DearQA: shape the heap state, gain the needed write or leak, and pivot to flag access.