Reframe Tier2 source family frontier

docs/rehost-queue.md

@@ -10,6 +10,22 @@ Working rule:
 
 ## Next
 
+- Make the current Tier-2 head explicit: the `00`-name mystery is closed, and the next source
+  pass is the stock style-family loader strip above the later banked clone pass. Direct recovery
+  now shows:
+  - `0x00416ce0` is the stock `gpdBuildingTypeDB` `%1*.bty` load callback and already rewrites
+    bare `port` / `warehouse` to `Port00` / `Warehouse00`
+  - `0x004197e0` iterates the stock style/source-family table at `0x005f3c6c` through
+    `0x00414490`, not a map-specific alternate catalog; the current recovered source names are
+    `StationSml`, `StationMed`, `StationLrg`, `ServiceTower`, `Maintenance`, `ClpBrd`, `Kyoto`,
+    `Persian`, `SoWest`, `Tudor`, and `Victorian`
+  - `0x00419230` is then the later two-bank, twelve-ordinal clone-and-rename pass that stamps
+    `Warehouse%02d` / `Port%02d`
+  - so the next honest question is which source rows out of that stock style-family strip first
+    satisfy each later `(bank, ordinal)` pair before `0x00419230` clones them
+  - that means the queue should keep tracing `0x004197e0 -> 0x00414490 -> 0x00419230` and its
+    callsites, not return to the older generic hidden-writer hypothesis
+
 - Treat the periodic-company trace as the main shellless simulation frontier now that the
   infrastructure footer-bit residue is layout/presentation-owned. The checked-in
   `runtime inspect-periodic-company-service-trace <save.gms>` report now exposes concrete branch
@@ -798,6 +814,13 @@ Working rule:
     stock `BuildingTypes/*.bty` discovery for the numbered families either; the remaining `01..11`
     source work belongs under scenario/live candidate-table projection and row-family choice above
     the already-grounded bare-name remap.
+    The stock source-family strip above that remap is grounded now too. `0x004197e0` formats file
+    names from the source-name table `0x005f3c6c` and companion path table `0x005f3c80`, feeds the
+    result into `0x00414490`, and only then tails into `0x00419230`. The recovered source-name
+    table is `StationSml`, `StationMed`, `StationLrg`, `ServiceTower`, `Maintenance`, `ClpBrd`,
+    `Kyoto`, `Persian`, `SoWest`, `Tudor`, and `Victorian`, so the next Tier-2 source question is
+    no longer “where do numbered names come from?” but “which style-family rows first survive into
+    the later two-bank, twelve-ordinal clone pass?”
     The direct `+0xba/+0xbb` writer census is narrower now too. The obvious newly surfaced stores
     at `0x004ecd42/0x004ecdaa` and `0x004ed5d5/0x004ed625` are only shell-side portrait/string
     refresh helpers: they walk a separate id-keyed collection through `0x0053f830`, free and