Map infrastructure constructor argument bundles

docs/rehost-queue.md

@@ -197,9 +197,25 @@ Working rule:
   `TunnelSTBrick_Cap.3dp / Infrastructure:2`,
   `TunnelSTBrick_Section.3dp / Infrastructure:2`.
   Its rows are spread across many spans rather than one dominant restore span.
+- Source-side constructor analysis is narrower now too. `0x00490960` takes:
+  - mode at stack arg 1
+  - stem at stack arg 2
+  - args 3/4 into `0x539530`
+  - arg 5 into `0x53a5b0`
+  - arg 10 as the primary-child cache gate for `[this+0x248]`
+  - args 7/8/9 into the selector-copy block for `[this+0x219]`, `[this+0x251]`, and bit `0x20`
+    in `[this+0x24c]` when `mode < 4`
+- That already separates the remaining mixed classes:
+  - fixed `TrackCap` mode `0x0b` callers at `0x0048ed01/0x0048ed20` push arg7/arg8/arg9 as
+    `-1 / -1 / 0` and bypass selector-copy entirely because `mode >= 4`
+  - tunnel mode `0x02` callers at
+    `0x004a17eb / 0x004a1995 / 0x004a1b44 / 0x004a1b7d / 0x004a1b95`
+    necessarily flow through selector-copy because `mode < 4`, with arg8 fixed at `1`, arg9
+    fixed at `0`, and only arg7 varying through a branch-local one-bit register
 - So the next infrastructure slice should stop treating the remaining frontier as a generic
   “mixed 0x06/outlier” problem and instead target the owning constructor/restore semantics for
-  those two exact mixed compact-prefix classes.
+  those two exact mixed compact-prefix classes, especially how tunnel arg7 and the fixed
+  `TrackCap` no-selector bundle both still collapse into the observed mixed save-side prefixes.
 - The candidate-pattern classes are now explicit across the whole stream too: `0x0055 / 0x00`
   is a pure `BallastCapST_Cap.3dp / Infrastructure` class across `18` rows, always preceded by a
   zero-length prior profile span, while `0x0002 / 0xff` is a pure