Ground blocked owner strips with direct disassembly

crates/rrt-runtime/src/smp.rs

@@ -3669,6 +3669,7 @@ fn build_region_service_trace_report(
             evidence: vec![
                 "atlas already bounds this owner as the direct consumer of [region+0x276], [region+0x302], and [region+0x316]".to_string(),
                 "the new region trace already proves the record envelope and profile subcollection, so the remaining gap is the separate persisted latch seam rather than the service owner".to_string(),
+                "direct disassembly now shows 0x004358d0 calling 0x00420030 twice plus 0x00420280, resolving the linked company through 0x0047efe0, posting company stat slot 4, and then clearing [region+0x276] while stamping [region+0x302] or [region+0x316]".to_string(),
             ],
             blockers: vec![
                 "persisted owner seam for [region+0x25e/+0x276/+0x302/+0x316]".to_string(),
@@ -3864,6 +3865,7 @@ fn build_infrastructure_asset_trace_report(
                 ),
                 "atlas already bounds these helpers under the literal Infrastructure owner".to_string(),
                 "the side-buffer corpus is disjoint from the placed-structure triplet corpus, so a separate child/rebuild family is more plausible than a compact alias".to_string(),
+                "direct disassembly now shows 0x0048a1e0 cloning the first child triplet bands through 0x52e880/0x52e720, destroying the prior child, seeding a new literal Infrastructure child through 0x455b70 with payload seed 0x5c87a8, attaching through 0x5395d0 or 0x53a5d0, and republishing the two bands through 0x52e8b0/0x530720".to_string(),
             ],
             blockers: vec![
                 "exact compact-prefix regime semantics".to_string(),

docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md

@@ -73,7 +73,18 @@ The same brush strip is tighter now too:
   `[region+0x316]` is still clear, the same owner publishes one alternate one-shot notice from the
   same amount and region scalar before setting `[region+0x316]`. So the pending-region bonus lane
   is no longer just a queued setup artifact: it has a concrete later service owner and an explicit
-  shell-facing fallback above the same queue family now too. That narrows the next closure target
+  shell-facing fallback above the same queue family now too. Direct disassembly tightens the
+  bridge below that owner as well: `0x004358d0` first requires `[region+0x276]`, then drives two
+  separate `0x00420030` gate calls plus one `0x00420280` first-match selector before resolving the
+  linked company through `0x0047efe0`; only after that does it emit the success-side company/stat
+  update or the one-shot fallback notice. The peer helper itself is more concrete now too:
+  `0x00420030` walks collection `0x006cec20`, applies the class match through `0x0042b2d0`, uses
+  the optional linked-company filter through `0x0047efe0`, keeps the station-or-transit gate
+  `0x0047fd50`, and then tests the candidate status branch through `0x0047de00 -> 0x0040c990`
+  before reporting success. The paired selector `0x00420280` is the same scan with the same
+  filters, but returns the first matching site id instead of a boolean. So the remaining region gap
+  is now squarely the persisted latch/id seam, not the live peer/service logic itself.
+  That narrows the next closure target
   as well: ordinary-save probes can stop treating `[world+0x66a6]` persistence as the primary
   blocker, because the checked-in negative results on `q.gms`, `p.gms`, and `Autosave.gms` now make
   the pending-bonus owner plus its peer/linkage strip the first safe static target instead. The

docs/control-loop-atlas/runtime-roots-camera-and-support-families.md

@@ -2911,6 +2911,16 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0`
   The smaller attach helper `0x00490a3c` is now bounded too: it conditionally allocates one
   `Infrastructure` child from a caller-supplied payload stem, attaches it to the current owner, and
   then seeds three caller-supplied position lanes through `0x00539530` and `0x0053a5b0`. The
+  direct disassembly now makes that strip more concrete than the earlier structural note alone:
+  `0x0048a1e0` really does clone the first child through paired triplet readers
+  `0x0052e880/0x0052e720`, destroys the prior child through vtable slot `+0x18(0)`, allocates the
+  new `0x23a` object, seeds it through `0x00455b70` with literal payload seed `0x005c87a8`, and
+  then republishes the two sampled triplet bands through `0x0052e8b0` and `0x00530720` after
+  attaching through `0x005395d0`. The non-clone branch still seeds the same literal
+  `Infrastructure` child but attaches through `0x0053a5d0` instead. That means the next unknown is
+  no longer whether this strip owns the child/rebuild seam at all, but which side-buffer prefix
+  groups feed the clone-or-payload choice before the later route/local-runtime family runs.
+  The
   remaining closure target above the grounded `0x38a5` side-buffer seam is therefore narrower now:
   the next safe static pass should start at this exact attach/rebuild strip, not at the whole
   placed-structure family. The key open questions are whether the compact-prefix/name-pair groups

docs/rehost-queue.md

@@ -40,6 +40,12 @@ Working rule:
   first owner-visible bridge from the side-buffer seam into route-entry rebuild; and which child
   fields or grouped rows absorb the side-buffer payload before `0x00448a70/0x00493660/0x0048b660`
   become relevant.
+- Targeted disassembly now tightens that strip further: `0x0048a1e0` clones the first child through
+  `0x0052e880/0x0052e720`, destroys the prior child, seeds a literal `Infrastructure` child
+  through `0x00455b70` with payload seed `0x005c87a8`, and republishes the two sampled bands
+  through `0x0052e8b0/0x00530720` after attaching through `0x005395d0`; the non-clone branch
+  attaches through `0x0053a5d0`. So the next unknown is no longer whether this strip owns the
+  child/rebuild seam, but which `0x38a5` compact-prefix groups drive the clone-vs-payload choice.
 - Reconstruct the save-side region record body on top of the newly corrected non-direct tagged
   region seam (`0x5209/0x520a/0x520b`, stride hint `0x06`, `Marker09` record stems) now that the
   `0x55f3` payload is known to be fully consumed by the embedded profile collection on grounded
@@ -69,6 +75,14 @@ Working rule:
   how far the grounded city-connection peer/linkage helpers
   (`0x00420030/0x00420280`, `0x0047efe0`) can be reused directly before the transient queued-notice
   family matters again.
+- Targeted disassembly now tightens that strip too: `0x004358d0` calls `0x00420030` twice plus
+  `0x00420280`, then resolves the linked company through `0x0047efe0`, posts company stat slot `4`
+  on success, and stamps `[region+0x302]` or `[region+0x316]` while clearing `[region+0x276]`.
+  `0x00420030` itself now reads as the real peer gate over collection `0x006cec20`, combining
+  `0x0042b2d0`, the optional company filter through `0x0047efe0`, the station-or-transit gate
+  `0x0047fd50`, and the status branch `0x0047de00 -> 0x0040c990`; `0x00420280` is the same scan
+  returning the first matching site id. So the remaining unknown is the persisted latch/id seam,
+  not the live peer/service logic.
 - Reconstruct the save-side placed-structure collection body on top of the newly grounded
   `0x36b1/0x36b2/0x36b3` header seam so the blocked city-connection / linked-transit branch can
   stop depending on atlas-only placed-structure and local-runtime refresh notes, especially the