From bed0ef86b0bccd535613a19eb1276f2a5ed562a3 Mon Sep 17 00:00:00 2001
From: Jan Petykiewicz <jan@mpxd.net>
Date: Sun, 19 Apr 2026 02:38:53 -0700
Subject: [PATCH] Bound runtime-effect per-record trigger gate

---
 crates/rrt-runtime/src/smp.rs | 10 ++++++++++
 docs/rehost-queue.md          |  8 ++++++++
 2 files changed, 18 insertions(+)

diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 5b42025..6711c02 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -9529,6 +9529,9 @@ fn parse_event_runtime_collection_summary_with_tag_width(
             control_lane_notes.push(
                 "the remaining non-editor [event+0x7ef] mutators are bounded away from restore too: the 0x00443200..0x004436e3 sweep searches existing live runtime-event names through 0x005a57cf (including strings like 'New Beginnings', 'Chicago to New York', 'The American', and 'Labor') and retags already-live records, so it reads as scenario-specific live maintenance rather than the missing 0x4e9a restore owner".to_string(),
             );
+            control_lane_notes.push(
+                "direct disassembly of 0x004323a0 now makes the live gate explicit too: the per-record service returns before dispatch unless one-shot latch [event+0x81f] is clear, mode byte [event+0x7ef] matches the selected trigger kind from 0x00432f40, and compact chain root [event+0x00] is nonzero; its kind-8 side path at 0x00432ca1..0x00432cb0 only calls 0x00438710 on already-live records with [event+0x7ef] == 8".to_string(),
+            );
         }
         if records_with_trigger_kind != 0 {
             control_lane_notes.push(format!(
@@ -22365,6 +22368,13 @@ mod tests {
                 && line.contains("New Beginnings")
                 && line.contains("The American")
         }));
+        assert!(summary.control_lane_notes.iter().any(|line| {
+            line.contains("0x004323a0")
+                && line.contains("[event+0x81f]")
+                && line.contains("[event+0x7ef]")
+                && line.contains("0x00432ca1..0x00432cb0")
+                && line.contains("0x00438710")
+        }));
         assert!(summary.control_lane_notes.iter().any(|line| {
             line.contains("0x00431b20 dispatch-strip opcodes present in decoded grouped rows = [4]")
         }));
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index 29e98e5..220bc02 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -280,6 +280,14 @@ Working rule:
     but emits only the corpus-level count fields, so the next broader map-install pass no longer
     needs to wade through every occurrence payload just to compare descriptor or trigger-kind
     coverage.
+  - the per-record trigger gate is explicit now too:
+    direct disassembly of `0x004323a0` shows the service returns before dispatch unless
+    one-shot latch `[event+0x81f]` is clear, mode byte `[event+0x7ef]` matches the selected
+    trigger-kind argument from `0x00432f40`, and the compact chain root `[event+0x00]` is
+    nonzero. The kind-`8` side path at `0x00432ca1..0x00432cb0` only calls `0x00438710` on
+    already-live records carrying `[event+0x7ef] == 8`. So the remaining ordinary bundle question
+    is no longer “does the service loop itself bypass the per-record trigger byte?”; it is which
+    later owner, if any, materializes or retags `[event+0x7ef]` for the nondirect compact rows.
   - cross-map probing now gives a better static-analysis lead too:
     `British Isles.gmp` shows no current `0x00431b20` dispatch-strip rows, `Germany.gmp` stays on
     `Game Variable 1` plus `Company Variable 3..4`, while `Texas Tea.gmp` adds `Economic Status`