Census locomotive tail blockers across local saves

docs/README.md

@@ -313,8 +313,12 @@ The highest-value next passes are now:
 - recovered scalar locomotive availability and locomotive-cost descriptors now import through that
   save-native or embedded `RuntimeState.locomotive_catalog` context into the ordinary
   `named_locomotive_availability` and `named_locomotive_cost` runtime maps
-- the grounded executable lower locomotive prefix now extends through save-backed locomotive id
-  `61` (`Zephyr`); the unresolved lower tail and upper locomotive bands stay on explicit parity
+- the full lower locomotive bands now execute through that save-native ordinal catalog too:
+  availability `241..351` and cost `352..451`; the checked `29`-save `.gms + .gmx`
+  `locomotive-catalog-tail-census.json` export now fixes the last save-stable static descriptor
+  boundary at ordinal `58` (`VL80T`) and leaves descriptor `452` plus the upper bands
+  `457..474` / `475..502` as external-corpus or dynamic blockers rather than active repo-local
+  static work
 - cargo-production `230..240` and territory-access-cost `453` now execute too through minimal
   world-side scalar landing surfaces: slot-indexed `cargo_production_overrides` and
   `world_restore.territory_access_cost`
@@ -331,8 +335,10 @@ The highest-value next passes are now:
 - the company/chairman frontier has moved too: checked-in save-slice documents can now carry that
   context natively, so the next work on that axis is broader recovery and eventual raw save
   reconstruction rather than overlay-only ownership
-- keep in mind that the current local `.gms` corpus still exports with no packed event collection,
-  so real descriptor mapping needs to stay plumbing-first until better captures exist
+- keep in mind that the current local `.gms + .gmx` corpus does carry packed-event collections,
+  but the checked `29`-save locomotive census still finds no descriptor carriers in `452` or
+  `457..502`, so further locomotives-page closure now needs either broader save evidence or
+  dynamic captures
 - use `rrt-hook` primarily as optional capture or integration tooling, not as the first execution
   environment
 - keep `docs/runtime-rehost-plan.md` current as the runtime baseline and next implementation slice

docs/rehost-queue.md

@@ -10,18 +10,23 @@ This file is the short active queue for the current runtime and reverse-engineer
 
 ## Current Active Items
 
-- Keep the periodic-company trace as the main shellless simulation frontier, with the next concrete control-lane pass focused on the ordinary loaded runtime-effect strip `0x00444d92 -> 0x00432f40(kind 8) -> 0x004323a0 -> 0x00431b20`.
-  The checked `rt3_105/maps` compact-dispatch corpus is now exported directly and partially mirrored into the periodic-company trace: `41` maps scanned, `38` with dispatch-strip rows, `318` nondirect rows total, the add-building subset is only `10` grouped occurrences across `7` descriptor keys, and the strongest broader nondirect families are now bounded too at `36` grouped occurrences across `18` maps for `nondirect-ge1e-h0001-0360-0004-0100-0200-p0000-0000-0000-ffff :: [864:4]` plus `27` across `14` maps for the mixed `[-1:4]` cluster. All of those checked rows still lack recovered trigger kind. The packed-state bridge is narrower than that queue head used to allow too: `0x0042db20/0x00430d70` rebuild and serialize only the fixed text bands plus the standalone and grouped row lists, while the metadata band `+0x7ee..+0x80e` is only mirrored by deep-copy helper `0x0042e050`. The active open question is therefore which ordinary loaded rows acquire or bypass the missing trigger-kind control lane before they can reach placed-structure mutation opcodes.
-  The dispatcher-side caller census is wider in a way that makes the remaining blocker sharper: `0x00432f40` is already driven shelllessly for kinds `1/0/3/2` and then `5/4` from the recurring simulation-maintenance strip `0x0040a220..0x0040a9ac`, for kind `7` from the grounded company-startup family, and for kind `6` from the placed-structure post-create, startup-refresh, and route-entry post-change tails, while `LoadScreen.win` still owns kind `9`. So the missing piece is no longer “find another shellless dispatcher entrypoint.” It is why ordinary loaded rows still fail to present a matching nonzero `[event+0x7ef]` when the later world-entry one-shot at `0x00444d92` requests kind `8`.
-  The largest direct writer table is ruled out now too: `0x004d8ea0` is the shell-side `EventConditions.win` commit helper, where controls `0x4e98..0x4ea2` write `[event+0x7ef] = 0..10` on the currently selected live event, so that seed family does not explain shellless post-load bringup.
-  The broad scenario-name fixup owner is narrower in the same direction: `0x00442c30` really does mutate live event rows after reload, but its grounded trigger-kind writes still only retag `1 -> 5` and `0 -> 2`, while the surrounding event-side branches only patch modifier bytes or nested payload dwords under already-existing kinds. No grounded branch there seeds kind `8`.
-  The metadata-copy helper is ruled out in the same way: `0x0042e050` really does clone `[event+0x7ef]`, but the current whole-binary caller search still finds only the shell-side selected-event clone path `0x004db8b0`, not any shellless post-load or periodic caller.
-  The direct write census is tighter in the same direction: the only grounded explicit write of value `8` into `[event+0x7ef]` is `0x004d91b3` inside that same shell helper, while the runtime-side grounded writers still only cover zero-init, copy, `2/3` follow-on seeds, and the later `5` / `2` retags.
-  Static progress on this head now appears genuinely blocked: the whole-binary `[...+0x7ef]` reference census still collapses to that same grounded writer set plus the already-known compare and copy helpers, so the next honest step likely requires hook-side or runtime tracing between reload `0x00433130` and the world-entry kind-`8` sweep at `0x00444d92`.
+- No active repo-local non-dynamic items remain.
+  The last local static head was the locomotives-page tail, and the checked [locomotive catalog tail census](../artifacts/exports/rt3-1.06/locomotive-catalog-tail-census.json) now exhausts the full local `.gms + .gmx` corpus under `rt3_wineprefix/drive_c`: `29` candidate saves found, `26` parsed samples, `5` catalog-bearing saves, one save-stable ordinal prefix through `58` (`VL80T`), two observed `59+` tail clusters (`g.gms` with `242 A1 / Class 460 / Class A1 / Class P8 / U1`, and the four classic 1.05 saves with `GP 35 / U1 / Zephyr`), zero observed `Class QJ`, and zero packed-event carriers for descriptor `452` or the upper bands `457..474` / `475..502`.
+  The added `18` `.gmx` sandbox saves widen the local corpus and packed-event coverage, but they still contribute no named locomotive table and no derived `locomotive_catalog`, so they do not move the save-native tail evidence beyond the same five catalog-bearing `.gms` saves.
+  That means the remaining locomotive questions are no longer repo-local static work. They now require either a broader save corpus or dynamic tracing.
+  Preserved checked locomotive blocker detail now lives in [Locomotive descriptor tails](rehost-queue/locomotive-descriptor-tails-2026-04-21.md).
+  Preserved checked format inventory detail now lives in [RT3 format inventory](rehost-queue/format-inventory-2026-04-21.md).
+
+## Preserved External And Dynamic Blockers
+
+- The locomotives-page tail remains preserved as an external-corpus blocker.
+  Static repo-local work on this head is now exhausted: the local `29`-save `.gms + .gmx` census proves the stable prefix through `58`, proves the same two scenario-dependent `59+` tail families, and still finds no `Class QJ` placement plus no descriptor carriers in `452` or `457..502`. The next honest non-hook step requires a broader save corpus; the next non-static step requires dynamic tracing.
+  Preserved checked blocker detail now lives in [Locomotive descriptor tails](rehost-queue/locomotive-descriptor-tails-2026-04-21.md).
+- The periodic-company control-lane head remains preserved as a dynamic blocker around the ordinary loaded runtime-effect strip `0x00444d92 -> 0x00432f40(kind 8) -> 0x004323a0 -> 0x00431b20`.
+  Static progress on this head now appears genuinely blocked: the whole-binary `[...+0x7ef]` reference census still collapses to the grounded writer set plus the already-known compare and copy helpers, so the next honest step likely requires hook-side or runtime tracing between reload `0x00433130` and the world-entry kind-`8` sweep at `0x00444d92`.
   Preserved checked control-lane detail now lives in [Periodic company control lane](rehost-queue/periodic-company-control-lane-2026-04-21.md).
-- Keep the next static Tier-2 building pass focused on the earlier seed/projection seam into `0x00412d70`, not another broad `BuildingTypes` sweep.
-  The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The load-side handoff is narrower now too: `0x004120b0` explicitly reads `[candidate+0xba]` and `[candidate+0xbb]` as one-byte stream fields, and the very next projection owner `0x00412d70` immediately consumes those bytes in two passes, first `+0xba` and then `+0xbb`, to pick one seed row whose full `0x1f2`-dword body will be cloned or reused for each numbered runtime record. The stock decode side is narrower in the same direction: `0x00414490` does not just copy the `0xb8..0xbb` tail, it already derives the optional plane size from `[record+0xb8] * [record+0xb9] << 5` and uses the high nibble of `[record+0xba]` while materializing the four optional plane buffers at `[record+0xcf/+0xd3/+0xd7/+0xdb]`, before `0x00416ce0` remaps only the bare `port` / `warehouse` names and the later `0x00419230` rebank-or-clone pass consumes any bank-qualified owners. The same static pass rules out one lingering false lead too: the earlier suspected `0x00414500..0x00414b14` replay strip is not a separate serializer or import family at all, just the interior plane-decode band of `0x00414490`. The stock `BuildingTypes` corpus is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which later seed or projection seam turns that already-decoded stock-side shape or selector state together with the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.
-  Static progress on this head is close to the same boundary now: the stock decode chain, the bare-name remap callback, the rebank-or-clone owner, and the earlier suspected mid-range replay strip are all grounded, so the next honest step likely requires runtime tracing of which source rows actually enter the live bank-qualified seed set.
+- The Tier-2 building head remains preserved as a dynamic blocker around the seed/projection seam into `0x00412d70`.
+  The stock decode chain, the bare-name remap callback, the rebank-or-clone owner, and the earlier suspected mid-range replay strip are all now grounded, so the next honest step likely requires runtime tracing of which source rows actually enter the live bank-qualified seed set.
   Preserved checked row-family detail now lives in [Tier2 candidate row families](rehost-queue/tier2-candidate-row-families-2026-04-21.md).
   Preserved checked stock selector-byte detail now lives in [Tier2 selector-byte sources](rehost-queue/tier2-selector-byte-sources-2026-04-21.md).
   Preserved checked rebuild sequencing detail now lives in [Tier2 rebuild sequencing](rehost-queue/tier2-rebuild-sequencing-2026-04-21.md).
@@ -29,6 +34,8 @@ This file is the short active queue for the current runtime and reverse-engineer
 ## Preserved Detail
 
 - [Archive snapshot](rehost-queue/archive-2026-04-19.md)
+- [RT3 format inventory](rehost-queue/format-inventory-2026-04-21.md)
+- [Locomotive descriptor tails](rehost-queue/locomotive-descriptor-tails-2026-04-21.md)
 - [Periodic company control lane](rehost-queue/periodic-company-control-lane-2026-04-21.md)
 - [Tier2 candidate row families](rehost-queue/tier2-candidate-row-families-2026-04-21.md)
 - [Tier2 rebuild sequencing](rehost-queue/tier2-rebuild-sequencing-2026-04-21.md)

docs/rehost-queue/README.md

@@ -4,6 +4,11 @@ This directory preserves older queue snapshots and long-form implementation note
 useful as evidence, but should not stay in the short active queue file.
 
 - `archive-2026-04-19.md`: preserved detailed queue snapshot from the pre-index cleanup.
+- `format-inventory-2026-04-21.md`: current file-format inventory under `rt3/` and `rt3_105/`,
+  including the RT3-native families we still do not parse.
+- `locomotive-descriptor-tails-2026-04-21.md`: checked `.gms + .gmx` local locomotive catalog
+  census and the remaining external-corpus blocker around `Class QJ`, descriptor `452`, and the
+  upper descriptor bands.
 - `periodic-company-control-lane-2026-04-21.md`: checked compact-dispatch/control-lane evidence
   for the active periodic-company queue head, including the top ordinary nondirect cluster carrier
   maps.

docs/rehost-queue/locomotive-descriptor-tails-2026-04-21.md

@@ -0,0 +1,139 @@
+# Locomotive Descriptor Tails (2026-04-21)
+
+This note preserves the checked evidence behind the locomotives-page tail after the full local
+`.gms + .gmx` save-corpus pass, so the short queue can treat the remaining work honestly as an
+external-corpus or dynamic blocker rather than another repo-local static task.
+
+## Local Save-Corpus Census
+
+The checked [locomotive catalog tail census](../../artifacts/exports/rt3-1.06/locomotive-catalog-tail-census.json)
+now exhausts the full local save corpus under `rt3_wineprefix/drive_c`:
+
+- `29` candidate saves found
+- `26` parsed samples
+- `5` saves with a save-side named locomotive table and derived `locomotive_catalog`
+- `26` saves with packed-event collections present
+- one save-stable catalog prefix through ordinal `58` (`VL80T`)
+- two observed tail clusters beyond that prefix:
+  - one `63`-entry tail on `g.gms` / `Spanish Mainline.gmp`: `242 A1 / Class 460 / Class A1 /
+    Class P8 / U1`
+  - one `61`-entry tail on the four 1.05 save families: `GP 35 / U1 / Zephyr`
+
+The added `18` `.gmx` sandbox saves still carry no reconstructed named locomotive table and no
+derived `locomotive_catalog`, so they widen the local event corpus without widening the save-native
+ordinal catalog evidence. The three classic `rt3/` `.gms` saves (`Autosave.gms`, `hh.gms`,
+`kk.gms`) remain catalog-free too, so the save-native tail evidence is still carried only by the
+same five 1.05 `.gms` saves.
+
+The scan still skips the three classic `rt3/` sandbox saves (`Autosave.gmx`, `aaa.gmx`,
+`bbb.gmx`) at save-slice load time, so the currently parsed sample set is `26` rather than the
+full `29` candidate paths. That does not change the locomotive blocker: none of the successfully
+parsed `.gmx` samples widens the save-native catalog, places `Class QJ`, or surfaces descriptor
+carriers in `452` or `457..502`.
+
+## Grounded Lower Bands
+
+The lower descriptor bands are now grounded enough to execute through the existing save-native
+owner seam:
+
+- availability descriptors `241..351` already map directly onto recovered locomotive ids `1..111`
+- cost descriptors `352..451` already map directly onto recovered locomotive ids `1..100`
+- the save-side named locomotive table already projects into `RuntimeState.locomotive_catalog` as
+  one ordinal id-to-name map derived from row order
+- that means the remaining lower-tail rows `302..351` and `413..451` are no longer missing an
+  owner seam; they are just later ordinals on the same catalog
+
+The old “grounded executable prefix through save-backed locomotive id `61` (`Zephyr`)" boundary is
+therefore retired. The whole lower bands are executable whenever the save or overlay supplies the
+catalog context.
+
+## Grounded Shipped Name Cohort
+
+The remaining lower-tail labels are no longer blocked on missing shipped engine names.
+
+The checked export [engine-type locomotive display census](../../artifacts/exports/rt3-1.06/engine-type-locomotive-display-census.json)
+now parses the fixed `.car` header fields for every shipped `Data/EngineTypes` locomotive pair:
+
+- `66` shipped `.car` / `.lco` locomotive families
+- `61` primary display names that match the broader checked shipped-name prefix
+- `5` extra shipped named families not present in the current grounded prefix:
+  - `242 A1`
+  - `Class 460`
+  - `Class A1`
+  - `Class P8`
+  - `Class QJ`
+
+That means the remaining lower-tail uncertainty is no longer “what are the extra shipped
+locomotive names?” It is where those five named families land in the live ordinal catalog that the
+save-side named availability table mirrors.
+
+The full local save corpus tightens that further. The only observed nonclassic tail in the checked
+census is `rt3_wineprefix/drive_c/rt3_105/Saved Games/g.gms`, which exposes one `63`-entry named
+locomotive table whose observed tail is:
+
+- `59` `242 A1`
+- `60` `Class 460`
+- `61` `Class A1`
+- `62` `Class P8`
+- `63` `U1`
+
+That observation matters because the four catalog-bearing 1.05 save families still carry the
+classic `59..61` tail `GP 35 / U1 / Zephyr`. So the currently honest static descriptor-name
+boundary is not the broader shipped-name prefix through `61`; it is the last save-stable prefix
+through ordinal `58` (`VL80T`). After that point, save-backed ordinal names are real and
+executable, but they are no longer universal enough to hard-code in the static semantic catalog.
+
+The same checked local corpus still does **not** surface `Class QJ`, even though the shipped
+engine-type corpus proves that family exists on disk. So the current non-hook evidence only closes
+the dynamic tail through the observed `63`-entry family above; it does not yet place the fifth
+extra shipped name in any live ordinal slot.
+
+The same checked local corpus also exposes no packed-event rows in descriptor range `452..502`, so
+the remaining `Unknown Loco Cost` and upper-band frontier is absent from the local save-backed
+event corpus as well as unmapped in the static descriptor metadata.
+
+## Remaining Blocker
+
+What is left is narrower and cleaner, but it is no longer a repo-local static task:
+
+- ordinal placement of the scenario-dependent locomotive tail beyond the save-stable `1..58` prefix
+- descriptor `452` `Unknown Loco Cost`
+- upper availability band `457..474`
+- upper cost band `475..502`
+
+The upper bands still carry only slot labels in the checked semantic catalog:
+
+- `Upper-Band Locomotive Availability Slot 1..18`
+- `Upper-Band Locomotive Cost Slot 1..28`
+
+The lower bands now split cleanly into two layers:
+
+- ordinals `1..58` keep fixed checked descriptor labels through `VL80T`
+- ordinals `59+` stay executable through recovered ids plus save catalog context, but the checked
+  semantic catalog keeps generic slot labels because the local save corpus already shows
+  scenario-dependent tails
+
+Unlike the lower bands, the current checked row summary metadata does not yet recover live
+locomotive ids for the upper-band descriptors at all.
+
+## Blocker Result
+
+The next question is no longer whether locomotive page descriptors can import through a save-native
+owner seam at all, or whether the shipped engine-type files even have stable names. The checked
+repo-local answer is already as tight as it can get:
+
+- where the extra shipped named families (`242 A1`, `Class 460`, `Class A1`, `Class P8`,
+  `Class QJ`) land across the scenario-dependent tail beyond the save-stable `1..58` prefix, and
+- whether the upper bands continue the same ordinal locomotive catalog after the lower `1..111` /
+  `1..100` families, or
+- do they belong to a separate page-owned selector family that only sits adjacent in the recovered
+  `EventEffects` table
+
+Descriptor `452` should stay separate from that question until stronger evidence ties it to either
+the lower cost band or the upper tails.
+
+The current repo-local blocker is therefore explicit:
+
+- the next honest non-hook step needs a broader save corpus than the eight local saves already
+  exhausted here
+- the next honest non-static step needs dynamic tracing or hooks

docs/runtime-rehost-plan.md

@@ -166,13 +166,16 @@ Implemented today:
 - the recovered locomotives-page availability bands can now import as full scalar overrides
   through `RuntimeState.locomotive_catalog` into `RuntimeState.named_locomotive_availability`;
   raw `.smp` inspection/export now reconstructs the save-side locomotive row family and derives the
-  catalog directly into save-slice documents, so standalone save-slice imports can execute those
-  rows whenever the save carries enough catalog entries, and the grounded executable lower prefix
-  now extends through save-backed locomotive id `61` (`Zephyr`)
-- the grounded lower locomotive-cost band `352..409` now imports too through the same save-native
-  or embedded catalog into the event-owned `RuntimeState.named_locomotive_cost` map when its
-  scalar payloads are nonnegative; the unresolved lower tail and upper cost tail now stay on
-  explicit parity instead of synthetic execution
+  catalog directly into save-slice documents, so standalone save-slice imports can execute the
+  full lower availability band `241..351` whenever the save carries enough catalog entries; the
+  checked `29`-save `.gms + .gmx` `locomotive-catalog-tail-census.json` export now fixes the last
+  save-stable static boundary at ordinal `58` (`VL80T`), leaving the upper bands `457..474`,
+  `475..502`, plus descriptor `452` as external-corpus or dynamic blockers instead of active
+  repo-local static work
+- the full lower locomotive-cost band `352..451` now imports too through the same save-native or
+  embedded catalog into the event-owned `RuntimeState.named_locomotive_cost` map when its scalar
+  payloads are nonnegative; the remaining unresolved tail is the separate descriptor `452` plus
+  the upper cost band `475..502`
 - the remaining recovered scalar world families now execute as well: cargo-production `230..240`
   rows lower into slot-indexed `cargo_production_overrides`, and territory-access-cost descriptor
   `453` lowers into `world_restore.territory_access_cost`