From e2f60bef9a3c29ade18a173cd10505c8f28b66a8 Mon Sep 17 00:00:00 2001
From: Jan Petykiewicz <jan@mpxd.net>
Date: Sun, 19 Apr 2026 02:40:30 -0700
Subject: [PATCH] Narrow event retagger trigger coverage

---
 crates/rrt-runtime/src/smp.rs | 11 +++++++++++
 docs/rehost-queue.md          |  9 +++++++++
 2 files changed, 20 insertions(+)

diff --git a/crates/rrt-runtime/src/smp.rs b/crates/rrt-runtime/src/smp.rs
index 6711c02..b47fe44 100644
--- a/crates/rrt-runtime/src/smp.rs
+++ b/crates/rrt-runtime/src/smp.rs
@@ -9532,6 +9532,9 @@ fn parse_event_runtime_collection_summary_with_tag_width(
             control_lane_notes.push(
                 "direct disassembly of 0x004323a0 now makes the live gate explicit too: the per-record service returns before dispatch unless one-shot latch [event+0x81f] is clear, mode byte [event+0x7ef] matches the selected trigger kind from 0x00432f40, and compact chain root [event+0x00] is nonzero; its kind-8 side path at 0x00432ca1..0x00432cb0 only calls 0x00438710 on already-live records with [event+0x7ef] == 8".to_string(),
             );
+            control_lane_notes.push(
+                "the post-load name-driven retagger is narrower than a bulk trigger-kind materializer too: direct disassembly of 0x00442c30 (called from 0x00443a50 at 0x00444b50) shows a hardcoded scenario-name patch table over already-live records in 0x0062be18/0x0062bae0, and the checked cases mostly tweak modifier bytes [event+0x7f9/+0x7fa] or nested payload scalars on records that already carry concrete kinds such as 7 ('Open Aus', 'The American'), 6 ('Test connections'), 5 ('Win - Gold'), and 1 ('Win - Silver' / 'Win - Bronze')".to_string(),
+            );
         }
         if records_with_trigger_kind != 0 {
             control_lane_notes.push(format!(
@@ -22375,6 +22378,14 @@ mod tests {
                 && line.contains("0x00432ca1..0x00432cb0")
                 && line.contains("0x00438710")
         }));
+        assert!(summary.control_lane_notes.iter().any(|line| {
+            line.contains("0x00442c30")
+                && line.contains("0x00444b50")
+                && line.contains("0x0062be18/0x0062bae0")
+                && line.contains("Open Aus")
+                && line.contains("Win - Gold")
+                && line.contains("Win - Silver")
+        }));
         assert!(summary.control_lane_notes.iter().any(|line| {
             line.contains("0x00431b20 dispatch-strip opcodes present in decoded grouped rows = [4]")
         }));
diff --git a/docs/rehost-queue.md b/docs/rehost-queue.md
index 220bc02..3168baf 100644
--- a/docs/rehost-queue.md
+++ b/docs/rehost-queue.md
@@ -288,6 +288,15 @@ Working rule:
     already-live records carrying `[event+0x7ef] == 8`. So the remaining ordinary bundle question
     is no longer “does the service loop itself bypass the per-record trigger byte?”; it is which
     later owner, if any, materializes or retags `[event+0x7ef]` for the nondirect compact rows.
+  - the post-load retagger is narrower than that missing owner too:
+    direct disassembly of `0x00442c30` (called from `0x00443a50` at `0x00444b50`) shows a
+    hardcoded scenario-name patch table over already-live records in `0x0062be18/0x0062bae0`.
+    The checked cases mostly tweak modifier bytes `[event+0x7f9/+0x7fa]` or nested payload scalars
+    on records that already carry concrete kinds such as `7` (`Open Aus`, `The American`), `6`
+    (`Test connections`), `5` (`Win - Gold`), and `1` (`Win - Silver` / `Win - Bronze`). So the
+    remaining trigger-kind frontier is no longer “maybe the name sweep bulk-materializes null
+    kinds”; it is the smaller set of scenario-specific records where that sweep explicitly writes
+    `[event+0x7ef]` itself or a still-later owner does.
   - cross-map probing now gives a better static-analysis lead too:
     `British Isles.gmp` shows no current `0x00431b20` dispatch-strip rows, `Germany.gmp` stays on
     `Game Variable 1` plus `Company Variable 3..4`, while `Texas Tea.gmp` adds `Economic Status`