Exclude fixed region policy chunk from payload frontier

docs/rehost-queue.md

@@ -550,12 +550,13 @@ Working rule:
   dword candidates instead of raw integers only. That gives the next region payload pass a direct
   way to compare both opaque payload bands against the remaining acquisition-side lane shapes
   instead of redoing raw hex inspection by hand.
-- Grounded real-save output already narrows that new probe once further: on `p.gms`, every decoded
-  region triplet currently still has `pre_name_prefix_len = 0` and an empty
-  `pre_name_prefix_dword_candidates` vector, so the remaining acquisition-side payload target does
-  not appear to live in the pre-`0x55f1` band on that save. That shifts the next payload-comparison
-  pass onto the fixed `0x55f2` policy chunk and any later separate body seam, not back onto the
-  pre-name prefix.
+- Grounded real-save output now narrows that new probe two steps further: on both `p.gms` and
+  `q.gms`, every decoded region triplet currently still has `pre_name_prefix_len = 0`, an empty
+  `pre_name_prefix_dword_candidates` vector, and `fixed 0x55f2 policy reserved dwords are nonzero
+  on 0 of 145 decoded region records`. So the remaining acquisition-side payload target does not
+  appear to live in either the pre-`0x55f1` prefix band or the fixed `0x55f2` reserved dword band
+  on grounded ordinary saves. That shifts the next region payload-comparison pass onto later body
+  seams, not back onto the prefix or fixed-policy chunk.
 - The rest of `0x00455fc0` is ruled down further now too: after the `+0x48` callback it only runs
   `0x0052ebd0`, which reads two one-byte generic flags through `0x531150` into base object bytes
   `[this+0x20]`, `[this+0x8d]`, `[this+0x5c..+0x61]`, `[this+0x1ee]`, `[this+0x1fa]`, and