diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 31cc25b..28f76fe 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -10956,8 +10956,13 @@ fn parse_real_grouped_effect_row_summary(
             "add-building descriptor maps to live candidate id {candidate_id}"
         ));
         notes.push(
-            "0x430270 add-building consumer uses placement count byte 0x11 plus packed span words 0x14/0x16 after the descriptor_id - 503 candidate bridge; it does not branch directly on grouped opcode".to_string(),
+            "0x430270 add-building consumer uses placement count byte 0x11, center words 0x12/0x14, and radius word 0x16 after the descriptor_id - 503 candidate bridge; it clamps radius to at least 1 and retries up to 200 randomized placements without branching directly on grouped opcode".to_string(),
         );
+        if candidate_id > 66 {
+            notes.push(
+                "current non-hook candidate-name catalogs only ground concrete add-building names through candidate id 66, so this descriptor remains on the checked-in candidate-slot boundary beyond the live RT3 1.05 table".to_string(),
+            );
+        }
     }
 
     Some(SmpLoadedPackedEventGroupedEffectRowSummary {
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index 49ca265..d100251 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -348,7 +348,8 @@ Working rule:
   - the compact opcode-`8` frontier therefore shifts:
     direct disassembly of `0x00430270` now shows that the add-building consumer does not branch on
     grouped opcode at all for descriptor strip `503..613`; it consumes the descriptor-derived
-    candidate id, placement count byte `0x11`, and the packed span words at `0x14/0x16`.
+    candidate id, placement count byte `0x11`, center words `0x12/0x14`, and radius word `0x16`,
+    clamps that radius to at least `1`, and retries randomized placements up to `200` times.
     The next static-analysis pass should therefore target the remaining span-field meaning and
     shell-owned placement-flow ownership on that strip, not more missing-label recovery: the
     descriptor-side candidate bridge is now checked in across `503..613`, and the honest remaining