Rank higher-layer consumer hypotheses

docs/README.md

@@ -201,8 +201,9 @@ The highest-value next passes are now:
   is still ambiguous, prefer rehosting the owning source state or real reader/setter family first
   instead of guessing another derived leaf field from neighboring raw offsets; the checked-in
   `docs/rehost-queue.md` file is the control surface for that work loop, and after each commit the
-  next queue item should run unless the queue is empty, a real blocker remains, or approval is
-  needed
+  next queue item should run unless the queue is empty, a real blocker remains that cannot be
+  advanced by targeted static analysis or by expanding the rehosted probe/owner surface without
+  guessing, or approval is needed
 - `rrt-runtime` now also exposes higher-layer probe commands for the current blocked frontier:
   `runtime inspect-periodic-company-service-trace <save.gms>`,
   `runtime inspect-region-service-trace <save.gms>`, and

docs/rehost-queue.md

@@ -4,11 +4,18 @@ Working rule:
 
 - Do not stop after commits.
 - After each commit, check this queue and continue.
-- Only stop if the queue is empty, you hit a real blocker, or you need approval.
+- Only stop if the queue is empty, you hit a real blocker that cannot be advanced by targeted
+  static analysis or by expanding the rehosted probe/owner surface without guessing, or you need
+  approval.
 - Before any final response, state which stop condition is true. If none is true, continue.
 
 ## Next
 
+- Use the higher-layer probes as the standard entry point for the current blocked frontier instead
+  of generic save scans:
+  `runtime inspect-periodic-company-service-trace <save.gms>`,
+  `runtime inspect-region-service-trace <save.gms>`, and
+  `runtime inspect-infrastructure-asset-trace <save.gms>`.
 - Follow the new higher-layer probe outputs instead of another blind save scan:
   `runtime inspect-infrastructure-asset-trace <save.gms>` now shows that the `0x38a5`
   infrastructure-asset seam is grounded and the old alias hypothesis is disproved on `q.gms`, so
@@ -18,6 +25,14 @@ Working rule:
   `0x00448a70/0x00493660/0x0048b660`, `0x004133b0`) plus bridge/tunnel/track-cap name-family
   counts, so the next pass can start at those concrete owners instead of the whole
   placed-structure family.
+- Rehost or bound the next concrete `Infrastructure` consumer above `0x38a5` instead of treating
+  “consumer mapping missing” as a stop: start with the checked-in candidate strip
+  `0x0048a1e0`, `0x0048dd50`, `0x00490a3c`, `0x004559d0`, `0x00455870`, `0x00455930`,
+  `0x00448a70/0x00493660/0x0048b660`, `0x004133b0`, and narrow that list to the first true
+  shellless owner that consumes the side-buffer seam. The infrastructure trace now ranks the
+  current best hypothesis as the child attach/rebuild strip
+  (`0x0048a1e0`, `0x0048dd50`, `0x00490a3c`), with the serializer/load companions next and the
+  route/local-runtime follow-on family explicitly secondary.
 - Reconstruct the save-side region record body on top of the newly corrected non-direct tagged
   region seam (`0x5209/0x520a/0x520b`, stride hint `0x06`, `Marker09` record stems) now that the
   `0x55f3` payload is known to be fully consumed by the embedded profile collection on grounded
@@ -32,6 +47,15 @@ Working rule:
   `0x00437c00`, `0x004c7520`, `0x004358d0`, `0x00438710`, `0x00420030/0x00420280`,
   `0x0047efe0`) so the next pass can focus on the missing saved latches and stable region id/class
   rather than on rediscovering the outer service family.
+- Rehost or bound the next concrete region owner above the missing latches instead of treating the
+  absent persisted queue as a stop: start with the checked-in owner strip `0x00422100`,
+  `0x004337c0`, `0x00437c00`, `0x004c7520`, `0x004358d0`, `0x00438710`,
+  `0x00420030/0x00420280`, `0x0047efe0`, and reduce it to the first true save-owned or rebuild
+  owner that can explain `[region+0x25e/+0x276/+0x302/+0x316]` plus a stable region id/class. The
+  region trace now ranks the current best hypothesis as the pending bonus service owner
+  (`0x004358d0`) plus the peer/linkage strip (`0x00420030/0x00420280`, `0x0047efe0`), with the
+  transient producer/queue family explicitly secondary and the queued kind-`7` modal dispatch kept
+  as shell-adjacent reference only.
 - Reconstruct the save-side placed-structure collection body on top of the newly grounded
   `0x36b1/0x36b2/0x36b3` header seam so the blocked city-connection / linked-transit branch can
   stop depending on atlas-only placed-structure and local-runtime refresh notes, especially the
@@ -70,6 +94,9 @@ Working rule:
 - Full shell/dialog ownership remains intentionally out of scope.
 - Any candidate slice that requires guessing rather than rehosting owning state or real
   reader/setter families stays blocked until a better owner seam is grounded.
+- Missing owner seams or dispatch mappings are not by themselves a stop condition when a targeted
+  static-mapping pass or a higher-layer rehosted trace/evaluator surface can still narrow them
+  further without guessing.
 - The city-connection announcement / linked-transit roster-maintenance branch is still blocked at
   the record-body level, not the collection-identity level: the runtime now has a corrected
   non-direct tagged region seam, a tagged train header-plus-directory seam, and a tagged
@@ -95,10 +122,16 @@ Working rule:
   consumer candidates rooted at the `Infrastructure` child attach/rebuild/serializer helpers and
   the later route/local-runtime follow-on owners. That means the next `0x38a5` pass can be
   targeted static mapping instead of another generic scan.
+- That same trace now also ranks those consumers into explicit hypotheses, so the next
+  infrastructure pass should start with the attach/rebuild strip instead of treating all
+  candidate owners as equally likely.
 - The region trace now also carries the corresponding atlas-backed candidate owner strip above the
   unresolved save latches, so the region frontier is now explicitly “missing persisted owner seam
   for `[region+0x25e/+0x276/+0x302/+0x316]` and stable region id/class,” not “unknown service
   family.”
+- That same trace now also ranks those owners into explicit hypotheses, so the next region pass
+  should start with the pending bonus service owner and peer/linkage strip rather than the queued
+  modal family.
 - Save inspection now splits the shared `0x5209/0x520a/0x520b` family correctly: the smaller
   direct `0x1d5` collection is the live train family and now exposes a live-entry directory rooted
   at metadata dword `16`, while the actual region family is the larger non-direct `Marker09`

docs/runtime-rehost-plan.md

@@ -296,7 +296,9 @@ bond-service simulation.
 The process rule for the remaining runtime work is explicit too: prefer rehosting owning state and
 real reader/setter families over guessing leaf fields, and use `docs/rehost-queue.md` as the
 checked-in control surface for the work loop. After each commit, check that queue and continue
-unless the queue is empty, a real blocker remains, or approval is needed.
+unless the queue is empty, a real blocker remains that cannot be advanced by targeted static
+analysis or by expanding the rehosted probe/owner surface without guessing, or approval is
+needed.
 The same control surface now also has matching runtime probes:
 `runtime inspect-periodic-company-service-trace <save.gms>`,
 `runtime inspect-region-service-trace <save.gms>`, and