diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 8662239..eae57b3 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -9523,6 +9523,9 @@ fn parse_event_runtime_collection_summary_with_tag_width(
             control_lane_notes.push(
                 "the checked 0x0042e050 caller census is narrow too: current direct caller 0x004dba23 sits under the event-editor duplication path rather than 0x00433130 load, so ordinary 0x4e9a restore is not currently grounded to inherit trigger/control bytes through that deep-copy seam".to_string(),
             );
+            control_lane_notes.push(
+                "the first non-editor positive control-lane writer is bounded away from ordinary restore too: 0x00430b50 allocates a fresh live runtime-effect row through 0x00432ea0 -> 0x0042d5a0, seeds [event+0x7ef] to 2 or 3 plus adjacent control bytes, and is reached from 0x004323a0 service at 0x0043232e rather than 0x00433130 load".to_string(),
+            );
         }
         if records_with_trigger_kind != 0 {
             control_lane_notes.push(format!(
@@ -9784,6 +9787,9 @@ fn parse_nondirect_event_runtime_record_summary(
     notes.push(
         "the adjacent deep-copy seam is bounded too: current direct caller census shows 0x0042e050 reached from editor duplication at 0x004dba23, not from the ordinary 0x00433130 load path, so this non-direct row family is not currently grounded to inherit trigger/control bytes during restore through that helper".to_string(),
     );
+    notes.push(
+        "the first non-editor positive control-lane writer is bounded away from ordinary restore too: 0x00430b50 allocates a fresh live runtime-effect row through 0x00432ea0 -> 0x0042d5a0, seeds [event+0x7ef] to 2 or 3 plus adjacent control bytes, and is only reached from the 0x004323a0 follow-on service strip rather than the 0x00433130 nondirect load path".to_string(),
+    );
 
     let decoded_conditions = decode_real_condition_rows(&standalone_condition_rows, None);
 
@@ -22335,6 +22341,11 @@ mod tests {
         assert!(summary.control_lane_notes.iter().any(|line| {
             line.contains("0x004dba23 sits under the event-editor duplication path")
         }));
+        assert!(
+            summary.control_lane_notes.iter().any(|line| {
+                line.contains("0x00430b50 allocates a fresh live runtime-effect row")
+            })
+        );
         assert!(summary.control_lane_notes.iter().any(|line| {
             line.contains("0x00431b20 dispatch-strip opcodes present in decoded grouped rows = [4]")
         }));
@@ -22371,6 +22382,11 @@ mod tests {
         assert!(record.notes.iter().any(|line| {
             line.contains("0x0042e050 reached from editor duplication at 0x004dba23")
         }));
+        assert!(
+            record.notes.iter().any(|line| {
+                line.contains("0x00430b50 allocates a fresh live runtime-effect row")
+            })
+        );
         assert!(
             record
                 .notes
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index ad65494..5cb09c0 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -357,6 +357,13 @@ Working rule:
     strip. So the next non-hook question is not “maybe load inherits trigger kind through
     0x0042e050”; it is which other ordinary owner, if any, seeds `[event+0x7ef]` for these
     already-decoded non-direct rows.
+  - the first non-editor positive control-lane writer is bounded away from restore too:
+    direct disassembly now shows `0x00430b50` allocating a fresh live runtime-effect row through
+    `0x00432ea0 -> 0x0042d5a0`, zero-initializing the full `[event+0x7ee..0x7fa]` block, then
+    seeding `[event+0x7ef]` to `2` or `3` plus adjacent control bytes. That builder is reached
+    from the `0x004323a0` follow-on service strip at `0x0043232e`, not from `0x00433130` restore.
+    So the remaining ordinary-owner question is narrower again: neither deep-copy inheritance nor
+    the first positive control-lane builder currently belongs to the non-direct `0x4e9a` load path.
   - the positive-path caller census is effectively boxed in now too:
     direct `0x0040ef10` callers are the create-side pair `0x00403ef3 / 0x00404489`, the transport
     tuple pair `0x0046f073 / 0x004707ff`, and the already-ruled-down live controller