wasm32: E8 proves store bug is emergent (aggregate on 8-bit and 32-bit axes)

tcg/wasm32/tcg-target.c.inc

@@ -3372,11 +3372,12 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo
     tcg_tci_out_qemu_ldst(s, opc, args);
     tcg_wasm_out_qemu_st(s, args, is_64);
     /* ponytail: Store-Containing TBs Run on TCI - Upstream qemu-wasm sets this for every guest store.
-     * Investigation (docs/wasm-inflate-panic.md E3-E7) narrowed it to the restartable-block rewind
-     * machinery around stores, not the store data codegen: both direct and helper store paths corrupt,
-     * a replay-skip precheck does not help, and the crash is deterministic but needs a byte-store TB
-     * and a 32-bit-store TB compiled together (counter-monotonic: adding 16-bit compilation hides it).
-     * Ceiling: store-TBs interpreted (perf cost). Upgrade path: fix restart/register handling. */
+     * Investigation (docs/wasm-inflate-panic.md E1-E8) proved the corruption is emergent, not
+     * localizable: it is deterministic and needs both 8-bit and 32-bit store TBs compiled, yet no
+     * single PC region of either width reproduces it, and it survives disabling TB chaining, pinning
+     * instances, routing stores through the helper, and skipping replayed helpers. Whole-TB gating
+     * (the backend's only knob) cannot dissect it further; the fix needs generated-wasm inspection or
+     * per-op TCI. Ceiling: store-TBs interpreted (perf cost, ~30s book open). */
     wasm_tci_only_tb = true;
 }
 static void tcg_out_deposit_i32(TCGContext *s, TCGOpcode opc, TCGReg dest, TCGReg arg1, TCGReg arg2, int pos, int len)