Resolve the shrub region bound: the chunk container closes it

The shrub region's end was the last unlocated bound in core_data. It was not
in the core index, and unlike moby->tie it had no successor boundary to chain
against, so the last shrub class in every level ran out to the lump's end and
the aggregates over it (the "3.5M records / 28MB of shrub body") were
artifacts of that oversized span.

Range measured: for each level, from the last shrub class's geometry offset to
the constant trailer. Nothing outside that range is read.

Method: scan forward from the last shrub class for the pair (a) the constant
two bytes f6 7c sitting immediately in front of (b) a chunk signature -- a
16-byte header ending 0xff, ten zero bytes, then four or more 0xf0-tagged
offsets. The two halves are each weak alone, and the halves are measured
separately: the marker pair occurs 25 to 103 times in a 5 to 17 MB lump, so
matching it alone picks dozens of wrong offsets; the chunk shape matches
random data often enough to need four tagged offsets before it is believed.

Result: on all 27 levels the marker sits exactly two bytes before the first
chunk header, and the two parts of the signature are never found apart. No
chunk signature occurs inside any last shrub body, on any level. The three
levels without shrub (10, 25, 26) carry the same marker before the container
that closes tie instead, which is what makes the locator a property of the
region rather than a shrub rule.

Consequences:

- All 358 shrub class bodies are bounded and are whole 8-byte records. That
  was not assertable while the last class in each level ran to the lump's end,
  and it is the check the boundary earns its keep for.
- 9,600 records in total, against the 8,938 previously measurable in
  successor-bounded spans; 662 of them sit in the 24 last-class bodies. The
  shrub region totals 2,033,776 bytes across the 24 levels that have one.
- The chunk container is 25,775,850 bytes across 27 levels (1,236 chunks,
  22,562 records). The container measurements were previously taken over "the
  900,000 bytes before the trailer", a window that did not align to its real
  extent: on level 0 it is 690,302 bytes, and 27 of 1,123 chunks were
  truncated at that invented edge. chunk_containers_resolve_on_every_level now
  reads the region from core_layout instead of measuring backwards from the
  end of the lump.

core_layout takes core_data now: the container's start is the one bound that
cannot be derived from the index. It gains the chunks region, so every byte of
level-specific core_data belongs to a named region. Where the signature is not
found the end stays None -- the region is left visible rather than clamped to
the tail.

Still open: the marker's meaning (constant across 27 levels, at exactly this
position, unnamed) and the shrub body payload's encoding.

docs/plan/level-assets.md

@@ -961,3 +961,46 @@ This is the second time in this format that a confident aggregate hid a bad
 bound -- the first was the VIF reading. The pattern is worth noting: aggregates
 across many spans are only as trustworthy as the span bounds underneath them,
 and those are the easy thing to get wrong because nothing errors.
+
+## Shrub span bounds: resolved (2026-10-11, later still)
+
+The offset that ends the shrub region is the **start of the chunk container**,
+and it is found by signature rather than read from the core index, which has no
+successor offset for shrub.
+
+**Range measured:** for each level, from the last shrub class's geometry offset
+to the constant trailer. Nothing outside that range is read.
+
+**Method:** scan forward from the last shrub class for two bytes `f6 7c`
+sitting immediately in front of a chunk signature (16-byte header ending `0xff`,
+ten zero bytes, four or more `0xf0`-tagged offsets). Each half of that
+signature is weak alone -- the marker pair occurs 25 to 103 times per lump --
+and together they are exact.
+
+**Result: on all 27 levels the marker sits exactly two bytes before the first
+chunk header.** The two parts of the signature are never found apart, and no
+chunk signature occurs inside any last shrub body. The three levels without
+shrub (10, 25, 26) carry the same marker before the container that closes
+*tie*, so the locator is a property of the region, not a shrub rule.
+`gc_formats::chunks::chunk_region_start` implements it and
+`regions::core_layout` closes shrub with it.
+
+Consequences, all measured over the new bounds:
+
+- **All 358 shrub class bodies are bounded and well formed** -- every one is
+  whole 8-byte records. That was not assertable while the last class in each
+  level ran out to the lump's end, and it is the check the boundary earns.
+- **9,600 records in total**, against the 8,938 previously measurable in
+  successor-bounded spans; 662 of them sit in the 24 last-class bodies, 24 to
+  30 per level. The retracted "3.5 million records / 28 MB of shrub body"
+  figure stays retracted: the correct total for the shrub region is
+  **2,033,776 bytes** across the 24 levels that have one.
+- The chunk container is **25,775,850 bytes across 27 levels** (1,236 chunks,
+  22,562 records), not an ~690-900 KB afterthought per level. The earlier
+  container measurements were taken over "the 900,000 bytes before the
+  trailer", a window that did not align to the container's real extent: on
+  level 0 it is 690,302 bytes, and 27 of 1,123 chunks were truncated at that
+  invented edge. The chunk test now reads the region from `core_layout`.
+
+What is still not known: the marker's meaning (constant across 27 levels, at
+exactly this position, unnamed), and the shrub body payload's encoding.