md

@@ -266,14 +266,19 @@ is what the autopilot needs in order to CHOOSE a target. One run in:
 
 * 🔴 **Not a live class head-count.** Counter 4 against 8 attackers / 7 friendly
   Delta Sabers / 7 turrets / 1 player — no class matches, no pair sums to it.
-* ❔ **11 candidate per-entity flag offsets** on a proper 161-entity sample
-  (2026-08-23, later) — still **never put to the second test**, and two of the
-  groups look wrong on inspection (seven consecutive floats shared by 12 of 32
-  attackers read like a shared AI parameter block; `+0x0238 = 4` is shared by
-  twelve *turrets*).
+* 🔴 **The per-entity flag is REFUTED** (2026-08-23, final): sample A at counter
+  12 over 120 entities gave **2** candidates; the counter went **12 → 11** and
+  **neither survived**. Within ±0x400 of the position triple there is no 4-byte
+  word whose shared-value population tracks the counter. ❔ **Not** ruled out: a
+  single **bit** ORed into a word that also varies (the test needs an exact
+  shared value), anything outside that window, and anything on entities
+  `entities2` cannot see — it types by position *changing*, so stationary
+  objectives are invisible. A bit-level differential is the follow-on.
 * 🔴 **The counter is not "hostiles left" either.** It held at `012` for fifteen
-  minutes of **live** flight while the ADAN population fell 132 → 93. That is
-  also why there is still no verification: no transition to filter on.
+  minutes of live flight while the ADAN population fell 132 → 93.
+* ✅ **But it decrements when the player kills**: `12 → 11` with 411 `fire=1`
+  samples and `YOU KILLED WARPLANES 0003` on the HUD — the first decrement seen,
+  and the first run where the player's guns were part of the experiment.
 * ✅ **`pilot.py` never fires — ROOT CAUSE FIXED** (2026-08-23):
   `flight_probe.Pad` was writing to the **vgamepad FIFO**, dead since the uinput
   pad was replaced by `--hid=file`, so every axis, trigger and button from every