diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 99ba7e2..a381ce0 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -4632,6 +4632,7 @@ fn build_periodic_company_service_trace_report(
             ],
             evidence: vec![
                 "0x0040cac0 is only the exact raw delta reader over [site+0x310/+0x338/+0x360]".to_string(),
+                "direct local binary inspection now shows 0x0040c9a0 as the deferred additive accumulator over [site+0x310/+0x338/+0x360], folding that tri-lane into [site+0x2b4/+0x2b8/+0x2bc], mirroring the nine-dword side array rooted at [site+0x2e4], and then clearing the tri-lane".to_string(),
                 "the current binary write scan finds no direct placed-structure runtime writer for [site+0x310/+0x338/+0x360]".to_string(),
                 "current checked-in save owners still do not serialize those lanes directly, which rules down the known save seams while leaving a later restore family open".to_string(),
                 "0x00481430 -> 0x0047d8e0 repopulates the dynamic side-buffer route-entry list, three byte arrays, five proximity buckets, and trailing scratch band from stream without claiming the tri-lane".to_string(),
@@ -4671,7 +4672,7 @@ fn build_periodic_company_service_trace_report(
     let near_city_acquisition_region_lane_statuses = vec![
         "[site+0x276] owner-present gate: consumed directly by 0x004014b0, and the live owner-company meaning is already grounded through 0x0047efe0, but its save-native or replay projection is still missing".to_string(),
         "[site+0x2a4] placed-structure id lane: peer-chain helpers already ground this as the record's own site id, and constructor-side 0x00480210 seeds it for new linked-site rows, but the save or replay projection into restored live placed-structure rows is still missing for the 0x004014b0 commit path".to_string(),
-        "[site+0x310/+0x338/+0x360] cached tri-lane: exact raw delta reader grounded at 0x0040cac0, and the current binary write scan finds no direct placed-structure runtime writer, so the lane now looks payload/restore-owned".to_string(),
+        "[site+0x310/+0x338/+0x360] cached tri-lane: exact delta reader grounded at 0x0040cac0 and deferred additive accumulator/reset helper grounded at 0x0040c9a0, but the current binary write scan still finds no direct placed-structure runtime writer, so the lane now looks restore-owned rather than service-produced".to_string(),
         "placed-structure subtype filter: 0x0040d360 is the exact test [candidate+0x32] == 4, and the owning subtype byte is already bounded under 0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0; the remaining gap is projecting [site+0x04] back into that loaded candidate row".to_string(),
     ];
     let atlas_candidate_consumers = vec![
@@ -4743,6 +4744,8 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "0x00481430 / 0x0047d8e0 dynamic side-buffer stream-load owner repopulating route-entry lists, three byte arrays, five proximity buckets, and trailing scratch band"
             .to_string(),
+        "0x0040c9a0 deferred additive accumulator/reset helper folding tri-lane [site+0x310/+0x338/+0x360] into [site+0x2b4/+0x2b8/+0x2bc] and mirroring the nine-dword side array rooted at [site+0x2e4]"
+            .to_string(),
         "0x0052edf0 generic base constructor seeding [this+0x04] from caller arg 1".to_string(),
         "0x00455b70 placed-structure specialization constructor feeding 0x0052edf0 arg 3 as the primary selector and arg 1 as fallback"
             .to_string(),
@@ -4934,6 +4937,9 @@ fn build_periodic_company_service_trace_report(
     notes.push(
         "The tri-lane restore side is narrower now too. The checked-in dynamic side-buffer load owner 0x00481430 -> 0x0047d8e0 repopulates the route-entry list, three per-site byte arrays, five proximity buckets, and the trailing scratch band from stream, so that seam is no longer a plausible hidden owner for [site+0x310/+0x338/+0x360]. The remaining tri-lane question is now specifically a later restore family beyond the known triplet and side-buffer seams.".to_string(),
     );
+    notes.push(
+        "Direct local binary inspection now also gives the tri-lane one concrete runtime role: 0x0040c9a0 folds [site+0x310/+0x338/+0x360] into the local scalar band [site+0x2b4/+0x2b8/+0x2bc], mirrors the nine-dword side array rooted at [site+0x2e4], and then clears the tri-lane. Together with the existing delta reader 0x0040cac0, that makes the lane look like a deferred additive cache handed off by restore rather than an ordinary live service output.".to_string(),
+    );
     notes.push(
         "Direct disassembly now tightens the remaining placed-structure lanes too: 0x0040cac0 is only the raw tri-lane delta reader over [site+0x310/+0x338/+0x360]; 0x0040d360 is only the exact subtype test [candidate+0x32] == 4; and the current binary write scan finds no direct placed-structure runtime writer for either [site+0x2a4] or [site+0x310/+0x338/+0x360], which now makes both lanes look payload/restore-owned rather than service-produced.".to_string(),
     );
@@ -27939,7 +27945,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 9);
-        assert_eq!(trace.known_bridge_helpers.len(), 50);
+        assert_eq!(trace.known_bridge_helpers.len(), 51);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28076,6 +28082,12 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("0x00481430 -> 0x0047d8e0"))
         );
+        assert!(
+            trace.near_city_acquisition_projection_hypotheses[1]
+                .evidence
+                .iter()
+                .any(|line| line.contains("0x0040c9a0"))
+        );
         assert!(
             trace.near_city_acquisition_projection_hypotheses[2]
                 .candidate_consumers
@@ -28210,6 +28222,14 @@ mod tests {
                     && line.contains("record's own site id")
                     && line.contains("0x00480210"))
         );
+        assert!(
+            trace
+                .near_city_acquisition_region_lane_statuses
+                .iter()
+                .any(|line| line.contains("[site+0x310/+0x338/+0x360]")
+                    && line.contains("0x0040cac0")
+                    && line.contains("0x0040c9a0"))
+        );
         assert!(
             trace
                 .near_city_acquisition_region_lane_statuses
@@ -28368,6 +28388,14 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("0x00481430 / 0x0047d8e0"))
         );
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x0040c9a0")
+                    && line.contains("[site+0x310/+0x338/+0x360]")
+                    && line.contains("[site+0x2b4/+0x2b8/+0x2bc]"))
+        );
         let city_branch = trace.companies[0]
             .branches
             .iter()
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index b8625b5..08849ae 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -112,6 +112,10 @@ Working rule:
     `0x00481430 -> 0x0047d8e0` repopulates the route-entry list, three byte arrays, five
     proximity buckets, and the trailing scratch band from stream, but still does not claim the
     cached tri-lane
+  - the tri-lane now has one real runtime consumer too:
+    direct local binary inspection shows `0x0040c9a0` folding `[site+0x310/+0x338/+0x360]` into
+    `[site+0x2b4/+0x2b8/+0x2bc]`, mirroring the nine-dword side array rooted at `[site+0x2e4]`,
+    and then clearing the tri-lane
   - the third hypothesis is now a cached source/candidate bridge question, not just a raw
     `[site+0x04]` selector question:
     `0x0040cd70` seeds `[site+0x3cc/+0x3d0]` from `0x62b2fc / 0x62b268`,