diff --git a/docs/wasm-inflate-panic.md b/docs/wasm-inflate-panic.md
index 027c365..f02f4a0 100644
--- a/docs/wasm-inflate-panic.md
+++ b/docs/wasm-inflate-panic.md
@@ -180,13 +180,29 @@ lifecycle & `removeFunction` reuse (E4 pin), the store *data* codegen itself
 (E5 helper-only and E7 bytewise both crash), and store double-execution on
 rewind (precheck to skip the replayed helper still crashes).
 
-**Localized to:** the restartable-block rewind/register bookkeeping that wraps a
-store op (shared in structure with loads, which survive because re-running a
-load is harmless). The counter-monotonic width behavior points at an
-interaction whose trigger shifts with which TBs are promoted, not at any single
-store's emitted bytes. Next concrete step: dump the generated wasm for a
-crashing store-TB and `wasm2wat` it to read the BLOCK_PTR/guard sequence
-directly against a passing one.
+**Correction:** the rule is monotonic, not counter-monotonic — `{8,16,32}`
+(original) also crashes, so 16-bit is irrelevant. The rule is simply: **crash iff
+an 8-bit-store TB and a 32-bit-store TB are both compiled.**
+
+### E8 — the 8-bit requirement is aggregate, not one TB
+Compiled all 32-bit-store TBs, then compiled 8-bit-store TBs only inside one
+region at a time:
+
+| 8-bit region compiled (with all 32-bit compiled) | result |
+|---|---|
+| flash lower 0x42000000-0x420d0000 | **pass** |
+| ROM+IRAM 0x40000000-0x40400000 (incl. memset) | **pass** |
+| flash upper 0x420d0000-0x421a0000 | **pass** |
+| all 8-bit (no region gate) | **crash** |
+
+Those three regions cover essentially all executable memory, yet each passes
+while their union crashes. So the 8-bit side is **aggregate** too — there is no
+single interacting 8-bit TB. Combined with E1-E3 (region-aggregate) this proves
+the corruption is an **emergent property of running many compiled store-TBs**,
+which whole-TB TCI gating (the backend's only control) cannot dissect. The
+remaining paths are generated-wasm inspection of the BLOCK_PTR/register restart
+sequence, or building per-op TCI. A deterministic reproducer exists (remove
+`wasm_tci_only_tb`, open example.txt, faults at MEPC 0x4201e210, gen 16).
 
 ### Next options
 1. **Ship E1 as a guarded workaround** — reader works now; measure real
diff --git a/third_party/qemu b/third_party/qemu
index 3c064ae..e80c3c7 160000
--- a/third_party/qemu
+++ b/third_party/qemu
@@ -1 +1 @@
-Subproject commit 3c064ae6c9f9ca5e707ad3c51a8df1023429c23e
+Subproject commit e80c3c708863b30fef43609e5edf65398862f7f3