# Input, Save/Load, and Simulation: Editor Breadth

### Editor Breadth

The broader map-editor page owner is now bounded through
  `map_editor_panel_select_active_section` `0x004ce070` and
  `map_editor_panel_dispatch_active_section_message` `0x004cf700`, which switch among the grounded
  setup pages, `Cities/Regions`, `Territories`, the `Players` and `Player Pool` setup slices, the
  now-grounded `Building Density` page, the locomotives-available and industry-availability pages,
  the economic and special-condition pages, the `Port/Warehouse Cargos` page, and the later report
  pages. The mid-editor ownership is materially clearer now too: the chairman-slot editor is the
  `Players` page, the available-chairman editor is the `Player Pool` page, and the former unnamed
  dual tri-state page now lines up with localized page text `997` `Building Density` plus help text
  `1017` and the direct field captions `1642` `Starting Building Density Level:` and `1644`
  `Building Density Growth:`. Both controls are now bounded as stored ordinal bytes `0/1/2` rather
  than loose labels: the first three-choice control is the map-wide starting-density selector, with
  its default middle state `1` matching the documented `100%` baseline from `1643`; the second is
  the paired overall growth selector whose effects later appear in the city-growth side of the
  simulation. `map_editor_city_region_panel_construct` and
  `map_editor_city_region_panel_handle_message` own the city-or-region editing lane with rename and
  copy-industry-data flows. That page is tighter on the save/load seam now too:
  `map_editor_city_region_panel_format_selected_region_detail_stats_and_projected_building_rows`
  `0x004cc340` is the selected-region detail formatter bound by the constructor, and it is now a
  grounded live reader of the same persisted economic tuning band
  `[world+0x0be2/+0x0be6/+0x0bea/+0x0bee]`. It formats one current building-count row from
  `[region+0x242]`, formats the leading tuning lane through localized id `0x40d`, and then uses
  `world_region_accumulate_structure_category_totals` `0x00422900` plus
  `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` to build the
  projected/live category rows `0x40e..0x414`. The neighboring callback
  `map_editor_city_region_panel_store_selected_region_density_scalar_and_rebuild` `0x004cc930`
  writes the selected region density scalar back into `[region+0x25a/+0x25e]` and reconstructs the
  page, and the `.smp` restore owner `0x00446d40` now shows the same pair being rehydrated as one
  shared density dword on newer bundles or one legacy bucket-to-density lookup on pre-`0x3f3`
  bundles, so the `Cities/Regions` page now has one direct live write-side density lane and one
  concrete restore-side bridge instead of only the older generic page note.
  The broader handler `0x004ce380` is tighter in the same way now too: besides rename and source
  chooser flows, it commits one direct callback value into `[region+0x272]`, forwards another
  through `0x004204c0` on the selected region, supports two bulk profile-weight sweeps over the
  live candidate pool through `0x004206b0` using `0.0` or `1.0`, and uses chooser result `0x3f2`
  to re-enter `0x00420e00` for source-region profile cloning before rebuilding the page; the same
  direct callback lane now also matches the `.smp` restore-side write into `[region+0x272]`.
  The adjacent economic tuning page is explicit now too:
  `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` registers
  `map_editor_economic_cost_slider_dispatch` `0x004ca980` on six visible slider controls
  `0x5bcd..0x5bd7`, re-publishes the current values from
  `[world+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and pairs that band with the localized
  captions `Prime Rate`, `Merger Premium`, and the construction/maintenance cost family
  `Build Stations Cost` through `Steam Engine Cost`. The dispatch side writes those six floats
  directly back into the same state band and mirrors the first lane into `[world+0x0bde]`, which
  now ties the editor page directly to the `.smp` save/load plateau and the post-load/runtime
  consumers grounded elsewhere in the atlas. The read-side presentation seam is explicit now too:
  `map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows` `0x004caaf0` is the
  control-`0x5be1` sibling for that same page. It reads the live six-float band, builds one
  preview curve from leading lane `[world+0x0be2]` plus the stepped multiplier table
  `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and republishes the six formatted numeric
  rows through the neighboring dynamic-text controls `0x5bce/0x5bd0/0x5bd2/0x5bd4/0x5bd6/0x5bd8`.
  The post-load consumer side is tighter now too: the same selected-year bringup later runs
  `0x00433bd0`, `0x00435603`, and `0x00434130`, where `0x00433bd0` rebuilds one direct year-bucket
  trio plus two dependent three-lane companion bands from the fixed year ladder, and `0x00434130`
  reclamps shared year-gap scalar `[world+0x4ca2]` into the closed `1/3..1.0` band.
  That closes the economic tuning page as one real save/load-facing editor family rather than only
  a constructor plus one write-only slider dispatcher. The city-or-region copy side is tighter now too: the
  handler first enters
  `0x00420e00`, which rebuilds the selected region's profile collection `[region+0x37f]`, clones
  the source region's live label-weight entries when a source region is present, and otherwise
  reseeds a fixed default weight set through repeated `0x004206b0` calls. The no-source companion
  `0x00420ed0` now makes that split explicit: it rebuilds the same subcollection and then picks one
  of two fixed default label-weight sets based on region class dword `[region+0x23e]`, using one
  all-`0.2f` family for nonzero-class regions and one class-`0` family that starts with `0.3f`
  before continuing with repeated `0.2f` entries. The lower mutator
  `0x004206b0` then linearly scans the selected region subcollection by profile label, creates a
  new profile only when the copied weight is positive, removes an existing profile when the copied
  weight is non-positive, updates `[entry+0x1e]` otherwise, and refreshes the region's derived
  availability-summary bytes `[region+0x2f6/+0x2fa/+0x2fe]` through `0x00420410`; `map_editor_territory_panel_construct` and
  the adjacent no-source companion `0x00420ed0` is tighter too: it rebuilds the same collection
  root `[region+0x37f]` but then seeds one of two fixed default profile-label sets directly through
  repeated `0x004206b0` calls, splitting by region class dword `[region+0x23e]`. Nonzero-class
  regions take one all-`0.2f` default set, while class-0 regions take a different set that starts
  with one `0.3f` weight before continuing with repeated `0.2f` entries. That makes `0x420ed0`
  the true class-split default-profile companion to the source-cloning helper at `0x420e00`,
  rather than just more of the same editor copy path. Two neighboring collection queries are tight
  enough now too. `0x00421d20` counts how many live regions have at least one profile row in
  `[region+0x37f]` whose label matches the candidate-name string for one caller-supplied candidate
  id; `0x00421e30` resolves the Nth such matching region. Both helpers reuse the same
  `0x0041fac0` ordinal label-and-weight copy helper we just grounded, only increment once per
  region, and skip nonzero-class regions whose companion count `[region+0x242]` is nonpositive.
  Those two queries are what the editor summary side at `0x004cdd56/0x004cdeab` uses before it
  formats per-region lists for one selected industry or profile name. The adjacent world-facing
  query strip is bounded too: `0x00422010` scans the live region collection for class-0 regions
  whose normalized coordinates fall inside one caller-supplied float rectangle, keeps the nearest
  region id `[region+0x23a]` by squared XY distance through `0x0051db80`, and returns `0` when no
  qualifying region is found; `0x004220b0` is the small wrapper above it that returns the matched
  region name `[region+0x356]` or the fallback localized scratch string at `0x0062ba90`.
  The adjacent scenario-rule page is tighter on the same save/load axis too:
  `map_editor_scenario_special_conditions_panel_clear_visible_row_band` `0x004cb1a0` and
  `map_editor_scenario_special_conditions_panel_format_row_by_index` `0x004cb1c0` are now the
  concrete range and row callbacks behind list control `0xa7fa`, so the persisted 49-dword
  scenario-rule band `[world+0x4a7f..+0x4b3f]` is no longer only constructor-shaped in the atlas.
  The constructor `0x004cb2b0` binds those callbacks, counts enabled rows directly from that same
  dword band, and keeps the trailing scalar `[world+0x4b43]` in the same page family. The handler
  is tighter now too: `0x004cb8e0` bulk-writes the full 49-dword rule array from `0xa7fb/0xa7fc`,
  parses control `0xa7ff` back into trailing scalar `[world+0x4b43]`, and special-cases rule
  ordinals `0x19` and `0x1a` through immediate follow-on calls to `0x00493150` and `0x00413620`
  after direct row writes from callback band `0xabe0..0xafc7`.
  `map_editor_territory_panel_construct` and
  `map_editor_territory_panel_handle_message` own the territory rename and border-remap lane;
  `map_editor_locomotive_availability_panel_construct` plus
  `map_editor_locomotive_availability_panel_handle_message` now bound the locomotive policy page
  over `0x006ada84`; `map_editor_industry_availability_panel_construct` plus
  `map_editor_industry_availability_panel_handle_message` do the same for the industry candidate
  pool at `0x0062b268`; and `map_editor_port_warehouse_cargo_panel_construct` plus
  `map_editor_port_warehouse_cargo_panel_handle_message` now ground the recipe-book page that edits
  port or warehouse cargo policies through twelve per-book state blocks at
  `[0x006cec78+0x0fe7+index*0x4e1]`. Each book now has a shared maximum annual production float at
  `book+0x3ed` and five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`; each
  line is bounded as a mode dword, annual amount, a supplied-cargo token at `+0x08`, and a
  demanded-cargo token at `+0x1c`. The constructor and handler now make those fields materially
  tighter too: the row pair shown in `Supply Only` and `Production Demand->Supply` is the `+0x08`
  supplied-cargo selector, the row pair shown in `Demand Only` and `Production Demand->Supply` is
  the `+0x1c` demanded-cargo selector, and the single amount field at `+0x04` is labeled `Annual
  Demand:` only in mode `1` but `Annual Supply:` in modes `2/3`. The editor-side token boundary is
  narrower now too: `0x004cf910` re-enters the same runtime importer `0x00435630` on entry, then
  exact-matches the persisted `+0x08/+0x1c` token strings against visible live cargo names through
  `0x005a57cf` while seeding the selector controls. There is still no special marker decode on this
  side; unmatched token strings simply leave the selector index at its zero default while the raw
  scenario-state strings stay in the recipe-book slab, and `0x004d0040` writes those selected cargo
  names back into `+0x08/+0x1c` verbatim rather than normalizing them first. The write-side control
  map is tighter now too: `0x59d8` updates the shared production-cap float at `book+0x3ed`,
  `0x59d9` opens the rename modal, `0x59da/0x59db` cycle the selected book modulo `12`, and
  `0x59de` commits the selected book ordinal. The five line-level write bands are exact in the
  same way: `0x5a0a..0x5a0e` write the line-mode dwords at `book+0x3f1+line*0x30`,
  `0x5a1e..0x5a22` copy one live cargo name into the supplied-token lane at
  `book+0x3f9+line*0x30`, `0x5a32..0x5a36` copy one live cargo name into the demanded-token lane
  at `book+0x40d+line*0x30`, and `0x5a50..0x5a54` write the per-line amount float to
  `book+0x3f5+line*0x30` after the handler clamps the entered value to `<= 6`. The constructor-side
  usage summary is bounded too: it scans the live city-or-region collection at `0x0062bae0`, keeps
  only rows whose usage gates `[entry+0x242]` and `[entry+0x2f6]` are live and whose current
  recipe ordinal `[entry+0x2f2]` matches the selected book, concatenates up to eight visible names
  from `[entry+0x356]` with the separator at `0x005c9f38`, counts the rest, and then formats the
  bounded usage summaries from localized ids `508` and `509`. The stronger new runtime-side
  result is now a full chain rather than only the importer:
  `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` first imports those same five
  lines into one repeated array of identical `0xbc`-byte runtime descriptors with no row-index
  special casing, while mode `3` keeps reseeding the primary token lane until it differs from the
  one-row subordinate lane and then writes literal `1.0` into the subordinate amount slot
  `[desc+0x48]`. The candidate-side rebuild pass at
  `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` then
  projects those descriptors into the live structure collection at `0x0062b268` in two
  availability-bank passes. The current local disassembly now shows that this bridge reuses live
  candidate slots by prior ordinal field `[candidate+0x794]` when possible, otherwise allocates one
  fresh candidate, clones from the current bank's template source candidate, and only then copies in
  the imported recipe-line count, shared production-cap float, and packed `0xbc` descriptor strip
  from scenario state. The label side is narrower than the earlier note too: current local
  disassembly of `0x00412d70` does not consult the recipe-book name at `[state+0x0fe8]` at all.
  Instead it formats display stem `[candidate+0x04]` directly from one of two fixed built-in roots
  chosen by availability bit `[candidate+0xba] & 1`, together with the current ordinal. Each
  rebuilt candidate then feeds
  `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0`, which rebuilds
  the per-cargo runtime summary tables. That helper now reads more concretely too: it clears both
  emitted cargo-id tables at `[candidate+0x79c]` and `[candidate+0x7a0]`, clears the per-cargo
  float band at `[candidate+0xa1..+0xb8]`, and fills one local `0x35`-cargo status scratch from
  the descriptor strip. The year window is narrower than the earlier generic wording too: each
  subordinate row contributes status `2` only while `start_year <= current_year < end_year`, using
  live world year `[0x006cec78+0x0d]` or fallback year `0x709` when no world is present; rows
  outside that active window still contribute status `1` as referenced cargo, and the helper keeps
  the maximum status per remapped cargo id through `0x0062ba8c+0x9a`. It then allocates the two final
  compact membership tables from the `status>=1` and `status>=2` sets with counts stored at
  `[candidate+0x7a4]` and `[candidate+0x7a8]`. The same scan also makes the production-mode split
  explicit on the runtime side: descriptor mode `0` uses the shared production cap at
  `[candidate+0x2a]` divided by the descriptor amount, while nonzero mode bypasses that scaling
  path and publishes the row amount directly. At that point the candidate import strip is
  structurally closed in current local evidence: the local import and rebuild seam is no longer
  where the loader reconstructs runtime descriptor or membership tables. Current local evidence now
  supports a stronger carry for the supply-marker token family too: there is no hidden decode stage
  surfaced at all, so those lanes are best kept as opaque scenario-authored marker strings. The
  editor slab preserves unmatched token strings verbatim, the constructor
  only reflects selector ordinals for tokens that already exact-match visible live cargo names, the
  handler writes selected cargo names back into those same token slots verbatim, and the importer
  later writes the exact-matcher result ids straight into the live descriptor lanes, defaulting
  failed matches to cargo id `0`. The reset side narrows that further too:
  `0x00436d10` only zero-fills the recipe books and reseeds their `# %1` name lane, so those
  marker-like token strings are not coming from the built-in reset path. A fresh direct-hit scan
  on the recipe-book root `0x0fe7` also did not surface any new live writer beyond the already
  grounded reset, save/load, and editor-panel families. The one suspicious later hit neighborhood
  around `0x00500c73/0x00500d3f` turns out not to be another recipe writer either: it is a shell
  control-construction strip using localized ids `0x0fe6/0x0fe8/0x0fe9` as UI resource ids, not
  `[world+0x0fe7]` accesses. Combined with the checked map/save pairs that preserve those raw
  marker payloads byte-for-byte, that closes the load/save ownership question at the current
  evidence level: inside the local binary the marker families are best treated as opaque
  scenario-authored token payload, not as a hidden runtime decode stage waiting to be mapped. The immediate sibling
  `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, which for
  subtype byte `[candidate+0x32] == 2` scans the imported descriptor strip and derives two compact
  post-import flags from mode `0` presence and whether every mode-`0` descriptor keeps at least
  one subordinate row. The stream-load side is
  tighter in the same way: the constructor-side load owner
  `structure_candidate_collection_construct_and_stream_load_runtime_records` `0x004131f0`
  seeds global pool `0x0062b268` and immediately re-enters the broader collection importer
  `structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability`
  `0x00412fb0`. That owner streams each packed candidate body back through
  `structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state` `0x004120b0`, then
  reruns the same scenario-side recipe projection at `0x00412d70`, the same stem-policy sweep at
  `0x00412ab0`, the collection aggregate subtotal pass over `[pool+0x8c..+0x9c]`, rebuilds the
  fixed name catalog at `0x0061dbc2/0x0061dc09` for non-subtype-`1` zero-availability candidates
  with live ids `<= 0x6e` via localized string `0x0b53`, and only then re-enters the same
  named-availability refresh at `0x00412c10` before returning. The broader scenario-state reset
  and editor-writer side is explicit now too: the saved named-availability table is not only
  startup-owned. `map_editor_industry_availability_panel_handle_message` `0x004cf430` has one
  direct row-callback path for controls `0xa028..0xa40f` that forwards the clicked candidate name
  plus one callback-supplied boolean into `0x00434f20`, and one bulk boolean sweep from the top
  controls `0x9c43` and its sibling that walks the live candidate pool and forwards every
  surviving page-visible candidate into that same upsert owner. So the scenario-side
  availability override bit at `[entry+0x1e]` now has three grounded write families together:
  startup preseed, stream-load refresh, and editor-side direct or bulk override. The package-save
  side is explicit now too: in the editor-map branch of `0x00444dd0`, the shared prepass
  `scenario_state_preseed_named_candidate_availability_overrides_from_editor_map_placed_structures`
  `0x00436a70` walks qualifying placed structures, resolves their linked candidate/runtime owners,
  and upserts boolean overrides from owner names immediately before the named-availability
  collection is serialized.
  The broader scenario-state reset
  side is explicit now too: `0x00436d10` is the shared reset-and-rebuild owner beneath startup and
  world-entry paths. It zeroes the late scenario-state bands, immediately reseeds setup-preview
  validity byte `[state+0x66be] = 1`, seeds the fixed `Minimum Start Year` / `Default Start Year`
  / `Maximum Start Year` trio at `[state+0x66ca/+0x66d2/+0x66ce]`, the four startup dwords
  `[state+0x6a68/+0x6a6c/+0x6a70/+0x6a74] = 1`, and the chairman-slot rows, including the first
  slot's special occupied-seat byte `[state+0x69db]`, clears the queued-event and fast-forward
  latches `[state+0x46c38/+0x46c3c/+0x66a2/+0x66a6/+0x66aa]`, rebuilds the two named availability
  collections at `[state+0x66b2]` and
  `[state+0x66b6]`, zero-fills the twelve recipe books at `[state+0x0fe7]`, then only reseeds
  their per-book name lane from the fixed `# %1` format string at `0x005c9f78` through
  `0x0051b700 -> 0x00518de0`. The selected-year rebuild tail is tighter now too: in the
  campaign/setup-but-not-sandbox lane it copies profile year word `[profile+0x77]` into scenario
  default start year `[state+0x66d2]`, seeds Jan-1 tuple lanes `[state+0x05/+0x09]` through `0x0051d3f0`,
  optionally decrements that chosen year through the shell/tutorial gates at
  `[0x006cec74+0x68/+0x178]` and `[0x006cec78+0x4af7]`, and only then rebuilds the absolute
  selected-year counter through `0x0051d390 -> 0x00409e80`, the selected-year bucket band through
  `0x00433bd0`, the derived year-threshold band through `0x00435603`, and the year-gap scalar
  helper `0x00434130`. The matched editor-side consumer is explicit too:
  `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` republishes that same reset
  block through the `0x5b69..0x5b74` control band, with the start-year trio landing on
  `0x5b6a/0x5b6c/0x5b6b`, campaign-scenario byte `[state+0x66de]` on checkbox `0x5b6e`, and the
  inverse of metadata byte `[state+0x66f3]` on control `0x5b74`. Only after that chain does it
  meet its write-side sibling: `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0`
  commits the same control band back into live state by copying bounded text payloads into
  `[state+0x672e]`, `[state+0x4f30]`, and `[state+0x5ae9]`, flipping `0x621f50`,
  toggling `[state+0x66de]` and `[state+0x66f3]`, and parsing the three year edit fields through
  `0x005a1ea5` before clamping each to `1829..2100` and enforcing
  `minimum <= default <= maximum`.
  Only after that chain does it
  re-enter `0x00435630`, `0x0041e970`,
  `0x00412bd0`, and `0x00436af0`, where the cached available-locomotive rating now reads as a
  year-tiered baseline `110/200/300` plus the strongest surviving live locomotive rating filtered
  by era-policy and named-availability gates, then normalized through the fixed `100/220` scale
  pair and clamped into the final `50..100` cache band at `[world+0x4cbe]`. The startup side is tighter now too:
  `0x00438890` does not jump straight into one selector-specific file-load branch. It first
  re-enters `0x00436d10`, mirrors one shell-managed label list from `0x006d4020+0x429b0` into local
  state, allocates the common runtime pools (`0x0062ba8c`, `0x0062b268`, `0x0062b2fc`,
  `0x0062ba88`, `0x006ada84`, `0x0062c120`, `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`,
  `0x006cea4c`, `0x006acd34`, `0x0062b244`), and pre-seeds named locomotive-availability rows
  through `0x004350b0` before the profile selector at `[profile+0x01]` chooses tutorial,
  setup-generation, or file-load lanes. The neighboring placed-structure
  side is bounded too: global pool `0x0062b26c` comes from
  `placed_structure_collection_construct_empty_runtime_pool` `0x00413230`, while the paired tagged
  collection owners `0x00413280` and `0x00413440` now own the broader placed-structure stream
  load/save path around tags `0x36b1/0x36b2/0x36b3` and the per-entry virtual load/save slots
  `+0x40/+0x44`. The adjacent collection pass `0x00412ab0` is tighter in
  the same way: it now reads as a pure stem-policy sweep that refreshes candidate dword `[+0xbc]`
  from defaults `0x1869f/3/4` plus the fixed override table at `0x005edca8..0x005edd20`, with the
  non-default `3/4` branches driven directly by post-import flag `[candidate+0x78c]` and subtype
  byte `[candidate+0x32]`. The stream-load side is tighter too: `0x004120b0` now clearly reads the
  fixed header fields first, allocates the descriptor strip as `count*0xbc + 1`, zeroes every
  loaded `0xbc` descriptor slot before import, resolves primary mode-`0` cargo names from
  `+0x08 -> +0x1c` and subordinate row cargo names from `+0x30 -> +0x44`, clamps descriptor start
  year `[desc+0x20]` upward to the resolved cargo availability floor `[cargo+0x21]`, and only then
  reruns `0x00411ee0` plus `0x00411ce0`. Its version gates are explicit too: bundles before
  `0x3ed` omit `[candidate+0x3b..+0xbb]`, bundles before `0x3f2` keep the narrow `0x02`-byte form
  of `[candidate+0xc0]`, nonzero `[candidate+0x4b]` forces `[candidate+0x47] = 1.0` and rescales
  `[candidate+0x43]` to at least `0x1388`, and the later stem-index resolution first checks two
  built-in alias stems before the full fixed row table at `0x005ed338..0x005edca4`. The
  current local file-side result is now tighter too: the
  grounded recipe-book root at `0x0fe7` is preserved byte-for-byte across the checked map/save
  scenario pairs, so the loader can safely treat the twelve `0x4e1`-byte books as preserved
  scenario payload rather than a drifting save-only band. A conservative summary probe now only
  reports per-book head signatures, raw cap dwords at `+0x3ed`, and five raw line summaries rooted
  at `+0x3f1` so the file-side structure stays aligned with this grounded ownership. The
  player-facing line modes remain `Disabled`, `Demand Only`, `Supply Only`, and
  `Production Demand->Supply`, and the fourth mode is tighter now too: current wording around
  `1674`, `1675`, and `504` plus the downstream scaling path says it is the
  production-line mode governed by the shared annual production cap, where the entered annual amount
  stays on the supply side while the demanded side becomes the normalized input branch. The
  candidate-side accumulator pass reinforces that split by applying the shared production cap only
  to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The
  lower gameplay side is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels`
  `0x00412650` is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds
  four per-cargo summary banks and returns one direct primary-cargo scalar channel, one cap-share
  primary-cargo scalar channel, one nonzero-mode subrow channel, and one zero-mode cap-scaled
  subrow channel for a requested cargo id. The internal indexing is tighter now too: the two
  primary-cargo banks index from `[desc+0x1c]`, while both subordinate-row banks index each row
  directly from `[desc+0x44+row*0x1c]`. The mode split is tighter in the same way: nonzero-mode
  descriptors bypass the primary-cargo banks entirely and only feed the nonzero-mode subrow bank,
  while mode-`0` descriptors either add their direct scalar to `[this+0x03a]` or, when subrows are
  present, add one cap-share scalar to `[this+0x0a4]` and one cap-scaled row contribution to
  `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and
  the summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if
  the imported low-16 marker rows fail the exact matcher at `0x0041e9f0`, the resulting `0` ids
  will still hit the first summary-bank bucket inside `0x00412650`, but the caller layer above
  that bank now treats cargo id `0` as the nonstandard linked-site classification sentinel rather
  than one ordinary cargo id. So the remaining gap here is only whether any opaque saved marker
  words encode real cargo ids before they reach that matcher, not another missing import or
  rebuild owner. The sibling helper
  `structure_candidate_supports_or_references_cargo_id`
  `0x004129d0` then uses those same banks plus the cached cargo-membership arrays to answer whether
  a live candidate materially references a cargo at all. One compare step tighter, the raw line
  lanes now split cleanly by scenario family while still preserving map->save identity inside each
  checked pair. `Alternate USA.gmp` and `Autosave.gms` match at the raw line-content level: books
  `0..4` keep mixed line areas, their `line02` slots carry the recurring nonzero mode words
  `0x00110000`, `0x000b0000`, `0x000b0000`, `0x00130000`, and `0x00180000`, and the same `line02`
  slots also carry one recurring supplied token `0x000040a0`; the neighboring `line00/line01`
  slots carry the same recurring demanded token lanes such as `0x00010000`, `0x72470000`,
  `0x6f430000`, `0x694c0000`, and `0x694d0000`. `Southern Pacific.gmp` and `p.gms` also match at
  the raw line-content level, but the same rooted line slots stay zero in the checked pair.
  `Spanish Mainline.gmp` and `g.gms` again match at the raw line-content level yet carry a distinct
  nonzero pattern: books `0..4` keep mixed line areas, line-level supplied tokens include
  `0x00170000`, `0x00150000`, `0x00004040`, and `0x00004000`, demanded tokens include
  `0x00010000`, `0x68430000`, and `0x6c410000`, and the later `line02` mode words stabilize at
  `0x00070000` then `0x00010000`. So the loader can now safely treat these raw line lanes as
  preserved scenario payload with family-specific signatures. The mode family itself is now
  grounded at the player-facing layer: the editor page and importer split line up on `Disabled`,
  `Demand Only`, `Supply Only`, and `Production Demand->Supply`, with mode `0` skipped on import,
  mode `1` entering the demand-only branch, mode `3` entering the dual production branch, and the
  remaining nonzero modes taking the supply-side branch. One inference is tighter now too: when those
  demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte
  order reads as short two-letter stems such as `Gr`, `Co`, `Li`, `Mi`, `Ch`, and `Al`, which fit
  the current scenario cargo-name families `Grain`, `Corn`, `Livestock`, `Milk`, `Cheese`, and
  `Alcohol` from `RT3.lng`; the runtime probe now exposes those only as probable ASCII stems, not
  as fully grounded cargo-id decodes. The supplied-token side is now bounded as a separate layout
  family rather than forced into that same stem model: the `Alternate USA` family uses one stable
  low-16 marker `0x000040a0` only in `book00..04.line02`, the `Southern Pacific` family leaves the
  supplied lanes zero in the checked pair, and the `Spanish Mainline` family splits between two
  high-16 numeric tokens `0x00170000` and `0x00150000` in `book00/01.line01` plus the later low-16
  markers `0x00004040`, `0x00004000`, and `0x00004040` in `book02..04.line02`. The probe now
  exposes those conservatively as token-layout classes `high16-ascii-stem`, `high16-numeric`, and
  `low16-marker`, without claiming that the non-stem numeric or marker families are decoded yet.
  One more structural layer is stable enough to name conservatively: the checked nonzero recipe
  rows repeatedly fall into four line-signature classes. `Alternate USA` books `0..4` all expose
  one `demand-numeric-entry` at `line00` (`0x00010000`), one `demand-stem-entry` at `line01`
  (`Gr/Co/Li/Mi` stems), and one `supply-marker-entry` at `line02` (nonzero mode plus
  `0x000040a0`). `Spanish Mainline` books `2..4` expose that same three-line pattern with
  `Ch/Al` stems and the `0x00004040/0x00004000` marker family, while books `0/1` only expose the
  earlier `supply-numeric-entry` form at `line01`. So the loader can now distinguish recurring row
  roles such as demand-stem versus supply-marker without pretending the marker payloads themselves
  are decoded. The importer-side branch map is tighter now too because local `objdump` over
  `0x00435630` shows that only nonzero mode dwords materialize into `0xbc` runtime descriptors:
  mode `0` lines are skipped entirely, mode `1` enters the demand-only branch, mode `3` enters the
  dual demand-plus-supply branch, and every other nonzero mode falls into the supply-side branch.
  In the checked corpus that means the recurring `demand-numeric-entry` and `demand-stem-entry`
  rows in `Alternate USA` and `Spanish Mainline` are preserved scenario-side line records but do
  not become live runtime descriptors, while the later `supply-marker-entry` rows are the ones that
  actually reach the runtime import path. The runtime probe now exposes that directly as
  `imports_to_runtime_descriptor` plus one conservative `runtime_import_branch_kind`.
  The raw token windows beneath those branch labels are tighter now too. The checked mode-zero
  demand rows preserve string-bearing windows at `line+0x1c`, and the current probe shows those
  conservatively as prefixed ASCII previews such as `..Grain`, `..Corn`, `..Livestock`, and
  `..Milk`; local `objdump` now grounds `0x0041e9f0` itself as
  `cargo_collection_find_entry_id_by_exact_name`, a direct exact-string walk over the live cargo
  collection at `0x0062ba8c` that returns one live cargo entry id or `0`. The importer at
  `0x00435630` feeds both token lanes through that same matcher after one conservative in-place
  cleanup pass: empty strings are replaced with the first live cargo name, and mode `3` loops
  until the supplied and demanded token strings no longer compare equal. By contrast, the imported
  `supply-marker-entry` rows still feed nonprintable windows such as `.@...` from `line+0x08`
  through that same exact matcher, and the resolver path currently shows no special-case decoding
  for those marker forms. So the strongest static read is now: the stem-like demand rows preserve
  cargo-name text but are skipped because their mode is zero, while the nonzero imported marker
  rows are the live descriptor inputs yet likely fail exact cargo-name resolution unless another
  upstream transform exists; when they do fail, the importer writes the returned `0` ids directly
  into the runtime descriptor cargo lanes instead of taking any special marker-side fallback path.
  The wrapper layer above that query no longer looks like a hiding place for special treatment
  either. Local `objdump` now shows `0x00412960` simply summing the two supply-side floats returned
  by `0x00412650`, while `0x004129a0` returns the single zero-mode cap-scaled subrow lane directly;
  neither wrapper checks for cargo id `0` after the query returns. The broader world-side
  accumulator at `0x0041e7be` is tighter in the same way: it calls `0x00412650`, requires all four
  returned channels to be positive before continuing, queries one linked-instance count through
  `0x00413940`, scales the direct-primary, cap-share-primary, nonzero-mode-subrow, and
  zero-mode-cap-scaled-subrow lanes by that count, and then writes the finished quartet into
  candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]` while stamping
  `[candidate+0x8a]` from current world field `[0x006cec78+0x15]`. So the current strongest read
  is no longer an unresolved null-cargo semantic question inside the load bridge: unresolved
  marker rows can still propagate through the first bank bucket, but the first place that meaning
  matters is a normal positivity-gated cargo-channel consumer rather than a dedicated null-cargo
  branch.
  The caller side is narrower than before too. The steady-state site bitset owner
  `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` starts its inner cargo
  loop at id `1` and only walks upward through the current live cargo count, so it never
  intentionally queries cargo id `0`. The broader placed-structure sweep around `0x00452e60`
  tightens the same boundary from above: when the requested cargo id is nonzero it resolves the
  backing candidate and enters `structure_candidate_supports_or_references_cargo_id`, but when the
  requested id is exactly `0` it skips that cargo-reference helper entirely and falls through to a
  different linked-site or station-or-transit gate. Current local `objdump` now shows that bypass
  first requiring one subtype latch through the placed-structure vtable `+0x70`, then resolving the
  linked site id at `[site+0x2a8]` through the placed-structure collection `0x006cec20`, and then
  forwarding that linked peer into the narrower predicate at `0x0047fd50`. That narrower helper is
  tighter than before too: it resolves the linked peer's backing candidate through the peer site id
  at `[peer+0x04]`, reads candidate class byte `[candidate+0x8c]`, and returns true only for the
  first three class values `0/1/2` while rejecting `3/4` and anything above `4`. So current local
  callers treat cargo id `0` as a nonstandard linked-site-classification sentinel, not one
  ordinary cargo lane they routinely probe.
  The vtable-`+0x70` latch itself is bounded a bit better now too. It still lacks a direct field
  decode, but every local callsite we checked around `0x0040d230`, `0x0040dba0`, `0x0040dbf0`, and
  `0x0040f670` uses that slot only as the precondition for touching `[site+0x2a8]` and the
  neighboring linked-site helpers `0x0047dda0`, `0x0047fd50`, and `0x004138b0`. That makes the
  safest current read a linked-site-bearing or linked-site-capable latch, strongly aligned with the
  subtype-`1` construction lane that is the only grounded writer of `[site+0x2a8]`, rather than a
  broad cargo or route-style predicate.
  The neighboring maintenance pair tightens that linked-site read further. Local `objdump` now
  shows `0x0040dba0` and `0x0040dbf0` as complementary tiny helpers that each require the same
  vtable-`+0x70` latch, resolve optional linked peer id `[site+0x2a8]` through `0x006cec20`,
  forward that linked peer (or null) into `0x0047dda0`, and then mirror opposite values into local
  byte `[site+0x42]` (`0` for `0x0040dba0`, `1` for `0x0040dbf0`). The route-entry side beneath
  them is tighter too: `0x0047dda0` reads route-entry anchor id `[peer+0x08]`, resolves that anchor
  through `0x006cfca8`, and only dispatches one of two route-entry vtable calls when
  `0x0048a090(1)` reports that all three anchor-slot dwords `[entry+0x206]`, `[entry+0x20a]`, and
  `[entry+0x20e]` are still `-1`. So the strongest current read is no longer just "linked-site
  capable" in the abstract: this latch consistently fronts the local linked-peer class gate
  `0x0047fd50`, the paired `[site+0x42]` route-entry state toggles, the route-link cleanup sweep
  `0x004138b0`, and the later linked-peer collection families `0x004139a0`, `0x00413a00`,
  `0x00413aa0`, and `0x00413b40`, which count linked peers that pass the station-or-transit gate,
  narrow that same subset to candidate class `3/4`, or stay on the subtype-`4` side and only
  inspect raw linked-instance candidate byte `0xb9`.
  That keeps the `cargo id 0` bypass path firmly on the linked-site route-anchor or classification
  side rather than on an ordinary cargo lane.
  One smaller ownership boundary is tighter too: byte `[site+0x42]` is not private scratch owned
  only by that pair. Local `objdump` shows tiny direct setters at `0x0040cbc0` and `0x0040cbd0`
  plus a raw getter at `0x0040cbf0`, so the `0x0040dba0/0x0040dbf0` pair is writing one shared
  placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution
  is tighter now too: later mode-gated reads at other addresses also touch a `+0x42` byte on their
  own object layouts, so the safest current note keeps only the immediate
  `0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0` cluster grouped together and does not
  reuse those later byte reads as same-family evidence.
  The vtable side sharpens that split too. A local `.rdata` scan shows `0x0040dba0` and
  `0x0040dbf0` each appearing exactly once, together with `0x0040cbf0`, in one method table rooted
  at `0x005c8c50`; the constructor chain is tighter now too, because `0x0040c950` installs that
  same table as one concrete placed-structure specialization above the common base table
  `0x005cb4c0`, while `0x0040c970` tears the same specialization back down to the base before the
  temporary object is freed. By contrast the raw set or get trio
  `0x0040cbc0/0x0040cbd0/0x0040cbf0` also appears in several sibling tables such as `0x005c9750`
  and `0x005dd1f0`. So the strongest current structural read is that byte `[site+0x42]` belongs
  to one broader placed-structure virtual interface, while the linked-peer route-entry toggles are
  one specialization-specific override pair inside that family rather than generic setters used by
  every sibling.
  One negative boundary is tighter now too: the
  raw token words in this recipe block do not look like the already grounded shell-side
  `AnyCargo/AnyFreight/AnyExpress` selector-table ids from `0x00621e04/0x00621e10`, so the current
  best read is that these on-disk line tokens are not just copied UI selector ordinals or the same
  small express-side id family in another wrapper. One broader collection pass also now ties
  the editor rule side back into runtime filtering:
  `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0` rebuilds
  per-candidate flag `[candidate+0x56]` across the live structure collection, and current grounded
  callers show it rerunning directly off the runtime cargo-economy latch at `[0x006cec74+0x25f]`,
  which aligns this lane with the editor's `Disable Cargo Economy` special condition rather than
  leaving it as a purely editor-owned recipe page. The first common live gate beneath that filter is
  now bounded too: `structure_candidate_is_enabled_for_current_year` `0x0041e220` is the shared
  year-and-filter check used by the collection refresh and later candidate-selection branches, while
  `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0` is a setup-side local service
  scorer that already consumes the same enabled candidate records through world-grid sampling. One
  steady-state world-side consumer is now grounded as well:
  `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` walks linked placed
  structures, filters live category-`2` candidates through
  `structure_candidate_is_enabled_for_current_year`, and compacts the direct and scaled supply-side
  channels from `0x00412960` and `0x004129a0` into per-cargo bitsets on the placed-structure record.
  The next site-side owner layer is tighter now too:
  `placed_structure_refresh_linked_candidate_flag4` `0x0042c8f0` refreshes the sibling state bit at
  `[site+0x0e6]`, `placed_structure_refresh_candidate_service_state` `0x0042cdf0` ties that flag
  refresh to the cargo-service bitset rebuild,
  `placed_structure_rebuild_candidate_local_service_tables` `0x0042ce00` then performs the heavier
  per-site candidate score rebuild over the aligned float and word tables at `[site+0x107]`,
  `[site+0x02]`, and `[site+0x6c]`, and `placed_structure_refresh_local_service_score_bundle`
  `0x0042d580` is now the local wrapper that chains that rebuild into the neighboring post-passes
  before the world-grid owner continues. Those post-passes are tighter too:
  `placed_structure_apply_route_linked_service_caps` `0x0042cc50` is the first route-backed cap pass
  over the rebuilt local tables,
  `placed_structure_redistribute_local_service_pressure_from_neighbors` `0x0042c1b0` is the
  neighboring-site redistribution pass, and `placed_structure_clamp_candidate_service_age_table`
  `0x0042cb30` is the final recent-service clamp over the primary per-candidate word table. Above
  that refresh lane, `placed_structure_query_candidate_local_service_metrics` `0x0047e240` is the
  first higher-level query, `placed_structure_count_candidates_with_local_service_metrics`
  `0x0047e330` counts how many candidates currently produce that query,
  `placed_structure_get_nth_candidate_id_with_local_service_metrics` `0x0047e620` is the ordinal
  selector over that same visible candidate family,
  `placed_structure_query_cached_express_service_class_score` `0x0047e390` caches one parallel class
  score for the express family now strongly aligned with `Passengers`, `Mail`, and `Troops`,
  `placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site`
  `0x0047eb90` rebuilds one peer-site comparison cache over the same local-service inputs, and
  `placed_structure_select_best_candidate_id_by_local_service_score` `0x0047f910` is the best-hit
  selector above the direct and directional local-service query pair. Those site-side scores now
  have grounded shell read-side consumers too:
  `shell_station_detail_format_freight_and_express_summary` `0x00506be0` formats the visible
  `Freight: %1` and `Express: %1` lines in `StationDetail.win`, and the same station-detail family
  now has a deeper candidate-service lane:
  `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` stores the active
  `(station id, candidate id)` pair for the world-side preview scan and now grounds the whole
  world-side arming strip through
  `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active`
  `0x00452f60`,
  `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`,
  `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active`
  `0x00452db0`, and
  `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`,
  `shell_station_detail_clear_active_candidate_service_preview` `0x00504a90` tears that pair back
  down, `shell_station_detail_update_candidate_service_entry` `0x00504ba0` is the shell-side entry
  updater above that preview pair, `shell_station_detail_format_candidate_local_service_summary`
  `0x00504bea` uses `placed_structure_query_candidate_local_service_metrics` together with localized
  ids `681`, `682`, and `2813` to build the visible candidate service text,
  `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150` now grounds the paired `To`
  and `From` hauled-traffic strip widgets, `shell_station_detail_present_to_from_haul_stats_popup`
  `0x00504770` owns their click-through annual and lifetime `hauled TO/FROM this station` popup,
  `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470` owns the five-row
  nearby-structure jump lane, and `shell_station_detail_refresh_candidate_service_rows` `0x00505760`
  is now the larger row-list owner that enumerates active candidate-service entries and wires
  `shell_station_detail_update_candidate_service_entry` into the per-row click path. The broader
  owner above those lanes is tighter now too: `shell_station_detail_window_refresh_controls`
  `0x00506610` is the real `StationDetail.win` refresh pass, validating the current station from the
  detail manager, publishing the upper summary lane, splitting the `0xb3b7/0xb3b8` action strip by
  scenario latch `[0x006cec74+0x1db]`, routing that scenario branch through
  `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590`, routing
  class `3/4` sites into the alternate branch
  `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and otherwise rebuilding the nearby-structure lane, the paired `To/From` widgets,
  and the candidate-service rows together. The broader message side is bounded now too:
  `shell_station_detail_window_handle_message` `0x00505e50` owns the wide `StationDetail.win`
  switch over message ids `0`, `0xca`, `0xcb`, and `0x3ea`, routes candidate-service rows
  `0xb4dc..0xb5a3` into preview arm or clear or a Ctrl-modified `Overview.win` handoff, routes
  nearby-structure rows `0xb40a..0xb413` into the detail transition and optional world-centering
  path, refreshes control `0xb3f8` on the `0x3ea` branch, and dispatches the lower
  `0xb3b5..0xb3bf` action band through the selected-station ownership and class-gated helper strip.
  The compact siblings under that pass are tighter now too:
  `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` is the dirty
  clear owner over the dynamic row bands and the paired haul widgets, `shell_station_detail_has_valid_selected_station`
  `0x00504370` is the bare selected-station validity probe, `shell_station_detail_selected_station_belongs_to_selected_company`
  `0x00504390` is the selected-company ownership gate, and
  `shell_station_detail_present_selected_station_not_controlled_notice` `0x005043f0` is the
  localized not-controlled popup beneath the same action family,
  `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` is the
  scenario-latched station-to-station triplet popup that walks the current station's
  `0x24`-byte per-destination table, skips invalid or self ids, and formats three five-byte-stepped
  per-destination scalar lanes as `%5.2f` after dividing by `100.0`, or `N/C` when the lane is
  absent, and
  `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0` is the alternate
  class-`3/4` branch that rebuilds the `Trains Serviced` / `Trains Maintained` matrix before
  reusing the shared haul-popup callback wiring,
  `shell_station_detail_refresh_class_partitioned_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`
  is tighter now too: it does not just gate one vague lower strip. It partitions the lower action
  row into two class-sensitive families, leaving `0xb3bb/0xb3bd/0xb3be` active only when the linked
  candidate class is `0`, while `0xb3bc/0xb3bf` stay active only when that class is exactly `1`.
  The
  adjacent lifecycle and navigation side is tighter now too:
  `shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton` `0x00505bf0`
  is the real `StationDetail.win` destructor, and
  `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class`
  `0x00505cb0` plus wrappers `0x00505e30` and `0x00505e40` now bound the next-or-previous station
  stepping path that keeps the selection inside the same owner and station-site class family before
  optionally recentering the world view. The broader shell command layer above that station-detail
  branch is tighter now too:
  `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00` and
  `shell_command_step_active_window_subject_backward_or_publish_contextual_notice` `0x00440f20`
  are the paired next-or-previous shell commands that first prefer `StationDetail.win`, then the
  live building-detail family, then `CompanyDetail.win`, and finally the sibling singleton at
  `0x006d3b20` before falling back to the localized notice pairs `0x017a/0x017b` and
  `0x017c/0x017d`. The adjacent direct subject-openers are tighter now too:
  `shell_open_or_focus_train_detail_for_current_or_first_owned_train` `0x00441040` reuses current
  detail subject `[detail+0x78]` or falls back to the first owned train for the selected chairman
  company before re-entering `shell_detail_panel_transition_manager` with mode `2`, while
  `shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station` `0x004410d0`
  reuses `[detail+0x80]` or falls back to the first owned linked station before the same transition
  manager is re-entered with mode `5`. Two later registered command siblings are now bounded only
  structurally but still usefully: `0x00441160` requires active scenario plus live world root
  `0x0062c120` and dispatches either
  `world_enable_preview_mode_0x15_latch_and_enter_if_idle` `0x00453370` or
  `world_disable_preview_mode_0x15_latch_and_clear_if_active` `0x00453780` by the query at
  `world_query_preview_mode_0x15_latch_active` `0x00450150`,
  while `0x004411a0` requires active scenario plus live route-store root `0x006cfca8` and
  dispatches either `0x00491880` or `0x004932a0` by the boolean result of `0x004934a0(0)`.
  The next registered shell-command strip is bounded the same way now:
  `shell_command_toggle_shared_world_preview_global_0x62be84` `0x00441240` flips the shared
  preview-oriented global `0x0062be84`,
  `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`
  and `...variant_1...` `0x004412a0` both route through
  `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`,
  which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across
  detail controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards
  the selected variant into
  `world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty` `0x0043a0a0`, and
  `shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds` `0x004412e0`
  re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` and then rewrites the
  paired shell-state dwords at `[0x006cec74+0x1df/+0x1e3]` through `0x00482850`. Those three
  commands are still structurally named rather than semantically named, but the current static owner
  boundaries are now explicit. The same command band is tighter at both edges too: `0x004411e0`
  simply flips presenter dword `[0x006d4024+0x114276]` when the main shell presenter is live, and
  `0x00441200` is the adjacent active-scenario gate that injects shell message `0xcb` for control
  `0x9858` through
  `shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars` `0x00538e00`. The later edge
  of the same shell strip is bounded too:
  `0x00441ac0` and `0x00441af0` are the two small active-scenario plus shell-idle wrappers over
  `shell_map_file_entry_coordinator` `0x00445ac0`, forwarding flag triplets `(0,0,0)` and
  `(0,1,0)` respectively, while `0x00441b20` is the neighboring live-world clamp that ensures
  `[world+0x168d]` never falls below `[world+0x1689]`. The next broader neighbor is now grounded
  too: `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` is the
  real editor-map-mode toggle owner above `0x00482e50`. It branches on current shell mode
  `[0x006cec74+0x68]`, uses one-shot latches `0x0062be88` and `0x0062be8c` to gate localized
  warnings `0x017e` and `0x0b24`, and on the non-editor side can instead raise warning `0x0b6e`
  when `0x004349a0` reports more than one active profile. After those gates it forwards target mode
  `([shell+0x68] == 0)` into
  `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`.
  The adjacent time-of-day strip is grounded now too:
  `shell_command_increment_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar`
  `0x00441cb0` and
  `shell_command_decrement_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar`
  `0x00441d20` are the paired registered commands beneath localized ids `0x0db5/0x0db6`, whose
  RT3.lng captions are `Increment Time Of Day` and `Decrement Time Of Day`. Both
  require active scenario state plus the same single-profile gate from `0x004349a0`, clear shell
  dwords `[0x006cec74+0x233]` and `[+0x124]`, then adjust startup scalar `[0x006cec78+0xbfa]` by
  `+0.5` or `-0.5` before re-entering
  `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute
  counter `[0x006cec78+0x15]` and refreshing the live world view through `0x00439a80`. So the
  registration-side identity is now closed: these are the paired half-step time-of-day
  presentation commands, not generic shell scalars and not the earlier selected-year read.
  The adjacent progress-status side is tighter now too:
  `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90` is the shared save or load
  progress payload builder, and
  `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` is the
  throttled callback installed at `0x00442960` through global `0x00d93988`. That callback advances
  the progress latches `0x0062bec8/0x0062becc/0x0062c118`, rebuilds the percent payload through
  `0x00441d90`, republishes it through `0x00538c70`, and services the shell frame through
  `0x00482160`. The surrounding `0x00445de0` callers keep that pair on the save or load progress
  side of the shell strip rather than as another input-command family. The adjacent companion-image
  file seam is bounded now too:
  `shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags`
  `0x00441f70` and
  `shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path`
  `0x004420f0` are the paired `_A.tga` / `_A.jpg` import and export helpers around the same
  tagged stage-dword plus fixed-preview strip at `0x00441ec0`. Both derive an extensionless stem through
  `support_copy_string_stem_before_first_dot` `0x0051dde0`, choose the `_A.tga` versus `_A.jpg`
  suffix by selector byte `[record+0x09]`, and then shuttle the file bytes through the shared
  staging descriptor rooted at `0x0062bed4/0x0062bed8`. That keeps the family grounded on the same
  fallback descriptor later reused by
  `world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback` `0x00535430`,
  instead of leaving it as an isolated save-side file copier. The neighboring exporter
  `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100`
  `0x00442ba0` is bounded now too: it copies one `0x403c2`-byte live setup-preview payload record
  from `[this+0x66be]`, forces validity byte `+0x00 = 1`, patches world dimensions and three shell
  bytes into offsets `+0x01..+0x0b`, and then normalizes the embedded `0x100 x 0x100` pixel block
  at `+0x03c2` through `0x0047a120` before the save-side callers branch in two different ways. The
  package-save path at `0x00444f42` calls `0x00442ba0` and then immediately enters `0x00441ec0`
  at `0x00444f47`, while the `.smp` serializer branch at `0x00446312` calls `0x00442ba0` first and
  then emits `0x2ee0`, writes the full `0x403c2` payload through `0x00531030`, and closes `0x2ee1`
  directly without re-entering `0x00441ec0`. The `0x00441ec0` strip is tighter now too: it
  snapshots the shared leading dword seeded from `0x00620e94`, then mirrors one `dword + 0x2ee0 +
  0x03c2 + 0x2ee1` strip through its staged-object or companion-file transport branches, and does
  not itself choose the companion-image selector byte. The same negative boundary is explicit now too:
  current local restore-side evidence still does not show either `0x00441ec0` or the later `.smp`
  loader `0x00446d40` writing that restored leading dword back into `0x00620e94`, so the sidecar
  format is carrying more framing than the grounded restore owners currently republish into live
  state. The copied shell-byte trio is
  tighter now too: current local disassembly grounds payload bytes `+0x09/+0x0a` as direct mirrors
  of shell-controlled sidecar dwords `[0x006d4024+0x11471a/+0x11471e]`, while `+0x0b` is the low
  byte of shared dword `0x0062bec4` later seeded by the package-save coordinator from the sibling
  selector pair `[0x006d4024+0x11472a/+0x11472e]`; the display-runtime defaults path around
  `0x0051ee48..0x0051ee85` initializes those same four dwords together, and the broader
  `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family`
  `0x00464c80` later owns the direct toggle strip for controls `0xe101..0xe104`, including the
  grounded implication rules `!0x11471e -> clear 0x11472a` and `(0x11472a || 0x11472e) -> set 0x11471e`.
  Payload bytes `+0x0a/+0x0b` are therefore the same
  companion-image and companion-payload sidecar gates later read from `[world+0x66c8/+0x66c9]` in
  the package-save tail. The broader sibling
  `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46`
  `0x00442740` is bounded now too: it copies the embedded preview pixels at `[record+0x03c2]`
  into a temporary `0x40000`-byte RGBA buffer, constructs one temporary `0xec`-byte surface-like
  owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, forwards the caller path
  plus fixed selector `0x46` into `0x00542f50`, stores the returned dword into payload field
  `[record+0x18]`, and then releases the temporary owner again through `0x00542c90` and
  `0x0053b080`. That keeps the short save-side branch at `0x00445925` grounded as a one-shot
  preview-surface query helper rather than leaving another anonymous image-copy leaf between the
  tagged export path and the progress notice strip. The broader sibling
  `shell_map_bundle_rewrite_companion_payload_file_via_tmp_extension_path_and_progress_callback`
  `0x004427c0` is now bounded as the `.tmp`-extension owner above that same tag strip: it strips
  the caller extension, appends `.tmp`, installs progress callback `0x00441e20` in `0x00d93988`,
  rewrites the middle payload band rooted at `+0x03ce` through `0x00553000`, writes the result
  back out through `0x005a276f`, updates payload dword `[record+0x18]`, and only then re-enters
  `0x00441ec0`.
  The sibling
  `shell_map_bundle_rewrite_companion_payload_file_from_path_stored_byte_offsets_and_sync_tags`
  `0x00442900` is bounded now too: it takes the live payload record in `EAX`, reads the full
  companion file named by the caller path, installs the same progress callback, rewrites the
  middle payload through `0x00553000` using stored offsets `[record+0x18/+0x1c]`, and then writes
  the output back in four spans: the leading `0x03ce` bytes, the transformed middle payload, the
  untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. It then stores the
  caller path back into `[record+0x18]` and re-enters `0x00441ec0`. That closes the path-plus-
  stored-offset save-side sibling reached from `0x004459dd` after `0x00441f70`, so the
  companion-payload strip is no longer split between one named temp-path owner and one anonymous
  offset-band rewrite body.
  The underlying temporary-surface seam beneath those save-side helpers is bounded now too.
  `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10`
  scans the eight-entry row band `[this+0xa0..+0xbc]`, allocates one `0x32`-byte row, seeds width,
  height, and type, and returns the chosen slot index; `0x00541ba0` is the indexed release-side
  companion. `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` is the
  named-resource dispatcher used by `0x00442740`: it opens the caller-seeded resource path,
  forwards the result into `0x005428c0`, and then dispatches by imported row type
  `[row+0x18] = 2/3/4`. `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish`
  `0x005438d0` is the commit-side publish helper over the active RGBA backing buffer
  `[row+0x26]`, while `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode`
  `0x00543980` is the constructor or ensure owner that allocates one first-use slot through
  `0x00541b10(..., width, height, 3)` and then commits the caller pixels through `0x005438d0`.
  That keeps the save-side preview seam tied back to the same reusable surface-owner family already
  visible in the world-presentation and shell-overlay branches, instead of leaving the temporary
  preview query path grounded only at the leaf helper level.
  The lower surface-owner base is bounded now too. `surface_owner_base_init_and_register_on_global_list`
  `0x00540e30` seeds the fixed owner label, capability bytes, helper-object pair, row-slot bands,
  and global intrusive registration under `0x00ccbb2c`; `surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers`
  `0x00540fc0` is the shared maintenance owner that recomputes cached byte totals `[this+0xcc/+0xd0]`
  across the eight row slots and also owns the full row-buffer release pass; and
  `surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate` `0x00541210`
  is the row-side repack body that converts the active backing pixels into the live 16-bit buffer
  `[row+0x2a]`, either through a palette-like accumulated-channel path or a direct nibble-packed
  conversion path depending on owner byte `[this+0x96]`. That closes the reusable surface family
  one layer deeper instead of stopping at the first slot allocator and commit helpers.
  The two remaining compact helpers in that same seam are bounded now too.
  `surface_owner_query_dimension_cap_from_mode_and_quality_band` `0x00541160` derives the active
  power-of-two size cap `0x100/0x200/0x400/0x800` from owner byte `[this+0x05]`, shell gate
  `[0x006d4024+0x11422f]`, and selector dword `[this+0xd8]`, while
  `surface_owner_probe_named_file_for_type2_header_signature` `0x005411c0` is the adjacent file
  probe that opens one named path, reads `0x12` header bytes, and accepts only the local type-`2`
  signature. The broader survivor above them is bounded now too:
  `surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream` `0x005428c0`
  allocates temporary alpha and RGB planes from the active row, splits the current backing pixels,
  seeds the local codec object, and then writes the tagged record family `0xbaba/0xbabb/0xbabe`
  into the already-open stream, either directly or through the transformed payload path via
  `0x00553000`. That closes the immediate import-export seam under `0x00542f50`; the next open
  work in this branch is no longer a still-missing leaf, but the broader type-specific row owners.
  Those are bounded now too. `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer`
  `0x00541c30` is the type-`4` importer that validates the `0xbabe` lead tag plus the later
  `0xbaba/0xbabb` branches, reconstructs one RGBA row from the tagged payload bands, and then
  re-enters `0x00541210`. `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer`
  `0x00542030` is the type-`3` importer that validates the recovered width, height, and pixel-size
  header, allocates a full RGBA destination plus temporary staging, and decodes the supported
  `0x18`/`0x20` source families into RGBA rows. `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer`
  `0x00542d50` is the type-`2` importer: it validates `DDS `, enforces the dimension cap from
  `0x00541160`, copies the block-compressed payload from offset `0x80`, stores format tag
  `DXT3`, and optionally materializes the live companion buffer through `0x005423d0`.
  That closes the current type-dispatch branch under `0x00542f50` without leaving its three row
  owners as anonymous stream bodies.
  The direct export-side sibling is bounded now too.
  `surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file` `0x00542b30`
  is the paired file-write alternative to `0x00542f50`: it opens one caller path in `wb` mode,
  builds the compact `0x12`-byte header with row type `2`, first-row width and height, fixed
  pixel-size byte `0x20`, and one optional `0x20` flag bit from the second caller argument, then
  optionally forces RGBA materialization through `0x00541970` and writes the first-row RGBA payload
  `[row+0x26]` plus that header to the open stream. The paired callers at `0x00520cda`,
  `0x00520f61`, and `0x00534dd6` all use it as the direct-file branch immediately before the same
  temporary-surface release through `0x00542c90 + 0x0053b080`, so the current export/import seam is
  no longer split between one named importer and one anonymous file-write sibling.
  The small dispatch sub-strip under that importer is bounded now too.
  `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0` is the direct selector over
  embedded row type `[row+0x18]`, routing type `2/3/4` to `0x00542d50/0x00542030/0x00541c30`.
  The wrapper immediately above it,
  `surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure` `0x00543000`,
  clears selector field `[this+0x07]`, allocates one fresh row slot through `0x00541b10`,
  re-enters `0x00542fb0`, drops the slot again through `0x00541ba0` on the `1/2` failure paths,
  and then refreshes cached byte totals through `0x00540fc0`. That closes the type-dispatch seam
  between the file-open owner and the per-row import bodies instead of leaving one more anonymous
  slot wrapper in the middle.
  The lower lifecycle in that same surface-owner family is tighter now too.
  `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` is the
  shared query-or-materialize helper for non-type-`2` rows: it optionally returns width and height,
  returns `[row+0x26]` when RGBA backing pixels already exist, and otherwise expands the live
  16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords before storing the new backing
  pointer back into `[row+0x26]`. The broader sibling
  `surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers` `0x00542550`
  is the next owner above that helper: when shell capability byte `[0x006d4024+0x11422d]` is live
  and local latch `[this+0x95]` is still clear, it revisits the active row slots, skips type-`2`
  and already-processed rows, forces RGBA materialization through `0x00541970`, marks row byte
  `[row+0x21]`, seeds row state `[row+0x1c] = 0x3c`, discards the previous 16-bit output buffer,
  and rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA
  source, halving `[row+0x04]` on the `0x20`-pixel-size branch. The release-side owner is bounded
  now too: `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90`
  releases optional helper roots `[this+0xdc/+0xe4]`, unlinks the owner from the global intrusive
  list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter when `[this+0x93]`
  is set, and then drops both the selector-side handle and all row slots through
  `0x00541780` and `surface_owner_release_all_row_slots_0xa0` `0x00542870`. That closes the
  reusable surface-owner seam one level deeper instead of stopping at construction, import, and
  commit helpers.
  The remaining tiny surface-owner leaves in that strip are bounded now too.
  `surface_owner_query_first_row_width_or_one` `0x00541aa0` and
  `surface_owner_query_first_row_height_or_one` `0x00541ad0` are the fallback-safe first-row
  geometry getters used by later projection and world-presentation math paths, while
  `surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0` `0x00541bf0`
  simply refreshes cached scalar `[this+0xd4]` from the live shell presenter and returns
  `[this+0xc0]`. The last tiny release helper `surface_owner_release_selector_handle_0x07_if_present`
  `0x00541c10` does exactly what the current name says: when `[this+0x07]` is live it re-enters
  `0x00541780` and clears that handle back to zero.
  The later owner `shell_apply_scenario_name_specific_post_load_world_and_object_fixups`
  `0x00442c30` is bounded now too: `world_entry_transition_and_runtime_bringup` re-enters it at
  `0x00444b50` with the loaded scenario title, and it dispatches on many fixed `.rdata` names
  including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`,
  `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`,
  `Central Pacific`, and `Orient Express`, with several branches further gated by campaign-scenario
  byte `[this+0x66de]`. The matched branches now have a few concrete anchors too instead of reading
  as one anonymous title-side publish. The non-campaign `Go West!` branch retags world-object row
  `7` named `Open Aus` by promoting byte `[obj+0x7f9]` from `1` to `2` when its nested opcode-`0x1b`
  payload is still in the expected starter state; the campaign-gated `Go West!`/`Germany`/`Orient Express`
  side nudges selected city float pairs `[city+0x25a/+0x25e]` upward when they remain below fixed
  thresholds; and the `Central Pacific` branch injects repeated localized `Company Track Miles`
  text lines into shell band `[this+0x4f30]` through `0x0051e5d0`. Beyond those grounded examples,
  the owner also patches object-state dwords and bytes inside collections rooted at `0x0062be18`,
  `0x0062bae0`, and `0x006ada80`, copies paired ten-dword record blocks when specific name/class
  pairs match, flips secondary-raster bits through table `0x005ee508..0x005ee5cc`, and retunes one
  later collection at `0x0062b268`. That finally makes the broad post-load scenario-fixup seam
  explicit instead of leaving it as an unbounded string-switch body beneath world entry.
  One neighboring status helper is bounded now too:
  `shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks` `0x00442660` is the
  shared byte-delta and elapsed-time notice builder used by both the bundle-service strip and the
  save-side progress loop. It measures the current byte counter through `0x00530b70`, formats the
  rounded kilobyte delta and elapsed ticks through `%5d` and `% 4d`, packages them through
  `0x005193f0 -> 0x00518de0 -> 0x0051d680`, and then updates the running previous-counter latch
  `0x0062c11c`.
  That setter writes `[shell+0x68]`, then either rebuilds the editor-side shell surface through
  `0x004d4500` or refreshes the detail-panel and world side through `0x004d44a0`, `0x004dfda0`,
  and `0x0044fb70`, before both branches pulse graphics side effects through `0x00484d70(0x0d, 1)`.
  The adjacent display-settings strip is bounded now too:
  `shell_command_cycle_display_resolution_forward` `0x00483680` is the registered `+1` command
  wrapper into `shell_cycle_display_resolution_and_publish_status` `0x00483780`, while
  `0x00483990` and `0x004839a0` are the plain `+1` and `-1` wrappers into that same shared owner.
  The owner requires the live shell presenter `0x006d4024`, walks the supported resolution tables
  at `0x00620e64/0x00620e7c`, applies the chosen size through `0x005206b0`, publishes the updated
  size string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, and then refreshes dependent
  presentation state through `0x004625b0`, `0x00484910(1)`, and `0x004821d0`. After that point the
  embedded world-view controller strip is tighter now too.
  `world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet`
  `0x00439820` samples a five-point local clearance ring around the current eye X/Z pair through
  `0x00534490`, keeps the highest sample, expands it through `0x0052d0c0` plus fixed margins, and
  republishes the eye triplet through `0x0052d1e0` when the current eye height needs to be lifted.
  The embedded controller base beneath that path is now first-class instead of only being referenced
  indirectly: `0x0052d140` stores the four blend scalars at `[+0x50..+0x5c]`, `0x0052d180` stores
  the focus triplet and raises dirty byte `[+0x64]` when it changes, `0x0052d1e0` stores the eye
  triplet and refreshes sampled vertical delta `[+0x66]`, `0x0052d230` extracts focus-to-eye
  distance plus heading/pitch-like angles, `0x0052d2b0` serializes the focus, eye, and orientation
  lanes into one camera-view snapshot record, `0x0052d400` is the inverse helper that rebuilds the
  focus triplet from eye, heading, pitch, and distance, `0x0052d450` rebuilds the eye triplet from
  focus, heading, pitch, and distance, `0x0052d640` clamps distance against sampled eye height,
  `0x0052d750` is the stream-load companion that rehydrates one stored camera-view snapshot back
  into the controller base, and `0x0052d570/0x0052d5a0/0x0052d6f0/0x0052d860` are the
  base-reset, default-seed, seed, and reset-plus-seed constructor owners. One level higher,
  the compact accessor and dirty-latch strip is bounded now too: `0x0052cd20/0x0052cd60` export the
  current eye triplet as packed or split outparams, `0x0052cd40/0x0052cd80` do the same for the
  focus triplet, `0x0052cda0/0x0052cdc0` are the matching load-store helpers for auxiliary triplet
  `[+0x2c..+0x34]`, `0x0052cde0/0x0052ce20` snapshot the current focus, heading, and distance bands
  into the two cached companion strips when their paired dirty latches are cleared, and
  `0x0052ce70` refreshes shell presenter scalar `[+0x6a]` while consuming the primary dirty latch
  back to zero; the next compact query strip is bounded now too: `0x0052cea0` exports heading and
  pitch lanes `[+0x10/+0x14]`, `0x0052cec0` samples owner height at current eye X/Z,
  `0x0052cf00` broadens that into a clamped XY-extent peak-height query, `0x0052d0c0` is the
  current-eye wrapper into that peak-height query, and `0x0052d0f0` is the normalized scalar-band
  containment predicate over `[+0x50..+0x5c]`. One level higher,
  `world_view_refresh_dependent_projection_visibility_and_presentation_scalars` `0x0043bde0`
  now bounds the larger refresh pass that derives visibility and presentation-side scalars from the
  current focus and eye triplets before later motion and input branches resume. The load-side owner
  one layer above that strip is bounded now too:
  `world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars` `0x0043ac30`
  releases any pending helper handle, clears presenter ownership, resets the local controller strip,
  rehydrates one stored camera-view snapshot through `0x0052d750`, conditionally loads one
  extra-row band into `[this+0x10e]`, reseeds the four controller blend scalars through
  `0x0052d140(0, 0, 1.0, 0.7)`, and then normalizes heading before control returns to the broader
  world-view owner family. The adjacent low-side layout-state strip is bounded now too:
  `0x00544290/0x00544360` publish or reset the local descriptor blocks rooted at
  `[layout+0x352f]` and `[layout+0x34ef]`; the next setter strip `0x00544cb0..0x005450a0`
  publishes or clears bound-node property pairs `0x0d/0x0e`, packed property `0x3c`, grouped
  property `0x0b`, the broader capability and mode-gated slot strips
  `0x1d/0x13/0x14/0x12` and `0x15/0x1a/0x11/0x10`, plus the cached-byte-backed property `0x89`;
  and `0x005450c0/0x005450e0/0x00545130` export the cached local block `[layout+0x24f0]` and the
  negated local scalar triplet `[layout+0x2517/+0x251b/+0x251f]`, with the middle lane clamped up
  to `0.5f`. One level lower, `0x00545180` builds the generated default preset table rooted at
  `[layout+0x840]` as `0x90` fixed `0x33`-byte rows from an angular sweep, while
  `0x00545400/0x00545470/0x005454a0` are the adjacent indexed row setters and query helpers over
  that same table and `0x00545420/0x00545440` are the paired scalar-array siblings for
  `[layout+0x25f7/+0x25ff]`; the next local strip `0x005457c0/0x005458a0/0x005458d0` publishes
  one property-`0x8b` stack descriptor on the bound node and borrows or releases the current
  segment-record window handle `[layout+0x265b]` with global counter `0x00ccd824`; the immediate
  sibling wrappers `0x005459f0/0x00545a20/0x00545a40/0x00545a70/0x00545aa0/0x00545ac0/0x00545af0/0x00545b90/0x00545bb0/0x00545be0`
  repeat the same borrow-release pattern for the adjacent table handles `[layout+0x2643/+0x2647/+0x264b/+0x264f/+0x2653/+0x263f]`.
  The last clean local leaves after that are `0x00545ca0/0x00545d50/0x00545d60/0x00545db0/0x00545e00`,
  which cover the first-slot clear plus type-`1` span commit, the accumulated span counter query,
  the counter reset and optional bound-node reseed, the bound-node finalize-and-optional-clear
  helper, and the small bound-node signature classifier. One level up, the next owner body is
  bounded now too: `0x00545e30` queries one external/provider report and builds summary text in
  buffer `[layout+0x43c]`, falling back to localized id `0x73` when the provider lookup fails and
  otherwise appending the localized fragment strip `0x74..0x7d` plus the fixed format family
  `%1(16-bit HW) ` / `%1(8-bit HW) ` / `%1(8-bit) ` / `%1(16-bit) ` from the returned report. The
  adjacent reset-and-property strip is also tighter now: `0x005464d0` runs one repeated four-pass
  bound-node reset sequence, `0x00546540/0x00546560` force property `0x17` to `7` or `4`,
  `0x00546580/0x005465a0` clear or raise property `0xa8`, `0x005467a0/0x005467e0` are the paired
  one-bit gate writes for property `0x1c`, and `0x00546810/0x00546850/0x00546890` are the
  template-gated and clear-side mode writes for property `0x16` via local mode byte
  `[layout+0x254a]`. One level higher again, `0x0054a0c0` is now bounded as the broader setup-side
  owner above that strip: it binds one external source onto the bound presentation node, falls
  back to the midband release helper when that bind fails, conditionally reapplies the cached
  gamma-ramp scalar from `[[layout+0x83c]+0x2f]`, seeds optional handle `[layout+0x33ab]` through
  the small `0x00570fbd -> 0x00570f86` refcounted `0x14`-byte object helper pair, which now opens
  into a tighter row-container family: `0x0057091d` reserves one `0x40`-byte row block from the
  fixed template `0x0056cd2c`, with `0x005708ce/0x005708f2` as the aligned block alloc/free
  helpers, `0x00570908/0x005709da` as the destructor and release-side wrappers,
  `0x00570fa1` as the direct refcount-drop path, `0x0057098b` answering only `IUnknown` plus one
  custom IID, and `0x005709f6` as the first grow-and-duplicate-last-row owner. The next
  current-entry strip is also bounded now:
  `0x00570aac` seeds the current `0x40`-byte entry to an identity 4x4 matrix, `0x00570b0d`
  stores one caller matrix directly into that current slot, and `0x00570b2c/0x00570b76` are the
  two immediate left/right composition siblings over the same current matrix through
  `0x0056d3cd`. One level wider, the same family now has three helper-generated matrix-pair
  variants too: `0x00570bc0/0x00570c2f` build a temporary matrix through `0x0056df7d`,
  `0x00570c9e/0x00570d1a` do the same through `0x0056e1a8`, and `0x00570d96/0x00570e12` plus
  `0x00570e8e/0x00570f0a` do the same through `0x0056dc9a` and `0x0056dd2a`, with each pair
  preserving the same right- and left-side current-matrix composition split. The adjacent helper
  region is now bounded as one sibling COM-style object pair too: `0x0057aef3/0x0057aedb/0x00571016`
  are the init, refcount-drop, and release-side wrappers for vtable `0x005def30`, with
  `0x0057ad5a` as the direct addref helper,
  `0x0057ad20` as its destructor and `0x0057ae97` as its `IUnknown` plus custom-IID query gate,
  `0x0057ad67` as its resource-field bind plus attached-object and payload-copy owner,
  `0x0057add4/0x0057adfb` as the attached-object getter and fixed payload copy-out helpers, and
  `0x0057ae0f/0x0057ae1e/0x0057ae2d/0x0057ae53/0x0057ae79/0x0057ae88` as the direct pass-through
  wrappers over resource field `[+0x48]` and payload block `[+0x08]`,
  while `0x0057af0e/0x00571032` are the destructor and release-side wrapper for sibling vtable
  `0x005def5c`, with `0x0057af4e` as the matching addref helper, `0x0057af5b` as the target-attach
  plus cached-flag derivation owner, `0x0057afd0` as the target getter, and `0x0057aff6` as the
  one-shot target-handle release helper, `0x0057b021` as the paired two-handle clear path,
  `0x0057b065` as the matching `IUnknown` plus custom-IID query gate, `0x0057b0a9` as the
  refcount-drop helper, `0x0057b0c1` as the first broader target-handle and property-strip
  seeding owner, and `0x0057b4fd` as the next target-side transform-block builder over optional
  anchor pairs plus caller angle and scale. The resource-field branch under `0x0057ae0f..0x0057ae88`
  is now tighter too: `0x00580867` is the small constructor-style init for the `0xb0`-byte
  target-service object, clearing the embedded entry-band roots, ready byte, auxiliary handle
  fields, and cache link; `0x005808b2` is the matching full destructor, releasing the two
  target-bound service handles, both embedded eight-entry bands, attached object, target, the
  auxiliary handle family rooted at `[+0x6c/+0x98/+0x9c/+0xa8]`, and then unlinking the object
  from the global cache chain rooted at `0x00db89e4`; `0x005809ab` is the release-side wrapper for
  that destructor; `0x005809c7` seeds service handles `[+0x64]` and `[+0x68]`, invokes attached
  object `[+0x0c]` through slot `+0x10`, republishes those two handles through target slots `+0xdc`
  and `+0xd8`, and latches ready byte `[+0x60]`; `0x00580a54` is the paired clear-side sibling
  that releases handle `[+0x64]` through target slot `+0xd8`, notifies the attached object through
  slot `+0x1c`, and clears `[+0x60]`; `0x00580a84` is the broader release body over those target
  handles plus the two embedded eight-entry bands rooted at `[+0x10]` and `[+0x30]`;
  `0x00580aff` is the setup-side entry-band owner that chooses one of two fixed parameter triples
  from local mode byte `[+0x50]`, seeds scalars `[+0x54/+0x58/+0x5c]` through `0x00570669` and
  `0x00570691`, and dispatches live per-entry objects through slot `+0x3c`; `0x00580bb9` is the
  small auxiliary-handle release helper over the pointer band rooted at `[+0xa8]`; `0x00580bdc`
  is the direct refcount-drop path; `0x00580be8` is the constructor-side owner that stores target
  `[+0x04]`, derives mode byte `[+0x50]`, seeds the fixed scalar triple `[+0x54] = 0x15`,
  `[+0x58] = 0x40`, `[+0x5c] = 0x10`, builds the entry bands, and binds the auxiliary handle
  family rooted at `[+0x6c]`, `[+0x98]`, and `[+0x9c]`; and `0x00580d29` is the primary
  payload-dispatch and layout-style service owner below the `0x0057ae2d/0x0057ae53` wrappers,
  taking the target-service object, caller payload block, five caller arguments, and fixed
  mode-variant flag while using service handle `[+0x6c]` plus external callbacks
  `0x005c81e4/0x005c8248/0x005c824c`,
  and `0x0058123c` is the cache-or-create factory above that strip, walking the same global cache
  root `0x00db89e4` for a matching target, otherwise allocating one `0xb0`-byte object, running
  `0x00580867`, and finishing construction through `0x00580be8`. Immediately below that service
  factory the local container strip is now bounded too: `0x005812b1/0x005812c1/0x005812cf/
  0x0058133d/0x00581371` form the reset, release, push, pop, and status helpers for one growable
  dword-pointer vector, while `0x00581379/0x0058138c/0x005813bd/0x00581470/0x005814a4` do the same
  for the sibling growable string-pointer vector with accumulated byte count at `[+0x10]`, and
  `0x005814ac` is the first owner above that string-vector family, building one newline-joined
  text object from the stored strings. The adjacent object strip is now bounded too:
  `0x00581673/0x005815cf/0x005815dc/0x00581610` are the init, addref, refcount-drop, and release
  wrappers for vtable `0x005e0bd8`, `0x00581594` is the destructor, `0x005815a9` allocates the
  owned text buffer, `0x005815fc/0x00581606` are the direct getters for that buffer and its stored
  length, and `0x0058162c` is the matching `IUnknown` plus custom-IID query gate. The adjacent
  SIMD math strip is now bounded too: `0x00581690` applies the first two basis rows plus
  translation row `[+0x30]` to one XY pair and stores the full vec4 result, `0x005816d0` is the
  projective sibling that scales by a reciprocal derived from lane 3 and returns projected XY, and
  `0x00581730` is the translation-free low-64-bit sibling over just the first two basis rows,
  while `0x00581770/0x00581830/0x005818f0` are the corresponding 3D XYZ helpers for basis-only,
  basis-plus-translation, and projected basis-plus-translation output, `0x005819f0` is the direct
  4D vec4-by-4x4 basis application helper, `0x00581ab0` is the four-row batch sibling over a full
  4x4 source block, and `0x00581c00/0x00581cd0` are the shared normalize-or-zero helpers for vec3
  and vec4 input. One level wider, `0x00581db0` is now bounded as the shared 4x4 inversion helper
  with optional determinant outparam, `0x00582070` is the packed-output batch sibling to the
  earlier four-row 4D basis application helper, `0x005821d0` is a standalone 4D cross-product-like
  helper over three vec4 inputs, `0x00582280` is the unchecked vec4 normalization sibling, and
  `0x00582320/0x005823e0/0x00582470/0x00582520` are the first cubic-basis interpolation helpers
  in the same math strip for vec3, vec2, vec4, and the first alternate-basis vec3 case.
  The same family now extends cleanly through `0x005825e0` and `0x00582680` as the alternate-basis
  vec4 and vec2 siblings, then into `0x00582710/0x00582770/0x005827c0` as the two-scalar affine
  blend helpers computing `p0 + s*(p1-p0) + t*(p2-p0)` for vec3, vec4, and vec2 inputs.
  The next geometry leaves are bounded too: `0x00582820` is the plane-versus-segment intersection
  helper over one plane vec4 and two vec3 endpoints, `0x005828e0` is the standalone 4x4
  determinant helper beside the nearby inversion body, and `0x005829b0` builds one plane vec4
  from three vec3 points by cross product, normalization, and signed-distance writeout. The next
  quaternion strip is now bounded too: `0x00582c30` builds one 4x4 rotation matrix from a
  quaternion-like vec4, `0x00582d10` is the quaternion product helper, and `0x00582da0` is the
  unchecked quaternion-normalization sibling. The adjacent plane-and-quaternion leaves are tighter
  now too: `0x00582aa0` is the shared plane-driven projective 4x4 matrix builder over one plane
  vec4 and one second vec4 input, `0x00582e40` is the quaternion inverse helper that conjugates
  the spatial XYZ lanes and divides by squared length, `0x00582eb0` rebuilds one quaternion from a
  caller 3x3 rotation-matrix block, and `0x00582fd0` builds one quaternion from three caller Euler
  angles by halving them, routing the packed tuple through trig helper `0x0058aa70`, and then
  combining the resulting sine and cosine lanes. The next packed-row sibling strip is now bounded
  too: `0x005830a0` applies one compact 3x3 basis block to one vec3 input, `0x00583160` is the
  translation-bearing vec4 sibling, `0x00583220` is the packed projective vec3 sibling that scales
  by a reciprocal derived from lane 3, `0x00583320` is the packed 4x4 vec4 application helper,
  `0x005833e0` is its four-row batch sibling over a full caller 4x4 source block,
  `0x00583530/0x00583600` are the packed vec3 and vec4 normalize-or-zero siblings of
  `0x00581c00/0x00581cd0`, `0x005836e0` is the packed 4x4 inversion sibling with optional
  determinant outparam, `0x005839a0` is the packed-output batch sibling of `0x005833e0`, and
  `0x00583b00` is the packed-row sibling of the earlier 4D cross-product helper. The same packed
  analogue strip now extends further: `0x00583cc0` is the packed 4x4 determinant sibling,
  `0x00583d90` is the packed three-point plane builder, `0x00583e80` is the packed plane-driven
  projective 4x4 matrix builder, `0x00584010` is the packed quaternion-to-matrix sibling,
  `0x005840f0` rebuilds one quaternion from a packed 3x3 rotation-matrix block, and
  `0x00584210` is the packed Euler-angle-to-quaternion sibling using packed trig helper
  `0x0058ad50`. The lower trig seam is bounded now too: `0x00583bb0` and `0x00583c30` are the two
  single-angle packed axial rotation-matrix variants above the same trig layer, `0x0058ac60` is
  the interleaved packed sine/cosine helper they share, and `0x0058ad50` is the wider packed
  sin/cos vector generator used by the packed Euler-angle-to-quaternion helper. The MMX or 3DNow
  analogue seam is bounded now too: `0x005842e0` is the quaternion-product sibling,
  `0x00584379/0x005843d6` are the vec4 and vec3 normalize-or-zero siblings,
  `0x00584489` rebuilds one quaternion from a 3x3 rotation-matrix block,
  `0x005848ba` is the MMX or 3DNow Euler-angle-to-quaternion sibling using scalar trig helper
  `0x0058b660`, `0x0058497f` is the explicit axis-angle-to-quaternion sibling,
  `0x005849eb` is the core quaternion slerp helper, `0x00584b22` and `0x00584baf` are the next
  two nested-slerp multi-control helpers, `0x00584c41` is the quaternion inverse sibling,
  `0x00584ca5` extracts an axis-angle-style vec4 from one quaternion, and `0x00584d4c` is the
  scaled-axis-to-quaternion sibling. The next broader MMX owner is bounded now too: `0x00584df1`
  takes four caller key quaternions, aligns neighboring keys onto a common hemisphere, converts the
  two relative deltas around each interior key through the already-grounded inverse and
  axis-angle-style helpers, averages those tangent-like terms, exponentiates back into quaternions,
  and multiplies by the interior keys to write two inner spline-control quaternions. The immediate
  plane-and-matrix seam after that is tighter now too: `0x00585b4b` is the row-major MMX
  translation-matrix constructor, `0x00585b9b` is the MMX sibling to the shared plane-driven
  projective 4x4 matrix builder, `0x00585c86` is the paired plane-reflection matrix helper, and
  `0x0058a988` is the shared normalize-by-XYZ-length helper beneath those plane-driven bodies, while
  `0x0058a8ca` is the MMX origin-plane-versus-segment intersection sibling and `0x0058a9ec` is the
  MMX 4D vec4-by-4x4 basis application sibling. The immediate matrix seam after that is bounded
  too: `0x00585d62/0x00585dc5/0x00585e23` are the three single-angle MMX axial 4x4 rotation-matrix
  variants, `0x00585e7c` is the MMX diagonal scale-matrix constructor rather than a translation
  helper, `0x00585ec3` is the small 4x4 transpose or repack helper, `0x00585f32` is the MMX
  identity-matrix constructor, and `0x00585f6b/0x0058603d` are the two MMX quaternion-to-4x4
  rotation-matrix variants. The adjacent broader matrix owner beneath that constructor strip is
  bounded too: `0x0058584a` is the non-alias-staging MMX 4x4 multiply sibling that repacks one
  split-qword matrix to temporary contiguous rows before multiplying it through the second caller
  matrix, `0x00585a7c` is the scalar determinant helper for the upper 3x3 basis of the same
  split-layout 4x4 matrix family, `0x005860f2` is the broader affine-transform owner that builds
  one matrix from optional base translation, base rotation, pivoted post-rotation, and trailing
  translation-delta inputs, `0x0058728a` is the adjacent three-angle rotation-matrix builder that
  uses half-angle trig rather than the single-angle strip, `0x0058742f` is the uniform-scale
  sibling that adds one optional pivoted quaternion rotation and one trailing translation delta,
  `0x00587963` is the axis-angle rotation-matrix sibling over a normalized axis vec3 plus one
  caller angle, and `0x00587a7c` is the broader shared transform owner that supports one base
  translation, up to two optional pivoted quaternion rotations, and one trailing translation delta.
  One lower MMX sibling strip is bounded now too: `0x005895fa` is the
  3D basis-plus-translation-to-vec4 sibling of `0x00581830`, `0x0058966b` is the basis-only vec3
  sibling of `0x00581770`, `0x005896d2` is the vec3 normalize-or-zero sibling of `0x00581c00`, and
  `0x00589731` is the two-scalar affine vec3 blend sibling of `0x00582710`. The next MMX
  interpolation strip is bounded too: `0x005897a2` is the cubic-basis vec3 sibling of
  `0x00582320`, `0x00589876` is the alternate-basis vec3 sibling of `0x00582520`, `0x00589960` is
  the projective 3D basis-plus-translation sibling of `0x005818f0`, `0x005899eb` is the four-row
  4D basis application sibling of `0x00581ab0`, and `0x0058a1aa` is the cubic-basis vec2 sibling
  of `0x005823e0`. The remaining low-dimensional MMX strip is bounded now too: `0x0058a0b8` is the
  2D basis-plus-translation-to-vec4 sibling of `0x00581690`, `0x0058a10d` is the basis-only vec2
  sibling of `0x00581730`, `0x0058a146` is the projective 2D sibling of `0x005816d0`,
  `0x0058a242` is the affine vec2 blend sibling of `0x005827c0`, `0x0058a28b` is the vec2
  normalize-or-zero sibling, `0x0058a2ce` is the alternate-basis vec2 sibling of `0x00582680`,
  `0x0058a379` is the duplicate-layout 4D vec4-by-4x4 basis application sibling, `0x0058a3fb` is
  the four-lane normalize-or-zero sibling, `0x0058a45a` is the MMX 4D cross-product sibling of
  `0x005821d0`, `0x0058a58c` is the affine vec4 blend sibling, `0x0058a5fd` and `0x0058a6c5` are
  the cubic and alternate-basis vec4 siblings of `0x00582470` and `0x005825e0`, `0x0058a7a3`
  builds one plane vec4 from a normal vec3 plus point, and `0x0058a7e6` is the three-point plane
  builder sibling of `0x005829b0`. The broader MMX matrix seam just above those leaves is bounded
  now too: `0x00588eb2` is the alias-safe packed 4x4 multiply owner over two caller matrices,
  `0x00588bd0` and `0x005892aa` are the two broader MMX 4x4 inverse helpers with optional
  determinant output, `0x005895de` is the thin FEMMS wrapper over `0x005892aa`, `0x00589bb2` is
  the tiny thunk into the projective vec3 apply helper `0x00589960`,
  `0x00589bb7` selects identity or the ordered composition of up to three optional 4x4 inputs
  through `0x005899eb`, applies the resulting chain through `0x00589960`, and optionally remaps
  the normalized result into one caller integer viewport-style range block, `0x00589d3f` is the
  inverse-side sibling that composes the same optional chain, inverts it through `0x005892aa`,
  optionally maps one caller integer viewport-style coordinate triple back into normalized
  projective space, and then applies the inverse chain through `0x00589960`, and `0x00589f67` is
  the adjacent inverse-projective sibling that uses alternate inverse helper `0x00588bd0` before
  the same viewport-normalize and projective-apply tail. The scalar trig roots beneath the
  quaternion side are bounded now too: `0x0058af80` is the shared scalar `atan2`-style angle
  worker, `0x0058b080` is the shared scalar arccos-style angle worker, `0x0058b180` is the
  adjacent alternate arccos-style branch, `0x0058b280` and `0x0058b380` are the scalar natural-log
  and base-10-log helpers, `0x0058b3a0` is the scalar natural-exponential helper, `0x0058b480`,
  `0x0058b4a0`, `0x0058b4c0`, and `0x0058b500` are the scalar square-root, absolute-value,
  ceil-style, and floor-style helpers, `0x0058b540` and `0x0058b580` are the adjacent
  `frexp`-style split and `ldexp`-style scale helpers, `0x0058b5de` and `0x0058b600` are the
  compact `modf`-style split and `fmod`-style remainder helpers, `0x0058b660` returns one
  cosine/sine-style lane pair from one caller angle,
  `0x0058b780` is the paired scalar sine-lane helper used when callers only need that one branch
  duplicated, and `0x0058b9e0` is the broader scalar `pow(x, y)` owner that stitches the adjacent
  log and exponential strips back together. After that point the strip stops looking like separate
  command leaves and turns back into broader owner bodies. The next adjacent command leaves are
  bounded the same way:
  `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340` is a guarded hop into
  the real cheat-code owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats`
  `0x00437d70`. That owner increments the shared shell counter at `[0x006d401c+0xc60]`, opens the
  localized cheat prompt `2922` `Do I detect a cheater in the house?\n\nEnter code (or <ESC> to
  cancel):`, and then scans the fixed 26-entry table at `0x005ee2c8`. The active selector strip is
  now grounded: winner/loss strings `3618/3619/3620/3622` route through
  `world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text` `0x004367c0`, selector `1`
  jumps to the out-of-line reset branch at `0x004d676c` that clears the selected-company stat bands
  rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`, selectors `2` and `3`
  post deltas into the selected company and selected chairman profile through `0x0042a080` and
  `0x00476050`, selector `4` resolves one locomotive by primary or alias stem through
  `0x00461c00` and applies it to every selected-company train through `0x004aefb0`, selector `5`
  forces territory-access byte `1` across the live territory table through `0x00424030`, selector
  `7` now reads more tightly as the train-crash branch because `0x004ad7a0(1)` is also the direct
  shell-command owner behind the `365` warning `There is no train available to crash!`, and
  selectors `6/8/9/10` toggle bytes `[state+0x4c8f/+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also
  contains the later cheat labels
  `3634` `Orca` and the alias-only tail `Katie..Seymour`, but those rows currently sit above the
  visible jump-table bound `0x0a`, so the safest static read is that they are unreached or handled
  elsewhere rather than active cases in this owner. By contrast
  `shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0` `0x00441360`
  requires the same single-profile gate, resolves one subject through `0x0040b2d0(0, 1)`, and then
  forwards that result into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`.
  The neighboring current-train command strip is bounded now too. Shared helper `0x00441790`
  resolves either the currently focused world-view train or one fallback train, but only keeps it
  when the owner company matches the current scenario-selected company. On top of that resolver,
  `0x00441810` is the direct `Current train crashes` command: it opens localized warning `365`
  when no owned train survives, otherwise it forwards the train into the crash owner
  `0x004ad7a0(1)`. `0x004418a0` is the paired `Current train breaks down` command with the same
  gate and warning `366`, but it forwards into the named breakdown owner `0x004ada00(1)`.
  `0x00441870` is the simpler `Current train whistles` command, which resolves the same owned train,
  finds the train-side visual owner through `0x004a77b0`, and writes request dword `1` into
  `[owner+0x33a]`. The immediately adjacent helper strip is bounded now too: `0x004a77d0` is a
  tiny two-float query over the same linked route object, defaulting both caller outputs to `10.0f`
  when `[train+0x41]` is empty and otherwise tail-calling the lower linked-route metric helper
  `0x0041add0`; and `0x004a7810` is the neighboring linked-route row-band refresh that walks
  `[route+0x316]` / `[route+0x31a]`, treats literal `steam` emitter definitions specially through
  `effect_name_matches_literal_steam` `0x004749a0`, and flips row byte `[row+0x1d8]` accordingly.
  The shell command strip on the other side is tighter too: `0x00441900`, `0x00441940`,
  `0x00441980`, `0x004419c0`, and `0x00441a00` are the five repeated `Overview.win` page toggles
  over detail-manager mode `9`, each closing the current page through
  `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when that exact page is already
  active and otherwise requesting mode `9` with page ordinals `0..4`. One nearby idle-shell gate
  is tighter now too: `0x004414d0` only forwards into the queued-record prompt owner `0x00438840`
  when the live world object exists and the active shell presentation stack depth
  `[0x006d401c+0xc64]` is not positive. The neighboring shell-command leaves are now explicit too:
  `shell_command_open_overview_for_previous_or_latest_fixed_preview_record` `0x00441490` walks the
  fixed preview-record sequence family at `0x005ce418`, preferring the predecessor of the current
  inactive minimum-sequence record and otherwise falling back to the max-sequence record before
  opening `Overview.win` through `0x004f3a10`; `shell_command_prompt_for_class0_region_name_and_focus_matching_world_region`
  `0x00441500` opens prompt `0x16a`, scans the live class-`0` region records in `0x0062bae0` by
  name `[region+0x356]`, and on a match centers the live world view through
  `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900`, while misses
  fall back to prompt `0x16b`; and
  `shell_command_prompt_for_text_and_submit_selector1_multiplayer_transport_request_when_auxiliary_preview_ready`
  `0x00441690` requires the auxiliary-preview owner gate `0x00434050` plus one live queued-preview
  record at `[world+0x66ae]`, opens prompt `0x0b6d`, and submits the entered text through
  `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `1`.
  `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50` feeds the
  station-list summary `%1 has %2 freight loads and %3 express loads available for hauling...`, and
  the paired modifier helper `shell_station_list_handle_center_or_rename_action` `0x00506d50` owns
  the visible Shift-center and Ctrl-rename row actions. The list owner itself is tighter now too:
  `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30` is the real
  `StationList.win` row and status refresh pass, clearing and repopulating controls `0x61a9` and
  `0x61aa`, wiring the visible summary and modifier callbacks, mirroring the shared selected-station
  latch at `[0x006cec78+0x4cba]` when it still belongs to the current company, and updating the two
  status labels `0x61af` and `0x61b0`. The row-side callout lane is tighter too:
  one adjacent active-window follow-on strip is explicit now too. The no-arg helper
  `shell_refresh_active_window_followons_without_subject_gate` `0x00436070` refreshes the live
  company-detail, stock-buy, and `Overview.win` branches for modes `7`, `0x0b`, and `9`.
  The helper
  `shell_refresh_active_window_followons_for_subject_and_optional_company_match` `0x004360d0`
  refreshes the live company-detail branch in mode `7`, the stock-buy branch in mode `0x0b`, the
  mode-`8` timed overlay only when the current subject id matches the caller dword, and the
  `Overview.win` side in mode `9`. Its wrapper
  `shell_refresh_active_window_followons_and_adjacent_station_or_train_lists` `0x00436170`
  forwards through that helper and then adds the station-list refresh through
  `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30` when mode `4` is
  active plus the `TrainList.win` refresh through
  `shell_train_list_window_refresh_controls` `0x005158f0(-1)` when mode `1` is active. The
  shared world-side follow-on beneath those shell branches is explicit now too:
  `world_refresh_collection_side_effects_after_broad_state_change` `0x004361d0` sweeps the live
  region, placed-structure, and three adjacent world collections, re-entering their per-record
  refresh owners after broader state changes. Current grounded callers include the larger
  world/status owner at `0x44b160` and the TrackLay teardown path at `0x50dba7`. The
  nearby train-detail lower-action special case
  `shell_handle_train_detail_lower_action_0x3f9_follow_current_route_object` `0x00435ac0` is now
  bounded too: it validates the current train, resolves its linked route object, recenters the
  world view on that route object, and then re-enters the shell detail manager with mode `2`.
  The row-side callout lane is tighter too:
  `shell_station_list_row_callback_publish_station_callout_card` `0x00506ac0` is the actual
  row callback beneath both list controls, resolving the selected station, deriving one category
  header through `0x0053de00` and `0x00552560`, and then publishing the station-name plus freight
  and express callout card through repeated `shell_publish_text_callout_presentation` calls. The
  side-selector branch is tighter too:
  `shell_station_list_window_handle_message` no longer just re-enters the raw `StationPick.win`
  constructor. It flips the active side bit at `0x006d1710` and then re-enters the modal helper
  `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`, which
  allocates one helper window, runs `shell_station_pick_window_construct` `0x00507620`, brackets the
  modal show path, and returns the staged selected station id from `0x00622ae8`. Inside that helper
  family, `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event`
  `0x005075c0` now bounds the small message-normalization strip beneath controls `0x80e8..0x80ea`.
  The Shift-center side is tighter now too:
  the shared helper `0x00433900` takes one object pointer plus one small mode, derives one
  mode-specific `(distance,height)` preset from the target's virtual classification, and then
  re-enters `0x0043c9a0` to center the live world view on that object. The report side is clearer
  as well:
  `0x004d3060` is the dedicated `Stats - Trees` constructor over `map_editor_tree_stats_report`,
  `0x004d3080` is the actual `General Validation` constructor over
  `map_editor_general_validation_report`, and the same page table also now grounds `Stats - Cargo`,
  `Stats - City/Region`, `Stats - City Count`, `Event Variable Values`, and the neighboring
  event-validation page. Those residual site-side scores and flag bits can now be carried
  conservatively as event-validation gameplay metric bands rather than as another editor ownership
  seam.
