diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 4c9372f..8214b3f 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -4621,9 +4621,10 @@ fn build_periodic_company_service_trace_report(
                 "0x004269b0 resolves the chosen site id through placed-structure collection 0x0062b26c before mutating the live row, so [site+0x2a4] is reconstructible from collection identity rather than a separate serializer-owned selector".to_string(),
                 "0x00444690 -> 0x004133b0 -> 0x0040ee10 is the current checked-in replay family above live placed structures".to_string(),
                 "0x004133b0 rebuilds cloned local-runtime records through 0x0040e450 and 0x0040ee10 only republishes local position/scalar triplets before 0x0040e360".to_string(),
+                "direct local writer census now shows the grounded [site+0x276] write side clustering under live mutation families such as 0x004269b0 / 0x00426a10, the create-side 0x0040ef10 / 0x0040f6d0 strip, and the bulk reassignment families 0x00426dce..0x00426ea1 and 0x00430040..0x004300d6 rather than under the known replay strip".to_string(),
             ],
             blockers: vec![
-                "current atlas evidence does not tie 0x004133b0 / 0x0040ee10 directly to [site+0x276], so another owner strip is still needed for the owner-company lane".to_string(),
+                "current atlas evidence does not tie 0x004133b0 / 0x0040ee10 directly to [site+0x276], and the grounded write side now looks create-side or control-transfer-side rather than replay-side, so another restore or persisted owner strip is still needed for the owner-company lane".to_string(),
             ],
         },
         SmpServiceConsumerHypothesis {
@@ -4734,6 +4735,8 @@ fn build_periodic_company_service_trace_report(
         "0x00420030 / 0x00420280 peer-site boolean/selector pair over the placed-structure collection".to_string(),
         "0x0047efe0 placed_structure_query_linked_company_id returning owner company id from [site+0x276]".to_string(),
         "0x004269b0 acquisition commit owner resolving one site id through 0x0062b26c and then mutating [site+0x276]/[site+0x27a] on the chosen live row".to_string(),
+        "0x00426dce..0x00426ea1 bulk placed-structure owner-company reassignment over 0x0062b26c for non-subtype-4 rows matching the current company".to_string(),
+        "0x00430040..0x004300d6 filtered placed-structure owner-company overwrite over site classes 0x09/0x0b/0x0c".to_string(),
         "0x0047fd50 linked-peer candidate-class gate returning true only for class-byte values 0/1/2 at [candidate+0x8c]".to_string(),
         "0x004131f0 / 0x00412fb0 / 0x004120b0 / 0x00412ab0 aux-candidate load and stem-policy chain owning subtype byte [candidate+0x32]".to_string(),
         "0x0040dc40 station-detail linked-site mutation validator/apply path consuming [site+0x276], candidate field [candidate+0x22], and company stat-family 0x2329/0x0d"
@@ -4907,7 +4910,7 @@ fn build_periodic_company_service_trace_report(
                     "0x00406050 city-connection bonus/news sibling owner",
                 ],
                 &[
-                    "Direct disassembly now shows this branch scanning the live placed-structure collection at 0x0062b26c for the best current acquisition target, rejecting sites whose owner field [site+0x276] is already nonzero, reusing the center-cell token gate 0x0041f6e0 -> 0x0042b2d0, reusing the linked-region status branch 0x0047de00 -> 0x0040c990, checking candidate reachability through 0x004801a0, consulting the placed-structure peer-site boolean/selector pair 0x00420030 / 0x00420280 over 0x006cec20, scoring candidate sites against company proximity and age through 0x0040d540 and 0x0040cac0, and then committing the chosen site through 0x004269b0. The peer-site selector seam itself is now grounded through the local helper strip: 0x0040cd70 seeds [site+0x3cc/+0x3d0] from 0x62b2fc / 0x62b268, 0x0040ceab and 0x0040d1a1 reach the save-backed 0x0045c150 / 0x0045c310 owner directly, that owner fills [owner+0x23e/+0x242] from tagged payload 0x5dc1, and 0x0045c36e then feeds [owner+0x23e] through 0x00456100 -> 0x00455b70 -> 0x0052edf0 into the live backing-record selector [site+0x04]. The remaining linked-site field work is now about which of those persisted site/peer lanes are actually sufficient for shellless acquisition and city-connection behavior, not about who owns [site+0x04].",
+                    "Direct disassembly now shows this branch scanning the live placed-structure collection at 0x0062b26c for the best current acquisition target, rejecting sites whose owner field [site+0x276] is already nonzero, reusing the center-cell token gate 0x0041f6e0 -> 0x0042b2d0, reusing the linked-region status branch 0x0047de00 -> 0x0040c990, checking candidate reachability through 0x004801a0, consulting the placed-structure peer-site boolean/selector pair 0x00420030 / 0x00420280 over 0x006cec20, scoring candidate sites against company proximity and age through 0x0040d540 and 0x0040cac0, and then committing the chosen site through 0x004269b0. The peer-site selector seam itself is now grounded through the local helper strip: 0x0040cd70 seeds [site+0x3cc/+0x3d0] from 0x62b2fc / 0x62b268, 0x0040ceab and 0x0040d1a1 reach the save-backed 0x0045c150 / 0x0045c310 owner directly, that owner fills [owner+0x23e/+0x242] from tagged payload 0x5dc1, and 0x0045c36e then feeds [owner+0x23e] through 0x00456100 -> 0x00455b70 -> 0x0052edf0 into the live backing-record selector [site+0x04]. The remaining linked-site field work is now about which persisted site/peer lanes are actually sufficient for shellless acquisition and city-connection behavior, not about who owns [site+0x04] or [site+0x2a4].",
                 ],
             ));
             SmpPeriodicCompanyServiceTraceEntry {
@@ -4932,13 +4935,13 @@ fn build_periodic_company_service_trace_report(
         "Direct disassembly now narrows the acquisition-side sibling substantially: 0x004014b0 gates on the periodic outer owner, then scans the live placed-structure collection at 0x0062b26c, rejects sites whose owner field [site+0x276] is already nonzero, filters candidates through the subtype-4 predicate 0x0040d360, scores surviving sites against company linkage/age/proximity through 0x0040d540 and 0x0040cac0, and then commits the chosen site through 0x004269b0 before the shared news lane 0x004554e0 formats the headline.".to_string(),
     );
     notes.push(
-        "The shellless acquisition frontier is narrower now too: the peer-site selector/linked-peer seam is grounded enough to plan around, the company/chairman side now includes the save-native route-anchor tuple used by 0x00401860, the live owner-company meaning of [site+0x276] is grounded through 0x0047efe0 / 0x0040d210, the self-id meaning of [site+0x2a4] is grounded through 0x0041f7e0 / 0x0041f810 / 0x0041f850, constructor-side 0x00480210 already seeds that self-id lane for new linked-site rows, and the subtype owner strip is bounded under the aux-candidate load chain 0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0. The remaining blocker is the placed-structure-side restore or replay ownership for [site+0x276], [site+0x2a4], and the cached tri-lane [site+0x310/+0x338/+0x360], plus the projection from [site+0x04] back into the loaded candidate subtype row.".to_string(),
+        "The shellless acquisition frontier is narrower now too: the peer-site selector/linked-peer seam is grounded enough to plan around, the company/chairman side now includes the save-native route-anchor tuple used by 0x00401860, the live owner-company meaning of [site+0x276] is grounded through 0x0047efe0 / 0x0040d210, the self-id meaning of [site+0x2a4] is grounded through 0x0041f7e0 / 0x0041f810 / 0x0041f850, constructor-side 0x00480210 already seeds that self-id lane for new linked-site rows, 0x004269b0 resolves the chosen site id back through 0x0062b26c before mutating [site+0x276], and the subtype owner strip is bounded under the aux-candidate load chain 0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0. The remaining blocker is the placed-structure-side restore or replay ownership for [site+0x276] and the cached tri-lane [site+0x310/+0x338/+0x360], plus the projection from [site+0x04] back into the loaded candidate subtype row.".to_string(),
     );
     notes.push(
         "The acquisition-side consumer family is tighter now too. The checked-in station-detail action path 0x0040dc40 already consumes live owner company [site+0x276], candidate field [candidate+0x22], company stat-family 0x2329/0x0d, projected-cell validation 0x00417840 -> 0x004197e0, and compact-grid replay 0x004142c0/0x004142d0 before it commits the linked-site mutation through 0x0040d1f0 -> 0x00480710 -> 0x0045b160 / 0x0045b9b0 / 0x00418be0 / 0x0040cd70. That means these lanes are already grounded as live preconditions and mutation-side rebuild inputs, even though the save or replay owner that populates them for shellless acquisition is still the open question.".to_string(),
     );
     notes.push(
-        "The create-side family is grounded separately too. City-connection direct placement already reaches the shared constructor/finalize strip 0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10, so the remaining shellless gap is no longer 'how are new placed structures finalized?' It is specifically how restored existing rows regain the owner-company lane, self-id lane, cached tri-lane, and cached candidate bridge before acquisition-style consumers run.".to_string(),
+        "The create-side family is grounded separately too. City-connection direct placement already reaches the shared constructor/finalize strip 0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10, and the direct writer census now shows [site+0x276] writes clustering under create-side, acquisition-side, and bulk control-transfer families rather than under the known replay strip. So the remaining shellless gap is no longer 'how are new placed structures finalized?' or '[site+0x2a4] mystery'; it is specifically how restored existing rows regain the owner-company lane and cached tri-lane before acquisition-style consumers run.".to_string(),
     );
     notes.push(
         "The tri-lane restore side is narrower now too. The checked-in dynamic side-buffer load owner 0x00481430 -> 0x0047d8e0 repopulates the route-entry list, three per-site byte arrays, five proximity buckets, and the trailing scratch band from stream, so that seam is no longer a plausible hidden owner for [site+0x310/+0x338/+0x360]. The remaining tri-lane question is now specifically a later restore family beyond the known triplet and side-buffer seams.".to_string(),
@@ -27954,7 +27957,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 9);
-        assert_eq!(trace.known_bridge_helpers.len(), 53);
+        assert_eq!(trace.known_bridge_helpers.len(), 55);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28362,6 +28365,18 @@ mod tests {
                     && line.contains("0x0062b26c")
                     && line.contains("[site+0x276]/[site+0x27a]"))
         );
+        assert!(trace.known_bridge_helpers.iter().any(
+            |line| line.contains("0x00426dce..0x00426ea1")
+                && line.contains("0x0062b26c")
+                && line.contains("non-subtype-4")
+        ));
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x00430040..0x004300d6")
+                    && line.contains("0x09/0x0b/0x0c"))
+        );
         assert!(
             trace
                 .known_bridge_helpers
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index 30da85c..cfbc5b4 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -133,14 +133,19 @@ Working rule:
     `0x2329/0x0d`, candidate field `[candidate+0x22]`, and the projected-cell validation strip
     `0x00417840 -> 0x004197e0`, then commits the linked-site mutation through
     `0x0040d1f0 / 0x00480710 / 0x0045b160 / 0x0045b9b0 / 0x00418be0 / 0x0040cd70`
+  - the direct writer census now narrows the remaining owner-company question too:
+    grounded `[site+0x276]` writes cluster under create-side and live mutation families such as
+    `0x004269b0 / 0x00426a10`, the create-side `0x0040ef10 / 0x0040f6d0` strip, and the bulk
+    reassignment families `0x00426dce..0x00426ea1` and `0x00430040..0x004300d6`, not under the
+    known `0x00444690 -> 0x004133b0 -> 0x0040ee10` replay strip
   - the create-side family is grounded separately too:
     city-connection direct placement already reaches
     `0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10`
     as the shared constructor/finalize strip for newly created site rows
   - so the acquisition blocker is no longer “is there any real consumer family above these
-    lanes?” or “how do new placed structures finalize?”; it is specifically the restore or replay
-    owner that populates those live preconditions for already-restored rows before shellless
-    acquisition runs
+    lanes?”, “how do new placed structures finalize?”, or “is `[site+0x2a4]` still missing?”; it
+    is specifically the restore or replay owner that populates `[site+0x276]` plus the cached
+    tri-lane for already-restored rows before shellless acquisition runs
   - direct disassembly now shows the generic base constructor `0x0052edf0` clearing base state
     through `0x0052ecd0` and then writing `[this+0x04]` from caller arg `1`
   - `0x00455b70` is the concrete placed-structure specialization constructor feeding