=== v1 baseline run.log: 30/30 oracle hits (th_sum=0x1111) ===
[sanity]   cstate th_sum = 0xC75D == 0xC75D OK  (mirror verified)
[oracle] round  1: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  2: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  3: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
[oracle] round  4: th_sum = 0x1111  <== OOB bytes leaked into kernel cstate
... (30 total)

=== v1 run.2.log: 30/30 oracle hits ===
[oracle] 30/30 rounds leaked non-zero stale bytes via th_sum

=== earlier diagnostic runs (cross-packet field leakage) ===
diag10 round 3: cstate urp=0x0033 win=0x1145 — bytes 0x33/0x34 are the TCP seq-field bytes
  of the previous sync packet, read from beyond the 4-byte probe frame.
diag11 2-byte probes: th_sum=0x6572, 0x7995 in 2 of 6 rounds — foreign kernel residue

=== v1 fix_run.log (patched slcompress.c): 0/30 oracle hits, legal frames OK ===
[sanity] after legal 19-byte frame with checksum 0xC75D:
[sanity]   cstate th_sum = 0xC75D == 0xC75D OK  (mirror verified)
[oracle] 0/30 rounds leaked non-zero stale bytes via th_sum