diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 302496f..92df26d 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -4989,6 +4989,7 @@ fn build_periodic_company_service_trace_report(
         "company linked-transit latch [company+0x0d56] consumed by 0x00409950 and the annual-finance debt lane".to_string(),
         "placed-structure-side company cache root [site+0x5bd] allocated by 0x00407780 as a 0x20-entry pointer table of 0x1a-byte per-company cache cells and freed by 0x004077e0".to_string(),
         "placed-structure-side per-company cache cells addressed through [site+0x5bd][company_id] and peer rows filled by 0x004a6630".to_string(),
+        "per-company cache-cell layout is bounded too: bytes +0x00/+0x01 gate participation, dword +0x02 is peer-row count, dword +0x06 is peer-row pointer, dword +0x0a is the peer-cache refresh stamp, and floats +0x0e/+0x12/+0x16 are the weighted/raw/final linked-transit score lanes".to_string(),
         "linked-transit peer-table row lanes +0x05 step count and +0x09 normalized continuity share under 0x004093d0".to_string(),
         "linked-transit site-score cache lanes [site+0x0e/+0x12/+0x16] rebuilt by 0x00407bd0".to_string(),
         "linked-transit local site occupancy/count lane [site+0x5c1] reset by 0x00481910, adjusted by 0x004819b0, and consumed by 0x00408280 as a divisor/penalty lane".to_string(),
@@ -5205,6 +5206,9 @@ fn build_periodic_company_service_trace_report(
     notes.push(
         "The per-company cache root is grounded now too: 0x00407780 allocates [site+0x5bd] as a 0x20-entry pointer table and seeds each entry with one zeroed 0x1a-byte company cache cell, while 0x004077e0 frees that same root and any nested cell payloads. That means the remaining linked-transit gap is no longer cache-root allocation identity; it is which persisted site-side inputs are sufficient to repopulate those per-company cells and the downstream score lanes before the bounded chooser/train strip runs shelllessly.".to_string(),
     );
+    notes.push(
+        "The per-company cache-cell layout is bounded now too: 0x004093d0 and 0x00407bd0 use bytes +0x00/+0x01 as the initial participation gates, dword +0x02 as the peer-row count, dword +0x06 as the peer-row pointer, dword +0x0a as the shorter peer-cache refresh stamp, and floats +0x0e/+0x12/+0x16 as the weighted/raw/final linked-transit score lanes. So the remaining linked-transit gap is no longer cell layout; it is the persisted site-side inputs and restore/service owners that repopulate those already-bounded cells.".to_string(),
+    );
     notes.push(
         "Direct disassembly now closes the negative persistence side too: the direct 0x36b1 per-record callbacks serialize the shared base scalar triplets rooted at [this+0x206/+0x20a/+0x20e] plus the subordinate payload callback strip, while the 0x4a9d/0x4a3a/0x4a3b side-buffer owner only persists route-entry lists, three byte arrays, five proximity buckets, and the sampled-cell list. That means neither checked-in save owner seam currently persists the core peer-site identity fields [site+0x04], [site+0x2a8], or [peer+0x08] directly.".to_string(),
     );
@@ -28251,7 +28255,7 @@ mod tests {
             trace.linked_transit_shellless_readiness_status,
             "timed_cache_and_train_side_followons_grounded_site_cache_input_owners_missing"
         );
-        assert_eq!(trace.linked_transit_runtime_backed_input_families.len(), 13);
+        assert_eq!(trace.linked_transit_runtime_backed_input_families.len(), 14);
         assert_eq!(trace.linked_transit_remaining_owner_gaps.len(), 2);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28711,6 +28715,16 @@ mod tests {
                     && line.contains("0x00407780")
                     && line.contains("0x004077e0"))
         );
+        assert!(
+            trace
+                .linked_transit_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("+0x00/+0x01")
+                    && line.contains("+0x02")
+                    && line.contains("+0x06")
+                    && line.contains("+0x0a")
+                    && line.contains("+0x0e/+0x12/+0x16"))
+        );
         assert!(
             trace
                 .linked_transit_runtime_backed_input_families
@@ -28952,6 +28966,14 @@ mod tests {
                 && line.contains("[site+0x5bd]")
                 && line.contains("0x1a-byte")
         }));
+        assert!(trace.notes.iter().any(|line| {
+            line.contains("0x004093d0")
+                && line.contains("0x00407bd0")
+                && line.contains("+0x02")
+                && line.contains("+0x06")
+                && line.contains("+0x0a")
+                && line.contains("+0x0e/+0x12/+0x16")
+        }));
         assert!(
             trace
                 .near_city_acquisition_runtime_backed_input_families
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index 18138f4..de9b874 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -35,6 +35,10 @@ Working rule:
   - the per-company cache root is bounded too:
     `[site+0x5bd]` is allocated by `0x00407780` as a 0x20-entry table of 0x1a-byte per-company
     cache cells and freed by `0x004077e0`
+  - the per-company cache-cell layout is bounded too:
+    bytes `+0x00/+0x01` gate participation, dwords `+0x02/+0x06/+0x0a` hold peer count, peer
+    pointer, and peer-cache refresh stamp, and floats `+0x0e/+0x12/+0x16` are the
+    weighted/raw/final score lanes
   - that makes the next linked-transit question narrower:
     identify which persisted site-side inputs are sufficient to repopulate the per-company cache
     cells, occupancy/age lanes, and weighted site-score lanes consumed by