ac17398515
With the per-entity searches refuted at word and bit level, the question became which object owns the counter. Sampling +-0x200 around it across a 4->8 transition: the control interval moved 0 of 256 words, and the step moved nine - the counter plus four words holding ASCII '4' -> '8' NUL-padded, and four pointers into 0xbcad2xxx that swap with them. Read live at HUD 008, all four character slots hold '8'. So the neighbourhood is the HUD's rendered text for this counter, which reframes the address: it is the HUD widget's value rather than "the mission's own objective counter" as this file called it. Recorded against that, because it is already measured: there is no separate mission-side copy moving on the same step. ob_hunt scans all of guest memory and requires a match across two transitions, and it left exactly one address. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE