diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index fb57feb..9b75ac6 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -4568,6 +4568,10 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "linked-site post-load replay republishing world-cell owner and linked-site chains through 0x0042bbf0/0x0042bbb0 and 0x0042c9f0/0x0042c9a0"
             .to_string(),
+        "placed-structure linked-company resolver 0x0047efe0 already grounds the live owner-company meaning of [site+0x276]"
+            .to_string(),
+        "aux-candidate stream-load and stem-policy chain 0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0 already grounds the subtype byte consumed as [candidate+0x32]"
+            .to_string(),
         "company stat-family lane 0x2329/0x0d already rehosted in runtime company state".to_string(),
         "company market state now carries the save-native linked-transit route-anchor tuple [company+0x0d35] and [company+0x7664/+0x7668/+0x766c]"
             .to_string(),
@@ -4577,16 +4581,16 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
     ];
     let near_city_acquisition_remaining_owner_gaps = vec![
-        "save-native projection of placed-structure owner field [site+0x276] for the acquisition-side owner-present gate".to_string(),
+        "save-native or replay projection of placed-structure owner-company field [site+0x276] for the acquisition-side owner-present gate; the live meaning is already grounded through 0x0047efe0".to_string(),
         "save payload or restore owner for [site+0x2a4] winning placed-structure id lane before 0x004269b0 commits the chosen site".to_string(),
         "save payload or restore owner for [site+0x310/+0x338/+0x360] cached tri-lane sampled by 0x0040cac0; current binary scan finds no direct placed-structure runtime writer".to_string(),
-        "save-native projection of the placed-structure subtype byte consumed by 0x0040d360 as [candidate+0x32] == 4".to_string(),
+        "aux-candidate projection from the restored backing-record selector [site+0x04] into the subtype byte consumed by 0x0040d360 as [candidate+0x32] == 4".to_string(),
     ];
     let near_city_acquisition_region_lane_statuses = vec![
-        "[site+0x276] owner-present gate: consumed directly by 0x004014b0, but its save-native projection is still missing".to_string(),
+        "[site+0x276] owner-present gate: consumed directly by 0x004014b0, and the live owner-company meaning is already grounded through 0x0047efe0, but its save-native or replay projection is still missing".to_string(),
         "[site+0x2a4] placed-structure id lane: consumed by 0x004014b0 before 0x004269b0 commits the chosen site, and no separate placed-structure runtime writer is currently grounded for the winning-candidate staging lane".to_string(),
         "[site+0x310/+0x338/+0x360] cached tri-lane: exact raw delta reader grounded at 0x0040cac0, and the current binary write scan finds no direct placed-structure runtime writer, so the lane now looks payload/restore-owned".to_string(),
-        "placed-structure subtype filter: 0x0040d360 is the exact test [candidate+0x32] == 4, but the save-native projection of that byte is still missing".to_string(),
+        "placed-structure subtype filter: 0x0040d360 is the exact test [candidate+0x32] == 4, and the owning subtype byte is already bounded under 0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0; the remaining gap is projecting [site+0x04] back into that loaded candidate row".to_string(),
     ];
     let atlas_candidate_consumers = vec![
         "0x004019e0 periodic company outer service owner".to_string(),
@@ -4636,8 +4640,9 @@ fn build_periodic_company_service_trace_report(
         "0x0048abc0 / 0x00493cf0 route-entry-anchor rebind and synthesis strip".to_string(),
         "0x0047dda0 linked-peer route-entry-anchor validator".to_string(),
         "0x00420030 / 0x00420280 peer-site boolean/selector pair over the placed-structure collection".to_string(),
-        "0x0047efe0 placed-structure linked-company resolver".to_string(),
+        "0x0047efe0 placed_structure_query_linked_company_id returning owner company id from [site+0x276]".to_string(),
         "0x0047fd50 linked-peer candidate-class gate returning true only for class-byte values 0/1/2 at [candidate+0x8c]".to_string(),
+        "0x004131f0 / 0x00412fb0 / 0x004120b0 / 0x00412ab0 aux-candidate load and stem-policy chain owning subtype byte [candidate+0x32]".to_string(),
         "0x0052edf0 generic base constructor seeding [this+0x04] from caller arg 1".to_string(),
         "0x00455b70 placed-structure specialization constructor feeding 0x0052edf0 arg 3 as the primary selector and arg 1 as fallback"
             .to_string(),
@@ -4662,7 +4667,7 @@ fn build_periodic_company_service_trace_report(
         "0x00409950 linked-transit roster sibling owner".to_string(),
     ];
     let next_owner_questions = vec![
-        "Which persisted region and company linkage fields are still missing for a shellless 0x004014b0 implementation once the peer-site restore subset is accepted as sufficient to reconstruct the live runtime subset?".to_string(),
+        "Which persisted placed-structure and city-or-region linkage fields are still missing for a shellless 0x004014b0 implementation once the peer-site restore subset, company route-anchor tuple, [site+0x276] live owner meaning, and candidate subtype owner strip are accepted as grounded?".to_string(),
         "How much of the linked-peer refresh path is strictly post-load versus recurring runtime maintenance now that 0x004133b0 reaches 0x0040ee10 -> 0x0040edf6 -> 0x00480710 during bring-up and 0x004160aa also re-enters 0x0040ee10 later?".to_string(),
         "Which later save payload or restore owner rehydrates the remaining placed-structure-side 0x004014b0 inputs [site+0x2a4] and [site+0x310/+0x338/+0x360] once peer/company inputs are accepted as grounded and the owner-present gate [site+0x276] is treated as save-native rather than service-produced?".to_string(),
         "Which infrastructure consumer above the grounded 0x38a5 seam actually drives the linked-transit branch that 0x00409950 follows?".to_string(),
@@ -4818,7 +4823,7 @@ fn build_periodic_company_service_trace_report(
         "Direct disassembly now narrows the acquisition-side sibling substantially: 0x004014b0 gates on the periodic outer owner, then scans the live placed-structure collection at 0x0062b26c, rejects sites whose owner field [site+0x276] is already nonzero, filters candidates through the subtype-4 predicate 0x0040d360, scores surviving sites against company linkage/age/proximity through 0x0040d540 and 0x0040cac0, and then commits the winning site through 0x004269b0 before the shared news lane 0x004554e0 formats the headline.".to_string(),
     );
     notes.push(
-        "The shellless acquisition frontier is narrower now too: the peer-site selector/linked-peer seam is grounded enough to plan around, and the company/chairman side now includes the save-native route-anchor tuple used by 0x00401860 on top of the existing runtime-backed stat-family and roster inputs. The remaining blocker is placed-structure-side restore or rebuild ownership for [site+0x276], [site+0x2a4], and the cached tri-lane [site+0x310/+0x338/+0x360], plus the save-native projection of the subtype gate consumed through 0x0040d360.".to_string(),
+        "The shellless acquisition frontier is narrower now too: the peer-site selector/linked-peer seam is grounded enough to plan around, the company/chairman side now includes the save-native route-anchor tuple used by 0x00401860, the live owner-company meaning of [site+0x276] is grounded through 0x0047efe0, and the subtype owner strip is bounded under the aux-candidate load chain 0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0. The remaining blocker is the placed-structure-side restore or replay ownership for [site+0x276], [site+0x2a4], and the cached tri-lane [site+0x310/+0x338/+0x360], plus the projection from [site+0x04] back into the loaded candidate subtype row.".to_string(),
     );
     notes.push(
         "Direct disassembly now tightens the remaining placed-structure lanes too: 0x0040cac0 is only the raw tri-lane delta reader over [site+0x310/+0x338/+0x360]; 0x0040d360 is only the exact subtype test [candidate+0x32] == 4; and the current binary write scan finds no direct placed-structure runtime writer for either [site+0x2a4] or [site+0x310/+0x338/+0x360], which now makes both lanes look payload/restore-owned rather than service-produced.".to_string(),
@@ -27819,7 +27824,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 7);
-        assert_eq!(trace.known_bridge_helpers.len(), 41);
+        assert_eq!(trace.known_bridge_helpers.len(), 42);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -27897,7 +27902,7 @@ mod tests {
             trace
                 .near_city_acquisition_runtime_backed_input_families
                 .len(),
-            7
+            9
         );
         assert_eq!(trace.near_city_acquisition_remaining_owner_gaps.len(), 4);
         assert_eq!(trace.near_city_acquisition_region_lane_statuses.len(), 4);
@@ -27948,6 +27953,21 @@ mod tests {
                 .any(|line| line.contains("[company+0x0d35]")
                     && line.contains("[company+0x7664/+0x7668/+0x766c]"))
         );
+        assert!(
+            trace
+                .near_city_acquisition_runtime_backed_input_families
+                .iter()
+                .any(|line| line.contains("0x0047efe0") && line.contains("[site+0x276]"))
+        );
+        assert!(
+            trace
+                .near_city_acquisition_runtime_backed_input_families
+                .iter()
+                .any(
+                    |line| line.contains("0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0")
+                        && line.contains("[candidate+0x32]")
+                )
+        );
         assert!(
             trace
                 .near_city_acquisition_runtime_backed_input_families
@@ -27967,7 +27987,7 @@ mod tests {
             trace
                 .near_city_acquisition_remaining_owner_gaps
                 .iter()
-                .any(|line| line.contains("[site+0x276]"))
+                .any(|line| line.contains("[site+0x276]") && line.contains("0x0047efe0"))
         );
         assert!(
             trace
@@ -27976,6 +27996,15 @@ mod tests {
                 .any(|line| line.contains("[site+0x2a4]")
                     && line.contains("placed-structure runtime writer"))
         );
+        assert!(
+            trace
+                .near_city_acquisition_region_lane_statuses
+                .iter()
+                .any(
+                    |line| line.contains("0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0")
+                        && line.contains("[site+0x04]")
+                )
+        );
         assert!(
             trace
                 .peer_site_runtime_reconstruction_steps
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index d92abb4..9481a35 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -74,8 +74,13 @@ Working rule:
   - the winning site id is staged in `[site+0x2a4]` before `0x004269b0` commits the acquisition
 - That leaves the acquisition blocker set tighter than before:
   - peer-site and linked-site replay seams are grounded enough for planning
-  - remaining non-hook gaps are the placed-structure save/rebuild lanes `[site+0x276]`, `[site+0x2a4]`,
-    `[site+0x310/+0x338/+0x360]`, and subtype byte `[candidate+0x32] == 4`
+  - the live owner-company meaning of `[site+0x276]` is already grounded through `0x0047efe0`,
+    and the subtype byte consumed as `[candidate+0x32] == 4` is already bounded under the
+    aux-candidate load/stem-policy chain
+    `0x004131f0 -> 0x00412fb0 -> 0x004120b0 -> 0x00412ab0`
+  - remaining non-hook gaps are the save or replay projection of `[site+0x276]`, the staged winner
+    lane `[site+0x2a4]`, the cached tri-lane `[site+0x310/+0x338/+0x360]`, and the projection from
+    restored backing-record selector `[site+0x04]` back into the loaded candidate subtype row
   - direct disassembly now shows the generic base constructor `0x0052edf0` clearing base state
     through `0x0052ecd0` and then writing `[this+0x04]` from caller arg `1`
   - `0x00455b70` is the concrete placed-structure specialization constructor feeding