6e081c5437
The section I added last iteration claimed to be testing an untested 🟡 and concluded "the address is run-dependent, always re-derive". Both halves were wrong, and the evidence was already further down the SAME file: - cross-run stability was not untested -- the body records 0xbdb59668 carrying the counter in 3 of 5 measured runs and reading a hard 0 in the other two. The stale claim was in the status line at the top, which I took at face value. - "always re-derive" is worse advice than the rule the file already gives: try 0xbdb59668 first, check it against the HUD, re-scan only when it reads 0. What my run genuinely adds is a SIXTH data point with a new failure mode: the address read neither the counter nor 0 but 95748078, constant over four samples. Status line rewritten to match the body (🟡 recurs but not universal), so the document no longer contradicts itself.