rrt/docs/control-loop-atlas/input-save-load-and-simulation.md

4117 lines
361 KiB
Markdown
Raw Normal View History

## Input, Save/Load, and Simulation
### Runtime Roots and Cadence
- Roots: the shell controller window-message ingress `shell_controller_window_message_dispatch` at
`0x0054e3a0`, the shell input-state object initialized at `0x006d4018` through
`shell_input_state_init` `0x0054e710`, the saved-world restore path
`world_load_saved_runtime_state_bundle` at `0x00446d40`, the live-world save path
`world_runtime_serialize_smp_bundle` at `0x00446240`, `world_entry_transition_and_runtime_bringup`
at `0x00443a50`, the frame-owned cadence `simulation_frame_accumulate_and_step_world` at
`0x00439140`, the recurring `GameMessage.win` service branch through
`game_message_window_service_if_present` `0x004e0720`, the world-facing `GameUppermost.win`
overlay branch ensured by `shell_ensure_game_uppermost_window` `0x004e0e40` and serviced through
`game_uppermost_window_service_world_hotspot_band` `0x004e0780`, and the lower step family rooted
at `simulation_advance_to_target_calendar_point` `0x0040ab50` with periodic branches through
`simulation_service_periodic_boundary_work` `0x0040a590`.
- Trigger/Cadence: shell-side input is event-driven by controller-window `WM_*` traffic while save
or load work is triggered either directly from shell commands or through the `fileopt.win` branch
flags into the `.smp` runtime-state family; post-bring-up world service becomes recurring once a
world root exists at `0x0062c120`, but the current grounded top-level cadence still remains the
shell-owned `shell_service_pump_iteration` path, which calls
`simulation_frame_accumulate_and_step_world` directly and lets it accumulate elapsed wall-clock
time into one or more simulation-step quanta. A second ingress is now bounded too:
`simulation_run_chunked_fast_forward_burst` at `0x00437b20` repeatedly calls the same lower
stepper `simulation_advance_to_target_calendar_point`, but current grounded callers put that
helper inside the larger post-load generation pipeline `world_run_post_load_generation_pipeline`
at `0x004384d0` under the `Seeding Economy...` phase rather than under the ordinary player-facing
speed buttons. That setup pipeline is now clearer at the progress-banner level too: on the fuller
setup path it first runs one preliminary named-candidate availability prepass through `0x00437743`
before any visible progress banner is posted. One startup-side selector edge is tighter now too:
`shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` reaches an early
selector-`2` branch at `0x00438a66..0x00438c00` that refreshes one support-family type-`7`
record from setup path buffer `0x006d1370` through `0x0053d130`, strips the basename extension
into a local label buffer, briefly drops the nested mouse-cursor hold through `0x0053f310`,
builds three progress-text payloads, and re-enters the hold through `0x0053f2f0` before the
common world-root bring-up continues. After that, localized id `318`
`Computing Transportation and Pricing...` stays visible while the pipeline runs
`world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection-owned staging pass
`world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`,
`world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair
`world_region_collection_seed_default_regions` `0x00421b60` plus
`world_region_collection_refresh_neighbor_and_profile_bands` `0x00420f30`. One save-load-side
status-stack strip is now tighter too: `0x004422d0/0x00442330` push and pop the same four shell
dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]`
through the local stack `0x0062be90` with depth `0x0062bedc`, and the paired wrappers
`0x004423a0/0x004423d0` bracket that same band while also servicing the live TrackLay.win and
StationPlace.win tool objects through `0x0050e070`, `0x00507a50`, `0x0050a530`, and
`0x0050e1e0`. The live `.smp` serializer uses the higher pair, while `world_entry_transition_and_runtime_bringup`
`0x00443a50` and `world_load_saved_runtime_state_bundle` `0x00446d40` also use the raw
push/pop pair directly around their heavier bundle and status spans.
`world_region_border_overlay_rebuild` `0x004882e0`. The transport/pricing side is tighter now
too: `0x0044fb70` first routes one null-build path through the preview ensure wrapper
`0x0044faf0`, whose deeper worker `0x0044f840` allocates a default target through
`0x00534930`, seeds five palette entries through `0x0051de10`, maps each target pixel back into
the live secondary raster through `0x00533970/0x00533980`, uses the low-3-bit class split plus a
local `+/-4` neighborhood and `0x0051db80` to choose the preview color, and only then re-enters
`0x0044e940` on the full rectangle. The later `322` side is tighter now too: the top owner
`0x0044d410` rejects while generation counter `[world+0x2205]` is live or when `0x00449e90`
cannot supply a surviving work rect, then forwards that rect into `0x005374d0`, `0x00533e70`,
and `0x00537010`, notifies the shell owner at `0x0062be68`, and refreshes neighboring region or
manager companions through `0x00421f50`, `0x00461770`, and `0x00415340`. `0x00421f50` itself is
now bounded as the narrow class-0 side of that refresh: it scans the live region collection for
class-0 records whose normalized coordinates fall inside the caller-supplied float rectangle and
republishes each surviving region's current-position triplet through `0x00455a70(0)`. The local
companion-float strip under that same owner is tighter now too: `0x0044d4e0` and `0x0044d6e0`
are sibling five-pass cross-neighbor relaxers over `[world+0x1605]`; both clamp the caller
rectangle, average the four cardinal neighbors, subtract the current sample, scale the delta by
one fixed coefficient and caller gain, and then feed the surviving rectangle back into
`0x0044d410`. The first helper only checks raster bit `0x01` in `[world+0x2135]`, while the
second adds the tighter acceptance gate `0x004499c0` and can skip the final `0x0044d410` tail
when its caller disables that refresh. Their center-biased sibling `0x0044d880` is now bounded
too: it seeds one baseline from the current center sample when its caller gain is positive,
expands one square neighborhood by radius, and raises surrounding cells toward that baseline
through the same `0x0051dc00` falloff model before tailing into `0x0044d410`. The local
peak-oriented sibling `0x0044da70` then raises one clamped square neighborhood by quantized
local maxima and on its optional branch also consults `0x00534f00` before keeping the larger
peak. So the `0x0044d4e0/0x0044d6e0/0x0044d880/0x0044da70` band now reads as the local
companion-float refinement layer immediately beneath the shared `Calculating Heights...` owner
rather than a set of unrelated scalar writes. The default-region side is tighter too:
one earlier class-0-only helper `0x0041fb00` now sits directly under that same family too:
it skips nonzero `[region+0x23e]` records, rounds the region center through
`0x00455800/0x00455810/0x005a10d0`, stamps one orientation-dependent local secondary-overlay
pattern through `0x00534e10` plus `0x004497a0`, and then runs one bounded scored refinement pass
through `0x0051db80`, `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0`. The finalizer
`0x00421730` then clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the
full live world raster, seeds each live region's cached bounds fields, and repopulates that same
raster by writing the nearest class-0 region id `[region+0x23a]` into empty or weaker cell slots
from one bounded center-and-radius sweep. The region-profile side is tighter too: `0x0041f940`
counts only the current subcollection entries whose backing
candidates pass `0x0041f998`, and that smaller predicate now has one real content split instead
of staying anonymous. Candidates whose subtype byte is not `2` pass immediately, while subtype-2
candidates only pass when either availability word `[candidate+0xba]` or runtime recipe latch
`[candidate+0x7ac]` is nonzero; `0x00412af0/0x00412b70` now ground the lookup step beneath both
counters as a casefolded profile-label-to-candidate resolver over the global candidate pool
`0x0062b268`; and the stricter year-filtered counter `0x0041f9b0` then stacks the subtype and
`[candidate+0x26] <= max_year` gates on top of that same availability test. Two adjacent
collection helpers are grounded now too. `0x0041fa30` linearly scans the same region profile
collection `[region+0x37f]`, compares labels through `0x005a57cf`, and returns profile-weight
float `[entry+0x1e]` from the first casefolded match or the shared zero float when none match;
`0x0041fac0` resolves one 1-based ordinal out of that same collection and copies both the
matched profile label and weight `[entry+0x1e]` to caller-owned outputs. Those reads line up with
the editor copy-industry mutator `0x004206b0`, which already treats `[entry+0x1e]` as the live
editable profile-weight lane. That border
pass is now tighter too: the
outer owner refreshes the companion region set `0x006cfc9c` through the reset-and-assign wrapper
`0x00487650` above the heavier record initializer `0x00487540`, then re-enters `0x004881b0` to
refresh the raw per-region cell-count band from the live world raster, and the inner emitter
`0x00487de0` clears prior chunked segment queues through `0x00533cf0`, scans the live region
raster, and appends fresh border-segment records through `0x00536ea0`. The lower presentation
helper strip under the same owner is now explicit too: `0x00533970/0x00533980` query the cached
world-grid X/Y maxima, `0x00533990` stores the secondary-overlay shift field `[world+0x15e1]`,
`0x005339a0` builds one plane equation from three XYZ points, and `0x00533a30` uses the same
three-point patch to solve one sampled height at caller-supplied `(x,z)`,
`0x00533ae0/0x00533af0/0x00533b00` expose the secondary-raster and companion byte-raster roots,
and `0x00533b20/0x00533b30/0x00533b70/0x00533b90` expose the normalized coordinate, strip-offset,
and sample-triplet tables used by shell-side overlay staging. The adjacent queue side is tighter
now too: `0x00533bc0/0x00533bd0/0x00533be0` are the direct append, remove, and root getters for
shell queue `[this+0x166d]`; `0x00533bf0/0x00533c20` are the cell-addressed attach/detach
helpers over nearby-presentation table `[this+0x1671]`; `0x00533c50/0x00533c70/0x00533ca0` do
the same for the region-border overlay chunk table `[this+0x1679]`; and
`0x00533dd0/0x00533e00` are the matching geographic-label cell-table attach/detach wrappers over
`[this+0x1675]`. The geographic-label text side is tighter now too: beneath
`shell_emit_geographic_label_text_span` `0x0053a960`, the support strip `0x0053b090`,
`0x0053b390`, `0x0053b590`, and `0x0053b5c0` now reads as one banked fixed-record loader and
keyed lookup family with a small recent-query cache plus a string-hash helper. The static load
loop at `0x0053ce09` seeds those banks from the pointer table rooted at `0x00624e48`, while the
lookup core partitions rows by `key & 0x1f` into `32` per-bank buckets and keeps a `10`-entry
recent-query cache rooted at `[this+0x4290c]`. The adjacent stream and staging side is bounded
too: `0x0053b630/0x0053b690/0x0053b6f0/0x0053b7c0/0x0053b830` now read as the current-entry
ordinal resolver, current-stream close/open helpers, and the shared byte-read strip, while
`0x0053b850/0x0053b8d0/0x0053b920/0x0053b970` own the local `13`-byte staging-table growth,
type-`7` service passes, and bucket-chain reset. The next owner layer is tighter now too:
`0x0053b9e0` is the broader `Pack System Leak Count : %1` report-and-reset pass, releasing the
four owned report-slot roots at `[this+0x429b0..+0x429bc]` plus sibling global `0x00ccba50`,
formatting staging-row fields through `0x0051b700`, publishing them through callback slot
`0x005c8078`, then tearing the staging slab and all per-bank handles back down. The keyed query
side now extends cleanly beyond raw lookup: `0x0053bd40` seeks the selected-or-current payload
stream and returns the handle, `0x0053be10` resolves or lazily opens one keyed typed auxiliary
object including a descriptor rooted at `data\\Other\\AirplaneTypes.txt`, `0x0053c930` is the
composite-string lookup wrapper, and `0x0053c9c0` is the matching payload-length resolver. The
local row side is now first-class too: `0x0053bf60`, `0x0053c000`, and `0x0053c070` release,
drop references on, and acquire-or-create refcounted staging rows with typed payload roots at
`[row+0x09]`, while `0x0053c900` resets the adjacent stream-plus-recent-query-cache strip.
`0x0053ca20/0x0053ca90` now bound the current-selection push/pop frame stack at `[this+0x20428]`,
and `0x0053cb10` is the small two-`u32` plus optional heap-blob reader sitting directly on top
of the shared byte-read helper. The broader bootstrap owner is tighter too: `0x0053cb60` zeroes
the whole family, allocates the four owned report slots, walks the static root-pointer table
`0x00624e14..0x00624e48`, loads banks through `0x0053b090`, and then routes selected keys such
as `companyLogo`, `portrait`, and `trainSkin` back through the typed-object strip into those
report slots. The nearby wrappers `0x0053d0f0/0x0053d110` are just the string-keyed type-`1`
and type-`6` staging-row acquire helpers above `0x0053c070`. The adjacent `0x0053d130` is
tighter now too: it strips one caller path to the final basename, derives a second stem copy
through `0x0051d8a0`, gates on `support_query_path_is_openable_for_read` `0x0051e430`, and only
then refreshes one type-`7` staging row through `0x0053c710` before resetting owner dword
`[this+0x427b0] = -1`. Immediately after that, the local
utility strip `0x0053d1d0..0x0053d470` now resolves as one scored binary-heap plus scored-node
queue family: `0x0053d1d0/0x0053d240/0x0053d2e0/0x0053d300` are the heap reorder and top-score
helpers, while `0x0053d320/0x0053d390/0x0053d440/0x0053d470` are the queue acquire, pop-highest,
membership, and release-side helpers. The sibling heap-owner body now lands too:
`0x0053d4c0/0x0053d540/0x0053d5d0/0x0053d630` are the pooled scored-heap insert, pop-top,
release, and construct-with-capacity paths over the same score-at-`+0x04` node shape. The
adjacent extended owner is now bounded too: `0x0053d6f0/0x0053d740` are the release and
construct-with-capacity paths for the sibling scored-heap owner that carries one extra sentinel
header at `[this+0x10]` plus best-score lane `[this+0x14]`, and current callers are the hotkey
report iterator `0x0045f250` and the nearby shell/runtime owner around `0x00522c67`. The next
support strip is tighter too: `0x0053d810/0x0053d870` are the CRC32-like NUL-string and fixed
byte-span hash helpers over table `0x00624e48`, while `0x0053d8a0/0x0053d960/0x0053d9e0/
0x0053daa0/0x0053dae0/0x0053db20/0x0053dbf0` now resolve as one intrusive `u32 -> ptr`
hash-table family with optional pooled `0x10`-byte nodes: release, insert, remove-and-return,
contains, lookup, callback iteration, and construct-with-bucket-count-and-node-capacity.
That family is already grounded on real world owners too, not just support-side data-structure
shape: connected-component and local bucket maps under `0x00416170/0x00419110`, selected owner
hashes under `0x00531ef0`, and the shell-side cleanup owner around `0x00522e7e` all use the same
pooled hash helpers. Beneath both the scored heaps and that hash family, `0x0053dcb0/
0x0053dcf0` are now bounded as the shared fixed-stride pool-descriptor release and reset helpers,
with freelist seeding over caller stride and count rather than one owner-family-specific allocator.
The next typed payload branch in the same banked-record family is tighter now too: row type `6`
is no longer just “some constructor under `0x0053c070`”. `0x0053ee70/0x0053e370` now read as the
construct wrapper and full constructor for one shell image-marker payload that parses a grounded
keyword set from the banked record text (`Image`, `ImageWH`, `ImageWHForceScale`,
`ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`,
`MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`,
`TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`,
`HorizontalScaleModifier`, `VerticalScaleModifier`), registers one shell helper token through
`[0x006d401c+0xc69]`, and then hands off to `0x0053de60`. That heavier sibling is now bounded as
the payload's screen-metrics and VRAM-policy variant-table refresh owner: it derives current
screen-space scale from shell display state, resolves one selected TGA or DDS resource through
`0x0053c1c0`, and rebuilds the live variant array `[this+0x24]` through `0x005520a0` for later
consumers such as `shell_queue_world_anchor_marker` `0x00552560`. The rebuild and release side
is explicit too: `0x0053e2b0` releases current variants and the loaded image handle before
tail-jumping back into `0x0053de60`, while `0x0053e2e0/0x0053ee60` are the real destructor and
release thunk for the same type-`6` payload family.
The nearby overlay builders are tighter now too. `0x00478200` is no longer just a generic
single-marker wrapper: it validates owner id `[this+0x11b]` against collection `0x0062bae0`,
resolves that live city-database-style owner, samples normalized XY through `0x00455800` and
`0x00455810`, derives one localized label through `0x0053de00([this+0xaf],2)`, measures
projected half-height through `0x00477a10`, and then queues the finished marker through
`0x005521a0/0x00552160/0x00552560`. The broader sibling `0x00478330` now reads as the real
active-mode overlay-list owner: it derives the current world-space view box from
`[this+0xc3/+0xc7/+0xcb/+0xcf]` plus live world dims, runs six category passes `0..5`, pulls one
active-mode collection through `0x005130f0 -> 0x004b2b70` or `0x0050f600`, walks live placed
structures in `0x006cec20` through `0x0047fd50`, `0x0047df30`, and `0x0047df50`, and emits one
repeated label-marked overlay stream through `0x00477a10`, `0x004779c0`, and
`0x00552560`. After those category passes it also walks `0x006cfcbc` and can add one final
focused-region marker from `[this+0x113]` through `0x0048a170` with label id `0x3c`. The local
overlay-state helper strip under those builders is tighter now too. `0x00477af0` is the actual
default reset for the state band `[this+0xa3..+0x11f]`, seeding minimum span floor
`[this+0x11f]`, default cell bounds `[this+0xbb/+0xbf/+0xcb/+0xcf]`, scale lanes
`[this+0xd3/+0xd7/+0xdb]`, and normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]`. `0x00477a70`
is the paired scaled-max-span helper over the rebuilt cell bounds, while `0x00478dc0` and
`0x00479510` are now bounded as the two heavier owner passes above that strip: the first rebuilds
world-cell bounds and normalized rect from mode flags, raster bit `0x02`, and optional
placed-structure scans, while the second clamps and recenters those bounds and then refreshes the
normalized rect again after drag- or zoom-side updates. One input-side owner is bounded now too:
`0x00477c10` maps one screen-space point into a world-cell pair under the current overlay-state
bounds, and the larger sibling `0x00478cb0` is the drag-side loop above it that repeatedly
applies those deltas through `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`
before re-entering the same overlay-state rebuild or clamp family. The next query above that is
tighter now too: `0x00479b50` is the nearest-target resolver for this overlay family, first
searching placed structures in `0x006cec20` through `0x0047df30/0x0047df50` and `0x0051db80`,
then optionally falling back to regions in `0x006cfca8` through `0x0048a170` when the shell-side
metric flag bit `0x4` is set. The click-side owner above that is bounded now too: `0x00479d30`
first maps the cursor through `0x00477c10`, resolves the nearest target through `0x00479b50`,
then either publishes restriction notices `0x0c12/0x0c13`, forwards one compact selector-`0x384`
request into the Multiplayer preview owner at `0x006cd8d8`, or dispatches that same local target
through the active-mode handler pair `0x004b3160/0x004b2c10` before easing the shell scalar tail
through `0x0045ea20`. The broader raster owner above this branch is bounded now too:
`0x0047a120` first stages one visible overlay rect through `0x00534930/0x00534c50`, optionally
allocates the target RGBA buffer, and then rasterizes the visible map window through the world
classification helpers `0x00534e50`, `0x00534f00`, `0x00449bd0`, and `0x00448aa0`, mapping the
result through palette table `0x005f2c34` and finally marking city-database owners from
`0x0062bae0`. The small constructor strip under that raster owner is tighter now too:
`0x0047b070` and `0x0047b0d0` are the two concrete constructors for vtable `0x005ce840`, both
reusing `0x00477af0` for default state and then seeding the trailing template byte
`[this+0xa2]`. The release and service strip under the same vtable is tighter now too:
`0x0047b110` drops template handle `[this+0xaf]` and surface root `[this+0xab]` before tailing
into the base release; `0x0047b170` is the main service body that refreshes bounds through
`0x00479510`, draws the current overlay surface, and then queues either the repeated marker list
`0x00478330`, the single city-database marker `0x00478200`, or the fallback quad path
`0x00477d80`; and `0x0047b3d0` is the narrow wrapper that reruns `0x0047a120` into a temporary
raster target and commits the result back into live surface handle `[this+0xab]`. The next local
owner strip is tighter now too: `0x0047b470` ensures surface handle `[this+0xab]` by deriving
zoom-scaled requested dimensions from the current shell zoom table at `[0x006d4024+0x11421e]`,
growing them as powers of two under controller caps, allocating one `0xec`-byte surface owner
through `0x00543980`, and immediately rerasterizing through `0x0047b3d0`; `0x0047b5e0` is the
hover-update sibling that either tracks hovered classification id `[this+0x117]` under overlay
flag `0x00400000` or refreshes nearest target ids `[this+0x10f/+0x113]` through `0x00479b50`
before forwarding the live cursor band into `0x00558760`; and `0x0047b720` is now bounded as the
main message dispatcher for the same family, with current grounded cases for id `6`, refresh pair
`0xba/0xbb`, and scalar-update id `0xbc`, dispatching into the click owner `0x00479d30`, the
drag owner `0x00478cb0`, the ensure-surface path `0x0047b470`, the reraster path `0x0047b3d0`,
and the bounds rebuild owner `0x00478dc0`. The adjacent global marker strip is tighter now too:
`0x0047ba60` clears the ten-entry global pointer-marker slot table at `0x006ceba4`,
`0x0047bb90` is the matching release loop, and `0x0047ba80` rebuilds one indexed slot by
constructing a `0x26e`-byte specialization-root object through `0x0045b680`, seeding it from
literal roots `pointer`, `pointer2`, or `pointer3` through `0x0045b9b0`, publishing the caller
world anchor through `0x004556f0`, applying scalar `0.8f` through `0x00455720`, and clearing bit
`0x20` in the derived state byte. Current grounded callers are the clustered world-side branches
at `0x0051677b`, `0x00516797`, `0x005167df`, and `0x005167fe`, so this now reads as a real
shell-side global pointer-marker slot family rather than loose specialization constructors.
That keeps the label side grounded as a real support-family database strip rather than a loose
collection of anonymous bootstrap helpers. If shell-state gate
`[0x006cec74+0x174]` is set it then posts id `320` `Setting Up Buildings...` for
`world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`
it then posts id `321` `Seeding Economy...` for `simulation_run_chunked_fast_forward_burst`
`0x00437b20`; only after those setup-side gates does the code post id `319`
`Setting up Players and Companies...`. That `319` lane is no longer just a shell-state placeholder: its
earlier hidden prepass is tighter now too: `0x00437743` is the scenario-side named
candidate-availability seeding pass over the live candidate pool `0x0062b268`, feeding the
override collection at `[state+0x66b2]` through `0x00434f20` before any visible banner is posted.
That grounded write path is narrower than the static file evidence, though: the startup reset
helper `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0` explicitly clears
`[state+0x66b2]` before the dispatch path begins, and the current exported write-side callers
we can name after that reset are still just the live-pool preseed `0x00437743`, the sibling
startup lane `0x00436ad7`, and the editor-side `Industry (Overall)` toggle handler
`0x004cf430` through `0x00434f20`. So while the fixed `0x6a70..0x73c0` candidate-availability
block is now well grounded as bundled map/save source data, a direct bulk-import path from that
block into the live runtime collection `[state+0x66b2]` is still not grounded by the current
disassembly notes.
That candidate-side table now has a grounded fixed record layout too: each entry is a `0x22`-byte
blob with a zero-terminated candidate-name slot at `[entry+0x00..+0x1d]` and one trailing
availability dword at `[entry+0x1e]`, read through `0x00434ea0` and mirrored later into
`[candidate+0x7ac]`. The same scenario state keeps a locomotive-side sibling collection at
`[state+0x66b6]`, read through `0x00435030` and updated through `0x004350b0`, which is now the
shared named locomotive-availability lane beneath the `Locomotives` editor page and the
startup-side locomotive seeding branches. That locomotive-side table is the same pattern at a
larger width: each entry is a `0x41`-byte blob with a zero-terminated locomotive-name slot at
`[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`, later mirrored into
`[loco+0x7b]`. Both override dwords now read most safely as simple availability bits rather than
wider mode enums. That `319` lane is no longer just a shell-state placeholder: its
primary grounded work is still the chairman-profile pair
`world_seed_default_chairman_profile_slots` `0x004377a0` plus
`world_build_chairman_profile_slot_records` `0x00437220`, which seed the 16 selector bytes at
`[0x006cec7c+0x87]`, materialize the per-slot chairman records from the scenario selectors,
campaign override flag `[0x006cec7c+0xc5]`, and the static persona table at `0x005f2d28`, and then
publish the selected chairman-profile and linked company summary pair through `[state+0x25]` and
`[state+0x21]`. The local slot-record shape is tighter too because the shell editor panel around
`0x004cc2d0` now surfaces it directly: `[slot+0x00]` is the staged chairman profile id,
`[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`,
`[slot+0x02]` combines with the separate per-slot gate at `[world+0x0bc3+slot*9]` to surface
`Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and
`[slot+0x04]` is the numeric tuning field. Both the selector seeder and the record materializer
treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded
writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction.
That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat
flag rather than a generic role byte. The summary fields are tighter too: current direct accessors
now show `[state+0x25]` as the selected chairman profile id in `0x006ceb9c`, while `[state+0x21]`
is the linked owning company id copied from `[profile+0x1dd]` through
`scenario_state_set_selected_chairman_profile` `0x00434890`. The raw id strip under those record
helpers is tighter now too: `0x004337a0` reads `[state+0x21]` directly as the selected company
id, `0x004337b0` reads `[state+0x25]` directly as the selected chairman profile id, and
`0x00433790` is the paired raw selected-company setter that the company and chairman reassignment
flows use when the visible ownership summary changes without re-entering the full profile setter.
The underlying profile constructor family is grounded now too. `0x00476140` is the broad
named-profile constructor beneath both chairman seeding passes: it stores the caller id at
`[profile+0x00]`, marks the record live through `[profile+0x04] = 1`, seeds byte and guard lanes
across `[profile+0x291..+0x295]` and `[profile+0x1e1]`, zeroes the large per-company and tail
bands `[profile+0x2ab..]` and `[profile+0xc66..]`, copies the caller byte into `[profile+0x15c]`,
seeds `[profile+0x158]` to `7.763f`, formats localized fallback name `0x0b87` when the caller
name is empty, copies the caller biography into `[profile+0x27]`, and picks one static persona
row through `0x004760f0`. That helper is now bounded as the wrapped-unused-row allocator over the
static persona table at `0x005f2d28`, marking one zero flag byte at stride `0x27` after a
modulo-`0x29` search. The neighboring raw company-slot strip is explicit too: `0x004760a0`
resolves indexed dword slot `[profile + company_index*4 + 0x2ab]` when the caller's generation
stamp differs from `[profile+0xc43]`, and `0x004760c6` is the paired store-side helper for the
same slot plus optional stamp write. The adjacent profile-metric strip used by the player-list
page is tighter now too: `0x00476320` sums the per-company holding band `[profile+0x15d..]`
against either cached company scalar `0x00423eb0` or the broader support-adjusted company scalar
`0x00424fd0`, while `0x004763b0` folds those same per-company contributions through one extra
thresholded transform before accumulating them. The active-profile collection helpers are direct
now too: `0x004778c0` returns the live record id of the Nth active chairman profile, and
`0x00477920` counts how many active chairman profiles precede one caller-selected live record id.
The neighboring transaction and cached-metric strip is tighter now too. `0x00476780` is the
direct-total-plus-cash query (`0x00476320 + [profile+0x154]`), while `0x00476c20` is the
threshold-adjusted-total-plus-cash sibling (`0x004763b0 + [profile+0x154]`). `0x004767a0`
selects between raw cash `[profile+0x154]`, the direct holding total, or their sum, and
`0x00476810` caches selectors `0` and `1` into the local qword band rooted at `[profile+0x1e9]`.
The trade-side helpers now split cleanly too: `0x00476460` is the sell-side mutator that reduces
one company holding slot `[profile + company_id*4 + 0x15d]`, converts the resulting proceeds
through `0x00424fd0(-units,1)`, and adds the scaled result back into `[profile+0x154]`; the buy
companion is `0x00477110`, which first reuses the feasibility gate `0x00476ff0`, then increases
that same holding slot and subtracts the scaled purchase cost from `[profile+0x154]`. Between
them, `0x00476e50` computes the rounded `1000`-sized trade block by mode, and `0x00476ff0`
performs the actual buy-affordability check against current cash plus an optional direct-holdings
fallback; the reduction-side sibling `0x00476c40` uses the same threshold-adjusted-total-plus-cash
lane from `0x00476c20` as its optional fallback when the direct holding slot is too small. One
broader periodic scalar is grounded now too: `0x00476560` walks raw issue `0x39`
through `scenario_state_sum_issue_opinion_terms_raw` plus the scenario baseline at `0x00433740`,
clamps the resulting factor against several `[profile+0x154]` thresholds, and then adds the
final scaled delta back into `[profile+0x154]`; current grounded caller `0x0040a760` applies
that adjustment across every active chairman profile before the later trigger-kind-`2` pass.
The adjacent start-new-company gate is explicit now too: `0x00476d10` first rejects through
localized id `2952` `You're not able to start a new company.` when scenario gate `0x00476a60`
is active; otherwise it treats `0x004763b0(1) + [profile+0x154]` as the relevant purchasing-power
lane, succeeds only when that total reaches threshold `0x005c8830`, and on failure formats the
richer localized warning `271` `You don't have enough money to start a new company!...` using the
selected chairman profile's current purchasing-power figure from `0x004348c0`.
The adjacent persona-row lookup strip is partly explicit now too: `0x00476bb0` returns the
matched static persona row index for current profile stem `[profile+0xc47]`, while `0x00476b30`
returns the same matched row's `+0x20` asset-stem pointer or falls back to `[profile+0x20]`,
and `0x00476ab0` is the structural `+0x40` string-pointer sibling for that same row family.
The adjacent chairman refresh owner is tighter now too: `0x00433850` uses the guard pair
`0x0062be20/0x0062be1c` to walk the active-chairman collection through
`0x00477820/0x00477860 -> 0x004771e0` until no nested mutation asks for another pass.
The editor-side scenario setup surface beside that chairman panel is clearer now too.
`map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` republishes the scenario
description from `[0x006cec78+0x672e]`, the start-year trio `[+0x66ca]`, `[+0x66d2]`, and
`[+0x66ce]`, the direct campaign-designated bit `[+0x66de]` through control `0x5b6e`, and the
inverse of the paired metadata byte `[+0x66f3]` through control `0x5b74`. The resource-side
anchor is now explicit too: `editorDetail.win` carries localized ids `3160/3161` `Campaign
Scenario` and `If checked, this map will be reserved as a campaign scenario.` inside the control
record rooted at `0x5b6e`, so `[+0x66de]` is now the grounded campaign-scenario flag rather than
an anonymous metadata boolean. `map_editor_scenario_metadata_panel_refresh_briefing_mode`
`0x004ca670` now bounds the single-player versus multiplayer briefing switch by flipping selector
`0x621f50`, publishing localized headings `1491` and `3586`, and refreshing the two briefing texts
from `[state+0x4f30]` and `[+0x5ae9]`. The companion dispatcher
`map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0` makes the year semantics tighter
too: it commits the description and both briefing texts from edit-control payloads, toggles the
same two booleans, and clamps the three year fields to `1829..2100` while maintaining `minimum <=
default <= maximum`, which now lines up directly with the editor strings `Description:` `Minimum
Start Year:` `Default Start Year:` `Maximum Start Year:` `Briefing` and `Multi-Player Briefing`.
The neighboring special-conditions page is clearer as well:
`map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0` now grounds the live owner
for the `Setup_Options_Buttons.imb` list rooted at `0xa7fa`, walks the 49-entry static rule table
at `0x005f3ab0`, counts enabled flags from `[0x006cec78+0x4a7f]`, and publishes the `Special
Conditions In Effect` summary from localized id `1053`. The same page now has a bounded live
dispatcher too: `map_editor_scenario_special_conditions_panel_handle_message` `0x004cb8e0` handles
both bulk selection controls and direct row-state changes, commits them back into
`[0x006cec78+0x4a7f]`, and then re-enters the panel constructor to refresh the summary. That table
is no longer just a raw id run; it now clearly includes the finance and construction restrictions
`2535..2563`, plus later editor toggles such as `Use Bio-Accelerator Cars`, `Disable Cargo
Economy`, `Disable Train Crashes`, `Disable Train Crashes AND Breakdowns`, and `AI Ignore
Territories At Startup`. The neighboring available-chairman page is tighter too.
`map_editor_available_chairman_panel_construct` `0x004ca540` now bounds the shell-side owner for
the 40-entry persona-availability surface under `0x5aa0..0x5b03`: it walks the same persona table
family at `0x005f2d28`, publishes one localized chairman-name row per profile, counts enabled
availability bytes from `[0x006cec78+0x6987..]`, and emits the summary `%1 out of %2 are
selected.` from localized id `1035`. The live state owner beside it is now grounded as well:
`map_editor_available_chairman_panel_handle_message` `0x004cb6f0` handles three bulk-selection
controls `0x5aa1..0x5aa3` by rewriting that same availability-byte array from preset bytes
embedded in the persona table, and it also commits direct per-row toggle changes from
`0x5aaa..0x5b03` back into `[state+0x6987..]` before refreshing the page. So the editor lane now
has three distinct scenario-setup slices rather than one chairman-only blob: chairman slots,
scenario metadata and briefings, plus both a rule-toggle matrix and an available-chairman pool.
There is now one adjacent company-side lane too: current neighboring setup flow conditionally
enters `world_conditionally_seed_named_starting_railroad_companies` `0x0047d440` when the
Multiplayer preview owner `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is
set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is
clear. That helper no longer looks like a generic company refresh. It seeds exactly three fixed
named railroad-company records from `RT3.lng` ids `575..577`: `Missouri Pacific`, `New York
Central`, and `Grand Trunk Railroad`. The first seeded company is tied back to the selected
chairman-profile summary and becomes the selected company id. The second railroad is tighter now
too: it only receives a chairman link when `profile_collection_count_active_chairman_records`
finds at least two live chairman records, and the helper then binds the zero-based second active
chairman through `profile_collection_get_nth_active_chairman_record` with ordinal `1`. The third
railroad currently gets no matching chairman-link branch in the grounded setup flow and therefore
remains an unchaired named company in the live roster. The shell UI above that setup lane is now
tighter as well: `shell_company_list_window_construct` `0x004c7200` builds a live company-list
window over the company collection at `0x0062be10`, `shell_company_list_window_refresh_rows`
`0x004c6c30` formats the active companies with localized strings `267..270`, and only then
conditionally appends one synthetic row id `0x7fff` through
`shell_company_list_format_company_or_start_row` `0x004c6b40` so `<<Start New Company>>` appears
as a separate affordance rather than as part of the seeded trio itself. Current shell paging
around that same roster is tighter too because the live company collection now has a grounded
active-only ordinal helper family: `company_collection_count_active_companies` `0x00429a50`,
`company_collection_count_active_companies_before_company_id` `0x004299f0`, and
`company_collection_get_nth_active_company_id` `0x00429990`. Those helpers now anchor the “current
company among active companies” math used by shell-side detail and picker flows rather than
leaving it as anonymous collection glue. `shell_company_list_window_handle_message` `0x004c6f30`
then routes the synthetic row into `start_new_company_dialog_open` `0x0047d080`, whose commit path
now grounds through `start_new_company_dialog_commit_create_company` `0x0047d120`. That lower
helper unlinks any current chairman-owned company, allocates a fresh company id from the live
collection at `0x0062be10`, initializes it through `0x00428420`, and only then publishes the new
selected company. The neighboring compact request helper
`start_new_company_request_create_company` `0x0047d320` does the same fresh-company path from a
request block and is already reached from the startup-company branch at `0x00470e48`. The dialog
side is tighter now too: `0x0047c070` and `0x0047bea0` rebuild the two funding-band globals from
the selected chairman profile through `0x00476c20` and `0x00476950`, publish their range cards
into controls `0x714f` and `0x7150`, `0x0047c190` republishes the current pair `0x006cec14` and
`0x006cec10` into controls `0x7149` and `0x714a`, `0x0047c220` snaps those two current funding
lanes back onto the active band steps, and `0x0047c360` is the small child-control callback gate
over that same funding family. The immediate pre-open helper `0x0047d020` is now bounded too: it
seeds the staged dialog name buffer and then runs the same clustered funding-band rebuild sequence
before `start_new_company_dialog_open` continues into the constructor/callback modal path. The
constructor and message side are bounded enough now too: `0x0047c590` constructs the modal dialog
controls for `0x714f/0x7150/0x7149/0x714a/0x714b/0x714c/0x714d/0x714e`, installs callback
`0x0047c360` on the funding-band pair, and publishes the live dialog root at `0x006cec18`,
while `0x0047c3a0` is the main dialog message owner over shell messages `0xca/0xcb`, the staged
name field `0x714b`, the two funding-step controls `0x714c/0x714d`, the companion summary lane
`0x714e`, and the modal notice branch rooted at `0x03f2/0x03f4`. The
immediate sibling shell branch below that roster is still station-oriented: current grounded
resource names and handlers put one branch on `shell_station_detail_window_construct`
`0x005068c0`, another on `shell_station_list_window_construct` `0x005074c0`, and the subordinate
selector lane on `shell_station_pick_window_open_modal_and_return_selected_station_id`
`0x005078c0` above `shell_station_pick_window_construct` `0x00507620`. But the broader
company-detail ownership question is no longer open. There is now a separately grounded
`CompanyDetail.win` family rooted at `shell_company_detail_window_construct` `0x004c5540`, with
`shell_company_detail_window_handle_message` `0x004c56a0` as its main dispatcher and
`shell_company_detail_window_refresh_controls` `0x004c2ca0` as the shared repopulation pass for
the selected-company presentation and tabbed control bands around `0x9476..0x9490`. A grounded
direct shell-command strip now sits cleanly above those two company panels too: `0x00433a40` is
the shared availability gate for both the company-list and selected-company-detail lanes,
rejecting only when scenario toggle `[0x006cec78+0x4aef]` is set. `0x004405a0` uses that gate to
open detail-panel mode `7` as the direct company-list path, while `0x004405d0` first recovers
the selected-company id through `0x004337a0`, optionally offers `Start New Company` through
`0x0047d080` after warning `368` when no company is selected, and only then opens detail-panel
mode `8` for the selected-company `CompanyDetail.win` lane. A grounded
shell detail-manager caller reaches that constructor at `0x004dde24`, the first finance-action
layer beneath it is now bounded through `shell_company_detail_issue_bond_offer_flow` `0x004c3890`,
`shell_company_detail_issue_stock_offer_flow` `0x004c3f30`,
`shell_company_detail_buyback_stock_flow` `0x004c46d0`, and
`shell_company_detail_change_dividend_rate_flow` `0x004c5360`, and the first non-finance layer is
now bounded too through `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`,
`shell_company_detail_bankruptcy_flow` `0x004c5b99`, the territory-access family rooted at
`shell_company_detail_refresh_selected_territory_access_summary` `0x004c1b60` plus
`shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, backed by
`company_clear_selected_chairman_if_current_profile` `0x00428a10`,
`company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90`,
`company_has_territory_access_rights` `0x00424010`, `company_set_territory_access_rights_byte`
`0x00424030`, and `company_can_purchase_territory_access_rights` `0x00426be0`, plus the two
control-transfer lanes. `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0` now
grounds the special chairman's election path: it checks the caller's current stock ownership in
the target company, rejects insufficient holdings through localized id `623`, rejects recent
failed attempts through id `624`, and then opens the confirmation under id `625` before seeding
the local takeover-election state or packaging the same request through the multiplayer shell
transport. The follow-on resolver `shell_resolve_chairmanship_takeover_vote_and_commit_outcome`
`0x0050c940` now closes the single-player election loop too: it walks the active chairman profile
collection, computes weighted votes for and against the takeover, compares the affirmative total
against half the target-company value, presents the result through
`shell_present_chairmanship_takeover_vote_outcome_dialog` `0x0050c500` in single-player or
localized id `3082` in multiplayer, and then either transfers chairmanship through `0x00428a30` or
stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.
`shell_company_detail_attempt_merger_flow` `0x004ec640` now grounds the merger side too: it
rejects empty worlds through id `727`, rejects recent failed attempts through id `728`, checks the
proposed premium against company cash through localized id `3889`, and then commits into the
resolver family. That merger resolver is now bounded too:
`shell_resolve_merger_vote_and_commit_outcome` `0x004ebd10` walks the active chairman profile
collection, computes weighted votes for and against the proposed merger, compares the affirmative
total against half the target-company value, presents the result through
`shell_present_merger_vote_outcome_dialog` `0x004eb890` in single-player or localized id `3059` in
multiplayer, and then either commits the merger through `0x00427e20` or stamps the current year
into `[company+0x15f]` as the grounded merger-cooldown field. The vote-bias side beneath that
resolver is tighter now too: `scenario_state_compute_issue_opinion_multiplier` `0x00436590` is no
longer just an abstract issue table lookup because its merger callsite uses issue id `0x3a`, which
lines up directly with localized id `726` saying merger votes depend on public attitude toward the
management of the two companies. By contrast the broader support-adjusted share-price helper
`company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` uses issue id `0x37`,
and the shared setter under that lane is tighter now too: `0x004339b0` clamps one small
scenario-side issue value into `[state+0x2d]` with range `0..4`, derives one companion scalar in
`[state+0x29]`, and then forces a live-company sweep through `0x00424fd0` so the support-adjusted
share-price family is recomputed immediately after the issue lane changes. The finance-side debt
helpers now bound `0x38` and `0x39` separately as the explicit
credit-rating and prime-rate lanes. That leaves `0x37` as the broader investor-confidence lane
behind equity support, share price, and adjacent governance pressure, with the strongest current
text anchors coming from the investor-attitude strings `1217` and `3048/3049` about company or
chairman performance rather than from the merger-only management-attitude term. One older local lead is now ruled out too: the
`0x460900..0x460cac` / `0x473620` setup block is the camera-view command family over localized ids
`3474..3493` (`Select/Assign Camera View 1..9` and `0`), not issue-opinion infrastructure, so it
should no longer be used as evidence for the player-facing meaning of issue `0x37`. The editor-side
`Stock Prices` label is also no longer being used as direct evidence here: the `0x4ca980` /
`0x4cadf0` panel owns a separate float-tuning block `[state+0x0bde..0x0bf6]`, with
`[state+0x0bde]` merely mirroring `[state+0x0be2]`, so that label belongs to a different
settings family than the issue table behind `0x37`. A direct shell-resource follow-up now narrows
the remaining caption question too: the extracted `CompanyDetail.win` blob from `rt3_2WIN.PK4`
contains no plain-English investor or finance caption for this lane, which matches the owner-side
read that section-0 is a dynamic `0x947f` text widget fed by
`shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a separate
fixed label row. The supporting stat layer is bounded more cleanly now too: the
surrounding `0x0b` setup in the merger and takeover offer builders is formatter mode rather than a
player-facing issue number, while the company-side stat wrapper
`company_read_year_or_control_transfer_metric_value` `0x0042a5d0` now reads as a generic
stat-family accessor over year-relative series or the bounded slot family in
`company_read_control_transfer_metric_slot` `0x0042a2e0`. Its recurring family token `0x2329` is
no longer treated as an issue id here either; it is the stat-family selector paired with localized
company-stat label id `2329`. That means the paired raw and scaled helpers at `0x004241e0` and
`0x00424200` now read as narrow control-transfer offer policy totals instead of direct
issue-argument consumers, and the same broader support-and-governance metric family now also feeds
the annual shareholder-revolt and creditor-liquidation lane surfaced by localized ids `300..304`.
The editor-side help text cluster around ids `2433..2437` is no longer floating either: current
grounded map-editor code now has a live economic tuning family beside the chairman-slot panel.
`map_editor_economic_cost_slider_panel_construct` `0x004cadf0` binds six slider controls through
`map_editor_economic_cost_slider_dispatch` `0x004ca980` into the scenario-state float block
`[0x006cec78+0x0be2..0x0bf6]`, while the surrounding descriptor table at `0x00611c70..0x00612220`
pairs that wider editor lane with localized fields `Prime Rate`, `Merger Premium`, and `Build
Stations Cost` through `Steam Engine Cost` plus the comparison or help texts `2433..2437`. The
broader shell-state master flag at `[0x006cec74+0x68]` still sits above the remaining post-load
phases, plus two narrower per-phase gates: `[0x006cec74+0x174]` directly fronts id `320` `Setting
Up Buildings...` and the later region-owned structure-demand and placement pass through
`world_region_collection_run_building_population_pass` `0x00421c20` plus the deeper per-region
worker `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, while
`[0x006cec74+0x178]` directly fronts id `321` `Seeding Economy...` and the chunked burst helper
`simulation_run_chunked_fast_forward_burst`, whose grounded tail now also sweeps the live region
collection through `world_region_refresh_cached_category_totals_and_weight_slots` `0x00423d30`;
id `322` then fronts `Calculating Heights...`. The
master `+0x68` flag is no longer just structural: the shell load/save coordinators now use the
same flag to force the editor-map `.gmp` family, so current evidence treats it as the broader
editor-map mode above those later setup branches rather than an unnamed generic toggle. That
worker is no longer one opaque building bucket: current grounded categories split into `House`, a
weighted region-profile family surfaced through the `Industry Weightings` stats path, and a third
branch whose low-level fallback token is `Commercial` but whose aligned stats label is `City
Support`. The same placement-commit gate beneath it, `world_region_validate_and_commit_candidate_placement`
`0x00422a70`, is also corroborated by the separate world-side randomized batch helper
`world_try_place_random_structure_batch_from_compact_record` `0x00430270`, which retries
placements around one compact center/radius record rather than the ordinary per-region demand
deficits. That batch placer now sits under a wider compact runtime-effect dispatcher,
`world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, so the world-side
branch is no longer just “another caller near `0x43051e`” but one real effect family alongside
the ordinary region-demand worker. Above that, the live scenario event collection at `0x0062be18`
now has a tighter runtime-effect lane too: `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects`
`0x004323a0` services one live runtime-effect record, dispatches its linked compact effects
through `0x00431b20`, and can synthesize follow-on records through
`scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets`
`0x00430b50`, which in turn allocates new live records through
`scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`.
Above that, `scenario_event_collection_service_runtime_effect_records_for_trigger_kind`
`0x00432f40` now bounds the collection-wide loop that services those live runtime-effect records
for one trigger kind. That trigger split is tighter now too: recurring simulation maintenance
drives kinds `1`, `0`, `3`, and `2`; the neighboring route-style follow-on drives `5` and `4`;
startup-company and named-railroad creation branches drive `7`; kind `6` is now bounded as a
mixed post-change family spanning the placed-structure post-create tail, one build-version-gated
company-startup or roster-refresh tail, and the route-entry post-change sweep on `0x006cfca8`;
one world-entry-side one-shot gate drives `8` and then clears shell-profile latch
`[0x006cec7c+0x97]`; the briefing-text query lane is kind `9`; and the collection dirty latch
still forces the internal rerun at kind `0x0a`.
That moves this branch out of the “isolated world-side placement oddity” bucket and into a real
scenario-runtime effect pipeline with a mostly bounded trigger-kind family.
The same lower helper also reappears later on a slower
simulation-side cadence with
scale `1/12`, so it no longer looks like one-time setup glue only. The actual game-speed control
family remains separate, rooted at `world_set_game_speed_mode` `0x00434680`,
`world_adjust_game_speed_mode_delta` `0x00434850`, and `world_toggle_pause_or_restore_game_speed`
`0x00437a60`. The direct shell command stub above that family is now explicit too: `0x00440880`
just re-enters the pause-or-resume toggle with flag `1` and then issues one indexed shell
feedback nudge through `0x0045ea20` with selector `0x2c` and scalar `0.5f`. That feedback path
is tighter now too: `0x0045ea20` is the reusable indexed audio-feedback helper over the
table-driven pairs at `0x005f0828/0x005f082c`, and `0x00531e10` is the shell-audio-service sink
that only dispatches those nudges when the live service gates are satisfied.
### Camera View Command Strip
The adjacent shell-command family at `0x004408f0..0x00440c30` is now
grounded as the ten-slot `Assign/Select Camera View` owner rather than as a generic modal strip.
`shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0` snapshots one `0x30`-byte
record inside the live world-view owner through `world_view_store_camera_view_slot_snapshot`
`0x0043b2c0`, storing both the live view tuple `[view+0x04..+0x24]` and one saved focus-kind pair
from `[0x006cec78+0x45/+0x49]`; `shell_select_camera_view_slot_or_publish_unassigned_warning`
`0x004409c0` then re-enters `world_view_restore_camera_view_slot_snapshot_if_populated`
`0x0043ca20`, which restores the same fields, optionally replays the saved focus through
`shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and returns silently on success.
Only empty slots surface the shared shell modal path, using localized ids `371..373` after one
label-format pass through `0x0051b700`. The wrapper strip `0x00440b00..0x00440c30` is now fully
bounded too: `0x00440b00/10/20/30/40/50/60/70/80/90` are `Assign Camera View 1..9/0`, while
`0x00440ba0/b0/c0/d0/e0/f0/c00/c10/c20/c30` are `Select Camera View 1..9/0`, and the
registration block at `0x00460903..0x00460cac` ties those wrappers to localized command ids
`3474..3493`.
### CompanyDetail Addendum
The shared helper `shell_company_detail_resolve_selected_company` at
`0x004c16f0` now bounds the common current-company accessor beneath the whole pane, and the
read-side owner also has a separate active-company navigation family through
`shell_company_detail_step_selected_active_company_delta` at `0x004c3470` plus the next or
previous wrappers at `0x004c3540` and `0x004c3550`. The section switch in
`shell_company_detail_window_refresh_controls` is now grounded too: section index `0x006cfe60`
selects a chairman/governance slice, a debt-and-capital slice, a per-share slice, or a
territory-access slice, published through the tab band around `0x9472..0x9479`, with adjacent
section-navigation controls around `0x947b..0x947c` and `0x948f..0x9490`.
### Key Dispatchers
`shell_controller_window_message_dispatch`,
`shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`,
`shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`,
`world_runtime_serialize_smp_bundle`, `simulation_frame_accumulate_and_step_world`,
`game_message_window_service_if_present`, `game_message_window_service_frame`,
`game_uppermost_window_handle_message`, `game_uppermost_window_service_world_hotspot_band`,
`game_uppermost_window_refresh_controls`,
`world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`,
`world_view_step_zoom_bucket`, `world_seed_default_chairman_profile_slots`,
`world_build_chairman_profile_slot_records`,
`world_conditionally_seed_named_starting_railroad_companies`,
`scenario_state_set_selected_chairman_profile`,
`scenario_state_get_selected_chairman_profile_record`,
`scenario_state_get_selected_chairman_company_record`, `shell_company_list_window_construct`,
`shell_company_list_window_refresh_rows`, `shell_company_list_window_handle_message`,
`start_new_company_dialog_open`, `start_new_company_dialog_commit_create_company`,
`start_new_company_request_create_company`, `shell_station_detail_window_construct`,
`shell_station_list_window_construct`, `shell_station_list_window_handle_message`,
`shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`,
`map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_handle_message`,
`map_editor_chairman_slot_panel_refresh_selected_slot`,
`map_editor_chairman_slot_panel_cycle_selected_slot_profile`,
`map_editor_available_chairman_panel_construct`,
`map_editor_available_chairman_panel_handle_message`,
`map_editor_scenario_metadata_panel_refresh_briefing_mode`,
`map_editor_scenario_metadata_panel_refresh_controls`,
`map_editor_scenario_metadata_panel_handle_message`,
`map_editor_scenario_special_conditions_panel_construct`,
`map_editor_scenario_special_conditions_panel_handle_message`,
`map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`,
`station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`,
`track_lay_window_refresh_controls`, `track_lay_window_service_frame`,
`track_lay_window_handle_message`, `simulation_advance_to_target_calendar_point`, the smaller
single-step helper at `0x00409e80`, `0x0040a9c0`, `0x0040a910`, and
`simulation_service_periodic_boundary_work`.
### State Anchors
Shell input object `0x006d4018`, per-key state table starting at `[input+0x100]`,
packed shell input flags at `[input+0xa8c]` now grounded as Right Shift `0x1`, Left Shift `0x2`,
Control `0x4`, and Alt `0x20`, nested dispatch counter `[input+0xa90]`, global shell controller
`0x006d4024`, active world root `0x0062c120`, `GameMessage.win` object `0x006d081c`,
`GameUppermost.win` overlay object `0x006d0820`, `StationPlace.win` tool object `0x006d1720`,
`TrackLay.win` tool object `0x006d1a8c`, accumulated leftover simulation time at `[this+0x4c80]`,
shell and mode globals at `0x006cec74`, `0x006cec78`, and `0x006cec7c`, world manager collections
at `0x0062be10`, `0x006ceb9c`, `0x006cfcbc`, `0x006cec20`, `0x0062bae0`, and `0x006acd34`, plus
the packed calendar-like tuple fields around `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and
`[this+0x14]`.
### Subsystem Handoffs
The controller window dispatcher now looks like the first grounded input
ingress. It translates keyboard and mouse `WM_*` traffic into shell controller state and the
separate input object at `0x006d4018`; read-side cursor and camera helpers later snapshot that
object through `shell_input_snapshot_dispatch_state` and gate world-relative interaction through
`shell_input_cursor_inside_active_view`. Current grounded consumers around `0x00478cb0`,
`0x004e0780`, `0x0053f450`, and `0x0053fe90` still sit on the shell controller path and consult
`0x006d4024` or the world owner at `0x0062be68`, so there is still no evidence for a distinct
gameplay-only input object after world entry. Instead, the first deeper world-mode interaction
branch now looks like a shared world-view coordinator layered on top of the same shell-fed input
state. Shell_transition_mode ensures the `GameUppermost.win` object at `0x006d0820`; its message
dispatcher `game_uppermost_window_handle_message` owns the narrow action band `0x7918` through
`0x7921`; and the recurring service helper `game_uppermost_window_service_world_hotspot_band`
rate-limits those hotspot actions, rechecks `shell_input_cursor_inside_active_view`, and then pans
the live world view through `world_view_pan_relative_offset_in_camera_plane` `0x0043d130`. The
same lower setter family is also reached from the cursor-drag path through
`world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`. Above both of those sits the
larger recurring service `world_view_service_shell_input_pan_and_hover` `0x0043db00`, which now
has one grounded keyboard branch beneath it:
`world_view_service_keyboard_turn_pan_and_zoom_bindings` `0x0043d740`. That helper resolves four
binding-pair families from the shell input table via `0x0054e7d0`, and the localized labels are
now grounded from `Data/Language/RT3.lng`: `Camera Forward` and `Camera Backward` feed the first
signed pan channel, `Camera Left` and `Camera Right` feed the second signed pan channel, `Camera
Zoom In` and `Camera Zoom Out` feed the signed zoom-step channel that `0x0043db00` smooths into
`world_view_step_zoom_bucket` `0x0043cc30`, and `Camera Rotate Left` plus `Camera Rotate Right`
feed the continuous heading-turn branch through `0x0043c810`. The setup side is now better bounded
too: `world_view_seed_keyboard_binding_slot_pairs` at `0x00439e40` seeds the eight slot pairs at
`[this+0x0a6]` through `[this+0x0e2]` from the global action-binding registry through
`shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id` `0x0045f370` using
the distinct registry keys `0x0043d2a0` through `0x0043d310`, and the registration block at
`0x00460769` through `0x004608e7` plus the shared installer
`shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` show those roots
are defaulted to the expected Up Down Left and Right virtual keys before runtime polling begins.
The adjacent lookup strip is tighter now too: `shell_input_binding_registry_resolve_entry_by_action_stem`
`0x0045ede0` resolves one action stem into the live binding registry, while
`shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and
`shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400` are the small
display-label and primary-code wrappers above that resolver. The camera-view modal family at
`0x004408f0/0x004409c0` now uses that same strip directly when formatting the optional focus-label
lines inside the assign/select camera-view confirmations. The lower label path is now bounded too:
`shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90` is the actual
registry-entry formatter with the three localized prefix fragments `0xdef/0xdf0/0xdf1` plus the
descriptor-table caption fallback at `0x005f0a34`, and
`shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular`
`0x0045ed90` is the descriptor-side bucket-key helper used by the installer when the target mode
mask is singular. The same local family now reaches one step further into the hotkeys sidecar:
`shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250` builds a
temporary sorted report queue over the live registry, `shell_input_write_hotkeys_report_file`
`0x0045f550` writes the resulting table to `hotkeys\hotkeys.txt`, and the hotkey reassignment path
uses the smaller helpers `0x0045ec00`, `0x0045ec70`, `0x0045ecd0`, `0x0045ed70`, `0x0045ef00`,
and `0x0045f8a0` to split imported `foo+bar` labels, recover one action id from the descriptor
table, decode a compact modifier code, expand that code back into the live registry mask, and
finally rebucket or replace the live binding entry. The surrounding registry lifecycle is tighter
now too: `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0`
seeds the fixed defaults from `0x005ecadc` and then appends the smaller manual shell-command
strip; `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070` is the
hard reset that also flushes `hotkeys\hotkeys.txt`; and
`shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file`
`0x00461120` rebuilds the pool roots, reseeds defaults, and tail-jumps into
`shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels` `0x0045f420`
when the caller requests saved-hotkey import.
Beneath that camera stack, the enclosing frame
path now has one grounded non-view sidecar: after `0x0043db00` it reads the active controller-view
object pointer at `[0x006d4024+0x18]+0x366e`, compares it against the latched target at
`[frame_owner+0x66a2]`, fires exit and enter-style vtable callbacks on pointer changes through
slots `+0x64` and `+0x60`, and only latches the new object when the object passes its own slot
`+0x1c` availability test and shell detail control id `0x07d6` on `0x006d0818` has flag bit `0x4`.
That `0x07d6` gate is now more bounded than before: the dedicated `TrackLay.win` tool family
rooted at `0x006d1a8c` special-cases the same control id in both `track_lay_window_service_frame`
and `track_lay_window_handle_message`, uses world hit tests through `0x00448ac0` to arm and
release a drag latch on that surface, and routes the resulting command work through the shared
track-lay mode state at `0x00622b0c`. The surrounding `track_lay_window_refresh_controls` pass now
shows that this is not just one isolated drag handler: the same tool family owns three mutually
exclusive primary mode buttons at `0x985e` `0x985f` and `0x9860`, and current primary evidence now
bounds those values as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40`
from the localized strings 2054 2055 and 1721 plus the matching control-routing branches in
`track_lay_window_handle_message`. The same family also owns the downstream route-entry policy
bridge at `0x004955b0`: current caller evidence says that helper maps the live TrackLay primary
mode into endpoint-synthesis policy `1` or `4` before the tool re-enters `0x00493cf0`, which is
the strongest current bridge from the player-facing single-track versus double-track buttons into
the lower route-builder policy bytes. The same family also owns a bridge-type preference selector
rooted at `0x006cec74+0x138`, two wrapped `Never` through `Common` frequency settings at
`0x006cec74+0x140` and `0x006cec74+0x13c`, two boolean track-lay preference toggles, and the
electrify-all-track action path. Those last two toggles are now tighter than before: current
evidence strongly aligns control `0x986e` and state `0x006cec74+0x144` with `Auto-Hide Trees
During Track Lay` from strings 1838 and 1839, while control `0x986d` and state `0x006cec78+0x4c74`
align with `Auto-Show Grade During Track Lay` from strings 3904 and 3905. That mapping is still
evidence-backed rather than absolutely direct from a recovered resource table, but the state
ownership and control order now make it the strongest current fit. That makes `0x07d6` look like
the shared main-world interaction surface inside a broader TrackLay world-command subsystem, not
an unrelated detail button. The neighboring `StationPlace.win` family is now grounded on that same
surface too: the shell detail-panel constructor family allocates it through
`station_place_window_construct` at `0x00509d80`, publishes it at `0x006d1720`, services it each
frame through `station_place_window_service_frame` at `0x0050a530`, and routes player-facing
commands through `station_place_window_handle_message` at `0x005091b0`. That dispatcher
special-cases the same `0x07d6` control, and the shared helper
`station_place_world_surface_sync_and_dispatch` at `0x00508bb0` either accepts that direct surface
traffic or falls back to the same detail-panel control looked up through `0x006d0818`, rechecks
flag bit `0x4`, hit-tests the world through `0x00448ac0`, stages world coordinates into
`0x006d1738/0x006d173c`, refreshes the remaining preview metric field through
`station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and updates the live
station-placement selection state at `0x00622af0`, `0x00622aec`, and `0x006d1740`. The tool-side
save and restore choreography is tighter now too: `station_place_window_release_cached_selection_handles_and_world_followons`
`0x005079c0` releases cached helper handles `[this+0x7c/+0x80/+0x88/+0x84]` through the matching
global owners after re-entering world and placed-structure follow-ons, and the thin wrapper
`0x00507a50` is the entry used by the broader save-load status-stack helpers. The category side
of that state is now tighter too: the shared helper `0x0044bd10` quantizes the staged world coordinates into the
current cell, resolves the mixed byte-or-word region id from `[world+0x212d]`, looks up the
owning city-or-region entry through `0x0062bae0`, and returns `[entry+0x272]` with fallback
`5`; the StationPlace world-surface branches at `0x00508b80`, `0x00508d59`, and `0x0050a4e6`
use that result directly to refresh the current selection category latch at `0x00622af0`.
Together with
`station_place_select_category_and_refresh` `0x00508880`,
`station_place_refresh_category_controls` `0x00507b90`, and `station_place_format_preview_panel`
`0x00508730`, that makes StationPlace a second grounded consumer of the shared main-world
interaction surface rather than only a sibling constructor plus frame hook. The StationPlace
control semantics are now tighter too: the top category strip at `0x697c` through `0x6981` now
grounds as small station, medium station, large station, service tower, maintenance facility, and
non-station building from `RT3.lng` strings 2197 through 2202. For the three station categories
only, the secondary strip at `0x6988` and `0x6989` plus display field `0x698c` no longer looks
like another placement mode family; it is a building-style scroller. The click handlers on
`0x6988` and `0x6989` cycle the style override in `0x00622aec`, and the display path builds the
active style token from `StationSml`, `StationMed`, or `StationLrg` plus the localized
architecture styles `Victorian`, `Tudor`, `Southwest`, `Persian`, `Kyoto`, and `Clapboard` from
`RT3.lng` ids 2672 through 2667. One layer lower, the remaining opaque controls are now much
tighter: `0x6985` and `0x6986` are no longer a generic assist toggle but the two station-rotation
policy choices from strings 2207 and 2206, switching between auto-orienting the building to track
or obstacles and strictly obeying the rotation specified by the circle above. The dedicated
control at `0x6987` is the station-rotation circle itself, wired through
`station_place_rotation_circle_callback_publish_current_heading_widget` `0x00507a90` and aligned
with `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.`
string 2208. The lower rotation strip is now grounded too:
`station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` owns the write to
`0x006d172c` and the live selected-site pose refresh, `station_place_window_drag_rotate_selected_site_toward_world_cursor`
`0x00507d80` is the drag-update branch under the dispatcher, and
`station_place_step_rotation_by_integer_notches` `0x005086c0` is the discrete notch helper used by
the neighboring StationPlace rotation-step branches. That matches the lower behavior too: when the
strict-rotation choice is off, both preview and commit paths route staged coordinates through
`station_place_window_try_auto_orient_candidate_to_covering_route_entry_and_validate_placement`
`0x00508040`, which performs the extra orientation search before validation by retrying a small
orientation-mode set around the reusable covering-route-entry helper `0x00417b40`; when strict
rotation is on, that pass is skipped and the current angle in `0x006d172c` is used directly. The
preview strip is tighter now too: `station_place_format_preview_panel` `0x00508730` is the real
owner for controls `0x6982/0x6983/0x6984`, and the middle field `0x6983` is no longer anonymous.
`station_place_refresh_preview_metric_control_0x6983` `0x00508550` resolves the staged world-cell
category through `0x0044ad60`, reads the linked profile scalar at `[profile+0x22]`, chooses issue
slot `0x3b` or `0x3c` from candidate subtype byte `[candidate+0x32]`, folds that scalar through
`scenario_state_compute_issue_opinion_multiplier` `0x00436590`, and then passes it through the
version-gated quantizer `0x005084a0` before formatting the visible text into control `0x6983`.
The singleton-side entry above that strip is explicit now too:
`station_place_format_preview_panel_if_live_singleton_and_valid_selection` `0x00508860` only
forwards non-`-1` selection ids into that refresh path when `0x006d1720` is live.
One layer below preview versus commit, the shared gate is also tighter now:
`station_place_validate_current_selection_at_world_coords_and_optionally_format_status`
`0x00507e80` is the common validation-and-status path beneath the preview and commit branches,
publishing red, yellow, or green feedback through `0x0040cb10` around the same
`placed_structure_validate_projected_candidate_placement` `0x004197e0` core. The
direct shell UI also exposes the same discrete view-step family through
`world_view_step_heading_quadrant` `0x0043cb00` and
`world_view_step_zoom_bucket` `0x0043cc30`. The neighboring gating predicates
`world_view_should_drive_primary_pan_channel` and `world_view_should_drive_secondary_pan_channel`
test packed shell input bits `0x3`, and `shell_input_apply_window_key_transition` now grounds
those bits as the left and right Shift modifiers from scan codes `0x2a` and `0x36`. That means
cursor drag, overlay hotspots, held Shift state, direct keyboard turn/pan/zoom bindings, the
TrackLay and StationPlace world-command surfaces, and at least one frame-owned hover or
focus-target branch all converge under the same shell-fed world-mode input path rather than a
separate gameplay-input stack.
### Evidence
Function-map rows for `shell_controller_window_message_dispatch`,
`shell_drain_pending_window_messages`, `shell_input_state_init`,
`shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`,
`shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`,
`world_runtime_serialize_smp_bundle`, `world_entry_transition_and_runtime_bringup`,
`simulation_frame_accumulate_and_step_world`, `game_message_window_service_if_present`,
`game_message_window_service_frame`, `shell_ensure_game_uppermost_window`,
`game_uppermost_window_construct`, `game_uppermost_window_handle_message`,
`game_uppermost_window_service_world_hotspot_band`, `world_view_set_focus_position_xyz`,
`world_view_apply_screen_delta_to_focus_position`,
`world_view_pan_relative_offset_in_camera_plane`, `world_view_seed_keyboard_binding_slot_pairs`,
`world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`,
`world_view_step_zoom_bucket`, `world_view_should_drive_primary_pan_channel`,
`world_view_should_drive_secondary_pan_channel`, `world_view_service_shell_input_pan_and_hover`,
`world_seed_default_chairman_profile_slots`, `world_build_chairman_profile_slot_records`,
`world_conditionally_seed_named_starting_railroad_companies`,
`profile_collection_count_active_chairman_records`,
`profile_collection_get_nth_active_chairman_record`,
`scenario_state_set_selected_chairman_profile`,
`scenario_state_get_selected_chairman_profile_record`,
`scenario_state_get_selected_chairman_company_record`, `start_new_company_dialog_open`,
`start_new_company_dialog_commit_create_company`, `start_new_company_request_create_company`,
`shell_company_list_format_company_or_start_row`,
`shell_company_list_activate_or_shift_center_company`, `shell_company_list_window_refresh_rows`,
`shell_company_list_window_handle_message`, `shell_company_list_window_construct`,
`shell_company_detail_window_refresh_controls`, `shell_company_detail_window_construct`,
`shell_company_detail_window_handle_message`, `shell_station_detail_window_construct`,
`shell_station_list_window_construct`, `shell_station_list_window_handle_message`,
`shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`,
`map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_refresh_slot_list`,
`map_editor_chairman_slot_panel_refresh_selected_slot`,
`map_editor_chairman_slot_panel_refresh_slot_counters`,
`map_editor_chairman_slot_panel_cycle_selected_slot_profile`,
`map_editor_chairman_slot_panel_handle_message`, `map_editor_available_chairman_panel_construct`,
`map_editor_available_chairman_panel_handle_message`,
`map_editor_scenario_metadata_panel_refresh_briefing_mode`,
`map_editor_scenario_metadata_panel_refresh_controls`,
`map_editor_scenario_metadata_panel_handle_message`,
`map_editor_scenario_special_conditions_panel_construct`,
`map_editor_scenario_special_conditions_panel_handle_message`,
`map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`,
`station_place_refresh_category_controls`, `station_place_format_selected_site_summary`,
`station_place_format_preview_panel`, `station_place_select_category_and_refresh`,
`station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`,
`station_place_window_construct`, `station_place_window_service_frame`,
`track_lay_window_refresh_controls`, `track_lay_window_construct`,
`track_lay_window_service_frame`, `track_lay_window_handle_message`, and
`simulation_service_periodic_boundary_work`, plus the shell-input disassembly around `0x0054f290`,
`0x0054e880`, `0x0054e9c0`, `0x0054ea20`, `0x0054eb10`, and `0x0054ee50`,
the world-view setup and service branches around `0x00439e40`, `0x0043d740`, `0x0043db00`,
`0x0043cb00`, and `0x0043cc30`, the `319` setup-side branches around `0x004377a0`, `0x00437220`,
`0x00477820`, `0x00477860`, `0x0047d440`, `0x004c6c30`, `0x004c6f30`, `0x0047d080`, `0x0047d120`,
`0x0047d320`, `0x004c2ca0`, `0x004c5540`, `0x004c56a0`, `0x005068c0`, `0x005071e0`, `0x005074c0`,
and `0x005076c0`, the direct summary-field helpers around `0x00434870` `0x00434890` and
`0x004348c0`, the company-link writers at `0x00427c70` and `0x00427d74`, the company constructor
at `0x00428420`, the startup-company branch around `0x00470e48`, the shell company-list strings
`266` `<<Start New Company>>`, `267` `You are the chairman of the %1!`, `268` `The %1 has no
chairman at the moment.`, `269` `%1 is the chairman of the %2.`, `270` `Double-click for
details.`, and `2992` `Shift-Click to center on this company's primary station.`, the
`CompanyDetail.imb` and `CompanyDetail.win` resource strings in `.rdata`, the `StationDetail.imb`,
`StationDetail.win`, `StationList.win`, and `StationPick.win` resource strings in `.rdata`, the
shell editor window branches around `0x004c9da0`, `0x004ca010`, `0x004ca1c0`, `0x004ca540`,
`0x004ca670`, `0x004ca790`, `0x004ca980`, `0x004cb2b0`, `0x004cb4a0`, `0x004cb6f0`, `0x004cb8e0`,
`0x004cc250`, `0x004cc2d0`, `0x004ceb90`, and `0x004cecc0`, the localized chairman-slot strings
`2997` through `3001` `Optional` `Mandatory` `Human or Computer` `Computer` and `Human`, the
localized scenario-editor strings `1483..1492` `Description:` through `Type the briefing for this
map.`, the localized summary strings `1035` `%1 out of %2 are selected.` and `1053` `Special
Conditions In Effect`, the 40-entry persona availability page under `0x5aa0..0x5b03`, the 36-entry
special-condition table at `0x005f3ab0` covering ids `2535..2563`, `2874`, `3722`, `3835`, `3850`,
`3852`, and `3920`, the static persona table at `0x005f2d28`, the selector array at
`0x006cec7c+0x87`, the persona collection at `0x006ceb9c`, the localized persona strings in
`Data/Language/RT3.lng` including `2730` `Unassigned`, the named-chairman range `2731+`, and the
neighboring biography range `2495+`, plus the seeded railroad-name strings `575` `Missouri
Pacific`, `576` `New York Central`, and `577` `Grand Trunk Railroad`, the StationPlace.win
constructor plus category, dispatcher, rotation-circle, shared-world-surface, preview-build, and
recurring service branches around `0x00507a90`, `0x00507b90`, `0x00508550`, `0x00508730`,
`0x00508880`, `0x00508bb0`, `0x005091b0`, `0x00509d80`, and `0x0050a530`, the StationPlace string
cluster `Place a small station` 2197 `Place a medium station` 2198 `Place a large station` 2199
`Place a service tower` 2200 `Place a maintenance facility` 2201 `Place a non-station building`
2202 `Scroll through building styles.` 2203 `When placing the building, it will strictly adhere to
the rotation specified by the circle above.` 2206 `When placing the building, it will rotate
itself as needed to orient to track or avoid obstacles.` 2207 `Click to rotate the building. You
can also use bracket keys [ and ] to rotate buildings.` 2208 and the architecture-style labels
`Clapboard` 2667 `Kyoto` 2668 `Persian` 2669 `Southwest` 2670 `Tudor` 2671 and `Victorian` 2672,
the TrackLay.win constructor and dispatcher family around `0x0050d2d0`, `0x0050e400`,
`0x0050e070`, `0x0050e1e0`, and `0x0050e5c0`, the localized `Never` through `Common` strings 615 through 618,
the track-lay strings `Bulldoze` 1721 `Lay single track.` 2054 `Lay double track.` 2055 and 3114,
and the deeper shared bulldoze helper at `0x0044b160`. That helper is no longer just a vague
proximity scan: it validates the active company unless editor mode is active, emits the exact
RT3.lng bulldoze rejection ladder `419..424`, reads company cash through `0x0042a5d0`,
debits approved bulldoze cost through `0x0042a080`, and then scans nearby route entries,
linked structures, city-or-region records, route blockers, and placed structures before
committing the mutation. The nested tool-side entry is tighter now too: `0x0050e070` increments
the TrackLay reentry guard, snapshots several live route-owner fields from `0x006cfca8` into the
tool object, refreshes tool-local state through `0x0050dab0`, and only then tails into the later
restore or service branch `0x0050d1e0`. That tail is now tighter too: `0x0050d1e0` resets the
route-owner search state through `0x0049ad90/0x00495540`, drops invalid cached route ids from the
TrackLay tool or deletes non-admitted live entries when route latch `[route+0x118]` is set,
clears `[tool+0x78]`, and then conditionally refreshes shell presenter slot `[presenter+0x3741]`
through `0x00523e20`. The destructor side is tighter too: `0x0050db10` restores the TrackLay
vtable, re-enters that same cleanup tail, runs the route-owner post-change sweep
`0x004a3db0`, clears singleton `0x006d1a8c`, conditionally replays world follow-ons around
`0x00453510`, and only then tails into the common shell destroy path `0x0053f7d0`. Two smaller
TrackLay-side helpers are tighter now too: `0x0050dc00` refreshes the version-gated action rows
`0x986a..0x986c` plus `0x9872` before re-entering the main control refresh, and `0x0050dc80`
owns the active route-latch branch that either forwards into `0x004a00b0` or clears route latch
`[0x006cfca8+0x118]` plus local byte `[tool+0x82]`. The broader shared route or hit-test owner
under both message and recurring service is now tighter too: `0x0050dce0` first drops any cached
tool route id, then either seeds or updates the current route-owner selection from a world-surface
hit test through `0x00448ac0`, `0x00493600`, `0x0049ace0`, and `0x0049b180`, or refreshes the
active route-owner path through `0x004955b0`, `0x00493cf0`, and `0x004a04c0`, with the cleanup
side posting the fixed shell payload and optionally deleting route ids `[+0x125]` and `[+0x129]`.
The smallest active-route companion is tighter now too: `0x0050dab0` only runs when latch
`[0x006cfca8+0x118]` and route id `[+0x125]` are both live, then resolves that entry, re-enters
`0x0049afe0`, `0x0048b660`, and `0x0049b070`, and returns.
dispatching the selected delete branch through `0x004937f0`, `0x004941a0`, `0x0048abf0`, or the
surrounding placed-structure virtual slot `+0x58`. That makes the TrackLay `Bulldoze` mode
tighter than before: the tool-side mode latch at `0x00622b0c == 0x40` is only the front-end
selector, while the actual world-side bulldoze choice and failure policy sits under `0x0044b160`
and is reused by neighboring world-surface callers beyond TrackLay itself.
the TrackLay preference strings `Auto-Hide Trees During Track Lay` 1838 `If 'Auto-Hide Trees
During Track Lay' is checked, trees will automatically be reduced to small stumps whenever you are
in track laying mode.` 1839 `Auto-Show Grade During Track Lay` 3904 and `If 'Auto-Show Grade
During Track Lay' is checked, you'll see the grade number over the track while laying track -
useful for trying to keep your slopes to a minimum.` 3905, the electrify-all confirmation and
failure strings 3083 3084 3837 and 3900, the binding-registry lookup path at `0x0045f370`, the
registration block at `0x00460769` through `0x004608e7`, and the localized labels in
`Data/Language/RT3.lng` ids `3466` through `3473`.
### Open Questions
Current evidence grounds the shell-controller-backed input and frame path as the
only coordinator after world entry; no separate outer gameplay loop or gameplay-only input
object is grounded yet. The new setup-pipeline evidence also points the same way: the
currently grounded chunked burst path at `0x00437b20` now looks subordinate to
`world_run_post_load_generation_pipeline` rather than to the ordinary speed controls, and even
there it still reuses the same lower stepper and pumps shell work between chunks instead of
revealing a detached gameplay loop owner. The player-facing speed-control family is now cleaner
too: `world_set_game_speed_mode` owns the bounded `Paused` through `Very Fast` ladder plus the
hidden `Ultra Fast 6..9` extension, `world_toggle_pause_or_restore_game_speed` uses `[this+0x1d]`
as the resume slot, and the multiplayer host restriction now looks attached to that same setter
family rather than to the setup-side burst helper. The frame-owned shell coupling is tighter now
too: inside `simulation_frame_accumulate_and_step_world` itself, one direct branch opens or
focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page`, and the post-step
shell-window ladder also probes several sibling shell windows by the same presence-plus-dirty
pattern, including the live `LoadScreen` singleton, the shared callback-driven custom modal, the
shared file-options dialog, `SettingsWindow.win`, the now-grounded `Overview.win` and
`BuildingDetail.win` singletons, the adjacent tool-window strip now grounded as
`Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintRegion.win`, `PaintSound.win`,
`PaintTerrain.win`, `PaintTerritory.win`, and `StockBuy.win`, and now the shell-side
`Trainbuy.win` singleton too. The `SettingsWindow.win` side is tighter now too:
`shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60`
rebuilds the hotkeys list control `0x757a` from the same sorted binding-report iterator
`0x0045f250`, using the temporary `0x88`-stride list model at `0x006d1354` before restoring the
previous selection. The message owner above it is bounded now too:
`shell_settings_window_handle_message` `0x004fede0` is the actual dispatcher for the singleton,
and its currently grounded hotkeys cases are the reset-to-defaults path
`0x00500147 -> 0x00461120(0) -> 0x0045f550 -> 0x004fec60` and the selected-row reassignment path
`0x00500186..0x0050022b`, which resolves one chosen hotkey row from control `0x757a`, validates
the destination bucket through `0x0045ed90`, skips Enter and Escape, expands the compact modifier
code through `0x0045ed70`, commits the rebucket through `0x0045ef00`, and then rewrites the same
report file plus rebuilds the list. The page-refresh side is bounded now too:
`shell_settings_window_refresh_selected_page_controls` `0x00500410` republishes the category
strip `0x7533..0x7540`, uses the local in-refresh guard byte `0x006d135d`, and then dispatches
the current page through the `0x005005e0` table; page `7` is now directly grounded as the
hotkeys page because it dispatches into `0x004fec60`. The category table at `0x00622870` now
grounds the whole page order as `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`,
`Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`,
`Miscellaneous`, and `Sandbox Options`, with only the second dword in each table row still
unresolved as a small subgroup or style flag. Several page bodies are now grounded too:
`0x004fda20` is the `Gameplay` refresh owner, `0x004fdb90` the `Sound` refresh owner,
`0x004fe770` the top-level `Graphics` refresh owner, `0x004fe960` the `Model Detail` refresh
owner, `0x004feb20` the `Draw Distance` refresh owner, `0x004febd0` the `Textures` refresh
owner, `0x004fdd70` the first `Miscellaneous` refresh owner, `0x004fdf20` the `Scrolling`
refresh owner, `0x004fdfd0` the `Camera Controls` refresh owner, `0x004fd940` the `Dialogs`
refresh owner, `0x004fd730` the later `Miscellaneous` refresh owner, and `0x004fd8d0` the
`Sandbox Options` refresh owner. The neighboring companion helpers are tighter now too:
`0x004fd550` refreshes the `Draw Distance` companion strip under controls
`0x7566/0x7596/0x7560/0x7562/0x7564`, `0x004fd650` does the same for the `Textures` companion
strip under `0x756e/0x756a/0x756c/0x7570`, `0x004fe4c0` rebuilds the graphics custom-resolution
list on `0x7553` from the live display-mode table filtered to `640x480 .. 1600x1200` and
formatted through `%1x%2`, and `0x004fe6f0/0x004fe730` are the small primary-selector mirror
helpers for `Draw Distance` `0x755f` and `Textures` `0x7569`. The `Camera Controls` page is
stronger now too: `0x7587` is the day-night cycling selector rooted at `Normal day/night
cycling` through `Frozen at 11pm`, while `0x7588` is the weather-cycling selector rooted at
`Normal weather cycling` through `Frozen at storms`. The callback strip under the dispatcher is
tighter now as well: `0x004fefb0` is the sound-backend selection-change owner for
`0x7551/0x7550`, `0x004ff070` is the custom-resolution selection owner, `0x004ff0d0` the
top-level graphics selector-change owner, `0x004ff1b0` the main draw-distance selector-change
owner, `0x004ff2e0` the textures selector-change owner, and `0x004ffbc0` the graphics
custom-resolution or range-refresh branch that persists `engine.cfg`, rebuilds the custom list,
and republishes `0x7555/0x7578`. The small wrapper `0x00500620` is the nonreentrant `if live,
refresh page` gate above that body. The tiny helper strip beneath those branches is at least
bounded now too: `0x00531640/0x005316d0` query the active sound-backend index and availability
flag from the shell audio service, `0x0053ef60/0x0053ef70` read the graphics-backend status
slots used by controls `0x757c/0x759a`, and `0x0051fd40/0x0051fd60` are the small graphics-range
custom-mode flag and scalar queries behind `0x7555/0x7578`. The next apply-strip under the same
family is tighter now too: `0x004fe270` applies a changed custom-resolution tuple and persists
it, `0x004fe2d0` applies the top-level graphics selector then republishes `0x757c/0x759a`,
`0x004fe3b0` applies the draw-distance selector then refreshes `0x004fd550`, `0x004fe400`
applies the textures selector then refreshes `0x004fd650`, `0x004fe140` is the small composite
backend-status predicate used by the timer-gated graphics service branch, and `0x004fe160` is
the sound-backend follow-on refresh path. The graphics service tail is tighter now too:
`0x004ffafb` is the timer-gated backend-service-plus-graphics-page repaint branch using
`0x0051d890` against deadline `0x006d136c`, the follow-on calls `0x0053f170/0x0053f2c0`, and a
shortened `60` ms rearm after it repaints `0x004fe770`, while `0x004ffb64` is the sibling
backend-service branch that uses `0x0053f0f0/0x0053f210` and only raises the shell refresh latch
without repainting the page directly. The same `MouseCursor.cpp` owner family is tighter now too:
`0x0053f000` is the live cursor-shape selector that lazily loads native handles, updates the
shell-side presentation payload, and toggles cursor visibility on the `0 <-> nonzero` boundary;
`0x0053f0f0`, `0x0053f170`, and `0x0053f210` are the three local hidden or release-transition
branches that mirror shell latches `[0x006d4024+0x11473a/+0x11473e]`; `0x0053f2f0/0x0053f310`
are the nested hold-counter helpers; `0x0053f330` is the constructor-side reset and latch-sync
owner; `0x0053f400` is the coarse global-latch service; and `0x0053f450` is the inside-view
watcher paired with `shell_input_cursor_inside_active_view` `0x0054f540`. The same pair is now
grounded on the heavier save/load paths too: `world_entry_transition_and_runtime_bringup`
`0x00443a50` pushes the hold at `0x443b04` before the larger startup-dispatch and staged
rehydrate work, then pops it at `0x444c03` after the late world or shell rebuild tail; the live
`.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240` does the same thing through
`0x446271` and `0x446d09` around its bundle-write and fixed status-publish span. The exact
save/load-side status stack under those spans is tighter now too: `0x004422d0/0x00442330` push
and pop shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte
`[0x006cec78+0x4c74]` through `0x0062be90`, while `0x004423a0/0x004423d0` layer the same band
under active TrackLay.win and StationPlace.win service. The per-frame tail is
tighter now too: `0x0054f5b0` queues one 12-dword shell-input event record into the rotating
ring at `[input+0x128]`; `0x0054f6a0` and `0x0054f6b0` are the two neighboring fixed-value
seeders for shared phase scalar `0x00d93850` used by shell-side branches `0x00538b72`,
`0x0052819d`, and `0x0052b9f8`; and `0x0054f6c0`, `0x0054f6d0`, and `0x0054f6e0` are the tiny
primary-motion scalar reset, snapshot, and restore leaves that `0x0053f4e0` uses around the
later cursor-presentation pass. The graphics-range
callback strip beneath that is bounded now too: `0x004ffd10` is the user-facing custom-mode
toggle rooted at control `0x7555`, using
`0x0051fd00`, `0x0051fd40`, `0x00520fd0`, and the localized dialog ids `0x0e16/0x0e17/0x0e93`;
`0x004ffe72` flips the graphics-range scalar through `0x00521030`; and the adjacent
display-runtime toggles `0x004ffea4`, `0x004ffeff`, `0x004fff2d`, `0x004fff59`, `0x004fff85`,
`0x004fffde`, and `0x0050000a` now bound a compact persisted graphics or model-detail option
strip over controller fields `[0x006d4024+0x1146eb]`, `[+0x114697]`, `[+0x1146e9]`, `[+0x1146b8]`,
`[+0x1146af]`, `[+0x1146a8]`, and `[+0x1146e3]` rather than one anonymous tail blob. The lower
setter layer is tighter too: `0x0051fd00` is the current `has live custom payload` predicate for
the graphics-range family, `0x00520fd0` stores the custom-mode flag and re-applies the current
range when possible, `0x00521030` stores the scalar and re-applies it when the graphics mode is
live, and `0x0051d890` is the shared elapsed-tick helper over the bootstrap-seeded tick count.
The same local support strip is broader now too: `0x0051e1d0` is the mode-`0` alternate sibling
of the packed preview-color ramp at `0x0051dfc0`; `0x0051e430/0x0051e480` are the shared
path-openability and file-size probes; `0x0051e4e0/0x0051e560` are the bounded ASCII clipboard
export and import helpers; `0x0051e6e0` is the nonempty digits-only predicate used by nearby
text-entry validation branches; `0x0051e720/0x0051e740` own the active debug-log filename
(`rt3_debug.txt` / `language_debug.txt`) and the one-time `.\\data\\log\\%s` separator write;
and `0x0051e810` is now grounded as the `MouseCursor.cpp` `ShowCursor` refcount and live-position
sync helper that the warning-modal strip also reuses. The immediate shell-controller strip under
that is tighter now too: `0x0051ea80` is the small core-state reset plus default seeding path
rerun by `0x0051ff90`; `0x0051f000` registers the static `World` window class through wndproc
`0x0054e3a0`; `0x0051f070/0x0051f080` and `0x0051f090/0x0051f0a0` are the paired controller
accessors and setters for the live presentation owner and world-basis owner; `0x0051f0c0`,
`0x0051f0d0`, and `0x0051f0e0` are the small indexed input-subobject flag write or query helpers
beneath the shell window-message path; `0x0051f100` materializes the active display-mode tuple
from `[controller+0x34]` and selector `[+0x11421e]`; `0x0051f1a0` is the current
graphics-mode-byte accessor over `[controller+0x114226]`; and the nearby shared shell-presenter
helper `0x00527de0` is now bounded as the common scalar-caption publisher reused by several tool
windows. It scales one caller float through `0x005dd158`, forwards that value into nested
presenter field `[this+0x364d]` through `0x0052ea90`, scales a second caller float through
`0x005c8568`, and stores that auxiliary caption-side weight in `[this+0x3728]`. Grounded callers
now include `Bulldoze.win`, `ChangeTrees.win`, the world-surface brush ordinal setter,
`PaintRegion.win`, `PaintSound.win`, `PaintTerrain.win`, and `PaintTerritory.win`, so this is the
shared shell scalar-caption lane rather than a window-specific text formatter. The neighboring page-owned dispatcher
leaves are tighter now too: `0x004ff58a`, `0x004ff5b6`,
and `0x004ff5e6` are direct persisted toggles for the later `Miscellaneous` input page fields
`[0x006d4024+0x1146d7]`, `[0x006cec74+0x28b]`, and `[0x006cec74+0x283]`, with the last one also
republishing a `Game.win` affordance through `0x004dd8d0`; `0x004ff637`, `0x004ff667`,
`0x004ff697`, `0x004ff6c7`, `0x004ff6f7`, and `0x004ff727` are the page-owned toggle leaves for
the `Dialogs` page fields `[0x006cec74+0xf8]` and `[+0x26b/+0x26f/+0x273/+0x277/+0x27b]`; and
`0x004ff757`, `0x004ff796`, `0x004ff7c6`, and `0x004ff84e` are the remaining compact `Gameplay`
page toggle leaves over `[0x006d4024+0x114742]`, `[0x006cec74+0x0a8]`, `[+0x263]`, and
`[+0x309]`, with the `+0x114742` path also nudging `BuildingDetail.win` and the `+0x263/+0x309`
paths triggering narrow live-tool follow-ons. The next tiny leaves are bounded now too:
`0x00500036` is the direct apply leaf for the graphics-misc option family mirrored through
`0x00484af0(0x0c)` into control `0x7586`; `0x0050006c/0x0050009c/0x005000cc` are the shared
setup-config toggles over `[0x006cec74+0x247/+0x24b/+0x243]` that persist the same three booleans
later mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`; and `0x005000fc` is the direct
scrolling-page boolean-companion setter for `[0x006cec74+0x120]` and control `0x7585`.
neighboring stock-buy lane is tighter now too: `0x00433aa0` is the shared `StockBuy.win`
availability gate, rejecting when scenario toggle `[0x006cec78+0x4aa7]` is set or when no
selected-company id is present at `[scenario+0x21]`. The direct shell opener `0x00440660` and
the page-side launcher `0x004de50f` both use that gate before entering detail-panel mode `0x0c`,
whose same-mode refresh tail re-enters `0x00493150`. The shell-side control strip under that
window is tighter now too: `0x0050a660` is the raw selected-chairman-row setter for global
`0x006d19f4`, `0x0050a570` is the selected-company stock-data panel callback wired to control
`0x3aa0` and feeding the shared stock formatter `0x004c0160`, `0x0050a6d0` publishes the current
selected company id into `0x00622b00` and restyles control `0x3a9b`, `0x0050a670` is the shared
live-window refresh wrapper hit by the buy/sell chairman mutators after they touch
`[profile+0x154]` and the per-company holding band, `0x0050a5e0` is the constructor-wired
invalidation callback for control `0x3a9a`, and `0x0050a6a0` is the unconditional invalidation
sibling used by the local in-window trade branches after they commit the rounded block. One level
higher, `0x0050a730` is now bounded as the broad row/card refresh owner: it walks the active
chairman profiles through `0x00477820/0x00477860`, lays out the selected and unselected profile
cards through the cached widget roots `0x006d19d8/0x006d19dc/0x006d19e8/0x006d19ec`, resolves
persona/name labels through `0x00476bb0`, and pulls the same currently grounded metric lanes
from `0x00476320`, `0x00476780`, and `0x00476c20`. The selected-company panel under control
`0x3a9a` is separate and broader: `0x0050ae50` is now bounded as the main selected-company
summary renderer, resolving the current company through `0x00518140`, the current chairman row
through `0x00477860`, choosing one of panel roots `0x006d19e8/0x006d19ec`, and then formatting a
mixed text-plus-metric surface through helpers such as `0x00423eb0`, `0x00426b10`, and
`0x00426ef0`. The adjacent publish side is bounded too: `0x0050b910` formats the selected company
ownership line through localized ids
`0x0e10/0x0e11/0x0e12` plus the resolved company and owner labels, and `0x0050ba00` is the
shared selected-company summary refresh tail over controls `0x3a9a/0x3a9b`; `0x0050c130` is the
narrow mode-`0x0b` refresh wrapper that re-enters that tail only when the current detail-panel
object is actually `StockBuy.win`; and `0x0050c470` is the selected-company clamp/setter sibling
that republishes `0x00622b00` before re-entering the same summary tail. The payload-driven trade
commits are explicit now too: `0x0050c150` resolves one chairman record from payload
`[profile_id, company_id]`, derives the rounded buy block through `0x00476e50`, and commits it
through `0x00477110`; `0x0050c1f0` is the same sibling for the rounded sell block and
`0x00476460`. Both also emit the local selected-chairman shell cue before the shared
`StockBuy.win` refresh tail when the payload chairman matches the currently selected chairman in
`0x006cec78`. The message-owner and teardown side are bounded now too: `0x0050bbe0` is the real
`StockBuy.win` dispatcher, with `0xcb` control bands for chairman-row selection
`0x3afc..0x3b5f`, company-row selection `0x3d54..0x3db7`, company wrap/step controls
`0x3aa1..0x3aa3`, and toggle-byte writes `0x3aad..0x3ab2`, while `0xca` owns the local buy row
band `0x3c8c..0x3cef` and sell row band `0x3cf0..0x3d53`. The buy-side confirmation path now has
one extra leaf too: `0x0050a600` is the callback-driven tutorial gate for the localized
`0x0292` confirmation modal, opening the sibling tutorial modal `0x0e8c` only on `0xcb` control
`0x03f4` while tutorial flag `0x006d3b4c` is live. The destructor counterpart `0x0050bac0`
releases the cached roots `0x006d19d8..0x006d19ec`, frees the per-company cached stock-data
handles in `0x006d1748`, invalidates controls `0x3b60` and `0x3e4e`, clears singleton
`0x006d19f0`, and then tails into the common shell-object teardown. The
remaining adjacent detail-panel gates are now at least structurally bounded too even though their
target families are still unnamed: `0x00434db0` layers extra scenario toggle `[0x006cec78+0x4a7f]`
on top of the broader company-list/detail gate before allowing mode `0x0b`, while `0x00434e20`
only hard-blocks mode `0x06` when all three toggles `[+0x4ab3/+0x4ab7/+0x4abf]` are set and
otherwise, outside editor-map mode, still requires a selected-company id before the direct
openers `0x00440530` and `0x00440690` hand those modes to `shell_detail_panel_transition_manager`.
The
train-buy family is no longer just an unnamed probe pair either: the opener path is now grounded
under the same shell-owned cadence through `shell_can_open_trainbuy_window_or_warn` and
`shell_open_or_focus_trainbuy_window`, and its current family semantics already extend beyond a
bare locomotive picker into selected-train upgrade summary and route-edit affordances. The direct
shell opener `0x004406c0` now aligns with the page-side launcher `0x004de7d9`: both use
`shell_can_open_trainbuy_window_or_warn` `0x00433b00` before calling
`shell_open_or_focus_trainbuy_window` `0x00512c50`. The
selected-train side is tighter now too: we have explicit query helpers for the selected train
record, id, validity, and company ownership, plus one explicit ownership-mismatch warning modal.
That same pass also clarified one boundary we should not conflate: the neighboring shell family
rooted at `0x006d3b20` is now grounded separately as `TrainDetail.win`. It reuses the same
selected-train context and some of the same helpers, but it is not the same `Trainbuy.win`
singleton family. The `TrainDetail.win` side now has its own constructor, opener, refresh path,
and message owner above the broader train-command strip. Its inner `0xcb` strip is tighter now
too: one bounded branch is the selected-train engine-replacement or trainbuy handoff lane using
warning ids `593/594`, and another is the selected-train retirement lane using `595/596/597`
with either a local teardown path or multiplayer opcode `0x37`. The remaining train-command
family is narrower too: the shared `0x33`-stride helper trio at `0x004b2f00`, `0x004b3000`, and
`0x004b3160` now looks like a real train route-stop or waypoint list rather than a generic row
buffer, and route-entry flag byte `+0x28` now has one grounded top-level split: sign bit clear
entries are the live placed-structure-backed family, while sign bit set entries use the direct
route-node payload side. The helper `train_route_list_count_live_site_reference_entries`
`0x004b2b80` now counts the first family explicitly. One deeper lower-bit result is grounded too:
both `train_route_list_insert_staged_entry_at_index` and the auxiliary finalize helper
`train_finalize_aux_route_entry_buffer_preserving_subflags` `0x004a94b0` explicitly preserve
bits `0x40`, `0x20`, and `0x10` in the same flag byte during route-entry rewrites. Those bits are
also no longer copy-only: the neighboring shell helper
`shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20` now consumes them to
restyle the `BuildingDetail.win` row bands `0x7d07..0x7d1c` and `0x7f58..0x801f`. The exact
player-facing labels for those rows are still open, but the subflags now have one real shell-side
consumer instead of only preservation logic. The broader `BuildingDetail.win` refresh family is
tighter too: `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0` now
clearly owns the selected subject rows around `0x7d06`, `0x7d96..`, and `0x7d0e`, resolving
ordinary ids through the live candidate collection and the special express-side ids through the
embedded `AnyCargo.imb`, `AnyFreight.imb`, and `PassMail.imb` paths. The first fixed triplet is
now table-grounded instead of only inferred: `0x00621df8` seeds the short-label controls
`0x7dc8..0x7dca` with RT3.lng `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while
`0x00621e10` seeds the adjacent `0x7e90..0x7e92` icon-name triplet with `AnyCargo`,
`AnyFreight`, and `PassMail` before `%1.imb` formatting. RT3.lng also tightens the longer popup
side now: `0x00621e04` feeds the first clickable selector triplet `0x7f58..0x7f5a` with
`494/497/498`, so the help text there is `Any Cargo`, `Any Freight\n(Freight is everything but
Passengers, Mail, and Troops)`, and `Any Express\n(Express is Passengers, Mail, and Troops)`.
The sibling special service rows still align to `Dining Car` and `Caboose`. The extracted
`BuildingDetail.win` blob now sharpens the resource boundary too: its embedded text table is
currently sparse rather than rich, exposing the help line for `0x7d01`, repeated
`BuildingDetail.imb` asset strings, and one standalone caption entry `Cargo`. That makes
`Cargo` the strongest current resource-side anchor for the row header around `0x7d06`. The
ordinary deeper rows are tighter now too: they do not look like hidden caption-table entries,
but like live candidate-derived rows. The current path validates each ordinary id through
`indexed_collection_entry_id_is_live` `0x00517d40`, resolves the concrete candidate record
through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then reuses candidate
field `[record+0x04]` as one shared stem for both the row asset `%s.imb` path and the
neighboring display-label lookup through
`localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. That lookup is now
bounded too: it scans the static stem table at `0x006243c8`, already grounding entries such as
`Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng
`3202..3220`, and only falls back to localized id `3866` when no table entry matches before the
fixed `0x384..0x386` express-side triplet takes over. One neighboring candidate-side helper is
tighter now too: `structure_candidate_query_route_style_or_local_availability_metric`
`0x0041e650` shares the same route-style byte at `[candidate+0x46]`, returning the cached local
float at `[candidate+0x5a]` for ordinary candidates but switching route-style rows to one
normalized count over the world-side route-link collection `0x006ada90` keyed by candidate class
`[candidate+0x3e]`. That collection is tighter now too: it is constructed during world bring-up
by `placed_structure_route_link_collection_construct` `0x00468110`, and current grounded
creation flow through `placed_structure_route_link_allocate_site_pair_for_candidate_class`
`0x00467f50` seeds class byte `+0x10`, a masked initial state template, and the strongest
current creation-side site-pair fields at `+0x0c` and `+0x0e` before
`placed_structure_route_link_attach_site_owner` `0x00467eb0` links the new route-link record
into the placed-structure-owned chain at `[site+0x272]`. The owner-side split is tighter now
too: route-link field `+0x08` is the separate route-node-style owner anchor used by
`placed_structure_route_link_attach_route_node_owner` `0x00467f20`, while `+0x0a/+0x0c/+0x0e`
now read as the site-reference triple matched by
`placed_structure_route_link_collection_remove_links_touching_site_id` `0x004681f0`. Creation
flow now sharpens that further: `+0x0c` is the strongest current candidate for the stable
first-site field seeded before owner attachment, `+0x0a` is the mutable owner-site anchor
installed by the attach helper, and `+0x0e` is the stable second-site field. One more split is
tighter now too: `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`
currently uses `+0x0a` and `+0x0e` as the active endpoint site pair while recomputing state
byte `+0x12`; `+0x0c` is still not directly read there. The family also has a clearer release
and refresh side now: `placed_structure_route_link_release_and_detach` `0x004680b0` rolls back
the class counters and then tails into `placed_structure_route_link_detach_current_owner_chain`
`0x00467df0`, while
`placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0`
explicitly reruns the per-record endpoint-pair reconciler across the whole live route-link
collection. One layer above that,
`placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state`
`0x00468300` now looks like the full-family refresh owner: it clears three route-style class
lanes in the world-grid tables rooted at `[0x0062c120+0x2129]`, then clears bit `0x2` across
the live route-link records and reruns the endpoint-pair reconciler. That now lines up with the
visible shell split: non-route candidates keep the richer local metric and price lane, while
route-style candidates use one world-side route-link family instead. The emission side is
tighter now too: `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class`
`0x0040fef0` scans the live placed-structure collection for one best peer site by
class-specific weight, distance window, and type gate, then only creates a new route-link
through `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` when
`placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0` says the chosen site
pair does not already share a route-entry key. One layer above that,
`placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` now reads
as the broader per-site owner of this lane: it computes per-class route-style score scalars from
local site state and scenario multipliers, drives the first three route-style emission attempts,
and then continues into a larger descriptor-driven scoring phase. Inside that larger pass,
`placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link` `0x0042cab0`
now cleanly shows the split between ordinary candidates, which add directly into the local
route-style grid lane at `[site+candidate*4+0x103]`, and remapped route-style candidates, which
re-enter the peer-link emitter. One layer above that, the broader post-create or post-edit site
rebuild `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`
conditionally re-enters `0x004101e0` with stack flag `1` when its local latch at `[site+0x29e]`
stays clear, so the route-style lane is no longer floating under an unnamed single-site caller.
The placement side is tighter now too: the direct constructor
`placed_structure_collection_allocate_and_construct_entry` `0x004134d0` is the shared allocator
immediately beneath the current placement-side callers before they hand the new site into
`0x0040ef10`, and the lower constructor
`placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now bounds the
actual field-seeding layer beneath that allocator. The old unresolved higher placement chooser is
bounded more cleanly now too: the `0x00403ed5` and `0x0040446b` direct-placement commits sit
inside one larger helper,
`city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`. That shared
heavy builder is now the common target of the compact wrapper `0x00404640`, the peer-route
candidate builder `0x004046a0`, the region-entry pair wrapper
`city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry
paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news`
`0x00404ce0`. Internally it now has three bounded lanes:
an early route-entry search or synthesis attempt through
`route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`,
a single-endpoint direct-placement lane that scans `Maintenance` and `ServiceTower` candidates
and commits through `0x00403ed5 -> 0x004134d0 -> 0x0040ef10`,
and a later paired-endpoint fallback lane that seeds two endpoint candidates from the same stem
family, walks a temporary route-entry list, and commits through
`0x0040446b -> 0x004134d0 -> 0x0040ef10`.
That early lane can now be described more concretely: it can reuse supplied route-entry
endpoints, synthesize a missing leading endpoint from the caller's coordinates, seed the
route-store builder-state block, and then hand off to the deeper path-search core without
placing a new site. The previously vague side family at `0x006cfcb4` is tighter too: current
evidence now bounds it as a small auxiliary route-entry tracker collection with an allocator at
`0x004a42b0`, a refcount or destroy path at `0x004a4340`, a direct route-entry group-id setter
at `0x00489f80`, an endpoint-membership probe at `0x00494ed0`, a boolean-latch refresh or
owner-notify path at `0x00494fb0`, and a two-endpoint merge or bind helper at `0x00494f00`.
One smaller constructor-side ownership split is tighter now too: the cached `u16` chain fields
`[site+0x26e]`, `[site+0x270]`, and `[site+0x383]` are no longer free-floating. Constructor-side
helper `0x0041f7e0` prepends one new peer into that chain by storing the old head from
`[this+0x383]` into `[peer+0x270]` and then replacing `[this+0x383]` with the peer's own
placed-structure id `[peer+0x2a4]`; the direct resolver `0x0041f810` turns the cached head id
back into one live record through `0x0062b26c`; and the removal-side companion `0x0041f850`
removes one peer from the same chain before clearing `[peer+0x26e/+0x270]`. That caller split is
now strong enough to treat this as one cached single-link or predecessor-chain family beneath
placed-structure construction and rebuild rather than as unrelated scratch words.
That bind side is tighter now too: the trackers group route entries only when a route-key-like
value from `0x0048aa70`, the route-entry signature word `+0x22e`, and the boolean latch derived
from byte `+0x44` all agree. The deeper handoff under that lane is no longer anonymous either:
`route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380` is now
bounded as the internal search core that runs the first candidate sweep, quality gates, and the
later route-extension fallbacks before returning one resolved route-entry id or `-1`. The first
sweep now has a bounded owner at `0x0049bd40`, and the two later fallback helpers are bounded as
the route-entry point-window coverage query `0x00494cb0` and the frontier-extension helper
`0x0049c900`. The math side is bounded more cleanly now too: the family reuses
`math_measure_float_xy_pair_distance` `0x0051db80` for its direct point-to-point scalar,
`math_compute_quadrant_adjusted_heading_angle_from_xy_pair` `0x004952f0` for heading-angle
construction, `math_normalize_subtracted_angle_delta_and_report_wrap` `0x004953c0` for wrapped
angle deltas, and now one tighter visual-side strip too: `0x00539230` applies one local
float-preset layout from state byte `[entry+0x218]`, `0x00539380` loads the matching
table-driven profile bands and optional display latch `[entry+0x44]`, `0x005394b0` exports four
consecutive `3*dword` triplet bands from the entry into caller buffers, and `0x005391b0`
releases one optional world-space attachment before the entry's vtable slot `+0x00` teardown
fires. The adjacent publish side is bounded too: `0x00539580` broadcasts one caller-supplied
three-scalar packet across the optional attached-handle list at `[entry+0x08]`, and
`0x005395d0` ensures that same list, adds one new handle, and immediately republishes one
aggregate scalar derived from local bands `[+0x18/+0x24/+0x30/+0x3c]` together with head lanes
`[+0x0c/+0x10]`. The next owner layer is tighter now too: `0x00539640` is the heavy derived-band
rebuild that turns those four triplets plus profile weights `[entry+0x1f5/+0x1f9/+0x1fd]` into
the larger scalar bands rooted at `[entry+0x63]` through `[entry+0x1d3]`, refreshes center
scalars `[entry+0x0c/+0x10]`, re-enters root query `0x00534490` several times, and conditionally
maintains the optional `0xc0`-byte display buffer at `[entry+0x1e3]` according to display-state
byte `[entry+0x44]`. The surrounding wrappers are coherent with that same ownership split:
`0x0053a740` copies caller triplets into `[entry+0x14/+0x20/+0x2c/+0x38]`, refreshes optional
attachment id `[entry+0x55]` through `0x00533e00/0x00533dd0`, and republishes center lanes
`[entry+0x1ed/+0x1f1]`; `0x0053a890` reprojects the stored triplets through `0x00534490` and
rebuilds; `0x0053a920` fills all four triplets from one uniform scalar before rebuilding;
`0x0053ac40` rebinds the root pointer, clears attachment state, and optionally rebuilds from the
current triplets; `0x0053aca0` is the concrete default constructor for the same route-entry
object family; and `0x0053ae10` is the construction-time root-bind plus state-profile-and-triplet
initializer. The attachment manager beneath that strip is tighter too: `0x0053a5b0` is the tiny
broadcast wrapper over current head lanes, `0x0053a5d0` is the heavier ensure-and-clone path
that seeds one new attached handle from the first live entry when a list already exists, and
`0x0053a6d0` tears that attached-handle list back down. The collection side is tighter too:
`0x00491af0` constructs the indexed
`0x006cfca8` owner beneath the world bundle-load path, and the later post-load `319` lane now
uses `0x00491c20` as a dedicated collection-wide refresh pass that re-enters `0x00539640` on
every live route entry. That keeps the route-entry visual or presentation side grounded as a real
sibling strip to the search and regrouping code, not loose per-caller scratch fields.
angle-delta checks, and `math_abs_double_with_crt_special_case_handling` `0x005a152e` for the
absolute-value side of the quality gates. Current evidence also bounds the threshold shape a
little more tightly: the initial sweep and later extension path both reuse one signed angle-bias
term `+/-0.181000038854627`, and the first sweep switches between a looser `1.4` and stricter
`1.8` quality multiplier depending on route-policy byte `4` or the broader display-runtime
preference `[0x006cec78+0x4c74]`, already grounded elsewhere as `Auto-Show Grade During Track
Lay`.
The small policy-byte semantics are still not fully closed, but current evidence is tighter than
before. Literal byte `1` is now the strongest current match for direct linked-site
endpoint-anchor creation or replacement, because the linked-site constructor and neighboring
repair branches around `0x00480463`, `0x00480a77`, and `0x00480b69` all feed that byte into
`0x00493cf0` before rebinding one chosen route-entry anchor through `0x0048abc0`. Literal byte
`2` now looks broader: the later world-side caller at `0x00480cd0` and the linked-site refresh
helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` both
reach `0x004a01a0` with both optional endpoint-entry ids unset and that byte, so the strongest
current read is a full linked-site route-anchor rebuild between optional endpoint entries rather
than the narrower direct creation lane. The TrackLay side now gives one tighter user-facing
anchor too: the live mode field `0x00622b0c` is already grounded as `Lay single track.` `0x1`
versus `Lay double track.` `0x4`, and the small mapper `0x004955b0` collapses that state into
the endpoint-policy bytes later passed to `0x00493cf0`, so the strongest current read is
`policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`.
Bytes `1/2` are still the ones that enable the
auxiliary tracker lane in `0x004a01a0`, while byte `4` now reads more narrowly as the larger
company-side endpoint-synthesis charge inside `0x00493cf0`, because that helper feeds `-1`
versus `-2` into the saturating company counter helper `0x00423ec0` on `[company+0x7680]`
rather than skipping the company branch entirely. That counter is tighter now too: nearby
company initialization seeds it to `50` when scenario byte `0x4aaf` is enabled and to sentinel
`-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed
fallback `29999`. Current language-table correlation also gives `0x4aaf` a stronger
player-facing meaning: it is the live gate behind `Company track laying is limited...` and the
event variable label `Company Track Pieces Buildable`. So the current strongest read is
available track-laying capacity, not an abstract company route-budget. That site-side helper
also closes one adjacent ownership gap: beneath
`placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, it rebuilds
one linked site's route-entry anchor and display-name buffer. That path is tighter now than just
“bind anchor then touch `0x006cfcb4`”: after the literal-policy-`2` rebuild succeeds it
re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`,
which can now be described more concretely. Its early prepass at `0x004a4380` can split one
mismatching adjacent subchain into a fresh tracker group; its later helper at `0x004a4ce0` can
transfer one compatible adjacent chain between neighboring groups; and the repair-side helper at
`0x004a4ff0` can reseed a whole route-entry component into a fresh tracker when the old group id
is missing or invalid. The regrouping pass also still rewrites compatible endpoint slots through
`0x004950f0` and refreshes one nearby cached-match payload band through `0x00495020` before the
helper resumes the name-buffer work. The remaining display-name side still matches the earlier
grounded text family: copy the resolved city name when available, append civic suffixes
`Township`, `New`, `Modern`, or `Renaissance`, append `Service Tower` or `Maintenance Facility`
on the linked-instance class branches, and otherwise fall back through the older
`Junction`..`Center` and `Anytown` text families.
The higher owner-refresh side of that same tracker family is tighter now too. The reusable gate
at `0x004a4c00` no longer looks like a stray predicate: it explicitly requires both route-entry
trackers to keep matching cached fields `+0x18/+0x1c/+0x1d/+0x1e` and both route entries to keep
their special side fields `+0x20e/+0x222` unset before adjacent-chain transfer is allowed. The
collection-wide traversal sweep at `0x004a5fc0` is bounded now as the connected-component refresh
owner over tracker field `+0x0c`, with a temporary queue at `[this+0x94]` and direct fallback
into the reseed helper `0x004a4ff0` whenever one neighboring route entry has lost valid tracker
ownership. Above both of those sits `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links`
`0x004a6360`, which now reads as the owner-side latch-change refresher invoked from
`0x00494fb0`: it starts from one owner route-entry id, confirms both bound endpoint entries agree
on the boolean class state implied by route-entry byte `+0x44`, and then probes both endpoint
sides for adjacent route-entry groups that can be absorbed through the `0x004a4c00 -> 0x004a4ce0`
gate-and-transfer pair. The sibling query side is bounded now too:
`aux_route_entry_tracker_collection_query_component_label_by_tracker_id` `0x004a6320` is the
dirty-aware accessor for tracker field `+0x0c`, while
`aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` is the remaining
mode-switched lower metric dispatcher beneath the heavier chooser at `0x004a6630`, forwarding
fixed route-entry-pair candidate sets into either `0x004a5280` or `0x004a5900` depending on the
shared hundredths-scaled build-version query
`runtime_query_hundredths_scaled_build_version` `0x00482e00` over `0x006cec74`. The current
caller thresholds `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` now line up with executable
build values `1.03`, `1.04`, `1.05`, and `1.06`, and the version source itself can come from
the multiplayer companion path as well as the local executable, so this split is no longer
best-read as a time- or era-side cutover at all. It now reads more cleanly as a pre-`1.03`
versus `1.03+` route-metric compatibility dispatcher. That lower split is tighter now too:
`0x004a5280` is the weighted recursive branch with heuristic ordering, per-tracker best-cost
cache `0x006cfcac`, and prune threshold `0x006cfcb0`, while `0x004a5900` is the alternate
recursive neighbor-walk branch that stays within compatible component labels through
`0x004a62c0` and accumulates step and mismatch penalties over route-entry links
`+0x206/+0x20a/+0x20e`. Above both of them,
`aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks`
`0x004a6630` is now bounded as the real chooser: direct fixed-pair query when both entries pass
`0x0048b870`, otherwise endpoint-pair fallback across the two tracker groups.
The adjacent route-style rebuild side is tighter now too: the same build-version family reaches
`placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0`, where build
`1.04+` keeps one `Recycling Plant` stem-specific compatibility branch alive and build `1.05+`
skips one older descriptor-side attenuation fallback. There is also one neighboring world-side
compatibility lane now bounded below the same family: `placed_structure_collect_connected_component_tile_bounds_with_version_gate`
`0x004160c0` skips one older recursive component-bounds walk through `0x00415f20` on build
`1.03+` when scenario field `[0x006cec78+0x46c38]` is already active. The wrapper above that
path is bounded now too: `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh`
`0x00416170` walks the caller rectangle, maps tile keys into the component table rooted at
`0x0062ba7c`, and only re-enters `0x004160c0` when the current owner still has no cached bounds
and the local world or scenario suppressors stay clear. The higher neighboring raster side is
tighter too. `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610` is the
shared projected-rectangle helper above `world_grid_refresh_flagged_region_float_extrema_and_mean`
`0x00415020`: it refreshes the temporary sample band at `0x0062b7d0`, publishes the surviving
rectangle through `0x0044d410`, and on the single-sample path re-enters
`world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` to flip mask bit
`0x01` for the corresponding non-sentinel cells. Current grounded callers for `0x00418610` are
the neighboring placed-structure local-runtime helper `0x00418be0` and the heavier placement
validator `0x004197e0`, so this adjacent family now reads more like projected placement or local
raster prep than an unowned generic world-grid scan. One neighboring caller into the same
height-support band is tighter now too: the world-side branch at `0x00419070..0x004190f0`
walks one admitted local window, dispatches the acceptance-gated relaxer `0x0044d6e0` once per
cell with a one-cell radius and no immediate tail refresh, and only after that outer loop
completes re-enters `0x0044d410` on the full surviving rectangle. The higher owner split is
tighter now too.
`placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch`
`0x00418be0` is the broader construction or rebuild lane: resolve one candidate id from a stem,
build projected scratch through `0x00416ec0`, then publish the projected rectangle and validate
its side windows through `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows`
`0x00416620`. That publish pass is bounded now too: it stages `0x0062b308/0x0062b30c/0x0062b310`,
validates the rectangle against route-entry coverage through
`route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, can branch into
the special projected-slot picker `placed_structure_try_select_projected_rect_profile_slot`
`0x00415570`, and refreshes the compact per-cell side tables through
`world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` before the
finished scratch is copied into one queued runtime record and the new record re-enters
`0x00416170` when its rectangle is valid. The smaller sibling
`0x00419200` is now bounded beneath that same projected-rectangle family too: it is the tiny
getter over the temporary dword cell-value bank at `0x0062b300`, flattening one caller cell
through live world width `[0x0062c120+0x2155]` and returning the corresponding dword when the
bank exists, else `0`. Current grounded caller is the later world-side branch at `0x0048af99`.
The smaller sibling
`placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds`
`0x00418a60` now reads as the current-subject clone path above the same connected-component and
mask-refresh helpers, returning the cloned local runtime record later stored into `[site+0x24e]`
by `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem`
`0x0040e450`. The higher wrapper above that clone path is bounded now too:
`placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`
first drains the temporary site-id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` through
`placed_structure_local_runtime_site_id_queue_count` `0x00414480` and
`placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`, rebuilding one cloned
local-runtime record per queued placed structure through `0x0040e450`, and only then sweeps all
live placed structures through the side refresh helper
`placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10`.
The constructor or ownership split beneath that family is tighter now too. The shared allocator
`placed_structure_collection_allocate_and_construct_entry` `0x004134d0` no longer just reaches
an anonymous `0x3e1`-byte scratch object: it first constructs one concrete placed-structure
specialization through `placed_structure_construct_concrete_specialization_vtable_5c8c50`
`0x0040c950`, which calls `0x0045b680` to seed the common base table `0x005cb4c0`, clear the
derived field band `[this+0x23a..+0x26a]`, and re-enter the older base initializer
`0x00455610`, then installs the specialization table `0x005c8c50`. The paired cleanup path at
`0x0040c970` now reads like the matching teardown thunk: it briefly reinstalls `0x005c8c50`,
then immediately demotes the record back to the base table through `0x0045b040 ->
0x00455650` before the stack object is freed or unwound. The corresponding serializer entry
`0x0040c980` is equally tight now: it simply tails into `0x0045b560`, which first re-enters the
base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1` and
`0x5dc2` over `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`.
One nearby string clue is useful but narrower than it first looked. The specialization table at
`0x005c8c50` is immediately followed by `RadioStation` and `Radio Station`, but the local member
method `0x0040ce60` now shows why: it compares site stem `[this+0x3ae]` against `Radio Station`,
canonicalizes that stem to `RadioStation` on match, and then re-enters `0x0040cd70` plus
`0x0045c150`. So those adjacent strings ground one stem-normalization lane inside the
specialization, not the specialization name by themselves. The small virtual-slot and cached-id
side is tighter now too. The same `0x005c8c50` table carries three literal-false stubs
`0x0040cc10/0x0040cc20/0x0040cc30`, one literal-true stub `0x0040ccc0`, and the narrower
linked-site-id presence predicate `0x0040ccb0`, which simply returns whether `[this+0x2a8]` is
nonzero. Beneath the stem-normalization path, `0x0040cd70` is now bounded as the common cached
source/candidate resolver: it clears `[this+0x3cc]` and `[this+0x3d0]`, scans source collection
`0x0062b2fc` for a stem match against `[this+0x3ae]`, stores the matched source id into
`[this+0x3cc]` plus the linked candidate/profile id from `[source+0x173]` into `[this+0x3d0]`,
and when no match exists formats localized id `0x00ad` through `0x0051e980` with the current
stem buffer. That warning path is tighter now too: `0x0051e980` is the guarded warning-modal
publisher that forces cursor visibility through `MouseCursor.cpp` before showing the shared
warning box. The two tiny followers `0x0040cec0` and `0x0040cee0` then resolve those cached ids
back into concrete source and candidate records through `0x0062b2fc` and `0x0062b268`
respectively. The derived payload and transient family under that same table is tighter now too.
`0x0045c150` is the clear payload-loader
counterpart to `0x0045b560`: it reinitializes the derived field band, opens the `0x5dc1/0x5dc2`
payload bracket, restores the two payload strings into `[this+0x23e]` and `[this+0x242]`, clears
the transient roots `[this+0x24e]`, `[this+0x256]`, `[this+0x25a]`, and `[this+0x25e]`, and then
rebuilds follow-on specialization state through `0x0045b5f0` and `0x0045b6f0`. The neighboring
builder pair is coherent too: `0x0045b210` formats `amb_%1_01.wav`, allocates a `0x141`-byte
transient object, stores it at `[this+0x24a]`, and registers it through `0x0052da00`, while
`0x0045c310` allocates the separate primary transient handle at `[this+0x246]` from payload
strings `[this+0x23e]` and `[this+0x242]`, then publishes it through `0x00530720` and
`0x0052d8a0`. The next rebuild layer is tighter now too. `0x0045b5f0` resolves one current
world-position tuple through `0x0052e720 -> 0x0051f090 -> 0x00534490`, then uses that derived
scalar to refresh the ambient-side transient again through `0x0045b210`. Above that,
`0x0045b6f0` clears the optional handles at `[this+0x25a]` and `[this+0x25e]`, then probes and
materializes a larger named variant family rooted in `[this+0x23e]` through strings such as
`%1_`, `%1_Upgrade1`, `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and
`%1_Upgrade1Light%2.3dp`, looping across numbered variants and publishing surviving records
through `0x0052d8a0`. One higher timed branch is bounded now too: `0x0045baf0` advances the two
timer-like fields `[this+0x26a]` and `[this+0x266]`, gates on nearby world-distance and
candidate-side checks, and then formats one output around `rnd_%1_%2.wav` plus the same anim or
light string family before dispatching through `0x00531e50` under owner `0x006d402c`. Their
release-side companions `0x0045b160` and `0x0045c3c0` tear down those same transient roots and
payload strings again, and the recurring service slice `0x0045be50` updates the derived scalar
triplet `[this+0x22e]`, `[this+0x232]`, and `[this+0x236]` before republishing it through
`0x00530720`. The string literals `amb_%1_01.wav`, `%1_Anim%2.3dp`,
`%1_Upgrade1Anim%2.3dp`, `%1_Upgrade1Light%2.3dp`, and `rnd_%1_%2.wav` therefore ground the
derived band `[this+0x23e..+0x26a]` as one payload-plus-transient owner family with ambient,
animation, light, and random-sound components, rather than more linked-site or route-entry ids.
One broader specialization-side build pass under that same family is bounded now too.
`0x0045b760` first scans one base-or-upgrade descriptor family rooted in `[this+0x23e]`
through `%1_` or `%1_Upgrade1`, probing each numbered hit through `0x0053c930` and dispatching
every accepted one through vtable slot `+0x7c`. It then builds the matching attached-emitter list
through `0x0045e940`, ensures the shared `%1_Anim.3dp` payload root exists through `0x0045ae80`,
and finally scans the paired animation family through `%1_Anim%2.3dp` or
`%1_Upgrade1Anim%2.3dp`, materializing each accepted hit into a `0x206` record through
`0x00530640`, publishing that record through `0x0052d8a0`, hashing the generated name through
`0x0053d810`, and forwarding the result into `[this+0x256]` through `0x0045a7f0`. So that
specialization side now has one explicit base-or-upgrade descriptor and animation-record build
pass above the later timed anim/light/random-sound service slice, not just the narrower
`%1_Anim` and `%1_Upgrade1Light` helpers.
The shared `%1_Anim.3dp` collection under that build pass is tighter now too. `0x0045ae80`
formats literal `%1_Anim.3dp`, probes the named-bank owner `0x006d4020`, reads the matched
payload bytes, and lazily allocates the intrusive shared list root `0x006acd5c`, so this is the
bootstrap for the specialization-side shared animation payload family rather than just another
bank-read leaf. `0x0045a7f0` then acts as the keyed replace-or-publish helper over that same
family: it rewrites matching keys across the current `0x006acd50/0x006acd4c` row collection,
mirrors the replacement into the per-row four-lane pointer bands, inserts newly active rows into
the intrusive list rooted at `0x006acd5c`, and when selector table `0x006acd44` is live it
allocates one selector-`0` effect slot through `0x00475ed0` before forwarding it into
`0x00475240(-1,0)`. The smaller helper `0x0045a700` is the keyed three-float accumulator beneath
that same path: it scans the live `0x168`-byte rows in `0x006acd50`, filters on one key dword
plus row flag bit `0x400`, and accumulates one output anchor delta from the shared basis bands in
`0x006acd4c+0x04/+0x34` or `+0x40/+0x70`. The service side above the collection is also bounded:
`0x0045af50` clears globals `0x006acd44/48/54`, publishes the current row collection into
`0x006acd50/0x006acd4c`, releases oversize selector roots through `0x00475100`, and prunes every
intrusive active record in `0x006acd5c` whose owner pointer at `[record+0xf0]` matches the
current collection owner. The heavier per-record body is `0x0045a9c0`: it honors the current
controller gates in `0x006acd48/58`, clears and re-arms the selected effect-slot band in
`0x006acd44`, optionally mirrors one caller dword into row field `[row+0x80]`, updates timing and
mode fields across every matching shared row, derives local scalar deltas through `0x0045a280`,
optionally subtracts keyed anchor deltas through `0x0045a700`, and republishes the finished two
owner triplets through `0x0052e8b0` and `0x00530720`.
`0x0045ade0` seeds cursor `0x006acd60` from `[0x006cec78+0x15]`, then services the intrusive
list in `0x0f`-tick windows by dispatching the heavier per-record body at `0x0045a9c0(owner,
cursor, 0)` for every linked record whose owner pointer at `[record+0xf0]` is live. So the
specialization transient family now includes a concrete shared `%1_Anim.3dp` payload root,
keyed record replacement, keyed anchor accumulation, and a bounded 15-tick shared service loop,
not just the base builder at `0x0045b760`.
The low-side leaves under that same family are tighter now too. `0x0045b050` is the explicit
field reset for payload roots `[this+0x23e/+0x242]`, transient handles `[this+0x246/+0x24a/+0x24e]`,
selector slot `[this+0x262] = -1`, timer fields `[this+0x266/+0x26a]`, and the packed flag band
`[this+0x23a..+0x23d]`, with an optional tail into `0x00455610` when the caller requests a
broader base clear. `0x0045b0b0` is the paired integer-triplet publish leaf: it forwards one
caller triplet through `0x0052e680` on the specialization owner and, when present, repeats that
same publish into the primary transient `[this+0x246]`. `0x0045b0f0` is the neighboring packed
RGB-triplet forwarder into vtable slot `+0x58`. The two tiny wrappers around them are now
explicit too: `0x0045b040` demotes the specialization straight back to base vtable `0x005cb4c0`
before tailing into the common cleanup body `0x00455650`, while `0x0045b110` is just the direct
wrapper into the shared world-anchor triplet publisher `0x00455660`.
One intermediate transient build layer is bounded now too. `0x0040cf00` first requires
creation-mode byte `[this+0x3d4] == 1` and live seed handle `[this+0x24e]`, re-enters
`0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`,
`[this+0x21]`, `[this+0x3a]`, and `0x005c8cf4`, and then allocates a second transient handle
into `[this+0x25a]` through `0x00475ed0`. It follows that with one current world-position
resolve through `0x00414450` and `0x0052e720`, several local offset-triplet writes through
`0x00475010`, and four numbered channel updates through `0x00475030` with selector ids `1..4`.
That is enough to bound it as another specialization-side transient-handle builder beneath the
same payload family as `0x0045c310` and `0x0045b210`, without yet over-naming the user-facing
subtype or effect semantics of the built handle. The adjacent data-loading strip under that same
transient family is tighter now too. `0x00474700` reloads `particles.dat` into global root
`0x006cea5c` and then registers literal `ParticlesTexture` through owner `0x006d4030`;
`0x00474790` reloads `emitters.dat` into global root `0x006cea60`; `0x00474820` hashes one
caller-supplied emitter name and resolves the first matching entry out of that `emitters.dat`
table; `0x00474860` is the adjacent formatted-variant iterator that walks the same table through
`%s%s%i.3dp`, saving the selected row root into `0x006cea90` and the generated variant name into
`0x006cea94`; `0x00474970` is the small handle-array release helper used by the same
emitter-template teardown side; and `0x004749a0` is the tiny exact-compare predicate for literal
`steam`. The lower definition-to-handle materialization body is bounded now too: `0x004749d0`
copies scaled float and packed dword bands from one emitter-definition row into the attached
emitter handle, resolves the named particle row from `particles.dat` through `0x0053d810`, and
mirrors that particle row into `[handle+0x10c..]` before returning the live handle. The
higher creator above that materializer is tighter now too: `0x00474e20` first strips special
high bits for `CargoMoney_DollarSign`, clears incoming flag `0x400` when definition gate
`[def+0xb8]` is zero, and then either hashes the definition name plus owner token and clones one
owner-side template through `0x00556ce0`, or allocates a fresh `0x1fd` runtime emitter through
`0x00556920` before re-entering `0x004749d0`. On success it publishes that emitter through
`0x0052d950`, stores the definition owner pointer into `[emitter+0x60]`, and when final flags
carry `0x02000000` it forces persistent flag dword `[emitter+0xbc] = 1`. One larger owner-stem
branch above that iterator is bounded now too: `0x0045e940` rejects `Stadium`, clears caller flag
bit `0x10` for `ParticleCar`, repeatedly pulls formatted variants through `0x00474860`,
instantiates each accepted variant through `0x00474e20`, sets emitter flag `0x02` for
`Nuclear`, and optionally returns the created emitter list through the caller array. So the
`0x00474e20/0x00475010/0x00475030` emitter builders are now sitting on top of a grounded pair
of particle and emitter data tables plus one concrete owner-stem-driven variant-list builder,
not just anonymous global payload roots. The small shared slot utilities
under those builders are tighter now too: `0x00474fe0` is the shared per-slot flag broadcast
into `[emitter+0xbc]`; `0x00475010` caches one shared anchor
triplet into globals `0x006cea68/0x006cea6c/0x006cea70`, `0x00475030` republishes that cached
triplet into either all emitters in one slot container or one selected emitter index at
`[emitter+0x1b0..+0x1b8]`, `0x00475240` toggles the per-emitter enable byte `[emitter+0x1d8]`
for either all or one selected emitter, and `0x004752b0` is the paired boolean query that
reports true only when that same byte is zero. The update side is explicit too: `0x00474f70`
runs `0x00555e50(0)` across either one supplied slot container or every slot in the global linked
list rooted at `0x006cea74`. The release side is explicit too: `0x00475100`
tears emitter slots down, optionally unlinks them from the global active list
`0x006cea74/0x006cea78/0x006cea7c`, and then either recycles or frees the slot depending on
whether it falls inside the pooled descriptor rooted at `0x006cea58`. Two named bundle builders
are grounded now too: `0x004752d0` builds the three-emitter `BrokenDown_Steam` +
`FlamespoutB` + `Crash_SmokeA` bundle, while `0x00475550` builds the two-emitter
`BrokenDown_Steam` + `BrokenDown_Smoke` bundle. The next owner layer above those helpers is
grounded now too. `0x00474ce0` is the global particle/emitter bootstrap: it reloads
`emitters.dat`, reloads `particles.dat`, publishes the mode-`1` ratio labels through
`0x00474690`, lazily allocates pooled slot root `0x006cea58`, allocates backing slab
`0x006cea54`, seeds that slab into the pooled descriptor through `0x0053dcf0(0x38, 0x2710, 1)`,
clears the global linked-slot heads and shared anchor globals, rebuilds the flagged templates
through `0x00474c60`, and finally publishes enable-state `1` through owner `0x006d4030`.
`0x00474db0` is the teardown-side companion that frees `0x006cea54`, `0x006cea5c`,
`0x006cea60`, and then resets and frees the pooled slot root `0x006cea58`. That makes the
effect-slot builders a real subsystem rooted at `0x006cea54..0x006cea98`, not just a loose
string-and-handle utility strip. The named bundle surface is broader now too: `0x00475420`
selects one `Volcano_BlackSmoke*` + `Volcano_Lava*` pair from the caller float tier
`0.5/0.75/1.0/1.5/2.0` and builds the two-emitter volcano bundle; `0x00475650` builds the
three-emitter `ServiceTower_Water2` + `ServiceTower_Water` + `ServiceTower_Water3` water bundle
from the paired `ServiceTower_Anim2#water.3dp`, `ServiceTower_Anim3#water.3dp`, and
`ServiceTower_Anim4#water.3dp` definitions; `0x004757b0` builds the three-emitter
`Rocket_Flame` + `Rocket_Smoke` + `Rocket_Sparkle` fireworks bundle from the paired
`Fireworks_Anim2/3/4#water.3dp` definitions; `0x00475910` is the adjacent randomized
one-emitter fireworks builder that rotates among `Fireworks1/2/3`, uses
`Fireworks_Anim5#water.3dp`, and writes fixed dword `0x3c` into `[emitter+0xbc]`;
`0x004759f0` and `0x00475b30` build the one-emitter `CargoMoney_DollarSign` and
`SpendMoney_DollarSign` bundles; `0x00475a90` builds the one-emitter `SelectObject` bundle;
`0x00475bd0` builds the five-emitter directional construction bundle from `Construct_Pos`,
`Construct_Left`, `Construct_Right`, `Construct_Back`, and `Construct_Forward`; `0x00475dc0`
selects between one-emitter `Mist` and `MistSmall`; and `0x00475e30` builds the one-emitter
`Vent` bundle. The next local owner above that catalog is grounded too: `0x00475ed0` is the
selector-driven named-bundle dispatcher that chooses one of those builders from the caller
selector, mirrors the first emitter's attachment token into `[slot+0x04]`, stores caller mode
into `[slot+0x34]`, and when that mode equals `1` links the finished slot into the global active
list `0x006cea74/0x006cea78/0x006cea7c`. So that specialization-side transient path now has a
much broader data-backed effect catalog and a concrete selector-driven bundle owner above it, not
just the earlier broken-down bundles.
One adjacent train-side effect strip is bounded now too, and it should stay separate from the
concrete placed-structure specialization family. `0x0045d130` resolves one owner profile
through `0x006ada84`, allocates a `0x141`-byte handle, initializes it through `0x00554830`
using one mode-selected train sound stem from the tiny selector at `0x0045d22e`, applies two
fixed parameter writes through `0x00554340` and `0x00554450`, stores the result at `[this+0x336]`,
and registers it through `0x0052da00`. `0x0045d260` is the paired live-handle updater: it clamps
one caller-scaled rate into `0x1f40..0xac44`, forwards that through `0x005542c0`, pushes the
caller gain through `0x00554450`, and when the current handle mode at `[handle+0x138]` equals
`1` also forwards zero through `0x005543f0`. The broader owner above both helpers is
`0x0045d2e0`: it republishes the current world anchor through `0x0052e720`, updates an existing
live sound handle at `[this+0x346]` when one exists, or otherwise selects one new sound stem from
fixed `Train_Burning.wav`, fixed `Train_Breakdown_loop.wav`, or one dynamic table-driven name
after the `0x0041b8f0 -> 0x004a8840` branch, then creates the fresh sound handle through
`0x00531e50`, stores it at `[this+0x346]`, sets fixed flag bits `0x18`, seeds two scale fields
from the chosen mode factor, and clears the three train-state latches `[this+0x33a/+0x33e/+0x342]`
again. So the neighboring `0x0045d130/0x0045d260/0x0045d2e0` family is now bounded as a
train breakdown-or-burning sound/effect handle strip rather than more placed-structure emitter
state.
The larger owner above that train-side strip is bounded now too. `0x0045d4b0` optionally clears
prior state through `0x00455610`, copies the caller primary and secondary stems into
`[this+0x32e]` and `[this+0x332]`, probes the named-bank owner `0x006d4020` for the secondary
stem, then falls back through the primary stem and the suffixed `_C.tga` form. It resolves one
`ServicePoint.3dp` payload into `[this+0x23e/+0x23a]`, one `Body.3dp` payload into
`[this+0x242/+0x246]`, counts existing `%1_Truck%2.3dp` variants into `[this+0x31a]`, allocates
the larger per-variant table at `[this+0x316]`, and then enters the later subloops that fill the
cargo-icon, bogie, drivewheel, piston, connecting-rod, coupling-bar, body, and track-point
bands. That keeps the `0x0045d130/0x0045d260/0x0045d2e0` sound helpers nested under a broader
train visual/profile preload owner rather than floating as an isolated sound-only strip.
The release and load sides of that same train family are bounded now too. `0x0045e390` drops the
optional sound handle `[this+0x346]` through `0x00531ef0` plus the mode-gated `0x005317b0` path,
clears the live train-effect handle root `[this+0x336]` by re-entering `0x0045cc90(0)` and
`0x0045cf40(0)`, iterates the variant table at `[this+0x316]` to free per-row pointer arrays,
two heap buffers, and any nested owned list rooted at `[row+0x0c]->[+0x75]`, then frees the main
table and the two payload strings `[this+0x32e]` and `[this+0x332]`. `0x0045e530` is the
load-side owner: it opens tags `0x61a9` and `0x61aa`, reads two heap strings, optionally rewrites
the first string by scanning the live collection at `[0x006d4020+0x429b8]`, rebuilds the train
visual family through `0x0045d4b0` with unit scale, republishes the early per-row handles through
`0x005548d0`, and under scenario latch `[0x006cec78+0x46c34] > 0x2585` also enters the optional
child-record branch under tag `0x61b2` before closing `0x61ab`. That makes the train-side strip a
real payload-owned family with explicit preload, service, load, and teardown phases rather than a
one-off visual helper.
Two shared selector-slot toggles under that same family are bounded now too. `0x0045cc90` owns
the three selector-driven effect slots at `[table+0x34]`, `[table+0x38]`, and `[table+0x3c]`:
in build mode it allocates selectors `1`, `2`, and `3` through `0x00475ed0`, reseeds their
shared anchors through `0x00475010/0x00475030`, and then enables every live emitter in the main
row-object list by writing byte `1` into `[emitter+0x1d8]`; in release mode it tears those same
three slots down through `0x00475100`, clears the table fields again, and disables the same
emitter list by writing byte `0`. `0x0045cf40` is the same pattern for selector `5` into
`[table+0x40]`. So the train visual family now has one explicit selector-slot toggle layer above
the named `0x00475ed0` bundle catalog, rather than touching those effect slots only through the
broader load and teardown owners.
One smaller service leaf under that same family is grounded now too. `0x0045e8c0` walks the
fixed 32-entry row-object strip rooted at `[this+0x277]` and dispatches vtable slot `+0x10` on
every live row object. When the caller supplies a valid selected row index instead of `-1`, it
re-enters that selected row through vtable slot `+0x0c`, and when the paired per-row flag byte in
the neighboring strip is nonzero it also pushes `0,0,1.0f,1.0f` through `0x0052eab0` on that
selected row object. The current grounded callers at `0x0041c680` and `0x0041c69a` derive the
selected row from byte `[cargo+0x20]`, so this is best read as the row-object service plus
selected-entry refresh leaf under the train visual family, not a generic object-list sweep.
One adjacent helper block is tighter now too, and it should stay separate from the concrete
`0x005c8c50` vtable rather than being folded into it. The small predicates
`0x0040cc40/0x0040cc60/0x0040cc80` all follow the same `[this+0x173] -> 0x0062b268` chain into
one linked candidate/profile record. `0x0040cc40` returns whether candidate subtype byte
`[candidate+0x32]` equals `1`, `0x0040cc60` returns raw candidate byte `[candidate+0xba]`, and
`0x0040cc80` returns the stricter conjunction `subtype == 1 && class == 3` using class byte
`[candidate+0x8c]`. The current grounded caller for all three is
`world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where they derive
the two boolean mode inputs for `0x00415020`; that makes them a shared candidate-profile helper
cluster adjacent to the specialization family, not direct overrides in the `0x005c8c50` table.
The neighboring `0x0040ccf0` stays on the same “adjacent but not the same vtable” side of the
boundary: it resolves one linked instance through `0x0047de00`, follows that instance's vtable
`+0x80` owner chain, and returns candidate class byte `[candidate+0x8c]`. Current grounded
callers at `0x00480fb5` and `0x004b03ce` compare that returned class against `3` and `4`, so the
current safest note is simply “linked-instance candidate-class reader.” One gated collection-side
scan in the same neighborhood is bounded now too. `0x0040cd10` first requires shell latch
`[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current
subject's center world-grid cell through `0x00455f60`, reads the local site roster count and id
list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through
`0x006cec20`. Its current grounded caller is the broader collection sweep at `0x00413860`, so
the strongest current read is a gated center-cell site-roster scan rather than one more direct
specialization override.
One small neighboring world-grid helper is grounded cleanly enough to keep too. `0x0040ccd0`
takes one live world root, one X-like index, and one Y-like index, multiplies the Y-like term by
world width `[world+0x2145]`, adds the X-like term, scales the resulting slot by fixed cell
stride `0x1d7`, and returns the corresponding cell pointer under base `[world+0x2129]`. Current
grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386` and
several world-grid overlay passes in the `0x004525bc..0x00452bb2` range, so that helper is now
best read as the shared `(x,y) -> world-cell*` resolver rather than another object-specific
method.
The next sibling table at `0x005c9750` is tighter now too, though still not fully decoded. The
structural anchor is `map_load_city_database` `0x00474610`: that loader stages bundle tags
`0x61a9..0x61ab`, iterates one collection, and dispatches each entry through vtable slot `+0x44`.
In `0x005c9750`, that same slot resolves into the sibling record family beside
`0x0041ab70/0x0041ab80`, which is enough to treat the table as the city-database entry family
rather than a generic unresolved runtime object. The small load-side slot `0x0041ab70` simply
jumps into `0x0045c6f0`, which restores two strings into `[this+0x32e]` and `[this+0x332]`,
stages the same `0x61a9/0x61aa/0x61ab` tag family, and iterates the child runtime band rooted at
`[this+0x316]`. The one real behavioral slot we recovered there is `0x0041ab80`: it refreshes
one named handle through owner `0x006d4020`, writes the resulting handle into `[this+0x1c]`,
queries three base floats through `0x0045c480`, and returns one scaled float derived from the
first queried component. That method is currently called from later world-side branches at
`0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantics of the handle and
the many constant-return virtuals in the same table are still open, but the family boundary is no
longer arbitrary: this is now the current city-database entry vtable cluster, not another
placed-structure specialization. One correction matters here too: the lower
`0x00455660/0x00455800/0x00455810/0x00455930` helpers are no longer city-only. Local `.rdata`
now shows the same shared slots under both the city-entry table `0x005c9750` and the sibling
`Infrastructure` table `0x005cfd00`, whose constructors at `0x0048a240/0x0048a2dc/0x00490a3c`
all re-enter `0x00455b20`, install `0x005cfd00`, and seed the same scalar-band family through
`0x00455b70` with the literal stem `Infrastructure`. So the safest current family name for those
low helpers is the broader `0x23a` runtime-object band rather than city-entry-only. `0x00455800`
and `0x00455810` are simply the paired normalized coordinate getters over `[this+0x1e2]` and
`[this+0x1ea]`, which explains why they recur all over the city-side, route-link, and
placed-structure placement code. The narrower helper `0x00455660` sits above those getters: it
scales the caller-supplied normalized coordinate pair, converts it through
`0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied integer height bias, optionally
rounds that height through `0x005a10d0` when the auxiliary-preview gate `0x00434050` is active,
and finally publishes the resulting world-anchor triplet through `0x00530720`. One
serializer-side sibling is bounded too. `0x00455930` queries two triplet-like scalar bands
through `0x0052e720` and `0x0052e880` and writes the resulting six dwords through `0x00531030`;
its load-side stream counterpart `0x00455870` reads the same six four-byte lanes back through
`0x00531150`, republishes the first triplet through `0x00530720`, republishes the second through
`0x0052e8b0`, and returns the summed byte count. The neighboring tagged string-triplet serializer
`0x004559d0` is now no longer reversed either: it writes bracket tags `0x55f1/0x55f2/0x55f3`
through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through
`0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before the closing
tag.
### Shared Runtime-Object and Support Families
The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` is the
common local-state reset that clears the list and handle roots, resets the string/scalar side
bands, preserves only selected low bits of `[this+0x20]`, and reseeds the recurring default
`1.0f` lanes; `0x0052ebd0/0x0052ec50` are the load/save companions for the two flag bits stored
in that same byte; `0x0052eb90` releases every entry hanging from list root `[this+0x79]`
through `0x00554d50`; and `0x0052eca0` is the grouped-table cursor over `[this+0x14]`,
`[this+0x21]`, and `[this+0x3a]` that returns the next `0x45`-byte subrecord in the current
group when one exists. The next shared initializer `0x0052edf0` then binds caller
pointer `[this+0x04]`, resolves optional handles into `[this+0x10]` and `[this+0x1c]`, copies
one anchor triplet into `[this+0x1e2/+0x1e6/+0x1ea]`, sets bit `0x08`, and seeds packed color
`[this+0x43] = 0x007f7f7f`; its release-side siblings `0x0052eeb0` and `0x0052ef10` clear the
two owned list roots `[this+0x79]` and `[this+0x7d]` through distinct per-entry destructors
before freeing the list roots themselves. The broader release body `0x0052ef70` sits above that
strip: it clears the active shell preview-owner latch when it still points at `this`, drops the
dependent handle at `[this+0x0c]`, recursively tears down the nested object list `[this+0x75]`,
clears sibling owned list `[this+0x81]`, detaches any world binding rooted at `[this+0x04/+0x08]`,
and finally frees the optional handles at `[this+0x10]` and `[this+0x1c]`. The next shared
dirty-bit helper `0x0052f120` is now bounded too: when byte `[this+0x20]` still carries bit
`0x02`, it rebuilds the cached 16-dword transform-style block at `[this+0x14e]` from scale
`[this+0x36]`, anchor triplet `[this+0x1e2/+0x1e6/+0x1ea]`, and either the live local vector
lanes `[this+0x4b/+0x4f/+0x53]` or the stored fallback block at `[this+0x18e]`, then flips the
dirty bit over to the cached-ready bit `0x04`. The next two adjacent helpers are bounded too:
`0x0052f1e0` is a pure five-vec3 boolean geometry predicate built from signed-volume or
separating-plane style tests, and `0x0052f370` is the quantized selector that rounds world
coordinates, folds them through table `0x006d9098`, samples one grouped metric through owner
`[this+0x04]`, updates byte `[this+0x5c]`, and then chooses the active `0x45`-byte subrecord by
storing index `[this+0x21]` and pointer `[this+0x18]`. The adjacent emission owner `0x0052f500`
is tighter now too: it starts from that selected grouped subrecord, snapshots the global packet
write pointer and remaining count at `0x00cc3b64/0x00cc3b5c`, optionally refreshes the cached
transform block and applies the five-vec3 predicate when state bit `0x01` is active, and then
emits the selected `0x45`-byte records into one run of `0x20`-byte output packets while
advancing the shared packet cursor. The next shared helpers under that emission band are now
bounded too. `0x0052fb70` is the packed-color propagation helper over `[this+0x43/+0x47]`: when
shell gate `[0x006d4024+0x114742]` is live it combines stored high-byte state with either dim
RGB `0x003c3c3c` or full-bright RGB `0x00ffffff`, pushes the same dim-or-bright triplet into the
child list `[this+0x75]` through `0x0052e680`, and optionally recurses that update over the whole
child tree; when the shell gate is absent it instead stores the raw byte into `[this+0x47]` and
only recurses that byte state. `0x0052fd60` then republishes current anchor triplet
`[this+0x1e2/+0x1e6/+0x1ea]` into every attached entry hanging from list root `[this+0x81]`
through `0x005545d0`. The heavier relocation sibling `0x0052fdc0` marks the object dirty, adds a
caller-supplied triplet delta to the same anchor, quantizes old and new X/Z lanes against the
live world grid, rebinds world handle `[this+0x08]` through `0x00533c20/0x00533bf0` when the
quantized cell changes, and on success re-enters `0x0052fd60`; out-of-bounds moves restore the
prior anchor and fail. One more adjacent rotation-side helper is now bounded too: `0x0052ffb0`
converts the current local 4-dword orientation block at `[this+0x1ce..+0x1da]` into a temporary
axis-angle representation, scales the recovered angle by the caller float, and rebuilds the
stored orientation block by re-entering `0x0052e9f0`. The immediate anchor-publish sibling
`0x00530720` is now explicit too: it is the absolute-triplet form of the same relocation family,
storing one caller-supplied anchor directly into `[this+0x1e2/+0x1e6/+0x1ea]`, optionally
rebinding world handle `[this+0x08]` when the quantized X/Z cell changes, and then re-entering
`0x0052fd60`. The adjacent packet-side query `0x00530030` is bounded as well: it starts from the
currently selected grouped `0x45`-byte subrecord, snapshots the same global packet source span as
`0x0052f500`, lazily refreshes cached basis lanes when needed, transforms one caller-supplied
input triplet through that basis, and then walks the remaining packet span until
`0x0052f1e0` reports one overlap or the span is exhausted. One sibling-table strip is now
explicit too. Table `0x005dd1f0` has the tiny wrappers `0x00530640`, `0x00530670`, and
`0x00530680` as its shared seeded-constructor, reset, and release thunks over `0x0052edf0`,
`0x0052ecd0`, and `0x0052ef70`, while `0x005305c0` is the small list-bit propagator that sets or
clears bit `0` in `[entry+0xb0]` across owned list `[this+0x79]`. The first heavier body under
that same table is now bounded too: `0x00530690` copies one pair of 16-dword cached blocks from a
source object into `[this+0x10e]` and `[this+0xce]`, refreshes local cached transform
`[this+0x14e]`, and recurses the same copy into child list `[this+0x75]`. The `Infrastructure`
side is tighter now too. The optional child
The next adjacent field-accessor strip is explicit too: `0x00533100/0x00533120` are the indexed
float set/get helpers for `[this+0x14e4 + index*4]`; `0x00533130/40`, `0x00533150/60`,
`0x00533170/80`, and `0x00533190/a0` are four direct dword set/get pairs over
`[this+0x1534]`, `[this+0x1540]`, `[this+0x153c]`, and `[this+0x1544]`; `0x005331b0/c0` are the
float set/get pair for `[this+0x14e0]`; and `0x005331d0` is the direct getter for `[this+0x1548]`.
The important caller-side grounding is narrow but real: `0x0052f370` samples one indexed float
through `0x00533120` while choosing the active grouped subrecord, and `shell_emit_ranked_overlay_cell_items`
`0x00524780` reads the current threshold pair through `0x00533160` and `0x00533180`. So this
strip is now bounded as a genuine shared field-accessor family under the same runtime-object
owner, even though the exact high-level meanings of those fields remain open.
attach helper `0x0048a1e0` allocates and seeds one fresh `Infrastructure` child and, when the
owner already has more than one child, clones the first child's two triplet bands into that new
child before attaching it. The looped rebuild `0x0048dd50` then rebuilds the owner-visible
`Infrastructure` children one ordinal at a time, tears down the higher extras above ordinal `5`,
refreshes cached primary-child slot `[this+0x248]` when needed, and finishes with the same
world-cell and route-side follow-on family around `0x00448a70`, `0x00493660`, and `0x0048b660`.
The smaller attach helper `0x00490a3c` is now bounded too: it conditionally allocates one
`Infrastructure` child from a caller-supplied payload stem, attaches it to the current owner, and
then seeds three caller-supplied position lanes through `0x00539530` and `0x0053a5b0`. The
direct route-entry side of the same family is no longer anonymous either: `0x0048e140`,
`0x0048e160`, and `0x0048e180` are the three direct resolvers over owner fields
`[this+0x206/+0x20a/+0x20e]` into the live route-entry collection `0x006cfca8`. Another shared
sibling family is tight enough now too: the real
packed-byte-triplet owner is `0x0052e680`, and the two local
wrappers `0x00455820` and `0x00455840` both force its recursion flag on. `0x00455820` forwards
three explicit byte arguments, while `0x00455840` unpacks one packed `u24`-style dword into
three byte lanes first. The downstream setter writes packed byte-triplet lane `[this+0x43]`,
defaults that lane to `0x007f7f7f` when all three bytes are zero, and when recursion is enabled
it walks child list `[this+0x75]` through `0x00556ef0/0x00556f00` and re-applies the same packed
update recursively to every child. The shared formatter thunk `0x00455860` is no longer a blind
jump target either: `0x00530820` now reads as the common group-selection status-label formatter
over the same `0x23a` family. It only answers when shell gate `[0x006d4024+0x1146be]` is live,
state bit `0x10` is clear, vtable slot `+0x14` says the current object should answer, and the
owned-entry bit propagator `0x005305c0` succeeds. Under that gate it formats one caller-owned
text buffer from either a fixed fallback block, a simple mode-`1` `X` or index form, or a
grouped-table form built from the current `0x45`-byte subrecord's float lane plus current index
`[this+0x21]`. The sibling `Infrastructure` table `0x005cfd00` also still carries three tiny
fixed-return slots after that shared formatter path: two return literal `0x46`, and one returns
fixed float `1.25f`, so those slots are now bounded as small table constants rather than as
missing behavior. One nearby global helper family is bounded enough too: `0x005309d0` lazily
clears and arms the indexed table rooted at `0x00ccb880`, `0x00530a00` services or releases one
slot in that table according to its local state dword, `0x00530b70/0x00530b90/0x00530c10` query
one slot's primary handle metric, primary handle, and payload-length lanes, and `0x00530ba0`
performs the release-side cleanup for one slot's owned buffers. Current callers are broad
enough that the table's exact resource type still stays open, but the init/service/query/cleanup
split is now grounded. The broader bundle or stream slot layer under that same table is bounded
now too: `0x00530c80` is the common open-or-reuse entry for named slots, `0x00531030` and
`0x00531150` are the shared write and read byte pumps, `0x00531340` and `0x00531360` are the
four-byte tagged-header wrappers used all over map, setup, world, and runtime bundle code, and
`0x00531380/0x00531410` are the shared variable-length heap-string load/save helpers built on
top of those byte pumps. The immediate neighbors are bounded too: `0x00531490` writes one raw
NUL-terminated string without the length prefix, `0x005314b0` is a callback-driven selector over
global `0x00ccba08`, and `0x00531500` is a small gate that only returns true when `[this+0x04]`
equals `1` and global `0x00ccb9f4` is nonnull. The next adjacent strip is now bounded
structurally too even though the owning subsystem is still open: `0x00531520..0x005317b0`
mostly share the inverse gate `[this+0x04] == 1 && 0x00ccb9f4 == 0`, then forward into one of
three global owners `0x00ccba00`, `0x00ccb9f8`, or `0x00ccb9fc`. The clearest member of that
strip is `0x005315c0`, a plain 3x4 affine point transform over three caller-supplied float
pointers. The rest are still best read as structural wrappers: `0x00531640` resolves the
zero-based index of the first callback-selected string matching the current `0x00ccb9fc` string
source, `0x005316d0` forwards one callback-selected entry pointer into `0x00569730`, and
`0x00531710/0x00531730/0x00531750/0x00531770/0x00531790/0x005317b0` are the small
mode-gated dispatch or query wrappers into the neighboring `0x5695..0x56ac..` family. The next
adjacent owner strip is bounded enough now too: `0x00531800/0x00531840` are the null-`0x00ccb9f4`
guarded call wrappers into `0x0056ae80(0x00ccb9f8)` and `0x00569cf0(0x00ccb9fc)` with scoped
reentrancy counter `0x00ccb9f0`; `0x00531880` releases optional handle `[this+0x4c]` through
two function-pointer calls when global `0x00624d58 == 1`; `0x005318b0` spin-waits for that same
reentrancy counter to drain; `0x005318c0` picks between owners `0x00ccb9f8` and `0x00ccb9fc`
from global selector `0x00ccba04`; and `0x005318f0` is the shared constructor that allocates
and initializes globals `0x00ccb9f8`, `0x00ccb9fc`, and `0x00ccba00`, then arms mode flag
`[this+0x04] = 1` when all three are live. The next owner block is no longer just a loose
cluster either: `0x00531a10` is the full teardown path for that same family, first raising
`0x00ccb9f4`, optionally fading scalar lanes `[0x00ccba00+0x104]` and `[0x00ccb9fc+0x58]`
through `0x00557d90/0x00569ae0/0x00569ca0` plus a `0x10`-tick sleep, then spin-waiting on
`0x005318b0`, releasing optional handle `[this+0x4c]`, shutting the three globals down, and
clearing `[this+0x04]` again. `0x00531c00` is the symmetric rebuild side: it force-calls
`0x00531a10(this,1)`, reconstructs the family through `0x005318f0`, and seeds the default live
state through `0x005696b0`, `0x00569660`, `0x00557d90`, `0x0056a8e0`, and `0x00569ae0` from
shell-owned scalars. The smaller strip between them is bounded structurally too: `0x00531d30`
refreshes the primary scalar and dispatches `0x00557e50`; `0x00531dc0` is the dual-scalar idle
predicate over `[0x00ccb9f8+0x20]` and `[0x00ccb9fc+0x58]`; `0x00531e50` is the string-driven
sibling of `0x00531e10`, tail-jumping into `0x0056a520` when the same family is ready; `0x00531e90`
stages one 16-dword local payload block into `[this+0x08..+0x44]` and forces
`[0x00ccb9fc+0x60] = 2`; `0x00531ed0` and `0x00531ef0` are the small active-mode field and
selected-hash-root queries; `0x00531f40` services `0x00ccb9f8/0x00ccb9fc` and clears staged flag
`[this+0x48]`; `0x00531f90` registers one of the guarded callbacks `0x00531800/0x00531840`; and
`0x00531fd0` is the timed primary-scalar transition service that coordinates `0x00ccba00` with
globals `0x00624d58/0x00624d60` under the same reentrancy counter `0x00ccb9f0`. The local
controller layer above that family is bounded now too: `0x00532150/0x00532200` are the
construct/destruct pair for the controller object itself, `0x00532230` rebuilds from one
callback-selected entry through `0x005314b0 -> 0x00531c00`, and `0x00532260` rebinds primary
handle `[this+0x4c]` while registering transition callback `0x00531fd0` and seeding selector
`[this+0x50]`. One other sibling table is bounded enough now
to keep separate too: local `.rdata` at `0x005c9a60` carries the same shared low `0x23a` slots
plus table-specific overrides `0x0041f680`, `0x0041f720`, `0x0041f7b0`, `0x0041f7e0`,
`0x0041f810`, and `0x0041f850`, with nearby literals `(%1)` and `Marker09`. The exact subtype
name behind that table is still open, but the behavior split is strong enough: `0x0041f680`
first refreshes the current global preview/helper owner through `0x00455de0` and then forwards
mode `1` plus handle `[this+0x23a]` into `0x004cf830`; `0x0041f720` formats `[this+0x356]`,
publishes the resulting shell text, and conditionally dispatches `0x00452fa0` with action
`0x12` when world state `[0x0062c120+0x2175]` is `0` or `0x15`; `0x0041f7b0` publishes one
fixed payload and only then jumps to `0x00453510` when that same world state is `0x12`. The
same table also has a tighter adjacent helper strip now: `0x0041f6a0` is the direct
`[this+0x37f] -> 0x00517cf0` slot-count query, `0x0041f6b0` is the rounded normalized-coordinate
world-scalar query above `0x0044afa0`, and that deeper helper is no longer opaque: it first
computes one distance-like term from the current cell to global preview-anchor fields
`[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`, samples the
companion float raster `[world+0x1605]` at the current cell plus two 8-direction rings, keeps
the strongest local rise above the center sample, adds one thresholded preview-scalar bias from
`[0x0062be68+0x20]`, and then adds `0x32` more when the small global gate `0x0041fff0` passes.
That gate itself now reads as a shared shell/preview threshold test: it returns true when
`[0x006cec74+0x2bb] == 2`, or when the same mode dword is merely nonzero and preview scalar
`[0x0062be68+0x20]` exceeds the float threshold at `0x005c9a9c`. `0x0041f6e0` resolves the
current center world-grid cell and checks one packed `u16` token through `0x0042b2d0`, and
`0x0041f6f0` is the raw byte getter over `[this+0x42]`. One nearby mode-gated flag reader is
bounded too: `0x0041f910` returns
literal `1` when shell mode gate `0x004338c0` is inactive or the object class dword
`[this+0x23e]` is nonzero, and only on the class-0 path does it return the same byte
`[this+0x42]`. That gate itself is tighter now too: `0x004338c0` is just the normalized boolean
wrapper over `0x004d4150`, which returns nonzero when the shell-side owner field at `0x006d07b4`
is live. The release side under that same sibling family is bounded too: `0x00420650`
lazily seeds `[this+0x317]` from shell-profile word `[0x006cec78+0x0d]` before re-entering
`0x00420350`, and that body is now bounded as the local scalar refresh over `[this+0x31b]`:
it compares the seeded word against the current shell-profile word, maps the delta through one
bounded piecewise float curve, and applies one extra affine adjustment when `[this+0x23e]` is
nonzero. `0x00420670` then frees the optional dynamic payload at
`[this+0x37f]`, clears the cached `u16` link chain through `0x0041f8d0`, and tails into base
cleanup `0x00455d20`; and the small collection-side wrapper `0x00421700` simply resolves one
entry id, re-enters `0x00420670`, and erases that id from the owning collection. The
city-entry family also now has one tighter
helper-object branch. `0x00474030`
switches over mode enum `0..10`, maps those cases into `0x00475ed0` with selector families
`4/0xd/0xe` and fixed scalar presets `0.5/0.75/1.0/1.5/2.0`, and on success publishes the
caller-supplied world triplet through `[helper+0x4]`. The refresh helper `0x00474260` first
reloads payload through `0x00455fc0`, then samples the current normalized coordinates plus one
world-height scalar from `0x00448bd0`, and rebuilds `[this+0x23a]` through that same
mode-selected helper builder using mode `[this+0x242]`. The surrounding collection-side and
teardown helpers are tight enough now too. `0x004743d0` and `0x00474400` are the two release
siblings over the same helper field `[this+0x23a]`: both destroy that helper through `0x00475100`
when live and clear the field, but `0x004743d0` tails into the smaller base cleanup
`0x00455650`, while `0x00474400` tails into the heavier dynamic-payload cleanup `0x00455d20`.
The small predicate `0x00474430` simply returns `1` unless shell mode gate `0x004338c0` is
active, in which case it returns byte `[this+0x42]`; the exact meaning of that flag byte is still
open, but the mode-gated query itself is bounded now. One level higher, `0x00474450` constructs
the collection rooted at vtable `0x005ce4a8` with fixed parameters `(0,0,0,0x14,0x0a,0,0)`, and
bootstrap caller `0x004487a9` stores that collection into global `0x006cea50`. The collection's
entry path is also bounded now: `0x004744a0` seeds a stack-local temporary entry through
`0x00474110`, allocates one `0x250`-byte live record, resolves it, constructs it through
`0x00474130`, and then tears the temporary entry down through `0x004743d0`; `0x00474510`
resolves one entry id, releases it through `0x00474400`, and removes it from the collection. The
collection-owned load loop at `0x00474540` sits directly beneath `map_load_city_database`
`0x00474610`: it opens the same `0x61a9/0x61aa/0x61ab` bracket on the caller-supplied bundle,
binds the selected path context, iterates the current collection, dispatches each record through
vtable slot `+0x40`, accumulates the returned byte counts, and tears down the temporary entry
after each record. That still leaves broader semantic questions open, but the current static edges
around the city-entry family are now largely exhausted. The adjacent scaffolding is bounded too.
Base helper `0x00455b20` initializes the shared `0x23a`-sized record family by installing base
vtable `0x005cb1c0`, clearing the scalar bands `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroing
the seven-dword block `[+0x212..+0x22a]`, and re-entering `0x0052ecd0`; that is why it shows up
not only in the city-entry temporary constructor `0x00474110`, but also in several later object
construction paths outside the city family. The city collection itself now has a bounded teardown
side too: `0x00474480` is the small release-and-free wrapper for the collection rooted at
`0x005ce4a8`, and teardown caller `0x004492c3` uses it before freeing the global collection
pointer at `0x006cea50`. On the load side, `0x00445713`'s broader setup branch re-enters
`map_load_city_database` `0x00474610` on that same global `0x006cea50` collection. Outside the
city-specific branch, the two tiny dispatch wrappers `0x00455a40` and `0x00455a50` are also now
bounded as raw vtable-slot helpers: the first jumps through entry slot `+0x44`, while the second
pushes one caller argument into slot `+0x40` and then clears the global roots
`0x006acd38/0x006acd3c/0x006acd40`. Finally, `0x00455a70` is now bounded as the generic
current-position triplet publisher that queries `0x0052e720`, converts through
`0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied height bias, optionally rounds
under `0x00434050`, and publishes through `0x00530720`. The temporary-entry constructor and live
entry constructor are bounded now too. `0x00474110` is the tiny stack-local initializer: it
re-enters shared base init `0x00455b20`, clears helper fields `[+0x23a]` and `[+0x242]`,
installs vtable `0x005ce428`, and returns. `0x00474130` is the real live-entry constructor: it
stores the entry id into `[+0x23e]`, clears the trailing helper payload block `[+0x246..+0x24e]`,
stores mode `[+0x242]`, derives one world-height scalar from the supplied coordinate pair through
`0x00448bd0`, builds helper field `[+0x23a]` through `0x00474030`, and then seeds the remaining
default scalar or flag tuple through `0x00455b70` using the fixed defaults at
`0x005ce49c/0x005ce4a0/0x005ce4a4`. That broader helper is no longer city-specific either:
`0x00455b70` is now bounded as the shared scalar-band initializer that clears the same
`[+0x206/+0x20a/+0x20e/+0x22e/+0x232]` family, optionally copies up to three caller-supplied
strings into `[+0x206/+0x20a/+0x20e]`, synthesizes one default local token buffer when the middle
string is absent, chooses one effective mode string from the third or first input, derives one
owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and
then seeds the remaining scalar band through `0x0052edf0` and `0x0052e670`.
The same specialization also now has one tighter UI-facing side. The override trio
`0x0040e4e0`, `0x0040e880`, and `0x0040e9d0` all sit in the same `0x005c8c50` table and reuse
the linked-site-capable vtable `+0x70` latch together with creation-mode byte `[this+0x3d4]`.
`0x0040e4e0` is the strongest current owner for contextual status text: it branches across
linked-peer checks, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current
owner state, and candidate or linked-peer display labels, then formats localized ids such as
`0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd` before pushing the result through
shell presenter `0x00538c70`. `0x0040e880` pairs with that publisher on the action side: it
first resets the same presenter through the fixed token at `0x005c87a8`, then dispatches several
world-side follow-ons through `0x00413620`, `0x00453510`, `0x00452db0`, and `0x00452fa0` under
the same linked-peer and world-mode gates. `0x0040e9d0` is the narrower query-style formatter:
when shell branch `[0x006cec74+0x74]` is live it formats one localized label with the fixed
suffix `\nAbsIndex %d`, otherwise it can return one company-side owner label through
`0x00426b10`, and only then falls back to `0x00455860`. So the current best read is that this
concrete specialization owns both the ambient or animation transient family and one linked-peer
status or action UI surface, without yet proving the user-facing subtype name.
One smaller subtype hook cluster is tighter now too. The concrete table also carries
`0x0040d170` and `0x0040d1b0`, both of which resolve the current candidate through cached stem id
`[this+0x3cc]` and then test candidate dword `[candidate+0x4b]`. When that flag is nonzero,
`0x0040d170` tail-calls the primary transient builder `0x0045c310` and `0x0040d1b0` tail-calls
the matching release path `0x0045c3c0`. The same neighborhood now also gives direct cached-record
resolvers instead of more anonymous pointer math: `0x0040d1f0` returns the linked peer from
`[this+0x2a8]` through `0x006cec20`, while `0x0040d210` returns the owner-side record from
`[this+0x276]` through `0x0062be10`. That makes the specialization-side ownership split cleaner:
the `0x005c8c50` family is not only formatting labels and driving side effects, it also has a
direct candidate-flag hook for building or dropping the primary transient handle.
The last lower side reads are tighter now too. `0x0040e450` first seeds the projected-slot cache
through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470` before it re-enters
`0x00418a60`, and the broader stem-based builder at `0x00418be0` now has one named optional side
renderer instead of an anonymous callsite:
`placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`.
The side refresh split is bounded now too. `0x0040ee10` publishes one local position or scalar
triplet through the shared setter `0x00530720`, then tails into
`placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`;
that smaller follow-on only runs on the current subtype-`1`, class-`3`, linked-site branch, and
recomputes one local-runtime triplet from the linked peer's route-entry anchor when that anchor
is still live. The heavier sibling above that side refresh is bounded now too:
`placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` is the
world-coordinate mutation helper that recomputes `[site+0x388]` and `[site+0x38c]`, rewrites the
world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`, updates the subtype-`4`
proximity-bucket family when needed, rebuilds the same local position or scalar triplet, and
then tails into the linked-site anchor follow-on at `0x0040e360`. One later caller into that
same side-refresh family is bounded now too: `0x00419110` clamps a caller rectangle to the live
world bounds, resolves one per-cell bucket chain through the hashed map at `[arg0+0x88]` and
`0x0053dae0`, and then re-enters `0x0040eba0` for every bucketed site in that rectangle using
the stored per-entry coordinate pair plus two zero flags. Current grounded caller is the edit-side
branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations,
so this now looks like a bucket-map-driven local-runtime side-state refresh wrapper rather than
another broad site sweep.
The sibling policy-`1` side is tighter now too. The constructor lane no longer stops at “one
linked site id at `[site+0x2a8]`”: the subtype-`1` branch in
`placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now clearly
allocates that linked record through
`placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, whose lower
constructor is `placed_structure_construct_linked_site_record_from_anchor_and_coords`
`0x00480210`. That lower constructor seeds the linked record's own id and anchor-site id, clears
the local route-anchor and display-name fields, projects the anchor footprint into world space,
and then either binds an already-covered route entry through
`route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` or
falls through into the neighboring policy-`1` route-entry synthesis family around `0x00493cf0`
before rebinding the chosen route entry through `0x0048abc0`.
The cleanup side is tighter now too. Linked-site removal now has a bounded owner at
`placed_structure_collection_remove_linked_site_record` `0x004813d0`: it resolves the linked
record through `0x006cec20`, runs the per-record teardown
`placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, removes the
live entry from the collection, and only then re-enters the still-bounded company-wide follow-on
at `0x00429c10` when the removed record passed the narrower transit-like latch. That per-record
teardown is no longer just “clear some scratch fields.” It now clearly clears the route-style
scratch lane, clears the five proximity buckets at `[site+0x590..0x5b8]`, detaches or invalidates
the current route-entry anchor, frees the three per-site byte arrays at `[site+0x24..0x2c]`,
clears this site's indexed byte from the corresponding arrays of later placed-structure records,
and then re-enters `0x00436040` with the current site id.
That company-side follow-on is no longer just one opaque callback either. It is now bounded as
`company_collection_refresh_active_company_linked_transit_site_peer_caches` `0x00429c10`, which
walks the active company roster and re-enters
`company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each company. That per-company
fast pass stamps a refresh tick at `[company+0x0d3e]`, clears and repopulates the
placed-structure-side cache cells addressed through `[site+0x5bd][company_id]`, marks the
eligible linked transit sites for that company, allocates one `0x0d`-stride peer table for each
eligible site, and fills those peer rows from
`aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks`
`0x004a6630`. That helper no longer reads as one anonymous route sweep: it either uses the fixed
pair directly or falls back across tracker endpoint combinations before returning the winning
route-entry id, one route-step count, and one companion mismatch count. The fast cache now reads
more cleanly too: peer-record dword `+0x05` stores that step count, while float `+0x09` stores
the normalized continuity share derived from `(steps - mismatches) / max(steps, 1)`, not a raw
delta-per-step ratio. The
adjacent timed wrapper `company_service_linked_transit_site_caches` `0x00409720` now shows the
cadence too: `0x004093d0` is the shorter-interval refresh, while the older heavier sibling at
`0x00407bd0` was only revisited on the longer interval.
That heavier sibling is now bounded too:
`company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` no longer looks like a
generic tail refresh. It reuses the fast peer tables, rebuilds candidate-local amount bands plus
normalized issue-opinion scales, and then folds the peer-side route metrics back into three
per-site cache floats with a cleaner split:
`+0x12` is the raw surviving site-score total,
`+0x0e` is the continuity-and-step-weighted companion total,
and `+0x16` is the promoted final site-ranking lane chosen from the strongest grouped candidate
bands.
That also closes most of the cross-version impact question:
the pre-`1.03` versus `1.03+` tracker metric split now looks like it mainly perturbs the weighted
`+0x0e` lane and the promoted `+0x16` lane, not the raw `+0x12` total.
That final lane then feeds the neighboring selectors
`company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280` and
`company_build_linked_transit_autoroute_entry` `0x00408380`. That makes the company-side follow-on
read more like a linked-transit autoroute cache family than a generic company maintenance pass.
The neighboring reachability gate is tighter now too:
`company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860` caches one company-side
route-entry anchor, and
`placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`
uses that anchor to decide whether a foreign linked transit site can still participate in the
current company's fast peer cache.
The first direct train-side consumer above that cache family is bounded now too:
`train_try_append_linked_transit_autoroute_entry` `0x00409770`. After servicing the owning
company's caches, it asks `0x00408380` for one staged `0x33`-byte route entry using the train's
current anchor site, then either appends that entry through `0x004b3160` and refreshes the new
trailing selection through `0x004b2f00`, or rotates one existing slot in place when the local
two-entry cap has already been reached. So this edge now reaches an actual train-side autoroute
append lane rather than stopping at anonymous company-side cache cells. The weighted cache lanes
still do not escape that route-choice family directly: this train-side append path only inherits
the weighted site and peer choice by calling `0x00408380`, not by reading cache `+0x0e/+0x16`
itself.
The train-side follow-on above that seed path is bounded now too. The owning company can count
its live roster through `company_count_owned_trains` `0x004264c0`, measure one aggregate linked
transit site pressure through `company_compute_owned_linked_transit_site_score_total`
`0x00408f70`, and then rebalance that roster through
`company_balance_linked_transit_train_roster` `0x00409950`.
The aggregate helper no longer reads as a raw sum either:
it starts from the site-cache `+0x12` totals, converts that into one tentative roster target
through year and site-count ladders, and on build `1.03+` adds one special distance-side scaling
branch when exactly two eligible linked transit sites survive.
Because it consumes `+0x12` rather than `+0x0e` or `+0x16`, current evidence now says the tracker
compatibility split is more important for seeded route choice and ranked site choice than for the
final company train-count target itself. The local linked-transit chain is now bounded enough to
say that directly: weighted cache lanes feed `0x00408280 -> 0x00408380 -> 0x00409770/0x00409830`,
while the separate pressure or roster lane feeds `0x00408f70 -> 0x00409950` from raw `+0x12`.
The balancer then applies two age bands to company-owned trains:
very old trains are removed when the roster already exceeds target or upgraded when it still
needs capacity, while the mid-age band can trigger one narrower upgrade pass.
After that it fills any remaining deficit by either packaging multiplayer opcode `0x75` or
locally re-entering
`company_try_add_linked_transit_train_and_publish_news` `0x00409830`. The two visible news
helpers under it are bounded too: `0x00409830` emits RT3.lng `2896` for a newly added train,
while `company_publish_train_upgrade_news` `0x00409300` emits RT3.lng `2897` for the upgrade
branch.
The subtype-`4` sibling side is bounded now too. The nearby-site bucket family now has:
`placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0`,
`placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10`, and
`placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, plus the two collection sweeps
`placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480` and
`placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0`.
Current evidence says those five buckets store `(peer site id, distance)` pairs for nearby
station-or-transit peers, grouped through the five-way classifier at `0x0040d350`. The older
stream-backed side is bounded too: `placed_structure_collection_load_dynamic_side_buffers_from_stream`
`0x00481430` walks the live placed-structure collection and re-enters
`placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0`, which repopulates the
route-entry list, the three per-site byte arrays, the five proximity buckets, and the trailing
scratch band from the caller-supplied persistence stream.
The linked-site route-entry list itself is tighter now too. The refresh or teardown branch at
`0x0040e102` re-enters `placed_structure_remove_route_entry_key_and_compact` `0x0047d810`, which
removes one matching `u16` key from the six-byte list rooted at `[site+0x462]/[site+0x466]`,
compacts the surviving entries into a replacement buffer, and decrements the stored route-entry
count.
The broader linked-site mutable runtime strip is tighter now too.
`placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch`
`0x0047f320` is no longer just a teardown-side stub: it resolves an effective comparison mode
from the linked candidate class byte `[candidate+0x8c]` unless the caller overrides it, derives
one radius threshold from current world coordinates `[site+0x4a8/+0x4ac]`, frees the prior
sampled-cell buffer at `[site+0x34]`, always clears the route-link scratch pair
`[site+0x462]/[site+0x466]`, and then scans one bounded world-grid rectangle through
`[0x0062c120+0x2129]` with per-cell distance measured by `0x0051db80`. For accepted cells it
emits temporary twelve-byte `(grid x, grid y, sampled score)` rows through `0x0042b190`,
`0x0042c530`, and `0x0042c580`; when caller arg0 is zero it compacts one representative subset
of those temporary rows into the persistent list at `[site+0x34]/[site+0x38]`, while nonzero
arg0 callers use the same helper as a clear-and-scan companion without the final materialization
step. Current grounded callers are the linked-site refresh and teardown strip
`0x00480542/0x004805c2/0x00480727/0x004807e2`.
The proximity-bucket rebuild side above that list is tighter now too.
`placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells`
`0x0047fef0` first requires the current record to pass the narrower station-or-transit class gate
`0x0047fd50`, quantizes the current site position through `0x00455800/0x00455810`, walks the
surrounding live cell window through `[0x0062c120+0x2129]`, follows each cell's linked
placed-structure chain through word field `[cell+0x0d6]` plus next-id `[peer+0x2a2]`, keeps only
peers whose resolved candidate subtype byte `[candidate+0x32]` equals `4`, and appends the
surviving `(peer site id, distance)` pairs into the same five bucket arrays rooted at
`[site+0x590..+0x5a4]`. So the narrower one-peer append helper `0x0047fdb0` now has a real
broader owner rather than only collection sweeps.
The whole linked-site refresh owner is correspondingly clearer now too.
`placed_structure_refresh_linked_site_runtime_side_buffers_and_route_entry_anchor` `0x00480710`
first clears the current proximity buckets through `0x0047dcd0`, runs `0x0047f320(1,arg1)`
against the pre-update state, republishes the current site position into the world-grid owner map
through `0x0042bbf0/0x0042bbb0`, reruns `0x0047f320(0,-1)` to materialize the current
sampled-cell list, and then rebuilds the nearby-transit buckets through `0x0047fef0`. After that
it either reuses a still-valid route-entry anchor through
`route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` and
`placed_structure_rebind_route_entry_anchor_to_site_id` `0x0048abc0`, or synthesizes a
replacement through `0x00493cf0` before rebinding it the same way; when an old anchor survives
but now points at a different owner, the helper clears the prior `[entry+0x222]` back to `-1`.
The world-cell owner and route-gather helpers beneath that strip are bounded now too. Word
`[cell+0xd4]` is the head of one placed-structure owner chain: `0x0042bbb0` prepends the current
site id into that chain by writing the previous head into `[site+0x3c]` through the tiny setter
`0x0047d6f0`, while `0x0042bbf0` removes one site id from the same chain by walking the linked
`[site+0x3c]` next pointers until it can splice the requested site out. The sampled-cell rebuild
also now has its lower route-gather leaf: `0x0042c530` walks one world cell's linked-site chain
from word `[cell+0xd6]` through next-id `[site+0x2a2]` and appends each visited site id plus the
caller payload into the six-byte route-entry list helper `0x0042b190`. That same compact list now
has its two local companions bounded too: `0x0042b230` removes one row by leading `u16` key, and
`0x0042b2d0` is the shared contains-key predicate over the same `[...+0xeb]/[...+0xef]` list.
The neighboring `[cell+0xd6]` linked-site chain is bounded now too. `0x0042c9a0` prepends one
site id into that chain by writing the previous head into `[site+0x2a2]` through the tiny setter
`0x0040cb00`, storing the new head back into `[cell+0xd6]`, and then re-entering the paired
rebuild helpers `0x0042c690` and `0x0042c8f0`. `0x0042c9f0` is the remove companion over the
same chain: it walks the linked `[site+0x2a2]` next pointers until it can splice the requested
site id out of the `[cell+0xd6]` head chain, then reruns the same two rebuild helpers.
The two remaining numeric leaves under this strip are bounded now too. `0x0042c580` accumulates
the directional word fan from `[cell+0xf3 + dir*2]` while stepping toward one caller-supplied
grid target through the fixed offset tables at `0x00624b28/0x00624b48`, and that is the floating
sampled-score source later stored by `0x0047f320`. `0x0042c960` is the shared rounded
issue-opinion-scaled word-lane query: it multiplies one local word lane `[this+index*2] << 4`
against the scenario-side scale returned by `0x00437d20(index)` and rounds the result through
`0x005a10d0`.
The broader company-side owner above these pieces is tighter now too. The periodic service pass
`company_service_periodic_city_connection_finance_and_linked_transit_lanes` `0x004019e0` now
reads as the current outer owner for this branch: it sequences the city-connection announcement
lanes, the linked-transit train-roster balancer, the acquisition-side sibling
`company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`, the annual finance-policy helper
`company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, and the shorter-versus-
longer linked-transit cache refresh tail through `0x004093d0` and `0x00407bd0`. That outer pass
also has one tighter temporary-state role now: it clears company bytes `0x0d17/0x0d18/0x0d56`,
mirrors `0x0d17` into scenario field `0x006cec78+0x4c74` only while the earlier route-building
side runs, and restores the original scenario value on exit. Current evidence now ties `0x0d17`
to the shared preferred-locomotive chooser `0x004078a0`: the override is only armed when that
helper picks one locomotive whose engine-type dword is `2`. That engine-type lane now best reads
as electric rather than an unnamed class slot, because the linked approval helper around
`0x0041d550` now reads as a real locomotive-era and engine-type policy gate, dispatching the same
`0/1/2` field across three scenario-opinion lanes while the local player-facing engine-type
family is explicitly `Steam / Diesel / Electric`. That same gate also now ties the later scenario
bytes `0x4c97..0x4c99` back to the editor-side `Locomotives` page rather than treating them as
anonymous availability flags: they are the live `All Steam Locos Avail.`, `All Diesel Locos
Avail.`, and `All Electric Locos Avail.` policy bytes behind `0x004cd680` / `0x004cf0d0`. The
current logic is also tighter than a plain override tier: a positive engine-family opinion result
can carry the gate by itself only while none of those three editor bytes is enabled; once any of
them is nonzero, `0x0041d550` instead requires one matching intersection between the record-local
family bytes and the enabled editor family bytes. The `WhaleL` carveout is narrower now too:
current data-file correlation ties that stem to the `Orca NX462` / `WhaleL_NE` locomotive family,
and it explicitly zeros that positive-opinion result before the later family-availability checks,
so it loses the shortcut rather than gaining a special approval path. The same
chooser now also has a bounded fallback below it, `locomotive_collection_select_best_era_matched_non_electric_fallback_id`
`0x00461cd0`, which explicitly skips engine-type `2` and chooses the lowest-penalty remaining
locomotive by era mismatch and approval gates. The route-search side is tighter too: this
electric-only override now clearly feeds the first path-sweep branch in `0x0049bd40`, forcing the
larger `1.8` initial quality multiplier instead of `1.4`, which is the same branch otherwise
chosen by explicit route-policy byte `4`. So the later annual finance helper is reading
same-cycle side-channel state from the earlier city-connection and linked-transit branches, not
unrelated long-lived finance fields. The inner
finance helper is not debt-only either. Current grounded outcomes include bankruptcy news
`2881`, the debt restructure family `2882..2886`, a later share-repurchase headline `2887`, and
the dividend-side adjustment branch. The main commit verbs under that helper are now grounded too:
`company_repay_bond_slot_and_compact_debt_table` `0x00423d70`,
`company_issue_bond_and_record_terms` `0x004275c0`,
`company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and
`company_issue_public_shares_and_raise_capital` `0x00427450`. The threshold side is tighter now
too. The earliest creditor-pressure lane requires scenario mode `0x0c`, the bankruptcy toggle
`[0x006cec78+0x4a8f]` to be clear, at least `13` years since `[company+0x163]`, and at least
`4` years since founding year `[company+0x157]`; it then scans the last three years of the
derived net-profits and revenue lanes `0x2b` and `0x2c`, chooses one negative pressure ladder
`-600000 / -1100000 / -1600000 /
-2000000` from the current slot-`0x2c` bands around `120000 / 230000 / 340000`, requires the
broader support-adjusted share-price or public-support scalar at least `15` or `20` depending on
whether all three sampled years failed, checks the current fuel-cost lane in slot `0x09` against
`0.08` times that ladder, and requires the
three-year slot-`0x2b` total to clear one final `-60000` gate before it falls into the
bankruptcy commit and RT3.lng `2881` headline.
The middle debt-capital layer is split more clearly now too. With `[+0x4a8b]` clear, one annual
bond lane first simulates full repayment through `company_repay_bond_slot_and_compact_debt_table`
and then uses the post-repayment cash window with fixed `-250000` and `-30000` thresholds plus
the broader linked-transit train-service latch `[company+0x0d56]` to decide whether to append one
or more `500000` principal, `30`-year bonds. The repurchase lane is separate again: when the
city-connection announcement-side latch `[company+0x0d18]` is set, growth setting `2` does not
suppress it, and `[+0x4a87]` is clear, it starts from one `1000`-share batch, can replace its
default `1.0` factor with one linked-chairman personality scalar, scales that by `1.6` when
growth setting `1` is active, and then runs one `800000` stock-value gate plus one
support-adjusted-share-price-times-factor-times-`1000`-times-`1.2` affordability gate before the
repeated `1000`-share buyback commits behind RT3.lng `2887`. The ordering above this helper is
tighter now too:
`company_service_periodic_city_connection_finance_and_linked_transit_lanes` clears those latches
first, runs the city-connection and linked-transit branches, and only then enters the annual
finance helper, so these look like same-cycle reaction gates rather than long-lived balance-sheet
flags.
After the earlier debt or bankruptcy outcomes stay inactive, the later stock-capital lane also
has a tighter bounded shape now too: it only opens on build `1.03+`, only after the earlier
bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles
`[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since
founding. It derives one issue batch from outstanding shares rounded down to `1000`-share lots
with floor `2000`, trims that batch until the broader support-adjusted share-price scalar times
batch no longer exceeds the `55000` gate, recomputes the pressured support-adjusted share-price
scalar and the paired `price/book` ratio, then tests the remaining gates in a fixed order:
share-price floor `22`, proceeds floor `55000`, current cash from `0x2329/0x0d` against the
chosen highest-coupon bond principal plus `5000`, one later stock-issue cooldown gate that
converts the current issue mixed-radix calendar tuple at `[company+0x16b/+0x16f]` through
`calendar_point_pack_tuple_to_absolute_counter` `0x0051d3c0` and compares the result against the
active world absolute calendar counter `[world+0x15]`, and only then the coupon-versus-price-to-book
approval ladder `0.07/1.3 -> 0.14/0.35`. The issue mutator preserves the previous tuple in
`[company+0x173/+0x177]` and refreshes the current tuple from `[world+0x0d/+0x11]` on the
derived-pricing lane. On success it issues two
same-sized tranches through repeated `company_issue_public_shares_and_raise_capital` calls and
publishes a separate equity-offering news family rooted at localized id `4053`, not the earlier
debt or buyback headline family.
The dividend side is bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be
clear, mode `0x0c`, at least `1` year since `[company+0x0d2d]`, and at least `2` years since
founding, then averages the last three years of the net-profits lane `0x2b`, folds in the
unassigned-share pool and the current `0x0d` band, applies the map-editor building-growth
setting `[0x006cec78+0x4c7c]`, treats growth setting `1` as a `0.66` scale-down and setting `2`
as a zeroing pass on the current dividend, quantizes surviving adjustments in tenths, and
finally clamps against
`company_compute_board_approved_dividend_rate_ceiling` `0x00426260`.
The linked-transit route-seeding side has one tighter sibling now too:
`company_reset_linked_transit_caches_and_reseed_empty_train_routes` `0x00401940`. It clears the
two company-side linked-transit cache timestamps, forces one immediate cache rebuild through
`0x00409720`, strips route lists from company-owned trains in modes `0x0a/0x13`, and then
re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770` only when a train's
route list has become empty.
On the wider chooser question, the current evidence is also tighter than before: every recovered
external owner of `0x00402cb0` is still in the city-connection family, so the two later direct
placement lanes currently read as city-connection fallback behavior rather than a broadly shared
world placement service.
It can still unwind through route-state cleanup without committing new placed structures, so the
exact lower helper semantics are not fully closed, but the broader chooser is no longer
anonymous and its main policy split is now visible. The two lower helpers directly under those
commit lanes are bounded now too:
`placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840` is the shared
projected-footprint offset helper over candidate bytes `[candidate+0xb8]` and `[candidate+0xb9]`,
and `placed_structure_validate_projected_candidate_placement` `0x004197e0` is the shared
go-or-no-go validator that checks company, territory, world-tile, and footprint occupancy state
before either direct-placement commit is allowed to fire. Its strongest current subtype branch is
a station-attachment or upgrade-style lane keyed by `[candidate+0x32] == 1`, which now has the
concrete failure family `2901..2906`: blocked upgrade footprint, ground not flat enough, not
your track, insufficient track-laying capacity, cannot connect to existing track, and ground too
steep. That tightens the chooser materially without yet proving that the validator is
station-only for every caller.
The recurring outer owner is tighter now too:
`placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580` walks every
fourth live placed structure from a scenario-time-derived offset and re-enters the per-site
rebuild with stack flag `0`, giving the route-style lane a concrete recurring maintenance sweep
under `simulation_service_periodic_boundary_work` rather than only a floating caller note. One
neighboring helper is now bounded on the message side too:
`shell_building_detail_handle_subject_value_row_band_action` `0x004ba270` switches over the
clicked row family `0x7d07..0x7d14`, treats subject bytes `+0x21/+0x22/+0x23` as one current
selection plus one bounded low/high pair, increments the family dirty latch at `0x006cfe0c` on
change, and republishes the refreshed value through the shared shell control helper on code
`0x66`. One neighboring helper is now bounded on the side-list path too:
`shell_building_detail_propagate_selected_subject_state_into_side_list` `0x004b9ec0` walks the
sibling list owner at `0x006cfe08`, copies the active subject state into each side-list record,
mirrors the current service or capability id at `+0x24`, and preserves the `0x40/0x20/0x10`
subflags from the active subject. That means the value-row actions and later selector rows now
read as propagating one shared building-detail state across the sibling list rather than only
mutating one isolated subject record. One neighboring helper is
now bounded separately too: `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20`
owns the mutually exclusive value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and
`0x7d13/0x7d14`, choosing among them from the same selected-subject flag byte and payload fields
at `+0x22/+0x23`, while the larger cargo-or-service row owner also gates the extra visual lanes
`0x7d6a`, `0x7d6b`, and `0x7d9d` from that same subflag family. The asset-string block is tighter
too: that branch family now explicitly uses `AnyCargo.imb`, `AnyFreight.imb`, `PassMail.imb`,
`Caboose.imb`, and `Dining.imb`, with the bit-`0x20` special lane already aligned to
`Caboose.imb` and the sibling bit-`0x10` special lane now aligned to `Dining.imb`. The larger
`0x7f58..0x801f` band is no longer just a styled row family either:
`shell_building_detail_present_flagged_service_capability_popup` `0x004b9fd0` is now grounded as
its explanatory popup callback. It resolves either one fixed express-side row from `0x00621e04`
or one active candidate or service id from `[subject+0x24]`, then formats one popup through the
shell message-box path. The neighboring refresh helper `shell_building_detail_refresh_flagged_service_capability_rows`
`0x004b9a20` is tighter now too: `0x7d07..0x7d1c` is not one anonymous block, but a real mask
partition over subject bits `0x20` and `0x10`, with one zero-mask pair, one bit-`0x20`-only
pair, one exclusive-or pair, and later one-bit and two-bit indicator rows. RT3.lng now closes
the fixed popup text family too: the single-line branch uses
`3922` `%1\nLoads available at %2: %3`, while the richer ordinary-candidate branch uses
`2981` `%1\nLoads available at %2: %3 Current Price: %4` and can append
`2982` `Price at next station, %1: %2 (%3%4)`. The selector band is narrower too: current
refresh-side evidence shows `0x7f58..0x801f` as one selected-ordinal highlight family over the
three fixed express rows plus the ordinary active-candidate rows, not as a generic unstructured
list. The neighboring `0x8020..0x8051` band is tighter too: it is primarily the matching
remove-entry family for the selected subject's live id list, with two special row indices
re-routing into the `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction
when the current `0x20/0x10` service-bit combination demands it. That means the exact captions
are no longer broadly open across the whole selector family: the fixed express-side rows, the
mask partitions, and the add/remove structure are grounded, and the remaining caption gap is
mostly the ordinary candidate rows further down the same band. The top-level toggles are
tighter now too: the paired
`0x7d02/0x7d03` controls are the real mode switch over subject bit `0x40`, choosing between the
bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`, while
the smaller `0x7d0f/0x7d10` controls flip the same special-service subflags later rendered as
`Caboose` and `Dining Car`. One adjacent control is tighter now too: the extracted
`BuildingDetail.win` resource contains the plain-English line `Set the initial cargo amount for
'Disable Cargo Economy' scenarios.`, and the `0x7d01` plus `0x7d09/0x7d0a` message-side branch
can mirror the current subject or selection through
`shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` into the auxiliary
owner queue at `[0x006cd8d8+0x8f48]`, with side-owner presence now explicitly grounded through
`shell_has_auxiliary_preview_owner` `0x00434050`. That queued request is tighter too: both
current callsites forward the same side-list mirror latch at `[0x006cfe08+0x0c]`, so the
auxiliary owner now clearly sees not just the staged subject but also whether the local
`BuildingDetail` side-list is in mirrored-subject mode. The same `0x7d01` lane also now has one
clear rejection note: localized id `3587` `This option is only available by following the
tutorial.` now sits behind the active tutorial flag at `0x006d3b4c` and the cached previous
tutorial expected-control id at `0x00622b38`, while the neighboring tutorial helper
`tutorial_advance_step_and_refresh_expected_control_ids` `0x00516be0` now grounds
`0x00622b34/0x00622b38/0x00622b3c` as the current and previous expected-control cache rather
than anonymous globals. The last field is tighter now too: `0x00622b3c` is currently best read
as the active tutorial step's alternate-accepted companion control id, because the generic shell
control path compares clicked control ids against it directly and suppresses the `3587` tutorial
rejection when they match. That does not fully close the player-facing caption bind for every
control, but it does bound the neighboring side-owner sync and tutorial-rejection lane instead
of leaving it as anonymous glue.
The extra pre-insert gate is narrower than it
first looked. It is now grounded as tutorial-only:
`tutorial_validate_train_route_station_indicator_step` `0x00516d00` checks the current tutorial
step from the shell tutorial descriptor table at `0x00622b48` before a live station-or-transit
site id can be committed into the staged route entry, and the currently accepted steps align with
localized prompts `3777` and `3778`, the two train-routing tutorial instructions that tell the
player to click the Milan and Turin station indicators. Outside that tutorial state family, the
route-entry insertion path is not gated there. The adjacent validator is tighter now too:
`train_route_list_validate_reachability_and_station_pair` `0x004b2c10` walks that same route list,
resolves placed-structure-backed entries through the live placed-structure and route-node
collections, uses the direct route-node payload branch for the remaining entry family, and fails
with `3089..3091` when the resulting route cannot be traversed or does not preserve a valid
terminal station pair. The post-validation follow-on is bounded too:
`train_current_route_context_uses_strict_reachability_mode` `0x004a9460` is now the small shared
gate above the stricter branch, keyed off the current linked route object's downstream class type,
and `train_set_route_operating_mode_and_scalar` `0x004ab980` now reads as the shared train mode
setter beneath route editing, with the local and multiplayer insertion paths choosing mode
`0x13` only when that stricter second validation succeeds and mode `0x0a` on the looser fallback
path. The first
deeper world-mode interaction branch is now better
bounded: `GameUppermost.win` hotspots, cursor drag, held Shift state, discrete shell view-step
commands, direct keyboard turn/pan/zoom bindings, the `TrackLay.win` and `StationPlace.win`
world-command surfaces, and a frame-owned hover or focus-target transition branch all feed the
same shell-controller-backed path. The remaining uncertainty has moved farther from basic
ownership: the hover-target branch clearly exists, and `0x07d6` now looks like the shared
main-world interaction surface rather than a generic detail button for one tool family only. One
more shell-side consumer is bounded now too: `0x004bc350` is a world-surface brush handler over
that same `0x07d6` control plus the adjacent mode family `0x0faa..0x0faf` and ordinal strip
`0x0fa0..0x0fa7`. That family is no longer just a generic unlabeled brush owner: the
detail-panel manager now grounds the sibling tool-window strip immediately above it as
`Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintTerrain.win`, `PaintRegion.win`,
`PaintSound.win`, and `PaintTerritory.win`, each with its own constructor, refresh pass, and
message owner beneath the same controller rooted at `0x006d0818`. Once its local drag latch is
active it dispatches the current mode dword at `[0x006d0818+0x8c]` into the companion-float
helpers `0x0044d4e0`, `0x0044d880`, and `0x0044da70`, or into the secondary-raster nibble path
`0x00448e20 -> 0x00419110`, so the remaining uncertainty has narrowed from ownership to the
exact one-to-one mode-button mapping inside that grounded tool-window strip. The
`PaintTerrain.win` side is tighter now too: constructor `0x004f7ce0` seeds shell singleton
`0x006d1304`, callback root `0x006d1334`, a constructor-time bulk-update latch at
`0x006d1330/0x006d1331`, and the broader terrain mode or scalar state from `0x00622748..0x00622788`
plus `0x006d1308..0x006d1324`; it then registers the callback strip `0x004f5960`,
`0x004f59f0`, `0x004f6070`, and `0x004f69e0` through `0x00540120`. The direct message owner
under that same family is no longer just a loose branch fan-out either: `0x004f6f50` owns
messages `2/0xca/0xcb`, keeps control `0x07d6` as the live world-surface drag latch, routes
explicit undo control `0x2775` into `0x004f5c30`, maps the selector and mode strips
`0x2711..0x2730`, `0x27d9..0x27df`, `0x283d..0x2843`, `0x28a1..0x28e6`, `0x2915..0x291e`,
`0x2964..0x2967`, and `0x29cd..` into the cached terrain lanes, and then fans the active drag
path into preview helpers `0x004f6930`, `0x004fb5e0`, `0x004fc280`, `0x004fc4d0`, and
`0x004fc630` depending on the current terrain mode. Inside that same family
`0x004f5a80/0x004f5c30` are now the bounded local undo snapshot pair, `0x004f5dd0` is the
tiny active-scalar-group selector, `0x004f6b50` owns the ten-entry mode strip rooted at
`0x28dd`, `0x004f6390` is the broad mode-panel repaint owner, `0x004f6250` is the
mode-dependent world-dispatch bridge, `0x004f6930` samples the current preview raster at
world coordinates, and `0x004fb5e0` is the heavier preview-raster rebuild and shell-surface
publish worker. The next local helpers under that same family are tighter now too:
`0x004f5ea0` and `0x004f5ec0` are just the two tiny special-mode predicates
`(mode 5, variant 2)` and `(mode 4, variant 2)`, `0x004f8770` is the weighted RGB sampler
over the current preview or undo-backed raster neighborhood, `0x004f89b0` is the local
byte-grid connected-component grower over the eight-neighbor tables `0x00624b28/0x00624b48`,
and `0x004f8bb0` is the main drag-path preview compositor that consumes the drag sample strip
`[this+0xf0/+0xf4/+0xf8]`, allocates temporary float or byte grids, and then rasterizes the
surviving preview rectangle through the current terrain descriptor tables at `0x005f3500`,
the weighted color sampler `0x004f8770`, the component grower `0x004f89b0`, and several live
world samplers before writing final RGBA pixels back into the preview surface. The late tail
under that same compositor is tighter too: the mode-`4`, variant-`2` path toggles
secondary-raster byte-2 bit `0x20` by comparing current and previous cells through
`0x00534f40`; the broader mode-`4/5` world-facing branch samples class set `2/4/5` through
`0x00534ec0`, re-enters `0x0044de30` and `0x0044df10`, latches pending world coordinates into
`[0x006d1304+0x78/+0x7c]`, and rewrites the low nibble plus the signed overlay-vector planes
through `0x00448df0`, `0x00448e20`, `0x00448ec0`, `0x00448ee0`, `0x00448e60`, and
`0x00448e90`. After the optional mode-`5` smoothing sweep through `0x004f8370`, the publish
tail either materializes one shell preview surface through `0x0051f090 -> 0x00534730` or, for
the mode-`4/5` world-facing variants, converts the surviving preview rectangle back into
world-space bounds and re-enters `0x0044e940`, `0x00452f20`, and `0x0044d410`. The companion
preview-rebuild owner `0x004fb5e0` is tighter on entry, too: `0x004f726c` is the early
rebuild path that first copies the live preview raster into `[this+0x118]` and snapshots undo
state through `0x004f5a80`, while `0x004f7ada` is the later drag-active path that first
allocates a temporary occupancy mask before rebuilding and then conditionally mirrors that
mask through `0x00450520` on the world-mode-`0x17` side path. So the remaining uncertainty
has narrowed again from family ownership to the exact meaning of a few per-mode scalar and
token lanes, not to whether `PaintTerrain.win` itself is still a mixed shell/world owner.
### Post-load Generation, PaintTerrain, and Save/Load Restore
The same brush strip is tighter now too:
`0x004bc210` stores the selected ordinal and refreshes one scalar caption
from table `0x00621e24`, `0x004bc260` exposes the cached world coordinate pair plus the
currently selected scalar, and `0x004bc290` restyles the ordinal strip `0x0fa1..0x0fa7` plus
the mapped mode strip `0x0faa..0x0faf` against the current mode dword `[0x006d0818+0x8c]`. The
next unresolved layer is narrower and more semantic: the setup side now has one grounded
owner, `world_run_post_load_generation_pipeline`, and its building-side branch is no longer just
one opaque block. We now have a region family, a region-border overlay rebuild, a region-owned
structure-demand and placement dispatcher, and a deeper per-region worker that computes category
demand, subtracts existing coverage, and tries candidate placements. The category map is tighter
too: category `0` falls back to `House`, category `2` is the year-gated weighted region-profile
family that also feeds the localized `Industry Weightings` stats panel, and category `3` now
reaches a separate pool-driven picker whose fallback label is `Commercial` but whose aligned
player-facing stats bucket is `City Support`. The normalized region band is tighter too:
`world_region_normalize_cached_structure_balance_scalars` `0x00422320` no longer just writes an
anonymous cached preview band at `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. Current growth-report
evidence now grounds `[region+0x2e2]` as the weighted-profit-margin scalar and `[region+0x2ee]`
as the annual-density-adjust scalar later formatted as a percent in `Stats - City/Region`, with
`[region+0x2e6/+0x2ea]` left as the intermediate normalized-delta and clamped companion slots
beneath that final adjust term. The per-region prepass feeding that normalization is tighter too:
`0x00420d40` clears `[region+0x306/+0x30a/+0x30e]`, walks the linked placed-structure chain from
`[region+0x383]`, accumulates two local placed-structure metrics through `0x0040ca70` and
`0x0040ca80`, and only for class-0 candidates also folds source field `[source+0x141]` through
`0x0040cec0` into the third accumulator before tailing into the later scalar refresh. That tail
helper `0x00420560` is tighter now too: on class-0 regions it revisits the same linked chain and
folds a class-mix contribution into `[region+0x312]`, with one source-derived term for candidate
class `0`, a separate branch keyed by `[candidate+0x78c]` and `[site+0x246]` for class `2`, one
fixed increment for class `3`, and no current contribution from class `1`. One neighboring
collection-side dispatcher is tighter now too: `0x00433b80` only runs when global mutation depth
`0x0062be40` is back at zero and then conditionally fans into the optional refresh hooks
`0x00481430`, `0x00413860`, `0x004b2a90`, and `0x004931e0`. The periodic boundary
side is narrower now too. `0x00422100`, reached only from
`simulation_service_periodic_boundary_work` `0x0040a590`, first requires several live world
state gates to stay clear, derives one year-sensitive random threshold from selected-year fields
plus world width, then scans the region collection for eligible class-0 regions whose transient
dwords `[region+0x276]` and `[region+0x302]` are both clear and which fail the city-connection
peer probe `0x00420030(1,1,0,0)`. When the gate passes it picks one random eligible region,
derives one small severity bucket from `[region+0x25e]`, stores the scaled amount back into
`[region+0x276]`, and appends one queued `0x20`-byte record through `0x004337c0` with literal
kind `7`, the chosen region id, that amount, the fixed payload `0x005c87a8`, and sentinel dwords
`-1/-1`. That append helper is now grounded directly too: `0x004337c0` allocates one zeroed
linked `0x20`-byte node, copies one string or payload seed into `[node+0x04..]`, stores the six
trailing caller dwords at `[node+0x08..+0x1c]`, and appends the finished node to the singly
linked list rooted at `[state+0x66a6]`. The gameplay label for that queued-record family is still
open, but the structural link from periodic region selection into the scenario-state queue is now
direct instead of speculative. One neighboring narrow counter is bounded too: `0x00422850`
counts class-0 regions that pass a second `0x00420030` peer-probe variant with fixed flags
`(1,1,1)` plus one caller-supplied trailing dword, and current callers are the query/script
dispatch at `0x0042f856` and the later region-stats formatter at
`0x004d2088`. The
remaining setup-side uncertainty has therefore narrowed
again: the region seed and border-overlay pair clearly complete before the `Setting up Players and
Companies...` banner is posted; `[0x006cec74+0x174]` now looks like the direct building-population
gate; `[0x006cec74+0x178]` now looks like the direct seeding-burst gate and selected-year-adjust
policy; and `[0x006cec74+0x68]` now aligns with editor-map mode because the same flag forces the
`.gmp` family in the shell file coordinators while suppressing the later building and seeding
branches and diverting the deeper region worker into alternate logic. One write side for that
`[shell+0x178]` policy is now grounded too: inside `shell_dispatch_ui_command` `0x00464410`,
command ids `0x9d26..0x9d28` store `command_id - 0x9d26` directly into `[0x006cec74+0x178]`,
yielding live values `0`, `1`, and `2`. That means the later restore branch is no longer gated
by an abstract hidden shell latch; at least one of its adjustment inputs is an explicit UI
launch policy and current evidence still does not show that value being recovered from saved
state. The `319` lane itself is no longer the
open structural gap; it now clearly owns chairman-profile slot seeding, profile-record
materialization, a shell editor surface over the same local record family, and a separate
live-company presentation path through the company-list window. The later interior order of that
same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` it
refreshes the auxiliary route-entry tracker collection `0x006cfcb4`, then runs
`placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`,
then a flagged world-grid cleanup sweep through the compact grid-flag query
`0x00448af0` plus the neighboring local chunk-cell write helper `0x00533fe0`, and only after
that the later route-entry post-pass at `0x00491c20`. The same `319` lane is tighter internally
now too:
before that later world and shell reactivation tail, `world_entry_transition_and_runtime_bringup`
runs one distinct post-bundle status and runtime refresh phase that posts progress ids `0x196`
and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes the
live event collection at `0x0062be18` through
`scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the
scenario-side port-or-warehouse cargo recipe runtime tables through `0x00435630`, and then runs
the named-candidate availability preseed through `0x00437743`. One later subphase is tighter now
too: before the broad world-reactivation sweep it posts progress ids `0x32dc/0x3714/0x3715`,
reloads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged
runtime-profile bytes back into `0x006cec7c` while latch `[profile+0x97]` is set, mirrors the
grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world
bytes `[world+0x66de]` and `[world+0x66f2]`, and restores the selected year/profile lane through
a tighter two-stage calendar path than before. Current local disassembly now shows the raw saved
lane at `[profile+0x77]` first feeding helper `0x0051d3f0` with constant components
`(month=1, day=1, subphase=0, tick=0)`, which writes the resulting Jan-1-style tuple dwords
into `[world+0x05/+0x09]`. Only after that seed does the same lane enter one mode-sensitive
adjustment branch: non-editor startup mode can decrement the lane by `1` or `3` depending on
shell-state editor gate `[0x006cec74+0x68]`, shell-side selected-year-adjust policy
`[0x006cec74+0x178]`, and the saved special-condition slot `[0x006cec78+0x4af7]`, and only that
adjusted lane then feeds
helper `0x0051d390` before `world_set_selected_year_and_refresh_calendar_presentation_state`
`0x00409e80` stores the final absolute counter into `[world+0x15]` and refreshes
`[world+0x0d/+0x11]`. That means the restore no longer reads as a direct
`[profile+0x77] -> [world+0x15]` copy; the raw lane seeds the tuple immediately, but the final
absolute-counter restore still depends on live shell/startup context. That dependency is tighter
now too: current local evidence shows `[shell+0x178] == 1` decrementing the restored lane by
`1`, `[shell+0x178] == 2` subtracting `3`, and otherwise a nonzero
`[0x006cec78+0x4af7]` supplying the fallback `-1` branch. That field is no longer unresolved:
current local disassembly now shows `0x00436d10` bulk-zeroing the dword table rooted at
`[startup+0x4a7f]` through `rep stos`, which includes `+0x4af7`, while the editor-side special
conditions owner at `0x004cb2b0/0x004cb8e0` counts and commits that same 49-entry table from the
static rule descriptors at `0x005f3ab0`. The `.smp` save or restore family now grounds that live
band directly too: `world_runtime_serialize_smp_bundle` `0x00446240` writes `49` dwords from
`[world+0x4a7f..+0x4b3f]` plus one trailing scalar at `[world+0x4b43]`, and
`world_load_saved_runtime_state_bundle` `0x00446d40` restores the same fixed `0xc8`-byte band
symmetrically. Slot `30` in that table is localized pair `3722/3723`
`Disable Cargo Economy`, so `+0x4af7` now reads as the live copy of that saved scenario rule,
not a startup-runtime-only mystery latch. The neighboring fixed reads line up with the same rule
cluster too: `+0x4aef` is slot `28` `Completely Disable Money-Related Things`, `+0x4af3` is slot
`29` `Use Bio-Accelerator Cars`, `+0x4afb` is slot `31` `Use Wartime Cargos`, `+0x4aff` is slot
`32` `Disable Train Crashes`, `+0x4b03` is slot `33` `Disable Train Crashes AND Breakdowns`, and
`+0x4b07` is slot `34` `AI Ignore Territories At Startup`. So the remaining loader gap is
narrower than before: the restore still depends on live shell policy `[shell+0x178]`, but the
`+0x4af7` input itself is save-derived scenario rule data rather than something that requires
runtime tracing to discover. Its read-side family is no longer isolated to the selected-year
restore either: it also shapes the chunk size in
`simulation_run_chunked_fast_forward_burst` `0x00437b20` and appears in candidate/local-service
selection and station-detail-side scoring branches around `0x0047f910`, `0x00410d87`, and
`0x005069c6`, which now makes this whole slot cluster look like broader runtime consumers of
scenario special conditions rather than one startup-only mode enum. One file-side anchor is now
tighter too: the checked classic and 1.05 `gmp/gms/gmx` corpus does expose the same aligned
`0x0d64..0x0e2c` `50`-dword band as the grounded `.smp` runtime save or restore copy into
`[world+0x4a7f..+0x4b43]`, but most checked file families only populate a sparse subset of that
band. The first `36` dwords still behave like the older inferred fixed rule matrix with hidden
slot `35` fixed to sentinel value `1`, while the trailing `13` unlabeled rule lanes plus one
scalar vary much more selectively by file family. Current local corpus scans make that split
concrete: the grounded 1.05 scenario-save family (`p.gms`, `q.gms`) stably lights lanes
`35, 37, 39, 44, 45, 46, 47, 48`; the base 1.05 save family (`Autosave.gms`, `nom.gms`) only
shares lane `35` stably and otherwise varies sparsely through `42`, `45`, and `47`; the checked
grounded 1.05 maps, the lone 1.05 alt save, and the visible sandbox-family `.gmx` files keep
only the sentinel lane `35` nonzero. So the current loader boundary is narrower than before: the
`.smp` path still gives a grounded direct runtime-band restore, and checked `gmp/gms/gmx` files
now show a partially populated projection of that same aligned band rather than a wholly separate
fixed record family. The overlap against the later scalar window is now explicit too: trailing
band indices `36..49` are byte-identical with post-window offsets `0x00..0x34`, so every nonzero
lane in that prefix of the post-sentinel scalar window is also a nonzero lane in the aligned
runtime-rule band. That means the real “other fields” boundary inside the post-sentinel window
starts only at `0x0e2c`: `0x0df4..0x0e2c` is the aligned-band overlap prefix, while
`0x0e2c..0x0f30` is the later tail that still looks like save-side scalar state. Local corpus
scans now make that tail split more specific. The base 1.05 save family
(`Autosave.gms`, `nom.gms`) shares a stable tail subset at relative offsets
`0xb4`, `0xc0`, `0xe0`, `0xfc`, and `0x100`, with additional per-file lanes around them. The
1.05 scenario-save family (`p.gms`, `q.gms`) has a much denser stable tail covering
`0x08`, `0x0c`, `0x10`, `0x14`, `0x20`, `0x24`, `0x28`, `0x30`, `0x34`, `0x3c`, `0x5c`,
`0x6c`, `0xa0`, `0xa8`, `0xbc`, `0xc0`, `0xc4`, `0xc8`, `0xcc`, `0xdc`, `0xe0`, `0xe4`,
`0xe8`, `0xf4`, `0xf8`, and `0xfc`; those values still differ per save, but the occupancy is
stable. The lone 1.05 alt save (`g.gms`) only lights `0x20`, `0x34`, `0xf0`, and `0xf4`.
Grounded map families and classic saves keep the tail zeroed, while the only current map-side
outlier remains `Tutorial_2.gmp` under the broad unknown map-family bucket. The immediately
following fixed file window at `0x0df4..0x0f30` is now bounded separately as well: checked maps
and classic saves leave that whole post-sentinel band zeroed,
while checked 1.05 saves carry sparse nonzero dwords there, many of which decode cleanly as
normal little-endian `f32` values. That makes the adjacent band look like a 1.05 save-only
runtime band rather than scenario-static payload, even though its semantics are still open.
One numeric alignment inside that band is now exact too: the tail start `0x0e2c` is the same
relative distance from the aligned runtime-rule base `0x0d64` as live object offset `+0x4b47`
is from grounded world-rule base `[world+0x4a7f]`, so the bounded tail window
`0x0e2c..0x0f30` is offset-aligned with live bytes `[world+0x4b47..+0x4c4b]`. The first
grounded live field at that boundary is no longer anonymous. `0x004367c0` sets one outcome mode
in `[world+0x4a73]`, zeros `[world+0x4d]`, snapshots the selected-year lane to `[world+0x4c88]`,
and then copies localized id `2923` `You lose.` or `2924` `You win, cheater...` into
`[world+0x4b47]`; `0x00472dd0` formats localized id `3918` `%1 has won the game!` with one live
profile name and writes that string into the same destination; and one compact runtime-effect
branch inside `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20` resets
the same destination to the fixed placeholder token at `0x005c87a8`. That gives a grounded live
interpretation for the start of the tail: `[world+0x4b47]` is the start of a victory or outcome
status-text buffer, not a float lane. The same evidence also gives a useful caution: those live
helpers copy up to `0x12c` bytes into `[world+0x4b47..+0x4c73]`, so the current bounded file-tail
window `0x0e2c..0x0f30` cuts through the first `0x104` bytes of a grounded text field rather
than ending on a clean live-field boundary. One small continuation probe now tightens that edge:
the remaining file window `0x0f30..0x0f58` is exactly the last `0x28` bytes needed to reach the
clean live-field boundary at `[world+0x4c73]`, and checked 1.05 saves still carry sparse nonzero
bytes in that continuation window rather than a trailing text-looking suffix. Checked 1.05 save
bytes in the aligned region therefore still do not resemble preserved text; they stay mostly zero
at the beginning and many nonzero lanes decode as ordinary `f32` values. So the safest current
note is: the tail is offset-aligned with the live object beyond `+0x4b43`, but it is not yet a
validated byte-for-byte mirror of the live `[world+0x4b47]` status-text buffer, and the current
nonzero save-side content continues right up to the first clean field edge at `0x0f58`. The next
exact grounded fields after that edge are byte lanes, not restored dwords: `0x0f59` maps to
`[world+0x4c74]` `Auto-Show Grade During Track Lay`, `0x0f5d` maps to `[world+0x4c78]`
`Starting Building Density Level`, `0x0f61` maps to `[world+0x4c7c]` `Building Density Growth`,
`0x0f65` maps to grounded dword `[world+0x4c80]` `leftover simulation time accumulator`, and
`0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The first later grounded
dword after that is `[world+0x4c8c]` at `0x0f71`. That means the simple 4-byte file-lane model
stops matching grounded live field boundaries immediately after the text-buffer edge: the post-
`0x0f58` file bytes are still offset-correlated to live state, but they are no longer naturally
dword-aligned with the next grounded object fields. The new byte-neighborhood probe makes the
mismatch more concrete. In checked 1.05 scenario saves, the exact grounded byte offsets
themselves do not look like clean selector values: `p.gms` carries `0x33` at `0x0f5d` and `0x8c`
at `0x0f6d`, while `q.gms` carries `0xcc` and `0xba` at those same offsets. The only clean
float-looking starts in that neighborhood instead appear one byte earlier, at `0x0f5c` and
`0x0f6c`: `p.gms` decodes those as roughly `7.6` and `6.0172`, while `q.gms` decodes them as
roughly `23.6` and `44.6824`. That tightens the current read further: the checked save bytes
remain offset-correlated to the live `[world+0x4c74..+0x4c8c]` neighborhood, but they are still
not a validated byte-for-byte mirror of the exact live field layout. Local
A second byte-oriented neighborhood immediately after that now has the same kind of split rather
than a clean restored-field mirror. The earlier grounded anchors in that band all stay zero in
the checked 1.05 saves: exact file offset `0x0f87` maps to selected-year bucket companion scalar
`[world+0x4ca2]`, while `0x0f93` and `0x0f97` map to the two startup-dispatch reset-owned bands
`[world+0x4cae]` and `[world+0x4cb2]`, and the local corpus leaves all three exact dword starts
zeroed. The same is true for the later exact byte-owned policy lanes: file offsets `0x0f78`,
`0x0f7c`, `0x0f7d`, and `0x0f7e` map cleanly to grounded byte fields `[world+0x4c93]` and
`[world+0x4c97..+0x4c99]`: the linked-site removal follow-on gate plus the three editor
locomotives-page policy bytes `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All
Electric Locos Avail.`. In the checked 1.05 save corpus those four exact byte lanes all stay
`0`, which is at least structurally clean. The later grounded dword fields in the same
neighborhood are less direct again. Exact file offset `0x0f9f` maps to `[world+0x4cba]` (the
station-list selected-station mirror) and exact offset `0x0fa3` maps to cached
available-locomotive rating `[world+0x4cbe]`, but the checked save bytes at those exact dword
starts do not look like clean preserved ids or floats. The only stable float-looking starts sit
three bytes earlier, at `0x0f9c` and `0x0fa0`: `p.gms` yields roughly `96.8754` and `186.4795`,
`q.gms` yields `329.9467` and the same `0x0fa0`-side candidate shape, `g.gms` yields `7.0` and
`95.8507`, and `Autosave.gms` only shows the later `0x0fa0` candidate at about `68.2629`. So
this later band now has the same conservative read as the post-text one: the save bytes are
still offset-correlated to grounded live fields, but the exact live byte or dword layout is not
yet validated as a direct on-disk mirror.
One more structural cut is now grounded beyond that neighborhood. The aligned scalar plateau
`0x0fa7..0x0fe7` ends exactly at the later recipe-book root `[world+0x0fe7]` already grounded in
the port-or-warehouse cargo editor and runtime rebuild path. We still do not have live semantic
names for the plateau itself, but its aligned dword run now splits cleanly by save family. The
base 1.05 saves (`Autosave.gms`, `nom.gms`) carry one stable signature with
`0x0faf = 0x8000003f`, `0x0fb3 = 0x75c28f3f`, repeated `0x75c28f3c` lanes through `0x0fbf`, a
sign-flipped lane `0x0fc3 = 0xa3d70a3c`, one tiny marker at `0x0fc7 = 0x0000003b`, and
`0x0fcb = 0x00300000`. The scenario-save family (`p.gms`, `q.gms`) carries a different stable
plateau over the same offsets, beginning `0x0faf = 0x4000003f`, `0x0fb3 = 0xe560423f`, then
`0x03126f3b`, `0x1374bc3c`, and paired `0x23d70a3c` lanes at `0x0fbf/0x0fc3`, with
`0x0fc7 = 0x0000003c`. The alt-save family (`g.gms`) follows the base signature through
`0x0fc7`, then diverges sharply into the same `0xcdcdcd..` fill pattern already seen in its
earlier header lanes. So the current best fit for `0x0fa7..0x0fe7` is a family-shaped aligned
scalar plateau that belongs to save-side runtime state and terminates immediately before the
grounded recipe-book block, not one more directly named live-field mirror. One conservative
loader-side summary probe now starts exactly at that recipe root instead of extending the plateau
model further. The fixed recipe-book block spans twelve books from `0x0fe7` with stride `0x4e1`,
and the checked map/save pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp ->
p.gms`, and `Spanish Mainline.gmp -> g.gms` preserve that rooted block byte-for-byte in the
sampled local corpus. The current probe therefore treats it as preserved scenario payload rather
than save-only runtime drift and only reports per-book signatures: a coarse head kind over the
pre-line region, the raw `book+0x3ed` annual-production dword, and one raw summary for each of
the five fixed `0x30`-byte cargo lines beginning at `book+0x3f1`: coarse line kind, raw mode
dword, raw annual-amount dword, and the raw supplied/demanded cargo-token dwords at `+0x08` and
`+0x1c`. That is enough to separate zero, `0xcd`-filled, and mixed books or lines without
overstating line semantics beyond the grounded editor/runtime ownership already documented below.
Local
corpus clustering now makes the remaining split more specific. The base 1.05 save family
(`Autosave.gms`, `nom.gms`) shares a narrow tail-heavy subset with stable relative offsets
`0xec`, `0xf8`, `0x118`, `0x134`, and `0x138`, while still varying in value across files. The
1.05 scenario-save family (`p.gms`, `q.gms`) shares a much broader stable set spanning almost the
whole window from `0x04` through `0x134`, again with per-file scalar differences but consistent
occupancy. Pairwise compare runs tighten that read further: `Autosave.gms` vs `nom.gms` does not
preserve one common numeric tail signature even at the shared base-save offsets, and `p.gms` vs
`q.gms` keeps the broad scenario-save occupancy pattern but still changes every shared value, with
`q.gms` additionally lighting two extra lanes at `0x78` and `0x84`. So the current best fit is
“family-shaped live scalar state” rather than family-default constants. The lone 1.05 alt-save
sample (`g.gms`) only lights up four lanes at `0x58`, `0x6c`,
`0x128`, and `0x12c`. The checked 1.05 maps and classic saves stay zero in that same bounded
window, which strengthens the current read that this is runtime-save scalar state rather than
generic map payload. One older unknown map-family outlier in the local corpus does still carry a
populated window: `Tutorial_2.gmp` under the classic install tree. So the safest current note is
“zero for grounded map families and classic save families, nonzero for observed 1.05 save
families, with one older unknown-map exception.” Static consumer grounding is still sparse for
that tail: direct object-offset hits currently only name the trailing scalar `[world+0x4b43]`
through the editor panel and `.smp` save or restore family, while local opcode searches do not
yet surface equally direct reads for the intervening `+0x4b0b..+0x4b3f` tail lanes. So the
save-file family clustering is now strong, but those later tail scalars remain structurally
bounded rather than semantically named. The
same branch is no longer world-entry-only either: current local
disassembly now shows the identical lane-adjust and
`0x51d3f0 -> 0x51d390 -> 0x409e80` sequence in the post-fast-forward selected-year tail at
`0x004370e0`, which lines up with the existing post-fast-forward callers already mapped under
`0x00433bd0`, `0x00435603`, `0x0041e970`, and `0x00436af0`. That restore now
also has some neighboring slot semantics bounded well enough to carry in the loader notes. Slot
`31` `[0x006cec78+0x4afb]` is no longer best read as an unnamed runtime cargo-economy latch:
local disassembly now ties it directly to the saved special-condition table entry `Use Wartime
Cargos`, and the strongest current runtime owner is
`structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Inside that
candidate-collection sweep the branch at `0x0041ed37` only activates when slot `31` is set and
then treats the string family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and
`Diesel` as one special cargo set before writing the live candidate filter byte `[entry+0x56]`.
That makes the old read-side note around `0x00412560` tighter too: the neighboring descriptor
gate is now best understood as using the live copy of the `Use Wartime Cargos` scenario rule,
not an anonymous cargo-economy mode byte. Slot `34` `[0x006cec78+0x4b07]` is similarly bounded
on the runtime side: the wrapper at `0x004013f0`, which sits immediately above the broader
company-start or city-connection chooser `0x00404ce0`, snapshots region dword `[entry+0x2d]`
across all `0x18` live region records in `0x006cfc9c`, zeros that field while the chooser runs,
and then restores the original values on exit. That is a strong current fit for the editor rule
`AI Ignore Territories At Startup`, even though the exact meaning of region field `+0x2d`
remains open. Slot `29` `[0x006cec78+0x4af3]` is less semantically tidy but still worth carrying
as a bounded consumer family: the branch at `0x0041d286` activates one later placed-structure or
building-side scoring path only when that slot is nonzero and the linked candidate or era record
at `[entry+0x41]` equals `5`, while two already-grounded world helpers
`world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` and
`world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670` also gate on the same
slot. So the identity of slot `29` as saved rule data is grounded, but the downstream runtime
semantics are still mixed enough that the loader should preserve the raw value without trying to
rename its whole consumer family yet. The neighboring train-safety slots are now bounded enough
to keep as a cautious runtime split too. Slot `33` `[0x006cec78+0x4b03]`
`Disable Train Crashes AND Breakdowns` is the coarse gate in the currently recovered train-side
deterioration family around `0x004af8a0`: the very first branch at `0x004af8ab` jumps straight
to the function tail when the slot is set, bypassing the year-scaled threshold build, the later
random or threshold comparison, and the two follow-on state transitions at `0x004ad7a0` and
`0x004ada00`. Slot `32` `[0x006cec78+0x4aff]` `Disable Train Crashes` is narrower in the same
family: after the threshold path has already run, the branch at `0x004af9c1` uses slot `32` to
suppress only the lower failure-transition path and force the milder follow-on at `0x004ada00`.
That same slot-`33` read also appears in the smaller train-side scalar query at `0x004ac460`,
where setting it returns one fixed float immediately before the ordinary route-object-dependent
calculation runs. So the current best loader-facing read is: slot `33` is the broad train
deterioration bypass, slot `32` is the narrower crash-only branch inside that same family, but
the exact player-facing names of the two unnamed train helpers still need one more naming pass.
That restore now
also has one concrete file-side correlation in the classic `.gms` family: local save inspection
now consistently finds `0x32dc` at `0x76e8`, `0x3714` at `0x76ec`, and `0x3715` at `0x77f8` in
`Autosave.gms`, `kk.gms`, and `hh.gms`, leaving one exact `0x108`-byte span from `0x76f0` to
`0x77f8` between `0x3714` and `0x3715`. That span already carries staged-profile-looking payload
text such as `British Isles.gmp`, so the current static-file evidence now supports the atlas-side
`0x108` packed-profile note for the classic save family even though the exact field layout inside
that block is still unresolved. The same classic corpus is tighter now too: inside that
`0x108` span the map-path C string begins at relative offset `0x13`, the display-name C string
begins at `0x46`, the block is otherwise almost entirely zeroed, and the three local samples are
byte-identical except for the leading dword at `+0x00` (`3` in `Autosave.gms` and `hh.gms`,
`5` in `kk.gms`). The currently atlas-tracked bytes `[profile+0x77]`, `[profile+0x82]`,
`[profile+0x97]`, and `[profile+0xc5]` are all `0` in that classic sample set, so the current
file-side evidence grounds the block boundaries and the embedded strings but does not yet show
live examples of those branch-driving latches being set. One 1.05-era file-side analogue is now
visible too, but only as an inference from repeated save structure rather than a disassembly-side
field map: local `.gms` files in `rt3_105/Saved Games` carry one compact string-bearing block at
`0x73c0` with the same broad shape as the classic profile slab, including a leading dword at
`+0x00`, one map-path string at `+0x10`, one display-name string at `+0x43`, and a small
nonzero tail around `+0x76..+0x88`. In that 1.05 corpus the analogue bytes at relative `+0x77`
and `+0x82` are now nonzero in every checked sample (`Autosave.gms`/`nom.gms` show `0x07` and
`0x4d`; `p.gms`/`q.gms` show `0x07` and `0x90`; `g.gms` shows `0x07` and `0xa3`), while
relative `+0x97` and `+0xc5` remain `0`. The compared 1.05 save set is tighter now too:
`Autosave.gms` and `nom.gms` cluster together on `Alternate USA.gmp` with `+0x82 = 0x4d`,
`g.gms` carries `Spanish Mainline.gmp` with `+0x82 = 0xa3`, and `p.gms`/`q.gms` cluster on
`Southern Pacific.gmp` with `+0x82 = 0x90`; across all five files the same inferred analogue
lane at `+0x77` stays fixed at `0x07`, while the same map- or scenario-sensitive tail word at
`+0x80` tracks those `0x4d/0xa3/0x90` byte lanes (`0x364d0000`, `0x29a30000`, `0x1b900000`).
The leading dword at `+0x00` also splits the same corpus, with `Autosave.gms` alone at `3` and
the other four checked 1.05 saves at `5`. That is enough to say the wider save corpus does
contain nonzero candidates for two of the atlas-tracked profile lanes, and that one of them
varies coherently with the loaded scenario family, but not yet enough to claim that the 1.05
block reuses the exact same semantic field assignments as the classic one. The loader-side
family split is tighter now too: `p.gms` and `q.gms` no longer live under a generic fallback;
their save headers now classify as one explicit `rt3-105-scenario-save` branch with preamble
words `0x00040001/0x00018000/0x00000746` and the early secondary window
`0x00130000/0x86a00100/0x21000001/0xa0000100`, while `g.gms` now classifies as a second
explicit `rt3-105-alt-save` branch with the different preamble lane
`0x0001c001/.../0x00000754` and early window
`0x00010000/0x49f00100/0x00000002/0xa0000000`. That branch now carries the same bootstrap,
anchor-cycle, named 1.05 trailer, and narrow profile-block extraction path as the other 1.05
saves. The bridge just below that trailer is now explicit too: the common 1.05 save branch
carries selector/descriptor `0x7110 -> 0x7801` in `Autosave.gms` and `0x7110 -> 0x7401` in
`nom.gms`, and both still reach the same first later candidate at
`span_target + 0x189c`, well before the packed profile at `span_target + 0x3d48`; the
`rt3-105-alt-save` branch instead carries `0x54cd -> 0x5901` and its first later candidate
lands at `packed_profile + 0x104`, essentially on the profile tail; the scenario-save branch
still diverges locally with `0x0001 -> 0x0186` and never enters that later `0x32c8`-spanned
bridge at all. The common-branch bridge payload is narrower now too: both checked base saves
expose the same 0x20-byte primary block at `0x4f14` followed by the same denser secondary block
at `0x671c`, `0x1808` bytes later, and that secondary block now appears to run intact up to the
packed-profile start at `0x73c0` for a total observed span of `0xca4` bytes. The trailing slice
of that secondary block is now typed one level further: a small header at `secondary+0x354`
carries the observed stride `0x22`, capacity `0x44`, and count `0x43`, followed by a fixed-width
67-entry name table starting at `secondary+0x3b5` and running through names like
`AluminumMill`, `AutoPlant`, `Bakery`, `Port00..11`, and `Warehouse00..11`, with a short footer
(`dc3200001437000000`) after the last entry. The trailing per-entry word is now surfaced too:
most entries carry `0x00000001`, while the currently observed zero-trailer subset is
`Nuclear Power Plant`, `Recycling Plant`, and `Uranium Mine`. That footer is tighter now too:
it parses directly as `0x32dc`, `0x3714`, and one trailing zero byte, so the shared
map/save catalog currently ends on the same two grounded late-rehydrate progress ids that the
classic staged-profile band already exposed. The strongest structural read is therefore that the
entire `0x6a70..0x73c0` catalog region is shared verbatim between `Alternate USA.gmp` and the
derived `Autosave.gms`, not rebuilt independently during save. Combined with the earlier
grounded record-layout work under `0x00437743`, `0x00434ea0`, and `0x00434f20`, the current
safest semantic read is that this shared catalog is the bundled source form of the scenario-side
named candidate-availability table later mirrored into `[state+0x66b2]`, with each entry's
trailing dword now reading as the same availability override bit later copied into
`[candidate+0x7ac]`. The loader-side coverage is tighter now too: the same table parser now
attaches both to the common-save bridge payload and directly to the fixed source range in
`.gmp` files and the non-common `rt3-105-scenario-save` / `rt3-105-alt-save` branches. That
makes the scenario variation explicit instead of anecdotal. `Alternate USA` keeps only three
zero-availability names in this table (`Nuclear Power Plant`, `Recycling Plant`, `Uranium
Mine`), `Southern Pacific` widens the zero set to twelve (`AutoPlant`, `Chemical Plant`,
`Electric Plant`, `Farm Rubber`, `FarmRice`, `FarmSugar`, `Nuclear Power Plant`, `Plastics
Factory`, `Recycling Plant`, `Tire Factory`, `Toy Factory`, `Uranium Mine`), and `Spanish
Mainline` widens it again to forty-two, including `Bauxite Mine`, `Logging Camp`, `Oil Well`,
`Port00`, and the `Warehouse00..11` run while also flipping `Recycling Plant` back to
available. The header lanes just ahead of the table vary coherently with those scenario
branches too: `Alternate USA` carries `header_word_0 = 0x10000000`, `Southern Pacific`
carries `0x00000000`, and `Spanish Mainline` carries `0xcdcdcdcd`, while the structural
fields from `header_word_2` onward remain stable (`0x332e`, `0x1`, `0x22`, `0x44`, `0x43`)
and the 9-byte footer still decodes as `0x32dc`, `0x3714`, `0x00` in all three checked maps.
A wider corpus scan over the visible `.gmp`/`.gms` files makes those two anonymous header
lanes less mysterious too: the parser currently sees only three stable
`(header_word_0, header_word_1)` pairs across 79 files with this table shape, namely
`(0x00000000, 0x00000000)`, `(0x10000000, 0x00009000)`, and
`(0xcdcdcdcd, 0xcdcdcdcd)`. The zero-availability count varies widely underneath the first and
third pairs (`0..56` under the zero pair, `14..67` under the `0xcdcdcdcd` pair), so those two
lanes no longer look like counts or direct availability payload; the safest current read is
that they are coarse scenario-family or source-template markers above the stable
`0x332e/0x22/0x44/0x43` table header, with `0xcdcdcdcd` still plausibly acting as one reused
filler or sentinel lane rather than a meaningful numeric threshold. Current exported
disassembly notes still do not ground one direct loader-side or editor-side consumer of
`header_word_0` or `header_word_1` themselves, so that family-marker read remains an
inference from corpus structure rather than a named field assignment.
The new loader-side compare command makes the save-copy claim sharper too: for the checked
pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and
`Spanish Mainline.gmp -> g.gms`, the parsed candidate-availability table contents now match
exactly entry-for-entry, with the only reported differences being the outer container family
(`map` vs `save`) and source-kind path (`map-fixed-catalog-range` vs the save-side branch).
has the explicit companion `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, which
rebuilds the dependent selected-year bucket floats after the packed year changes; and then
rehydrates the named locomotive availability collection at `[world+0x66b6]` through
`locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`.
That locomotive-side restore is tighter now too: its tail explicitly re-enters
`scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`, which rebuilds one
cached available-locomotive rating at `[state+0x4cbe]` from the current year plus the strongest
surviving available locomotive-side rating scalar `[loco+0x20]`, and the tiny query sibling
`0x00434080` is now bounded as the shell-side clamped read helper over that same cached field,
with the grounded shell-side reader later bucketing that value against `40/50/70/85/100`. The
same rehydrate band also refreshes the live structure-candidate filter and year-visible counts
through `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`,
rebuilding the paired per-slot bands at `[candidates+0x246]` and `[candidates+0x16e]` and the
aggregate counts at `[candidates+0x31a]` and `[candidates+0x242]`; the same late checkpoint also
re-enters `placed_structure_collection_seed_candidate_subtype2_runtime_latch` `0x00434d40`,
which seeds runtime dword `[candidate+0x7b0]` across subtype-`2` candidate records before the
later world-wide reactivation sweep. That checkpoint also now has an explicit shell-facing scalar
publisher: `world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides`
`0x004354a0` writes one clamped `0..255` value into the current shell presentation object,
sourcing it either from the shell selector override pairs or from the scenario-side year-threshold
band rooted at `[state+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`; and just ahead of the later
scenario-side recipe rebuild, the same band also re-enters
`scenario_state_ensure_derived_year_threshold_band` `0x00435603`, which only falls into its
heavier rebuild body while `[state+0x3a] < 2` and otherwise leaves the derived year-threshold
companion slots `[state+0x51/+0x55/+0x59/+0x5d/+0x61]` unchanged. The neighboring late status
checkpoints around progress ids `0x196` and `0x197` also share one explicit stage gate now:
`world_query_global_stage_counter_reached_late_reactivation_threshold` `0x00444dc5` compares the
global counter `0x00620e94` against threshold `0x9901`, and the two current callers use a
negative result to clear `[world+0x39]` before the broader world and shell reactivation sweep.
The later reactivation tail is tighter now too: it includes the region-center world-grid flag
reseed pass
`0x0044c4b0`, which clears bit `0x10` across the live grid and then marks one representative
center cell for each class-`0` region through `0x00455f60`; its immediate sibling `0x0044c450`
then reruns `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` across every
live grid cell. The small secondary-raster premark helper `0x0044c570` is bounded now too: it
only admits cells whose current raster byte has no bits in mask `0x3e` and whose parallel class
query `0x00534e10` is false, then rewrites that masked class field to `0x02` and widens the same
cached bounds-and-count band `[world+0x21c6..+0x21d6]`. The next helper `0x0044ce60` scans the secondary raster at `[world+0x2135]`
for cells with any bits in mask `0x3e`, caching min/max bounds plus a marked-cell count in
`[world+0x21c6..+0x21d6]`; the larger sibling `0x0044c670` then consumes those cached bounds to
normalize the same raster and rebuild one dependent overlay/cache surface before the later
route-style rebuild, shell-window, and briefing branches. That overlay side is tighter now too:
after `0x0044c670` resolves scaled surface dimensions through `0x00534c50`, it walks one local
`3 x 32` sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only
secondary-raster classes `4..0x0d`, folds several interpolated `0x0051db80` samples into one
strongest local score, writes packed overlay pixels into the staged surface buffer, and only then
publishes that staged overlay through `0x00534af0`. The lower helper layer under that overlay
pass is tighter now too: `0x00534e10` is the reusable secondary-raster class-set
predicate for classes `1/3/4/5`, `0x00534e50` is the smaller neighboring class-subset predicate
for `1/4`, `0x00534ec0` covers `2/4/5`, `0x00534f00` covers `3/5`, `0x00534e90` is the
marked-bit query over the same 3-byte cell family, and the nearby local counter `0x0044bdb0`
is now bounded as the 8-neighbor count companion for that same `2/4/5` subset, walking the
shared `0x00624b28/0x00624b48` offset tables and re-entering `0x00534ec0` on each bounded
neighbor cell. The first caller cluster around `0x0044bf9d..0x0044c37b` therefore reads as a
secondary-raster neighborhood service band rather than a generic map scan.
`0x00533e70` and `0x00534160` are the coarser siblings over the overlay table at `[world+0x1685]`:
the first clears coarse chunk objects across one clamped rectangle, while the second ensures one
chunk object and seeds local marks through its deeper stamp helper. One level up, the neighboring
rect owner `0x005374d0` now reads as the shared secondary-overlay refresh pass: it reruns the
local sample and unsigned-word reducers `0x00536230/0x00536420`, rebuilds the signed vector byte
planes through `0x00536710`, and then rebuilds the multiscale support surfaces through
`0x00533890`, whose inner reducers now explicitly target the packed sample-triplet buffer plus
the float and unsigned-word support planes rooted at the five-entry per-scale families
`[world+0x15f1..+0x1601]`, `[world+0x1605..+0x1615]`, and `[world+0x1619..+0x1629]`. The setup
side of that same family is tighter now too:
`0x005375c0` is the shared ensure-and-seed owner that allocates the sample, sidecar, mask,
raster, vector, and coarse-cell tables together; crucially, it seeds `[world+0x1655]` with byte
`0x02` and `[world+0x1659]` with byte `0x01`, which closes the default-fill split. The local
component-walk owner under the same neighborhood band is tighter now too: `0x0044c200`
allocates a temporary `width*height` visit bitmap at `0x0062c128`, seeds one class-`2/4/5`
starting cell, derives an initial direction index through the remap table `0x005ee5d4`, and then
fans into the deeper recursive walker `0x0044be20`. That deeper walker widens dirty bounds
`[world+0x21ad..+0x21b9]`, stamps one companion-word orientation lane through `0x005ee5cc`,
reuses `0x00534ec0` plus `0x0044bdb0` to filter admissible neighbors, tracks temporary
visitation in `0x0062c128`, and then applies the local byte-1 edge-bit `0x04/0x08` updates
before returning. So the `0x0044bf9d..0x0044c422` cluster now reads as a real connected-component
walk plus edge-flag refresh layer over the secondary raster rather than only a loose group of
local neighbor counters. The adjacent mutation strip is tighter now too: `0x0044dcf0` refreshes
companion-word bit `0x200` in one local rectangle by checking whether any neighbor belongs to
class set `2/4/5`, while `0x0044df10` clears three local sidecar byte planes, demotes class `4`
to `1` and class `5` to `3`, and then reruns that marked-bit refresh over the surrounding
`+/-1` window. One level up, `0x0044e500` is the rect-wide owner that recomputes byte-1 edge
bits `0x04/0x08` for class-`2/4/5` cells, dispatches `0x0044df10` on incompatible local
patterns, and finally consumes the pending global seed pair at `[0x006d1304+0x78/+0x7c]`
through `0x0044c200`. The shell-side owner of that pending pair is tighter now too:
`[0x006d1304]` is the live `PaintTerrain.win` shell singleton while the callback-heavy side also
keeps a second rooted pointer at `0x006d1334`; the tool constructor snapshots the broader
terrain-paint state into both families while the world-side raster owner still only consumes
`[0x006d1304+0x78/+0x7c]` as one pending component-seed pair. Its radial sibling `0x0044e7d0`
is narrower:
after validating world-space
coordinates through `0x00414bd0`, it stamps class-`2` marks into the secondary raster by walking
one clamped bounding box and admitting cells only when the radial falloff helper `0x0051db80`
stays positive before re-entering `0x0044c570`. The two small support predicates under that same
strip are now explicit too: `0x00414bd0` is the float grid-bounds gate, and `0x00449df0` is the
integer rectangle clamp-and-validity helper shared by the local mutation owners. One level up,
the broader rect-scoped owner is tighter now too:
`world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`
first reclamps the caller rectangle through `0x00449df0`, reruns the local edge-refresh owner
`0x0044e500`, lazily ensures one presentation target through
`0x0051f090/0x00534910/0x00534920/0x00534930`: the first helper resolves the shared
world-presentation owner, `0x00534910/0x00534920` expose the current staging flag and buffer
root, and `0x00534930` captures one normalized-bounds rect into that staging buffer before the
later publish step `0x00534af0`. The same family then resolves scaled target dimensions through
`0x00534c50` before allocating one temporary `width*height` mask. Its main scan then
walks the live secondary raster `[world+0x165d]` through the same class predicates
`0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four
sidecar byte planes `[world+0x1631..+0x163d]`, while the broader per-cell pass writes packed
values into the ensured target through `0x00534730` and also updates nibble lanes at byte offsets
`+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it
notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the
temporary mask, expands the caller rectangle by dirty bounds `[world+0x21ad..+0x21b9]` through
`0x00536710`, and finally seeds companion byte `[world+0x162d]` with `0xc4` on cells selected
from mask plane `[world+0x1655]`. So the `0x0044e500 -> 0x0044e940` band is now a real
derived-surface and companion-plane rebuild family rather than only a loose collection of local
raster mutations. The local
evidence now also supports a stronger negative conclusion: unlike `[world+0x1655]`, that second
mask plane is not part of the actively rebuilt runtime overlay path, and in the grounded local
corpus it behaves only as a separately seeded, cleared, and persisted sibling plane. One level
lower, the
base-plane allocator `0x00532c80` now reads more cleanly too: it is the narrower owner that
clears `[world+0x15e1]`, optionally applies the current grid dimensions, allocates the base
float-summary plane `[world+0x1605]`, the four sidecar byte planes `[world+0x1631..+0x163d]`,
both one-byte mask planes `[world+0x1655/+0x1659]`, and the packed secondary raster
`[world+0x165d]`, then seeds those planes with the same `0x02/0x01/0x00` default split. The
load-side owner for those same planes is tighter now too: the constructor thunk `0x0044e910`
immediately feeds the heavier payload body `0x0044cfb0`, which reads the rooted chunk families
`0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, allocates the core world-grid
and secondary-raster arrays `[world+0x2129..+0x2141]` plus the route-entry collection
`0x006cfca8`, initializes every grid-cell record through `0x0042ae50`, and only then hands off
into `world_compute_transport_and_pricing_grid` `0x0044fb70`, the neighboring presentation
refresh `0x00449f20`, and the shell-mode pulse `0x00484d70`. So the `0x0044e910 -> 0x0044cfb0`
load side is now bounded as the heavy world-grid and secondary-raster bundle-load body rather
than just another anonymous constructor tail. One
level higher again, the broader world-presentation reinitializer `0x00537e60` now sits above
that base allocator and the larger support-family ensure path `0x005375c0`: it stores the live
grid dimensions, hard-resets the whole overlay runtime family through `0x00532590`,
and that reset strip is no longer opaque either: the immediately preceding local helpers
`0x00532310..0x00532550` now bound one compact overlay-local state family under the same owner.
`0x00532310/0x00532360/0x00532370/0x00532380` own the seven-dword companion block
`[world+0x15b5..+0x15cd]` together with live flag byte `[world+0x15b4]`; `0x005323f0`,
`0x00532460`, and `0x00532490` are the ensure, publish, and query strip for cached surface root
`[world+0x478]` using saved dimensions `[world+0x159c/+0x15a0]`; `0x005324e0/0x00532500` are the
live-flag setters for `[world+0x159b]`; `0x00532510` is the direct setter for mode byte
`[world+0x159a]`; and `0x00532520/0x00532550` own the four-dword saved dimension quad
`[world+0x15a4..+0x15b0]`. So the broader `0x00532590` reset really does sit at the base of a
concrete local cached-surface and companion-block owner family, not just a pile of unrelated
presentation fields. The reinitializer then
reinitializes the secondary-overlay family for those dimensions, and then republishes the
neighboring overlay constants and support owners used by both the world-side reattach branch and
the `.smp` restore-side presentation rebuild path, including several owners that all funnel
through the shared static-template slot allocator `0x00532ad0` over the local `0x100` pointer
band at `[world+0x08]`. Those neighboring owners are tighter now too: `0x00535070` is the small
primary overlay-surface-or-template setup owner; `0x00535100` is the heavier requested-dimension
apply and four-slot overlay-surface rebuild owner used by the setup-side regenerate branch and
the load-side bundle path; while `0x005356e0` and `0x00535890` seed two
larger static-template slot bands rooted at `[world+0x1568/+0x156c/+0x1574/+0x1578]` and
`[world+0x1560/+0x1564]` respectively; the remaining heavier sibling `0x00535430` now reads as a
shared four-slot overlay-surface rebuild owner that resamples one source or fallback descriptor
into a short local slot strip above `[world+0x155c]`. The immediate helper strip under that same
family is tighter now too: `0x00534f60` is the small presentation-owner base init above
`0x00532590`; `0x00534f80` releases one transient surface handle at `[world+0x478]` and clears
byte `[world+0x159b]`; `0x00532760` releases the current overlay slot chosen by selector
`[world+0x1558]`; `0x005327a0` clamps two requested surface dimensions down to supported
power-of-two sizes while also enforcing shell display caps from `[0x006d4024+0x114243/+0x114247]`;
`0x00532860` is the local twelve-slot stitching pass over the parallel bands rooted at
`[world+0x08/+0x0c/+0x18]`, copying terminal rows and edge dwords between those sibling slot
surfaces before finalizing the primary band through `0x00541c10`;
`0x00532960` is the adjacent paired projection helper that maps two caller counters through the
current `16x16` and `4x4` rounded grid quanta and writes the resulting coarse offsets back to two
out-pointers;
`0x005329e0` maps one `(x,y)` pair into a `1`-based coarse `4x4` overlay region id using the
current rounded grid dimensions; `0x00532a30` is the direct getter for local dword `[world+0x1554]`,
which still reads only as the live count or tag for this overlay slot band;
`0x00532a40` and `0x00532aa0` are the time-selected query helpers over the first and second
template-seeded slot bands rooted at `[world+0x1568/+0x156c]` and `[world+0x1560/+0x1564]`; and
`0x00532a90` is the direct getter for trailing fallback slot `[world+0x1578]`. The next adjacent
owner is tighter now too: `0x00532b30` is the shared release/reset path for the local overlay
slot band at `[world+0x08]`, with a split release policy keyed by shell flag
`[0x006d4024+0x11422e]` and a special forced-direct range for slot ids `1..0x10`, after which it
clears band fields `[world+0x1554/+0x1568/+0x1570/+0x155c/+0x1560/+0x1564]`. The tail of that
same reinitializer is tighter one level up too: `0x00527ce0` is the broader ensure owner that
watches current grid extents plus world tag `[world+0x2121]`, re-enters `0x00532860` when those
cached values change, rebuilds or releases local helper `[this+0x65]`, and then clears the two
large global scratch planes rooted at `0x008f2520` and `0x00b33530`. The tail of that same
reinitializer is
tighter now too: after the larger support-family setup it seeds one seven-entry default overlay
companion set through `0x005373b0`, whose inner allocator `0x00535950` populates the local
`0x1b`-entry slot table from the static template rows `0x005dd300..0x005dd378`. The lifecycle
side is tighter in the same way now: `0x00536044` is the shared teardown owner that frees those same
three five-entry support families together with both mask planes, the packed secondary raster,
the vector-byte planes, the local staging buffer, and the neighboring sidecar or coarse-cell
tables. The remaining base-float lane is tighter too: the larger rebuild owner
`0x00538360` now clearly writes one base float-summary field into `[world+0x1605]`, clears both
one-byte mask planes, and then only repopulates the primary mask plane `[world+0x1655]` for the
qualifying class-`1` interior cells before re-entering `0x00532d90` to normalize that base
float-summary plane globally and `0x00532f60` to expand positive cells through one caller radius.
That asymmetry is now enough to close the local semantic edge: `[world+0x1655]` is the actively
rebuilt primary overlay mask, while `[world+0x1659]` is only the separately seeded and persisted
secondary mask sibling with no comparably grounded distinct read-side consumer. The only grounded
getter call to its root accessor `0x00533b60` is the shell staging branch at `0x00525bad`, and
that branch immediately discards the returned pointer. The bundle side is now explicit too:
`.smp` save-load treats the two mask planes as separate payloads with chunk ids `0x2cee` for
`[world+0x1655]` and `0x2d51` for `[world+0x1659]`, while the neighboring `0x2d49/0x2d50`
branches are the separate packed secondary-raster import lanes rather than alternate consumers
of the second mask plane. So, in the mapped local code, `0x1659` is best treated as a persisted
compatibility or seed-state sibling, not as a second actively consumed runtime overlay mask. The
transport/pricing preview side is tighter now too: `0x00538060` sits directly beneath
`0x0044faf0`, first seeds one preview handle through `0x00535430` using the short `C_`
descriptor, temporarily overrides shell globals
`[0x006d4024+0x11423b/+0x11423f/+0x114254/+0x114255]`, and then loads `%1.tga` through
`0x0053c1c0 -> 0x00541970`. It clamps that sampled image into the `0x401 x 0x401` range,
rewrites `[world+0x1605]` plus the mask/raster family `[world+0x1655/+0x1659/+0x165d]` from the
sampled pixels, optionally re-enters `0x00532d90/0x00532f60`, republishes the seeded preview
handle through `0x0053c000`, and then re-enters `0x005375c0(1, 0, 0)`. The small shell-global
owner it also touches is tighter now too: `0x006d401c` is constructed by `0x00538640`,
`0x005386e0` publishes the primary timed text lane, `0x005387a0` publishes the secondary fixed
`10000` ms lane, `0x00538810` finds the first registered shell window containing one child
control id by walking each window through `0x0053f830`, and `0x00538840/0x00538880/0x00538890`
manage the owner's local `1000`-slot active-token table keyed by child control id. The adjacent
list strip is tighter too: `0x00538990` is the registered-window virtual-slot-`0` gate that
stops on the first zero return, `0x005389c0` is the shared unlink helper for the same doubly
linked list rooted at `[owner+0x00/+0x04]`, `0x00538a60` is the zero-counter gate over
`[owner+0xc60]`, `0x00538a70` is the matching full reset-and-release body used during bootstrap
teardown, and `0x00538a10/0x00538a20/0x00538a30/0x00538a40` are the direct getter, setter,
increment, and clamped decrement helpers for the owner's scalar lanes `[+0xc5c]` and `[+0xc60]`.
The next shell-runtime strip is tighter now too: `0x005388d0` is the shared `12`-dword
descriptor dispatcher with the optional override validator at `[owner+0xc75]` and the recursive
`kind 6 -> 0xb7` rewrite; `0x00538c70` is the prioritized cached-text owner over
`[owner+0xbd8/+0xbdc/+0xbe0/+0xbe4]` that emits descriptor kind `0xae` through `0x005388d0`;
`0x00538e00` is the five-scalar descriptor-synthesis wrapper above that same dispatcher;
`0x00538e50` is the sorted registered-window insert owner over node key `[node+0x21]`;
`0x00538ec0` is the refresh sweep over the indexed helper collection rooted at `[owner+0xc69]`;
and `0x00538f10` is the broader optional-window publish plus blocking descriptor loop used by
modal launchers and some shell transition paths.
### Event Editors and Scenario Action Windows
The event side is tighter too:
that `0x00433130` pass in turn materializes each live event record through
`scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. Current shell-side xrefs
now tighten that event branch too: the first rebuilt linked row family under `0x0042db20` aligns
with the standalone condition list later queried by `EventConditions.win`, while the second
rebuilt family aligns with the four grouped effect lists later deep-copied through
`scenario_event_clone_runtime_record_deep_copy` `0x0042e050` during event duplication and effect
staging. The condition side is tighter now too: the tiny helper cluster
`0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is no longer just "some adjacent list scans".
Current evidence bounds it as four predicates over the standalone `0x1e`-row condition list,
testing class bits `0x01`, `0x02`, `0x04`, or any of those bits in the static table
`0x005f3e04 + id*0x81`, with special fallback checks through event fields `[event+0x7f9]`,
`[event+0x7fa]`, and `[event+0x7f0] == 0x63`. The shell side is tighter too: vtable slot
`0x005d0cd8` now binds `shell_event_conditions_window_handle_message` `0x004d59e0`, and vtable
slot `0x005d0cf8` binds `shell_event_effects_window_handle_message` `0x004d7060`. The effects
side is tighter too: the lower helper trio is no longer anonymous. `0x004d5d00` now reads as the
effect-type selector refresh under control family `0x4fb2`, `0x004d5f50` reads as the selected
effect parameter-row repaint, `0x004d6090` is the heavier staged-effect editor refresh over the
`0x4fc7/0x4fce/0x4ff6/0x4ff9/0x4ffc/0x5041/0x5044/0x5046/0x5047` bands, and `0x004d67f0`
commits the current editor state back into the staged effect row at `[this+0x78]`. The verb side
is tighter now too: `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0` and
`shell_open_event_effects_modal_and_return_result` `0x004d9e40` are the shared modal openers
above the two editor windows; `0x004da640`, `0x004da700`, and `0x004d9ed0` now read as the add,
edit, and remove verbs for standalone condition rows; `0x004da7c0`, `0x004da860`, and
`0x004da920` are the matching add, edit, and remove verbs for grouped effect rows; and
`0x004d8120` is now the heavier condition-row list panel refresh those condition-side verbs
re-enter after mutation. The conditions-side refresh split is tighter too: `0x0042d700`
aggregates standalone condition-list class or modifier flags, `0x0042d740` aggregates grouped
effect-row type flags for one selected grouped list, `0x004d9970` owns the condition-class
summary and grouped-row status bands, `0x004d77b0` owns the grouped summary-band affordance gate
for `0x4fed..0x4ff0` when selector `0x5000` lands on `0x5002`, `0x004d9d10` owns the smaller
grouped-effect territory-target affordance on control `0x500b`, `0x004d9f50` owns the selected-event mode
strip and summary text panels, and `0x004d9390` is the mode-dependent detail-row switch beneath
that strip. `0x004da0f0` is tighter too: selector `0x5001` now has the strongest current
RT3.lng fit as the condition-side `Test against...` mode above `0x004d9970`, while selector
`0x5002` has the strongest current fit as the grouped-effect-side `Apply effects...` mode.
That `0x5002` branch now clearly builds control `0x5014` from RT3.lng `1160..1164` as `to the
company/player/player (i.e. chairman)/territory for which the condition is TRUE` before
enabling the adjacent `0x5005`, `0x500a`, and `0x5014..0x501c` family. The strongest current
RT3.lng fit for the remaining visible target-scope strip is now `0x5015 = to the whole game`,
`0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories`, and
`0x501a..0x501c = to all/human/AI players`; the grouped effect-row type mask matches that split
directly through bits `0x08`, `0x01`, `0x04`, and `0x02`. The
selected-event strip is tighter now too: `0x004db120` is the broader selected-event repaint and
navigation refresh above those smaller helpers, `0x004db520` and `0x004db5e0` are the previous
and next selected-event stepping verbs, `0x004db8b0` is the add-or-clone event modal helper,
`0x004dba90` is the rename verb, `0x004d9360` is the delete verb, `0x004db6a0` is the live
selected-event id setter behind control `0x4e84`, and `0x004db6f0` is the callback-binding plus
pending-selection bootstrap path that seeds the strip during window bring-up. The larger
dispatcher at `0x004dbb80` now makes the strip explicit: `0x4e85..0x4e8a` are previous, next,
add blank, clone selected, rename, and delete event, while the later grouped band commits current
summary state through `0x004d8d50` before changing grouped selector `[this+0x9c]` via `0x004dbf93`.
The selection bootstrap side is tighter too: `0x004daf40` is now the placeholder reset helper for
the selected-event summary controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`.
The grouped target-scope side is tighter too: `0x004d8ea0` now reads as the commit helper for current
selected-event text panels before selection or grouped-action changes, `0x004d8d50` now records
the hidden selector family `0x5006..0x500e -> 0..8`, and `0x004dab60` projects that ordinal
one-to-one onto the visible grouped-effect target-scope display strip `0x5014..0x501c`. That
split is firmer now: `0x5006..0x500e` are the canonical hidden selectors that get stored into
`[event + group + 0x7fb]`, while `0x5014..0x501c` are the visible mirror rows republished from
that same ordinal rather than a second independently named selector family. The grouped row and
stored-summary refresh side is tighter too: `0x004d88f0` is now the selected grouped-effect
row-list renderer for `0x4ed5`, formatting the grouped `0x28`-byte rows through RT3.lng
`1154..1159`, and `0x004da9a0` is the current grouped-summary-state republisher that reloads
`0x500a`, `0x500b`, and visible action selection `0x5014..0x501c` from `[event + group + ...]`
before tailing back into `0x004da0f0`,
`0x004dbfca` as the grouped target-scope mode selector that persists the chosen control id into
`0x00622074`, with `0x5001/0x5002` now strongest-fit as `Test against...` and
`Apply effects...`, `0x004dbeeb` as the pending shared summary-text triplet publish helper for
`0x4eac/0x4ed9/0x4edb`,
`0x004d91e0` as the selected-event summary-header and grouped-mode commit helper above
`0x004d8d50`, and `0x004dbe7a` as the narrower `0x4ec6/0x4ec7` choice-event single-player-only
warning modal branch rooted at RT3.lng `3887`. The remaining gaps on
this lane are narrower again because the grouped-band `0x4dc09c` table now closes one earlier
overclaim: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into
`0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` only route to the smaller
`0x004d9d10` affordance path and the rest of `0x4ff1..0x5013` are default no-ops. The open
question is therefore no longer whether those visible target-scope rows are direct selector verbs;
current evidence says they are not.
The local slot records are rooted at
`[world+0x69d8]`,
`[slot+0x01]` polarity and the external role gate at `[world+0x0bc3+slot*9]` are now grounded, and
`[slot+0x03]` now looks like the distinguished primary-human-seat marker because current grounded
writes seed it only on slot zero and later logic moves it solely by whole-record compaction. The
open question is no longer whether the seeded trio lands in the visible shell company roster;
current evidence says it does, and ordinary `Start New Company` now looks like a fresh-company
allocator through `start_new_company_dialog_commit_create_company` and
`start_new_company_request_create_company`, not like the path that claims one of the seeded named
railroads. The immediate post-roster station branch is now clearly separate: current grounded
resource names and handlers put mode `8` on `StationDetail.win`, mode `5` on `StationList.win`,
and the subordinate modal selector helper on `StationPick.win` through
`shell_station_pick_window_open_modal_and_return_selected_station_id` above
`shell_station_pick_window_construct`. The company-side ownership question has therefore moved
down a layer rather than staying open. We now have a recovered `CompanyDetail.win`
owner family through `shell_company_detail_window_refresh_controls`,
`shell_company_detail_window_construct`, and `shell_company_detail_window_handle_message`; the
same owner now has one broader bounded read-side lane too, because control `0x9470` uses
`shell_company_detail_render_financial_history_panel` to draw the five-step Revenue or Expenses or
Interest or Profit or Lifetime strip, sibling control `0x9471` reuses
`shell_format_company_financial_summary_card` through
`shell_company_detail_render_company_summary_card`, controls `0x947d` and `0x947e` now ground a
bond maturity and repay panel through `shell_company_detail_render_bond_maturity_and_repay_panel`,
control `0x9488` now grounds the debt or credit or rate summary block through
`shell_company_detail_render_debt_credit_and_rate_summary_panel`, control `0x948a` now grounds the
share-value and dividend-payout block through
`shell_company_detail_render_share_value_and_dividend_summary_panel`, while the broader six-row
per-share stock-data family is now bounded under `shell_format_company_stock_data_panel`, and the
adjacent territory selector lane is bounded through
`shell_company_detail_select_territory_access_row`,
`shell_company_detail_render_territory_access_row`,
`shell_company_detail_sync_selected_territory_from_picker`, and
`shell_company_detail_refresh_selected_territory_access_summary`; the first finance-action layer
beneath it is bounded through the bond, stock-issue, stock-buyback, and dividend-rate helpers; the
territory-access side is bounded too through
`shell_company_detail_refresh_selected_territory_access_summary`,
`shell_company_detail_buy_territory_access_rights_flow`, and the underlying company access-rights
helpers; and the full takeover and merger vote-result lane is now grounded through
`shell_resolve_chairmanship_takeover_vote_and_commit_outcome`,
`shell_present_chairmanship_takeover_vote_outcome_dialog`,
`shell_resolve_merger_vote_and_commit_outcome`, and `shell_present_merger_vote_outcome_dialog`.
The remaining company-side uncertainty is therefore narrower than before: the broader support and
valuation side is now tighter too because
`company_compute_cached_recent_per_share_performance_subscore`,
`company_compute_five_year_weighted_shareholder_return`, and
`company_compute_public_support_adjusted_share_price_scalar` bound the recent per-share
performance and investor-support/share-price blend beneath those vote resolvers; the recent
per-share feeder now has a grounded four-lane tail too, with current partial-year weight
`(5 * [world+0x0f]) - 5`, prior full-year weights `48/36/24/12` on `0x1f/0x1e`, dividend
non-decline pair weights `9/8/7/6` on `0x20`, lane weights `40/10/20/30`, the startup age ramp
`0/0/0/100 -> 25/25/35/100 -> 50/50/65/100 -> 75/75/85/100 -> 100/100/100/100`, a strongest-lane
`*1.25` boost, a weakest-lane `*0.8` reduction, and separate bounded-intermediate versus final
difficulty applications under `0x005f33b8`; the next consumer `0x00424fd0` is also tighter now,
with the young-company interpolation against `[company+0x57]`, caller pressure clamped to
`[-0.2, 0.2]`, one `(shares / 20000)^0.33` share-count growth term, and the later threshold
ladder `0.6 / 0.45 / 0.3 / 1.7 / 2.5 / 4.0 / 6.0` before the issue-`0x37` multiplier,
`scenario_state_compute_issue_opinion_multiplier` now bounds the
next layer of optional company, chairman, and territory-specific opinion overrides on the active
scenario state, and the broader stat-reader family around
`company_read_control_transfer_metric_slot` and
`company_read_year_or_control_transfer_metric_value` is no longer just a merger-premium helper.
Current grounded callers show the same metric family feeding the annual shareholder-revolt and
creditor-liquidation lane surfaced by localized ids `300..304`, while the debt-side shell and
bond lane now separately close `0x38` as `Credit Rating` and `0x39` as `Prime Rate`. That means
the remaining gap is now mostly gone on the UI side too: issue `0x37` is already bounded to the
same investor-confidence family as the equity-support and governance-pressure paths, and current
grounded UI evidence still stops at the investor-attitude sentence family rather than one
standalone caption. The calendar side is tighter now too:
`[world+0x15]` is the absolute counter for the same mixed-radix `12 x 28 x 3 x 60`
year-plus-subfield tuple packed by `0x0051d3c0` and unpacked by `0x0051d460`, not just a vague
“calendar-like” blob. The `TrackLay.win` family now clearly owns `Lay single track.` `Lay double track.`
and `Bulldoze` as its three primary modes, its bridge selector, its wrapped frequency preferences,
and a strongly aligned pair of `Auto-Hide Trees During Track Lay` and `Auto-Show Grade During
Track Lay` toggles; the `StationPlace.win` family now clearly owns its six top-level category
buttons, the station-style scroller, and the station-rotation controls. The older `Building
placement center` string 671 no longer looks like a live StationPlace control label in the current
recovered flow, because the active constructor, preview, refresh, and dispatcher paths all use
neighboring ids such as 669 and 2208 without a direct recovered lookup of 671. On save or load the
broad serialize-versus-restore split is now grounded, the non-Quicksave `.gmp/.gmx/.gmc/.gms`
families are separated, and the auxiliary `.gmt` path is at least bounded to the preview-surface
side owner. The higher-value shell-facing gap has therefore shifted upward to the remaining
semantics of the post-load generation phases, the later recurring structure-population cadence,
the deeper vote-weight formulas inside takeover and merger resolution, and the still-open meaning
of the packed simulation calendar tuple.
### CompanyDetail and Section Ownership
The shell detail family now has an explicit
section-selector lane in addition to the read-side panels already mapped. Controls
`0x9472..0x9475` directly select the four visible CompanyDetail sections through `0x006cfe60`,
`0x9476..0x9479` are the companion visual controls for that same tab strip, and section `0` is now
bounded more tightly as the chairman or governance slice around the portrait-backed chairman band
on `0x9480` plus the dynamic overview widget `0x947f`. That widget is no longer just a vague
status line: the section-0 refresh binds it through a dedicated stack-built dynamic text path,
and the strongest current shared formatter candidate is
`shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0`, which first renders a
five-line company-metric preamble through localized ids `1211..1215`: `Revenues` from slot
`0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load
mile` from the derived `slot 0x2c / slot 0x17` branch, and `Average speed` from slot `0x26`
rendered through `1216` `%1 m.p.h.`. It then splits the governance summary more concretely: no
linked chairman emits `3045`, wholly owned companies emit `3046` for the scenario-selected
chairman or `3047` for another linked chairman, and investor-owned companies emit the
investor-attitude lines `3048/3049` with one adjective from the table at `0x00622170`. That
branch is no longer using unnamed helpers either: `company_get_linked_chairman_profile_record`
`0x00426ef0` resolves the linked chairman profile and `chairman_profile_owns_all_company_shares`
`0x004768c0` is the full-ownership test behind the `3046/3047` split. The salary side is tighter
too: the formatter computes one signed delta from `[company+0x14f]` and `[company+0x0d59]`, then
chooses `3050..3052` for the scenario-selected chairman or `3053..3055` for another linked
chairman depending on whether that delta is negative, positive, or zero. The bonus line is
narrower still: it only appears when the display year matches `[company+0x34f]`, using amount
`[company+0x353]` with `3056` or `3057`. It then appends the
`1218` `Economy status - %1.` tail caption and stages the adjacent selected-company report or
list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`,
`1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`,
`1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`.
Current evidence still does not recover separate `CompanyDetail.win` action controls for that
strip under `shell_company_detail_window_handle_message`, so it currently reads as staged
overview text or help content rather than as a closed launcher family. The direct `0x947f`
formatter call is still indirect, but the widget boundary is tighter too: the generic shell
helpers `shell_control_refresh_matching_dynamic_text_payload` `0x00540a47` and
`shell_control_release_dynamic_text_payload` `0x005639d2` now show that type `0x6f` controls
free or swap one heap-backed text payload and then short-circuit as a special dynamic-text case,
which strengthens the reading of `0x947f` as a display-only overview widget rather than a normal
callback control. One adjacent boundary is tighter now too: the broader overview wrapper at
`shell_render_company_overview_panel_header_and_optional_change_affordance` `0x004e5a80` owns
the fallback no-company texts `1210`, `3043`, and `3888`, styles controls `0x3f06` and `0x3f07`,
and on the narrower selected-company branch appends `3044` `Click to change company name and
logo.` plus the neighboring `1941` `Change` affordance before falling through into the shared
`0x004e5cf0` text body. That keeps the name/logo affordance outside the ordinary
`CompanyDetail.win` action dispatcher and makes the `0x947f` alignment cleaner. The message-side
action band is tighter too: `0x94b5` grounds
territory-access purchase, `0x94b6` grounds bankruptcy, `0x94cf..0x94d2` ground bond issue, stock
issue, stock buyback, and dividend-rate changes, `0x9493` routes into the destructive
company-clear helper that deactivates the selected company and clears chairman/share links,
`0x94d6` grounds bankruptcy, `0x94d7..0x94da` ground bond issue, stock issue, stock buyback, and
dividend-rate changes, `0x94db` grounds merger, `0x94dc` grounds resignation, and `0x9538` grounds
chairmanship takeover. The finance-side dialog family is tighter too: the bond-issue lane now has
the dedicated modal renderer `shell_company_detail_render_issue_bond_offer_dialog` `0x004c3560`
for underwriter terms `968..972`, the stock-issue lane has
`shell_company_detail_render_issue_stock_offer_dialog` `0x004c3b50` for the staged offer lines
`975..978`, and the buyback lane has
`shell_company_detail_render_stock_buyback_offer_dialog` `0x004c4300` for broker lines
`981..984`. The compact summary card on sibling control `0x9471` is tighter too:
`shell_format_company_financial_summary_card` at `0x004bfb30` now clearly renders `Cash:`,
`Revenue:`, and `Profits:` from company slots `0x0d`, `0x2c`, and `0x2b`, rather than one looser
unnamed finance block. The dividend lane is now split the same way:
`shell_company_detail_setup_dividend_rate_adjust_controls` `0x004c4c70` binds the paired adjust
controls `0x99e8` and `0xc0f9`,
`shell_company_detail_render_change_dividend_rate_dialog` `0x004c4e30` renders localized ids
`988..990`, and
`shell_company_detail_handle_change_dividend_rate_dialog_message` `0x004c5140` clamps the staged
dividend rate against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260` and
raises localized id `991` when the board refuses a higher dividend, all before the existing
company commit path. All four finance verbs now converge through the shared
callback-driven modal opener `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, which
is also reused by the multiplayer staged text-entry lane. The front controls in section `0` are
tighter too: `0x948b` is a
tutorial-guarded escape or back control that shows localized id `3724` `This option is disabled in
the tutorial.` before falling back to the shell detail-manager escape path, `0x9491` and `0x9492`
only restyle the paired visuals `0x948f` and `0x9490`, and `0x9494` opens localized id `3635`
`Enter the amount that your company's cash should be` and writes the accepted value directly into
the selected company cash pair. The neighboring debt section is tighter now too: controls
`0x947d` and `0x947e` no longer read as one-off bond widgets, but as the owners of two repayable
bond-slot row bands, `0x94e8..0x950f` and `0x9510..0x9537`. Those row controls now clearly
converge on the same repayment path in the message dispatcher: they reject unaffordable repayment
through localized id `2990`, open the early-repayment confirmation rooted at `2991`, and then
either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package
the request through the multiplayer shell transport. The render-side owner is tighter too:
`shell_company_detail_render_bond_maturity_and_repay_panel` formats `Due %1` and `Repay this
bond.` for the selected debt slot while the tiny binder
`shell_company_detail_bind_bond_row_band_for_active_panel` switches between the two row bands.
Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone
action cases. The message-side jump table now makes that passive/action split explicit too: in the
dispatch byte map rooted at `0x004c6640`, controls `0x94d6..0x94dc` map to cases `0x06..0x0c`,
control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5`
stay on the default path. The refresh-side ownership is tighter too: the helper now explicitly
loops over `0x94d4..0x9537` as the selected-company-owned band and over `0x9538..0x959b` as the
linked-chairman-owned band, and those two loops do not use the same style polarity.
`0x94d4..0x9537` take style `0x65` when the selected company matches the scenario-selected
company and `0x87` when it differs, while `0x9538..0x959b` take style `0x87` when the selected
company's linked chairman matches the scenario-selected chairman and `0x65` otherwise. The
selected-company action side
is tighter now too: scenario toggle `0x006cec78+0x4a8f` re-enables bankruptcy `0x94d6` together
with passive companion row `0x94d4`, `+0x4a8b` re-enables issue bonds `0x94d7` together with
passive companion row `0x94d5`, `+0x4a87` re-enables stock issue and stock buyback
`0x94d8..0x94d9`, `+0x4a93` re-enables dividend `0x94da` together with the same passive
companion row `0x94d5`, `+0x4adb` re-enables merger `0x94db`, `+0x4acb` re-enables resignation
`0x94dc`, and `+0x4acf` re-enables chairmanship takeover `0x9538`. That makes `0x94d4/0x94d5`
read more like passive companion or heading widgets than hidden verbs. The constructor boundary
is tighter too: current `CompanyDetail.win` setup still only binds explicit callbacks for
`0x9470`, `0x9471`, `0x947d`, `0x947e`, and `0x948c..0x948e`, not for the wider section-0 row
bands. That keeps the remaining `0x94d4..0x959b` content looking more like resource-defined
display rows that are gated and restyled by refresh than like individually code-rendered widgets.
That leaves the main remaining CompanyDetail-specific shell edge at the exact `0x947f` formatter
binding plus the still-unsplit render-side governance rows inside `0x94d4..0x959b`.
### Adjacent LoadScreen.win Report Family
The neighboring shell lane around controls
`0x3ef6..0x4073` is now separated from `CompanyDetail` instead of being treated as one more
extension of the `0x947f` overview path. The real outer owner is
`shell_load_screen_window_construct` `0x004ea620`, which binds `LoadScreen.win`, randomizes the
`LoadScreen%d.imb` background family, stores the singleton at `0x006d10b0`, and seeds the first
visible page-strip controls. Above the older page-specific work, the real message owner is now
`shell_load_screen_window_handle_message` `0x004e3a80`: it owns page id `[this+0x78]`,
page-local substate `[this+0x7c]`, page-kind `[this+0x80]`, current company `[this+0x88]`,
current chairman profile `[this+0x8c]`, display year `[this+0x9c]`, and the page-local report
row latch `[this+0x118]`, then fans back into the shared selector
`shell_load_screen_select_page_subject_and_refresh` `0x004e2c10`, the company-step helper
`0x004e3a00`, and narrower page branches such as `0x004e45d0`. The matching render-side owner is
now bounded too: `shell_load_screen_render_active_page_panel` at `0x004ea060` formats the common
heading and panel frame, then switches on page id `[this+0x78]` and hands control down into the
active page body. That older branch is now demoted to what it actually is:
`shell_load_screen_profile_stock_holdings_page_handle_message`, the page-specific handler beneath
the stock-holdings slice. Inside that same family,
`shell_load_screen_render_profile_stock_holdings_summary_panel` at `0x004e5300` grounds the
selected-profile holdings page: it resolves the current chairman profile from `[this+0x8c]`,
renders the top summary rows `1204` `Stock Value:`, `1205` `Total Assets:`, and
`1206` `Stock Holdings:`, then walks the active company roster and formats one row per positive
holding through `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`,
falling back to `1209` `None` when no positive holdings survive. It also appends `3029`
`Click to change player name and portrait.` plus the adjacent `1941` `Change` affordance only
when the rendered profile matches the scenario-selected chairman. The earlier pages are tighter
now too: `0x004e68e0` is the selected-company financial ranking page using the active company
roster plus `1235..1245` for revenue, profit, cash, track mileage, and report affordances; and
`0x004e6ef0` is the active-chairman wealth ranking page using the chairman profile collection
plus `1237`, `1241`, `1246..1250` for cash, stock, total, and purchasing-power style comparisons.
The later sibling renderers are broader than that one holdings page now too: `0x004e7670` is the
selected-company train list page using `1235..1267`, `0x004e8270` is the selected-company
building list page using `1268..1278`, `0x004e8bb0` is the selected-company station list page
using `1279..1288`, and `0x004e9460` is the map-wide cargo list page using `1289..1298` over the
live candidate collection rather than one company roster. The last broad early-page owner is
tighter now too: `0x004e9b20` is the shared multi-year company report-table renderer for page
`4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`, all driven from
`0x004ea060` with one caller-supplied mode byte and yearly company rows built through
`company_read_year_or_control_transfer_metric_value`. The row families are bounded too:
income-statement rows `1301..1315`, balance-sheet rows `2816` and `1317..1322`, and
haulage-report rows `1323..1335`. The only special rows inside that family are now tighter too:
`0x00425880` and `0x004258c0` provide the negative-cash and positive-cash interest-rate inserts
for the `%1/%2` placeholders in strings `2815` and `2816`, so they are no longer anonymous
private math blobs. The adjacent early siblings are tighter now too: `0x004e5130` is the
selected-company `Stock Data` page wrapper that falls back through `1299` and otherwise reuses
`0x004c0160` to render the `Largest Shareholders`, `Shares`, and `Per Share Data` family;
`0x004e6ef0` is the `Player List` page; `0x004e5300` is the `Player Detail` holdings page; and
`0x004e51ea` is the `Game Status` briefing panel that pulls current scenario briefing text from
the live scenario text store and appends the `1772/1773` `Briefing` affordance. The active-page
renderer at `0x004ea060` is now tighter too because its 13-byte page descriptor table at
`0x006220a0` has been decoded directly as `{ page kind, title string id, `0x3ef8` backlink
page, selected-company-header flag }`. The currently grounded rendered title order is:
`XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`,
`HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`,
`TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`,
and `INDUSTRY LIST`. Its live body bindings are now bounded too: page `0` falls back to
`1203` `Unable to display page`, page `1` is the company overview wrapper, page `2` is the
company list page, pages `3..5` are income statement, balance sheet, and haulage report, page
`6` is stock data, page `7` is player list, page `8` is player detail, page `9` is game status,
page `0x0a` is train list, page `0x0b` currently falls back to `1203`, page `0x0c` is station
list, page `0x0d` currently falls back to `1203`, page `0x0e` is cargo list, and page `0x0f`
is industry list. The row-click path is tighter now too: player-list rows re-enter page `8`
directly, but train, station, and industry rows leave `LoadScreen.win` through the shell
detail-panel manager at `0x004ddbd0` instead of switching to title-table pages `0x0b` or
`0x0d`. Page `0` is tighter now too: its descriptor is kind `0`, title `1200` `XXX`, backlink
`0`, and header flag `0`, and no current post-constructor selector path has been recovered for
it. The descriptor side now also bounds the only known reverse route for the dormant detail
titles: `0x3ef8` is the table-driven backlink affordance, so if page `0x0b` or `0x0d` were ever
selected, the known reverse path would return to train-list page `0x0a` or station-list page
`0x0c` respectively rather than through a separate detail-only owner.
The launcher side is tighter too: current grounded `shell_open_or_focus_load_screen_page`
callers cover pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`,
and no current recovered opener or row-click route selects `0x0b` or `0x0d`. So the
`LoadScreen.win` family now has a much cleaner shape: one outer message owner
`0x004e3a80`, one active-page render owner `0x004ea060`, and then the narrower page-specific
handlers and renderers beneath them. The launcher side is tighter now too: `0x004e4ee0` is the
shared open-or-focus ledger-page owner above this family. Outside sandbox it either re-enters
`shell_load_screen_select_page_subject_and_refresh` on the live runtime at `0x006d10a8` or
allocates that transient runtime, seeds it through `0x004e4b10`, and enters the visible modal
loop; inside sandbox it raises localized id `3899` `The ledger is not available in sandbox mode.`
instead.
The direct shell-command strip above that opener is now explicit too: `0x00440700..0x0044086e`
are just tiny `scenario-present -> open page` wrappers for pages `1`, `3`, `4`, `5`, `6`,
`0x0a`, `0x0c`, `0x0f`, `0x0e`, `2`, `7`, and `9` respectively. So the recovered launcher range
is no longer only “callers of `0x004e4ee0`” in the abstract; each of those small shell-command
stubs now just forwards one fixed page id into the shared opener.
instead. That narrows the remaining `LoadScreen.win` gap again: `TRAIN DETAIL` and
`STATION DETAIL` now read as dormant title-table entries unless some still-unrecovered nonstandard
selector reaches them. The live auto-load boundary is tighter now too: hook-driven
`shell_transition_mode(4, 0)` now completes old-mode teardown, reconstructs and republishes
`LoadScreen.win`, and returns cleanly, but the later post-transition service ticks still keep
`[0x006cec78] = 0`, `[shell_state+0x0c]` on the same `LoadScreen.win` singleton, and
`[LoadScreen.win+0x78] = 0` through at least counts `2..8`. So the next runtime edge is no
longer the old mode-`4` teardown or publish band; it is the `LoadScreen.win` message owner
`0x004e3a80` itself, because later service alone is not promoting the plain load screen into the
separate startup-runtime object path. One later runtime probe did not actually reach that edge:
the `0x004e3a80` hook installed, but the run never produced any ready-count, staging,
transition, post-transition, or load-screen-message lines, only ordinary shell node-vcall
traffic. So that result is now treated as a gate-or-cadence miss rather than as evidence against
the `LoadScreen.win` message path itself. The newer shell-state service trace tightens it again:
on a successful staged run the later service ticks do execute in `mode_id = 4`, but the
`0x004e3a80` message hook still stays silent while the state remains frozen in the plain
`LoadScreen.win` shape. So the next runtime boundary is now the shell-runtime prime call
`0x00538b60` beneath `shell_state_service_active_mode_frame` `0x00482160`, not the message owner
alone. The first direct `0x00538b60` probe run is not trustworthy yet, though: it stopped
immediately after the first shell-state service-entry line, before any ready-count or
runtime-prime entry logs. So that result is currently treated as probe validation work, not as a
real boundary move inside RT3. The static service branch is conditional too: `0x00482160` only
enters `0x00538b60` when `[shell_state+0xa0] == 0`, so silence from the runtime-prime hook does
not yet prove the shell stops before that call unless the service-entry logs also show the `+0xa0`
gate open. The newer run now closes that condition: `[shell_state+0xa0]` is `0`, and the
`0x00538b60` runtime-prime hook enters and returns cleanly. The newer run closes the next owner
too: `0x00520620` `shell_service_frame_cycle` also enters and returns cleanly on the same frozen
mode-`4` path, and the logged fields match its generic branch rather than a startup-promotion
lane (`[+0x1c] = 0`, `[+0x28] = 0`, `flag_56 = 0`, `[+0x58]` pulsed then cleared, and
`0x006cec78` stayed `0`). The static body under the same owner is tighter now too: `0x00538b60`
first re-enters `0x0054f6a0`, refreshes the primary timed-text lane from `[owner+0x1c]` through
`0x005386e0` when that deadline has expired, walks the registered shell-window list from tail
`[owner+0x04]` backward through `+0x54` while servicing each node through `0x0053fda0` and
`0x0051f1d0`, and only then conditionally presents the secondary and primary text lanes through
`0x005519f0`. So the next runtime boundary under the same shell-state service pass is now one
level deeper: the per-object service walker `0x0053fda0` beneath `0x00538b60`. The newer run
closes that owner too: it enters and returns cleanly while servicing the `LoadScreen.win` object
itself, with `field_1d = 1`, `field_5c = 1`, and a stable child list under `[obj+0x70/+0x74]`,
and its first child-service vcall target at slot `+0x18` stays `0x005595d0`. Since `0x006cec78`
still stays `0` through those clean object-service passes, the next runtime boundary is now the
child-service target `0x005595d0`, not the higher object walker. The newer child-service run
narrows that again: the first sixteen `0x005595d0` calls are stable child lanes under the same
`LoadScreen.win` parent, with `[child+0x86]` pointing back to the load-screen object,
`field_b0 = 0`, and a split where earlier children carry `flag_68 = 0x03` and return `4` while
later siblings carry `flag_68 = 0x00` and return `0`. The static body matches that read too:
`0x005595d0` is gated by `0x00558670` and then spends most of its work in draw or overlay
helpers `0x54f710`, `0x54f9f0`, `0x54fdd0`, `0x53de00`, and `0x552560`, so it now reads as
another presentation-side service lane rather than the missing startup-runtime promotion. The
widened allocator-window trace then reconciled the runtime with
the static mode-`4` branch one step further: the first transition-window allocation is `0x7c`,
which matches the static pre-construct `0x48302a -> 0x53b070` alloc exactly, and the later
`0x111/0x84/0x3a/0x25...` allocations all occur before `LoadScreen.win` construct returns, so
they now read as constructor-side child or control setup. That means the allocator probe did not
disprove the still-silent startup-runtime slice; it simply exhausted its log budget inside the
constructor before the post-construct block. The later reset-at-return run is now the decisive
one: after `LoadScreen.win` construct returns there are still no further allocator hits before
publish and transition return, which matches the corrected jump-table decode because mode `4`
does not own the `0x46c40 -> 0x4336d0 -> 0x438890` startup-runtime path.
### Editor Breadth
The broader map-editor page owner is now bounded through
`map_editor_panel_select_active_section` `0x004ce070` and
`map_editor_panel_dispatch_active_section_message` `0x004cf700`, which switch among the grounded
setup pages, `Cities/Regions`, `Territories`, the `Players` and `Player Pool` setup slices, the
now-grounded `Building Density` page, the locomotives-available and industry-availability pages,
the economic and special-condition pages, the `Port/Warehouse Cargos` page, and the later report
pages. The mid-editor ownership is materially clearer now too: the chairman-slot editor is the
`Players` page, the available-chairman editor is the `Player Pool` page, and the former unnamed
dual tri-state page now lines up with localized page text `997` `Building Density` plus help text
`1017` and the direct field captions `1642` `Starting Building Density Level:` and `1644`
`Building Density Growth:`. Both controls are now bounded as stored ordinal bytes `0/1/2` rather
than loose labels: the first three-choice control is the map-wide starting-density selector, with
its default middle state `1` matching the documented `100%` baseline from `1643`; the second is
the paired overall growth selector whose effects later appear in the city-growth side of the
simulation. `map_editor_city_region_panel_construct` and
`map_editor_city_region_panel_handle_message` own the city-or-region editing lane with rename and
copy-industry-data flows. That copy side is tighter now too: the handler first enters
`0x00420e00`, which rebuilds the selected region's profile collection `[region+0x37f]`, clones
the source region's live label-weight entries when a source region is present, and otherwise
reseeds a fixed default weight set through repeated `0x004206b0` calls. The no-source companion
`0x00420ed0` now makes that split explicit: it rebuilds the same subcollection and then picks one
of two fixed default label-weight sets based on region class dword `[region+0x23e]`, using one
all-`0.2f` family for nonzero-class regions and one class-`0` family that starts with `0.3f`
before continuing with repeated `0.2f` entries. The lower mutator
`0x004206b0` then linearly scans the selected region subcollection by profile label, creates a
new profile only when the copied weight is positive, removes an existing profile when the copied
weight is non-positive, updates `[entry+0x1e]` otherwise, and refreshes the region's derived
availability-summary bytes `[region+0x2f6/+0x2fa/+0x2fe]` through `0x00420410`; `map_editor_territory_panel_construct` and
the adjacent no-source companion `0x00420ed0` is tighter too: it rebuilds the same collection
root `[region+0x37f]` but then seeds one of two fixed default profile-label sets directly through
repeated `0x004206b0` calls, splitting by region class dword `[region+0x23e]`. Nonzero-class
regions take one all-`0.2f` default set, while class-0 regions take a different set that starts
with one `0.3f` weight before continuing with repeated `0.2f` entries. That makes `0x420ed0`
the true class-split default-profile companion to the source-cloning helper at `0x420e00`,
rather than just more of the same editor copy path. Two neighboring collection queries are tight
enough now too. `0x00421d20` counts how many live regions have at least one profile row in
`[region+0x37f]` whose label matches the candidate-name string for one caller-supplied candidate
id; `0x00421e30` resolves the Nth such matching region. Both helpers reuse the same
`0x0041fac0` ordinal label-and-weight copy helper we just grounded, only increment once per
region, and skip nonzero-class regions whose companion count `[region+0x242]` is nonpositive.
Those two queries are what the editor summary side at `0x004cdd56/0x004cdeab` uses before it
formats per-region lists for one selected industry or profile name. The adjacent world-facing
query strip is bounded too: `0x00422010` scans the live region collection for class-0 regions
whose normalized coordinates fall inside one caller-supplied float rectangle, keeps the nearest
region id `[region+0x23a]` by squared XY distance through `0x0051db80`, and returns `0` when no
qualifying region is found; `0x004220b0` is the small wrapper above it that returns the matched
region name `[region+0x356]` or the fallback localized scratch string at `0x0062ba90`.
`map_editor_territory_panel_construct` and
`map_editor_territory_panel_handle_message` own the territory rename and border-remap lane;
`map_editor_locomotive_availability_panel_construct` plus
`map_editor_locomotive_availability_panel_handle_message` now bound the locomotive policy page
over `0x006ada84`; `map_editor_industry_availability_panel_construct` plus
`map_editor_industry_availability_panel_handle_message` do the same for the industry candidate
pool at `0x0062b268`; and `map_editor_port_warehouse_cargo_panel_construct` plus
`map_editor_port_warehouse_cargo_panel_handle_message` now ground the recipe-book page that edits
port or warehouse cargo policies through twelve per-book state blocks at
`[0x006cec78+0x0fe7+index*0x4e1]`. Each book now has a shared maximum annual production float at
`book+0x3ed` and five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`; each
line is bounded as a mode dword, annual amount, a supplied-cargo token at `+0x08`, and a
demanded-cargo token at `+0x1c`. The constructor and handler now make those fields materially
tighter too: the row pair shown in `Supply Only` and `Production Demand->Supply` is the `+0x08`
supplied-cargo selector, the row pair shown in `Demand Only` and `Production Demand->Supply` is
the `+0x1c` demanded-cargo selector, and the single amount field at `+0x04` is labeled `Annual
Demand:` only in mode `1` but `Annual Supply:` in modes `2/3`. The stronger new runtime-side
result is now a full chain rather than only the importer:
`scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` first imports those same five
lines into one repeated array of identical `0xbc`-byte runtime descriptors with no row-index
special casing, and the candidate-side rebuild pass at
`structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` then
projects those descriptors into the live structure collection at `0x0062ba8c` before
`structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` rebuilds the
per-cargo runtime summary tables. The current local file-side result is now tighter too: the
grounded recipe-book root at `0x0fe7` is preserved byte-for-byte across the checked map/save
scenario pairs, so the loader can safely treat the twelve `0x4e1`-byte books as preserved
scenario payload rather than a drifting save-only band. A conservative summary probe now only
reports per-book head signatures, raw cap dwords at `+0x3ed`, and five raw line summaries rooted
at `+0x3f1` so the file-side structure stays aligned with this grounded ownership. The
player-facing line modes remain `Disabled`, `Demand Only`, `Supply Only`, and
`Production Demand->Supply`, and the fourth mode is tighter now too: current wording around
`1674`, `1675`, and `504` plus the downstream scaling path says it is the
production-line mode governed by the shared annual production cap, where the entered annual amount
stays on the supply side while the demanded side becomes the normalized input branch. The
candidate-side accumulator pass reinforces that split by applying the shared production cap only
to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The
lower gameplay side is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels`
`0x00412650` is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds
four per-cargo summary banks and returns one direct-supply channel, one cap-normalized supply
channel, one demand or input channel, and one scaled production-output subrow channel for a
requested cargo id. The internal indexing is tighter now too: the direct-supply lane indexes from
`[desc+0x1c]`, the demand or input lane uses that same resolved cargo id in the no-subrow branch,
and the scaled production-output lane indexes each subordinate row directly from
`[desc+0x44+row*0x1c]`, with no post-resolution failure guard between the importer writes and the
summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if
the imported low-16 marker rows fail the exact matcher at `0x0041e9f0`, the resulting `0` ids
will still hit the first summary-bank bucket inside `0x00412650`, but the semantic meaning of
cargo id `0` itself remains ungrounded. The sibling helper
`structure_candidate_supports_or_references_cargo_id`
`0x004129d0` then uses those same banks plus the cached cargo-membership arrays to answer whether
a live candidate materially references a cargo at all. One compare step tighter, the raw line
lanes now split cleanly by scenario family while still preserving map->save identity inside each
checked pair. `Alternate USA.gmp` and `Autosave.gms` match at the raw line-content level: books
`0..4` keep mixed line areas, their `line02` slots carry the recurring nonzero mode words
`0x00110000`, `0x000b0000`, `0x000b0000`, `0x00130000`, and `0x00180000`, and the same `line02`
slots also carry one recurring supplied token `0x000040a0`; the neighboring `line00/line01`
slots carry the same recurring demanded token lanes such as `0x00010000`, `0x72470000`,
`0x6f430000`, `0x694c0000`, and `0x694d0000`. `Southern Pacific.gmp` and `p.gms` also match at
the raw line-content level, but the same rooted line slots stay zero in the checked pair.
`Spanish Mainline.gmp` and `g.gms` again match at the raw line-content level yet carry a distinct
nonzero pattern: books `0..4` keep mixed line areas, line-level supplied tokens include
`0x00170000`, `0x00150000`, `0x00004040`, and `0x00004000`, demanded tokens include
`0x00010000`, `0x68430000`, and `0x6c410000`, and the later `line02` mode words stabilize at
`0x00070000` then `0x00010000`. So the loader can now safely treat these raw line lanes as
preserved scenario payload with family-specific signatures, even though the exact cargo-id and
mode-enum semantics still need separate grounding. One inference is tighter now too: when those
demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte
order reads as short two-letter stems such as `Gr`, `Co`, `Li`, `Mi`, `Ch`, and `Al`, which fit
the current scenario cargo-name families `Grain`, `Corn`, `Livestock`, `Milk`, `Cheese`, and
`Alcohol` from `RT3.lng`; the runtime probe now exposes those only as probable ASCII stems, not
as fully grounded cargo-id decodes. The supplied-token side is now bounded as a separate layout
family rather than forced into that same stem model: the `Alternate USA` family uses one stable
low-16 marker `0x000040a0` only in `book00..04.line02`, the `Southern Pacific` family leaves the
supplied lanes zero in the checked pair, and the `Spanish Mainline` family splits between two
high-16 numeric tokens `0x00170000` and `0x00150000` in `book00/01.line01` plus the later low-16
markers `0x00004040`, `0x00004000`, and `0x00004040` in `book02..04.line02`. The probe now
exposes those conservatively as token-layout classes `high16-ascii-stem`, `high16-numeric`, and
`low16-marker`, without claiming that the non-stem numeric or marker families are decoded yet.
One more structural layer is stable enough to name conservatively: the checked nonzero recipe
rows repeatedly fall into four line-signature classes. `Alternate USA` books `0..4` all expose
one `demand-numeric-entry` at `line00` (`0x00010000`), one `demand-stem-entry` at `line01`
(`Gr/Co/Li/Mi` stems), and one `supply-marker-entry` at `line02` (nonzero mode plus
`0x000040a0`). `Spanish Mainline` books `2..4` expose that same three-line pattern with
`Ch/Al` stems and the `0x00004040/0x00004000` marker family, while books `0/1` only expose the
earlier `supply-numeric-entry` form at `line01`. So the loader can now distinguish recurring row
roles such as demand-stem versus supply-marker without pretending the marker payloads themselves
are decoded. The importer-side branch map is tighter now too because local `objdump` over
`0x00435630` shows that only nonzero mode dwords materialize into `0xbc` runtime descriptors:
mode `0` lines are skipped entirely, mode `1` enters the demand-only branch, mode `3` enters the
dual demand-plus-supply branch, and every other nonzero mode falls into the supply-side branch.
In the checked corpus that means the recurring `demand-numeric-entry` and `demand-stem-entry`
rows in `Alternate USA` and `Spanish Mainline` are preserved scenario-side line records but do
not become live runtime descriptors, while the later `supply-marker-entry` rows are the ones that
actually reach the runtime import path. The runtime probe now exposes that directly as
`imports_to_runtime_descriptor` plus one conservative `runtime_import_branch_kind`.
The raw token windows beneath those branch labels are tighter now too. The checked mode-zero
demand rows preserve string-bearing windows at `line+0x1c`, and the current probe shows those
conservatively as prefixed ASCII previews such as `..Grain`, `..Corn`, `..Livestock`, and
`..Milk`; local `objdump` over `0x0041e9f0` then shows the importer feeding the corresponding
token buffer into an exact cargo-name matcher built over the live cargo collection at
`0x0062ba8c`. By contrast, the imported `supply-marker-entry` rows feed nonprintable windows such
as `.@...` from `line+0x08` through that same matcher, and the resolver path currently shows no
special-case decoding for those marker forms. So the strongest static read is now: the stem-like
demand rows preserve cargo-name text but are skipped because their mode is zero, while the
nonzero imported marker rows are the live descriptor inputs yet likely fail exact cargo-name
resolution unless another upstream transform exists.
The wrapper layer above that query no longer looks like a hiding place for special treatment
either. Local `objdump` now shows `0x00412960` simply summing the two supply-side floats returned
by `0x00412650`, while `0x004129a0` returns the single scaled production-output lane directly;
neither wrapper checks for cargo id `0` after the query returns. The broader world-side
accumulator at `0x0041e7be` is tighter in the same way: it calls `0x00412650`, requires all four
returned channels to be positive before continuing, and only then scales those four channel
values by one linked-instance count from `0x00413940` into caller-owned accumulators. So the
current strongest read remains structural rather than semantic: unresolved marker rows can still
propagate through the first bank bucket, but the first place that meaning matters is a normal
positivity-gated cargo-channel consumer, not a dedicated null-cargo branch.
The caller side is narrower than before too. The steady-state site bitset owner
`placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` starts its inner cargo
loop at id `1` and only walks upward through the current live cargo count, so it never
intentionally queries cargo id `0`. The broader placed-structure sweep around `0x00452e60`
tightens the same boundary from above: when the requested cargo id is nonzero it resolves the
backing candidate and enters `structure_candidate_supports_or_references_cargo_id`, but when the
requested id is exactly `0` it skips that cargo-reference helper entirely and falls through to a
different linked-site or station-or-transit gate. Current local `objdump` now shows that bypass
first requiring one subtype latch through the placed-structure vtable `+0x70`, then resolving the
linked site id at `[site+0x2a8]` through the placed-structure collection `0x006cec20`, and then
forwarding that linked peer into the narrower predicate at `0x0047fd50`. That narrower helper is
tighter than before too: it resolves the linked peer's backing candidate through the peer site id
at `[peer+0x04]`, reads candidate class byte `[candidate+0x8c]`, and returns true only for the
first three class values `0/1/2` while rejecting `3/4` and anything above `4`. So current local
callers treat cargo id `0` as a nonstandard request bound to one linked-site reachability or
classification side path, not one ordinary cargo lane they routinely probe.
The vtable-`+0x70` latch itself is bounded a bit better now too. It still lacks a direct field
decode, but every local callsite we checked around `0x0040d230`, `0x0040dba0`, `0x0040dbf0`, and
`0x0040f670` uses that slot only as the precondition for touching `[site+0x2a8]` and the
neighboring linked-site helpers `0x0047dda0`, `0x0047fd50`, and `0x004138b0`. That makes the
safest current read a linked-site-bearing or linked-site-capable latch, strongly aligned with the
subtype-`1` construction lane that is the only grounded writer of `[site+0x2a8]`, rather than a
broad cargo or route-style predicate.
The neighboring maintenance pair tightens that linked-site read further. Local `objdump` now
shows `0x0040dba0` and `0x0040dbf0` as complementary tiny helpers that each require the same
vtable-`+0x70` latch, resolve optional linked peer id `[site+0x2a8]` through `0x006cec20`,
forward that linked peer (or null) into `0x0047dda0`, and then mirror opposite values into local
byte `[site+0x42]` (`0` for `0x0040dba0`, `1` for `0x0040dbf0`). The route-entry side beneath
them is tighter too: `0x0047dda0` reads route-entry anchor id `[peer+0x08]`, resolves that anchor
through `0x006cfca8`, and only dispatches one of two route-entry vtable calls when
`0x0048a090(1)` reports that all three anchor-slot dwords `[entry+0x206]`, `[entry+0x20a]`, and
`[entry+0x20e]` are still `-1`. So the strongest current read is no longer just "linked-site
capable" in the abstract: this latch consistently fronts the local linked-peer class gate
`0x0047fd50`, the paired `[site+0x42]` route-entry state toggles, and the later linked-peer
collection sweep `0x004138b0`, which keeps the `cargo id 0` bypass path firmly on the
linked-site route-anchor or classification side rather than on an ordinary cargo lane.
One smaller ownership boundary is tighter too: byte `[site+0x42]` is not private scratch owned
only by that pair. Local `objdump` shows tiny direct setters at `0x0040cbc0` and `0x0040cbd0`
plus a raw getter at `0x0040cbf0`, so the `0x0040dba0/0x0040dbf0` pair is writing one shared
placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution
is tighter now too: there are later mode-gated reads at other addresses that also touch a
`+0x42` byte on their own object layouts, but current local evidence does not yet prove those are
the same placed-structure owner family, so the safest current note keeps only the immediate
`0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0` cluster grounded together.
The vtable side sharpens that split too. A local `.rdata` scan shows `0x0040dba0` and
`0x0040dbf0` each appearing exactly once, together with `0x0040cbf0`, in one method table rooted
at `0x005c8c50`; the constructor chain is tighter now too, because `0x0040c950` installs that
same table as one concrete placed-structure specialization above the common base table
`0x005cb4c0`, while `0x0040c970` tears the same specialization back down to the base before the
temporary object is freed. By contrast the raw set or get trio
`0x0040cbc0/0x0040cbd0/0x0040cbf0` also appears in several sibling tables such as `0x005c9750`
and `0x005dd1f0`. So the strongest current structural read is that byte `[site+0x42]` belongs
to one broader placed-structure virtual interface, while the linked-peer route-entry toggles are
one specialization-specific override pair inside that family rather than generic setters used by
every sibling.
One negative boundary is tighter now too: the
raw token words in this recipe block do not look like the already grounded shell-side
`AnyCargo/AnyFreight/AnyExpress` selector-table ids from `0x00621e04/0x00621e10`, so the current
best read is that these on-disk line tokens are not just copied UI selector ordinals or the same
small express-side id family in another wrapper. One broader collection pass also now ties
the editor rule side back into runtime filtering:
`structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0` rebuilds
per-candidate flag `[candidate+0x56]` across the live structure collection, and current grounded
callers show it rerunning directly off the runtime cargo-economy latch at `[0x006cec74+0x25f]`,
which aligns this lane with the editor's `Disable Cargo Economy` special condition rather than
leaving it as a purely editor-owned recipe page. The first common live gate beneath that filter is
now bounded too: `structure_candidate_is_enabled_for_current_year` `0x0041e220` is the shared
year-and-filter check used by the collection refresh and later candidate-selection branches, while
`structure_candidate_rebuild_local_service_metrics` `0x0041e2b0` is a setup-side local service
scorer that already consumes the same enabled candidate records through world-grid sampling. One
steady-state world-side consumer is now grounded as well:
`placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` walks linked placed
structures, filters live category-`2` candidates through
`structure_candidate_is_enabled_for_current_year`, and compacts the direct and scaled supply-side
channels from `0x00412960` and `0x004129a0` into per-cargo bitsets on the placed-structure record.
The next site-side owner layer is tighter now too:
`placed_structure_refresh_linked_candidate_flag4` `0x0042c8f0` refreshes the sibling state bit at
`[site+0x0e6]`, `placed_structure_refresh_candidate_service_state` `0x0042cdf0` ties that flag
refresh to the cargo-service bitset rebuild,
`placed_structure_rebuild_candidate_local_service_tables` `0x0042ce00` then performs the heavier
per-site candidate score rebuild over the aligned float and word tables at `[site+0x107]`,
`[site+0x02]`, and `[site+0x6c]`, and `placed_structure_refresh_local_service_score_bundle`
`0x0042d580` is now the local wrapper that chains that rebuild into the neighboring post-passes
before the world-grid owner continues. Those post-passes are tighter too:
`placed_structure_apply_route_linked_service_caps` `0x0042cc50` is the first route-backed cap pass
over the rebuilt local tables,
`placed_structure_redistribute_local_service_pressure_from_neighbors` `0x0042c1b0` is the
neighboring-site redistribution pass, and `placed_structure_clamp_candidate_service_age_table`
`0x0042cb30` is the final recent-service clamp over the primary per-candidate word table. Above
that refresh lane, `placed_structure_query_candidate_local_service_metrics` `0x0047e240` is the
first higher-level query, `placed_structure_count_candidates_with_local_service_metrics`
`0x0047e330` counts how many candidates currently produce that query,
`placed_structure_get_nth_candidate_id_with_local_service_metrics` `0x0047e620` is the ordinal
selector over that same visible candidate family,
`placed_structure_query_cached_express_service_class_score` `0x0047e390` caches one parallel class
score for the express family now strongly aligned with `Passengers`, `Mail`, and `Troops`,
`placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site`
`0x0047eb90` rebuilds one peer-site comparison cache over the same local-service inputs, and
`placed_structure_select_best_candidate_id_by_local_service_score` `0x0047f910` is the best-hit
selector above the direct and directional local-service query pair. Those site-side scores now
have grounded shell read-side consumers too:
`shell_station_detail_format_freight_and_express_summary` `0x00506be0` formats the visible
`Freight: %1` and `Express: %1` lines in `StationDetail.win`, and the same station-detail family
now has a deeper candidate-service lane:
`shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` stores the active
`(station id, candidate id)` pair for the world-side preview scan,
`shell_station_detail_clear_active_candidate_service_preview` `0x00504a90` tears that pair back
down, `shell_station_detail_update_candidate_service_entry` `0x00504ba0` is the shell-side entry
updater above that preview pair, `shell_station_detail_format_candidate_local_service_summary`
`0x00504bea` uses `placed_structure_query_candidate_local_service_metrics` together with localized
ids `681`, `682`, and `2813` to build the visible candidate service text,
`shell_station_detail_build_to_from_haul_summary_widget` `0x00505150` now grounds the paired `To`
and `From` hauled-traffic strip widgets, `shell_station_detail_present_to_from_haul_stats_popup`
`0x00504770` owns their click-through annual and lifetime `hauled TO/FROM this station` popup,
`shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470` owns the five-row
nearby-structure jump lane, and `shell_station_detail_refresh_candidate_service_rows` `0x00505760`
is now the larger row-list owner that enumerates active candidate-service entries and wires
`shell_station_detail_update_candidate_service_entry` into the per-row click path. The broader
owner above those lanes is tighter now too: `shell_station_detail_window_refresh_controls`
`0x00506610` is the real `StationDetail.win` refresh pass, validating the current station from the
detail manager, publishing the upper summary lane, splitting the `0xb3b7/0xb3b8` action strip by
scenario latch `[0x006cec74+0x1db]`, routing that scenario branch through
`shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590`, routing
class `3/4` sites into the alternate branch
`shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and otherwise rebuilding the nearby-structure lane, the paired `To/From` widgets,
and the candidate-service rows together. The compact siblings under that pass are tighter now too:
`shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` is the dirty
clear owner over the dynamic row bands and the paired haul widgets, `shell_station_detail_has_valid_selected_station`
`0x00504370` is the bare selected-station validity probe, `shell_station_detail_selected_station_belongs_to_selected_company`
`0x00504390` is the selected-company ownership gate, and
`shell_station_detail_present_selected_station_not_controlled_notice` `0x005043f0` is the
localized not-controlled popup beneath the same action family,
`shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` is the
scenario-latched station-to-station triplet popup that formats three per-destination scalar lanes
with `%5.2f` or `N/C`, and
`shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0` is the alternate
class-`3/4` branch that rebuilds the `Trains Serviced` / `Trains Maintained` matrix before
reusing the shared haul-popup callback wiring,
`shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`
refreshes the lower class-gated action strip rather than the older guessed `0xb3f8` lane.
`shell_station_list_format_freight_and_express_availability_summary` `0x00506e50` feeds the
station-list summary `%1 has %2 freight loads and %3 express loads available for hauling...`, and
the paired modifier helper `shell_station_list_handle_center_or_rename_action` `0x00506d50` owns
the visible Shift-center and Ctrl-rename row actions. The list owner itself is tighter now too:
`shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30` is the real
`StationList.win` row and status refresh pass, clearing and repopulating controls `0x61a9` and
`0x61aa`, wiring the visible summary and modifier callbacks, mirroring the shared selected-station
latch at `[0x006cec78+0x4cba]` when it still belongs to the current company, and updating the two
status labels `0x61af` and `0x61b0`. The row-side callout lane is tighter too:
`shell_station_list_row_callback_publish_station_callout_card` `0x00506ac0` is the actual
row callback beneath both list controls, resolving the selected station, deriving one category
header through `0x0053de00` and `0x00552560`, and then publishing the station-name plus freight
and express callout card through repeated `shell_publish_text_callout_presentation` calls. The
side-selector branch is tighter too:
`shell_station_list_window_handle_message` no longer just re-enters the raw `StationPick.win`
constructor. It flips the active side bit at `0x006d1710` and then re-enters the modal helper
`shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`, which
allocates one helper window, runs `shell_station_pick_window_construct` `0x00507620`, brackets the
modal show path, and returns the staged selected station id from `0x00622ae8`. Inside that helper
family, `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event`
`0x005075c0` now bounds the small message-normalization strip beneath controls `0x80e8..0x80ea`.
The Shift-center side is tighter now too:
the shared helper `0x00433900` takes one object pointer plus one small mode, derives one
mode-specific `(distance,height)` preset from the target's virtual classification, and then
re-enters `0x0043c9a0` to center the live world view on that object. The report side is clearer
as well:
`0x004d3060` is the dedicated `Stats - Trees` constructor over `map_editor_tree_stats_report`,
`0x004d3080` is the actual `General Validation` constructor over
`map_editor_general_validation_report`, and the same page table also now grounds `Stats - Cargo`,
`Stats - City/Region`, `Stats - City Count`, `Event Variable Values`, and the neighboring
event-validation page. The remaining open editor edge is therefore mostly the deeper gameplay
meaning of those site-side service scores and flag bits, not page ownership.
### Station-detail overlay
The shell-side candidate preview pair now has a grounded world consumer
too. `world_render_station_candidate_service_map_overlay` at `0x0043f640` reads the active
`(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, scans the placed-structure
collection, and then splits the legend by candidate mode. When the active candidate carries a
nonzero route-style byte at `[candidate+0x46]`, the overlay uses the heavier helper
`placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` in both
directions between the preview station and each scanned site and formats the resulting directional
rows as `3874` `Coming To %1` and `3875` `Going From %1`. When that byte is zero, the same overlay
falls back to the direct local-service path through
`placed_structure_query_candidate_local_service_metrics` and formats the two legend rows instead
as `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes
collapse to `3878` `--None--`, and one title lane falls back to literal `All`. Current disassembly
no longer supports treating `3872` `Already Connected by Another Company` or `3873` `Not
Connected` as direct overlay-body emits.
#### Corrected boundary
The neighboring connection-state note pair now appears
to live in a city connection-bonus label formatter, not in `0x0043f640`. That formatter is now
bounded as `city_site_format_connection_bonus_status_label` at `0x004207d0`: it directly chooses
localized ids `3868` through `3873` after consulting the reusable city-peer scan
`city_connection_bonus_exists_matching_peer_site` at `0x00420030`. Separately, `3879` `Out of
Sync` is grounded under the multiplayer preview dataset path instead:
`multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync` at `0x0046b780` checks
global `0x006cd91c`, raises the `Out of Sync` shell status through `0x5386e0`, and then continues
through the wider multiplayer preview launch-state service. So the station-detail overlay
currently owns only the `Coming To`, `Going From`, `Current Supply`, `Current Demand`, `--None--`,
and `All` legend lanes.
#### Ownership side
One reusable site helper is grounded now too.
`placed_structure_query_linked_company_id` at `0x0047efe0` resolves the current placed structure's
linked instance through `0x0062b26c` and returns its company id from `[instance+0x276]`; the
adjacent city bonus formatter at `0x004207d0` compares that id against the active company selector
before choosing whether a scanned site should carry `3871` `Connected By Another Company` or
`3872` `Already Connected by Another Company`. The larger caller boundary is no longer open
either: the first bounded announcement owner above this formatter family is now
`company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, which re-enters the
peer-route candidate builder at `0x004046a0` and later publishes one of the localized
city-connection bonus news strings `2888`, `2890`, or `2921` through the shell news path.
#### Peer-selector side
The city bonus formatter no longer depends only on
boolean peer existence. The companion helper
`city_connection_bonus_select_first_matching_peer_site` at `0x00420280` is now grounded as the
first-match selector paired with `city_connection_bonus_exists_matching_peer_site`: it walks the
same city-peer candidate set, applies the same site-class table plus the narrower
station-or-transit and linked-instance class-byte flags, and returns one representative matching
peer site id instead of a boolean. `city_site_format_connection_bonus_status_label` reuses that
selector after the note checks so it can recover one linked company context from the selected
peer. The remaining open edge here is therefore above this formatter family, not inside the
peer-scan pair itself.
#### Caller side
The reusable bridge between the status formatter and the
company news lane is now bounded too. `city_connection_bonus_build_peer_route_candidate` at
`0x004046a0` reuses `city_connection_bonus_select_first_matching_peer_site` with both selector
flags forced on, samples the selected peer's derived coordinates through `0x0047df30` and
`0x0047df50`, and then either tries the shared heavy builder
`city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0` or falls
back to the smaller wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry`
`0x00404640` before handing the result back to the company-side announcement sweep at
`0x00406050`. The score side of that announcement lane is tighter now as well:
`city_compute_connection_bonus_candidate_weight` at `0x004010f0` provides the per-city opportunity
weight, `company_query_min_linked_site_distance_to_xy` at `0x00405920` provides the nearest
linked-site distance term, `company_count_linked_transit_sites` at `0x00426590` provides one of
the company-side caps, `company_compute_connection_bonus_value_ladder` at `0x00425320` supplies
the bounded company-side value scalar, and
`company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580` now bounds the
shared prime-rate-side helper that this lane reuses beside the raw issue-`0x39` total,
`scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` now bounds the raw additive
issue-total helper beneath that term, and `company_connection_bonus_lane_is_unlocked` at
`0x00427590` is the small boolean gate above the ladder. Wider governance and CompanyDetail xrefs
now tighten slot `0x2b` into the rolling net-profits lane reused by annual finance checks and a
per-share/history formatter, while the report-history descriptor table now aligns raw slot `0x09`
with the Income Statement fuel-cost lane surfaced by tooltip `1309`. The wider result now reads
more like recent net profits minus recent fuel burden than a governance-pressure term. That now
also sharpens the annual finance lane at `0x00401c50`: the first bankruptcy branch reads as
sustained cash-and-debt stress over recent profits and fuel burden, the later fallback branch as
a deeper `-300000` cash / three bad years cleanup trigger, and the later stock-issue branch reads
as a price-to-book-versus-coupon approval ladder rather than a generic support vote. The tail is
cleaner now too: it compares total retired versus newly issued principal to choose the `2882..2886`
debt headline family, then publishes `2887` separately from the accumulated repurchased-share
count. The sibling news owner above the same
city-pair route family is bounded now too:
`simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`
filters and scores candidate city entries, re-enters the same shared heavy builder through
`city_connection_try_build_route_between_region_entry_pair` `0x00404c60` for the dense pair
sweep and the final retry, and then publishes `2889` `%1 has started a new company - the %2`
or `2890` `%1 has connected %2 to %3.` through the shell news path. The remaining open edge on
this branch is therefore narrower now: it is mostly whether `0x39` should be read as the
narrower city-connection public-opinion lane or as part of a broader management-attitude family,
not the ownership of the connection-bonus formatter, peer-route candidate path, or company news
gate.
#### Route-list side
The neighboring helper
`placed_structure_append_unique_route_entry` at `0x0047f010` is now grounded as the
append-if-missing builder for the six-byte route-entry list rooted at `[site+0x462]` and
`[site+0x466]`. That matters here because the directional overlay query at `0x0047e690` consumes
the same list, so the remaining uncertainty is no longer list ownership. It is down to the exact
semantics of each entry's `u32` payload.
#### Route-entry and Cache Side
The adjacent helper strip is tighter now too.
`placed_structure_service_candidate_local_service_comparison_cache_decay_and_row_propagation`
`0x0047df70` is the recurring age-and-propagation service pass over the paired comparison-cache
float tables `[site+0x3e]` and `[site+0x112]` with age stamps at `[site+0x1e6]`; it zeroes stale
entries older than `0x1d8800`, decays younger ones by the fixed `0x005ce900/0x005ce8f8` scales,
and then propagates stronger marked row values back through the three five-float row bands rooted
at `[site+0x24/+0x28/+0x2c]`. The wrapper
`placed_structure_query_candidate_route_or_local_service_comparison_score` `0x0047e9a0` is now
bounded too: it delegates to `placed_structure_query_candidate_directional_route_overlay_summary`
`0x0047e690` when the requested candidate carries a grouped routing class, otherwise it uses the
simpler local `[cell+0x103]` lane and the current sample list at `[site+0x34/+0x38]` before
writing back into the same comparison-cache bands. The route-entry strip beneath the linked-peer
family is no longer open either: `placed_structure_resolve_route_entry_anchor_record`
`0x0047f310` is the direct resolver over `[site+0x08]`, and
`placed_structure_route_anchor_matches_or_reaches_route_entry_id` `0x0047f250` is the boolean
gate above it, first checking a direct match against `[site+0x08]` and then re-entering
`0x0048e050(mode 2, fallback -1)` on the resolved route-entry record. The route-link companion
`route_link_route_entry_reaches_peer_site_route_group` `0x0047f2d0` is tighter now too: it reads
the peer site's route-entry anchor from `[peer+0x08]`, resolves the current link's own anchor,
and re-enters `0x0048e3c0` to test whether the two anchors belong to the same reachable
route-side family. One smaller linked-peer-side setter is grounded as well:
`placed_structure_set_overlay_mark_byte_and_refresh_linked_peer_overlay_if_changed` `0x0047f290`
updates byte `[site+0x5bc]` and then re-enters
`placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0` when the
byte changes.
#### Terrain-class Side
The nearby linked-instance raster wrappers are no
longer anonymous. `world_resolve_secondary_raster_class_record_at_float_xy` `0x0044e270` is the
world-side float-XY lookup over `[world+0x2131]` plus class table `0x006cfc9c`;
`placed_structure_query_linked_instance_secondary_raster_class_id` `0x0047f170` is the raw
linked-instance wrapper that returns the shifted class id directly; and the paired
record-returning wrappers `placed_structure_resolve_linked_instance_secondary_raster_class_record`
`0x0047f0e0` and
`placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query`
`0x0047f1f0` now bound the two record-returning lanes used by the later world-side and
linked-peer filters. That means the remaining uncertainty in this neighborhood is no longer the
route-entry or terrain-class helper ownership; it is the broader user-facing meaning of the later
callers that consume those gates.