Forty-eight bits mark the edge.

A reproducible offline harness generated known states, emitted partial observations and attempted complete recovery over grids of bits per call and observation count. The central finding was a sharp transition near forty-eight realized leaked bits, the size of the hidden state.

Leak shape did not materially move that information boundary in the tested models. It changed the computational and observational price of reaching it: residue recovery required low-bit slicing, while bit-length leakage required more observations and a feasibility gate.

The model implements java.util.Random as its 48-bit truncated linear congruential generator and validates forward and reverse stepping. The published Randar three-nextFloat vector anchors the round-off recovery path, and an optional OpenJDK oracle checks the model against the actual runtime.

Each phase-grid cell used deterministic seeded trials with known ground truth. Complete solvers returned every consistent state or disclosed a cell as ambiguous, underdetermined or infeasible. This prevents a convenient candidate from being mistaken for unique recovery.

Below forty-eight realized bits the state is underdetermined. Well above the boundary, tested cells recover uniquely. At the edge, the honest result is commonly a small candidate set rather than one state; odd-bound cells near forty-eight bits recovered uniquely in 67 to 88 of 200 trials and retained roughly 1.8 to 2.2 consistent states on average.

The top-bit grid follows the same transition. The result supports an information-bound interpretation: the product of useful bits and observations governs uniqueness more strongly than the arrangement of those bits.

For nextInt with an odd bound, recovery enumerates 2^17 low-bit slices and solves the remaining truncated-LCG box problem with certified bounds. Tested edge cells took roughly 10 to 35 milliseconds per trial before branching costs near three seconds in the harder region.

For bit-length leakage, every scored overdetermined trial recovered uniquely, but many trials could not supply forty-eight useful bits. At a two-bit-per-call extreme, feasibility rose from roughly 6% at 24 observations to 50% at 32, 98% at 48 and 99.5% at 64.

Noise forms a third axis. At the forty-eight-bit edge, one unit of bounded measurement error increased the candidate count from about 1.5 to about 27. A cell with ninety-six realized bits remained uniquely recoverable at noise twelve, showing that overdetermination buys tolerance.

MT19937 supplied a contrast victim. Exact full-output cloning needs a much larger consecutive observation set, while a separate GF(2) path recovered state from truncated random() and getrandbits outputs. The comparison concerns generator structure, not a claim that every use is exploitable.

The lab also demonstrates constructor-seed recovery, RandomStringUtils recovery through character-filter rejections and independently verifiable recovery artifacts. Those artifacts carry a content hash, prediction checks and an explicit claim boundary.

RepoAuditor uses the research as independent support for a weak-RNG review candidate. It does not import or execute the lab, and a syntactic match still does not prove that outputs cross a trust boundary or that an attacker can observe enough of them.

For the tested java.util.Random leak models, total realized information determines the unique-recovery edge, while leak structure determines the work and observations needed to approach it. Ambiguity and noise should therefore be reported as part of the result rather than hidden behind a successful candidate.

The experiments characterize generators instantiated inside a closed harness. Applying the result to a real system requires separate evidence about generator identity, observation access, call ordering and security impact.