Preserve Tier2 loader and clone-seed handoff

docs/control-loop-atlas/runtime-roots-camera-and-support-families.md

@@ -1410,11 +1410,15 @@
   layouts, not to the live `0x005c93cc` candidate rows.
   The positive candidate-side bound is tighter now too: `0x004120b0` explicitly declares
   `[candidate+0xba]` and `[candidate+0xbb]` as one-byte parser fields through `0x00531150`, and
-  the later helper `0x00412d70` can clone an already-materialized whole candidate row through
-  `rep movsl`, including those bytes, before `0x00412f02` picks the `Port%02d` vs `Warehouse%02d`
-  naming branch from cloned bit `[candidate+0xba]`. So the unresolved Tier-2 seam is no longer
-  “find any direct writer to candidate `+0xba/+0xbb`”; it is “find the earlier seed or projection
-  owner that first makes some source/live rows reach that clone path with nonzero bank bytes.”
+  the later helper `0x00412d70` does not consume them vaguely. It runs two explicit passes, first
+  accepting only nonzero `[candidate+0xba]` rows and then only nonzero `[candidate+0xbb]` rows,
+  remembers one availability-qualified seed row, prefers an existing target whose ordinal field
+  `[candidate+0x794]` already matches, and otherwise clones one whole `0x1f2`-dword candidate body
+  through `rep movsl`, including those bytes, before `0x00412f02` picks the `Port%02d` vs
+  `Warehouse%02d` naming branch from cloned bit `[candidate+0xba]`. So the unresolved Tier-2 seam
+  is no longer “find any direct writer to candidate `+0xba/+0xbb`”; it is “find the earlier seed
+  or projection owner that first makes some source/live rows reach that clone path with nonzero
+  bank bytes.”
   The top-level stock handoff above that clone pass is tighter now too. Direct disassembly of
   `0x004196c0` shows the broader stock `*.bca` rebuild loop formatting the wildcard path rooted at
   `0x005c93fc`, iterating the local `0x005c8190/0x005c8194/0x005c819c` find-first/find-next

docs/rehost-queue.md

@@ -16,7 +16,7 @@ This file is the short active queue for the current runtime and reverse-engineer
   The direct write census is tighter in the same direction: the only grounded explicit write of value `8` into `[event+0x7ef]` is `0x004d91b3` inside that same shell helper, while the runtime-side grounded writers still only cover zero-init, copy, `2/3` follow-on seeds, and the later `5` / `2` retags.
   Preserved checked control-lane detail now lives in [Periodic company control lane](rehost-queue/periodic-company-control-lane-2026-04-21.md).
 - Keep the next static Tier-2 building pass focused on the earlier seed/projection seam into `0x00412d70`, not another broad `BuildingTypes` sweep.
-  The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The stock `BuildingTypes` side is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which earlier seed/projection path lifts that narrow stock-side signal and the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.
+  The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The load-side handoff is narrower now too: `0x004120b0` explicitly reads `[candidate+0xba]` and `[candidate+0xbb]` as one-byte stream fields, and the very next projection owner `0x00412d70` immediately consumes those bytes in two passes, first `+0xba` and then `+0xbb`, to pick one seed row whose full `0x1f2`-dword body will be cloned or reused for each numbered runtime record. The stock `BuildingTypes` side is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which earlier seed/projection path lifts that narrow stock-side signal and the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.
   Preserved checked row-family detail now lives in [Tier2 candidate row families](rehost-queue/tier2-candidate-row-families-2026-04-21.md).
   Preserved checked stock selector-byte detail now lives in [Tier2 selector-byte sources](rehost-queue/tier2-selector-byte-sources-2026-04-21.md).
   Preserved checked rebuild sequencing detail now lives in [Tier2 rebuild sequencing](rehost-queue/tier2-rebuild-sequencing-2026-04-21.md).

docs/rehost-queue/tier2-rebuild-sequencing-2026-04-21.md

@@ -18,12 +18,15 @@ owners form one coupled strip:
   - re-enters `0x00412d70`
 - `0x00412d70`
   - rebuilds candidate runtime records from scenario state
+  - runs two explicit bank passes, first on `[candidate+0xba]` and then on `[candidate+0xbb]`
   - does not consult the scenario-side recipe-book name at `[state+0x0fe8]`
+  - picks one availability-qualified seed row and either reuses or clones its full `0x1f2`-dword body
   - re-enters `0x00435630`
   - also re-enters `0x00411ce0` and `0x00411ee0`
 - `0x00412fb0`
   - broader collection-load owner
   - directly loops through the stock/import stream via `0x004120b0`
+  - `0x004120b0` itself explicitly loads selector bytes `[candidate+0xba/+0xbb]` from the stream
   - then calls `0x00412d70`
   - then calls `0x00412ab0`
   - and only after the later catalog rebuild re-enters `0x00412c10`
@@ -79,6 +82,13 @@ This keeps the active Tier-2 owner question on sequencing and data handoff, not
 
 - one side of the strip is the coupled recipe/runtime rebuild family
   `0x00435630 -> 0x00412d70 -> 0x00412fb0`
+- the loader edge is explicit now: `0x004120b0` is the stream-side owner that reads
+  `[candidate+0xba/+0xbb]` as one-byte parser fields before `0x00412fb0` falls into the runtime
+  projection pass
+- the projection edge is explicit in the same way: `0x00412d70` does not just “see banked bytes”
+  abstractly, it runs one pass that accepts only nonzero `[candidate+0xba]` rows and one pass that
+  accepts only nonzero `[candidate+0xbb]` rows, reusing a matching prior ordinal when available and
+  otherwise cloning the full seed-row body
 - the other side is the later named-availability preseed/latch family
   `0x00437737 -> 0x00434f20 -> 0x00412c10`
 - the early checkpoint only refreshes `0x00412c10` when the live candidate pool already exists,