Prioritize save-backed peer-site selector strip

crates/rrt-runtime/src/smp.rs

@@ -4113,6 +4113,8 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "0x0045c36e feeds 0x00456100 selector arg 1 from [owner+0x23e], 0x0045da65 feeds zero, and 0x0045e0fc feeds [ebp+0x08]"
             .to_string(),
+        "0x0045c150 save-backed loader for [owner+0x23e/+0x242] via tagged payload 0x5dc1 ahead of 0x0045c310"
+            .to_string(),
         "0x00485819 typed placed-structure caller of 0x0052edf0 via 0x530640-style argument bundle"
             .to_string(),
         "0x00490a79 chooser-side caller of 0x00455b70 with literal selector 0x005cfd74 and fallback seed 0x005c87a8"
@@ -4121,7 +4123,7 @@ fn build_periodic_company_service_trace_report(
         "0x00409950 linked-transit roster sibling owner".to_string(),
     ];
     let next_owner_questions = vec![
-        "Whether the dense 0x0045c36e / 0x0045da65 / 0x0045e0fc caller family over 0x00456100 is the actual live class-0 site-row restore strip that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 depend on; the wrapper mapping is now grounded, so the remaining question is which of the sampled selector-source lanes ([owner+0x23e], literal zero, or [ebp+0x08]) corresponds to the persisted site-row selector.".to_string(),
+        "Whether the 0x0045c150 -> 0x0045c310 -> 0x0045c36e path is the actual live class-0 site-row restore strip that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 depend on. The selector-lane question is now much tighter: 0x0045c150 fills [owner+0x23e/+0x242] from tagged payload 0x5dc1, and 0x0045c36e then feeds [owner+0x23e] into 0x00456100 as selector arg 1.".to_string(),
         "How much of the linked-peer refresh path is strictly post-load versus recurring runtime maintenance now that 0x004133b0 reaches 0x0040ee10 -> 0x0040edf6 -> 0x00480710 during bring-up and 0x004160aa also re-enters 0x0040ee10 later?".to_string(),
         "Which persisted linkage fields behind 0x0047efe0, [region+0x2a4], and [region+0x276] are sufficient to rehost the 0x004014b0 proximity-and-news branch without shell state?".to_string(),
         "Which infrastructure consumer above the grounded 0x38a5 seam actually drives the linked-transit branch that 0x00409950 follows?".to_string(),
@@ -4286,7 +4288,7 @@ fn build_periodic_company_service_trace_report(
         "Direct disassembly now closes the negative persistence side too: the direct 0x36b1 per-record callbacks serialize the shared base scalar triplets rooted at [this+0x206/+0x20a/+0x20e] plus the subordinate payload callback strip, while the 0x4a9d/0x4a3a/0x4a3b side-buffer owner only persists route-entry lists, three byte arrays, five proximity buckets, and the sampled-cell list. That means neither checked-in save owner seam currently persists the core peer-site identity fields [site+0x04], [site+0x2a8], or [peer+0x08] directly.".to_string(),
     );
     notes.push(
-        "The replay strip is tighter now too. 0x00444690 is the current late world bring-up caller of 0x004133b0, that outer owner drains queued site ids through 0x0040e450 and then sweeps every live placed structure through 0x0040ee10, and 0x0040ee10 itself reaches 0x0040edf6 -> 0x00480710 plus the later 0x0040e360 follow-on. A separate runtime path at 0x004160aa also re-enters 0x0040ee10 later. So [peer+0x08] replay is no longer the open question, and [site+0x04] itself is no longer an owner mystery either: 0x00455b70 feeds 0x0052edf0 with arg 3 as the primary selector and arg 1 as fallback, while grounded caller shapes now include the local wrapper 0x00456100, the fixed 0x55f2 callback 0x00456072, and the chooser-side path 0x00490a79. The current leading restore-family hypothesis is the dense 0x0045c36e / 0x0045da65 / 0x0045e0fc caller strip above 0x00456100, because those callers repeatedly allocate 0x23a rows, pass stack-backed buffers, and use the same default scalar lanes; the wrapper mapping is now grounded far enough to say that the sampled selector-source lanes are [owner+0x23e], literal zero, and [ebp+0x08] respectively. The remaining non-hook target is to confirm which of those sampled lanes corresponds to the persisted selector for the live site rows that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 consume.".to_string(),
+        "The replay strip is tighter now too. 0x00444690 is the current late world bring-up caller of 0x004133b0, that outer owner drains queued site ids through 0x0040e450 and then sweeps every live placed structure through 0x0040ee10, and 0x0040ee10 itself reaches 0x0040edf6 -> 0x00480710 plus the later 0x0040e360 follow-on. A separate runtime path at 0x004160aa also re-enters 0x0040ee10 later. So [peer+0x08] replay is no longer the open question, and [site+0x04] itself is no longer an owner mystery either: 0x00455b70 feeds 0x0052edf0 with arg 3 as the primary selector and arg 1 as fallback, while grounded caller shapes now include the local wrapper 0x00456100, the fixed 0x55f2 callback 0x00456072, and the chooser-side path 0x00490a79. The current strongest restore-family candidate is now the save-backed 0x0045c150 -> 0x0045c310 -> 0x0045c36e strip, because 0x0045c150 fills [owner+0x23e/+0x242] from tagged payload 0x5dc1 and 0x0045c36e then feeds [owner+0x23e] into 0x00456100 as the selector-source lane. The remaining non-hook target is to confirm that this save-backed owner family is the same class-0 site family that 0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50 consume.".to_string(),
     );
 
     SmpPeriodicCompanyServiceTraceReport {
@@ -25947,7 +25949,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 7);
-        assert_eq!(trace.known_bridge_helpers.len(), 36);
+        assert_eq!(trace.known_bridge_helpers.len(), 37);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert_eq!(trace.companies.len(), 1);
         assert!(trace.atlas_candidate_consumers.iter().any(|line| {
@@ -25956,9 +25958,7 @@ mod tests {
                 && line.contains("peer-site boolean/selector pair")
         }));
         assert!(trace.next_owner_questions.iter().any(|line| {
-            line.contains("0x0045c36e")
+            line.contains("0x0045c150") && line.contains("0x0045c36e") && line.contains("0x5dc1")
-                && line.contains("0x00456100")
-                && line.contains("[owner+0x23e]")
         }));
         assert!(trace.next_owner_questions.iter().any(|line| {
             line.contains("0x004160aa")

docs/rehost-queue.md

@@ -78,6 +78,10 @@ Working rule:
   - the `0x00456100 -> 0x00455b70` wrapper mapping is now grounded far enough to say the sampled
     selector-source lanes are `[owner+0x23e]` at `0x0045c36e`, literal zero at `0x0045da65`, and
     `[ebp+0x08]` at `0x0045e0fc`
+  - direct disassembly now shows `0x0045c150` as a save-backed loader for `[owner+0x23e/+0x242]`:
+    it zeroes those fields, runs the shared tagged loader `0x00455fc0`, reads tagged payload
+    `0x5dc1`, and copies the two recovered lanes into `[owner+0x23e/+0x242]` before
+    `0x0045c310 -> 0x0045c36e` later feeds `[owner+0x23e]` into `0x00456100`
   - `0x00485819` is one typed placed-structure caller of `0x0052edf0` through the generic
     three-arg wrapper `0x00530640`
   - `0x00490a79` is one chooser-side caller of `0x00455b70`, feeding literal selector
@@ -85,8 +89,8 @@ Working rule:
   So the next owner question is no longer “what does the acquisition branch do?” or “which post-
   load owner replays linked-site refresh?” but “which concrete `0x00455b70` caller family applies
   to the live site rows, and which persisted lane becomes the selector bundle that ultimately
-  seeds `[site+0x04]`?” The current leading restore-family hypothesis is the dense
+  seeds `[site+0x04]`?” The current strongest restore-family hypothesis is now the save-backed
-  `0x0045c36e / 0x0045da65 / 0x0045e0fc -> 0x00456100 -> 0x00455b70` strip.
+  `0x0045c150 -> 0x0045c310 -> 0x0045c36e -> 0x00456100 -> 0x00455b70` strip.
 - Make the next static/rehost slice the peer-site rebuild seam above persistence, not another save
   scan:
   - treat `0x00444690 -> 0x004133b0 -> 0x0040e450 / 0x0040ee10 -> 0x0040edf6 -> 0x00480710` as
@@ -98,10 +102,10 @@ Working rule:
     bundle lanes into that field owner
   - distinguish which `0x00455b70` caller family actually seeds the live site rows before
     `0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50` consume the resulting selector, with the
-    current first target being the dense `0x0045c36e / 0x0045da65 / 0x0045e0fc -> 0x00456100`
+    current first target being the save-backed
-    family
+    `0x0045c150 -> 0x0045c310 -> 0x0045c36e -> 0x00456100` family
-  - name which of the currently sampled selector-source lanes (`[owner+0x23e]`, literal zero, or
+  - confirm that this save-backed owner family is the same class-0 site family consumed by
-    `[ebp+0x08]`) reaches selector arg `3` for the live site rows
+    `0x00420030 / 0x00420280 / 0x0047efe0 / 0x0047fd50`
 - Use the higher-layer probes as the standard entry point for the current blocked frontier instead
   of generic save scans:
   `runtime inspect-periodic-company-service-trace <save.gms>`,