Narrow region save payload blocker

crates/rrt-runtime/src/smp.rs

@@ -3252,7 +3252,7 @@ pub fn load_save_slice_from_report(
     }
     if let Some(probe) = &report.save_region_record_triplet_probe {
         notes.push(format!(
-            "Raw save tagged region records also expose {} repeated 0x55f1/0x55f2/0x55f3 triplets in the records span; first name={:?}, first policy lanes=({:.3}, {:.3}, {:.3}), trailing_word={}, first profile collection count={:?}.",
+            "Raw save tagged region records also expose {} repeated 0x55f1/0x55f2/0x55f3 triplets in the records span; first name={:?}, first policy lanes=({:.3}, {:.3}, {:.3}), trailing_word={}, first profile collection count={:?}, first profile collection trailing_padding_len={:?}.",
             probe.record_count,
             probe.entries.first().map(|entry| entry.name.as_str()),
             probe.entries
@@ -3273,6 +3273,9 @@ pub fn load_save_slice_from_report(
                 .unwrap_or("0x0000"),
             probe.entries.first().and_then(|entry| {
                 entry.profile_collection.as_ref().map(|collection| collection.live_record_count)
+            }),
+            probe.entries.first().and_then(|entry| {
+                entry.profile_collection.as_ref().map(|collection| collection.trailing_padding_len)
             })
         ));
     }
@@ -3678,7 +3681,7 @@ pub fn inspect_save_company_and_chairman_analysis_bytes(
     }
     if let Some(triplets) = region_record_triplets.as_ref() {
         notes.push(format!(
-            "Region analysis now also exports {} tagged 0x55f1/0x55f2/0x55f3 record triplets; first serialized region name={:?}, first policy lanes=({:.3}, {:.3}, {:.3}), first profile collection count={:?}.",
+            "Region analysis now also exports {} tagged 0x55f1/0x55f2/0x55f3 record triplets; first serialized region name={:?}, first policy lanes=({:.3}, {:.3}, {:.3}), first profile collection count={:?}, first profile collection trailing_padding_len={:?}.",
             triplets.record_count,
             triplets.entries.first().map(|entry| entry.name.as_str()),
             triplets
@@ -3698,6 +3701,9 @@ pub fn inspect_save_company_and_chairman_analysis_bytes(
                 .unwrap_or_default(),
             triplets.entries.first().and_then(|entry| {
                 entry.profile_collection.as_ref().map(|collection| collection.live_record_count)
+            }),
+            triplets.entries.first().and_then(|entry| {
+                entry.profile_collection.as_ref().map(|collection| collection.trailing_padding_len)
             })
         ));
     }
@@ -10122,6 +10128,15 @@ fn parse_save_region_record_triplet_probe(
             profile_collection,
         });
     }
+    let zero_trailing_padding_record_count = entries
+        .iter()
+        .filter(|entry| {
+            entry
+                .profile_collection
+                .as_ref()
+                .is_some_and(|collection| collection.trailing_padding_len == 0)
+        })
+        .count();
     Some(SmpSaveRegionRecordTripletProbe {
         profile_family: header_probe.profile_family.clone(),
         source_kind: "save-region-record-triplets".to_string(),
@@ -10138,6 +10153,10 @@ fn parse_save_region_record_triplet_probe(
             ),
             "each fixed 0x55f2 policy chunk currently decodes as three leading f32 lanes, three reserved dwords, and one trailing u16 word".to_string(),
             "the trailing 0x55f3 payload also carries an embedded direct profile collection with fixed 0x22-byte rows on grounded saves".to_string(),
+            format!(
+                "on grounded saves the 0x55f3 payload is fully consumed by that embedded profile collection: all {} decoded records currently have zero trailing padding beyond the direct profile rows",
+                zero_trailing_padding_record_count
+            ),
         ],
     })
 }

docs/rehost-queue.md

@@ -10,12 +10,13 @@ Working rule:
 ## Next
 
 - Reconstruct the save-side region record body on top of the newly corrected non-direct tagged
-  region seam (`0x5209/0x520a/0x520b`, stride hint `0x06`, `Marker09` record stems) and its now
-  grounded repeated `0x55f1/0x55f2/0x55f3` record-triplet envelope, especially the unresolved
-  fields that remain above the now-grounded embedded profile collection in the large `0x55f3`
-  payload: the pending bonus lane `[region+0x276]`, completion latch `[region+0x302]`, one-shot
-  notice latch `[region+0x316]`, severity/source lane `[region+0x25e]`, and any stable region-id
-  or class discriminator that can drive shellless city-connection service.
+  region seam (`0x5209/0x520a/0x520b`, stride hint `0x06`, `Marker09` record stems) now that the
+  `0x55f3` payload is known to be fully consumed by the embedded profile collection on grounded
+  real saves: the remaining blocker is no longer a hidden trailing payload tail, but finding the
+  separate save-owner seam for the pending bonus lane `[region+0x276]`, completion latch
+  `[region+0x302]`, one-shot notice latch `[region+0x316]`, severity/source lane `[region+0x25e]`,
+  and any stable region-id or class discriminator that can drive shellless city-connection
+  service.
 - Reconstruct the save-side placed-structure collection body on top of the newly grounded
   `0x36b1/0x36b2/0x36b3` header seam so the blocked city-connection / linked-transit branch can
   stop depending on atlas-only placed-structure and local-runtime refresh notes, especially the
@@ -71,6 +72,10 @@ Working rule:
   live-id/count headers, fixed `0x22`-byte rows, profile names, and trailing weight scalars, so
   the remaining region work is on the unresolved payload fields above that collection rather than
   on the profile subcollection itself.
+- Grounded real saves now also show that the region-side `0x55f3` payload has zero trailing
+  padding beyond that embedded profile collection, so the remaining region blocker has shifted
+  from “find the hidden tail inside this payload” to “find the separate owner seam that backs the
+  runtime latches the city-connection branch still reads.”
 - The placed-structure tagged save stream now also exposes repeated `0x55f1/0x55f2/0x55f3`
   triplets with dual name stems, a fixed five-`f32` policy row, and a compact `0x5dc1...0x5dc2`
   footer carrying one raw `u32` payload lane plus one live `i32` status lane, so the remaining