P116 tried the first active predictor-steering path. The live version
built, but wedged before the Linux kernel banner with the harness showing
pc=0x00000000. That is the useful failure: speculative target fetches
cannot reuse the existing architectural fetch queue and fill state
without a proper promote/discard contract.
The final RTL gates the speculative prefetch off, keeps the steering candidate counters, and passes the BusyBox shell workload. It recorded 4,464,122 steering candidates, 119,767 unaligned blocks, 11,378 TLB/permission blocks, and 0 issued steering fills.
The next frontend step should add a small speculative target buffer, not just remove the P116 safety gate.