Rule out shellless event metadata clone path

docs/rehost-queue.md

@@ -14,6 +14,7 @@ This file is the short active queue for the current runtime and reverse-engineer
   The checked `rt3_105/maps` compact-dispatch corpus is now exported directly and partially mirrored into the periodic-company trace: `41` maps scanned, `38` with dispatch-strip rows, `318` nondirect rows total, the add-building subset is only `10` grouped occurrences across `7` descriptor keys, and the strongest broader nondirect families are now bounded too at `36` grouped occurrences across `18` maps for `nondirect-ge1e-h0001-0360-0004-0100-0200-p0000-0000-0000-ffff :: [864:4]` plus `27` across `14` maps for the mixed `[-1:4]` cluster. All of those checked rows still lack recovered trigger kind. The packed-state bridge is narrower than that queue head used to allow too: `0x0042db20/0x00430d70` rebuild and serialize only the fixed text bands plus the standalone and grouped row lists, while the metadata band `+0x7ee..+0x80e` is only mirrored by deep-copy helper `0x0042e050`. The active open question is therefore which ordinary loaded rows acquire or bypass the missing trigger-kind control lane before they can reach placed-structure mutation opcodes.
   The largest direct writer table is ruled out now too: `0x004d8ea0` is the shell-side `EventConditions.win` commit helper, where controls `0x4e98..0x4ea2` write `[event+0x7ef] = 0..10` on the currently selected live event, so that seed family does not explain shellless post-load bringup.
   The broad scenario-name fixup owner is narrower in the same direction: `0x00442c30` really does mutate live event rows after reload, but its grounded trigger-kind writes still only retag `1 -> 5` and `0 -> 2`, while the surrounding event-side branches only patch modifier bytes or nested payload dwords under already-existing kinds. No grounded branch there seeds kind `8`.
+  The metadata-copy helper is ruled out in the same way: `0x0042e050` really does clone `[event+0x7ef]`, but the current whole-binary caller search still finds only the shell-side selected-event clone path `0x004db8b0`, not any shellless post-load or periodic caller.
   The direct write census is tighter in the same direction: the only grounded explicit write of value `8` into `[event+0x7ef]` is `0x004d91b3` inside that same shell helper, while the runtime-side grounded writers still only cover zero-init, copy, `2/3` follow-on seeds, and the later `5` / `2` retags.
   Preserved checked control-lane detail now lives in [Periodic company control lane](rehost-queue/periodic-company-control-lane-2026-04-21.md).
 - Keep the next static Tier-2 building pass focused on the earlier seed/projection seam into `0x00412d70`, not another broad `BuildingTypes` sweep.

docs/rehost-queue/periodic-company-control-lane-2026-04-21.md

@@ -180,6 +180,22 @@ The ordinary reload path is narrower in the same negative way now too:
 So the remaining periodic-company question stays between reload and service: the checked restore
 path repopulates the rows, but the later trigger-kind gate lives only in the service strip.
 
+## Deep-Copy Boundary
+
+The one remaining metadata-copy helper is narrower now too:
+
+- `0x0042e050`
+  - really does mirror the omitted metadata band `+0x7ee..+0x80e`, including `[event+0x7ef]`
+  - but the current whole-binary caller search only grounds one caller:
+    `0x004db8b0`, the shell-side `EventConditions.win` clone-selected-event path
+- no grounded post-load, world-entry, or periodic-service caller currently re-enters `0x0042e050`
+
+So the control-lane frontier narrows again:
+
+- shell event cloning can duplicate trigger-kind metadata intact
+- but there is still no grounded shellless duplication path between reload `0x00433130` and the
+  late `kind 8` service
+
 ## Current Writer Census
 
 The direct writer set for `[event+0x7ef]` is narrower now too: