Bound infrastructure payload string fallbacks

docs/control-loop-atlas/runtime-roots-camera-and-support-families.md

@@ -2937,9 +2937,12 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0`
   cached bridge bands, opens `0x55f1`, parses three len-prefixed strings through `0x00531380`,
   opens `0x55f2`, seeds the child through `0x00455b70`, dispatches slot `+0x48`, runs the local
   follow-on `0x0052ebd0`, and then opens `0x55f3`. The widened save-side probe currently still
-  sees only two embedded `0x55f1` strings on grounded `q.gms`, so the remaining payload question is
-  whether that third parsed string is absent on ordinary saves, hidden behind different framing, or
-  only populated on a narrower infrastructure subset.
+  sees only two embedded `0x55f1` strings on grounded `q.gms`, but `0x00455b70` now makes that
+  result much less mysterious: it stores the three payload strings into `[this+0x206/+0x20a/+0x20e]`,
+  defaulting the second lane through a fixed literal when absent and defaulting the third lane back
+  to the first string when absent. So the remaining payload question is no longer “where is the
+  third string hiding?”; it is how the current dual-name save-side rows align with the full
+  payload-stream grouping and the later tagged value roles.
   The child loader family is explicit now too: local `.rdata` at `0x005cfd00` proves the
   `Infrastructure` child vtable uses the shared tagged callback strip directly, with
   `+0x40 = 0x00455fc0`, `+0x48 = 0x00455870`, and `+0x4c = 0x00455930`. So the remaining

docs/rehost-queue.md

@@ -69,9 +69,12 @@ Working rule:
   disassembly now also shows the shared child payload callback `0x00455fc0` opening
   `0x55f1 -> 0x55f2 -> 0x55f3`, parsing three `0x55f1` strings through `0x00531380`, seeding the
   child through `0x00455b70`, and then dispatching slot `+0x48`; the widened save-side probe
-  currently sees `0` third `0x55f1` strings on grounded `q.gms`, so the next pass should ask
-  whether that third string is genuinely absent on ordinary saves or stored under different
-  framing than the current embedded-row scan.
+  currently sees `0` third `0x55f1` strings on grounded `q.gms`. That now looks less like a probe
+  failure and more like an ordinary fallback path, because direct disassembly of `0x00455b70`
+  stores the three payload strings into `[this+0x206/+0x20a/+0x20e]`, defaulting the second lane
+  through a fixed literal when absent and defaulting the third lane back to the first string when
+  absent. So the next pass should stay focused on payload-stream grouping and tagged value roles,
+  not on rediscovering a missing third-string encoding.
 - The child loader identity is closed now too: local `.rdata` at `0x005cfd00` proves the
   `Infrastructure` child vtable uses the shared tagged callback strip directly, with
   `+0x40 = 0x00455fc0`, `+0x48 = 0x00455870`, and `+0x4c = 0x00455930`. So the remaining