Rule out dynamic side-buffer ownership of acquisition tri-lane

crates/rrt-runtime/src/smp.rs

@@ -4634,9 +4634,10 @@ fn build_periodic_company_service_trace_report(
                 "0x0040cac0 is only the exact raw delta reader over [site+0x310/+0x338/+0x360]".to_string(),
                 "the current binary write scan finds no direct placed-structure runtime writer for [site+0x310/+0x338/+0x360]".to_string(),
                 "current checked-in save owners still do not serialize those lanes directly, which rules down the known save seams while leaving a later restore family open".to_string(),
+                "0x00481430 -> 0x0047d8e0 repopulates the dynamic side-buffer route-entry list, three byte arrays, five proximity buckets, and trailing scratch band from stream without claiming the tri-lane".to_string(),
             ],
             blockers: vec![
-                "no checked-in triplet or side-buffer payload field is tied directly to the tri-lane, and no later restore owner is grounded yet".to_string(),
+                "no checked-in triplet or side-buffer payload field is tied directly to the tri-lane, the dynamic side-buffer stream-load owner still does not claim it, and no later restore owner is grounded yet".to_string(),
             ],
         },
         SmpServiceConsumerHypothesis {
@@ -4740,6 +4741,8 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "0x004134d0 / 0x0040ef10 shared placed-structure allocator and finalize-or-rebuild lane for newly created site rows"
             .to_string(),
+        "0x00481430 / 0x0047d8e0 dynamic side-buffer stream-load owner repopulating route-entry lists, three byte arrays, five proximity buckets, and trailing scratch band"
+            .to_string(),
         "0x0052edf0 generic base constructor seeding [this+0x04] from caller arg 1".to_string(),
         "0x00455b70 placed-structure specialization constructor feeding 0x0052edf0 arg 3 as the primary selector and arg 1 as fallback"
             .to_string(),
@@ -4928,6 +4931,9 @@ fn build_periodic_company_service_trace_report(
     notes.push(
         "The create-side family is grounded separately too. City-connection direct placement already reaches the shared constructor/finalize strip 0x00402cb0 -> 0x00403ed5/0x0040446b -> 0x004134d0 -> 0x0040ef10, so the remaining shellless gap is no longer 'how are new placed structures finalized?' It is specifically how restored existing rows regain the owner-company lane, self-id lane, cached tri-lane, and cached candidate bridge before acquisition-style consumers run.".to_string(),
     );
+    notes.push(
+        "The tri-lane restore side is narrower now too. The checked-in dynamic side-buffer load owner 0x00481430 -> 0x0047d8e0 repopulates the route-entry list, three per-site byte arrays, five proximity buckets, and the trailing scratch band from stream, so that seam is no longer a plausible hidden owner for [site+0x310/+0x338/+0x360]. The remaining tri-lane question is now specifically a later restore family beyond the known triplet and side-buffer seams.".to_string(),
+    );
     notes.push(
         "Direct disassembly now tightens the remaining placed-structure lanes too: 0x0040cac0 is only the raw tri-lane delta reader over [site+0x310/+0x338/+0x360]; 0x0040d360 is only the exact subtype test [candidate+0x32] == 4; and the current binary write scan finds no direct placed-structure runtime writer for either [site+0x2a4] or [site+0x310/+0x338/+0x360], which now makes both lanes look payload/restore-owned rather than service-produced.".to_string(),
     );
@@ -27933,7 +27939,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 9);
-        assert_eq!(trace.known_bridge_helpers.len(), 49);
+        assert_eq!(trace.known_bridge_helpers.len(), 50);
         assert_eq!(trace.next_owner_questions.len(), 4);
         assert_eq!(trace.companies.len(), 1);
         assert_eq!(
@@ -28064,6 +28070,12 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("0x36b1/0x36b2/0x36b3"))
         );
+        assert!(
+            trace.near_city_acquisition_projection_hypotheses[1]
+                .evidence
+                .iter()
+                .any(|line| line.contains("0x00481430 -> 0x0047d8e0"))
+        );
         assert!(
             trace.near_city_acquisition_projection_hypotheses[2]
                 .candidate_consumers
@@ -28350,6 +28362,12 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("0x004134d0 / 0x0040ef10"))
         );
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x00481430 / 0x0047d8e0"))
+        );
         let city_branch = trace.companies[0]
             .branches
             .iter()

docs/rehost-queue.md

@@ -108,6 +108,10 @@ Working rule:
     the checked-in `0x36b1/0x36b2/0x36b3` triplet seam and the
     `0x4a9d/0x4a3a/0x4a3b` side-buffer seam still do not serialize `[site+0x310/+0x338/+0x360]`
     directly, so the known save seams are ruled down even though a later restore family is still open
+  - the dynamic side-buffer load seam is ruled down too:
+    `0x00481430 -> 0x0047d8e0` repopulates the route-entry list, three byte arrays, five
+    proximity buckets, and the trailing scratch band from stream, but still does not claim the
+    cached tri-lane
   - the third hypothesis is now a cached source/candidate bridge question, not just a raw
     `[site+0x04]` selector question:
     `0x0040cd70` seeds `[site+0x3cc/+0x3d0]` from `0x62b2fc / 0x62b268`,