Narrow linked-transit replay branch consumers

crates/rrt-runtime/src/smp.rs

@@ -5021,7 +5021,7 @@ fn build_periodic_company_service_trace_report(
         "linked-transit train-side autoroute append / rotate strip 0x00409770 plus add-train owner 0x00409830 beneath roster balancer 0x00409950".to_string(),
     ];
     let linked_transit_remaining_owner_gaps = vec![
-        "which exact branch inside the known placed-structure replay continuation 0x0040e360..0x0040edf6 rehydrates [site+0x276], [site+0x2a4], and linked-peer rows beyond the already-grounded 0x00480710 anchor-side refresh before 0x004093d0 / 0x00407bd0 rebuild their scratch cache lanes".to_string(),
+        "which earlier restore or service owner feeds [site+0x276] and the live linked-peer rows before replay continuation 0x0040e360..0x0040edf6, now that direct inspection shows the 0x0040ea96..0x0040eb65 owner-company branch only consumes [site+0x276] and subtype-4 follow-on 0x0040eba0 already republishes [site+0x2a4] into the world-cell chains before 0x004093d0 / 0x00407bd0 rebuild their scratch cache lanes".to_string(),
         "how much of the live placed-structure collection 0x006cec20 and linked-peer replay strip still has to run shelllessly beside already-grounded candidate-table owner 0x0041f4e0 / 0x0041ede0 and route-entry tracker owner 0x00494fb0 / 0x004a6360 before 0x00408280 / 0x00408380 / 0x00409770 become trustworthy".to_string(),
     ];
 
@@ -5229,7 +5229,7 @@ fn build_periodic_company_service_trace_report(
         "The per-company cache root is grounded now too: 0x00407780 allocates [site+0x5bd] as a 0x20-entry pointer table and seeds each entry with one zeroed 0x1a-byte company cache cell, while 0x004077e0 frees that same root and any nested cell payloads. That means the remaining linked-transit gap is no longer cache-root allocation identity; it is which persisted site-side inputs are sufficient to repopulate those per-company cells and the downstream score lanes before the bounded chooser/train strip runs shelllessly.".to_string(),
     );
     notes.push(
-        "The per-company cache-cell layout is bounded now too: 0x004093d0 and 0x00407bd0 use bytes +0x00/+0x01 as the initial participation gates, dword +0x02 as the peer-row count, dword +0x06 as the peer-row pointer, dword +0x0a as the shorter peer-cache refresh stamp, and floats +0x0e/+0x12/+0x16 as the weighted/raw/final linked-transit score lanes. The candidate-table and route-entry-tracker owners are bounded above that too: 0x0062ba8c is constructed through 0x0041f4e0 -> 0x0041ede0 -> 0x0041e970, while 0x004a6360 / 0x004a6630 sit under owner-notify refresh 0x00494fb0. The remaining linked-transit gap is therefore inside the known placed-structure replay continuation: 0x00444690 -> 0x004133b0 -> 0x0040ee10 -> 0x0040edf6 -> 0x00480710 already republishes anchor-side linked-peer state, but the later exact branch that rehydrates [site+0x276], [site+0x2a4], and the live peer rows for shellless cache rebuilds is still the open question.".to_string(),
+        "The per-company cache-cell layout is bounded now too: 0x004093d0 and 0x00407bd0 use bytes +0x00/+0x01 as the initial participation gates, dword +0x02 as the peer-row count, dword +0x06 as the peer-row pointer, dword +0x0a as the shorter peer-cache refresh stamp, and floats +0x0e/+0x12/+0x16 as the weighted/raw/final linked-transit score lanes. The candidate-table and route-entry-tracker owners are bounded above that too: 0x0062ba8c is constructed through 0x0041f4e0 -> 0x0041ede0 -> 0x0041e970, while 0x004a6360 / 0x004a6630 sit under owner-notify refresh 0x00494fb0. The remaining linked-transit gap is narrower again: subtype-4 follow-on 0x0040eba0 already republishes [site+0x2a4] through 0x004814c0 / 0x00481480 and world-cell chain helpers 0x0042c9f0 / 0x0042c9a0, and direct inspection of 0x0040ea96..0x0040eb65 shows that owner-company branch only consumes [site+0x276] rather than rehydrating it. That pushes the open question one level earlier to whichever restore or service owner feeds [site+0x276] and the live linked-peer rows before this replay continuation runs.".to_string(),
     );
     notes.push(
         "Direct disassembly now closes the negative persistence side too: the direct 0x36b1 per-record callbacks serialize the shared base scalar triplets rooted at [this+0x206/+0x20a/+0x20e] plus the subordinate payload callback strip, while the 0x4a9d/0x4a3a/0x4a3b side-buffer owner only persists route-entry lists, three byte arrays, five proximity buckets, and the sampled-cell list. That means neither checked-in save owner seam currently persists the core peer-site identity fields [site+0x04], [site+0x2a8], or [peer+0x08] directly.".to_string(),
@@ -28857,7 +28857,7 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("0x0040e360..0x0040edf6")
                     && line.contains("[site+0x276]")
-                    && line.contains("[site+0x2a4]"))
+                    && line.contains("earlier restore or service owner"))
         );
         assert!(
             trace
@@ -29098,14 +29098,25 @@ mod tests {
             line.contains("0x0062ba8c")
                 && line.contains("0x0041f4e0")
                 && line.contains("0x00494fb0")
-                && line.contains("remaining linked-transit gap is therefore inside the known placed-structure replay continuation")
+                && line.contains("remaining linked-transit gap is narrower again")
         }));
         assert!(trace.notes.iter().any(|line| {
-            line.contains("0x00444690")
+            line.contains("0x00409720")
-                && line.contains("0x004133b0")
+                && line.contains("0x004093d0")
-                && line.contains("0x0040ee10")
+                && line.contains("0x00407bd0")
-                && line.contains("0x0040edf6")
+                && line.contains("0x00409950")
+        }));
+        assert!(trace.notes.iter().any(|line| {
+            line.contains("0x0040eba0")
+                && line.contains("[site+0x2a4]")
+                && line.contains("0x004814c0 / 0x00481480")
+                && line.contains("0x0042c9f0 / 0x0042c9a0")
+        }));
+        assert!(trace.notes.iter().any(|line| {
+            line.contains("0x0040ea96..0x0040eb65")
                 && line.contains("[site+0x276]")
+                && line.contains("consumes")
+                && line.contains("rather than rehydrating")
         }));
         assert!(
             trace

docs/rehost-queue.md

@@ -55,11 +55,19 @@ Working rule:
     `0x00444690 -> 0x004133b0 -> 0x0040ee10 -> 0x0040edf6 -> 0x00480710` already republishes
     anchor-side linked-peer ids, route-entry anchors, and world-cell owner chains, and later
     runtime path `0x004160aa -> 0x0040ee10` re-enters the same family outside bring-up
+  - the subtype-`4` follow-on is tighter now too:
+    `0x0040eba0` already republishes `[site+0x2a4]` through `0x004814c0 / 0x00481480` plus
+    world-cell chain helpers `0x0042c9f0 / 0x0042c9a0`, so self-id replay is no longer the open
+    linked-transit blocker
+  - the owner-company branch is tighter now too:
+    direct inspection of `0x0040ea96..0x0040eb65` shows that it consumes `[site+0x276]` and
+    branches through owner/company helpers, but does not itself rehydrate `[site+0x276]`
   - that makes the next linked-transit question narrower:
-    identify which exact branch inside `0x0040e360..0x0040edf6` rehydrates `[site+0x276]`,
+    identify which earlier restore or service owner feeds `[site+0x276]` and the live linked-peer
-    `[site+0x2a4]`, and the live linked-peer rows beyond the already-grounded `0x00480710`
+    rows before replay continuation `0x0040e360..0x0040edf6`, beyond the already-grounded
-    anchor-side refresh before `0x004093d0 / 0x00407bd0 / 0x004a6630`, because the candidate
+    `0x00480710` anchor-side refresh, before `0x004093d0 / 0x00407bd0 / 0x004a6630`, because the
-    table, route-entry-tracker owners, replay-strip framing, bounded train-side strip
+    candidate table, route-entry-tracker owners, replay-strip framing, subtype-`4` self-id replay,
+    bounded train-side strip
     `0x00409770 / 0x00409830 / 0x00409950`, and cache-cell semantics are no longer the blocker
 - Make the next static/rehost slice the near-city industry acquisition owner seam under
   `0x004014b0`, not another generic infrastructure pass. The concrete questions are: