diff --git a/docs/wasm-inflate-panic.md b/docs/wasm-inflate-panic.md
index e2c6cec..c2fc838 100644
--- a/docs/wasm-inflate-panic.md
+++ b/docs/wasm-inflate-panic.md
@@ -127,6 +127,28 @@ interaction with a co-located op.
   the generated wasm for one miscompiled TB. Large task; reader already works at
   ~31s with the store flag, so this is headroom, not a blocker.
 
+### E3 — PC-windowed bisection: not a single TB, it's aggregate
+Added a compile-window to `tcg_out_qemu_st` (`s->gen_tb->pc` gate): store-TBs
+inside `[LO,HI)` compile, all others stay TCI. Each run rebuilt + browser-tested.
+
+| window | region | result |
+|--------|--------|--------|
+| 0x4201d000–0x4201f800 | uzlib inflate + FontDecompressor | **pass** |
+| 0x40000000–0x40400000 | ROM (memcpy/memset) + IRAM (tlsf/malloc) | **pass** |
+| 0x42000000–0x420d0000 | flash text lower half (prewarm callers) | **pass** |
+| 0x420d0000–0x421a0000 | flash text upper half | **pass** |
+| (none / all store-TBs compiled) | everything | **crash** |
+
+Every region compiles safely *in isolation*; only the full set corrupts. So the
+bug is **not a localizable miscompiled op/TB** — it is an aggregate effect that
+appears once enough compiled store-TBs run together. The faulting load is
+`d->dict_ring[d->lzOff]` (tinflate.c:476) off a stack-resident inflate struct,
+i.e. some store clobbers a *neighbouring* stack/heap pointer, and which store
+depends on timing. This matches a **rewind/replay or TB-instance-management
+race** in the compiled restartable-block store path, not a codegen typo — and it
+is exactly why upstream forces every store-TB to TCI. Fixing it is architectural
+(rewind/instance-safe compiled stores), not a one-op correction.
+
 ### Next options
 1. **Ship E1 as a guarded workaround** — reader works now; measure real
    navigation/page-turn perf before judging it unacceptable.
diff --git a/third_party/qemu b/third_party/qemu
index b3ca9f1..725845d 160000
--- a/third_party/qemu
+++ b/third_party/qemu
@@ -1 +1 @@
-Subproject commit b3ca9f1eb60fce26983ae365945cf7d17213af90
+Subproject commit 725845d0d8cd9254ce6a9e81721281e9c43f2aa0