Tighten runtime-effect kind-8 writer census

artifacts/exports/rt3-1.06/runtime-effect-kind8-late-bringup-note.md

@@ -131,6 +131,18 @@ So the active periodic-company/control-lane question narrows again:
 - and the currently grounded nonzero seed outside the scenario-name retags is the follow-on
   builder reached from the service/dispatch family rather than from the reload loop itself
 
+The direct-write census is tighter than that summary alone:
+
+- current whole-binary `objdump` search for `mov BYTE PTR [...+0x7ef], imm/reg` grounds only:
+  - zero-init `0x0042d5a0`
+  - copy helper `0x0042e11a`
+  - follow-on builder `0x00430b50`
+  - late retags `0x00443526` and `0x00443601`
+  - shell editor selector table `0x004d8ea0`
+- the only grounded explicit `kind 8` write is `0x004d91b3`, inside the shell-side selector table
+  for controls `0x4e98..0x4ea2`
+- no grounded shellless runtime-side direct writer currently seeds `8` into `[event+0x7ef]`
+
 ## Ruled-Out Shell Seed Table
 
 The large remaining direct writer table is bounded now too: