c1d01ad36a
Splitting the same comparison at the documented slot-table boundary (save+136): the header holds 34 words and ALL 12 differing words, while the slot table holds 35 words and ZERO differences. The slot region is byte-identical between the two same-state saves, so the documented slot fields are untouched by the churn and a slot-region diff is meaningful where a whole-file diff is not. Also corrects my own framing from the previous commit. The slot region contains 6 words in the pointer value range that do NOT change across runs -- a pointer captured from a moving heap would not sit still, so those are data whose values merely land in 0x70-0x8F / 0xB0-0xBF. The value-range test alone does not identify a pointer; a third of what it flags here is not one. What identifies a pointer is being pointer-shaped AND varying, ideally with a shared constant delta. So '26% of the file is heap addresses' overstates it and the defensible figure is the 8 header words that are both. Left the earlier section in place with the correction after it: a value-range classifier on 32-bit words always has a false-positive rate, and quoting its raw count as a fact about the format is the error.