Add save-side unclassified collection scanner

docs/rehost-queue.md

@@ -20,8 +20,9 @@ Working rule:
 - Reconstruct the save-side placed-structure collection body on top of the newly grounded
   `0x36b1/0x36b2/0x36b3` header seam so the blocked city-connection / linked-transit branch can
   stop depending on atlas-only placed-structure and local-runtime refresh notes, especially the
-  semantics of the now-grounded compact `0x55f3` footer dword/status lane and any deeper side
-  buffers beyond the repeated `0x55f1/0x55f2/0x55f3` triplet envelope.
+  semantics of the now-grounded compact `0x55f3` footer dword/status lane and the newly exposed
+  unclassified tagged-collection candidates that may correspond to the separate placed-structure
+  dynamic side-buffer lane.
 - Extend shellless clock advancement so more periodic-company service branches consume owned
   runtime time state directly instead of only the explicit periodic service command.
 - Keep widening selected-year world-owner state only when a full owning reader/rebuild family is
@@ -76,6 +77,9 @@ Working rule:
   padding beyond that embedded profile collection, so the remaining region blocker has shifted
   from “find the hidden tail inside this payload” to “find the separate owner seam that backs the
   runtime latches the city-connection branch still reads.”
+- Save inspection now also exports a generic low-tag unclassified collection scan over plausible
+  indexed-collection headers, so the next city-connection pass can compare real save candidates
+  against the atlas-owned placed-structure dynamic side-buffer lane instead of blind tag hunting.
 - The placed-structure tagged save stream now also exposes repeated `0x55f1/0x55f2/0x55f3`
   triplets with dual name stems, a fixed five-`f32` policy row, and a compact `0x5dc1...0x5dc2`
   footer carrying one raw `u32` payload lane plus one live `i32` status lane, so the remaining