Classify acquisition transport and builder callers

crates/rrt-runtime/src/smp.rs

@@ -4641,6 +4641,10 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "data-driven loader callers 0x0046f073 / 0x004707ff push tuple fields [+0x00/+0x04/+0x0c] into 0x0040ef10, and that helper's third argument flows into ebx and then [site+0x276] at 0x0040f5d4"
             .to_string(),
+        "at least one of those tuple-backed callers is now classified too: 0x004707ff sits under multiplayer transport selector-0x13 body 0x004706b0 rather than the ordinary save-load restore strip"
+            .to_string(),
+        "non-transport caller 0x00422bb4 also reaches 0x004134d0, but it pushes live args plus literal flags 1/0 and returns the created row id through an out-param instead of feeding the tuple-backed finalize path"
+            .to_string(),
         "station-detail mutation path 0x0040dc40 already consumes [site+0x276], company stat-family 0x2329/0x0d, and candidate field [candidate+0x22], then commits linked-site side-state rebuild through 0x0040d1f0 / 0x00480710 / 0x0045b160 / 0x0045b9b0 / 0x00418be0 / 0x0040cd70"
             .to_string(),
         "city-connection direct-placement family 0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10 already grounds the shared allocator/finalize path for newly created site rows"
@@ -4658,7 +4662,7 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
     ];
     let near_city_acquisition_site_owner_company_projection_status =
-        "loader_tuple_owner_arg_grounded_constructor_and_finalize_families_bounded_broader_projection_missing"
+        "transport_tuple_owner_arg_grounded_constructor_and_finalize_families_bounded_nontransport_projection_missing"
             .to_string();
     let near_city_acquisition_site_self_id_projection_status =
         "live_meaning_grounded_reconstructible_from_collection_identity".to_string();
@@ -4736,13 +4740,15 @@ fn build_periodic_company_service_trace_report(
                 "0x0040f6d0 immediately zeroes [site+0x2a8/+0x272/+0x27a/+0x29e], stamps [site+0x3d4/+0x3d5], and seeds further local caches, which makes it a create-side initializer rather than a replay-only refresh".to_string(),
                 "shared finalize helper 0x0040ef10 now has create-side callers 0x00403ef3 / 0x00404489 and data-driven callers 0x0046f073 / 0x004707ff; the latter feed it from tuple-backed loads after 0x0040eba0 / 0x0052eb90 rather than from the checked-in local replay strip".to_string(),
                 "the loader-side dataflow is narrower now too: 0x0046f073 / 0x004707ff push tuple fields [+0x00/+0x04/+0x0c] into 0x0040ef10, that helper reads arg3 into ebx at 0x0040ef1c, and the paired write at 0x0040f5d4 stores ebx into [site+0x276] while 0x0040f5da stores the computed companion word into [site+0x27a]".to_string(),
+                "the outer owner above 0x004707ff is now classified too: atlas-backed recovery ties that caller to multiplayer transport selector-0x13 body 0x004706b0, which attempts the placed-structure apply path through 0x004197e0 / 0x004134d0 / 0x0040eba0 / 0x0052eb90 / 0x0040ef10 rather than ordinary save-load restore".to_string(),
+                "another surviving 0x004134d0 caller is bounded away from persisted restore too: 0x00422bb4 pushes one live 0x0062b2fc record plus local args and literal flags 1/0 into 0x004134d0, then returns the created row id through an out-param rather than re-entering the tuple-backed finalize path".to_string(),
                 "inside 0x0040ef10 the [site+0x276] write at 0x0040f047 only clears owner-company under a world-flag branch, while the paired [site+0x276]/[site+0x27a] write at 0x0040f5d4 follows a 0x00436590 event/scalar path and is not the generic post-load republisher".to_string(),
                 "direct local writer census now shows the grounded [site+0x276] write side clustering under live mutation families such as 0x004269b0 / 0x00426a10, the create-side 0x0040ef10 / 0x0040f6d0 strip, and the bulk reassignment families 0x00426dce..0x00426ea1 and 0x00430040..0x004300d6 rather than under the known replay strip".to_string(),
                 "direct local control-flow reconstruction now shows those same writer families hanging under the 0x00431b20 opcode dispatcher over 0x0061039c: opcodes 0x04..0x07 dispatch to 0x00430040, opcodes 0x08/0x10..0x13 dispatch to 0x00426d60, and opcodes 0x0d/0x16 dispatch to 0x0042fc90".to_string(),
                 "0x0042fc90 itself iterates the live placed-structure collection 0x0062b26c, filters rows through 0x0040c990 plus optional company match [site+0x276], and then dispatches row vtable slot +0x70, which keeps that branch on the live application side rather than replay".to_string(),
             ],
             blockers: vec![
-                "current atlas evidence now grounds one persisted tuple path too: loader tuple field [+0x0c] reaches [site+0x276] through 0x0046f073 / 0x004707ff -> 0x0040ef10, but it still does not identify which broader persisted source family feeds that tuple or which additional restore/finalize calls are sufficient to repopulate the owner-company lane for shellless acquisition without guessing".to_string(),
+                "current atlas evidence now grounds one tuple-backed owner path too: loader tuple field [+0x0c] reaches [site+0x276] through 0x0046f073 / 0x004707ff -> 0x0040ef10, but the classified 0x004707ff caller belongs to multiplayer transport selector-0x13 rather than ordinary save-load restore, so a non-transport persisted source family is still needed for shellless acquisition".to_string(),
             ],
         },
         SmpServiceConsumerHypothesis {
@@ -4794,11 +4800,11 @@ fn build_periodic_company_service_trace_report(
         },
     ];
     let near_city_acquisition_remaining_owner_gaps = vec![
-        "persisted source family feeding the loader tuple-to-live projection of placed-structure owner-company field [site+0x276] for the acquisition-side owner-present gate; the live meaning is grounded through 0x0047efe0, the owner family is bounded under 0x004134d0 / 0x0040f6d0 plus shared finalize helper 0x0040ef10, and loader tuple field [+0x0c] is now known to seed [site+0x276] through 0x0046f073 / 0x004707ff".to_string(),
+        "non-transport persisted source family feeding the tuple-to-live projection of placed-structure owner-company field [site+0x276] for the acquisition-side owner-present gate; the live meaning is grounded through 0x0047efe0, the owner family is bounded under 0x004134d0 / 0x0040f6d0 plus shared finalize helper 0x0040ef10, and loader tuple field [+0x0c] is known to seed [site+0x276] through 0x0046f073 / 0x004707ff, but the classified 0x004707ff caller sits under multiplayer transport selector-0x13 rather than ordinary save-load restore".to_string(),
         "exact persisted inputs and shellless service semantics for the now-grounded live cached tri-lane writer family over [site+0x310/+0x338/+0x360], especially 0x0040d450 and 0x00410b30..0x004118f4 above 0x00412560".to_string(),
     ];
     let near_city_acquisition_region_lane_statuses = vec![
-        "[site+0x276] owner-present gate: consumed directly by 0x004014b0, the live owner-company meaning is grounded through 0x0047efe0, the write family is bounded under 0x004134d0 / 0x0040f6d0 plus shared finalize helper 0x0040ef10, and loader tuple field [+0x0c] is now known to seed that lane through 0x0046f073 / 0x004707ff; the remaining gap is which persisted source family and companion restore calls are sufficient for shellless acquisition".to_string(),
+        "[site+0x276] owner-present gate: consumed directly by 0x004014b0, the live owner-company meaning is grounded through 0x0047efe0, the write family is bounded under 0x004134d0 / 0x0040f6d0 plus shared finalize helper 0x0040ef10, and loader tuple field [+0x0c] is known to seed that lane through 0x0046f073 / 0x004707ff; the remaining gap is which non-transport persisted source family and companion restore calls are sufficient for shellless acquisition".to_string(),
         "[site+0x2a4] placed-structure id lane: peer-chain helpers already ground this as the record's own site id, constructor-side 0x00480210 seeds it for new linked-site rows, and 0x004269b0 resolves the chosen site id back through 0x0062b26c before mutating [site+0x276], so this lane is reconstructible from collection identity for the 0x004014b0 commit path".to_string(),
         "[site+0x310/+0x338/+0x360] cached tri-lane: exact delta reader grounded at 0x0040cac0, deferred additive accumulator/reset helper grounded at 0x0040c9a0, and direct live producers now grounded at 0x0040d450 plus the broader 0x00410b30..0x004118f4 candidate-processing loop above 0x00412560; the remaining gap is exact service semantics and persisted inputs, not writer existence".to_string(),
         "placed-structure subtype filter: 0x0040d360 is the exact test [candidate+0x32] == 4, the owning subtype byte is already bounded under 0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0, and direct local binary inspection now grounds stream-load callback 0x0040ce60 as the restore-side bridge into [site+0x3cc/+0x3d0]".to_string(),
@@ -4898,6 +4904,8 @@ fn build_periodic_company_service_trace_report(
         "0x00403ef3 / 0x00404489 create-side callers of shared finalize helper 0x0040ef10".to_string(),
         "0x0046f073 / 0x004707ff data-driven loader callers of shared finalize helper 0x0040ef10".to_string(),
         "0x0046f073 / 0x004707ff tuple field [+0x0c] feeding 0x0040ef10 arg3 and then [site+0x276] at 0x0040f5d4".to_string(),
+        "0x004706b0 multiplayer transport selector-0x13 body re-entering 0x004197e0 / 0x004134d0 / 0x0040eba0 / 0x0052eb90 / 0x0040ef10 before 0x004707ff".to_string(),
+        "0x00422bb4 direct non-tuple allocator caller pushing one 0x0062b2fc record plus local args and literal flags 1/0 into 0x004134d0, then returning the created row id through an out-param".to_string(),
         "0x004134d0 / 0x0040ef10 shared placed-structure allocator and finalize-or-rebuild lane for newly created or tuple-loaded site rows"
             .to_string(),
         "0x00481430 / 0x0047d8e0 dynamic side-buffer stream-load owner repopulating route-entry lists, three byte arrays, five proximity buckets, and trailing scratch band"
@@ -28134,7 +28142,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 9);
-        assert_eq!(trace.known_bridge_helpers.len(), 74);
+        assert_eq!(trace.known_bridge_helpers.len(), 76);
         assert_eq!(trace.next_owner_questions.len(), 5);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28219,7 +28227,7 @@ mod tests {
         );
         assert_eq!(
             trace.near_city_acquisition_site_owner_company_projection_status,
-            "loader_tuple_owner_arg_grounded_constructor_and_finalize_families_bounded_broader_projection_missing"
+            "transport_tuple_owner_arg_grounded_constructor_and_finalize_families_bounded_nontransport_projection_missing"
         );
         assert_eq!(
             trace.near_city_acquisition_site_self_id_projection_status,
@@ -28371,6 +28379,26 @@ mod tests {
                     && line.contains("[site+0x276]")
                     && line.contains("[site+0x27a]"))
         );
+        assert!(
+            trace.near_city_acquisition_projection_hypotheses[0]
+                .evidence
+                .iter()
+                .any(|line| line.contains("0x004707ff")
+                    && line.contains("0x004706b0")
+                    && line.contains("selector-0x13")
+                    && line.contains(
+                        "0x004197e0 / 0x004134d0 / 0x0040eba0 / 0x0052eb90 / 0x0040ef10"
+                    ))
+        );
+        assert!(
+            trace.near_city_acquisition_projection_hypotheses[0]
+                .evidence
+                .iter()
+                .any(|line| line.contains("0x00422bb4")
+                    && line.contains("0x0062b2fc")
+                    && line.contains("literal flags 1/0")
+                    && line.contains("out-param"))
+        );
         assert!(
             trace.near_city_acquisition_projection_hypotheses[0]
                 .evidence
@@ -28466,7 +28494,7 @@ mod tests {
             trace
                 .near_city_acquisition_runtime_backed_input_families
                 .len(),
-            18
+            20
         );
         assert_eq!(trace.near_city_acquisition_remaining_owner_gaps.len(), 2);
         assert_eq!(trace.near_city_acquisition_region_lane_statuses.len(), 4);
@@ -28555,6 +28583,23 @@ mod tests {
                     && line.contains("0x0040ef10")
                     && line.contains("0x0040f5d4"))
         );
+        assert!(
+            trace
+                .near_city_acquisition_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("0x004707ff")
+                    && line.contains("0x004706b0")
+                    && line.contains("selector-0x13"))
+        );
+        assert!(
+            trace
+                .near_city_acquisition_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("0x00422bb4")
+                    && line.contains("live args")
+                    && line.contains("literal flags 1/0")
+                    && line.contains("out-param"))
+        );
         assert!(
             trace
                 .near_city_acquisition_runtime_backed_input_families
@@ -28801,7 +28846,8 @@ mod tests {
                     && line.contains("0x0047efe0")
                     && line.contains("0x004134d0 / 0x0040f6d0")
                     && line.contains("0x0040ef10")
-                    && line.contains("[+0x0c]"))
+                    && line.contains("[+0x0c]")
+                    && line.contains("non-transport"))
         );
         assert!(
             !trace
@@ -29002,6 +29048,23 @@ mod tests {
                 && line.contains("[+0x0c]")
                 && line.contains("0x0040f5d4")
         }));
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x004706b0")
+                    && line.contains("selector-0x13")
+                    && line.contains("0x0040ef10"))
+        );
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x00422bb4")
+                    && line.contains("0x0062b2fc")
+                    && line.contains("literal flags 1/0")
+                    && line.contains("out-param"))
+        );
         assert!(
             trace
                 .known_bridge_helpers

docs/rehost-queue.md

@@ -127,9 +127,17 @@ Working rule:
     the data-driven loader callers `0x0046f073 / 0x004707ff` push tuple fields
     `[+0x00/+0x04/+0x0c]` into `0x0040ef10`, and inside that helper arg3 becomes `ebx` and then
     `[site+0x276]` at `0x0040f5d4`
+  - that tuple path is classified further now too:
+    the checked-in atlas ties `0x004707ff` to multiplayer transport selector-`0x13` body
+    `0x004706b0`, which attempts the placed-structure apply path through
+    `0x004197e0 / 0x004134d0 / 0x0040eba0 / 0x0052eb90 / 0x0040ef10`
+  - one surviving non-transport `0x004134d0` caller is bounded away from persisted restore too:
+    `0x00422bb4` pushes one live `0x0062b2fc` record plus local args and literal flags `1/0`
+    into `0x004134d0`, then returns the created row id through an out-param instead of feeding
+    the tuple-backed finalize path
   - the remaining owner-company question is therefore narrower than “find any replay seam”:
-    identify which persisted source family feeds that tuple and which companion restore/finalize
+    identify which non-transport persisted source family feeds that tuple and which companion
-    calls are sufficient to repopulate `[site+0x276]` for shellless acquisition
+    restore/finalize calls are sufficient to repopulate `[site+0x276]` for shellless acquisition
   - the second is narrower in the same way:
     the checked-in `0x36b1/0x36b2/0x36b3` triplet seam and the
     `0x4a9d/0x4a3a/0x4a3b` side-buffer seam still do not serialize `[site+0x310/+0x338/+0x360]`