Tighten Tier2 stock decode boundary

docs/control-loop-atlas/runtime-roots-camera-and-support-families.md

@@ -1426,6 +1426,15 @@
   tail-calling `0x00419230`. So the remaining Tier-2 source problem is increasingly “which stock
   rows that rebuild admits or seeds with nonzero bank bytes” rather than “which unrelated later
   service invokes the banked clone pass.”
+  The source-decoder edge inside that handoff is tighter in the same direction too. Direct
+  disassembly of `0x00414490` shows it already using the imported stock tail structurally rather
+  than merely forwarding it: after importing `[record+0xb8/+0xb9/+0xba/+0xbb]`, it derives the
+  optional-plane byte count from `[record+0xb8] * [record+0xb9] << 5`, allocates and zeroes the
+  four optional plane buffers at `[record+0xcf/+0xd3/+0xd7/+0xdb]`, and then uses the high nibble
+  of `[record+0xba]` while decoding those packed planes. So the remaining Tier-2 seam is not below
+  “raw stock bytes exist at all”; it is above a source decoder that already materializes the
+  shape-plane state before the later `0x00416ce0` bare-name remap and `0x00419230` rebank-or-clone
+  pass.
   The stock owner chain above those parser fields is explicit now too:
   `0x00438c8e -> 0x004131f0 -> 0x00412fb0 -> 0x004120b0` constructs root `0x0062b268`, and the
   adjacent `.rdata` strings at `0x005c93f4..0x005c940e` prove that `0x00412fb0` is the

docs/rehost-queue.md

@@ -18,7 +18,7 @@ This file is the short active queue for the current runtime and reverse-engineer
   The direct write census is tighter in the same direction: the only grounded explicit write of value `8` into `[event+0x7ef]` is `0x004d91b3` inside that same shell helper, while the runtime-side grounded writers still only cover zero-init, copy, `2/3` follow-on seeds, and the later `5` / `2` retags.
   Preserved checked control-lane detail now lives in [Periodic company control lane](rehost-queue/periodic-company-control-lane-2026-04-21.md).
 - Keep the next static Tier-2 building pass focused on the earlier seed/projection seam into `0x00412d70`, not another broad `BuildingTypes` sweep.
-  The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The load-side handoff is narrower now too: `0x004120b0` explicitly reads `[candidate+0xba]` and `[candidate+0xbb]` as one-byte stream fields, and the very next projection owner `0x00412d70` immediately consumes those bytes in two passes, first `+0xba` and then `+0xbb`, to pick one seed row whose full `0x1f2`-dword body will be cloned or reused for each numbered runtime record. The stock `BuildingTypes` side is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which earlier seed/projection path lifts that narrow stock-side signal and the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.
+  The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The load-side handoff is narrower now too: `0x004120b0` explicitly reads `[candidate+0xba]` and `[candidate+0xbb]` as one-byte stream fields, and the very next projection owner `0x00412d70` immediately consumes those bytes in two passes, first `+0xba` and then `+0xbb`, to pick one seed row whose full `0x1f2`-dword body will be cloned or reused for each numbered runtime record. The stock decode side is narrower in the same direction: `0x00414490` does not just copy the `0xb8..0xbb` tail, it already derives the optional plane size from `[record+0xb8] * [record+0xb9] << 5` and uses the high nibble of `[record+0xba]` while materializing the four optional plane buffers at `[record+0xcf/+0xd3/+0xd7/+0xdb]`, before `0x00416ce0` remaps only the bare `port` / `warehouse` names and the later `0x00419230` rebank-or-clone pass consumes any bank-qualified owners. The stock `BuildingTypes` corpus is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which later seed or projection seam turns that already-decoded stock-side shape or selector state together with the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.
   Preserved checked row-family detail now lives in [Tier2 candidate row families](rehost-queue/tier2-candidate-row-families-2026-04-21.md).
   Preserved checked stock selector-byte detail now lives in [Tier2 selector-byte sources](rehost-queue/tier2-selector-byte-sources-2026-04-21.md).
   Preserved checked rebuild sequencing detail now lives in [Tier2 rebuild sequencing](rehost-queue/tier2-rebuild-sequencing-2026-04-21.md).

docs/rehost-queue/tier2-selector-byte-sources-2026-04-21.md

@@ -58,8 +58,12 @@ claim:
 - the broader stock-side nonzero signal sits instead in the `.bty` alias-root family with
   `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty`
   and `Warehouse.bty`
+- the low source-record decoder `0x00414490` is already more than a passive copier:
+  it imports `[record+0xb8/+0xb9/+0xba/+0xbb]`, derives the optional-plane byte count from
+  `[record+0xb8] * [record+0xb9] << 5`, and then uses the high nibble of `[record+0xba]` while
+  materializing the four optional plane buffers at `[record+0xcf/+0xd3/+0xd7/+0xdb]`
 
 So the remaining Tier-2 question is still not “do the stock source files carry any selector-byte
 signal at all?” It is which earlier seed or projection seam lifts that narrow stock-side signal
-into the live candidate bank bytes `[candidate+0xba/+0xbb]` before `0x00412d70` and
-`0x00419230` consume it.
+and already-decoded optional-plane state into the live candidate bank bytes `[candidate+0xba/+0xbb]`
+before `0x00412d70` and `0x00419230` consume it.