Rank higher-layer consumer hypotheses

README.md

@@ -165,8 +165,9 @@ The working rule on the remaining frontier is explicit now too: when a lane is s
 should prefer rehosting the owning source state or the real reader/setter family rather than
 guessing one more derived leaf field from nearby offsets, and the checked-in
 [`docs/rehost-queue.md`](docs/rehost-queue.md) file is now the control surface for that loop:
-after each commit, check the queue and continue unless the queue is empty, a real blocker remains,
+after each commit, check the queue and continue unless the queue is empty, a real blocker remains
-or approval is needed. A checked-in
+that cannot be advanced by targeted static analysis or by expanding the rehosted probe/owner
+surface without guessing, or approval is needed. A checked-in
 The same runtime surface now also exposes higher-layer blocker probes:
 `runtime inspect-periodic-company-service-trace <save.gms>`,
 `runtime inspect-region-service-trace <save.gms>`, and

crates/rrt-runtime/src/smp.rs

@@ -2953,6 +2953,8 @@ pub struct SmpRegionServiceTraceReport {
     #[serde(default)]
     pub atlas_candidate_consumers: Vec<String>,
     #[serde(default)]
+    pub candidate_consumer_hypotheses: Vec<SmpServiceConsumerHypothesis>,
+    #[serde(default)]
     pub entries: Vec<SmpRegionServiceTraceEntry>,
     #[serde(default)]
     pub notes: Vec<String>,
@@ -2982,11 +2984,25 @@ pub struct SmpInfrastructureAssetTraceReport {
     #[serde(default)]
     pub atlas_candidate_consumers: Vec<String>,
     #[serde(default)]
+    pub candidate_consumer_hypotheses: Vec<SmpServiceConsumerHypothesis>,
+    #[serde(default)]
     pub branches: Vec<SmpServiceTraceBranchStatus>,
     #[serde(default)]
     pub notes: Vec<String>,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SmpServiceConsumerHypothesis {
+    pub label: String,
+    pub status: String,
+    #[serde(default)]
+    pub candidate_consumers: Vec<String>,
+    #[serde(default)]
+    pub evidence: Vec<String>,
+    #[serde(default)]
+    pub blockers: Vec<String>,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SmpLoadedSpecialConditionsTable {
     pub source_kind: String,
@@ -3604,6 +3620,61 @@ fn build_region_service_trace_report(
         "0x00420030 / 0x00420280 city-connection peer probes".to_string(),
         "0x0047efe0 placed-structure linked-company resolver".to_string(),
     ];
+    let candidate_consumer_hypotheses = vec![
+        SmpServiceConsumerHypothesis {
+            label: "pending region bonus service path".to_string(),
+            status: if analysis.region_record_triplets.is_some() {
+                "highest_priority_static_mapping_target".to_string()
+            } else {
+                "possible_consumer_family".to_string()
+            },
+            candidate_consumers: vec![
+                "0x004358d0 pending region bonus service owner".to_string(),
+                "0x00420030 / 0x00420280 city-connection peer probes".to_string(),
+                "0x0047efe0 placed-structure linked-company resolver".to_string(),
+            ],
+            evidence: vec![
+                "atlas already bounds this owner as the direct consumer of [region+0x276], [region+0x302], and [region+0x316]".to_string(),
+                "the new region trace already proves the record envelope and profile subcollection, so the remaining gap is the separate persisted latch seam rather than the service owner".to_string(),
+            ],
+            blockers: vec![
+                "persisted owner seam for [region+0x25e/+0x276/+0x302/+0x316]".to_string(),
+                "stable region id or class discriminator".to_string(),
+            ],
+        },
+        SmpServiceConsumerHypothesis {
+            label: "periodic producer and queued-notice path".to_string(),
+            status: "secondary_candidate_after_pending_service".to_string(),
+            candidate_consumers: vec![
+                "0x00422100 periodic class-0 region picker and queue seed owner".to_string(),
+                "0x004337c0 queued 0x20-byte notice-node append helper".to_string(),
+                "0x00438710 recurring queued-notice service owner".to_string(),
+            ],
+            evidence: vec![
+                "atlas ties these owners to the transient kind-7 queue family rooted at [world+0x66a6]".to_string(),
+                "grounded save probes now show that the ordinary-save queue family is not obviously persisted, so this looks more like runtime rebuild state than a direct save seam".to_string(),
+            ],
+            blockers: vec![
+                "transient queue is not obviously persisted in ordinary saves".to_string(),
+                "needs one upstream persisted latch or rebuild owner first".to_string(),
+            ],
+        },
+        SmpServiceConsumerHypothesis {
+            label: "queued kind-7 modal dispatch path".to_string(),
+            status: "shell_adjacent_reference_only".to_string(),
+            candidate_consumers: vec![
+                "0x00437c00 queued-kind dispatch owner".to_string(),
+                "0x004c7520 kind-7 region-focused custom-modal owner".to_string(),
+            ],
+            evidence: vec![
+                "atlas already bounds this family as the shell-facing modal dispatch above the queued region id".to_string(),
+                "it is still useful as a reference owner for field identity, but not the first shellless rehost target".to_string(),
+            ],
+            blockers: vec![
+                "full shell/dialog ownership remains out of scope".to_string(),
+            ],
+        },
+    ];
     let entries = analysis
         .region_record_triplets
         .as_ref()
@@ -3675,6 +3746,7 @@ fn build_region_service_trace_report(
             .map(|probe| probe.entries.len())
             .unwrap_or_default(),
         atlas_candidate_consumers,
+        candidate_consumer_hypotheses,
         entries,
         notes,
     }
@@ -3712,6 +3784,78 @@ fn build_infrastructure_asset_trace_report(
         "0x00448a70 / 0x00493660 / 0x0048b660 route and world follow-on family".to_string(),
         "0x004133b0 placed-structure local-runtime refresh outer owner".to_string(),
     ];
+    let candidate_consumer_hypotheses = vec![
+        SmpServiceConsumerHypothesis {
+            label: "infrastructure child attach/rebuild path".to_string(),
+            status: if side_buffer.is_some() && (bridge_like_name_pair_count > 0
+                || tunnel_like_name_pair_count > 0
+                || track_cap_like_name_pair_count > 0)
+            {
+                "highest_priority_static_mapping_target".to_string()
+            } else {
+                "possible_consumer_family".to_string()
+            },
+            candidate_consumers: vec![
+                "0x0048a1e0 infrastructure child attach helper".to_string(),
+                "0x0048dd50 infrastructure child rebuild loop".to_string(),
+                "0x00490a3c infrastructure payload attach helper".to_string(),
+            ],
+            evidence: vec![
+                format!(
+                    "real side-buffer name families currently count bridge/tunnel/track-cap pairs as {}/{}/{}",
+                    bridge_like_name_pair_count,
+                    tunnel_like_name_pair_count,
+                    track_cap_like_name_pair_count
+                ),
+                "atlas already bounds these helpers under the literal Infrastructure owner".to_string(),
+                "the side-buffer corpus is disjoint from the placed-structure triplet corpus, so a separate child/rebuild family is more plausible than a compact alias".to_string(),
+            ],
+            blockers: vec![
+                "exact compact-prefix regime semantics".to_string(),
+                "which child fields or grouped rows consume the side-buffer payload".to_string(),
+            ],
+        },
+        SmpServiceConsumerHypothesis {
+            label: "infrastructure serializer/load companion path".to_string(),
+            status: if side_buffer.is_some() {
+                "strong_static_mapping_candidate".to_string()
+            } else {
+                "possible_consumer_family".to_string()
+            },
+            candidate_consumers: vec![
+                "0x004559d0 infrastructure tagged string-triplet serializer".to_string(),
+                "0x00455870 infrastructure tagged string-triplet load companion".to_string(),
+                "0x00455930 infrastructure scalar-triplet serializer sibling".to_string(),
+            ],
+            evidence: vec![
+                "atlas already bounds the serializer/load strip around the Infrastructure owner and the same 0x55f1/0x55f2/0x55f3 tag family".to_string(),
+                "the save-side side-buffer carries embedded dual-name rows plus compact prefixes, which is compatible with a serializer-side bridge".to_string(),
+            ],
+            blockers: vec![
+                "whether the side-buffer is a direct serialized payload or one rebuild/cache layer above it".to_string(),
+            ],
+        },
+        SmpServiceConsumerHypothesis {
+            label: "route/local-runtime follow-on path".to_string(),
+            status: if side_buffer.is_some() {
+                "secondary_candidate_after_attach_rebuild".to_string()
+            } else {
+                "possible_consumer_family".to_string()
+            },
+            candidate_consumers: vec![
+                "0x00448a70 / 0x00493660 / 0x0048b660 route and world follow-on family".to_string(),
+                "0x004133b0 placed-structure local-runtime refresh outer owner".to_string(),
+            ],
+            evidence: vec![
+                "atlas ties the Infrastructure rebuild loop to later route-side and local-runtime follow-on owners".to_string(),
+                "current side-buffer trace shows separate infrastructure state but does not yet prove direct route-entry consumption".to_string(),
+            ],
+            blockers: vec![
+                "needs one upstream consumer or rebuild owner first".to_string(),
+                "no direct save-side evidence yet for route-entry or local-runtime field linkage".to_string(),
+            ],
+        },
+    ];
     let branches = vec![
         build_service_trace_branch_status(
             "infrastructure_asset_owner_seam",
@@ -3805,6 +3949,7 @@ fn build_infrastructure_asset_trace_report(
             .map(|probe| probe.overlapping_name_pair_count)
             .unwrap_or_default(),
         atlas_candidate_consumers,
+        candidate_consumer_hypotheses,
         branches,
         notes,
     }
@@ -21620,6 +21765,11 @@ mod tests {
         assert_eq!(trace.region_record_triplet_count, 1);
         assert_eq!(trace.queued_notice_record_count, 0);
         assert!(!trace.atlas_candidate_consumers.is_empty());
+        assert_eq!(trace.candidate_consumer_hypotheses.len(), 3);
+        assert_eq!(
+            trace.candidate_consumer_hypotheses[0].status,
+            "highest_priority_static_mapping_target"
+        );
         assert_eq!(trace.entries.len(), 1);
         assert_eq!(
             trace.entries[0].branches[0].status,
@@ -21676,7 +21826,20 @@ mod tests {
                 first_embedded_secondary_name: Some("Infrastructure".to_string()),
                 embedded_name_row_samples: Vec::new(),
                 compact_prefix_pattern_summaries: Vec::new(),
-                name_pair_summaries: Vec::new(),
+                name_pair_summaries: vec![SmpSavePlacedStructureDynamicSideBufferNamePairSummary {
+                    primary_name: "TrackCapST_Cap.3dp".to_string(),
+                    secondary_name: "Infrastructure".to_string(),
+                    count: 12,
+                    first_name_tag_relative_offset: 0x20,
+                    unique_compact_prefix_pattern_count: 2,
+                    dominant_prefix_leading_dword: 0xff0000ff,
+                    dominant_prefix_leading_dword_hex: "0xff0000ff".to_string(),
+                    dominant_prefix_trailing_word: 1,
+                    dominant_prefix_trailing_word_hex: "0x0001".to_string(),
+                    dominant_prefix_separator_byte: 0xff,
+                    dominant_prefix_separator_byte_hex: "0xff".to_string(),
+                    dominant_prefix_count: 9,
+                }],
                 evidence: Vec::new(),
             });
         analysis.placed_structure_dynamic_side_buffer_alignment =
@@ -21696,6 +21859,11 @@ mod tests {
         let trace = build_infrastructure_asset_trace_report(&analysis);
         assert!(trace.side_buffer_present);
         assert_eq!(trace.triplet_alignment_overlap_count, 0);
+        assert_eq!(trace.candidate_consumer_hypotheses.len(), 3);
+        assert_eq!(
+            trace.candidate_consumer_hypotheses[0].status,
+            "highest_priority_static_mapping_target"
+        );
         assert_eq!(trace.branches[0].status, "grounded_separate_owner_seam");
         assert_eq!(trace.branches[1].status, "disproved_by_grounded_probe");
     }

docs/README.md

@@ -201,8 +201,9 @@ The highest-value next passes are now:
   is still ambiguous, prefer rehosting the owning source state or real reader/setter family first
   instead of guessing another derived leaf field from neighboring raw offsets; the checked-in
   `docs/rehost-queue.md` file is the control surface for that work loop, and after each commit the
-  next queue item should run unless the queue is empty, a real blocker remains, or approval is
+  next queue item should run unless the queue is empty, a real blocker remains that cannot be
-  needed
+  advanced by targeted static analysis or by expanding the rehosted probe/owner surface without
+  guessing, or approval is needed
 - `rrt-runtime` now also exposes higher-layer probe commands for the current blocked frontier:
   `runtime inspect-periodic-company-service-trace <save.gms>`,
   `runtime inspect-region-service-trace <save.gms>`, and

docs/rehost-queue.md

@@ -4,11 +4,18 @@ Working rule:
 
 - Do not stop after commits.
 - After each commit, check this queue and continue.
-- Only stop if the queue is empty, you hit a real blocker, or you need approval.
+- Only stop if the queue is empty, you hit a real blocker that cannot be advanced by targeted
+  static analysis or by expanding the rehosted probe/owner surface without guessing, or you need
+  approval.
 - Before any final response, state which stop condition is true. If none is true, continue.
 
 ## Next
 
+- Use the higher-layer probes as the standard entry point for the current blocked frontier instead
+  of generic save scans:
+  `runtime inspect-periodic-company-service-trace <save.gms>`,
+  `runtime inspect-region-service-trace <save.gms>`, and
+  `runtime inspect-infrastructure-asset-trace <save.gms>`.
 - Follow the new higher-layer probe outputs instead of another blind save scan:
   `runtime inspect-infrastructure-asset-trace <save.gms>` now shows that the `0x38a5`
   infrastructure-asset seam is grounded and the old alias hypothesis is disproved on `q.gms`, so
@@ -18,6 +25,14 @@ Working rule:
   `0x00448a70/0x00493660/0x0048b660`, `0x004133b0`) plus bridge/tunnel/track-cap name-family
   counts, so the next pass can start at those concrete owners instead of the whole
   placed-structure family.
+- Rehost or bound the next concrete `Infrastructure` consumer above `0x38a5` instead of treating
+  “consumer mapping missing” as a stop: start with the checked-in candidate strip
+  `0x0048a1e0`, `0x0048dd50`, `0x00490a3c`, `0x004559d0`, `0x00455870`, `0x00455930`,
+  `0x00448a70/0x00493660/0x0048b660`, `0x004133b0`, and narrow that list to the first true
+  shellless owner that consumes the side-buffer seam. The infrastructure trace now ranks the
+  current best hypothesis as the child attach/rebuild strip
+  (`0x0048a1e0`, `0x0048dd50`, `0x00490a3c`), with the serializer/load companions next and the
+  route/local-runtime follow-on family explicitly secondary.
 - Reconstruct the save-side region record body on top of the newly corrected non-direct tagged
   region seam (`0x5209/0x520a/0x520b`, stride hint `0x06`, `Marker09` record stems) now that the
   `0x55f3` payload is known to be fully consumed by the embedded profile collection on grounded
@@ -32,6 +47,15 @@ Working rule:
   `0x00437c00`, `0x004c7520`, `0x004358d0`, `0x00438710`, `0x00420030/0x00420280`,
   `0x0047efe0`) so the next pass can focus on the missing saved latches and stable region id/class
   rather than on rediscovering the outer service family.
+- Rehost or bound the next concrete region owner above the missing latches instead of treating the
+  absent persisted queue as a stop: start with the checked-in owner strip `0x00422100`,
+  `0x004337c0`, `0x00437c00`, `0x004c7520`, `0x004358d0`, `0x00438710`,
+  `0x00420030/0x00420280`, `0x0047efe0`, and reduce it to the first true save-owned or rebuild
+  owner that can explain `[region+0x25e/+0x276/+0x302/+0x316]` plus a stable region id/class. The
+  region trace now ranks the current best hypothesis as the pending bonus service owner
+  (`0x004358d0`) plus the peer/linkage strip (`0x00420030/0x00420280`, `0x0047efe0`), with the
+  transient producer/queue family explicitly secondary and the queued kind-`7` modal dispatch kept
+  as shell-adjacent reference only.
 - Reconstruct the save-side placed-structure collection body on top of the newly grounded
   `0x36b1/0x36b2/0x36b3` header seam so the blocked city-connection / linked-transit branch can
   stop depending on atlas-only placed-structure and local-runtime refresh notes, especially the
@@ -70,6 +94,9 @@ Working rule:
 - Full shell/dialog ownership remains intentionally out of scope.
 - Any candidate slice that requires guessing rather than rehosting owning state or real
   reader/setter families stays blocked until a better owner seam is grounded.
+- Missing owner seams or dispatch mappings are not by themselves a stop condition when a targeted
+  static-mapping pass or a higher-layer rehosted trace/evaluator surface can still narrow them
+  further without guessing.
 - The city-connection announcement / linked-transit roster-maintenance branch is still blocked at
   the record-body level, not the collection-identity level: the runtime now has a corrected
   non-direct tagged region seam, a tagged train header-plus-directory seam, and a tagged
@@ -95,10 +122,16 @@ Working rule:
   consumer candidates rooted at the `Infrastructure` child attach/rebuild/serializer helpers and
   the later route/local-runtime follow-on owners. That means the next `0x38a5` pass can be
   targeted static mapping instead of another generic scan.
+- That same trace now also ranks those consumers into explicit hypotheses, so the next
+  infrastructure pass should start with the attach/rebuild strip instead of treating all
+  candidate owners as equally likely.
 - The region trace now also carries the corresponding atlas-backed candidate owner strip above the
   unresolved save latches, so the region frontier is now explicitly “missing persisted owner seam
   for `[region+0x25e/+0x276/+0x302/+0x316]` and stable region id/class,” not “unknown service
   family.”
+- That same trace now also ranks those owners into explicit hypotheses, so the next region pass
+  should start with the pending bonus service owner and peer/linkage strip rather than the queued
+  modal family.
 - Save inspection now splits the shared `0x5209/0x520a/0x520b` family correctly: the smaller
   direct `0x1d5` collection is the live train family and now exposes a live-entry directory rooted
   at metadata dword `16`, while the actual region family is the larger non-direct `Marker09`

docs/runtime-rehost-plan.md

@@ -296,7 +296,9 @@ bond-service simulation.
 The process rule for the remaining runtime work is explicit too: prefer rehosting owning state and
 real reader/setter families over guessing leaf fields, and use `docs/rehost-queue.md` as the
 checked-in control surface for the work loop. After each commit, check that queue and continue
-unless the queue is empty, a real blocker remains, or approval is needed.
+unless the queue is empty, a real blocker remains that cannot be advanced by targeted static
+analysis or by expanding the rehosted probe/owner surface without guessing, or approval is
+needed.
 The same control surface now also has matching runtime probes:
 `runtime inspect-periodic-company-service-trace <save.gms>`,
 `runtime inspect-region-service-trace <save.gms>`, and