20 challenges, 10 trials each, same process for observe+exploit.
Easy (full leak): 100% vs 100% (no advantage).
Medium (partial/no leak): 83% vs 40% (+43%).
Hard (no leak, noise): 67% vs 0% (+67%).
heaptrm provides decisive advantage when binary lacks address leaks.
Benchmark results: observe-once fails (stale addresses across processes)
Correct architecture is observe+act in same session via heaptrm JSON protocol.
LLM benchmark scaffolding ready for API-backed runs.
Key finding: observation must happen in same process as exploitation.
