diff --git a/rtl/gif_gs/gs_lpddr_z_rmw.sv b/rtl/gif_gs/gs_lpddr_z_rmw.sv
index 7f649d5..bbc9637 100644
--- a/rtl/gif_gs/gs_lpddr_z_rmw.sv
+++ b/rtl/gif_gs/gs_lpddr_z_rmw.sv
@@ -256,7 +256,7 @@ module gs_lpddr_z_rmw #(
                     // scene-end flush (ordered after all fragments): push the dirty line, keep it cached (persist across
                     // epochs). Waits for every pipeline stage to drain so nothing is stranded.
                     if (scene_flush && !d_valid && !rmw_valid && !cmp_valid && cache_valid && cache_dirty) begin
-                        awaddr<=ZBASE + (cache_beat<<5); awvalid<=1'b1;
+                        awvalid<=1'b1;   // Ch443f — awaddr already prepared at S_FILL_C install
                         wdata<=cache_data; wvalid<=1'b1; wlast<=1'b1; st<=S_SFLUSH_AW;
                     end
                     // STAGE 2 — barrel READ of the target lane into the RMW register (hit), or promote+fill (miss). Fires
@@ -272,7 +272,7 @@ module gs_lpddr_z_rmw #(
                             // MISS: promote the decoded fragment to pf_*, backpressure, flush-if-dirty then fill
                             pf_x<=d_x; pf_y<=d_y; pf_zq<=d_zq; pf_zmsk<=d_zmsk; pf_ztst<=d_ztst; pf_beat<=d_beat; pf_lane<=d_lane;
                             if (cache_valid && cache_dirty) begin
-                                awaddr<=ZBASE + (cache_beat<<5); awvalid<=1'b1;
+                                awvalid<=1'b1;   // Ch443f — awaddr already prepared at S_FILL_C install
                                 wdata<=cache_data; wvalid<=1'b1; wlast<=1'b1; st<=S_FLUSH_AW;
                             end else begin
                                 araddr<=ZBASE + (d_beat<<5); arvalid<=1'b1; st<=S_FILL_AR;
@@ -318,6 +318,12 @@ module gs_lpddr_z_rmw #(
                     // RMW stage (barrel READ of the target lane off the just-read beat). Stage 3 does the GEQUAL + 16-way
                     // lane write next cycle in S_RUN (a guaranteed hit). Same result as the old single-cycle fill, staged.
                     cache_data<=z_rd_q; cache_beat<=pf_beat; cache_valid<=1'b1; cache_dirty<=1'b0;
+                    // Ch443f — PRELOAD the line's normal-eviction AW address at install. The address
+                    // is a pure function of this line's beat (== cache_beat after this cycle) and is
+                    // stable across every hit/flush until the next fill re-installs it. Preparing it
+                    // here removes the 5-level cache_dirty -> awaddr control cone that was the EMIF
+                    // setup leader; the eviction branches below now only assert awvalid.
+                    awaddr<=ZBASE + (pf_beat<<5);
                     rmw_valid<=1'b1; rmw_dz<=z_rd_q[pf_lane*16 +: 16];
                     rmw_lane<=pf_lane; rmw_zq<=pf_zq; rmw_zmsk<=pf_zmsk; rmw_ztst<=pf_ztst; rmw_x<=pf_x; rmw_y<=pf_y;
                     st<=S_RUN;