diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index a96c82e..7bcbb41 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -5005,6 +5005,7 @@ fn build_periodic_company_service_trace_report(
         "company linked-transit peer-cache refresh absolute counter [company+0x0d3e] driving the shorter 0x00409720 -> 0x004093d0 cadence".to_string(),
         "company linked-transit autoroute site-score refresh absolute counter [company+0x0d3a] driving the longer 0x00409720 -> 0x00407bd0 cadence".to_string(),
         "company linked-transit latch [company+0x0d56] consumed by 0x00409950 and the annual-finance debt lane".to_string(),
+        "active-company refresh owner 0x00429c10 walks the live company roster and re-enters 0x004093d0 for each active company when linked-transit site-peer caches need a broader rebuild".to_string(),
         "placed-structure-side company cache root [site+0x5bd] allocated by 0x00407780 as a 0x20-entry pointer table of 0x1a-byte per-company cache cells and freed by 0x004077e0".to_string(),
         "placed-structure-side per-company cache cells addressed through [site+0x5bd][company_id] and peer rows filled by 0x004a6630".to_string(),
         "per-company cache-cell layout is bounded too: bytes +0x00/+0x01 gate participation, dword +0x02 is peer-row count, dword +0x06 is peer-row pointer, dword +0x0a is the peer-cache refresh stamp, and floats +0x0e/+0x12/+0x16 are the weighted/raw/final linked-transit score lanes".to_string(),
@@ -5012,13 +5013,15 @@ fn build_periodic_company_service_trace_report(
         "linked-transit site-score cache lanes [site+0x0e/+0x12/+0x16] rebuilt by 0x00407bd0".to_string(),
         "linked-transit local site occupancy/count lane [site+0x5c1] reset by 0x00481910, repopulated from current-site-id resolver 0x004a9340, adjusted by 0x004819b0, and consumed by 0x00408280 as a divisor/penalty lane".to_string(),
         "linked-transit local site age lane [site+0x5c5] stamped from world counter [world+0x15] at 0x004aee2b and consumed by 0x00408280 as the zero-occupancy age bonus ladder".to_string(),
+        "structure candidate table root 0x0062ba8c is world-load owned by 0x0041f4e0 -> 0x0041ede0 -> 0x0041e970 before 0x00407bd0 reuses candidate-local bands".to_string(),
+        "route-entry tracker compatibility and endpoint-fallback chooser 0x004a6360 / 0x004a6630 sit under owner-notify refresh 0x00494fb0, so the peer-table metric source is already bounded above the linked-transit caches".to_string(),
         "linked-transit aggregate roster-pressure helper 0x00408f70 consuming raw site-score lane [site+0x12]".to_string(),
         "linked-transit ranked-site chooser 0x00408280 and staged autoroute entry builder 0x00408380 above the rebuilt site caches".to_string(),
         "linked-transit train-side autoroute append / rotate strip 0x00409770 plus add-train owner 0x00409830 beneath roster balancer 0x00409950".to_string(),
     ];
     let linked_transit_remaining_owner_gaps = vec![
-        "which placed-structure-side restore or service owner guarantees that the save-backed identity inputs [site+0x276], [site+0x04], [site+0x2a4], [site+0x2a8], and [peer+0x04/+0x08] have already rehydrated the live site and peer tables before 0x004093d0 / 0x00407bd0 rebuild their scratch cache lanes".to_string(),
-        "which higher-layer non-hook owner above 0x00407780 / 0x004077e0 / 0x004093d0 / 0x00407bd0 / 0x004a6630 provides the live route-entry tracker and candidate-table inputs that make those rebuilt lanes trustworthy before 0x00408280 / 0x00408380 / 0x00409770 run shelllessly".to_string(),
+        "which placed-structure-side restore or service continuation guarantees that the save-backed identity inputs [site+0x276], [site+0x04], [site+0x2a4], [site+0x2a8], and [peer+0x04/+0x08] have already rehydrated the live site and peer tables before 0x004093d0 / 0x00407bd0 rebuild their scratch cache lanes".to_string(),
+        "how much of the live placed-structure collection 0x006cec20 and linked-peer replay strip still has to run shelllessly beside already-grounded candidate-table owner 0x0041f4e0 / 0x0041ede0 and route-entry tracker owner 0x00494fb0 / 0x004a6360 before 0x00408280 / 0x00408380 / 0x00409770 become trustworthy".to_string(),
     ];
 
     let companies = analysis
@@ -5225,7 +5228,7 @@ fn build_periodic_company_service_trace_report(
         "The per-company cache root is grounded now too: 0x00407780 allocates [site+0x5bd] as a 0x20-entry pointer table and seeds each entry with one zeroed 0x1a-byte company cache cell, while 0x004077e0 frees that same root and any nested cell payloads. That means the remaining linked-transit gap is no longer cache-root allocation identity; it is which persisted site-side inputs are sufficient to repopulate those per-company cells and the downstream score lanes before the bounded chooser/train strip runs shelllessly.".to_string(),
     );
     notes.push(
-        "The per-company cache-cell layout is bounded now too: 0x004093d0 and 0x00407bd0 use bytes +0x00/+0x01 as the initial participation gates, dword +0x02 as the peer-row count, dword +0x06 as the peer-row pointer, dword +0x0a as the shorter peer-cache refresh stamp, and floats +0x0e/+0x12/+0x16 as the weighted/raw/final linked-transit score lanes. So the remaining linked-transit gap is no longer cell layout; it is the persisted site-side inputs and restore/service owners that repopulate those already-bounded cells.".to_string(),
+        "The per-company cache-cell layout is bounded now too: 0x004093d0 and 0x00407bd0 use bytes +0x00/+0x01 as the initial participation gates, dword +0x02 as the peer-row count, dword +0x06 as the peer-row pointer, dword +0x0a as the shorter peer-cache refresh stamp, and floats +0x0e/+0x12/+0x16 as the weighted/raw/final linked-transit score lanes. The candidate-table and route-entry-tracker owners are bounded above that too: 0x0062ba8c is constructed through 0x0041f4e0 -> 0x0041ede0 -> 0x0041e970, while 0x004a6360 / 0x004a6630 sit under owner-notify refresh 0x00494fb0. So the remaining linked-transit gap is no longer generic table ownership; it is the placed-structure-side restore/service continuation that makes the live site and peer rows trustworthy before those already-bounded helpers run.".to_string(),
     );
     notes.push(
         "Direct disassembly now closes the negative persistence side too: the direct 0x36b1 per-record callbacks serialize the shared base scalar triplets rooted at [this+0x206/+0x20a/+0x20e] plus the subordinate payload callback strip, while the 0x4a9d/0x4a3a/0x4a3b side-buffer owner only persists route-entry lists, three byte arrays, five proximity buckets, and the sampled-cell list. That means neither checked-in save owner seam currently persists the core peer-site identity fields [site+0x04], [site+0x2a8], or [peer+0x08] directly.".to_string(),
@@ -28280,7 +28283,7 @@ mod tests {
             5
         );
         assert_eq!(trace.linked_transit_live_rebuilt_cache_lanes.len(), 5);
-        assert_eq!(trace.linked_transit_runtime_backed_input_families.len(), 14);
+        assert_eq!(trace.linked_transit_runtime_backed_input_families.len(), 17);
         assert_eq!(trace.linked_transit_remaining_owner_gaps.len(), 2);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28755,6 +28758,14 @@ mod tests {
                     && line.contains("[site+0x5c5]")
                     && line.contains("[world+0x15]"))
         );
+        assert!(
+            trace
+                .linked_transit_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("0x00429c10")
+                    && line.contains("0x004093d0")
+                    && line.contains("live company roster"))
+        );
         assert!(
             trace
                 .linked_transit_runtime_backed_input_families
@@ -28767,6 +28778,23 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("[company+0x0d3a]") && line.contains("0x00407bd0"))
         );
+        assert!(
+            trace
+                .linked_transit_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("0x0062ba8c")
+                    && line.contains("0x0041f4e0")
+                    && line.contains("0x0041ede0")
+                    && line.contains("0x0041e970"))
+        );
+        assert!(
+            trace
+                .linked_transit_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("0x004a6360")
+                    && line.contains("0x004a6630")
+                    && line.contains("0x00494fb0"))
+        );
         assert!(
             trace
                 .linked_transit_runtime_backed_input_families
@@ -28825,10 +28853,9 @@ mod tests {
             trace
                 .linked_transit_remaining_owner_gaps
                 .iter()
-                .any(|line| line.contains("0x00407780")
-                    && line.contains("0x004093d0")
-                    && line.contains("0x00407bd0")
-                    && line.contains("0x004a6630"))
+                .any(|line| line.contains("0x006cec20")
+                    && line.contains("0x0041f4e0")
+                    && line.contains("0x00494fb0"))
         );
         assert!(
             trace
@@ -29057,6 +29084,12 @@ mod tests {
                 && line.contains("+0x0a")
                 && line.contains("+0x0e/+0x12/+0x16")
         }));
+        assert!(trace.notes.iter().any(|line| {
+            line.contains("0x0062ba8c")
+                && line.contains("0x0041f4e0")
+                && line.contains("0x00494fb0")
+                && line.contains("placed-structure-side restore/service continuation")
+        }));
         assert!(
             trace
                 .near_city_acquisition_runtime_backed_input_families
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index b0755cf..b8d841b 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -46,11 +46,17 @@ Working rule:
     and world calendar lanes `[world+0x15/+0x0d]`, while the actual cache contents at
     `[site+0x5bd]`, `[site+0x5c1/+0x5c5]`, and `[site+0x0e/+0x12/+0x16]` are live rebuilt scratch
     lanes under `0x004093d0 / 0x00407bd0 / 0x00481910 / 0x004819b0 / 0x004aee2b`
+  - the upstream live-table owners are tighter now too:
+    active-company refresh owner `0x00429c10` walks the live company roster and re-enters
+    `0x004093d0`; candidate table root `0x0062ba8c` is world-load owned by
+    `0x0041f4e0 -> 0x0041ede0 -> 0x0041e970`; and route-entry tracker compatibility / chooser
+    helpers `0x004a6360 / 0x004a6630` already sit under owner-notify refresh `0x00494fb0`
   - that makes the next linked-transit question narrower:
-    identify which restore or service owner guarantees those save-backed site/peer/company identity
-    lanes have already rebuilt the live placed-structure, peer, route-entry tracker, and candidate
-    tables consumed by `0x004093d0 / 0x00407bd0 / 0x004a6630`, because the bounded train-side strip
-    `0x00409770 / 0x00409830 / 0x00409950` and the cache-cell semantics are no longer the blocker
+    identify which placed-structure restore or service continuation guarantees those save-backed
+    site/peer/company identity lanes have already rebuilt the live placed-structure and linked-peer
+    rows before `0x004093d0 / 0x00407bd0 / 0x004a6630`, because the candidate table,
+    route-entry-tracker owners, bounded train-side strip `0x00409770 / 0x00409830 / 0x00409950`,
+    and cache-cell semantics are no longer the blocker
 - Make the next static/rehost slice the near-city industry acquisition owner seam under
   `0x004014b0`, not another generic infrastructure pass. The concrete questions are:
   - which minimum persisted peer-site fields on the already-grounded `0x006cec20` placed-structure