diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index f7443dc..12a650b 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -4069,6 +4069,14 @@ fn build_periodic_company_service_trace_report(
             .to_string(),
         "0x004010f0 near-city acquisition region scorer over class-0 region entries".to_string(),
         "0x00405920 same-company industry proximity aggregator over linked site peers".to_string(),
+        "0x0041f6e0 center-cell token gate feeding 0x0042b2d0 over the current region".to_string(),
+        "0x0042b2d0 packed-u16 contains-key predicate over the region token list".to_string(),
+        "0x0047de00 linked-region resolver feeding the candidate status branch 0x0040c990"
+            .to_string(),
+        "0x004801a0 linked-transit route-anchor reachability gate for one candidate site"
+            .to_string(),
+        "0x00425b90 pending-bonus/company-state gate over the [region+0x276] companion object"
+            .to_string(),
         "0x0040cac0 region cached tri-lane delta sampler over [region+0x310/+0x338/+0x360]"
             .to_string(),
         "0x0040d360 region type/class filter over the region vtable +0x80 byte-0x32 lane"
@@ -4081,7 +4089,7 @@ fn build_periodic_company_service_trace_report(
         "0x00409950 linked-transit roster sibling owner".to_string(),
     ];
     let next_owner_questions = vec![
-        "Is the remaining near-city acquisition owner seam the live site/industry collection at 0x6cec20 above 0x004010f0/0x00405920, or a smaller helper that only builds the candidate site list for 0x004014b0?".to_string(),
+        "Is the remaining near-city acquisition owner seam the live peer-site collection at 0x6cec20 above 0x004010f0/0x00405920, or a smaller helper that only builds the candidate site list for 0x004014b0?".to_string(),
         "Which persisted linkage fields behind 0x0047efe0, [region+0x2a4], and [region+0x276] are sufficient to rehost the 0x004014b0 proximity-and-news branch without shell state?".to_string(),
         "Which infrastructure consumer above the grounded 0x38a5 seam actually drives the linked-transit branch that 0x00409950 follows?".to_string(),
     ];
@@ -4189,12 +4197,17 @@ fn build_periodic_company_service_trace_report(
                     "0x004014b0 near-city industry acquisition and news owner",
                     "0x004010f0 near-city acquisition region scorer",
                     "0x00405920 same-company industry proximity aggregator",
+                    "0x0041f6e0 center-cell token gate",
+                    "0x0042b2d0 packed-u16 contains-key predicate",
+                    "0x0047de00 linked-region resolver feeding 0x0040c990",
+                    "0x004801a0 linked-transit route-anchor reachability gate",
+                    "0x00425b90 pending-bonus/company-state gate",
                     "0x0040d360 region type/class filter",
                     "0x0040d540 weighted region-to-company proximity scorer",
                     "0x00406050 city-connection bonus/news sibling owner",
                 ],
                 &[
-                    "Direct disassembly now shows this branch iterating the live class-0 region collection, skipping regions with pending amount [region+0x276], rejecting the filtered region-type lane behind 0x0040d360, scoring regions against company proximity and aging through 0x0040d540 and 0x0040cac0, and then publishing the winning linked company id from [region+0x2a4].",
+                    "Direct disassembly now shows this branch iterating the live class-0 region collection, skipping regions with pending amount [region+0x276], reusing the center-cell token gate 0x0041f6e0 -> 0x0042b2d0, reusing the linked-region status branch 0x0047de00 -> 0x0040c990, checking candidate reachability through 0x004801a0, scoring regions against company proximity and aging through 0x0040d540 and 0x0040cac0, and then publishing the winning linked company id from [region+0x2a4].",
                 ],
             ));
             SmpPeriodicCompanyServiceTraceEntry {
@@ -4219,7 +4232,10 @@ fn build_periodic_company_service_trace_report(
         "Direct disassembly now narrows the acquisition-side sibling substantially: 0x004014b0 gates on the periodic outer owner, then iterates the live class-0 region collection at 0x62b26c, rejects regions with nonzero [region+0x276], filters the region-type lane through 0x0040d360, scores candidate regions against company linkage/age/proximity through 0x0040d540 and 0x0040cac0, and publishes the winning linked company id from [region+0x2a4] through the shared news lane 0x4554e0.".to_string(),
     );
     notes.push(
-        "That means the acquisition frontier is no longer a generic near-city owner gap. The remaining non-hook question is which site/industry collection and linkage helpers above 0x004010f0/0x00405920 feed the candidate-site list and peer linkage without relying on shell-owned news dispatch.".to_string(),
+        "That branch also reuses the same peer-site helper strip already bounded under the city-connection family: 0x0041f6e0 resolves the current center world-grid cell and checks one packed token through 0x0042b2d0, 0x0047de00 follows the linked region behind the candidate site into the status byte returned by 0x0040c990, and 0x004801a0 checks whether one candidate site is reachable from the cached company route anchor through the pending-bonus companion path 0x00425b90 -> 0x00401860 -> 0x0048e3c0.".to_string(),
+    );
+    notes.push(
+        "That means the acquisition frontier is no longer a generic near-city owner gap. The remaining non-hook question is which persisted peer-site collection and linkage fields above 0x6cec20 / 0x004010f0 / 0x00405920 feed the candidate-site list without relying on shell-owned news dispatch.".to_string(),
     );
 
     SmpPeriodicCompanyServiceTraceReport {
@@ -25880,7 +25896,7 @@ mod tests {
         let trace = build_periodic_company_service_trace_report(&analysis);
         assert_eq!(trace.selected_company_id, Some(7));
         assert_eq!(trace.atlas_candidate_consumers.len(), 6);
-        assert_eq!(trace.known_bridge_helpers.len(), 11);
+        assert_eq!(trace.known_bridge_helpers.len(), 16);
         assert_eq!(trace.next_owner_questions.len(), 3);
         assert_eq!(trace.companies.len(), 1);
         let acquisition_branch = trace.companies[0]
@@ -25916,6 +25932,12 @@ mod tests {
                 .iter()
                 .any(|line| line.contains("0x00405920"))
         );
+        assert!(
+            trace
+                .known_bridge_helpers
+                .iter()
+                .any(|line| line.contains("0x0041f6e0") && line.contains("0x0042b2d0"))
+        );
         let city_branch = trace.companies[0]
             .branches
             .iter()
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index c0dbaab..83f9d4c 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -30,6 +30,11 @@ Working rule:
     grounded annual-finance helper
 - Direct disassembly now narrows that acquisition strip further:
   - `0x004014b0` iterates the live class-0 region collection at `0x62b26c`
+  - `0x0041f6e0 -> 0x0042b2d0` is the center-cell token gate over the current region
+  - `0x0047de00 -> 0x0040c990` is the linked-region status branch reused from the city-connection
+    helper strip
+  - `0x004801a0` is the route-anchor reachability gate for one candidate site through
+    `0x00425b90 -> 0x00401860 -> 0x0048e3c0`
   - `0x0040d360` filters the region-type lane behind the region vtable `+0x80` byte `0x32`
   - `0x0040d540` scores region/company proximity with pending-bonus context
   - `0x0040cac0` samples the cached region tri-lane at `[region+0x310/+0x338/+0x360]`