Narrow late region reseed owner strip

crates/rrt-runtime/src/smp.rs

@@ -4263,10 +4263,13 @@ fn build_region_service_trace_report(
                 "the later restore-band siblings are tighter now too: 0x00487de0 clears the prior chunked border queues through 0x00533cf0, builds a small per-region id map from [region+0x00]/[region+0x35] keyed by class [region+0x31], scans the live world raster at [world+0x2131], and appends fresh border-segment rows through 0x00536ea0 without touching [region+0x25e/+0x276/+0x302/+0x316]".to_string(),
                 "the neighboring world-grid reseed 0x0044c4b0 is tighter now too: it clears bit 0x10 across the live grid byte at cell offset +0xe6, then walks the live region collection at 0x0062bae0, admits only class-0 records via [region+0x23e], resolves one representative center cell through 0x00455f60, and marks that same bit back on, which again reads as raster presentation state rather than pending/completion latch restore".to_string(),
                 "the companion region-set rebuild above that border pass is narrower now too: 0x00487650 is only a small constructor wrapper over 0x00487540 that seeds [region+0x00] from the caller-supplied id, while 0x004881b0 rebuilds [region+0x3d] from the world raster histogram, zeroes [region+0x41], folds class-0 children back into parent [region+0x41] through [region+0x35], and then tails into the border emitter on 0x006cfc9c via 0x00487de0".to_string(),
+                "the later class-0 batch at 0x00438087 is narrower now too: it walks live class-0 regions through 0x0062bae0, scales the mirrored severity/source pair [region+0x25a/+0x25e] from the current value using world-side factors, clamps the result, and then hands the whole collection to 0x00421c20; it never reads or writes [region+0x276/+0x302/+0x316]".to_string(),
+                "the follow-on 0x00421c20 is now bounded as a parameterized region-collection helper rather than a latch owner: it loops the same collection with caller-provided scalar arguments, dispatches each record through 0x004235c0, and never touches the pending/completion/one-shot lanes directly".to_string(),
+                "the subsequent world follow-ons are narrower too: 0x00437b20 only stages one world-side reentry guard at [world+0x46c38], iterates the live region collection through 0x00423d30, and then tails into 0x00434d40, while 0x00437220 rebuilds broader world byte-set state around [world+0x66be/+0x69db] and other global collections. Those branches are still broader runtime follow-ons, not direct owners of [region+0x276/+0x302/+0x316]".to_string(),
             ],
             blockers: vec![
                 "which later restore or rebuild owner rehydrates [region+0x276/+0x302/+0x316] after the 0x00421510 -> 0x0041f5c0 -> 0x00455fc0 path completes".to_string(),
-                "whether [region+0x25e] severity/source and any stable region id/class discriminator are serialized elsewhere in the tagged region body or recomputed later by another post-load owner after the 0x00421ce0 -> 0x0041fb00 -> 0x00421730 class-0 raster/id sweep, 0x004881b0 companion cell-count rebuild, 0x00487de0 border rebuild, and 0x0044c4b0 center-cell reseed are all ruled out as latch owners".to_string(),
+                "whether [region+0x25e] severity/source and any stable region id/class discriminator are serialized elsewhere in the tagged region body or recomputed later by another post-load owner after the 0x00421ce0 -> 0x0041fb00 -> 0x00421730 class-0 raster/id sweep, 0x004881b0 companion cell-count rebuild, 0x00487de0 border rebuild, 0x0044c4b0 center-cell reseed, the 0x00438087 mirrored severity/source batch, and the 0x00421c20 -> 0x004235c0 follow-on helper loop are all ruled out as latch owners".to_string(),
             ],
         },
         SmpServiceConsumerHypothesis {

docs/rehost-queue.md

@@ -385,6 +385,18 @@ Working rule:
   emitter over the world raster, and `0x0044c4b0` is the center-cell bit-`0x10` reseed pass. So
   the next region slice should stop revisiting those later owners and stay focused on the still-
   missing save-owned latch / severity / stable-id seam.
+- The later class-`0` batch at `0x00438087` is narrowed now too: it walks live class-`0` regions
+  through `0x0062bae0`, rescales the mirrored severity/source pair `[region+0x25a/+0x25e]` from
+  the current value using world-side factors, clamps the result, and then hands the collection to
+  `0x00421c20`; it still does not touch `[region+0x276/+0x302/+0x316]`.
+- Its follow-on `0x00421c20` is bounded as a parameterized region-collection helper rather than a
+  latch owner: it loops the same collection with caller-supplied scalar arguments, dispatches each
+  record through `0x004235c0`, and does not write the pending/completion/one-shot lanes directly.
+- The subsequent world follow-ons are narrower too: `0x00437b20` only stages a world-side reentry
+  guard at `[world+0x46c38]`, iterates the live region collection through `0x00423d30`, and tails
+  into `0x00434d40`, while `0x00437220` rebuilds broader world byte-set state around
+  `[world+0x66be/+0x69db]` and other global collections. Those later branches should stay out of
+  the remaining region latch-restore search too.
 - The widened real-save region trace rules out one more false lead too: on grounded saves the
   `0x55f2` fixed-policy chunk keeps all three reserved dwords at `0x00000000` and the trailing word
   at invariant `0x0001`, so that fixed chunk is not currently carrying the missing latch or stable