Narrow Tier2 candidate bank consumer frontier

docs/rehost-queue.md

@@ -687,6 +687,23 @@ Working rule:
     recover which later owner or alternate content path makes the live
     `[candidate+0xba/+0xbb]` bank/template state diverge from that all-zero shipped BCA corpus
     before `0x00411ee0 / 0x00411ce0 / 0x00412c10` run.
+  - the broader consumer strip above that split is narrower now too:
+    direct disassembly now rules three more neighbors onto the read-only side of the bank bytes.
+    `0x00419230` only scans already-linked owner candidates and runs two rebank-or-clone passes
+    keyed by `candidate[+0xba]` and `candidate[+0xbb]` before stamping `Port%02d` /
+    `Warehouse%02d` labels into the auxiliary pool. `0x00418610` only feeds `candidate[+0xba]`
+    plus subtype/class predicates into the projected-rectangle sample-band helper. And the broader
+    projected-offset lane at `0x0041a5fd..0x0041a944` resolves the same owner candidate and gates a
+    world-cell occupancy sweep on `candidate[+0xba]`, but still does not reconstruct the byte.
+    The `.smp` restore-side auxiliary branch is negative in the same way: `0x00413f80` only
+    restores queued temporary aux-record images without the fixed selector-byte body
+    `[+0xb8..+0xbb]`, and `0x0041a950` only releases the live aux collection before re-entering
+    the same `0x004196c0 -> 0x00419230` import-plus-follow-on strip when the restore flags demand
+    it.
+    So the honest next queue head is now one step earlier again:
+    recover the non-stock writer or restore-time projection owner that makes some live candidates
+    reach those later consumer strips with nonzero `[candidate+0xba/+0xbb]` despite the observed
+    all-zero `BuildingTypes/*.bca` corpus.
     kinds”; it is the smaller set of scenario-specific records where that sweep explicitly writes
     `[event+0x7ef]` itself or a still-later owner does.
   - two explicit trigger-kind materializations are now grounded inside that retagger: