diff --git a/artifacts/exports/rt3-1.06/runtime-effect-kind8-tier2-named-availability-note.md b/artifacts/exports/rt3-1.06/runtime-effect-kind8-tier2-named-availability-note.md
index b889b98..6ac540f 100644
--- a/artifacts/exports/rt3-1.06/runtime-effect-kind8-tier2-named-availability-note.md
+++ b/artifacts/exports/rt3-1.06/runtime-effect-kind8-tier2-named-availability-note.md
@@ -179,3 +179,39 @@ That makes the next Tier 2 question more concrete still:
   drives the later `Warehouse%02d` side in `Louisiana.gmp`
 - and whether that preserved bank/template state is the real bridge from the minimal recipe cluster
   to the shipped `5200 :: [7:0]` `Add Building Warehouse05` row
+
+## Later Consumer-Side Reads Already Narrowed
+
+One broader non-hook pass now rules several tempting later neighbors onto the consumer side rather
+than the missing writer or projection seam.
+
+- `aux_candidate_collection_rebank_or_clone_records_by_availability_pass_and_refresh_owner_links`
+  `0x00419230` does not seed `[candidate+0xba/+0xbb]` into the live candidate pool. It walks the
+  already-imported auxiliary/source pool at `0x0062b2fc`, selects template records only when the
+  linked live owner candidate at `[entry+0x173]` already passes the current bank test (`+0xba` on
+  pass `0`, `+0xbb` on pass `1`), and then clones or reuses auxiliary entries before stamping the
+  built-in `Port%02d` / `Warehouse%02d` roots back into `[entry+0x22]` and `[entry+0x04]`.
+- `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610` is also only a
+  consumer of the same candidate-bank state. It resolves the current candidate through helper
+  accessors, uses `candidate[0xba]` and the subtype/class predicates as mode inputs for the
+  projected-rectangle sample pass, and never writes the candidate bank bytes.
+- the broader projected-offset lane at `0x0041a5fd..0x0041a944` is the same shape: after geometric
+  reuse tests it resolves the current candidate owner, immediately branches on `candidate[0xba]`,
+  and then either runs one world-cell occupancy sweep or falls back to localized status strings.
+  Current direct disassembly still shows this path consuming the bank byte as a gate, not
+  reconstructing it.
+
+So the surviving frontier is narrower again:
+
+- `0x00414490`, `0x004120b0`, and the shipped `BuildingTypes/*.bca` corpus explain how the stock
+  zero bank bytes enter the source and live candidate families
+- `0x00419230`, `0x00418610`, and `0x0041a5fd..0x0041a944` explain how later auxiliary and
+  projected-placement consumers react to already-materialized bank bytes
+- the `.smp` restore-side auxiliary temp-bank path is ruled out as a hidden bank-byte source too:
+  `0x00413f80` restores queued temporary images with scalar runs, inline dword runs, and paired
+  byte streams, but not the auxiliary fixed body or selector bytes `[+0xb8..+0xbb]`; and
+  `0x0041a950`, when the restore flags demand it, only releases the current live aux collection and
+  tail-jumps back into the same `0x004196c0 -> 0x00419230` import-plus-follow-on chain
+- but the still-missing owner is the earlier non-stock writer or restore-time projection seam that
+  makes some live candidates reach those later consumers with nonzero `[candidate+0xba/+0xbb]`
+  despite the observed all-zero BCA corpus
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index a7bc096..3d04ba1 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -687,6 +687,23 @@ Working rule:
     recover which later owner or alternate content path makes the live
     `[candidate+0xba/+0xbb]` bank/template state diverge from that all-zero shipped BCA corpus
     before `0x00411ee0 / 0x00411ce0 / 0x00412c10` run.
+  - the broader consumer strip above that split is narrower now too:
+    direct disassembly now rules three more neighbors onto the read-only side of the bank bytes.
+    `0x00419230` only scans already-linked owner candidates and runs two rebank-or-clone passes
+    keyed by `candidate[+0xba]` and `candidate[+0xbb]` before stamping `Port%02d` /
+    `Warehouse%02d` labels into the auxiliary pool. `0x00418610` only feeds `candidate[+0xba]`
+    plus subtype/class predicates into the projected-rectangle sample-band helper. And the broader
+    projected-offset lane at `0x0041a5fd..0x0041a944` resolves the same owner candidate and gates a
+    world-cell occupancy sweep on `candidate[+0xba]`, but still does not reconstruct the byte.
+    The `.smp` restore-side auxiliary branch is negative in the same way: `0x00413f80` only
+    restores queued temporary aux-record images without the fixed selector-byte body
+    `[+0xb8..+0xbb]`, and `0x0041a950` only releases the live aux collection before re-entering
+    the same `0x004196c0 -> 0x00419230` import-plus-follow-on strip when the restore flags demand
+    it.
+    So the honest next queue head is now one step earlier again:
+    recover the non-stock writer or restore-time projection owner that makes some live candidates
+    reach those later consumer strips with nonzero `[candidate+0xba/+0xbb]` despite the observed
+    all-zero `BuildingTypes/*.bca` corpus.
     kinds”; it is the smaller set of scenario-specific records where that sweep explicitly writes
     `[event+0x7ef]` itself or a still-later owner does.
   - two explicit trigger-kind materializations are now grounded inside that retagger: