2c5f653bce
With the launcher repaired the scan could be run the way the method asks: the HUD was confirmed at 004 immediately before AND after the 0.9 s scan, and the filter was taken at a confirmed 012. That leaves 17 candidates from 39596. One of them is 0xbdb49668 - the run-1 address minus exactly 0x10000, at the same page offset 0x9668. Checked rather than admired: of all 39596 words holding 4 at scan time, exactly TWO sit at that page offset, so a survivor landing there by chance is a ~5e-5 event. The reading it suggests is testable - the counter sits at a fixed offset in an allocation whose base moves by whole 64 KB pages. Recorded as amber, not green, and the reason is written down: the later sample that killed 10 of the 17 was taken during the GAME OVER flash, with no HUD on screen, so the seven survivors are unrefuted rather than confirmed. The mission ended because the escorted ACROPOLIS was lost at ~13 min while pilot.py sat in EVADE/RETIRE; REMAINING OB held at 012 for the ten minutes before that, so there was no transition to verify against. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE