Save Selector Branch Selector Equation

Route: map1_01a -> map2_02d

Writer: 0x005428bc 0x00208212 via 0x0040b55f

Reader: 0x00542b0c 0x00209011 via 0x0040b4e6

Conclusion: The 12-slot secondaryBranchState equation is still unresolved as confirmed route proof, but the strongest predecessor-fill hypothesis narrows the value side: if selector 1:0 leaves secondaryBranchState as [1,1,0..], every active-flag/start-slot case selects a slot whose value is 1. Under that hypothesis, the prior selectionBuffer[0x20] value is no longer the primary blocker. Promotion remains blocked on proving 1:0 executes before 2:0, proving the state persists through the gated path to 0x00542b0c, and finding a strict map1_01a source hotspot.

Writer Algorithm

• stream+1 is 0x82, so opcode 0x12 uses secondaryBranchState at 0x0059e360.
• If byte(0x00457744) is set, the search starts from the existing selectionBuffer[0x20]; otherwise it starts from 0.
• The handler first walks backward through 12 slots with wraparound until it finds a nonzero secondaryBranchState slot.
• It then walks forward through 12 slots with wraparound until it finds a nonzero secondaryBranchState slot.
• The final slot index is written to selectionBuffer[0x20].

Reader Algorithm

• stream+1 is 0x90, so opcode 0x11 also reads secondaryBranchState at 0x0059e360.
• It reads slot = selectionBuffer[0x20].
• If secondaryBranchState[slot] == 1, execution falls through to 0x00542b14.
• Otherwise execution jumps to the stream operand target 0x0053f46f.

Predecessor-Fill Narrowing

• predecessor 1:0 root 0x00478364
• fill 0x00000210 -> [1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
• all starts pass reader: True
• active flag default resolved: True
• prior selectionBuffer still primary blocker: False

Remaining Unknowns

• prove predecessor 1:0 executes before current selector 2:0 in the normal route
• prove secondaryBranchState persists to 0x005428bc/0x00542b0c
• control-flow proof that 0x005428bc reaches the 0x00542b0c frontier reader
• strict source tile coordinate or hotspot for map1_01a
• real selector 2:0 savedata or equivalent runtime trace