diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 0f5925a..fdf03d4 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -4586,6 +4586,8 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "city-connection direct-placement family 0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10 already grounds the shared allocator/finalize path for newly created site rows"
             .to_string(),
+        "opcode-dispatch strip 0x00431b20 routes grouped 0x0061039c opcodes into the same live site-mutation helpers 0x00430040 / 0x00426d60 / 0x0042fc90 rather than the bring-up replay family"
+            .to_string(),
         "company stat-family lane 0x2329/0x0d already rehosted in runtime company state".to_string(),
         "company market state now carries the save-native linked-transit route-anchor tuple [company+0x0d35] and [company+0x7664/+0x7668/+0x766c]"
             .to_string(),
@@ -4622,6 +4624,8 @@ fn build_periodic_company_service_trace_report(
                 "0x00444690 -> 0x004133b0 -> 0x0040ee10 is the current checked-in replay family above live placed structures".to_string(),
                 "0x004133b0 rebuilds cloned local-runtime records through 0x0040e450 and 0x0040ee10 only republishes local position/scalar triplets before 0x0040e360".to_string(),
                 "direct local writer census now shows the grounded [site+0x276] write side clustering under live mutation families such as 0x004269b0 / 0x00426a10, the create-side 0x0040ef10 / 0x0040f6d0 strip, and the bulk reassignment families 0x00426dce..0x00426ea1 and 0x00430040..0x004300d6 rather than under the known replay strip".to_string(),
+                "direct local control-flow reconstruction now shows those same writer families hanging under the 0x00431b20 opcode dispatcher over 0x0061039c: opcodes 0x04..0x07 dispatch to 0x00430040, opcodes 0x08/0x10..0x13 dispatch to 0x00426d60, and opcodes 0x0d/0x16 dispatch to 0x0042fc90".to_string(),
+                "0x0042fc90 itself iterates the live placed-structure collection 0x0062b26c, filters rows through 0x0040c990 plus optional company match [site+0x276], and then dispatches row vtable slot +0x70, which keeps that branch on the live application side rather than replay".to_string(),
             ],
             blockers: vec![
                 "current atlas evidence does not tie 0x004133b0 / 0x0040ee10 directly to [site+0x276], and the grounded write side now looks create-side or control-transfer-side rather than replay-side, so another restore or persisted owner strip is still needed for the owner-company lane".to_string(),
@@ -4738,6 +4742,8 @@ fn build_periodic_company_service_trace_report(
         "0x004269b0 acquisition commit owner resolving one site id through 0x0062b26c and then mutating [site+0x276]/[site+0x27a] on the chosen live row".to_string(),
         "0x00426dce..0x00426ea1 bulk placed-structure owner-company reassignment over 0x0062b26c for non-subtype-4 rows matching the current company".to_string(),
         "0x00430040..0x004300d6 filtered placed-structure owner-company overwrite over site classes 0x09/0x0b/0x0c".to_string(),
+        "0x00431b20 grouped opcode dispatcher over 0x0061039c routing opcodes 0x04..0x07 to 0x00430040, 0x08/0x10..0x13 to 0x00426d60, and 0x0d/0x16 to 0x0042fc90".to_string(),
+        "0x0042fc90 live placed-structure mutator iterating 0x0062b26c through 0x0040c990, optional owner-company match [site+0x276], and row vtable slot +0x70".to_string(),
         "0x0047fd50 linked-peer candidate-class gate returning true only for class-byte values 0/1/2 at [candidate+0x8c]".to_string(),
         "0x004131f0 / 0x00412fb0 / 0x004120b0 / 0x00412ab0 aux-candidate load and stem-policy chain owning subtype byte [candidate+0x32]".to_string(),
         "0x0040dc40 station-detail linked-site mutation validator/apply path consuming [site+0x276], candidate field [candidate+0x22], and company stat-family 0x2329/0x0d"
@@ -4784,7 +4790,7 @@ fn build_periodic_company_service_trace_report(
     let next_owner_questions = vec![
         "Which persisted placed-structure and city-or-region linkage fields are still missing for a shellless 0x004014b0 implementation once the peer-site restore subset, company route-anchor tuple, [site+0x276] live owner meaning, and candidate subtype owner strip are accepted as grounded?".to_string(),
         "How much of the linked-peer refresh path is strictly post-load versus recurring runtime maintenance now that 0x004133b0 reaches 0x0040ee10 -> 0x0040edf6 -> 0x00480710 during bring-up and 0x004160aa also re-enters 0x0040ee10 later?".to_string(),
-        "Which later save payload or restore owner rehydrates the remaining placed-structure-side 0x004014b0 inputs [site+0x276] and [site+0x310/+0x338/+0x360] once [site+0x2a4] is treated as reconstructible from collection identity and peer/company inputs are accepted as grounded?".to_string(),
+        "Which later save payload or restore owner rehydrates the remaining placed-structure-side 0x004014b0 inputs [site+0x276] and [site+0x310/+0x338/+0x360] once [site+0x2a4] is treated as reconstructible from collection identity, the replay strip is ruled down, and the 0x00431b20 grouped opcode dispatcher is treated as a live application owner rather than a restore seam?".to_string(),
         "Which infrastructure consumer above the grounded 0x38a5 seam actually drives the linked-transit branch that 0x00409950 follows?".to_string(),
     ];
 
@@ -27960,7 +27966,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 9);
-        assert_eq!(trace.known_bridge_helpers.len(), 57);
+        assert_eq!(trace.known_bridge_helpers.len(), 59);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28127,7 +28133,7 @@ mod tests {
             trace
                 .near_city_acquisition_runtime_backed_input_families
                 .len(),
-            13
+            14
         );
         assert_eq!(trace.near_city_acquisition_remaining_owner_gaps.len(), 2);
         assert_eq!(trace.near_city_acquisition_region_lane_statuses.len(), 4);
@@ -28231,6 +28237,14 @@ mod tests {
                 .any(|line| line
                     .contains("0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10"))
         );
+        assert!(
+            trace
+                .near_city_acquisition_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("0x00431b20")
+                    && line.contains("0x0061039c")
+                    && line.contains("0x00430040 / 0x00426d60 / 0x0042fc90"))
+        );
         assert!(
             trace
                 .near_city_acquisition_runtime_backed_input_families
@@ -28388,6 +28402,25 @@ mod tests {
                 .any(|line| line.contains("0x00430040..0x004300d6")
                     && line.contains("0x09/0x0b/0x0c"))
         );
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x00431b20")
+                    && line.contains("0x0061039c")
+                    && line.contains("0x00430040")
+                    && line.contains("0x00426d60")
+                    && line.contains("0x0042fc90"))
+        );
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x0042fc90")
+                    && line.contains("0x0062b26c")
+                    && line.contains("[site+0x276]")
+                    && line.contains("vtable slot +0x70"))
+        );
         assert!(
             trace
                 .known_bridge_helpers
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index 5b9aa28..5d1a171 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -142,6 +142,15 @@ Working rule:
     `0x004269b0 / 0x00426a10`, the create-side `0x0040ef10 / 0x0040f6d0` strip, and the bulk
     reassignment families `0x00426dce..0x00426ea1` and `0x00430040..0x004300d6`, not under the
     known `0x00444690 -> 0x004133b0 -> 0x0040ee10` replay strip
+  - the same write side is now grounded one level higher too:
+    direct local control-flow reconstruction shows those families hanging under the grouped opcode
+    dispatcher `0x00431b20` over `0x0061039c`, with opcodes `0x04..0x07` dispatching to
+    `0x00430040`, opcodes `0x08/0x10..0x13` dispatching to `0x00426d60`, and opcodes
+    `0x0d/0x16` dispatching to `0x0042fc90`
+  - `0x0042fc90` itself is now ruled onto the live mutation side too:
+    it iterates the live placed-structure collection `0x0062b26c`, filters rows through
+    `0x0040c990`, optional owner-company match `[site+0x276]`, and row vtable slot `+0x70`,
+    which keeps that branch on the live application side rather than replay
   - the create-side family is grounded separately too:
     city-connection direct placement already reaches
     `0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10`