Scene/Event Runtime Evidence Handoff

do-not-call-update-goal 정적 frontier 이후 필요한 증거만 정리한다.

Watchpoint Targets

VA	Target	Width	Why	Capture
`0x004576da`	selector group byte	1	Generic selected-root lookup reads this as the selector directory group.	write caller/call stack current script/object pointer if available new value and adjacent selector slot byte
`0x004576db`	selector slot byte	1	Generic selected-root lookup reads this as the selector row slot.	write caller/call stack new value paired selector group byte
`0x0059de30`	selected root global	4	This is the selected-root pointer consumed by the prompt pipeline.	write caller/call stack written root pointer selector bytes at 0x004576da/db at the same moment whether the writer is generic opcode handling or an outer scheduler
`0x004576e8`	runtime descriptor count	1	Generic active-object descriptor add/remove writes this count.	writer opcode/caller count before/after whether the write happens before a route-like prompt root is selected
`0x004576e9`	runtime descriptor order bytes	array	Descriptor run order is generic-grounded, but route-specific producer is not.	index/order byte written owning command stream if available active selector key if available

selector	map	owner root	current static status
`34:0`	map8_32q	`0x0052db58`	blocked: exact opcode4f mode1 hit count is 0; route boundary values have no direct .text refs
`13:1`	-	`-`	grounded local prompt pipeline; outer selector58 scheduler remains data-only blocked
`14:0`	-	`-`	route-like positive selector command exists; terminal scheduler remains data-only blocked
`18:0`	-	`-`	route-like positive selector command exists; terminal scheduler remains data-only blocked

A write to 0x004576da/db or 0x0059de30 is captured with an instruction-bound caller that is outside the already-grounded generic save/load or opcode handler path.
The captured caller can be tied to a concrete scene/event record, selector root, descriptor run, or command stream address.
The captured selector/root corresponds to a route-like prompt root and is followed by the known prompt consumer path.
If only generic opcode handlers are captured, the upstream owner stream/object pointer must be recorded so static analysis can continue from that concrete owner instead of re-scanning all data.