Ground infrastructure composition chooser strip

crates/rrt-runtime/src/smp.rs

@@ -4261,6 +4261,7 @@ fn build_infrastructure_asset_trace_report(
         .count();
     let atlas_candidate_consumers = vec![
         "0x00493be0 infrastructure tagged side-buffer collection load owner".to_string(),
+        "0x004a2c80 infrastructure composition chooser owner".to_string(),
         "0x0048a1e0 infrastructure child attach helper".to_string(),
         "0x0048dcf0 infrastructure tagged child-stream restore outer owner".to_string(),
         "0x0048dd50 infrastructure child rebuild loop".to_string(),
@@ -4282,6 +4283,7 @@ fn build_infrastructure_asset_trace_report(
     ];
     let known_bridge_helpers = vec![
         "0x00493be0 tagged 0x38a5/0x38a6/0x38a7 collection load owner".to_string(),
+        "0x004a2c80 upstream infrastructure composition chooser with lookup tables 0x621a44..0x621a9c".to_string(),
         "0x00455a50 raw vtable slot +0x40 dispatch wrapper with global bridge reset".to_string(),
         "0x00518140 indexed_collection_resolve_live_entry_payload_pointer_by_live_id".to_string(),
         "0x005181f0 indexed_collection_unlink_non_direct_live_entry".to_string(),
@@ -4297,7 +4299,7 @@ fn build_infrastructure_asset_trace_report(
         "0x0048e140 / 0x0048e160 / 0x0048e180 route-entry resolver helpers".to_string(),
     ];
     let next_owner_questions = vec![
-        "Which upstream owner or boundary emits the grounded pure bridge-section class 0x0002/0xff before it reaches the two-child clone-path above 0x0048a1e0 and 0x0048dcf0?".to_string(),
+        "Inside the grounded upstream chooser 0x004a2c80..0x004a37de, which lookup-table families at 0x621a44..0x621a9c emit the grounded pure bridge-section class 0x0002/0xff before it reaches the two-child clone-path above 0x0048a1e0 and 0x0048dcf0?".to_string(),
         "Which upstream owner or boundary emits the pure BallastCap class 0x0055/0x00 if it is only a BallastCap-specific boundary artifact rather than a real outer prelude consumed by 0x0048dcf0?".to_string(),
         "Which 0x38a5 embedded name-pair groups survive into the per-child vtable +0x40 payload callbacks dispatched through 0x00455a50?".to_string(),
         "Is cached primary-child slot [this+0x248] the first owner-visible bridge from the restored child stream into route-entry rebuild once the bridge two-child class is isolated?".to_string(),
@@ -4330,6 +4332,7 @@ fn build_infrastructure_asset_trace_report(
                 "atlas already bounds these helpers under the literal Infrastructure owner".to_string(),
                 "the side-buffer corpus is disjoint from the placed-structure triplet corpus, so a separate child/rebuild family is more plausible than a compact alias".to_string(),
                 "direct disassembly now shows 0x00493be0 opening tag family 0x38a5/0x38a6/0x38a7, reading one shared dword into the owner-local 0x90/0x94 lane, iterating each live collection entry, and dispatching every loaded infrastructure record through 0x0048dcf0 before the later follow-on owners run".to_string(),
+                "direct disassembly now also grounds a dense upstream chooser strip at 0x004a2c80..0x004a37de: it repeatedly calls 0x0048a1e0, branches on child type codes at [this+0x226], selector bytes at [this+0x219]/[this+0x251], bit 0x20 in [this+0x24c], and lookup tables 0x621a44..0x621a9c before routing follow-on through 0x0048a340/0x0048f4c0/0x00490200/0x00490960".to_string(),
                 side_buffer
                     .and_then(|probe| probe.first_record_child_count_after_owner_shared)
                     .map(|child_count| {
@@ -4656,6 +4659,7 @@ fn build_infrastructure_asset_trace_report(
                 "the smaller attach primitive 0x00490a3c no longer looks like the semantic fork by itself: it just allocates one literal Infrastructure child, seeds it through 0x455b70 with caller-provided stem input, attaches it through 0x5395d0, seeds position lanes through 0x539530/0x53a5b0, and optionally caches it as primary child".to_string(),
             ],
             blockers: vec![
+                "how the upstream chooser tables at 0x621a44..0x621a9c map onto the grounded 0x38a5 compact-prefix and name-pair classes, especially the bridge-only 0x0002/0xff class and the BallastCap-only 0x0055/0x00 class".to_string(),
                 "how the payload streams reached through 0x00518380 -> 0x00518140 align with the embedded 0x55f1 name-pair groups and compact-prefix regimes surfaced by the save-side probe".to_string(),
                 "how the observed 0x55f3-to-next-0x55f1 gaps partition between the two 0x52ebd0 flag bytes and the next-record prelude now that the first 0x38a6 record head is grounded as child_count=1, saved_primary_child_byte=0xff, first 0x55f1 at +0x3".to_string(),
                 "which restored child fields or grouped rows retain the 0x38a5 embedded name-pair semantics before route/local-runtime follow-ons take over".to_string(),
@@ -4770,7 +4774,7 @@ fn build_infrastructure_asset_trace_report(
         ),
     ];
     let notes = vec![
-        "Infrastructure asset trace now makes the side-buffer-versus-triplet split explicit: owner seam identity is grounded, the pure bridge-only 0x0002/0xff candidate class is grounded save-side, and the remaining unknown is the upstream chooser above the child attach path.".to_string(),
+        "Infrastructure asset trace now makes the side-buffer-versus-triplet split explicit: owner seam identity is grounded, the pure bridge-only 0x0002/0xff candidate class is grounded save-side, and the upstream chooser above the child attach path is now grounded as 0x004a2c80..0x004a37de; the remaining unknown is the table-to-class mapping inside that chooser.".to_string(),
     ];
     SmpInfrastructureAssetTraceReport {
         profile_family: analysis.profile_family.clone(),
@@ -24353,19 +24357,40 @@ mod tests {
         assert!(trace.side_buffer_present);
         assert_eq!(trace.triplet_alignment_overlap_count, 0);
         assert_eq!(trace.known_owner_bridge_fields.len(), 7);
-        assert_eq!(trace.known_bridge_helpers.len(), 13);
+        assert_eq!(trace.known_bridge_helpers.len(), 14);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert!(trace
             .next_owner_questions
             .iter()
             .any(|line| line.contains("0x0002/0xff")
-                && line.contains("emits")
+                && line.contains("0x004a2c80")
                 && line.contains("two-child clone-path")));
+        assert!(trace
+            .known_bridge_helpers
+            .iter()
+            .any(|line| line.contains("0x004a2c80")
+                && line.contains("0x621a44..0x621a9c")));
         assert_eq!(trace.candidate_consumer_hypotheses.len(), 3);
         assert_eq!(
             trace.candidate_consumer_hypotheses[0].status,
             "highest_priority_static_mapping_target"
         );
+        assert!(
+            trace.candidate_consumer_hypotheses[0]
+                .evidence
+                .iter()
+                .any(|line| line.contains("0x004a2c80..0x004a37de")
+                    && line.contains("0x621a44..0x621a9c")
+                    && line.contains("0x0048a340/0x0048f4c0/0x00490200/0x00490960"))
+        );
+        assert!(
+            trace.candidate_consumer_hypotheses[0]
+                .blockers
+                .iter()
+                .any(|line| line.contains("0x621a44..0x621a9c")
+                    && line.contains("0x0002/0xff")
+                    && line.contains("0x0055/0x00"))
+        );
         assert!(
             trace.candidate_consumer_hypotheses[0]
                 .evidence
@@ -24399,6 +24424,7 @@ mod tests {
         );
         assert!(trace.notes.iter().any(|line| {
             line.contains("0x0002/0xff candidate class is grounded save-side")
+                && line.contains("0x004a2c80..0x004a37de")
         }));
         assert!(
             trace.candidate_consumer_hypotheses[0]

docs/control-loop-atlas/runtime-roots-camera-and-support-families.md

@@ -3001,6 +3001,13 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0`
   `0x0002 / 0xff` as the grounded save-side bridge-specific two-child candidate class above
   `0x0048a1e0/0x0048dcf0`, with the remaining unknown narrowed to the upstream chooser that emits
   that class before the attach/rebuild path runs.
+  That upstream chooser is grounded now too: direct disassembly of `0x004a2c80..0x004a37de`
+  shows a dense infrastructure composition strip repeatedly calling `0x0048a1e0`, branching on
+  `[this+0x226]`, selector bytes `[this+0x219]/[this+0x251]`, bit `0x20` in `[this+0x24c]`, and
+  lookup tables `0x621a44..0x621a9c`, then routing follow-on through
+  `0x0048a340/0x0048f4c0/0x00490200/0x00490960`. So the remaining infrastructure question is no
+  longer “is there an upstream chooser?” but “which lookup-table families inside that chooser map
+  to the grounded `0x0002 / 0xff` bridge class and the `0x0055 / 0x00` BallastCap class?”.
   The child loader family is explicit now too: local `.rdata` at `0x005cfd00` proves the
   `Infrastructure` child vtable uses the shared tagged callback strip directly, with
   `+0x40 = 0x00455fc0`, `+0x48 = 0x00455870`, and `+0x4c = 0x00455930`. So the remaining

docs/rehost-queue.md

@@ -152,6 +152,13 @@ Working rule:
   `0x0002 / 0xff` as the grounded save-side bridge-specific two-child candidate class above
   `0x0048a1e0/0x0048dcf0`, with the remaining unknown narrowed to the upstream chooser that emits
   that class before the attach/rebuild path runs.
+- That upstream chooser is grounded now too: direct disassembly of `0x004a2c80..0x004a37de`
+  shows a dense infrastructure composition strip repeatedly calling `0x0048a1e0`, branching on
+  `[this+0x226]`, selector bytes `[this+0x219]/[this+0x251]`, bit `0x20` in `[this+0x24c]`, and
+  lookup tables `0x621a44..0x621a9c`, then routing follow-on through
+  `0x0048a340/0x0048f4c0/0x00490200/0x00490960`. So the remaining infrastructure question is no
+  longer “is there an upstream chooser?” but “which lookup-table families inside that chooser map
+  to the grounded `0x0002 / 0xff` bridge class and the `0x0055 / 0x00` BallastCap class?”.
 - Reconstruct the save-side region record body on top of the newly corrected non-direct tagged
   region seam (`0x5209/0x520a/0x520b`, stride hint `0x06`, `Marker09` record stems) now that the
   `0x55f3` payload is known to be fully consumed by the embedded profile collection on grounded