Save Selector Predecessor Bridge Refs

predecessor 1:0 root 0x00478364 range 0x00478364..0x0048458c; current 2:0 root 0x00540714 range 0x00540714..0x00543578.

predecessor -> current hits: 0; current -> predecessor hits: 51; bridge found: True; promotion status blocked.

forward execution bridge found: False; reverse hits to fill sites: 0; reverse hits only before fill: True.

The direct bridge scan found no predecessor->current dword edge. The reverse direction has current-root dwords that point back into the predecessor root, but all of those targets are before the predecessor secondary fill sites 0x004844d0/0x004844d8 and none targets the fill sites themselves. This looks like shared/reused script substructure rather than proof that selector 1:0 executes into selector 2:0 or leaves its fill state for the current frontier. Promotion remains blocked until runtime order/state persistence or a strict map1_01a hotspot is proven.

Scan Summary

direction	source range	target root range	readable dwords	hits
predecessor -> current	`0x00478364..0x0048458c`	`0x00540714..0x00543578`	12426	0
current -> predecessor	`0x00540714..0x00543578`	`0x00478364..0x0048458c`	2969	51

Reverse Hit Classification

metric	count/status
reverse reuse hits	51
reverse hits before predecessor fill	51
reverse hits at/after predecessor fill	0
reverse hits to exact fill sites	0
reverse hits before current writer 0x005428bc	51
reverse hits only before fill	True

Predecessor -> Current Hits

source	value	inside target range	exact label
No hits.

Current -> Predecessor Hits

source	value	inside target range	exact label
`0x0054085c`	`0x00482bf4`	True	-
`0x00540870`	`0x00482ce2`	True	-
`0x005408c4`	`0x00482ee8`	True	-
`0x005408e8`	`0x0048305e`	True	-
`0x00540938`	`0x00483324`	True	-
`0x00540970`	`0x0048341c`	True	-
`0x0054098c`	`0x004834a0`	True	-
`0x00540a0c`	`0x004835fc`	True	-
`0x00540a18`	`0x0048378e`	True	-
`0x00540bf0`	`0x0047e802`	True	-
`0x00540ee0`	`0x00482b64`	True	-
`0x00540f2c`	`0x00482bae`	True	-
`0x00540f8c`	`0x00482d36`	True	-
`0x00540fa0`	`0x00482d74`	True	-
`0x00541038`	`0x00481ed4`	True	-
`0x00541050`	`0x00481f1e`	True	-
`0x00541068`	`0x00481fb4`	True	-
`0x00541160`	`0x00482034`	True	-
`0x00541178`	`0x004820f2`	True	-
`0x0054126c`	`0x004821b0`	True	-
`0x0054135c`	`0x004821fe`	True	-
`0x0054144c`	`0x004822a2`	True	-
`0x00541474`	`0x004822ca`	True	-
`0x00541488`	`0x0048233e`	True	-
`0x0054149c`	`0x004823a0`	True	-
`0x005414b0`	`0x00482414`	True	-
`0x005414c4`	`0x0048248a`	True	-
`0x005415b4`	`0x004824f8`	True	-
`0x005416a4`	`0x0048254c`	True	-
`0x00541794`	`0x004825d8`	True	-
`0x00541884`	`0x00482666`	True	-
`0x00541988`	`0x004826f6`	True	-
`0x00541a20`	`0x00482b02`	True	-
`0x00541af8`	`0x004827ac`	True	-
`0x00541be4`	`0x00482844`	True	-
`0x00541cd8`	`0x0048289c`	True	-
`0x00541cf0`	`0x00482aac`	True	-
`0x00541df8`	`0x00482dce`	True	-
`0x00541e10`	`0x00482e4e`	True	-
`0x00541e24`	`0x00482e88`	True	-
`0x00541ebc`	`0x00483df6`	True	-
`0x00541ed0`	`0x00483f62`	True	-
`0x00541eec`	`0x00483f9e`	True	-
`0x00541f00`	`0x00483fda`	True	-
`0x00541f24`	`0x004841ee`	True	-
`0x00541f38`	`0x00484218`	True	-
`0x00542264`	`0x0048396a`	True	-
`0x00542280`	`0x00483d1a`	True	-
`0x00542344`	`0x00484250`	True	-
`0x00542358`	`0x0048435e`	True	-
`0x005425fc`	`0x00483806`	True	-

Remaining Proofs

prove selector 1:0 executes before selector 2:0 in the normal runtime path
prove secondaryBranchState persists from predecessor fill to current reader
find strict map1_01a source coordinate or hotspot

Limitations

This scan covers direct dword values in the known selector root ranges only.
It does not rule out VM-dispatched execution order, save flag progression, or indirect runtime state transitions.
It does not replace the strict hotspot/source-coordinate requirement.