Card L-D1 (DIAGNOSTIC ONLY: debugger-forced, never a candidate) - written 2026-09-26 17:03:03 -0700 (clock-read) BEFORE running
Function: _widget_instance_render_recursive, source = scratch rr2.c (HEAD + RF-E RR2 patch), unchanged.
Question (perturbation test of the decoded rule): is the builder's input-1 -> base assignment the SOLE cause of the
remaining difference? Intervention: in C2's address builder swap test 0x1071c9ff, at 0x1071ca34 (`cmp ecx,0x285`,
ECX = opcode of the next node referencing the ADD result = 0x25e ARG in ours) FORCE ECX := 0x261 on hit 1 of the
window (k-1,k) (hit 1 = the loop fold, per k1trace FOUND #1). The rotation 0x1071ca44 then makes base <- SR IV temp,
index <- address temp. No other decision is touched.
Prediction: +0x78 becomes `mov dx, word ptr [ecx + eax]` and the whole section becomes byte-identical to January
(section_infos_equal) - 75%. Register allocation keeps eax = address, ecx = IV (separate webs). 15%: the swap
also changes allocation (other bytes move). 10%: hit 1 is not the loop fold (no change / other fold changes).
Decisive: alndiff of the forced object vs January; per-function comparison of all other functions (unchanged).

OUTCOME (appended 2026-09-26 17:03:53 -0700): PREDICTION HELD. The forced run (work/fd1_rr2; hit 1 = the loop fold:
ECX was 0x25e ARG, forced 0x261) emits +0x78 `mov dx, word ptr [ecx + eax]` and _widget_instance_render_recursive is
section_infos_equal to January (752 B). Of all 103 functions only render_recursive differs from the stock replay.
The remaining alndiff hunks (+0x179/+0x185/+0x18d/+0x1a1) are the literal-relocation spelling present in every EXACT
function (gate treats them equal). => the builder's base/index assignment for the loop fold is the SOLE remaining
difference; January reached base = SR IV by the swap OR by sorting the IV temp first (both produce this entry).
