diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 8214b3f..0f5925a 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -4638,6 +4638,7 @@ fn build_periodic_company_service_trace_report(
             evidence: vec![
                 "0x0040cac0 is only the exact raw delta reader over [site+0x310/+0x338/+0x360]".to_string(),
                 "direct local binary inspection now shows 0x0040c9a0 as the deferred additive accumulator over [site+0x310/+0x338/+0x360], folding that tri-lane into [site+0x2b4/+0x2b8/+0x2bc], mirroring the nine-dword side array rooted at [site+0x2e4], and then clearing the tri-lane".to_string(),
+                "direct local caller census now shows 0x0040c9a0 only under the broad live-collection sweep 0x0040a3a1..0x0040a4d3, while 0x0040cac0 stays under weighted scoring or evaluation families such as 0x0040fcc0..0x0040fe28 and 0x00422c62..0x00422d3c".to_string(),
                 "the current binary write scan finds no direct placed-structure runtime writer for [site+0x310/+0x338/+0x360]".to_string(),
                 "current checked-in save owners still do not serialize those lanes directly, which rules down the known save seams while leaving a later restore family open".to_string(),
                 "0x00481430 -> 0x0047d8e0 repopulates the dynamic side-buffer route-entry list, three byte arrays, five proximity buckets, and trailing scratch band from stream without claiming the tri-lane".to_string(),
@@ -4753,6 +4754,8 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "0x0040c9a0 deferred additive accumulator/reset helper folding tri-lane [site+0x310/+0x338/+0x360] into [site+0x2b4/+0x2b8/+0x2bc] and mirroring the nine-dword side array rooted at [site+0x2e4]"
             .to_string(),
+        "0x0040a3a1..0x0040a4d3 broad live-collection maintenance sweep calling 0x0040c9a0 once per live placed structure after sibling sweeps over companies, source records, and peer sites".to_string(),
+        "0x0040fcc0..0x0040fe28 and 0x00422c62..0x00422d3c weighted scoring families consuming 0x0040cac0 without grounding a tri-lane producer".to_string(),
         "0x005c8c50 +0x40 stream-load callback 0x0040ce60 canonicalizing the site stem and re-entering 0x0040cd70 / 0x0045c150 for restored rows"
             .to_string(),
         "0x0052edf0 generic base constructor seeding [this+0x04] from caller arg 1".to_string(),
@@ -4944,13 +4947,13 @@ fn build_periodic_company_service_trace_report(
         "The create-side family is grounded separately too. City-connection direct placement already reaches the shared constructor/finalize strip 0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10, and the direct writer census now shows [site+0x276] writes clustering under create-side, acquisition-side, and bulk control-transfer families rather than under the known replay strip. So the remaining shellless gap is no longer 'how are new placed structures finalized?' or '[site+0x2a4] mystery'; it is specifically how restored existing rows regain the owner-company lane and cached tri-lane before acquisition-style consumers run.".to_string(),
     );
     notes.push(
-        "The tri-lane restore side is narrower now too. The checked-in dynamic side-buffer load owner 0x00481430 -> 0x0047d8e0 repopulates the route-entry list, three per-site byte arrays, five proximity buckets, and the trailing scratch band from stream, so that seam is no longer a plausible hidden owner for [site+0x310/+0x338/+0x360]. The remaining tri-lane question is now specifically a later restore family beyond the known triplet and side-buffer seams.".to_string(),
+        "The tri-lane restore side is narrower now too. The checked-in dynamic side-buffer load owner 0x00481430 -> 0x0047d8e0 repopulates the route-entry list, three per-site byte arrays, five proximity buckets, and the trailing scratch band from stream, so that seam is no longer a plausible hidden owner for [site+0x310/+0x338/+0x360].".to_string(),
     );
     notes.push(
-        "Direct local binary inspection now also gives the tri-lane one concrete runtime role: 0x0040c9a0 folds [site+0x310/+0x338/+0x360] into the local scalar band [site+0x2b4/+0x2b8/+0x2bc], mirrors the nine-dword side array rooted at [site+0x2e4], and then clears the tri-lane. Together with the existing delta reader 0x0040cac0, that makes the lane look like a deferred additive cache handed off by restore rather than an ordinary live service output.".to_string(),
+        "Direct local binary inspection now also gives the tri-lane one concrete runtime role: 0x0040c9a0 folds [site+0x310/+0x338/+0x360] into the local scalar band [site+0x2b4/+0x2b8/+0x2bc], mirrors the nine-dword side array rooted at [site+0x2e4], and then clears the tri-lane. Caller census keeps that role narrow too: 0x0040c9a0 only appears under the broad live-collection sweep 0x0040a3a1..0x0040a4d3, while 0x0040cac0 stays under weighted scoring/evaluation families such as 0x0040fcc0..0x0040fe28 and 0x00422c62..0x00422d3c. Together that makes the lane look like a deferred additive cache handed off by restore rather than an ordinary live service output.".to_string(),
     );
     notes.push(
-        "Direct local binary inspection now grounds the cached-candidate restore bridge too: the placed-structure stream-load owner 0x00413280 dispatches per-entry vtable slot +0x40 on the 0x005c8c50 specialization table, that slot resolves to 0x0040ce60, and 0x0040ce60 immediately re-enters 0x0040cd70 plus 0x0045c150. So the acquisition-side cached source/candidate bridge [site+0x3cc/+0x3d0] is no longer a generic restore mystery for stream-loaded rows; the remaining restored-row gaps are [site+0x276], [site+0x2a4], and the deferred tri-lane.".to_string(),
+        "Direct local binary inspection now grounds the cached-candidate restore bridge too: the placed-structure stream-load owner 0x00413280 dispatches per-entry vtable slot +0x40 on the 0x005c8c50 specialization table, that slot resolves to 0x0040ce60, and 0x0040ce60 immediately re-enters 0x0040cd70 plus 0x0045c150. So the acquisition-side cached source/candidate bridge [site+0x3cc/+0x3d0] is no longer a generic restore mystery for stream-loaded rows; the remaining restored-row gaps are [site+0x276] and the deferred tri-lane.".to_string(),
     );
     notes.push(
         "Direct disassembly now tightens the remaining placed-structure lanes too: 0x0040cac0 is only the raw tri-lane delta reader over [site+0x310/+0x338/+0x360]; 0x0040d360 is only the exact subtype test [candidate+0x32] == 4; and the current binary write scan finds no direct placed-structure runtime writer for either [site+0x2a4] or [site+0x310/+0x338/+0x360], which now makes both lanes look payload/restore-owned rather than service-produced.".to_string(),
@@ -27957,7 +27960,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 9);
-        assert_eq!(trace.known_bridge_helpers.len(), 55);
+        assert_eq!(trace.known_bridge_helpers.len(), 57);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28100,6 +28103,14 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("0x0040c9a0"))
         );
+        assert!(
+            trace.near_city_acquisition_projection_hypotheses[1]
+                .evidence
+                .iter()
+                .any(|line| line.contains("0x0040a3a1..0x0040a4d3")
+                    && line.contains("0x0040fcc0..0x0040fe28")
+                    && line.contains("0x00422c62..0x00422d3c"))
+        );
         assert!(
             trace.near_city_acquisition_projection_hypotheses[2]
                 .evidence
@@ -28452,6 +28463,17 @@ mod tests {
                     && line.contains("[site+0x310/+0x338/+0x360]")
                     && line.contains("[site+0x2b4/+0x2b8/+0x2bc]"))
         );
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x0040a3a1..0x0040a4d3") && line.contains("0x0040c9a0"))
+        );
+        assert!(trace.known_bridge_helpers.iter().any(
+            |line| line.contains("0x0040fcc0..0x0040fe28")
+                && line.contains("0x00422c62..0x00422d3c")
+                && line.contains("0x0040cac0")
+        ));
         assert!(
             trace
                 .known_bridge_helpers
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index cfbc5b4..5b9aa28 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -119,6 +119,10 @@ Working rule:
     direct local binary inspection shows `0x0040c9a0` folding `[site+0x310/+0x338/+0x360]` into
     `[site+0x2b4/+0x2b8/+0x2bc]`, mirroring the nine-dword side array rooted at `[site+0x2e4]`,
     and then clearing the tri-lane
+  - caller census keeps that tri-lane role narrow:
+    `0x0040c9a0` only appears under the broad live-collection sweep
+    `0x0040a3a1..0x0040a4d3`, while `0x0040cac0` stays under weighted scoring or evaluation
+    families such as `0x0040fcc0..0x0040fe28` and `0x00422c62..0x00422d3c`
   - the cached source/candidate bridge is now grounded on stream load too:
     direct local binary inspection shows `0x00413280` dispatching per-entry vtable slot `+0x40`
     on the `0x005c8c50` specialization table, that slot resolving to `0x0040ce60`, and