Reframe Tier2 source family frontier

docs/control-loop-atlas/map-and-scenario-content-load.md

@@ -57,6 +57,14 @@
   `aux_candidate_collection_rebank_or_clone_records_by_availability_pass_and_refresh_owner_links`
   `0x00419230` before the later world-load side continues, with destructor
   `aux_candidate_collection_release_templates_queues_and_indexed_storage` `0x00419680`. The fixed
+  stock source-family layer above that clone pass is bounded now too: `0x004197e0` formats source
+  names from the `0x005f3c6c` / `0x005f3c80` style tables, routes them through parser
+  `0x00414490`, and only then falls into the same `0x00419230` rebank-or-clone sweep. The
+  recovered source-name table is `StationSml`, `StationMed`, `StationLrg`, `ServiceTower`,
+  `Maintenance`, `ClpBrd`, `Kyoto`, `Persian`, `SoWest`, `Tudor`, and `Victorian`, so the
+  remaining Tier-2 load-side question is the style-family row-selection path into that later bank
+  pass rather than another hidden naming stage.
+  The fixed
   tail is explicit now too: `0x00444dd0` writes one direct dword from
   `[world+0x19]`, one zeroed `0x1f4`-byte slab under `0x32cf`, closes the package, derives the
   preview path through `0x00442740`, and then conditionally emits the companion-image and

docs/control-loop-atlas/runtime-roots-camera-and-support-families.md

@@ -1282,6 +1282,13 @@
   stay in `named_binding_comparison.binding_only_canonical_stems`. So the numbered Tier-2
   families no longer belong under stock `BuildingTypes/*.bty` discovery either; they belong under
   the scenario/live candidate-table projection seam above the now-grounded bare-name remap.
+  The stock source-family loader above that remap is bounded now too. `0x004197e0` builds source
+  names from the table at `0x005f3c6c` plus companion path table `0x005f3c80`, feeds each result
+  into `0x00414490`, and only then tails into `0x00419230`. The currently recovered source-name
+  set is `StationSml`, `StationMed`, `StationLrg`, `ServiceTower`, `Maintenance`, `ClpBrd`,
+  `Kyoto`, `Persian`, `SoWest`, `Tudor`, and `Victorian`, so the remaining Tier-2 source frontier
+  is the style-family row-selection path into the later banked clone pass, not another hidden
+  name generator.
   The direct `+0xba/+0xbb` writer census now rules out a broad false lead too. The obvious new
   stores at `0x004ecd42/0x004ecdaa` and `0x004ed5d5/0x004ed625` are only shell-side
   portrait/string refresh helpers over a different id-keyed collection rooted through

docs/rehost-queue.md

@@ -10,6 +10,22 @@ Working rule:
 
 ## Next
 
+- Make the current Tier-2 head explicit: the `00`-name mystery is closed, and the next source
+  pass is the stock style-family loader strip above the later banked clone pass. Direct recovery
+  now shows:
+  - `0x00416ce0` is the stock `gpdBuildingTypeDB` `%1*.bty` load callback and already rewrites
+    bare `port` / `warehouse` to `Port00` / `Warehouse00`
+  - `0x004197e0` iterates the stock style/source-family table at `0x005f3c6c` through
+    `0x00414490`, not a map-specific alternate catalog; the current recovered source names are
+    `StationSml`, `StationMed`, `StationLrg`, `ServiceTower`, `Maintenance`, `ClpBrd`, `Kyoto`,
+    `Persian`, `SoWest`, `Tudor`, and `Victorian`
+  - `0x00419230` is then the later two-bank, twelve-ordinal clone-and-rename pass that stamps
+    `Warehouse%02d` / `Port%02d`
+  - so the next honest question is which source rows out of that stock style-family strip first
+    satisfy each later `(bank, ordinal)` pair before `0x00419230` clones them
+  - that means the queue should keep tracing `0x004197e0 -> 0x00414490 -> 0x00419230` and its
+    callsites, not return to the older generic hidden-writer hypothesis
+
 - Treat the periodic-company trace as the main shellless simulation frontier now that the
   infrastructure footer-bit residue is layout/presentation-owned. The checked-in
   `runtime inspect-periodic-company-service-trace <save.gms>` report now exposes concrete branch
@@ -798,6 +814,13 @@ Working rule:
     stock `BuildingTypes/*.bty` discovery for the numbered families either; the remaining `01..11`
     source work belongs under scenario/live candidate-table projection and row-family choice above
     the already-grounded bare-name remap.
+    The stock source-family strip above that remap is grounded now too. `0x004197e0` formats file
+    names from the source-name table `0x005f3c6c` and companion path table `0x005f3c80`, feeds the
+    result into `0x00414490`, and only then tails into `0x00419230`. The recovered source-name
+    table is `StationSml`, `StationMed`, `StationLrg`, `ServiceTower`, `Maintenance`, `ClpBrd`,
+    `Kyoto`, `Persian`, `SoWest`, `Tudor`, and `Victorian`, so the next Tier-2 source question is
+    no longer “where do numbered names come from?” but “which style-family rows first survive into
+    the later two-bank, twelve-ordinal clone pass?”
     The direct `+0xba/+0xbb` writer census is narrower now too. The obvious newly surfaced stores
     at `0x004ecd42/0x004ecdaa` and `0x004ed5d5/0x004ed625` are only shell-side portrait/string
     refresh helpers: they walk a separate id-keyed collection through `0x0053f830`, free and