From 049ffa6bd80634075728c532651f294c9ff717af Mon Sep 17 00:00:00 2001 From: Jan Petykiewicz Date: Tue, 14 Apr 2026 17:52:45 -0700 Subject: [PATCH] Close remaining static atlas and export work --- artifacts/exports/rt3-1.06/function-map.csv | 256 +++++++------- .../bootstrap-and-shell-service-bring-up.md | 7 +- .../crt-and-process-startup.md | 7 +- docs/control-loop-atlas/editor-breadth.md | 228 +++++++++---- .../input-save-load-and-simulation.md | 2 +- .../map-and-scenario-content-load.md | 25 +- .../multiplayer-session-and-transport-flow.md | 38 ++- .../control-loop-atlas/next-mapping-passes.md | 211 +++++++++++- ...tion-paintterrain-and-save-load-restore.md | 319 ++++++++++++++---- .../presentation-overlay-and-frame-timing.md | 7 +- ...ntime-roots-camera-and-support-families.md | 42 ++- ...shell-ui-command-and-deferred-work-flow.md | 8 +- .../station-detail-overlay.md | 30 +- 13 files changed, 842 insertions(+), 338 deletions(-) diff --git a/artifacts/exports/rt3-1.06/function-map.csv b/artifacts/exports/rt3-1.06/function-map.csv index 2e7313b..79c0d30 100644 --- a/artifacts/exports/rt3-1.06/function-map.csv +++ b/artifacts/exports/rt3-1.06/function-map.csv @@ -49,12 +49,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0040cc00,6,runtime_object_true_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0040cc10,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot0,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-false stub in the concrete placed-structure specialization table `0x005c8c50`. The helper clears `EAX` and returns immediately, with no field access or side effects. Current evidence only grounds it as one literal-false virtual slot beneath the specialization, so the note stays structural rather than semantic.","objdump + vtable scan" 0x0040cc20,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot1,map,thiscall,inferred,objdump + vtable scan,1,"Second tiny pure-false stub in specialization table `0x005c8c50`. Like the neighboring false slots, it simply clears `EAX` and returns. Current evidence grounds this only as a literal-false virtual slot rather than a named predicate.","objdump + vtable scan" -0x0040cc30,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot2,map,thiscall,inferred,objdump + vtable scan,1,"Third tiny pure-false stub in specialization table `0x005c8c50`. The helper only returns `0`, with no field reads or writes. Current evidence does not yet justify a semantic predicate name beyond that structural role.","objdump + vtable scan" +0x0040cc30,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot2,map,thiscall,inferred,objdump + vtable scan,1,"Third tiny pure-false stub in specialization table `0x005c8c50`. The helper only returns `0`, with no field reads or writes. Current evidence keeps the row at that structural predicate-slot level.","objdump + vtable scan" 0x0040cc40,32,placed_structure_subject_candidate_is_subtype1,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared candidate-profile predicate adjacent to the `0x005c8c50` specialization cluster. The helper follows candidate or profile id `[this+0x173]` through collection `0x0062b268`, reads candidate subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `1`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the returned boolean becomes one of the two mode inputs for `0x00415020`. This is the safest current read for a subtype-`1` predicate over the linked candidate/profile chain rather than a specialization-vtable slot.","objdump + caller inspection + local disassembly + candidate-subtype correlation" -0x0040cc60,26,placed_structure_subject_candidate_query_flag_byte_ba,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared candidate-profile accessor adjacent to the specialization cluster. The helper follows id `[this+0x173]` through candidate collection `0x0062b268` and returns byte `[candidate+0xba]`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the byte is only used as a boolean mode input. Current evidence grounds the field access but not the higher semantic name of candidate byte `0xba`, so the note stays deliberately raw.","objdump + caller inspection + local disassembly + candidate-byte-field correlation" +0x0040cc60,26,placed_structure_subject_candidate_query_flag_byte_ba,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared candidate-profile accessor adjacent to the specialization cluster. The helper follows id `[this+0x173]` through candidate collection `0x0062b268` and returns byte `[candidate+0xba]`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the byte is only used as a boolean mode input. Current evidence keeps the field at the raw candidate-byte level, so the note stays deliberately raw.","objdump + caller inspection + local disassembly + candidate-byte-field correlation" 0x0040cc80,42,placed_structure_subject_candidate_is_subtype1_class3,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared candidate-profile predicate over the same `[this+0x173] -> 0x0062b268` chain as `0x0040cc40`. The helper returns `1` only when candidate subtype byte `[candidate+0x32]` equals `1` and candidate class byte `[candidate+0x8c]` equals `3`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where this branch helps select the flagged-region float-stat mode beneath `0x00415020`. This is the safest current read for the combined subtype-`1` plus class-`3` predicate rather than a direct specialization method.","objdump + caller inspection + local disassembly + candidate-subtype correlation + candidate-class correlation" 0x0040ccb0,14,placed_structure_has_cached_linked_site_id,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Small specialization-side predicate over cached linked-site id `[this+0x2a8]`. The helper returns `1` when that dword is nonzero and `0` otherwise. Because it sits directly in the `0x005c8c50` vtable beside the linked-peer UI and route-anchor family, this is the safest current read for the specialization's cached-linked-site-id presence predicate rather than a broader linked-site resolver.","objdump + vtable scan + local disassembly + linked-site-field correlation" -0x0040ccc0,6,placed_structure_specialization_true_stub_vtable_5c8c50_slot,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-true stub in specialization table `0x005c8c50`. The helper loads literal `1` into `EAX` and returns immediately. Current evidence grounds it only as a literal-true virtual slot beneath the specialization, not yet as a named capability predicate.","objdump + vtable scan" +0x0040ccc0,6,placed_structure_specialization_true_stub_vtable_5c8c50_slot,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-true stub in specialization table `0x005c8c50`. The helper loads literal `1` into `EAX` and returns immediately. Current evidence keeps it at the literal-true virtual-slot level beneath the specialization.","objdump + vtable scan" 0x0040ccd0,30,world_grid_resolve_cell_pointer_by_xy_indices,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-grid address calculator over the live world root at `0x0062c120`. The helper multiplies the caller-supplied Y-like index by world width `[this+0x2145]`, adds the X-like index, scales the resulting linear slot by fixed cell stride `0x1d7`, and returns the corresponding cell pointer under base `[this+0x2129]`. Current grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386`, several world-grid or overlay-side passes at `0x004525bc..0x00452bb2`, and one later shell-side caller at `0x004df4d4`, so this is the safest current read for the shared `(x,y) -> world-cell*` resolver rather than an object-specific helper.","objdump + caller inspection + local disassembly + world-grid correlation + cell-stride correlation" 0x0040ccf0,23,placed_structure_query_linked_instance_candidate_class_byte,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small linked-instance candidate-class reader adjacent to the specialization cluster. The helper first resolves one linked instance through `0x0047de00`, then follows that instance's vtable `+0x80` owner chain, and finally returns candidate class byte `[candidate+0x8c]`. Current grounded callers include later world or UI-side branches at `0x00480fb5` and `0x004b03ce`, where the returned class is compared against `3` and `4`. This is the safest current read for a linked-instance candidate-class accessor rather than a general placed-structure vtable slot.","objdump + caller inspection + local disassembly + candidate-class correlation" 0x0040cd10,88,placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Gated center-cell site-roster sweep adjacent to the specialization cluster. The helper first requires shell or modal latch `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current subject's center world-grid cell through `0x00455f60`, reads the local roster count and packed site-id list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through collection `0x006cec20`. Current grounded caller is the broader collection walk at `0x00413860`, so this is the safest current read for a gated center-cell linked-site roster scan rather than another candidate predicate or direct vtable override.","objdump + caller inspection + local disassembly + center-cell roster correlation" @@ -62,7 +62,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0040ce60,83,placed_structure_canonicalize_radio_station_stem_and_refresh_specialization_state,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Small specialization-side stem normalizer. The helper compares the site stem at `[this+0x3ae]` against the literal `Radio Station`, and when that compare matches it rewrites the same stem buffer to the compact form `RadioStation`. It then re-enters the common stem or geometry refresh helper `0x0040cd70` and the neighboring specialization-side follow-on `0x0045c150` with the caller-supplied stack argument. Current local evidence is strong enough to ground the `Radio Station -> RadioStation` normalization, but not the broader semantic role of the owning specialization table `0x005c8c50`, so this note stays narrow.","objdump + local disassembly + string correlation + neighboring specialization-method correlation" 0x0040cec0,18,placed_structure_resolve_cached_source_record_from_id3cc,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over source id `[this+0x3cc]`. The helper resolves and returns the corresponding entry through source collection `0x0062b2fc`. Current local callers sit on the `0x005c8c50` specialization side beside the stem refresh family, so this is the safest current read for the direct cached source-record resolver rather than another generic collection helper.","objdump + local disassembly + cached-id-field correlation" 0x0040cee0,18,placed_structure_resolve_cached_candidate_record_from_id3d0,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Tiny cached-record resolver over candidate or profile id `[this+0x3d0]`. The helper resolves and returns the corresponding entry through collection `0x0062b268`. Because this function is itself a `0x005c8c50` vtable slot and directly follows the stem-refresh family, this is the safest current read for the specialization's cached candidate-record resolver rather than an unrelated collection bridge.","objdump + vtable scan + local disassembly + cached-id-field correlation" -0x0040cf00,527,placed_structure_build_secondary_specialization_transient_handle_with_four_slot_offsets,map,thiscall,inferred,objdump + local disassembly + transient-family correlation,2,"Heavier specialization-side transient build branch beneath the `0x005c8c50` table. The helper first requires creation-mode byte `[this+0x3d4] == 1` and live transient seed `[this+0x24e]`, then re-enters the neighboring cleanup gate `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, `[this+0x21]`, `[this+0x3a]`, and the constant at `0x005c8cf4`, and allocates one new handle through `0x00475ed0` into `[this+0x25a]`. It then resolves a current world-position tuple through `0x00414450` and `0x0052e720`, publishes several local offset triplets through `0x00475010`, and configures four numbered channels on the new handle through `0x00475030` with selector ids `1..4`. Current evidence grounds this as a second transient-handle builder in the same specialization-side payload family as `0x0045c310/0x0045b210`, but not yet the user-facing subtype semantics of the handle itself.","objdump + local disassembly + transient-family correlation + geometry-derived offset correlation" +0x0040cf00,527,placed_structure_build_secondary_specialization_transient_handle_with_four_slot_offsets,map,thiscall,inferred,objdump + local disassembly + transient-family correlation,2,"Heavier specialization-side transient build branch beneath the `0x005c8c50` table. The helper first requires creation-mode byte `[this+0x3d4] == 1` and live transient seed `[this+0x24e]`, then re-enters the neighboring cleanup gate `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, `[this+0x21]`, `[this+0x3a]`, and the constant at `0x005c8cf4`, and allocates one new handle through `0x00475ed0` into `[this+0x25a]`. It then resolves a current world-position tuple through `0x00414450` and `0x0052e720`, publishes several local offset triplets through `0x00475010`, and configures four numbered channels on the new handle through `0x00475030` with selector ids `1..4`. Current evidence carries this row conservatively as the second transient-handle builder in the same specialization-side payload family as `0x0045c310/0x0045b210`.","objdump + local disassembly + transient-family correlation + geometry-derived offset correlation" 0x0040d170,56,placed_structure_build_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Small specialization-side hook that conditionally builds the primary transient handle through `0x0045c310`. The helper resolves the current candidate from cached stem id `[this+0x3cc]`, follows that candidate's profile or source id through `[entry+0x173]`, and reads dword flag `[candidate+0x4b]`. When that flag is nonzero it tail-calls `placed_structure_specialization_build_primary_transient_handle_from_payload_strings` `0x0045c310`; otherwise it returns immediately. This is the strongest current owner for the candidate-flag-gated primary transient build hook in the `0x005c8c50` specialization family.","objdump + local disassembly + candidate-flag correlation + transient-build correlation" 0x0040d1b0,56,placed_structure_release_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Release-side companion to `0x0040d170`. The helper resolves the same candidate chain from cached stem id `[this+0x3cc]`, reads dword flag `[candidate+0x4b]`, and when that flag is nonzero tail-calls `placed_structure_specialization_release_primary_transient_handle_and_siblings` `0x0045c3c0`; otherwise it returns immediately. Current evidence grounds this as the candidate-flag-gated release hook for the primary specialization transient rather than a generic cleanup entry.","objdump + local disassembly + candidate-flag correlation + transient-release correlation" 0x0040d1f0,23,placed_structure_resolve_linked_peer_record_from_cached_site_id,map,thiscall,inferred,objdump + local disassembly,3,"Tiny cached-record resolver over linked site id `[this+0x2a8]`. When that id is nonzero the helper resolves and returns the linked placed-structure record through collection `0x006cec20`; otherwise it returns null. Current grounded callers include the contextual status publisher `0x0040e4e0` and the linked-anchor service family, so this is the safest current read for the direct linked-peer resolver rather than another boolean gate.","objdump + local disassembly + linked-peer resolver correlation" @@ -109,14 +109,14 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00418610,584,world_grid_refresh_projected_rect_sample_band_and_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan.","objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation" 0x00419110,234,placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map,map,cdecl,inferred,objdump + caller xrefs + local disassembly + bucket-map correlation,3,"Rectangular placed-structure refresh wrapper over a hashed per-cell bucket map. The helper clamps the caller rectangle against live world dimensions `[0x0062c120+0x2155/+0x2159]`, packs each cell key as `(row << 16) | col`, resolves one bucket head through the caller-supplied map root at `[arg0+0x88]` and the shared hash lookup `0x0053dae0`, and then walks the returned linked chain. For every resolved bucket entry it forwards the stored coordinate pair from `[entry+0x04/+0x08]` plus two zero stack flags into `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` on the current placed-structure owner carried by that entry, so the current effect is a local-runtime side-state refresh across every bucketed site in the rectangle rather than a generic collection iterator. Current grounded caller is the edit-side branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, so this is the safest current read for the bucket-map-driven rect refresh wrapper rather than another world-grid brush helper.","objdump + caller xrefs + local disassembly + bucket-map correlation + local-runtime-side-state correlation" 0x00419200,41,world_grid_query_projected_rect_scratch_cell_dword_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Tiny projected-rectangle scratch-bank getter over the temporary dword cell-value bank rooted at `0x0062b300`. When that bank exists, the helper flattens the caller-supplied cell coordinates through live world width `[0x0062c120+0x2155]` and returns the corresponding dword from the bank; otherwise it returns `0`. Current grounded caller is the later world-side branch at `0x0048af99`, which uses the returned nonzero test as one score or gating input, so this is the safest current read for the projected-rect scratch-cell dword getter rather than another permanent world-grid query.","objdump + caller xrefs + local disassembly + projected-rect correlation + scratch-bank correlation" -0x0041ab50,6,city_database_entry_constant_38_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" -0x0041ab60,6,city_database_entry_constant_34_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" +0x0041ab50,6,city_database_entry_constant_38_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly" +0x0041ab60,6,city_database_entry_constant_34_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly" 0x0041ab70,5,city_database_entry_load_tagged_payload_via_0x45c6f0,map,thiscall,inferred,objdump + vtable correlation + local disassembly,2,"Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540` iterates its loaded records and dispatches vtable slot `+0x40`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot.","objdump + vtable correlation + local disassembly + city-database loader correlation" -0x0041ab80,127,city_database_entry_refresh_named_handle_and_return_scaled_primary_float,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle is still open, but the owning family now aligns structurally with the city-database collection refreshed by `0x00474540` and serialized by `0x00474610`.","objdump + caller inspection + local disassembly + city-database family correlation" +0x0041ab80,127,city_database_entry_refresh_named_handle_and_return_scaled_primary_float,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The row is therefore carried conservatively as a named-handle refresh within the city-database collection family refreshed by `0x00474540` and serialized by `0x00474610`.","objdump + caller inspection + local disassembly + city-database family correlation" 0x0041ac00,3,city_database_entry_false_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041ac10,3,city_database_entry_false_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041ac20,3,city_database_entry_false_stub_vtable_5c9750_slot2,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Third tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" -0x0041ac30,6,city_database_entry_constant_10_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the city-database-entry table `0x005c9750`. The helper returns literal `10` in `EAX` and exits. Current evidence does not yet justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" +0x0041ac30,6,city_database_entry_constant_10_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the city-database-entry table `0x005c9750`. The helper returns literal `10` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly" 0x0041ac40,6,city_database_entry_true_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041ac50,6,city_database_entry_true_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041f5c0,134,world_region_load_tagged_payload_and_profile_collection_0x37f,map,thiscall,inferred,objdump + vtable scan + local disassembly + region-family correlation,2,"Payload-side virtual slot in the world-region record table rooted at `0x005c9a60`. The helper clamps scalar `[region+0x31b]` to at least `1.0`, clears `[region+0x317]` when that clamp fires, reloads the shared tagged string-triplet payload through `0x00455fc0`, allocates one `0x88`-byte indexed-collection object through `0x0053b070`, constructs that collection through `0x00518b90`, stores it into `[region+0x37f]`, and then forwards the caller-supplied bundle or stream context into that collection through `0x00518680`. The function returns the accumulated size from the payload reload plus collection load. Constructor-side evidence now ties `[region+0x37f]` to the same profile-collection family rebuilt by `0x00420e00` and `0x00420ed0`.","objdump + vtable scan + local disassembly + region-family correlation + profile-collection correlation" @@ -125,7 +125,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0041f6a0,11,world_region_query_profile_collection_slot_count_field_0x37f,map,thiscall,inferred,objdump + local disassembly + region-family correlation,2,"Tiny world-region helper that treats field `[region+0x37f]` as one indexed collection and returns its current slot count through `indexed_collection_slot_count` `0x00517cf0`. Current grounded caller is `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, where it bounds one region-local profile or structure-count loop.","objdump + local disassembly + region-family correlation + profile-collection correlation" 0x0041f6b0,40,world_region_query_world_scalar_at_rounded_normalized_coords,map,thiscall,inferred,objdump + local disassembly + region-family correlation,2,"Small helper in the world-region record family. It queries the normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, rounds both through `0x005a10d0`, then forwards the resulting integer pair plus the active world root `0x0062c120` into `0x0044afa0`. Current evidence is strong enough for the rounded region-coordinate world-scalar query shape, but not for a tighter semantic name for the returned scalar.","objdump + local disassembly + region-family correlation + world-scalar-query correlation" 0x0041f6e0,12,world_region_center_world_grid_cell_has_packed_u16_token,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small helper that resolves the current region's center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60` and then tails into `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` with the caller-supplied `u16` token. Current grounded callers include the city-connection bonus sweep `0x004010f0`, where it acts as a center-cell token probe rather than a broader route or ownership query.","objdump + local disassembly + caller correlation + packed-roster correlation" -0x0041f6f0,5,world_region_query_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + field inspection,1,"Tiny raw byte getter over region field `[this+0x42]`. The helper zero-extends that byte into `EAX` and returns immediately, with no side effect. Current evidence does not yet justify a tighter semantic name for the flag itself.","objdump + local disassembly + field inspection + region-family correlation" +0x0041f6f0,5,world_region_query_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + field inspection,1,"Tiny raw byte getter over region field `[this+0x42]`. The helper zero-extends that byte into `EAX` and returns immediately, with no side effect. Current evidence keeps the row at the raw flag-byte level.","objdump + local disassembly + field inspection + region-family correlation" 0x0041f700,3,runtime_object_false_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041f710,6,runtime_object_true_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot immediately after `0x0041f700` in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041f720,136,world_region_publish_formatted_name_and_enter_preview_mode_0x12_when_world_state_0_or_0x15,map,thiscall,inferred,objdump + vtable scan + local disassembly + caller correlation,2,"Virtual slot in the world-region record table rooted at `0x005c9a60`. The helper formats the current name lane `[region+0x356]` into one stack-local shell text buffer through `0x005193f0` and `0x00518de0`, publishes that buffer through `0x00538c70`, and then checks world state `[0x0062c120+0x2175]`. When that state is `0` or `0x15`, it dispatches `world_switch_preview_or_tool_mode_and_seed_parameter_block` `0x00452fa0` with preview handle `[region+0x23a]`, literal action `0x12`, and the paired sentinel dwords `0x1869f/0x1869f`. Constructor-side evidence now grounds this family as the live world-region record cluster rather than an unnamed sibling subtype.","objdump + vtable scan + local disassembly + caller correlation + region-family correlation + world-mode branch correlation" @@ -167,8 +167,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00455860,5,runtime_object_thunk_to_shared_formatter_0x530820,map,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Tiny tail-jump thunk that forwards directly into `0x00530820`. Current grounded callers include the placed-structure UI formatter `0x0040e9d0` and the city-site connection-status formatter `0x004207d0`, so the safest current read is a shared fallback formatter thunk rather than a standalone owner.","objdump + local disassembly + caller correlation" 0x00455870,83,runtime_object_load_two_triplet_scalar_bands_from_stream_and_publish_them,map,thiscall,inferred,objdump + local disassembly + stream-load symmetry,2,"Shared load-side helper over the broader `0x23a` runtime-object family. The function reads six four-byte lanes from the caller-supplied stream through `0x00531150`, then publishes the first three as one triplet through `0x00530720` and the second three through `0x0052e8b0`. The accumulated return value is the summed byte count from those six `0x531150` reads. This is the strongest current load-side counterpart to `runtime_object_serialize_two_triplet_scalar_bands` `0x00455930` rather than an unrelated stream helper.","objdump + local disassembly + stream-load symmetry + triplet-publish correlation" 0x00455b20,72,runtime_object_initialize_base_0x23a_record_fields,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared base initializer for one `0x23a`-sized runtime object family. The helper installs base vtable `0x005cb1c0`, clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, and re-enters `0x0052ecd0` before returning `this`. Current grounded callers include the city-entry temporary constructor `0x00474110`, multiple specialization loaders around `0x0045b683/0x0045c893`, and the object-construction path at `0x0048dd65`, so the safest current read is a shared base-field initializer rather than a city-only constructor.","objdump + caller xrefs + local disassembly + field-layout correlation + object-size correlation" -0x00455b00,1,runtime_object_noop_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + vtable scan + local disassembly" -0x00455b10,1,runtime_object_noop_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + vtable scan + local disassembly" +0x00455b00,1,runtime_object_noop_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level.","objdump + vtable scan + local disassembly" +0x00455b10,1,runtime_object_noop_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level.","objdump + vtable scan + local disassembly" 0x00455b70,266,runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared initializer over the same `0x23a`-sized runtime object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, optionally copies up to three caller-supplied strings into `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` through `0x0051d820`, synthesizes one default local token buffer when the middle string is absent through `0x00518de0`, chooses one effective mode string from the third or first input, derives one owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and then re-enters `0x0052edf0` plus `0x0052e670` to seed the remaining runtime scalar band. Current grounded callers span the city-entry constructor `0x004741e3`, several specialization-side rebuilds, and later object constructors at `0x0048a299`, `0x0048a31d`, and `0x00490a79`, so the safest current read is a shared scalar-band initializer from optional string triplet plus mode defaults rather than a city-only helper.","objdump + caller xrefs + local disassembly + field-layout correlation + optional-string correlation + mode-default correlation" 0x00455fc0,250,runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared tagged-payload loader over the broader `0x23a` runtime-object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, opens the tagged bracket `0x55f1..0x55f3`, reads three temporary strings through `0x00531380`, reseeds the runtime scalar band through `runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults` `0x00455b70` with default float lanes `1.0/1.0` and flag `0`, then dispatches vtable slot `+0x48` and re-enters `0x0052ebd0`. Current grounded callers include the city-entry refresh helper `0x00474260` and the placed-structure specialization loader `0x0045c150`, so the safest current read is a shared tagged string-triplet loader plus scalar-band reseed rather than a city-only payload helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation + scalar-band reseed correlation" 0x004560c0,53,runtime_object_query_nested_lookup_float_via_fields_0x14_0x3a_0x21,map,thiscall,inferred,objdump + local disassembly + field-chain correlation,1,"Small shared float query over the broader `0x23a` runtime-object family. When lookup root `[this+0x14]` is nonnull, the helper derives one nested table offset from `[this+0x3a]` and `[this+0x21]`, follows that chain, and returns the float at the resolved record's `+0x18`; otherwise it returns `0.0`. Current evidence grounds the lookup chain but not the higher semantic meaning of those fields, so the note stays deliberately structural.","objdump + local disassembly + field-chain correlation" @@ -184,7 +184,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00480210,448,placed_structure_construct_linked_site_record_from_anchor_and_coords,map,thiscall,inferred,objdump + caller inspection + constructor inspection,3,"Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`.","objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation" 0x0048a1e0,336,runtime_object_attach_infrastructure_child_with_optional_first_child_triplet_clone,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata correlation,2,"Shared `Infrastructure` child-attach helper over the broader `0x23a` runtime-object family. The function first checks the caller's child list at `[this+0x08]`. When that list holds more than one child, it samples the first child's two triplet scalar bands through `0x0052e880` and `0x0052e720`, destroys the caller-selected prior child through vtable slot `+0x18(0)`, allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, attaches it back to the owner through `0x005395d0`, and republishes the sampled triplets through `0x0052e8b0` and `0x00530720`. When the owner has at most one child, it still allocates and seeds the same `Infrastructure` object but attaches it through `0x0053a5d0` without the cloned-triplet republish. Current grounded callers are the repeated builder branches around `0x004a2cde..0x004a37d9`, so this is the safest current read for attaching one seeded `Infrastructure` child with an optional first-child triplet clone rather than a subtype-specific UI helper.","objdump + caller xrefs + local disassembly + rdata correlation + child-attach correlation" 0x0048abc0,11,linked_site_set_route_entry_anchor_id_field_0x222,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site dword `[this+0x222]`. The helper stores the caller-supplied route-entry id and returns. Current grounded callers are the linked-site constructor and refresh family at `0x00480210`, `0x00480bb0`, and nearby repair branches `0x00480463`, `0x00480968`, `0x00480ac1`, and `0x00480da1`, where this field is treated as the currently chosen route-entry anchor id. The safest current read is therefore a direct linked-site route-entry-anchor setter rather than a generic scalar write.","objdump + caller xrefs + local disassembly + route-anchor correlation" -0x0048abd0,1,linked_site_noop_stub,map,thiscall,inferred,objdump + local disassembly,1,"Literal no-op stub adjacent to the linked-site route-entry-anchor helpers. The function returns immediately with no field access or side effect. Current evidence does not justify a stronger semantic name.","objdump + local disassembly" +0x0048abd0,1,linked_site_noop_stub,map,thiscall,inferred,objdump + local disassembly,1,"Literal no-op stub adjacent to the linked-site route-entry-anchor helpers. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level.","objdump + local disassembly" 0x0048abe0,15,linked_site_query_mode_field_0x226_equals_2,map,thiscall,inferred,objdump + local disassembly,2,"Tiny predicate over linked-site dword `[this+0x226]`. The helper returns `1` only when that field equals literal `2`. Current local callers are still indirect through the linked-site vtable, so the field's player-facing meaning remains open; the safest current read is a direct `mode == 2` predicate over linked-site field `0x226`.","objdump + local disassembly + linked-site-field correlation" 0x0048dd50,359,runtime_object_rebuild_infrastructure_children_and_refresh_primary_child_slot,map,thiscall,inferred,objdump + local disassembly + caller correlation + rdata correlation,2,"Loop-driven `Infrastructure` child rebuild beneath the same `0x005cfd00` family. For each ordinal `0..count-1`, the helper allocates a fresh `Infrastructure` child, dispatches that child through `record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots` `0x00455a50`, and either tears the child down when the current ordinal is above `5` or attaches it back to the owner through `0x005395d0` after republishing the child's current triplet bands. When owner field `[this+0x248]` still points at the same ordinal index byte, it replaces that cached primary-child slot with the rebuilt child. After the loop it recomputes one grid anchor from current world-space fields, refreshes the current world cell through `0x00448a70`, conditionally re-enters `0x00493660` and `0x0048b660` when byte `[this+0x216]` equals `1`, and finally re-enters `0x0048b660` once more before returning. The current note stays structural because the user-facing subtype semantics remain open, but the `Infrastructure` child-rebuild ownership is strong.","objdump + local disassembly + caller correlation + rdata correlation + child-rebuild correlation" 0x0048e140,24,runtime_object_resolve_route_entry_from_field_0x206,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x206]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2cec` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation" @@ -219,12 +219,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00411da0,111,structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_pair,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Reads one fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When that slot is not `-1` and the row's leading name pointer at `+0x04` is nonnull, the helper copies the pointed zero-terminated string to the caller buffer and writes the two adjacent scalar dwords from row offsets `+0x0c` and `+0x10` to the caller outparams before returning `1`; otherwise it returns `0`. Current grounded caller is the placed-structure specialization service around `0x0045b245`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-pair accessor rather than a more specific asset-label decode.","objdump + local disassembly + caller inspection + fixed-table inspection" 0x00411e10,50,structure_candidate_try_query_positive_fixed_profile_slot_0x798_scalar_and_trailing_value,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Queries the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and the row dword at offset `+0x14` is positive, the helper writes row dword `+0x20` to the caller outparam and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, where it acts as a prerequisite gate before the heavier fixed-row payload copy sibling `0x00411e50`.","objdump + local disassembly + caller inspection + fixed-table inspection" 0x00411e50,133,structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_triplet,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Reads the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and row dword `+0x14` is positive, the helper copies the pointed zero-terminated string at row offset `+0x04` to the caller buffer, writes row dwords `+0x18`, `+0x1c`, and `+0x14` to the caller outparams, and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-triplet accessor rather than a narrower effect-family decoder.","objdump + local disassembly + caller inspection + fixed-table inspection" -0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection + local disassembly,3,"Rebuilds the per-candidate cargo-membership tables and scaled per-cargo rate band after one runtime descriptor array has been materialized. The helper clears the two compact cargo-id tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and the thirteen-dword per-cargo accumulator band rooted at `[this+0x0a1]`, then fills one local `0x35`-byte scratch status array from the live `0xbc` descriptor strip in `[this+0x37]`. Each subordinate cargo row is classified against the current scenario year at `[0x006cec78+0x0d]` into status `1` when that cargo is only referenced and status `2` when the row is currently year-active; the helper keeps the maximum status seen per remapped cargo id through `0x0062ba8c+0x9a`. The scaled-rate side is tighter now too: for descriptor mode `0` it multiplies each subordinate row amount by the shared production-cap float `[this+0x2a]` and divides by the descriptor amount `[desc+0x04]`, while nonzero-mode descriptors bypass that normalization and publish their row amount directly. After the scan it counts every cargo with scratch status `>= 1` into `[this+0x7a4]`, every cargo with status `>= 2` into `[this+0x7a8]`, allocates the two final `u16` id tables, zeroes them, and compacts the `status>=1` and `status>=2` sets into `[this+0x79c]` and `[this+0x7a0]` respectively. That keeps the stronger current split narrow and concrete: the first table is the referenced-cargo set, the second is the currently active-cargo set, and the per-cargo float band at `[this+0x0a1..+0x0b8]` is the same cap-scaled runtime rate band later queried by `0x004129d0`. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + local disassembly + scenario-state correlation + cargo-collection correlation + membership-table compaction correlation" +0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection + local disassembly,3,"Rebuilds the per-candidate cargo-membership tables and scaled per-cargo rate band after one runtime descriptor array has been materialized. The helper clears the two compact cargo-id tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and the thirteen-dword per-cargo accumulator band rooted at `[this+0x0a1]`, then fills one local `0x35`-byte scratch status array from the live `0xbc` descriptor strip in `[this+0x37]`. The year-status rule is tighter now too: with current scenario year `[0x006cec78+0x0d]`, or fallback year `0x709` when no live world is present, each subordinate cargo row is marked `2` only while `start_year <= current_year < end_year`; rows outside that active window still contribute status `1` as referenced cargo. The helper keeps the maximum status seen per remapped cargo id through `0x0062ba8c+0x9a`. The scaled-rate side is tighter in the same way: for descriptor mode `0` it multiplies each subordinate row amount by the shared production-cap float `[this+0x2a]` and divides by the descriptor amount `[desc+0x04]`, while nonzero-mode descriptors bypass that normalization and publish their row amount directly. After the scan it counts every cargo with scratch status `>= 1` into `[this+0x7a4]`, every cargo with status `>= 2` into `[this+0x7a8]`, allocates the two final `u16` id tables as `(count*2)+1`-byte buffers, zeroes them, and compacts the `status>=1` and `status>=2` sets into `[this+0x79c]` and `[this+0x7a0]` respectively. That keeps the stronger current split narrow and concrete: the first table is the referenced-cargo set, the second is the currently active-cargo set, and the per-cargo float band at `[this+0x0a1..+0x0b8]` is the same cap-scaled runtime rate band later queried by `0x004129d0`. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + local disassembly + scenario-state correlation + cargo-collection correlation + membership-table compaction correlation + year-window correlation" 0x004120b0,1119,structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Stream-load owner for one live structure candidate record beneath the broader collection load path at `0x00412fb0`. The helper seeds runtime id `[this+0xe4]` from its first caller argument, clears the cargo-membership pointers and mode-summary band at `[this+0x79c..+0x7b0]`, sets the cached summary year `[this+0x788] = -1`, opens one named bundle slot through `0x00530c80`, and then reads the packed candidate body through repeated `0x00531150` calls. The fixed header import is tighter now too: it reads one outer dword header, then the candidate stem or display band at `[this+0x04]` length `0x1e`, the scalar fields at `[this+0x22]`, `[this+0x2a]`, and `[this+0x2e]`, the year words `[this+0x26/+0x28]`, byte `[this+0x32]`, and runtime descriptor count `[this+0x33]`. The descriptor strip itself is allocated as `count*0xbc + 1` bytes into `[this+0x37]`, then every `0xbc` slot is zeroed before the raw read. Descriptor import is tighter in the same way: mode-`0` descriptors immediately resolve their primary token string at `+0x08` back into cargo id `[desc+0x1c]`, subordinate-row descriptors resolve each row token at `+0x30 + row*0x1c` back into `[desc+0x44 + row*0x1c]`, and both paths clamp the descriptor start-year word `[desc+0x20]` upward to the resolved cargo availability floor at `[cargo+0x21]`. The later import band is explicit too: bundles at `>= 0x3ed` load `[this+0x3b..+0xbb]`, including the scalar strip `[this+0x3b/+0x3f/+0x43/+0x47/+0x4b]`, label band `[this+0x4f]`, summary quartet `[this+0x8c..+0xa0]`, per-cargo float lanes `[this+0xa1..+0xb8]`, and selector bytes `[this+0xb9..+0xbb]`; bundles at `>= 0x3f2` then load the wider `0x24`-byte trailer at `[this+0xc0]`, while older bundles keep that trailer in its narrow `0x02`-byte form. When `[this+0x4b]` is nonzero the helper also forces `[this+0x47] = 1.0`, rescales `[this+0x43]` from `[this+0x22]` through `0x005a10d0`, and clamps the final value to at least `0x1388`. After closing the slot through `0x00530a00` it re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, resets stem index `[this+0x798]` to `-1`, normalizes the candidate stem through the two built-in aliases at `0x005c8f94` and `0x005c8e4c`, and then scans the fixed row table `0x005ed338..0x005edca4` until it finds the matching stem index. Current grounded caller is the collection-wide stream-load path at `0x00412fb0`.","objdump + local disassembly + caller correlation + bundle-slot correlation + descriptor-year-floor correlation + stem-table correlation + version-gate correlation + field-width correlation" 0x00412510,72,structure_candidate_is_enabled_for_current_runtime_year_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small enable-or-year gate beneath the live candidate cargo-summary family. The helper first requires latch `[this+0x7ac]` to be nonzero. When shell state `[0x006cec74+0x17c]` is already armed it returns true immediately; otherwise it consults the scenario-side runtime gate at `[0x006cec78+0x46c38]` and compares the current effective year from `[0x006cec78+0x05]` or `[0x006cec78+0x0d]` against candidate word `[this+0x26]`, returning true only when the scenario year has reached that threshold. Current grounded callers are the collection-side wrapper at `0x00413de0` and the linked-count cargo-summary accumulator at `0x0041e795`, so this is the safest current read for the candidate-side availability gate above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` rather than a general profile or editor predicate.","objdump + local disassembly + caller correlation + year-gate correlation" 0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_selected_mode_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by requiring the primary cargo id at `[desc+0x1c]` to map through the live cargo-availability latch at `0x0062ba8c[cargo].+0x16e`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the inclusive descriptor year window `[desc+0x20]..[desc+0x22]`. The selected-bank split is tighter now too: when caller bank `0` is active the helper rejects descriptors whose dword gate `[desc+0x24]` is nonzero, while caller bank `1` rejects descriptors whose dword gate `[desc+0x28]` is nonzero. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to keep that same live cargo-availability latch `[cargo+0x16e]` nonzero. Current grounded callers are `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-availability-latch correlation + selected-bank-gate correlation + special-condition correlation" 0x004125f0,87,structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the currently active mode-`0` runtime descriptors that still own at least one subordinate row for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, keeps only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active mode-`0` descriptors that contribute cap-shared subordinate-row output.","objdump + caller xrefs + callsite inspection + cap-share-bank correlation" -0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it stamps the current scenario year into `[this+0x788]`, clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, and then walks every live `0xbc` descriptor across both mode banks `0` and `1` through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. The bank split is tighter now too because it is driven first by descriptor mode and then by whether subordinate rows exist. Mode-`0` descriptors with no subordinate rows accumulate their primary cargo scalar `[desc+0x04]` into the direct primary-cargo bank rooted at `[this+0x03a]`, keyed by resolved cargo id `[desc+0x1c]`. Mode-`0` descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, then publish that cap share into the primary-cargo bank rooted at `[this+0x0a4]`, again keyed by `[desc+0x1c]`, and finally scale each subordinate row amount `[desc+0x48+row*0x1c]` into the zero-mode subrow bank rooted at `[this+0x178]`, keyed by `[desc+0x44+row*0x1c]`. Nonzero-mode descriptors bypass the primary-cargo banks entirely and accumulate their subordinate-row amounts directly into the nonzero-mode subrow bank rooted at `[this+0x10e]`, keyed by `[desc+0x44+row*0x1c]`. The return epilogue reads one caller-selected cargo lane back out of those exact roots as four distinct out channels: direct primary-cargo scalar from `[this+0x03a]`, cap-share primary-cargo scalar from `[this+0x0a4]`, nonzero-mode subrow scalar from `[this+0x10e]`, and zero-mode cap-scaled subrow scalar from `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and this consumer, so unresolved imported marker rows would still fall into the first summary-bank bucket here while the semantic meaning of cargo id `0` itself remains ungrounded. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + local disassembly + callsite inspection + scenario-state correlation + year-stamp correlation" +0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it stamps the current scenario year into `[this+0x788]`, clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, and then walks every live `0xbc` descriptor across both mode banks `0` and `1` through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. The bank split is tighter now too because it is driven first by descriptor mode and then by whether subordinate rows exist. Mode-`0` descriptors with no subordinate rows accumulate their primary cargo scalar `[desc+0x04]` into the direct primary-cargo bank rooted at `[this+0x03a]`, keyed by resolved cargo id `[desc+0x1c]`. Mode-`0` descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, then publish that cap share into the primary-cargo bank rooted at `[this+0x0a4]`, again keyed by `[desc+0x1c]`, and finally scale each subordinate row amount `[desc+0x48+row*0x1c]` into the zero-mode subrow bank rooted at `[this+0x178]`, keyed by `[desc+0x44+row*0x1c]`. Nonzero-mode descriptors bypass the primary-cargo banks entirely and accumulate their subordinate-row amounts directly into the nonzero-mode subrow bank rooted at `[this+0x10e]`, keyed by `[desc+0x44+row*0x1c]`. The return epilogue reads one caller-selected cargo lane back out of those exact roots as four distinct out channels: direct primary-cargo scalar from `[this+0x03a]`, cap-share primary-cargo scalar from `[this+0x0a4]`, nonzero-mode subrow scalar from `[this+0x10e]`, and zero-mode cap-scaled subrow scalar from `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and this consumer, so unresolved imported marker rows would still fall into the first summary-bank bucket here. Current caller-side evidence keeps that boundary narrow too: steady-state helpers do not probe cargo id `0` like an ordinary cargo lane, and the explicit `cargo id 0` placed-structure branch bypasses the normal cargo-reference helper for linked-site classification instead. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + local disassembly + callsite inspection + scenario-state correlation + year-stamp correlation + cargo-id-0 caller-boundary correlation" 0x00412960,49,structure_candidate_query_direct_and_normalized_supply_channels,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the sum of the wrapper's two supply-side out lanes rather than exposing all four summary channels directly. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the direct-supply-side cargo presence test. The wrapper does not add any post-query special case for unresolved cargo bucket `0`; it just sums the returned supply-side floats.","objdump + callsite inspection + wrapper-correlation" 0x004129a0,45,structure_candidate_query_scaled_production_output_channel,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the single scaled production-output subrow channel without combining it with the neighboring supply lanes. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the scaled-supply or production-side cargo presence test. Like the sibling wrapper at `0x00412960`, it does not special-case unresolved cargo bucket `0` after the underlying query returns.","objdump + callsite inspection + wrapper-correlation" 0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned nonzero-mode subrow channel plus zero-mode cap-scaled subrow channel are positive. One final fallback follows the global cargo remap at `0x0062ba8c+0x9a`: if the requested cargo has a valid remap target, the helper checks the two cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` for that remapped index before deciding. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation" @@ -306,7 +306,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00422be0,768,world_region_count_placed_structures_for_category,map,thiscall,inferred,objdump + callsite inspection,3,"Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen.","objdump + callsite inspection" 0x00422ee0,884,world_region_try_place_candidate_structure,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family.","objdump + caller xrefs + callsite inspection" 0x004235c0,1887,world_region_balance_structure_demand_and_place_candidates,map,thiscall,inferred,objdump + callsite inspection,4,"Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, queries projected structure-count scalars through `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0`, and then computes target demand for three structure categories by comparing those projected totals against live placed counts plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop.","objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation + projected-demand correlation" -0x004234e0,211,world_region_query_projected_structure_count_scalar_by_category,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Returns one projected structure-count scalar for the requested region and category family. On the live-region branch `[region+0x23e] != 0`, the helper indexes the category table at `0x005ee1b0` by `(live_region_class, category)`, scales it by scenario difficulty and the normalized region-density field `[region+0x25e]`, multiplies by the global pre-recipe scalar `[world+0x0bde]`, and then multiplies by the cached building-count slot `[region+0x242]`. On the fallback branch it instead derives one region bucket from `[region+0x25e]`, combines the two static tables `0x005ee138` and `0x005ee1b0`, applies the alternate scenario-difficulty scale, and again multiplies by `[world+0x0bde]` before returning the final float. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator.","objdump + local disassembly + caller correlation + city-count-stats correlation + pre-recipe-scalar correlation" +0x004234e0,211,world_region_query_projected_structure_count_scalar_by_category,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Returns one projected structure-count scalar for the requested region and category family. The helper has two materially different branches. On the live-region branch `[region+0x23e] != 0`, it indexes base table `0x005ee1b0` by `(live_region_class, category)`, multiplies by the scenario-difficulty table `0x005f33e0` selected from world difficulty dword `[world+0x2d]`, scales by normalized region-density `[region+0x25e] / 0x005c85d8`, multiplies by the global pre-recipe scalar `[world+0x0bde]`, and then multiplies by cached building-count slot `[region+0x242]` before the final fixed scale at `0x005c8918`. On the fallback branch it instead rounds `[region+0x25e]` through `0x005a10d0`, derives one region bucket via `0x00421490`, combines tables `0x005ee138` and `0x005ee1b0`, applies the alternate scenario-difficulty table `0x005f33cc`, scales by the same normalized region-density and global pre-recipe scalar `[world+0x0bde]`, then applies fixed scale `0x005c8d68` without the `[region+0x242]` multiplier. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator.","objdump + local disassembly + caller correlation + city-count-stats correlation + pre-recipe-scalar correlation + branch-split correlation" 0x00423d30,51,world_region_refresh_cached_category_totals_and_weight_slots,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Refreshes one small cached region summary band rooted at `[this+0x27a]`. The helper forwards three out-pointers `+0x27a/+0x27e/+0x282` plus one return slot `+0x286` into world_region_accumulate_structure_category_totals `0x00422900`, forcing the remaining category outputs and optional aggregate pointers to zero. Current grounded caller is the post-load seeding-burst tail around `0x00437bdc`, which sweeps the live region collection `0x0062bae0` after simulation_run_chunked_fast_forward_burst `0x00437b20`. This is therefore the narrow cached-category-summary refresher beneath that region-side setup and maintenance family rather than a company debt-table helper.","objdump + local disassembly + caller inspection + post-load caller correlation" 0x00423d70,176,company_repay_bond_slot_and_compact_debt_table,simulation,thiscall,inferred,objdump + caller inspection,4,"Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper.","objdump + caller inspection + finance-field correlation" 0x00423ec0,33,company_adjust_available_track_laying_capacity_with_floor_zero,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter.","objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation" @@ -337,7 +337,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0042a2e0,645,company_read_control_transfer_metric_slot,simulation,thiscall,inferred,objdump + caller inspection,3,"Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader.","objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation" 0x0042a5d0,131,company_read_year_or_control_transfer_metric_value,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula.","objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation" 0x0042c690,311,placed_structure_rebuild_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. The cargo-id sweep is tighter now too: the inner loop starts at cargo id `1` and runs upward through the current live cargo count, so this steady-state bitset owner never intentionally queries cargo id `0`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + cargo-id-loop correlation" -0x0042c8f0,112,placed_structure_refresh_linked_candidate_flag4,map,thiscall,inferred,objdump + caller xrefs + linked-instance inspection,3,"Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open.","objdump + caller xrefs + linked-instance inspection + candidate-flag correlation" +0x0042c8f0,112,placed_structure_refresh_linked_candidate_flag4,map,thiscall,inferred,objdump + caller xrefs + linked-instance inspection,3,"Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild with candidate byte `[candidate+0xba]` kept at the raw-flag level.","objdump + caller xrefs + linked-instance inspection + candidate-flag correlation" 0x0042cab0,117,placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link,map,thiscall,inferred,objdump + caller inspection + route-style remap inspection,3,"Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests.","objdump + caller inspection + route-style remap inspection + peer-link emission correlation" 0x0042cb30,124,placed_structure_clamp_candidate_service_age_table,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper.","objdump + caller xrefs + callsite inspection + route-age correlation" 0x0042cbb0,145,placed_structure_route_supports_candidate_local_service_mode,map,thiscall,inferred,objdump + caller xrefs + route-record inspection,3,"Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms.","objdump + caller xrefs + route-record inspection + candidate-table correlation" @@ -371,11 +371,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00433730,1,world_runtime_release_followon_noop_placeholder,map,cdecl,inferred,objdump + local disassembly + caller correlation,1,"Single-instruction `ret` placeholder immediately beside `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`. Current grounded caller is the old-active-mode teardown branch inside `shell_transition_mode` `0x00482ec0`, where it contributes no observable release work between `world_runtime_release_global_services` `0x00434300` and the common free path `0x0053b080`. This is therefore the safest current read for a no-op followon placeholder rather than a meaningful runtime teardown owner.","objdump + local disassembly + caller correlation" 0x00432ea0,103,scenario_event_collection_allocate_runtime_effect_record_from_compact_payload,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Allocates and initializes one live runtime-effect record in the scenario event collection at `0x0062be18` from a compact payload source. The helper allocates one temporary `0x88f` payload object, inserts a new collection entry through the generic collection allocator path, resolves the inserted live entry, and then initializes that entry from the caller-supplied compact payload through `0x0042d670` before freeing the temporary object. Current grounded callers are `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50` and the shell-side branch at `0x004db9f1`, where the returned live entry id is stored back into the caller object. This is therefore the current safest read for the scenario event collection's runtime-effect allocator rather than a generic collection clone helper.","objdump + local disassembly + caller correlation + runtime-effect-allocation correlation" 0x00432f40,267,scenario_event_collection_service_runtime_effect_records_for_trigger_kind,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide service loop over the live scenario event collection at `0x0062be18` for one caller-selected trigger kind byte. The helper first rejects fast-forward and editor-map gates through `0x006cec78+0x46c38`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x68]` unless the trigger kind is `9`, then walks every live runtime-effect record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Each resolved record is serviced through `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` `0x004323a0` with the selected trigger kind and optional text sink. When any record fires, the helper refreshes every active company's cached share price through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`; when the collection dirty latch at `[this+0x88]` is raised it clears that latch and immediately reruns the whole pass with trigger kind `0x0a`. The caller split is now tighter too: recurring simulation maintenance drives kinds `1`, `0`, `3`, and `2` through `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3`, while the neighboring route-style follow-on at `0x0040a91f` drives kinds `5` and `4` through `0x0040a930` and `0x0040a9ac`; world or startup-side company creation branches at `0x00407682`, `0x0047d293`, `0x0047d42b`, and `0x0047d6de` drive kind `7`; the kind-`6` branch is now tighter too, covering the placed-structure post-create tail at `0x0040f69e`, the build-version-gated company-startup or roster-refresh tail at `0x00428406`, and the route-entry post-change sweep at `0x004a3eae`; the kind-`8` world-entry one-shot gate now sits inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where it fires after the post-load company or route setup passes and then clears shell-profile latch `[0x006cec7c+0x97]`; and the `LoadScreen.win` briefing page at `0x004e520b` drives kind `9`. This is therefore the current safest read for the scenario event collection's collection-wide runtime-effect service loop rather than a generic text-query helper.","objdump + local disassembly + caller correlation + collection-service correlation + trigger-kind callsite decode" -0x00433bd0,546,world_refresh_selected_year_bucket_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads packed year word `[this+0x0d]`, walks the 21-entry threshold ladder rooted at `0x005f3980`, and chooses either the first bucket baseline at `0x005f3984`, the terminal bucket scalar at `0x005f3a24`, or one interpolated scalar between the paired `(year,value)` table entries at `0x005f3978/0x005f3980`. It then derives the dependent selected-year float band from that chosen scalar: direct bucket lanes `[this+0x65]`, `[this+0x69]`, and `[this+0x6d]` come from three fixed multipliers, while the later normalized companion lane is rebuilt after a build-version-sensitive clamp through `0x00482e00(0x006cec74)` before the wider selected-year sidebands continue. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on.","objdump + local disassembly + caller inspection + threshold-ladder correlation + year-bucket-table correlation + world-entry correlation" +0x00433bd0,546,world_refresh_selected_year_bucket_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads packed year word `[this+0x0d]`, walks the 21-entry threshold ladder rooted at `0x005f3980`, and chooses either the first bucket baseline at `0x005f3984`, the terminal bucket scalar at `0x005f3a24`, or one interpolated scalar between the paired `(year,value)` table entries at `0x005f3978/0x005f3980`. It then rebuilds the dependent selected-year float band in two layers. First it seeds the direct bucket trio `[this+0x65/+0x69/+0x6d]` from three fixed multipliers of that chosen scalar. It next derives three normalized complement lanes `[this+0x71/+0x75/+0x79]` from that trio after the build-version-sensitive clamp through `0x00482e00(0x006cec74)`, and three additional scaled companion lanes `[this+0x7d/+0x81/+0x85]` from the same direct trio. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on.","objdump + local disassembly + caller inspection + threshold-ladder correlation + year-bucket-table correlation + world-entry correlation + direct-trio correlation + complement-lane correlation" 0x00433f02,28,scenario_state_roll_pending_float_0x4caa_into_accumulator_0x4ca6,map,thiscall,inferred,objdump + local disassembly + field xrefs,3,"Tiny scenario-state accumulator rollup over the late world-state float pair `[this+0x4ca6]` and `[this+0x4caa]`. The helper adds the pending lane `[this+0x4caa]` into accumulator `[this+0x4ca6]`, clears `[this+0x4caa]` back to zero, and returns. Current field evidence grounds the relationship too: the periodic support-side branch at `0x0041144f` accumulates live deltas into `[0x006cec78+0x4caa]`, while the shell-side query family at `0x0042f89b/0x0042f8bb` reads both the pending lane alone and the accumulated sum. Current grounded caller is the late world-side scalar rollup strip around `0x00433ec0`.","objdump + local disassembly + field xrefs + accumulator-rollup correlation" 0x00434050,11,shell_has_auxiliary_preview_owner,shell,cdecl,inferred,objdump + caller inspection + side-owner correlation,4,"Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live.","objdump + caller inspection + side-owner correlation + caller xrefs" 0x00434080,80,scenario_state_query_cached_available_locomotive_rating_clamped_for_shell,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small read-side helper over cached scenario-state float `[this+0x4cbe]`. The helper returns that cached available-locomotive rating in `st(0)` when it stays under the local threshold, and otherwise falls back to one fixed shell-side float constant before returning. Current grounded caller is the shell-side formatter band around `0x004b11c5`, where this cached value is optionally rounded to an integer and then compared against display thresholds `40/50/70/85/100`. This is therefore the safest current read for the query-side companion of the later locomotive-rating refresh rather than a broader world-state getter.","objdump + caller inspection + local disassembly + shell-threshold correlation + display-bucket correlation" -0x00434130,196,scenario_state_refresh_year_gap_scalar_from_current_year_minus_1850_into_0x4ca2,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small year-derived float refresh over active scenario state `0x006cec78`. The helper subtracts literal base year `1850` from current year word `[this+0x0d]`, converts that year gap into one normalized float through fixed constants rooted at `0x005c9680`, `0x005c8770`, `0x005c9ef8`, and `0x005c8d80`, stores the result into `[this+0x4ca2]`, and clamps that field into the closed `0.0..1.0` range. Current grounded callers are the periodic year-step branch at `0x0040a310`, the scenario-state reset or rebuild owner at `0x00436d10`, and the two world-entry load lanes at `0x00443edd` and `0x00444070`, so this is the safest current read for a shared year-gap-derived scenario float refresh rather than a presentation-only helper.","objdump + caller xrefs + local disassembly + year-gap correlation + clamp correlation" +0x00434130,196,scenario_state_refresh_year_gap_scalar_from_current_year_minus_1850_into_0x4ca2,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small year-derived float refresh over active scenario state `0x006cec78`. The helper subtracts literal base year `1850` from current year word `[this+0x0d]`, converts that year gap into one normalized float through fixed constants rooted at `0x005c9680`, `0x005c8770`, `0x005c9ef8`, and `0x005c8d80`, stores the first result into `[this+0x4ca2]`, then immediately reclamps the same field into the closed `1/3..1.0` range by flooring sub-threshold values to literal `0.333333...` and capping larger values at `1.0`. Current grounded callers are the periodic year-step branch at `0x0040a310`, the scenario-state reset or rebuild owner at `0x00436d10`, and the two world-entry load lanes at `0x00443edd` and `0x00444070`, so this is the safest current read for a shared year-gap-derived scenario float refresh rather than a presentation-only helper.","objdump + caller xrefs + local disassembly + year-gap correlation + clamp correction + two-stage-store correlation" 0x00434300,881,world_runtime_release_global_services,map,cdecl,inferred,objdump + local disassembly + caller correlation,4,"Primary old-world teardown owner for the live runtime object at `0x006cec78`. The helper first increments one local reentrancy band at `[this+0x4c93]`, then destroys and frees the two indexed world collections at `[this+0x66b2]` and `[this+0x66b6]` through `0x00518bd0` plus `0x0053b080`, clears global roots `0x0062b244`, `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, and `0x0062c120` through their typed release siblings `0x0040b720`, `0x004b23b0`, `0x00429980`, `0x00477770`, and `0x00449500`, and then tears down the map-content service roots `0x0062ba8c`, `0x006ada84`, `0x0062ba88`, `0x0062b2fc`, `0x0062b268`, `0x006cea4c`, and `0x006acd34` through `0x0041e8d0`, `0x004619b0`, `0x0041d7a0`, `0x00419680`, `0x00412a90`, `0x00473da0`, and `0x00455350` before freeing each backing object and nulling the global slot. After that typed global strip it releases the eight shell-helper handles at `[this+0x46a80..+0x46aa0]` plus the variable-length owner band rooted at `[this+0x46aa4]` through repeated `0x0053c000`, drains the linked chains at `[this+0x66a6]` and `[this+0x66aa]` through `0x0053afd0`, clears `[this+0x66ae]`, optionally re-enters `0x00516ba0` when shell gate `0x006d3b4c` is live, and finally decrements `[this+0x4c93]` before returning. Current grounded callers are the heavier world-entry branch `0x00443a50`, the sibling `.smp` world-state branch `0x00446d40`, and the old-active-mode teardown branch in `shell_transition_mode` `0x00482ec0`.","objdump + local disassembly + caller correlation + typed-global-release-order correlation" 0x00434d40,100,placed_structure_collection_seed_candidate_subtype2_runtime_latch,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Shared post-setup sweep over the live placed-structure collection at `0x0062b26c`. The helper walks every live placed structure through the indexed-collection accessors, resolves each linked candidate or structure descriptor through vtable slot `+0x80`, and when the resolved record's subtype byte `[candidate+0x32]` equals `2` it writes `1` to runtime dword `[candidate+0x7b0]`. Local field evidence is now tight enough to keep the name structural: the same dword is zeroed during candidate runtime materialization around `0x00412112`, read as a one-shot guard in the world-side placement branch around `0x00423c43`, and also written there after the guarded follow-on fires. Current grounded callers are the post-fast-forward setup tail at `0x00437bf9` and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared subtype-`2` candidate-runtime latch seeder rather than a one-off world-entry patch.","objdump + local disassembly + caller correlation + candidate-runtime-latch correlation" 0x004354a0,355,world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared shell-facing scalar publisher beneath selected-year changes, shell-state selector updates, and the late world-entry reactivation band. The helper always resolves the current shell presentation object through controller `0x006d4024 -> [controller+0x18]` and writes one clamped `0..255` integer into `[object+0x15]` through `0x00523d60`. Its source split is now bounded enough to name conservatively: when tutorial flag `0x006d3b4c` is live it forces `0`; otherwise it first honors the temporary shell-state selector pair `[0x006cec74+0x1df/+0x1e3]`, then the persisted selector pair `[0x006cec74+0x23b/+0x23f]` when sandbox bit `[0x006cec7c+0x82]` is set, and only when no selector override is active does it derive one interpolated scalar from the current year `[this+0x15]` against the ensured threshold band `[this+0x51/+0x55/+0x59/+0x5d/+0x61]` plus the base value at `[this+0x3a]`, re-entering `scenario_state_ensure_derived_year_threshold_band` `0x00435603` before the year-band path needs it. Current grounded callers are the simulation year-advance path at `0x0040ab39`, the shell-state setter at `0x00482878`, the startup-side branch at `0x005173d3`, and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared shell-controller progress-scalar publisher rather than a world-entry-only helper.","objdump + local disassembly + caller correlation + shell-controller correlation + year-threshold-band correlation" @@ -383,14 +383,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00435b50,1764,world_service_year_threshold_news_and_structure_milestone_notifications,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"World-side year-threshold and structure-milestone news owner beneath periodic simulation and startup bring-up. The helper reads the current packed year at `[0x006cec78+0x0d]`, suppresses itself when scenario gate `[0x006cec78+0x46c38]` is live or when cached prior-year field `[0x006cec78+0x05]` already matches, and then services several threshold families. Fixed threshold years `0x749/0x767/0x780/0x7a6` (`1865/1895/1920/1958`) publish paired localized ids `0x157..0x15e` through `0x005193f0` and append the resulting fixed records into collection `0x006cea4c` through `0x00473f80`. Years `0x73a/0x76c/0x79e` build three formatted numeric fragments through `0x0051b700`, splice them into localized id `0x15f`, and publish the finished notice through `0x004337c0`. The later milestone branch resolves specific candidate stems through `0x00412af0`, counts matching live placed structures through `0x004138f0`, and for year `0x755` also combines those counts with localized text fragments `0x161..0x165` before queueing one news record through `0x004337c0`; the single-stem branches at `0x7a4/0x789/0x794` instead publish localized ids `0x166/0x167/0x168` directly when at least one matching live structure exists. Current grounded caller is the periodic boundary work branch at `0x0040a6f7`, so this is the safest current read for the shared year-threshold and structure-milestone news owner rather than a generic date-change helper.","objdump + local disassembly + caller correlation + year-threshold correlation + structure-milestone correlation + news-record correlation" 0x0043ad50,227,world_view_query_city_label_alpha_byte_from_normalized_xy_and_view_scalars,shell,thiscall,inferred,objdump + local disassembly + caller xrefs,3,"Small bounded-byte helper beneath the city-site label formatters at `0x004207d0` and `0x004613d0`. The caller supplies rounded normalized `(x,y)` values, while the helper samples the current world-view state at `0x0062be68`: it first tests the view scalar at `[this+0x14]` against a three-band threshold ladder, returning `0` on the lowest band, `0xff` on the saturated band, and otherwise deriving one provisional byte through scaled subtraction and integer rounding. It then folds in the auxiliary view scalars at `[this+0x1c]` and `[this+0x24]` through the shared x87 rounding helper `0x005a10d0` and finishes by returning one bounded byte-like priority or alpha value in `EAX`. Current grounded callers use any nonzero result to arm a highlighted city-label style and only splice the returned byte into the top color lane when it stays below `0xff`, so the safest current read is a world-view-dependent city-label alpha-byte query rather than a generic camera scalar helper.","objdump + local disassembly + caller xrefs + city-label correlation" 0x00434ea0,124,scenario_state_query_named_candidate_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named candidate-availability collection at `[this+0x66b2]`. The helper normalizes the first byte of the caller-supplied candidate name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x1e]`; otherwise it returns zero. The insert sibling `0x00434f20` shows the exact record shape now too: each collection entry is a zero-initialized `0x22`-byte blob with a fixed zero-terminated name slot at `[entry+0x00..+0x1d]` and one trailing availability dword at `[entry+0x1e]`. Current grounded callers are the runtime refresh pass `0x00412c10`, the editor-side detail and summary formatters at `0x004cc209`, `0x004cdfa3`, `0x004d14b8`, and `0x004d1684`, and the same startup-side candidate filter family that later writes `[candidate+0x7ac]`. This is therefore the current safest read for the candidate-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation" -0x00434f20,272,scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437737` and `0x00436ad7` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation" +0x00434f20,272,scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437737` and `0x00436a70` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation" 0x00435030,124,scenario_state_query_named_locomotive_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation" 0x004350b0,249,scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation" 0x004351c0,1099,scenario_state_rebuild_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Broader rebuild owner for the compact scenario-side year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. The helper first samples one shell presentation scalar through `0x006d4024 -> [controller+0x18] -> [object+0x15]`, chooses one of three range profiles from that scalar (`<0x28`, `<0x46`, or later), and seeds base lane `[this+0x61]` to `0xff`, `0xc8`, or `0xe6` together with one paired year-span scalar derived from the fixed `0x5a0` multiplier. It then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` on the current year `[this+0x15]`, queries three companion shell integers through `0x00527cc0`, folds those shell-side values into one normalized offset, and writes the rebuilt threshold quartet into `[this+0x51]`, `[this+0x55]`, `[this+0x59]`, and `[this+0x5d]` through the shared x87 rounding helper `0x005a10d0`. The same owner also contains the shell-facing follow-on hidden by the tiny ensure wrapper `0x00435603`: when the caller stack flag is nonzero, or when the current shell progress scalar falls outside the rebuilt band, it computes one interpolated or clamped `0..255` presentation value from current year `[this+0x15]`, base byte `[this+0x3a]`, floor `[this+0x61]`, and the rebuilt threshold quartet, then republishes that value into the current shell presentation object through `0x00523d60`. Current grounded callers are the ensure wrapper `0x00435603`, the shell command `0x004412e0`, the shell-state setter path around `0x00482878`, the compact runtime-effect side branch at `0x00431e03`, and the world-entry late rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the actual year-threshold rebuild owner beneath selected-year restore and shell progress refresh rather than another anonymous math body.","objdump + local disassembly + caller correlation + year-threshold-band correlation + shell-progress-followon correlation" +0x00436a70,128,scenario_state_preseed_named_candidate_availability_overrides_from_editor_map_placed_structures,map,thiscall,inferred,objdump + local disassembly + package-save correlation + caller correlation,3,"Small editor-map prepass over the live placed-structure collection `0x0062b26c`, reached directly from the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0` before the later direct named-availability collection save. The helper walks every live placed-structure through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, keeps only records accepted by the subtype-family predicate `0x0040c990`, resolves each accepted record's linked candidate/runtime owner through virtual slot `+0x80`, filters that owner to subtype byte `[obj+0x32] == 2` with both availability bytes `[obj+0xba]` and `[obj+0xbb]` clear, and then forwards the owner name at `[obj+0x04]` plus boolean `1` into `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`. Current grounded caller is the editor-map package branch at `0x00444f30`, which makes this the strongest current read for the save-side preseed pass that materializes candidate-availability override records from qualifying placed structures before the direct collection serializer `0x00517d90` persists `[world+0x66b2]` rather than a generic placement scan.","objdump + local disassembly + package-save correlation + caller correlation + placed-structure collection correlation + named-availability correlation" 0x00436c70,37,scenario_state_check_special_tutorial2_signature_gate,map,cdecl,inferred,objdump + local disassembly + string inspection + caller correlation,2,"Small special-case gate immediately above the broader scenario reset owner `0x00436d10`. The helper returns true only when the caller selector equals `0x10`, the current world root at `0x0062c120` reports map dimensions `0x180 x 0x1c0`, the live city collection `0x0062bae0` reports exactly `0x41` entries, the first live city name at `[entry+0x356]` matches `Italy - North`, the current shell-side file or scenario root at `0x0062be18` passes `0x4331e0 == 0x16`, and its row `7` subtype byte `[row+0x7ef]` equals `6`. The nearby string table points at `Tutorial_2.gmp`, so the safest current read is one hard-coded tutorial-signature predicate rather than a generic map-size or city-count checker.","objdump + local disassembly + string inspection + caller correlation + special-case-signature correlation" -0x00436af0,384,scenario_state_refresh_cached_available_locomotive_rating_from_year_baseline_and_live_availability_gates,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]` with explicit tiers `110.0` through year `2000`, `200.0` after `2000`, and `300.0` after `2010`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, resolves the linked era through `[loco+0x72]`, filters each locomotive through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. The winning rating is forced to at least `1.0`, normalized, and clamped into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper.","objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation + year-baseline correlation" +0x00436af0,384,scenario_state_refresh_cached_available_locomotive_rating_from_year_baseline_and_live_availability_gates,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]` with explicit tiers `110.0` through year `2000`, `200.0` after `2000`, and `300.0` after `2010`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, resolves the linked era through `[loco+0x72]`, filters each locomotive through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. The winning rating is forced to at least `1.0`, normalized through the fixed `100.0 / 220.0` scale pair at `0x005c9f40/0x005c85d8`, then floored to `50.0` and capped at `100.0` before storage into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper.","objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation + year-baseline correlation + normalization-tail correlation" 0x004367c0,92,world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + RT3.lng strings,3,"Small world-side outcome-status helper. The caller-supplied mode dword is stored into `[this+0x4a73]`, world flag `[this+0x4d]` is cleared, and the current selected-year snapshot byte `[this+0x15]` is copied into `[this+0x4c88]`. The helper then copies one fixed localized string into status buffer `[this+0x4b47]`: id `2923` `You lose.` when the incoming mode equals `1`, otherwise id `2924` `You win, cheater...`. Current grounded callers are the cheat-modal owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and the scenario follow-on command branch around `0x004648e1`, so this is the safest current read for the cheat-owned outcome-mode setter rather than a generic prompt publisher.","llvm-objdump + local disassembly + caller correlation + RT3.lng strings + outcome-buffer correlation" -0x00436d10,522,scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges,map,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broader scenario-state reset or initialization owner over active world state `0x006cec78`. The helper first zeroes one contiguous late-state slab from `[this+0x4cc2]` for `0x9b` dwords plus one trailing byte, then separately clears the much larger late runtime slab rooted at `[this+0x66be]`. It seeds fixed default years `[this+0x66ca/+0x66ce/+0x66d2] = 0x726/0x7d0/0x74e`, seeds the sixteen 9-byte chairman-slot rows at `[this+0x69dc]` with default tuning `0x186a0`, and clears several now-grounded latch families explicitly: `[this+0x19/+0x21/+0x25/+0x29/+0x31/+0x3d/+0x41/+0x45/+0x49/+0x4d]`, outcome and cheat bands `[this+0x4a73/+0x4a77/+0x4a7b]`, the scenario-rule table `[this+0x4a7f..+0x4b3f]` plus trailing scalar `[this+0x4b43]`, the outcome text root `[this+0x4b47]`, the byte-policy and cached-scalar cluster `[this+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[this+0xbce..+0xbf6]` before reseeding the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `map_editor_economic_cost_slider_dispatch` `0x004ca980`: `+0xbde/+0xbe2 = 1.0f`, `+0xbe6/+0xbea/+0xbee/+0xbf2 = 0x3c75c28f`, and `+0xbf6 = 0x3ba3d70a`. It then zero-fills the twelve scenario recipe books at `[this+0x0fe7]` and only seeds their per-book name lane through the fixed format string `# %1` at `0x005c9f78`, using generated ordinal strings `1..12` via `0x0051b700` and `0x00518de0`; current local disassembly does not show it preloading any default line modes, amounts, or cargo-token strings into the later `+0x3ed/+0x3f1` recipe payload. It also destroys and recreates the two named-availability collections at `[this+0x66b2]` and `[this+0x66b6]` with fixed record sizes `0x22` and `0x41`, rebuilds selected-year and calendar state from the live profile plus shell gates into `[this+0x05/+0x09/+0x0d/+0x1d]` through `0x0051d3f0`, `0x0051d390`, `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, and `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, then re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0` before clearing several shell-controller-side cached state dwords under `0x006d4024+0x11425a..+0x114276`. Current grounded callers are the startup-profile dispatcher `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` and the world-entry coordinator `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared scenario-state reset-and-rebuild owner beneath startup and load paths rather than a smaller recipe-only helper.","objdump + caller xrefs + local disassembly + default-state correlation + economic-tuning-band correlation + named-availability-collection correlation + recipe-book-name-template correlation + selected-year-refresh correlation + runtime-bridge correlation + late-state-reset-cluster correlation" +0x00436d10,522,scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges,map,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broader scenario-state reset or initialization owner over active world state `0x006cec78`. The helper first zeroes one contiguous late-state slab from `[this+0x4cc2]` for `0x9b` dwords plus one trailing byte, then separately clears the much larger late setup-preview/runtime slab rooted at `[this+0x66be]` and immediately reseeds its leading validity byte `[this+0x66be] = 1`. It seeds the same editor-owned scenario start-year trio later refreshed by `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` and clamped by `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0`: minimum `[this+0x66ca] = 0x726` (`1830`), default `[this+0x66d2] = 0x74e` (`1870`), and maximum `[this+0x66ce] = 0x7d0` (`2000`). It also seeds the four neighboring startup dwords `[this+0x6a68/+0x6a6c/+0x6a70/+0x6a74] = 1`, seeds the sixteen 9-byte chairman-slot rows rooted at `[this+0x69d8]` with default tuning `0x186a0`, and explicitly sets the first slot's distinguished occupied-seat byte `[this+0x69db] = 1`, matching the later chairman-slot readers `0x00437220`, `0x004377a0`, and `0x004ca1c0` that treat `[slot+0x03]` as the special occupied-seat marker. The helper clears several now-grounded latch families explicitly: `[this+0x19/+0x21/+0x25/+0x29/+0x31/+0x3d/+0x41/+0x45/+0x49/+0x4d]`, queue or fast-forward latches `[this+0x46c38/+0x46c3c/+0x66a2/+0x66a6/+0x66aa]`, outcome and cheat bands `[this+0x4a73/+0x4a77/+0x4a7b]`, the scenario-rule table `[this+0x4a7f..+0x4b3f]` plus trailing scalar `[this+0x4b43]`, the outcome text root `[this+0x4b47]`, the byte-policy and cached-scalar cluster `[this+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[this+0xbce..+0xbf6]` before reseeding the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `map_editor_economic_cost_slider_dispatch` `0x004ca980`: `+0xbde/+0xbe2 = 1.0f`, `+0xbe6/+0xbea/+0xbee/+0xbf2 = 0x3c75c28f`, and `+0xbf6 = 0x3ba3d70a`. It then zero-fills the twelve scenario recipe books at `[this+0x0fe7]` and only seeds their per-book name lane through the fixed format string `# %1` at `0x005c9f78`, using generated ordinal strings `1..12` via `0x0051b700` and `0x00518de0`; current local disassembly does not show it preloading any default line modes, amounts, or cargo-token strings into the later `+0x3ed/+0x3f1` recipe payload. It also destroys and recreates the two named-availability collections at `[this+0x66b2]` and `[this+0x66b6]` with fixed record sizes `0x22` and `0x41`. The selected-year rebuild tail is explicit now too: when live profile `0x006cec7c` reports campaign/setup byte `[profile+0xc5] != 0` and sandbox byte `[profile+0x82] == 0`, the helper copies profile year word `[profile+0x77]` into scenario default year `[this+0x66d2]`; it then seeds `[this+0x05/+0x09]` from that chosen year through `calendar_pack_year_and_component_bytes_to_packed_tuple_dwords` `0x0051d3f0` with Jan-1-style constants, conditionally decrements the selected year before `calendar_pack_unpacked_components_to_absolute_counter` `0x0051d390` based on shell mode `[0x006cec74+0x68/+0x178]` and tutorial gate `[0x006cec78+0x4af7]`, stores the resulting absolute counter into `[this+0x15]`, clamps `[this+0x1d]` from current year `[this+0x19]`, and only then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, and `scenario_state_ensure_derived_year_threshold_band` `0x00435603`. After that selected-year/calendar chain it re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0` before clearing several shell-controller-side cached state dwords under `0x006d4024+0x11425a..+0x114276`. Current grounded callers are the startup-profile dispatcher `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` and the world-entry coordinator `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared scenario-state reset-and-rebuild owner beneath startup and load paths rather than a smaller recipe-only helper.","objdump + caller xrefs + local disassembly + default-state correlation + economic-tuning-band correlation + named-availability-collection correlation + recipe-book-name-template correlation + selected-year-refresh correlation + runtime-bridge correlation + late-state-reset-cluster correlation + profile-year-import correlation + setup-preview-payload correlation + scenario-metadata-year-trio correlation + chairman-slot-marker correlation + queue-latch correlation" 0x0043cb00,295,world_view_step_heading_quadrant,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.,objdump + caller xrefs + callsite inspection 0x0043cc30,437,world_view_step_zoom_bucket,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4.,objdump + caller xrefs + callsite inspection 0x0043d050,111,world_view_set_focus_position_xyz,shell,thiscall,inferred,objdump + caller xrefs,4,Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d.,objdump + caller xrefs @@ -420,9 +421,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0045f6d0,334,shell_input_register_action_binding_with_mode_specific_defaults,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf.","objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation" 0x0045f8a0,315,shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper.","objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation" 0x0045f9e0,598,shell_input_seed_default_binding_registry_entries_from_static_table,shell,cdecl,inferred,objdump + local disassembly + static-table inspection,4,"Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch.","objdump + local disassembly + static-table inspection + post-table registration-strip correlation" -0x00460fe0,52,shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" -0x00461000,52,shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" -0x00461040,40,shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" +0x00460fe0,52,shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The row is therefore carried at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" +0x00461000,52,shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The row is therefore carried at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" +0x00461040,40,shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The row is therefore carried at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" 0x00461070,170,shell_input_binding_registry_destroy_all_roots_and_reset_globals,shell,cdecl,inferred,objdump + local disassembly + global-field correlation,4,"Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command.","objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation" 0x00461120,171,shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file,shell,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Constructs the live shell input-binding registry, seeds the default action set, and optionally imports the saved hotkeys file. The helper first hard-resets the old registry through `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070`, zeros the monotonic id source `0x006acd68`, allocates and clears the primary pool owner at `0x006acd6c`, allocates the two companion owners at `0x006acd70` and `0x006acd74`, seeds the default bindings through `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0`, and when the caller flag in `ECX` equals `1` immediately tail-jumps into the hotkey import worker `0x0045f420` using the fixed path literal `hotkeys\\hotkeys.txt`. This is therefore the safest current read for the binding-registry constructor and optional hotkey-import owner rather than a generic allocator batch.","objdump + local disassembly + caller correlation + pool-allocation correlation + default-seed correlation + hotkey-import correlation" 0x00439e40,557,world_view_seed_keyboard_binding_slot_pairs,shell,thiscall,inferred,objdump + callsite inspection,4,"Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store.",objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng @@ -437,8 +438,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00433a40,82,shell_can_open_company_list_or_detail_panel_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,4,"Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker.","objdump + caller inspection + shell-detail correlation + modal-path correlation" 0x00433aa0,95,shell_can_open_stockbuy_window_or_warn,shell,thiscall,inferred,objdump + caller inspection + stockbuy correlation,4,"Shared availability gate above the shell-side `StockBuy.win` family. The helper first rejects scenario states where toggle `[0x006cec78+0x4aa7]` is nonzero, surfacing the same shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0`. When the scenario toggle allows the action, it still requires a nonzero selected-company id at `[scenario+0x21]`; if no company is currently selected it raises the sibling shell modal rooted at localized id `335` and returns `0`. Only the success path returns `1` to the callers at `0x00440673` and `0x004de50f`, both of which immediately open detail-panel mode `0x0c` that later refreshes through the `StockBuy.win` family. This is therefore the safest current read for the stock-buy availability gate rather than a generic company-selection check.","objdump + caller inspection + stockbuy correlation + modal-path correlation" 0x00433b00,117,shell_can_open_trainbuy_window_or_warn,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Shared availability gate above the shell-side `Trainbuy.win` family. The helper first rejects scenario states where the train-buy action is globally disabled through `[0x006cec78+0x4aa3]`, surfacing localized id `334` `That action is not allowed in this scenario.` through the shared shell modal path when blocked. It then checks whether the active company or world object state supplied by the caller allows train purchase; if no company is active it raises id `337` `You can't buy a train without starting a company first!`, and if no track has been placed it raises id `338` `You can't buy a locomotive until some track has been placed!`. Only the success path returns nonzero to the callers at `0x004406d3` and `0x004de7d9`, both of which immediately enter `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + RT3.lng strings + train-buy gate correlation" -0x00434db0,91,shell_can_open_detail_panel_mode_0x0b_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the safest current read for the mode-`0x0b` availability gate rather than a tighter family name we have not yet recovered.","objdump + caller inspection + shell-detail correlation + modal-path correlation" -0x00434e20,128,shell_can_open_detail_panel_mode_0x06_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the safest current read for the mode-`0x06` availability gate rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation" +0x00434db0,91,shell_can_open_detail_panel_mode_0x0b_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the current bounded read for the mode-`0x0b` availability gate.","objdump + caller inspection + shell-detail correlation + modal-path correlation" +0x00434e20,128,shell_can_open_detail_panel_mode_0x06_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the current bounded read for the mode-`0x06` availability gate.","objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation" 0x00433b80,69,scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner.","objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation" 0x00433da0,367,shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay,shell,cdecl,inferred,objdump + caller inspection + overlay-control correlation,3,"Shared owner beneath the paired shell commands `0x00441260` and `0x004412a0` for the mode-`0x19` overlay family. The helper takes one caller-supplied presenter-state boolean and one variant selector, restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across the detail-panel control band `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and then forwards the same variant into world helper `0x0043a0a0`. Current grounded callers are the two registered shell commands that derive the presenter-state boolean from `[0x006d4024+0x114216] == 1` and pass variant `0` or `1`, which makes this the safest current read for the shared mode-`0x19` variant-open and overlay-refresh owner rather than another anonymous control restyler.","objdump + caller inspection + overlay-control correlation + mode-0x19 correlation + detail-panel transition correlation" 0x00439820,91,world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared world-view helper beneath the local controller strip. The function samples five nearby heights through `0x00534490` at the current eye X/Z pair `[this+0x1c/+0x24]` and four axis-offset probes, keeps the highest sampled clearance, rounds and expands that limit through `0x0052d0c0` plus fixed scalar margins, and then compares the result against current eye height `[this+0x20]`. When the smoothed or clamped target exceeds the current eye height it republishes the eye triplet through `0x0052d1e0`; when local smoothing latch `[this+0x60]` is live it also uses gain `[this+0x34e]` and cached scalar `[this+0x34a]` before that republish. Current grounded callers are the shell-input controller path `0x0043a1d4`, the camera-restore and step buckets at `0x0043c967`, `0x0043cdd4`, `0x0043d0a6`, and the neighboring motion branches `0x0043e4d5` and `0x0043f427`, so this is the safest current read for the local clearance-ring clamp and republish helper rather than a generic terrain-height query.","objdump + caller inspection + local disassembly + world-view correlation + local-clearance correlation + eye-triplet correlation" @@ -454,11 +455,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0050f760,45,shell_trainbuy_window_query_selected_locomotive_id,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`.","objdump + caller inspection + strings correlation + selected-row correlation" 0x0050f790,241,shell_trainbuy_window_compute_selected_upgrade_total_and_count,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Computes the current selected-train upgrade summary beneath the shell-side `Trainbuy.win` family. The helper counts all flagged train entries in the `0x2000`-byte selection array rooted at `0x006d1aa8`, resolves the currently selected locomotive choice through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, and then multiplies the resulting selected-train count by the per-train upgrade cost from `0x004619c0` after converting the current and target locomotive ids through `0x004337b0` and `0x004337a0`. It writes the total upgrade cost through the first out-parameter and the number of selected trains through the second. Current grounded callers are the summary formatter at `0x0050f890` and the purchase-or-upgrade confirmation path inside `shell_trainbuy_window_handle_message`.","objdump + caller inspection + RT3.lng strings + selection-array correlation + upgrade-cost correlation" 0x0050f890,368,shell_trainbuy_window_render_selected_train_upgrade_summary,shell,cdecl,inferred,objdump + caller inspection + RT3.lng strings,4,"Formats the selected-train upgrade summary text in the shell-side `Trainbuy.win` family. After resolving the currently selected locomotive id through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, the helper calls `shell_trainbuy_window_compute_selected_upgrade_total_and_count` at `0x0050f790` and then builds the player-facing status string from localized ids `1338` `No trains currently selected to upgrade.`, `1339` `Total Cost to Upgrade the %1 Selected Trains to %2 is %3.`, and `1340` `Total Cost to Upgrade the 1 Selected Train to %1 is %2.`. It publishes the resulting heap-backed text through the callback-driven shell control path rooted at control resource `0x275c`. Current grounded callers are the family refresh path at `0x00511500` and the row-selection branch at `0x00512ac7`.","objdump + caller inspection + RT3.lng strings + upgrade-summary correlation" -0x0050fc00,1003,shell_trainbuy_window_render_selected_train_route_and_state_panel,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Renders the richer selected-train detail panel beneath the shell-side `Trainbuy.win` family. The helper resolves the currently selected train and its linked locomotive definition, formats one header block through the shared shell text path at `0x005519f0`, and then builds the lower route or cargo state block through `0x0053de00`, `0x0041d540`, and `0x00552560`. When the runtime latch at `[0x006cec74+0x180]` is set it also appends up to three localized fragments through ids `1341..1343`, gated by bytes `[train+0x30..0x32]`, before laying the final text out. Current grounded callers are the per-row hover or selection refresh paths beneath `Trainbuy.win`; the evidence is strong enough to treat it as the selected-train route-and-state renderer even though the exact player-facing captions for the three optional fragments are still unrecovered.","objdump + caller inspection + nearby-family correlation + selected-train correlation" +0x0050fc00,1003,shell_trainbuy_window_render_selected_train_route_and_state_panel,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Renders the richer selected-train detail panel beneath the shell-side `Trainbuy.win` family. The helper resolves the currently selected train and its linked locomotive definition, formats one header block through the shared shell text path at `0x005519f0`, and then builds the lower route or cargo state block through `0x0053de00`, `0x0041d540`, and `0x00552560`. When the runtime latch at `[0x006cec74+0x180]` is set it also appends up to three localized fragments through ids `1341..1343`, gated by bytes `[train+0x30..0x32]`, before laying the final text out. Current grounded callers are the per-row hover or selection refresh paths beneath `Trainbuy.win`; the evidence is strong enough to carry it as the selected-train route-and-state renderer, with the three optional localized fragments kept at that bounded caption level.","objdump + caller inspection + nearby-family correlation + selected-train correlation" 0x00511500,2941,shell_trainbuy_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `Trainbuy.win` singleton later published at `0x006d3ac8`. The constructor binds the window resource through `0x0053fa50`, caches three shell runtime handles in `0x006d3abc..0x006d3ac4`, seeds the live singleton pointer at `0x006d3ac8`, builds one filtered locomotive-choice list under `0x006d3ae8`, and then wires the family controls and callbacks through `0x00540120`. Current grounded control ownership is broad enough to treat this as the full `Trainbuy.win` family rather than a small helper: it binds the main action and selection controls under resources `0x2afa..0x2aff`, the selected-train summary path through `shell_trainbuy_window_render_selected_train_upgrade_summary` at `0x0050f890`, the per-row hover helpers at `0x0050fa00` and `0x0050fc00`, the selected-row refresh helper at `0x00511170`, and the selection-paging helper at `0x00512080`. Current grounded caller is `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + strings correlation + control-wiring inspection + singleton correlation" 0x00512080,372,shell_trainbuy_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Refreshes the visible control state for the shell-side `Trainbuy.win` family. The helper consumes and clears the temporary refresh gate at `0x006d3ae1`, clamps the current selected locomotive-row index from control resource `0x2aff` against the live filtered choice list length at `0x006d3aec`, rewrites the list-selection state across control `0x88`, updates the current mode-strip and list-state controls rooted at `0x00622b28`, and then tail-calls the selected-row detail refresher at `0x00511170`. Current grounded callers are the family constructor at `0x00511500`, the action path after row or mode changes inside `shell_trainbuy_window_handle_message`, and the initial open path in `shell_open_or_focus_trainbuy_window` at `0x00512dd5`.","objdump + caller inspection + strings correlation + list-state correlation" 0x00512c50,615,shell_open_or_focus_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation + RT3.lng strings,4,"Shared opener for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper first rejects duplicate opens through the live flag at `0x006d3ae4`, seeds the family globals `0x006d3ad0..0x006d3ad8`, `0x006d3acc`, `0x006d3aa8`, `0x006d1aa0`, `0x006d1aa4`, `0x006d3af0`, `0x006d3af4`, `0x00622b24`, and the filtered locomotive-choice list at `0x006d3ae8`, allocates an `0x80`-byte shell window object, constructs it through `shell_trainbuy_window_construct` at `0x00511500`, refreshes it through `shell_trainbuy_window_refresh_controls` at `0x00512080`, and publishes it to the shell runtime at `0x006d401c`. Current grounded callers are the direct train-buy shell command branches at `0x004406ee` and `0x004de7f4` after `shell_can_open_trainbuy_window_or_warn` at `0x00433b00`, plus the sibling train-side action family around `0x00514c97` and `0x00514d7e`. The current family semantics are broader than a bare locomotive picker: nearby message and summary paths show that the same window also stages selected-train upgrade state and train-route editing affordances, but the strongest resource-name anchor remains `Trainbuy.win`.","objdump + caller inspection + strings correlation + RT3.lng strings + singleton correlation + control-family correlation" -0x00512f80,193,shell_trainbuy_window_refresh_selection_side_toggle,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the small side-toggle strip beneath `Trainbuy.win` and stores the chosen side in `0x006d3b28`. The helper converts the caller-supplied boolean into two opposing style states on controls `0x6593` and `0x6594`, rewrites one small layout block through `0x0053fe90`, and keeps the current side latched for the surrounding message paths that call it with `0` and `1` at `0x00514fed` and `0x00514fd8`. Current grounded caller is the neighboring train-side window family rooted at `0x006d3b20`, which reuses the same selected-train context but is not yet safely named.","objdump + caller inspection + control-flow inspection + side-toggle correlation" +0x00512f80,193,shell_trainbuy_window_refresh_selection_side_toggle,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the small side-toggle strip beneath `Trainbuy.win` and stores the chosen side in `0x006d3b28`. The helper converts the caller-supplied boolean into two opposing style states on controls `0x6593` and `0x6594`, rewrites one small layout block through `0x0053fe90`, and keeps the current side latched for the surrounding message paths that call it with `0` and `1` at `0x00514fed` and `0x00514fd8`. Current grounded caller is the neighboring train-side window family rooted at `0x006d3b20`, which reuses the same selected-train context and is carried conservatively at that neighboring family root.","objdump + caller inspection + control-flow inspection + side-toggle correlation" 0x005130f0,62,shell_trainbuy_window_query_selected_train_record,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train record or `0` when the active shell detail controller at `0x006d0818` does not hold one valid train id in `[this+0x90]`. The helper validates that selected id against the train collection at `0x006cfcbc` and then resolves the live record through `0x00518140`. Current grounded callers include the neighboring train-side shell window family around `0x005146d6`, `0x00514ce2`, and `0x00515176`, which repeatedly reuse the same selected-train pointer for route, upgrade, and warning flows.","objdump + caller inspection + nearby-family correlation + selected-train correlation" 0x00513130,51,shell_trainbuy_window_query_selected_train_id,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train id from the active shell detail controller at `0x006d0818` when that id is positive and still present in the train collection at `0x006cfcbc`; otherwise returns `-1`. Current grounded callers are the same neighboring train-side shell families that package selected-train requests for local and multiplayer follow-on work.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation" 0x00513170,44,shell_trainbuy_window_has_valid_selected_train,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Boolean validity probe above `shell_trainbuy_window_query_selected_train_id`. The helper returns `1` only when the active shell detail controller at `0x006d0818` currently holds one positive train id in `[this+0x90]` and that id is still live in the train collection at `0x006cfcbc`. Current grounded callers include the train-side command family around `0x00514c66`, `0x00514cb5`, `0x00514d9c`, and `0x0051515c`, where it gates nearly every selected-train verb before deeper ownership or route checks run.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation" @@ -572,8 +573,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004bc210,67,shell_world_surface_brush_set_selected_ordinal_and_refresh_scalar_caption,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small setter beneath the shell world-surface brush family. The helper stores the caller-selected ordinal into `[this+0x78]`, resolves the corresponding dword from table `0x00621e24`, converts that value into a float caption through `0x0051f070` and `0x00527de0` under shell owner `0x006d4024`, and returns. Current grounded caller is the `0x0fa0..0x0fa7` ordinal-strip branch inside `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the selected-ordinal setter plus scalar-caption refresh rather than a generic text helper.","objdump + caller inspection + local disassembly + ordinal-strip correlation + scalar-caption correlation" 0x004bc260,43,shell_world_surface_brush_query_cached_world_coords_and_selected_scalar,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cached-parameter getter beneath the same shell world-surface brush family. The helper copies cached world coordinates `[this+0x80]` and `[this+0x84]` into the two caller out-pointers and returns the current selected scalar from table `0x00621e24[ordinal]`, where the ordinal is stored at `[this+0x78]`, through the third out-pointer. Current local field correlation keeps this bounded as the brush-family cached-parameter query rather than a generic subject getter.","objdump + local disassembly + field correlation + ordinal-table correlation" 0x004bc290,192,shell_world_surface_brush_refresh_ordinal_and_mode_button_rows,shell,thiscall,inferred,objdump + caller inspection + control-family correlation,3,"Shared control refresh helper for the shell world-surface brush family. The first loop restyles the ordinal strip `0x0fa1..0x0fa7` through `0x00540120`, highlighting the current selected ordinal at `[this+0x78]`. The second loop restyles the mode strip `0x0faa..0x0faf` by mapping the current mode dword `[0x006d0818+0x8c]` from `0x0e..0x13` into local indices `0..5` and highlighting the matching button through the same shell control helper. Current grounded callers are the ordinal-strip branch at `0x004bc3fc` and the mode-change path beneath `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the ordinal and mode button-row refresh owner rather than a generic widget restyler.","objdump + caller inspection + control-family correlation + ordinal-mode-strip correlation" -0x004bc350,1496,shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf,shell,thiscall,inferred,objdump + local disassembly + control-family correlation,3,"Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is strong enough to treat this as a shell world-surface brush and mode dispatcher even though the exact window-family resource name is still open.","objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation" -0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first mirrors the leading editor economic-tuning scalar from `[world+0x0be2]` back into runtime multiplier lane `[world+0x0bde]` and then runs the preliminary candidate-availability prepass at `0x00437737` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early candidate-local service pass `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation + pre-recipe-scalar mirror correlation + economic-tuning-band correlation" +0x004bc350,1496,shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf,shell,thiscall,inferred,objdump + local disassembly + control-family correlation,3,"Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is sufficient to carry this as a shell world-surface brush and mode dispatcher.","objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation" +0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]`, mirrors the leading editor economic-tuning scalar from `[world+0x0be2]` back into runtime multiplier lane `[world+0x0bde]`, and on the caller-selected setup path first runs the preliminary candidate-availability prepass `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437737(0)`. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early candidate-local service pass `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50(1)`, and, only on the setup path, the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set while master editor-mode latch `[0x006cec74+0x68]` is still clear, id `320` `Setting Up Buildings...` posts next, marks one-shot latch `[world+0x46c3c] = 1`, runs `world_region_collection_run_building_population_pass` `0x00421c20(1.0, 1)`, and then clears that latch again; if `[0x006cec74+0x178] > 0` under the same editor-mode clear gate, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: when startup latch `0x006cd8d8` is clear it stamps `[0x006cec7c+0x79] = 1`, ensures `[world+0x6a6c] >= 1`, forces chairman-seat byte `[world+0x69db] = 1`, and then runs the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`; current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation + pre-recipe-scalar mirror correlation + economic-tuning-band correlation + direct-body gate correlation" 0x00437737,105,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The real function entry starts at `0x00437737`, where it first checks the shared stage counter at `0x00620e94` against threshold `0x26ad` and returns immediately once that earlier startup window has passed. Otherwise it walks the live candidate pool at `0x0062b268` in reverse order, derives one boolean override bit, and upserts each surviving candidate stem into the scenario-side named availability table through `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on `0x006cec78`. That override bit is now tighter than the older structural read: any nonzero availability word at `[candidate+0xba/+0xbb]` forces the upsert with bit `0`, while zero-word candidates derive the bit from the subtype parity check on `[candidate+0x32]` via the local `2 xor subtype` path; those zero-word subtype cases are skipped only when the copied stage-counter argument is nonzero. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass that mirrors live candidate subtype or availability state into `[world+0x66b2]` before the visible progress phases begin, rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation + override-bit-derivation correlation + entry-boundary correction" 0x00438890,644,shell_active_mode_run_profile_startup_and_load_dispatch,map,thiscall,inferred,objdump + caller xrefs + debugger comparison,4,"Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, immediately re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, posts several shell progress or status updates through `0x5193f0/0x540120`, mirrors one shell-managed string table off `0x006d4020+0x429b0` into local dword slots `[this+0x46a80..+0x46aa4]`, and allocates the common startup-side runtime pools before the selector jump at all: the cargo collection `0x0062ba8c`, structure-candidate pool `0x0062b268`, auxiliary candidate collection `0x0062b2fc`, support owner `0x0062ba88`, locomotive pool `0x006ada84`, optional world root `0x0062c120`, city-label and manager families `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, `0x006cea4c`, and `0x006acd34`, plus the setup helper at `0x0062b244`. That common pre-branch stage is tighter now too: after allocating the locomotive pool it reverse-walks the live locomotives through `0x00461c80` and pre-seeds named locomotive-availability rows in scenario state through `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` before the later progress lane continues. Only after that common allocation pass does it switch over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438a66..0x00438c00` that first refreshes one support-family type-`7` record from setup path buffer `0x006d1370` through `global_banked_type7_record_refresh_from_openable_path_basename_and_stem` `0x0053d130`, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor selection hold through `0x0053f310`, builds three progress-text payloads, re-enters the hold through `0x0053f2f0`, and only then allocates `0x0062c120` when absent, runs `0x0044faf0`, and forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call.","objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation + selector2-support-record correlation + cursor-hold choreography correlation + startup-allocation-pass correlation + locomotive-availability-preseed correlation" 0x00435603,10,scenario_state_ensure_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny guard wrapper over one derived scenario-state year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. When the small mode or threshold byte at `[this+0x3a]` is already `>= 2` the helper returns immediately; otherwise it falls back into the heavier rebuild body at `0x004351c0`, which refreshes those companion thresholds from the current year and shell-controller-side values before continuing. Current grounded callers are the post-fast-forward selected-year tail at `0x00437170`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, the compact runtime-effect side branch at `0x00431e03`, and the shell-command lane at `0x004661c0/0x004661e9`, so this is the safest current read for the small year-threshold ensure wrapper rather than a generic boolean probe.","objdump + local disassembly + caller correlation + year-threshold-band correlation" @@ -581,7 +582,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `[0x006cec74+0x178]`, and then overrides that count to literal `0x150` whenever special-condition slot `30` `[0x006cec78+0x4af7]` is nonzero before repeatedly advancing the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering + special-condition override correlation" 0x00434680,435,world_set_game_speed_mode,simulation,thiscall,inferred,objdump + strings,3,"Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.`","objdump + RT3.lng strings + multiplayer handoff" 0x00434850,19,world_adjust_game_speed_mode_delta,simulation,thiscall,inferred,objdump,3,"Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled.","objdump + callee inspection" -0x004338c0,12,shell_mode_gate_is_active,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Tiny boolean wrapper over the shell-side gate at `0x006d07b4`. The helper simply forwards `0x004d4150`, normalizes the result to `0/1`, and returns. Current grounded callers use it as a coarse mode gate before trusting several scenario-side and runtime-object fields, including the flag-byte readers at `0x0041f910`, `0x00461500`, and `0x00474430`, plus broader world or shell-side branches such as `0x004197e0`, `0x00440e4d`, and `0x0044ccdc`. The exact player-facing owner of `0x006d07b4` is still open, so the safest current name stays structural around one active shell-mode gate.","objdump + local disassembly + caller correlation + gate reuse correlation" +0x004338c0,12,shell_mode_gate_is_active,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Tiny boolean wrapper over the shell-side gate at `0x006d07b4`. The helper simply forwards `0x004d4150`, normalizes the result to `0/1`, and returns. Current grounded callers use it as a coarse mode gate before trusting several scenario-side and runtime-object fields, including the flag-byte readers at `0x0041f910`, `0x00461500`, and `0x00474430`, plus broader world or shell-side branches such as `0x004197e0`, `0x00440e4d`, and `0x0044ccdc`. The row is therefore kept at the structural active-shell-mode-gate level around `0x006d07b4`.","objdump + local disassembly + caller correlation + gate reuse correlation" 0x00433790,8,scenario_state_set_selected_chairman_company_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw setter over the shell-side scenario state object at `0x006cec78`. The helper stores the caller-supplied company id directly into `[this+0x21]` and returns. Current grounded callers are the company and chairman reassignment flows at `0x00426dd4`, `0x00427d06`, `0x00427d93`, and the startup-company seeding or rotation paths around `0x0047d282`, `0x0047d409`, and `0x0047d609`, where it keeps the raw selected-company summary in sync with later chairman or ownership changes. This is therefore the direct id-level companion to the higher record accessor `scenario_state_get_selected_chairman_company_record` `0x00434870` rather than a broader state mutator.","objdump + global-state inspection + caller correlation + selected-company-summary correlation" 0x004337a0,4,scenario_state_get_selected_chairman_company_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns company id field `[this+0x21]` directly without resolving it through the live company collection. Current grounded callers include the linked-site status formatter `0x0040e4e0`, the company or chairman reassignment families around `0x00426dd4`, `0x004427aac`, and `0x0047d462`, the startup-company seeding branches around `0x0047d4ed`, and many shell-side overview or ledger renderers that compare the current row against the scenario-selected company before choosing text or style. This is therefore the raw selected-company-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_company_record` `0x00434870`.","objdump + global-state inspection + caller correlation + selected-company-summary correlation" 0x004337b0,4,scenario_state_get_selected_chairman_profile_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns chairman profile id field `[this+0x25]` directly without resolving it through the global persona collection. Current grounded callers include the company-detail and load-screen style selectors, chairman rotation or reassignment branches around `0x00427cf4`, `0x00427d80`, `0x004295ef`, and `0x0047d3f9`, and many shell-side renderers that compare the current row's linked chairman against the scenario-selected chairman before choosing visible styling. This is therefore the raw selected-chairman-profile-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_profile_record` `0x004348c0`.","objdump + global-state inspection + caller correlation + selected-chairman-summary correlation" @@ -619,16 +620,16 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00448fe0,108,world_serialize_four_sidecar_byte_planes_into_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Save-side sibling of world_load_four_sidecar_byte_planes_from_runtime_bundle. The helper opens chunk family `0x9471..0x9472` for output through `0x00531340`, computes the same one-plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four source plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and writes those four buffers through repeated `0x00531030` calls before closing the chunk family. Current grounded callers are the `.smp` serializer inside world_runtime_serialize_smp_bundle `0x00446240` and the neighboring world-side bundle-save branch at `0x00449714`, so this is the safest current read for the shared four-plane runtime-bundle serializer rather than a generic writer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation" 0x00449520,636,world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-tag correlation,4,"Save-side sibling of `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`. The helper first opens chunk `0x2ee2`, delegates one fixed `0xc8`-byte world-grid header save through `world_serialize_fixed_grid_header_mask_planes_secondary_raster_and_overlay_chunks_into_bundle` `0x00553760`, posts progress notice `0x005caa50`, and then writes the core grid and stride scalars from `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It follows with chunk family `0x2ef4/0x2ef5/0x2ef6` for the three main packed sidecar bands rooted at `[this+0x213d]`, `[this+0x2131]`, and `[this+0x2135]`, chunk family `0x2ee4/0x2ee5` for the extra bitplane and cell-word side rooted at `[this+0x2141]` and `[this+0x212d]`, re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0`, and then walks every live world-grid cell from `[this+0x2129]` through `0x0042b4a0` before closing the `0x2ee5` phase. Current grounded caller is the early package-save owner `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, so this is the safest current read for the early world-grid and secondary-raster bundle-save body rather than a generic header writer.","objdump + caller inspection + local disassembly + bundle-tag correlation + world-grid-array correlation + save-side sibling correlation" 0x0044afa0,439,world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Composed local world-scalar query over the live world root. The helper first derives one distance-like term from the caller cell to global preview anchor fields `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`; distances above `0x32` contribute one clamped bias term. It then samples the companion float raster rooted at `[world+0x1605]` at the caller cell and across two 8-direction rings from the static offset tables `0x00624b28/0x00624b48`, keeps the highest rounded neighbor sample, and folds the local rise above the center sample into the running score. When preview scalar `[0x0062be68+0x20]` exceeds threshold `0x005ca190` it adds one further scaled bias, and when the neighboring shell-mode gate `0x0041fff0` passes it adds `0x32` more before returning the final score plus base offset `0x8c`. Current grounded callers are the shared rounded-coordinate wrapper `0x0041f6b0` and the sibling virtual wrapper `0x004614d0`.","objdump + caller xrefs + local disassembly + float-grid correlation + radial-distance-helper correlation" -0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437737`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation" +0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]` before the broader reactivation sweep continues. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437737`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation + late-reactivation-clear correlation" 0x0044c670,2544,world_service_secondary_grid_marked_cell_overlay_cache,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Recurring world-side service pass over the secondary raster rooted at `[this+0x2135]` after `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` has cached min/max/count bounds into `[this+0x21c6..+0x21d6]`. The helper first requires shell-state gate `[0x006cec78+0x4af3]`, then consumes the cached bounds to normalize the marked-cell band and rewrite per-cell bits in the same secondary raster. Its later overlay side is tighter now too: after resolving scaled surface dimensions through `shell_world_presentation_query_scaled_surface_dimensions` `0x00534c50`, it walks one local 3-by-32 sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only secondary-raster classes `4..0x0d`, folds several interpolated samples through repeated `0x0051db80` evaluation into one strongest local score, writes packed overlay pixels into the staged surface buffer, and only then publishes that staged overlay through `shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer` `0x00534af0`. The lower helper cluster beneath that owner is now explicit too: `0x00533e70` refreshes the coarse overlay chunks in a rectangle, `0x00534160` ensures one coarse chunk and seeds local marks, and `0x00534e90` is the neighboring marked-bit predicate over the same 3-byte raster family. Current grounded callers are the recurring simulation-maintenance route-style branch at `0x0040a9f4` inside `simulation_service_periodic_boundary_work` `0x0040a590` and one startup-side world branch at `0x00448168`, so this is the safest current read for the shared secondary-grid marked-cell overlay-cache service rather than a one-shot startup helper or a fully player-facing panel renderer.","objdump + local disassembly + caller inspection + secondary-raster correlation + recurring-maintenance correlation + staged-overlay publish correlation" 0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it explicitly re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The collection-side tagged load strip inside that bringup is now explicit too: before the later runtime rehydrate tail it loads the main route-entry collection `0x006cfca8` through `0x00493be0`, the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, refreshes placed-structure local runtime records through `0x004133b0`, rebuilds one flagged secondary-raster cleanup band through `0x00448af0/0x00533fe0`, reloads the world-manager side family at `0x006ceb9c` through `0x00477780`, reloads the geographic-label database at `0x006ada80` through `geographic_label_database_refresh_records_from_tagged_bundle` `0x00461580`, reloads the city-database entry collection at `0x006cea50` through `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540`, reloads the live region collection at `0x0062bae0` through `world_region_collection_refresh_records_from_tagged_bundle` `0x00421510`, refreshes the neighboring manager at `0x006cfc9c` through `0x00487c20`, reloads the support family at `0x0062b244` through `0x0040b5d0`, and reloads event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The recipe-runtime lane is now split more tightly than before too: one early restore-side call at `0x00443ebc` rebuilds the scenario-side port-or-warehouse cargo runtime tables immediately after restoring the named candidate-availability collection at `[world+0x66b2]`, and before the neighboring candidate-filter/count refreshes `0x00412c10/0x00412bd0` plus the year-derived follow-ons `0x00434130/0x00436af0`; a second late call at `0x00444ac1` reruns that same recipe rebuild only after the `0x197` checkpoint, shell-progress scalar publish `0x004354a0`, territory-side sweep `0x00487de0`, and before the final named-candidate availability preseed `0x00437737` plus the later candidate-filter refresh `0x00412c10`. The later load-side rehydrate band is tighter now too. Before the final world and shell reactivation it posts shell progress ids `0x32dc/0x3714/0x3715`, restores the late world-status block `[world+0x66be]` from `0x2ee0/0x2ee1`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, reruns `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, the shared stage-threshold compare `0x00444dc5`, the candidate visibility sweep `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`. Only after that does it restore the two named-availability collections rather than only the locomotive side: the candidate table at `[world+0x66b2]` is restored first from fixed `0x22`-byte name-plus-dword rows, keeping only names that survive the built-in stem rejects and still resolve into the live candidate pool through `0x00412b70`, with no later candidate-side fallback preseed if that validated pass stays empty. Only after that does the same band restore the named locomotive-availability collection at `[world+0x66b6]` by raw row insertion, preserving the older empty-collection fallback into `0x004350b0`, followed by the live locomotive override refresh `0x00461e00`. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation.","objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation + tagged-collection-load-order correlation + named-availability-restore-order correlation + selected-year-reactivation correlation + recipe-runtime-double-rebuild correlation" -0x00440530,46,shell_open_or_focus_detail_panel_mode_0x0b_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x0b`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x0b_or_warn` `0x00434db0`; on success it forwards `(-1, 0x0b)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de49a`, which uses the same gate and mode. This is therefore the safest current read for the direct mode-`0x0b` opener rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + mode-transition correlation" +0x00440530,46,shell_open_or_focus_detail_panel_mode_0x0b_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x0b`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x0b_or_warn` `0x00434db0`; on success it forwards `(-1, 0x0b)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de49a`, which uses the same gate and mode. This is therefore the current bounded read for the direct mode-`0x0b` opener.","objdump + caller inspection + shell-detail correlation + mode-transition correlation" 0x00440560,22,shell_open_or_focus_detail_panel_mode_0x01_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 1)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`1` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation" 0x00440580,22,shell_open_or_focus_detail_panel_mode_0x04_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 4)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`4` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation" 0x004405a0,46,shell_open_or_focus_company_list_panel_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,4,"Direct shell command branch that opens the company-list panel through detail-panel mode `7`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; on success it forwards `(-1, 7)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side command strip at `0x004de2dd`, which uses the same gate and mode. This is therefore the safest current read for the direct company-list opener rather than a generic mode-toggle stub.","objdump + caller inspection + shell-detail correlation + mode-transition correlation" 0x004405d0,126,shell_open_or_focus_selected_company_detail_panel_with_start_company_fallback,shell,cdecl,inferred,objdump + caller inspection + company-detail correlation,4,"Direct shell command branch above the selected-company `CompanyDetail.win` lane. The helper first requires the live detail-panel controller at `0x006d0818`; if no selected-company id is available through `scenario_state_get_selected_chairman_company_id` `0x004337a0`, it raises localized id `368` through the shared shell modal path and, when the current chairman still passes `0x00476d10`, it offers the `Start New Company` dialog through `0x0047d080` before retrying the selected-company lookup. Once a selected-company id exists it re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40` and then forwards `(selected_company_id, 8)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the load-screen side launcher strip at `0x004de3a8`, which shares the same gate, fallback dialog, and selected-company handoff. This is therefore the safest current read for the direct selected-company-detail opener with start-company fallback rather than a generic company-command branch.","objdump + caller inspection + company-detail correlation + start-company fallback correlation + mode-transition correlation" 0x00440660,46,shell_open_or_focus_stockbuy_window_for_selected_company_if_allowed,shell,cdecl,inferred,objdump + caller inspection + stockbuy correlation,4,"Direct shell command branch that opens the shell-side `StockBuy.win` family through detail-panel mode `0x0c`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_stockbuy_window_or_warn` `0x00433aa0`; on success it forwards `(-1, 0x0c)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. The later same-mode refresh tail inside `0x004ddbd0` also special-cases mode `0x0c` through `0x00493150`, which keeps this on the `StockBuy.win` family rather than another company-side page. Current grounded companion caller is the page-side launcher at `0x004de50f`.","objdump + caller inspection + stockbuy correlation + mode-transition correlation + same-mode-refresh correlation" -0x00440690,46,shell_open_or_focus_detail_panel_mode_0x06_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x06`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x06_or_warn` `0x00434e20`; on success it forwards `(-1, 0x06)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de27a`, which uses the same gate and mode. This is therefore the safest current read for the direct mode-`0x06` opener rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + mode-transition correlation" +0x00440690,46,shell_open_or_focus_detail_panel_mode_0x06_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x06`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x06_or_warn` `0x00434e20`; on success it forwards `(-1, 0x06)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de27a`, which uses the same gate and mode. This is therefore the current bounded read for the direct mode-`0x06` opener.","objdump + caller inspection + shell-detail correlation + mode-transition correlation" 0x004406c0,51,shell_open_or_focus_trainbuy_window_if_allowed,shell,cdecl,inferred,objdump + caller inspection + trainbuy correlation,4,"Direct shell command branch above the shell-side `Trainbuy.win` family. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_trainbuy_window_or_warn` `0x00433b00`; on success it calls `shell_open_or_focus_trainbuy_window` `0x00512c50` with the fixed singleton-open argument set used by the same family elsewhere. Current grounded companion caller is the page-side launcher at `0x004de7d9`, which shares the same gate and opener. This is therefore the safest current read for the direct train-buy opener rather than a generic shell command stub.","objdump + caller inspection + trainbuy correlation + singleton-open correlation" 0x00440700,22,shell_open_or_focus_load_screen_page_1_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `1` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table already grounds page `1` as the company-overview wrapper.","objdump + local disassembly + load-screen correlation + page-table correlation" 0x00440720,22,shell_open_or_focus_load_screen_page_3_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `3` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `3` as the income-statement slice.","objdump + local disassembly + load-screen correlation + page-table correlation" @@ -671,19 +672,19 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00440f20,274,shell_command_step_active_window_subject_backward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Backward-step sibling of `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00`, registered at `0x45ffdf` with action id `0x21` and localized label id `0x0d66`. The helper walks the same live window-family priority chain: `StationDetail.win` through `shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class` `0x00505e40`, then the building-detail singleton `0x006cfd04` through `0x004b6fd0`, then the company-detail singleton `0x006cfe4c` through `shell_company_detail_select_previous_active_company` `0x004c3550` when no custom modal is active, and finally the sibling singleton `0x006d3b20` through `0x00514890`. When none of those families is live but scenario state `0x006cec78` exists, it builds and conditionally publishes the paired contextual notice through localized ids `0x017c/0x017d`, `0x0045f3d0`, and `0x004554e0`. This is therefore the broad reverse-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation" 0x00441040,131,shell_open_or_focus_train_detail_for_current_or_first_owned_train,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff1b` with action id `0x54` and localized label id `0x0d62`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current train-subject id from `[detail+0x78]` and validates it against the live train collection `0x006cfcbc`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned trains through `company_count_owned_trains` `0x004264c0`, and falls back to the first owned-train id through `0x00426520`. Once a valid train id survives it forwards `(train_id, 2)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct train-detail opener or refresher for the current subject with first-owned-train fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + train-detail correlation + first-owned-train fallback correlation" 0x004410d0,138,shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff7d` with action id `0x53` and localized label id `0x0d64`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current station-subject id from `[detail+0x80]` and validates it against the live placed-structure collection `0x006cec20`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned linked stations through `company_count_linked_transit_sites` `0x00426590(0)`, and falls back to the first owned linked-station id through `0x00426620(1, 0)`. Once a valid station id survives it forwards `(station_id, 5)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct station-detail opener or refresher for the current subject with first-owned-station fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + station-detail correlation + first-owned-station fallback correlation" -0x00441160,50,shell_command_dispatch_live_world_followon_by_query_0x450150,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling beneath the same command table. The helper requires active scenario state `0x006cec78` plus the live world root `0x0062c120`, re-enters query helper `0x00450150`, and then dispatches one of two world-root follow-ons: `0x00453370` when that query returns zero, or `0x00453780` when it returns nonzero. The registration block at `0x460286` ties this body to localized label id `0x0d73` and command id `0x47`. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + world-root followon correlation" -0x004411a0,52,shell_command_dispatch_live_route_store_followon_by_query_0x4934a0_zero,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling over the live route-store root `0x006cfca8`. The helper requires active scenario state `0x006cec78` plus a live route-store owner, re-enters `0x004934a0(0)`, and then dispatches one of two route-store follow-ons: `0x00491880` when that query returns nonzero, or `0x004932a0` when it returns zero. The registration block at `0x4602b7` ties this body to localized label id `0x0f01` and the same command id `0x47` family. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + route-store followon correlation" +0x00441160,50,shell_command_dispatch_live_world_followon_by_query_0x450150,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling beneath the same command table. The helper requires active scenario state `0x006cec78` plus the live world root `0x0062c120`, re-enters query helper `0x00450150`, and then dispatches one of two world-root follow-ons: `0x00453370` when that query returns zero, or `0x00453780` when it returns nonzero. The registration block at `0x460286` ties this body to localized label id `0x0d73` and command id `0x47`. The row is therefore kept at that concrete dispatch-shape and localized-command level.","objdump + command-registration correlation + local disassembly + world-root followon correlation" +0x004411a0,52,shell_command_dispatch_live_route_store_followon_by_query_0x4934a0_zero,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling over the live route-store root `0x006cfca8`. The helper requires active scenario state `0x006cec78` plus a live route-store owner, re-enters `0x004934a0(0)`, and then dispatches one of two route-store follow-ons: `0x00491880` when that query returns nonzero, or `0x004932a0` when it returns zero. The registration block at `0x4602b7` ties this body to localized label id `0x0f01` and the same command id `0x47` family. The row is therefore kept at that concrete dispatch-shape and localized-command level.","objdump + command-registration correlation + local disassembly + route-store followon correlation" 0x00441240,21,shell_command_toggle_shared_world_preview_global_0x62be84,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + global-state correlation,2,"Tiny registered shell command that flips global dword `0x0062be84` between `0` and `1`. The same global is already grounded on the station-detail candidate-service preview side and on the city-site connection-bonus label formatter, so this command currently reads as a shared world-preview-global toggle rather than a detail-window-local helper. The registration block at `0x4602e8` ties it to action id `0x4e` and localized label id `0x0d74`.","objdump + command-registration correlation + local disassembly + global-state correlation + shared-preview-global correlation" -0x00441260,49,shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Registered shell command beneath action id `0x09` and localized label id `0x0d70`. The helper first rejects while sibling singleton `0x006d3b4c` is live, then requires active scenario state `0x006cec78` and the main shell presenter root `0x006d4024`. It derives one boolean from presenter field `[root+0x114216] == 1`, passes that boolean together with variant selector `0` into `0x00433da0`, and that shared helper in turn restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across detail-panel controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the variant into world helper `0x0043a0a0`. Current evidence is strong enough for the mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation" -0x004412a0,49,shell_command_open_detail_panel_mode_0x19_variant_1_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Variant-`1` sibling of `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`, registered under the same action id `0x09` family with localized label id `0x0d71`. The helper enforces the same `0x006d3b4c` / scenario-state / presenter-root gates, derives the same presenter boolean from `[0x006d4024+0x114216] == 1`, and then re-enters `0x00433da0` with variant selector `1`, which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the selected variant into world helper `0x0043a0a0`. Current evidence is strong enough for the paired mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation" -0x004412e0,85,shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-state correlation,3,"Registered shell command beneath action id `0x45` and localized label id `0x0d75`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then accepts either when shell-state probe `0x00435480` succeeds or when shell flag `[0x006cec74+0x1df]` is already nonzero through `0x00482840`. On the active path it re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` with stack flag `1` and then writes shell dwords `[0x006cec74+0x1df/+0x1e3] = 0/0` through `0x00482850`, which also triggers the follow-on refresh helper `0x004354a0`. Current evidence is strong enough for the shell-state-band and year-threshold refresh owner shape, but not yet for a tighter user-facing command name.","objdump + command-registration correlation + local disassembly + shell-state correlation + year-threshold-band correlation" +0x00441260,49,shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Registered shell command beneath action id `0x09` and localized label id `0x0d70`. The helper first rejects while sibling singleton `0x006d3b4c` is live, then requires active scenario state `0x006cec78` and the main shell presenter root `0x006d4024`. It derives one boolean from presenter field `[root+0x114216] == 1`, passes that boolean together with variant selector `0` into `0x00433da0`, and that shared helper in turn restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across detail-panel controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the variant into world helper `0x0043a0a0`. The row is therefore kept at that concrete mode-`0x19` variant-open level.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation" +0x004412a0,49,shell_command_open_detail_panel_mode_0x19_variant_1_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Variant-`1` sibling of `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`, registered under the same action id `0x09` family with localized label id `0x0d71`. The helper enforces the same `0x006d3b4c` / scenario-state / presenter-root gates, derives the same presenter boolean from `[0x006d4024+0x114216] == 1`, and then re-enters `0x00433da0` with variant selector `1`, which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the selected variant into world helper `0x0043a0a0`. The row is therefore kept at that concrete mode-`0x19` variant-open level.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation" +0x004412e0,85,shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-state correlation,3,"Registered shell command beneath action id `0x45` and localized label id `0x0d75`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then accepts either when shell-state probe `0x00435480` succeeds or when shell flag `[0x006cec74+0x1df]` is already nonzero through `0x00482840`. On the active path it re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` with stack flag `1` and then writes shell dwords `[0x006cec74+0x1df/+0x1e3] = 0/0` through `0x00482850`, which also triggers the follow-on refresh helper `0x004354a0`. The row is therefore kept at that shell-state-band and year-threshold refresh level.","objdump + command-registration correlation + local disassembly + shell-state correlation + year-threshold-band correlation" 0x004411e0,31,shell_command_toggle_presenter_flag_0x114276_if_present,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + presenter-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d79`. The helper probes the main shell presenter root at `0x006d4024` and, when that root is live, flips the dword at `[presenter+0x114276]` between `0` and `1`. Current evidence is only strong enough for the direct toggle and owner boundary, not for a tighter user-facing semantic name for that presenter-side latch.","objdump + command-registration correlation + local disassembly + presenter-root correlation + toggle-latch correlation" -0x00441200,52,shell_command_send_message_0xcb_to_control_0x9858_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-message correlation,2,"Small registered shell command beneath action id `0x5a` and localized label id `0x0d7b`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then forwards shell message `0xcb` with control id `0x9858` plus three zero trailing arguments into the shared shell runtime at `0x006d401c` through `0x00538e00`. Current evidence is strong enough for the message-injection owner shape, but not yet for a tighter user-facing command name for control `0x9858`.","objdump + command-registration correlation + local disassembly + shell-message correlation + active-scenario correlation" +0x00441200,52,shell_command_send_message_0xcb_to_control_0x9858_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-message correlation,2,"Small registered shell command beneath action id `0x5a` and localized label id `0x0d7b`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then forwards shell message `0xcb` with control id `0x9858` plus three zero trailing arguments into the shared shell runtime at `0x006d401c` through `0x00538e00`. The row is therefore kept at that concrete message-injection and control-`0x9858` level.","objdump + command-registration correlation + local disassembly + shell-message correlation + active-scenario correlation" 0x00441340,15,shell_command_dispatch_cheat_code_modal_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + cheat-owner correlation,2,"Tiny registered shell command beneath action id `0x00be` and localized label id `0x0d7c`. The helper requires active scenario state `0x006cec78` and then tail-calls `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70`. This is therefore the direct command-table entry for the cheat-code modal owner rather than a generic scenario follow-on.","objdump + command-registration correlation + local disassembly + cheat-owner correlation" -0x00441360,68,shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + focus-handoff correlation,3,"Registered shell command beneath action id `0x47` and localized label id `0x0db3`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, requires live collection root `0x0062b244`, then queries selector `0x0040b2d0(0, 1)`. When that selector returns a nonzero subject id, the helper forwards `(1, 3, subject_id)` into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. Current evidence is strong enough for the focus-handoff owner shape, but not yet for a tighter user-facing verb or subject family name.","objdump + command-registration correlation + local disassembly + focus-handoff correlation + selector-correlation" -0x00441490,85,shell_command_open_overview_for_previous_or_latest_fixed_preview_record,shell,cdecl,inferred,llvm-objdump + local disassembly + fixed-record-family correlation,3,"Small shell-side command over the fixed preview-record family rooted at `0x005ce418`. The helper first queries `fixed_preview_record_query_min_sequence_entry_or_zero` `0x00473e70(0)` from the live preview dataset object `0x006cea4c`; when that inactive-minimum sequence record exists it immediately asks `fixed_preview_record_query_previous_sequence_entry_or_zero` `0x00473ee0` for the predecessor sequence `([entry+0x14] - 1)`. When no inactive minimum entry exists, it falls back to `fixed_preview_record_query_max_sequence_entry_or_zero` `0x00473dc0`. Any resulting record pointer is then forwarded into `shell_open_or_focus_overview_for_fixed_preview_record` `0x004f3a10`, otherwise the command returns silently. Current evidence is strong enough for the previous-or-latest fixed-preview record command shape, but not yet for the exact user-facing registration label.","llvm-objdump + local disassembly + fixed-record-family correlation + overview-window correlation" +0x00441360,68,shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + focus-handoff correlation,3,"Registered shell command beneath action id `0x47` and localized label id `0x0db3`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, requires live collection root `0x0062b244`, then queries selector `0x0040b2d0(0, 1)`. When that selector returns a nonzero subject id, the helper forwards `(1, 3, subject_id)` into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. The row is therefore kept at that concrete focus-handoff and selector-resolved subject level.","objdump + command-registration correlation + local disassembly + focus-handoff correlation + selector-correlation" +0x00441490,85,shell_command_open_overview_for_previous_or_latest_fixed_preview_record,shell,cdecl,inferred,llvm-objdump + local disassembly + fixed-record-family correlation,3,"Small shell-side command over the fixed preview-record family rooted at `0x005ce418`. The helper first queries `fixed_preview_record_query_min_sequence_entry_or_zero` `0x00473e70(0)` from the live preview dataset object `0x006cea4c`; when that inactive-minimum sequence record exists it immediately asks `fixed_preview_record_query_previous_sequence_entry_or_zero` `0x00473ee0` for the predecessor sequence `([entry+0x14] - 1)`. When no inactive minimum entry exists, it falls back to `fixed_preview_record_query_max_sequence_entry_or_zero` `0x00473dc0`. Any resulting record pointer is then forwarded into `shell_open_or_focus_overview_for_fixed_preview_record` `0x004f3a10`, otherwise the command returns silently. The row is therefore kept at that fixed-preview command shape and localized-command level.","llvm-objdump + local disassembly + fixed-record-family correlation + overview-window correlation" 0x00441500,399,shell_command_prompt_for_class0_region_name_and_focus_matching_world_region,shell,cdecl,inferred,llvm-objdump + local disassembly + region-family correlation + world-view correlation,3,"Broader shell command that prompts for one class-`0` world-region name and focuses the matching region in the live world view. The helper requires active scenario state `0x006cec78`, opens one callback-driven prompt rooted at localized id `0x16a` through `0x005193f0 -> 0x004c98a0`, and then walks the live region collection `0x0062bae0`. It skips any nonzero region-class records at `[region+0x23e]`, compares the entered text against each candidate name `[region+0x356]` through the bounded locale-aware string comparator `0x005a5f26`, and on the first match temporarily sets `0x0062be70 = 1`, clears the live world-view latch `[view+0x346]` through `0x0043a190` when the view owner `0x0062be68` is live, and then re-enters `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900` with the matched region pointer before restoring `0x0062be70` and refreshing the view through vtable slot `+0x1c`. When no class-`0` region name matches, it instead opens the fixed failure modal rooted at localized id `0x16b`. Current evidence is strongest for the class-`0` region-name prompt and focus owner rather than a narrower city-only label.","llvm-objdump + local disassembly + region-family correlation + world-view correlation + locale-compare correlation" -0x00441690,244,shell_command_prompt_for_text_and_submit_selector1_multiplayer_transport_request_when_auxiliary_preview_ready,shell,cdecl,inferred,llvm-objdump + local disassembly + multiplayer-preview correlation + auxiliary-preview-owner correlation,3,"Broader shell command that opens one text-entry prompt and forwards the entered string into the multiplayer preview-dataset transport path, but only when the auxiliary-preview owner is live. The helper requires active scenario state `0x006cec78`, the auxiliary-preview-owner gate `shell_has_auxiliary_preview_owner` `0x00434050`, and a live queued-preview record at `[world+0x66ae]`. It then increments the shared shell modal depth through `0x00538a30`, sets shell-global `0x0062be80 = 1`, opens one callback-driven prompt rooted at localized id `0x0b6d` through `0x005193f0 -> 0x004c98a0`, and when the returned text buffer is nonempty submits `(request_id 0, selector 1, payload, strlen+1, flag 1, aux 0)` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` on the live preview dataset `0x006cd8d8`. On every exit it decrements the shell modal depth through `0x00538a40`, clears `0x0062be80`, and returns `0`; failed preconditions return `1`. Current evidence supports the structural prompt-plus-selector-`1` transport owner shape, but not yet a tighter user-facing semantic label for prompt `0x0b6d`.","llvm-objdump + local disassembly + multiplayer-preview correlation + auxiliary-preview-owner correlation + shell-modal-depth correlation" +0x00441690,244,shell_command_prompt_for_text_and_submit_selector1_multiplayer_transport_request_when_auxiliary_preview_ready,shell,cdecl,inferred,llvm-objdump + local disassembly + multiplayer-preview correlation + auxiliary-preview-owner correlation,3,"Broader shell command that opens one text-entry prompt and forwards the entered string into the multiplayer preview-dataset transport path, but only when the auxiliary-preview owner is live. The helper requires active scenario state `0x006cec78`, the auxiliary-preview-owner gate `shell_has_auxiliary_preview_owner` `0x00434050`, and a live queued-preview record at `[world+0x66ae]`. It then increments the shared shell modal depth through `0x00538a30`, sets shell-global `0x0062be80 = 1`, opens one callback-driven prompt rooted at localized id `0x0b6d` through `0x005193f0 -> 0x004c98a0`, and when the returned text buffer is nonempty submits `(request_id 0, selector 1, payload, strlen+1, flag 1, aux 0)` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` on the live preview dataset `0x006cd8d8`. On every exit it decrements the shell modal depth through `0x00538a40`, clears `0x0062be80`, and returns `0`; failed preconditions return `1`. The row is therefore kept at that structural prompt-plus-selector-`1` transport level for prompt `0x0b6d`.","llvm-objdump + local disassembly + multiplayer-preview correlation + auxiliary-preview-owner correlation + shell-modal-depth correlation" 0x00441790,111,shell_resolve_focused_or_fallback_train_owned_by_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Shared current-train resolver beneath the shell-side train command strip. The helper first probes the live world-view owner at `0x0062be68`, and when a focused subject exists through `[view+0x60]` plus vtable slot `+0x6c`, it resolves the corresponding live train from collection `0x006cfcbc` by id `[subject+0x390]`. It then requires that train's owner company id `[train+0x51]` to match the current scenario-selected company through `scenario_state_get_selected_chairman_company_id` `0x004337a0`; otherwise it falls back to `0x005130f0` and repeats the same ownership test on that fallback train. Success returns the live train pointer; failure returns null. Current grounded callers are the adjacent shell command leaves `0x00441810`, `0x00441870`, and `0x004418a0`, so this is the safest current read for the focused-or-fallback owned-train resolver rather than a broader world-view query.","objdump + local disassembly + caller inspection + world-view correlation + selected-company correlation + train-command-strip correlation" 0x00441810,79,shell_command_crash_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x43` and localized label id `0x0d77` `Current train crashes`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`. When no train survives it opens the simple shell modal rooted at localized id `365` `There is no train available to crash!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the resolved train into `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0(1)`.","objdump + command-registration correlation + local disassembly + RT3.lng strings + crash-owner correlation" 0x00441870,34,shell_command_mark_current_or_fallback_owned_train_whistle_request,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,2,"Registered shell command beneath action id `0x57` and localized label id `0x0d76` `Current train whistles`. The helper resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`; when that succeeds it resolves the train-side visual owner through `0x004a77b0` and writes request dword `1` into `[owner+0x33a]`. Failure is silent and returns `0`. Current evidence is strong enough for the whistle-request owner shape even though the deeper user-facing meaning of `[owner+0x33a]` remains open.","objdump + command-registration correlation + local disassembly + RT3.lng strings + train-visual-owner correlation" @@ -701,7 +702,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00441d20,111,shell_command_decrement_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation + RT3.lng correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`, whose RT3.lng caption is `Decrement Time Of Day`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. Current evidence therefore closes the player-facing label and narrows the command to the time-of-day presentation family, even though the exact relationship between `[world+0xbfa]` and the mixed-radix calendar state beneath `0x00409e80` still needs one deeper pass.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation + RT3.lng correlation" 0x00441d90,135,shell_build_percent_status_payload_clamped_0_to_100,shell,cdecl,inferred,objdump + local disassembly + caller inspection + status-publisher correlation,3,"Shared percentage-status payload builder used by the save or load progress strip. The helper divides one caller float by one caller integer, multiplies by fixed scalar `100.0f`, rounds through `0x005a10d0`, clamps the result to at most `100`, and then packages that percentage into the small status payload built through `0x0051b700`, `0x005193f0`, and `0x00518de0`, returning the final shell text handle rooted at `0x0062c0d8`. Current grounded callers include the repeated progress-notice loop inside `shell_map_file_world_bundle_coordinator` `0x00445de0` and the adjacent throttled progress callback `0x00441e20`, so this is best read as the shared percent-status payload builder rather than a one-off modal helper.","objdump + local disassembly + caller inspection + status-publisher correlation + save-load-progress correlation" 0x00441e20,155,shell_progress_callback_publish_incremental_percent_status_until_target,shell,cdecl,inferred,objdump + caller inspection + local disassembly + progress-callback correlation,3,"Shared incremental progress callback above `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90`. The helper first checks global progress latches `0x0062bec8`, `0x0062becc`, and `0x0062c118`; when the caller target count has not advanced it returns immediately, and when the target equals `0x64` it instead advances `0x0062becc` by `0x14` and clears `0x0062c118`. Otherwise it increments `0x0062c118`, derives one intermediate percentage from the caller target divided by `3`, scaled by `100.0`, offset by current base `0x0062becc`, and then re-enters `shell_build_percent_status_payload_clamped_0_to_100` before publishing the resulting status through `0x00538c70` and servicing the shell frame through `0x00482160`. Current grounded owner correlation is the callback installation at `0x00442960`, which writes this function into global `0x00d93988` before entering a longer staged work loop, plus the same save or load progress family around `0x00445de0`. This is the safest current read for the throttled percent-status callback rather than another direct shell command leaf.","objdump + caller inspection + local disassembly + progress-callback correlation + staged-work correlation + shell-status correlation" -0x00441ec0,107,shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. On the save-side branch it writes one caller dword through `global_indexed_slot_table_write_bytes` `0x00531030` and then emits tagged headers `0x2ee0`, `0x03c2`, and `0x2ee1` through `0x00531340`; on the load-side branch it mirrors the same triplet through `0x005a276f` after opening the incoming staged object. Current grounded callers are the two companion-image file siblings `0x00441f70` and `0x004420f0`, where it serializes the selector byte at `[record+0x09]`, the payload size lane `[record+0x04]`, and the copied dword at `[record+0x00]` beside the external `_A.tga/_A.jpg` file path. This is the safest current read for the shared companion-image tag strip rather than a generic slot-table header helper.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation" +0x00441ec0,107,shell_map_bundle_serialize_or_restore_stage_dword_and_fixed_preview_payload_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. The helper first snapshots shared stage-counter dword `0x00620e94` into one stack-local slot, then splits into two concrete transport branches. On the slot-table branch `esi == 0` it writes that 4-byte leading dword through `global_indexed_slot_table_write_bytes` `0x00531030`, emits tagged headers `0x2ee0` and `0x2ee1` through `0x00531340`, and streams one fixed `0x03c2`-byte payload block from the caller buffer between those tags. On the staged-object branch `esi != 0` it opens the incoming object through `0x005a261f` and mirrors the same `dword + 0x2ee0 + 0x03c2 + 0x2ee1` strip through repeated `0x005a276f` transfers. The current incoming branches are tighter now too: direct package-save path `0x00444f47` reaches this helper immediately after `0x00442ba0`, while the companion-image and companion-payload sidecar branches around `0x00445983`, `0x00443cd3`, and `0x004459dd` also re-enter it after their file work. The separate `.smp` slot-table branch at `0x00446312` does not use this helper; it calls `0x00442ba0` and then emits `0x2ee0`, writes `0x403c2` bytes, and closes `0x2ee1` directly. Current local evidence still does not show `0x00441ec0` itself committing the restored leading dword back into `0x00620e94`, so the safest name stays on the serialize-or-restore tag strip rather than a stronger stage-counter restore claim.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation + stage-counter correlation + branch-split correlation + save-branch correlation" 0x00441f70,384,shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Broader companion-image load helper paired with `0x004420f0`. The helper derives an extensionless stem from the caller path through `support_copy_string_stem_before_first_dot` `0x0051dde0`, appends either `_A.tga` or `_A.jpg` according to selector byte `[record+0x09]`, opens the resulting path in mode `r+b`, streams the file through `0x005a1b05` into a temporary `0x200`-byte loop buffer, and then mirrors the loaded bytes through `0x005a276f` before writing the companion-image selector tags through `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`. Current grounded caller is the broader save or load coordinator strip around `0x00445983`, and the sibling overlay-surface owner `0x00535430` later consumes the same global fallback descriptor rooted at `0x0062bed4/0x0062bed8`. This is the safest current read for the companion-image file import path rather than a generic external file loader.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation" 0x004420f0,476,shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Write-side sibling of `0x00441f70` for the same companion-image family. The helper derives an extensionless stem from the caller destination path, appends either `_A.tga` or `_A.jpg` by selector byte `[record+0x09]`, tries to open that file in mode `r+b`, and when no existing file is present allocates or reuses the global staging buffer rooted at `0x0062bed4/0x0062bed8` before streaming bytes from the source handle in `0x200`-byte chunks. On the existing-file path it writes the same chunks through `0x005a276f`; on completion it clears the temporary typed cache through `0x0053c900`, copies the final companion path into the caller out-buffer, and returns. Current grounded caller is the save-side branch at `0x00443d1c`, which immediately follows this helper by writing the paired tagged headers `0x2ee0/0x2ee1`. The later world-presentation fallback path `0x00535430` also consumes the same global staging descriptor, so this is the safest current read for the companion-image export path rather than a generic file-copy helper.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation" 0x00450150,7,world_query_preview_mode_0x15_latch_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny getter for the shared world-side preview-mode latch byte `[this+0x21c5]`. The helper returns that byte unchanged as a boolean-like integer. Current grounded callers are the shell command strip at `0x00441173`, which chooses between the enter and exit siblings `0x00453370` and `0x00453780`, and the TrackLay destructor path at `0x0050db8d`, which only re-enters `0x00453510` when this latch is clear while world mode `[world+0x2175]` still equals `0x15`. This is therefore the safest current read for the direct mode-`0x15` preview-latch query rather than a broader world-mode predicate.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation" @@ -720,16 +721,16 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00453370,405,world_enable_preview_mode_0x15_latch_and_enter_if_idle,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared world-side owner for entering the preview-capable mode `0x15`. The helper first rejects when latch byte `[this+0x21c5]` is already nonzero; otherwise it sets that latch and only continues when current mode `[this+0x2175]` is still `0`. On the active path it releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles prior shell-presenter counters for the neighboring mode families `3` and `7` plus optional flag pair `[this+0x219d/+0x21a1]`, adjusts the shared presenter count lane `[0x006d4024+0x11426e]` from the mode table at `0x005ee5e8/0x005ee6e4`, seeds mode `0x15` into `[this+0x2175]`, clears the local scalar band `[+0x2179..+0x2189]`, seeds both timeout-like dwords `[+0x218d/+0x2191] = 0x1869f`, and re-enters `0x00450520` before tailing through `0x00452d30` according to shell field `[0x006cec74+0x12c]`. Current grounded caller is the shell command strip at `0x00441182`, which dispatches here when active scenario plus world state exist and the same preview latch is still clear. This is the safest current read for the mode-`0x15` preview-latch entry owner rather than a generic world reset.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation" 0x00453510,621,world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared teardown-or-reseed owner for the same world-side preview-mode family rooted at mode byte `[this+0x2175]` and latch `[this+0x21c5]`. The helper first reconciles the auxiliary preview byte `[this+0x2171]` through the small clear tail at `0x00452d30`, then tears down the current mode state through `0x00532360`, `0x00532500`, and `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, clears the current mode dword `[this+0x2175]`, and decrements the same shell-presenter counter families used by the entry sibling for prior modes `3` and `7` plus optional flags `[this+0x219d/+0x21a1]`. When preview latch byte `[this+0x21c5]` is still set, it then replays the same mode-`0x15` reset strip against the live world root `0x0062c120`, re-seeding `[world+0x2175] = 0x15`, the scalar band `[+0x2179..+0x2191]`, and the later `0x00450520 -> 0x00452d30` tail. When that latch is clear it returns with the mode fully torn down. Current grounded callers include the shell-side linked-peer action branch at `0x0040e94c`, the route or preview wrappers at `0x00449467` and `0x00464f2d`, many shell tool-window destructors such as `0x004f3b50`, `0x004f50fa`, `0x004f5784`, and `0x0050db9c`, plus the explicit latch-clear sibling `0x004537a0`. This is therefore the safest current read for the shared preview-mode clear-or-reseed owner rather than a one-window destructor helper.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation + tool-window teardown correlation" 0x00453780,38,world_disable_preview_mode_0x15_latch_and_clear_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny paired exit helper for the same world-side preview-mode family. When latch byte `[this+0x21c5]` is nonzero the helper clears that latch and, if current mode `[this+0x2175]` still equals `0x15`, tail-jumps into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`; otherwise it returns immediately. Current grounded callers are the shell command strip at `0x0044118a` and the neighboring settings-side wrapper at `0x004ff90c/0x004ff94a`, which use it as the direct preview-mode unlatch path when the same mode-`0x15` latch is already active. This is the safest current read for the paired latch-clear helper rather than another generic world-mode toggle.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation" -0x004422d0,96,shell_status_stack_push_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status bytes into one `5`-byte slot selected by the current depth: the low bytes of shell fields `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. Current grounded callers include the heavier wrappers `0x004423a0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction" -0x00442330,112,shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_byte_latches_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five saved bytes from the selected `0x0062be90` slot back into shell fields `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, sign-extending the first three shell byte lanes and zero-extending the fourth before writing them back into the wider shell dwords. Current grounded callers include the higher wrapper `0x004423d0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction" +0x004422d0,96,shell_status_stack_push_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status bytes into one `5`-byte slot selected by the current depth: the low bytes of shell fields `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. The caller boundary is tighter now too: current direct callers are the higher wrapper `0x004423a0` and the world-entry branch `0x00443a50` at `0x444e2c`; the grounded `.smp` serializer and neighboring simulation-side consumers `0x00446240`, `0x0040a9c0`, and `0x0046b9f0` reach this push through `0x004423a0` instead of calling it directly. This is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction + direct-caller-boundary correlation + world-entry correlation" +0x00442330,112,shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_byte_latches_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five saved bytes from the selected `0x0062be90` slot back into shell fields `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, sign-extending the first three shell byte lanes and zero-extending the fourth before writing them back into the wider shell dwords. The caller boundary is tighter now too: current direct callers are the higher wrapper `0x004423d0`, the world-entry branch `0x00443a50` at `0x444ecb`, and the non-`.smp` package-save tail at `0x00445a55`, while the live `.smp` serializer and neighboring simulation-side wrappers reach this pop through `0x004423d0` instead of calling it directly. This is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction + direct-caller-boundary correlation + package-tail correlation + world-entry correlation" 0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_byte_latches_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation + byte-lane-correction" -0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded callers include the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, the neighboring save-load path `0x00446d40`, and the collection-side world branch `0x0046b9f0`, so this is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation + byte-lane-correction" -0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads the smaller startup payload and preview-surface chunks rooted at ids `0x0001` and `0x03c2`, while the map-style side reads the larger setup payload chunks rooted at ids `0x0004`, `0x2ee0`, and `0x2ee1`, with the exact chunk mix gated by the parsed bundle-header word in the local scratch. Current grounded caller is `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`.","objdump + local disassembly + caller inspection + chunk-family correlation" +0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded direct callers are the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the collection-side world branch `0x0046b9f0`. The non-`.smp` package-save tail under `0x00445de0` is tighter now too: it does not re-enter this wrapper, but instead calls `0x00442330` directly at `0x00445a55` and then services `0x0050a530/0x0050e1e0` inline. This is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation + byte-lane-correction + package-tail correlation + direct-caller-boundary correlation" +0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads one smaller startup payload dword through the ordinary tag-`0x0001` family, stores that dword in shared global `0x00620e94`, reads one raw `0x03c2`-byte preview block, and then expands the returned `RGB` byte surface into packed `ARGB` dwords rooted at `[payload+0x03c2]`. The map-style side is a different family, not a second writer for that global: it reads the larger setup payload family under `0x0004`, `0x2ee0`, and `0x2ee1`, and current local disassembly shows no `0x00620e94` store in that branch. For bundle versions `>= 0x3f7` it restores the full `0x403c2`-byte setup-preview payload block directly into the destination record, while older versions only restore `0x402c9` bytes and explicitly zero the trailing `0x1003e`-byte tail rooted at `[payload+0x2c9]`. The `0x00620e94` store is therefore narrower now too: that same global is later reused by the early and late world-entry threshold gates `0x00437737` and `0x00444dc5`, but in this loader it is seeded only by the ordinary saved-profile lane rather than the tagged map-style setup block. Current grounded callers are `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`, the launch validator `0x004425d0`, and the selector-`0x59` helper `0x00472290`.","objdump + local disassembly + caller inspection + chunk-family correlation + version-gate correlation + preview-surface expansion correlation + stage-counter correlation + caller correlation" 0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation" 0x00442660,209,shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks,shell,cdecl,inferred,objdump + caller inspection + local disassembly + status-notice correlation,2,"Shared progress-sample notice helper in the surrounding save or load strip. The helper measures the current byte counter through `0x00530b70`, derives one rounded kilobyte delta against previous counter `0x0062c11c`, formats that delta through `%5d`, measures elapsed ticks against `0x0062bed0` through `0x0051d890`, formats the elapsed field through `% 4d`, and then packages both fields plus the caller-supplied status stem into the shared shell text builder `0x005193f0 -> 0x00518de0 -> 0x0051d680`. It finally updates `0x0062c11c` to the current byte counter. Current grounded callers include the bundle-service strip at `0x00413469/0x004134b4` and the save-side progress path inside `shell_map_file_world_bundle_coordinator` around `0x00445098`, so this is the safest current read for the shared byte-delta and elapsed-time progress notice helper rather than a one-off formatter.","objdump + caller inspection + local disassembly + status-notice correlation + save-load-progress correlation" 0x00442740,128,shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Short companion helper in the same save or export strip. The function allocates a temporary `0x40000`-byte RGBA copy of the embedded preview pixel block rooted at `[record+0x03c2]`, constructs one temporary `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, and then forwards the caller path seed plus fixed selector `0x46` into `0x00542f50`, storing the returned dword into payload field `[record+0x18]`. It finally releases the temporary owner through `0x00542c90 + 0x0053b080`. Current grounded caller is the save-side bundle branch at `0x00445925`, immediately after tagged setup-preview payload export and before the shared progress notice path, so this is the safest current read for the temporary-surface query helper rather than a generic image copier.","objdump + caller inspection + local disassembly + surface-family correlation + save-side bundle correlation" -0x004427c0,624,shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Broader companion-payload rewrite owner in the same save or export strip. The helper copies the caller path into a local buffer, strips its extension through `support_strip_extension_in_place` `0x0051df90`, appends the fixed `%1.tmp` suffix, opens the source file, allocates one full-size heap buffer, and reads the file body through `0x005a1b05`. It then installs `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` into global `0x00d93988`, forwards the source tail plus destination tail rooted at `+0x03ce` into `0x00553000`, and writes the rewritten output back through `0x005a276f`, preserving the leading `0x03ce` bytes and the trailing untouched source bands around the transformed middle region. On completion it updates payload dword `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x00443cd3`, which enters this helper only when payload byte `[record+0x66c9]` is set before deriving the external `_A.tga/_A.jpg` companion path. This is the safest current read for the temporary-path companion-payload rewrite owner rather than a generic file copy helper.","objdump + caller inspection + local disassembly + companion-image correlation + tmp-path correlation + progress-callback correlation" -0x00442900,304,shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Sibling companion-payload rewrite owner in the same save or export strip. The helper takes the live payload record in `EAX` plus one caller path on the stack, reads the whole source file into a temporary heap buffer, installs progress callback `0x00441e20` in `0x00d93988`, and then rewrites the middle payload band through `0x00553000` using the stored file offsets in `[record+0x18/+0x1c]`. It writes the rebuilt output in four spans through `0x005a276f`: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. On completion it stores the caller path back into `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x004459dd`, reached after companion-image import `0x00441f70` when payload byte `[record+0x66c9]` is set, so this is the safest current read for the offset-driven companion-payload rewrite sibling rather than another generic file copier.","objdump + caller inspection + local disassembly + companion-image correlation + progress-callback correlation + save-side bundle correlation" +0x004427c0,624,shell_map_bundle_rewrite_companion_payload_file_via_tmp_extension_path_and_progress_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Broader companion-payload rewrite owner in the same save or export strip. The helper copies the caller path into a local buffer, strips its extension through `support_strip_extension_in_place` `0x0051df90`, appends the fixed `.tmp` suffix, opens that temporary-path file, allocates one full-size heap buffer, and reads the whole file body through `0x005a1b05`. It then installs `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` into global `0x00d93988`, forwards the source tail plus destination tail rooted at `+0x03ce` into `0x00553000`, and writes the rewritten output back through `0x005a276f`, preserving the leading `0x03ce` bytes and the trailing untouched source bands around the transformed middle region. On completion it updates payload dword `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x00443cd3`, which enters this helper only when payload byte `[record+0x66c9]` is set before deriving the external companion sidecar path. This is the safest current read for the `.tmp`-extension companion-payload rewrite owner rather than a generic file copy helper.","objdump + caller inspection + local disassembly + companion-image correlation + tmp-path correlation + progress-callback correlation" +0x00442900,304,shell_map_bundle_rewrite_companion_payload_file_from_path_stored_byte_offsets_and_sync_tags,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Sibling companion-payload rewrite owner in the same save or export strip. The helper takes the live payload record in `EAX` plus one caller path on the stack, opens and reads the whole source file into a temporary heap buffer, installs progress callback `0x00441e20` in `0x00d93988`, and then rewrites the middle payload band through `0x00553000` using the stored byte offsets in `[record+0x18/+0x1c]`. It writes the rebuilt output in four spans through `0x005a276f`: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. On completion it stores the caller path back into `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x004459dd`, reached after companion-image import `0x00441f70` when payload byte `[record+0x66c9]` is set, so this is the safest current read for the path-plus-stored-offset companion-payload rewrite sibling rather than another generic file copier.","objdump + caller inspection + local disassembly + companion-image correlation + progress-callback correlation + save-side bundle correlation" 0x00442a40,31,locomotive_policy_issue_id_is_in_primary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Small range-membership predicate in the locomotive-policy strip. The helper returns true only for issue ids in the two disjoint bands `0x0f1..0x15f` and `0x1c9..0x1da`, and false everywhere else. Current grounded callers are the stream-load path `0x0042ddd0`, the stream-save inverse path `0x00430feb`, the scenario availability-owner path `0x0043160b`, the setup-side terrain or candidate branch `0x004d6125`, and the neighboring primary forward mapper `0x00442a85`, so this is the safest current read for the primary locomotive-engine-family issue-band membership test rather than a generic range helper.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation" 0x00442a5f,38,locomotive_policy_issue_id_is_in_secondary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Sibling range-membership predicate in the same locomotive-policy strip. The helper returns true only for issue ids in the disjoint bands `0x160..0x1c4` and `0x1db..0x1f6`, and false everywhere else. Current grounded callers are the same stream-load and stream-save pair `0x0042ddde` and `0x00431000`, plus the neighboring secondary forward mapper `0x00442aac`, so this is the safest current read for the secondary locomotive-engine-family issue-band membership test rather than another anonymous range check.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation" 0x00442a85,23,locomotive_policy_map_primary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + editor-policy correlation,3,"Primary forward mapper in the locomotive-policy strip. The helper treats the caller value as one compact engine-family or policy index, leaves `0` unchanged, maps `1..0x6f` into issue ids `0x0f1..0x15f`, maps `0x70..` into issue ids `0x1c9..0x1da` by inserting a fixed gap `0x69`, and then bounds the result against the upper limit `0x1db`. Current grounded callers are `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, the stream-load branch `0x0042de19`, and the neighboring primary row resolver `0x00442a9c`, so this is the safest current read for the forward map from the primary locomotive engine-family index space into raw issue ids rather than a plain arithmetic shim.","objdump + caller xrefs + local disassembly + editor-policy correlation + locomotive-policy correlation" @@ -738,8 +739,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00442ac3,16,locomotive_policy_resolve_secondary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Secondary row resolver over the same fixed issue table rooted at `0x00610398`. The helper maps the caller through `locomotive_policy_map_secondary_engine_family_index_to_issue_id` `0x00442aac`, multiplies the resulting issue id by stride `0x6e`, adds the base `0x00610398`, stores the row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the sibling shell-side formatter strip at `0x004624ae`, where it resolves the alternate localized issue-name row. This is the safest current read for the secondary issue-row resolver rather than a generic pointer arithmetic stub.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation" 0x00442ad3,14,locomotive_policy_map_primary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442a85` in the same locomotive-policy strip. The helper subtracts base issue id `0x0f0`, and when the resulting compact index rises above `0x6f` it removes the inserted gap `0x69` to recover the original primary engine-family or policy index. Current grounded caller is the stream-save path `0x00430ff2`, which uses this inverse map when serializing the primary issue band back into the compact save-side index space. This is the safest current read for the primary issue-id-to-index inverse rather than a free-standing subtractive helper.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation" 0x00442ae1,14,locomotive_policy_map_secondary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442aac` in the same locomotive-policy strip. The helper subtracts base issue id `0x15f`, and when the resulting compact index rises above `0x65` it removes the inserted gap `0x16` to recover the original secondary engine-family or policy index. Current grounded caller is the stream-save path `0x00431007`, which uses this inverse map when serializing the secondary issue band back into the compact save-side index space. This is the safest current read for the secondary issue-id-to-index inverse rather than another subtractive arithmetic stub.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation" -0x00442ba0,143,shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100,shell,thiscall,inferred,objdump + caller inspection + local disassembly + payload-export correlation,3,"Concrete live-payload export helper in the setup and map-bundle strip. The helper copies the full live payload record from `[this+0x66be]` into the caller buffer, forces the leading validity byte to `1`, patches the exported world dimensions from `[0x0062c120+0x2155/+0x2159]` into offsets `+0x01/+0x05`, mirrors three shell-side state bytes from `[0x006d4024+0x11471a]`, `[0x006d4024+0x11471e]`, and `0x0062bec4` into offsets `+0x09..+0x0b`, and then normalizes the embedded pixel block at `+0x03c2` through `0x0047a120` with fixed dimensions `0x100 x 0x100`. Current grounded callers are the save-side setup export path at `0x00444f42`, which immediately forwards the resulting record into the companion-image tag strip `0x00441ec0`, and the slot-table bundle serializer at `0x00446312`, which emits the same copied record under tags `0x2ee0/0x03c2/0x2ee1`. This is the safest current read for the live setup-preview payload exporter rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + payload-export correlation + companion-image correlation + bundle-tag correlation" -0x00442c30,3600,shell_apply_scenario_name_specific_post_load_world_and_object_fixups,shell,thiscall,inferred,objdump + caller inspection + local disassembly + scenario-string correlation,4,"Broad post-load fixup owner reached from `world_entry_transition_and_runtime_bringup` at `0x00444b50`. The helper compares the caller-supplied scenario title against many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload byte `[this+0x66de]`. Matching branches then perform targeted live-world and collection edits: they mutate object-state dwords and bytes inside collections rooted at `0x0062be18`, `0x0062bae0`, and `0x006ada80`; retune selected float and scalar fields; copy paired ten-dword record blocks when specific name or class pairs match; patch secondary-raster bits through the fixed table `0x005ee508..0x005ee5cc`; update one later collection at `0x0062b268`; and inject several scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated `0x0051e5d0`. This is the safest current read for the scenario-name-specific post-load fixup owner rather than a generic string-dispatch helper.","objdump + caller inspection + local disassembly + scenario-string correlation + live-world mutation correlation + post-load-fixup correlation" +0x00442ba0,143,shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100,shell,thiscall,inferred,objdump + caller inspection + local disassembly + payload-export correlation,3,"Concrete live-payload export helper in the setup and map-bundle strip. The helper copies one `0x403c2`-byte live payload record from `[this+0x66be]` into the caller buffer, forces the leading validity byte to `1`, patches the exported world dimensions from `[0x0062c120+0x2155/+0x2159]` into offsets `+0x01/+0x05`, mirrors two live shell-controlled sidecar dwords from `[0x006d4024+0x11471a]` and `[0x006d4024+0x11471e]` into offsets `+0x09/+0x0a`, mirrors the low byte of shared dword `0x0062bec4` into offset `+0x0b`, and then normalizes the embedded pixel block at `+0x03c2` through `0x0047a120` with fixed dimensions `0x100 x 0x100`. That sidecar-byte trio is tighter now too: the later package-save tail reads `[world+0x66c8]` and `[world+0x66c9]` as the companion-image and companion-payload sidecar gates, so the exported payload bytes `+0x0a` and `+0x0b` are the same two save-side gate lanes inside the copied `0x66be` block. Current local save-side evidence also shows `0x0062bec4` being reseeded by `shell_map_file_world_bundle_coordinator` `0x00445de0` from the shell-owned selector pair `[0x006d4024+0x11472a/+0x11472e]` before this exporter runs, while the broader settings owner `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family` `0x00464c80` toggles the same shell dwords `0x11471a/0x11471e/0x11472a/0x11472e` and enforces the grounded implication rules `!0x11471e -> clear 0x11472a` and `(0x11472a || 0x11472e) -> set 0x11471e`. The two current save-side callers now split cleanly: package-save branch `0x00444f42` calls `0x00442ba0` and then immediately re-enters `0x00441ec0`, while the `.smp` serializer branch at `0x00446312` calls `0x00442ba0` and then emits `0x2ee0`, writes the full `0x403c2` payload through `0x00531030`, and closes `0x2ee1` directly. This is the safest current read for the live setup-preview payload exporter rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + payload-export correlation + companion-image correlation + bundle-tag correlation + payload-size correlation + sidecar-gate correlation + save-coordinator correlation + shell-sidecar-selector correlation + save-branch-split correlation" +0x00442c30,3600,shell_apply_scenario_name_specific_post_load_world_and_object_fixups,shell,thiscall,inferred,objdump + caller inspection + local disassembly + scenario-string correlation,4,"Broad post-load fixup owner reached from `world_entry_transition_and_runtime_bringup` at `0x00444b50`. The helper compares the caller-supplied scenario title against many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, `Central Pacific`, and `Orient Express`, with several branches further gated by campaign-scenario byte `[this+0x66de]`. The matched bodies are no longer just generic title-side edits. Current local disassembly now grounds several concrete examples: the non-campaign `Go West!` branch retags linked world-object row `7` named `Open Aus` by promoting byte `[obj+0x7f9]` from `1` to `2` when its nested opcode-`0x1b` payload is still in the expected starter state; the campaign-gated `Go West!`/`Germany`/`Orient Express` side nudges selected city float pairs `[city+0x25a/+0x25e]` upward when they remain below fixed thresholds; the `Central Pacific` branch injects repeated localized `Company Track Miles`-style text lines into the shell band `[this+0x4f30]` through `0x0051e5d0`; later branches copy paired ten-dword record blocks when specific object-name/class pairs match; patch secondary-raster bits through the fixed table `0x005ee508..0x005ee5cc`; mutate opcode payload dwords and bytes inside collections rooted at `0x0062be18`, `0x0062bae0`, and `0x006ada80`; and update one later collection at `0x0062b268`. This is the safest current read for the scenario-name-specific post-load fixup owner rather than a generic string-dispatch helper.","objdump + caller inspection + local disassembly + scenario-string correlation + live-world mutation correlation + post-load-fixup correlation + campaign-flag correlation" 0x0044c450,96,world_rebuild_all_grid_cell_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop.","objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation" 0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation" 0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation" @@ -771,14 +772,14 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0044e940,1792,world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Broad rectangle-scoped rebuild owner over the live secondary-raster derived presentation family. The helper first clamps the caller rectangle through `0x00449df0` and reruns `world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component` `0x0044e500`. It then lazily ensures one presentation target through `0x0051f090` plus `0x00534910/0x00534920/0x00534930`, refreshes neighboring world-presentation state through `0x00449f20`, resolves scaled target dimensions through `0x00534c50`, and allocates a temporary `width*height` mask. The main scan then walks the live secondary raster `[this+0x165d]` and class predicates `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four sidecar byte planes `[this+0x1631..+0x163d]`, while the broader per-cell pass computes local windows, emits packed values into the ensured target through `0x00534730`, and also updates nibble lanes at byte offsets `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the temporary mask, expands the caller rectangle by dirty bounds `[this+0x21ad..+0x21b9]` through `0x00536710`, and finally seeds companion byte `[this+0x162d]` with `0xc4` on cells selected from mask plane `[this+0x1655]`. Current grounded callers include the post-load generation path at `0x00444a42`, the shell-mode toggle branch at `0x004480ec`, the sibling owner at `0x0044fac6`, and later world-side branches at `0x004fb1f9`, `0x004fc21e`, and `0x004ffee4`, so this is the safest current read for the broad secondary-raster derived-surface and companion-plane rebuild owner rather than a one-off shell preview draw.","objdump + caller xrefs + local disassembly + secondary-raster correlation + derived-surface publish correlation" 0x00414bd0,112,world_query_float_coords_within_live_grid_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-coordinate bounds predicate over the live world grid. The helper returns true only when both caller-supplied float coordinates are `>= 0` and `<= [world+0x15d9]-1` / `<= [world+0x15d5]-1` respectively; otherwise it returns false. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the radial secondary-raster stamp helper `0x0044e7d0`, several later world-side branches around `0x00480af8`, `0x00498278`, and `0x004982cb`, and the StationPlace world-surface branch at `0x005085a4`, so this is the safest current read for the shared float grid-bounds gate rather than a tool-specific placement check.","objdump + caller xrefs + local disassembly + grid-bounds correlation" 0x00449df0,144,world_clamp_rect_coords_to_live_grid_and_validate_nonempty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small rectangle clamp-and-validate helper over integer world-grid coordinates. The function takes four caller-owned coordinate pointers, clamps the two lower bounds to zero, clamps the two upper bounds to `[world+0x2155]-1` and `[world+0x2159]-1`, and then returns true only when the resulting rectangle is still nonempty and fully within those live dimensions. Current grounded callers include the local marked-bit refresh helper `0x0044dcf0`, the rect-wide secondary-raster edge refresh owner `0x0044e500`, the broader owner `0x0044e982`, later secondary-raster siblings around `0x0044ec93` and `0x0044eee9`, the route-entry window gate `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, and one later world-side caller at `0x00494261`, so this is the safest current read for the shared rect clamp-and-validity predicate rather than a serializer-only rectangle helper.","objdump + caller xrefs + local disassembly + rect-clamp correlation" -0x00444dd0,3301,map_bundle_open_reference_package_and_serialize_early_world_datasets,map,cdecl,inferred,objdump + caller xrefs + local disassembly + chunk-family correlation,4,"Broader package-save prelude beneath the non-`.smp` branch of `shell_map_file_world_bundle_coordinator` `0x00445de0` and the neighboring multiplayer-side fallback path at `0x0046cfcb`. The helper seeds the shared stage/progress globals `0x00620e94 = 0x26ad`, `0x0062bec8 = 0x15`, `0x0062becc = 0`, and `0x0062bed0 = ticks`, optionally runs the editor-map side prepass `0x00436a70` when `[0x006cec74+0x68]` is live, opens one bundle through `0x00530c80(4, 0x30d40, 1)`, and on failure raises the localized modal rooted at `0x0fda` before unwinding the surrounding shell notices. On success it serializes the first broad save/package band in a fixed order with interleaved progress updates through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`: chunk `0x32c8` with the fixed `0x4f2c` world block `[world+0x04]`, chunk `0x32c9` with the fixed `0x0bb9` block `[world+0x4f30]`, chunk family `0x332d/0x332e` with the late world-status band `[world+0x66be]`, the shared indexed-collection serializer `0x00517d90` over candidate named-availability collection `[world+0x66b2]`, chunk `0x32dc`, chunks `0x3714/0x3715` with the `0x108` staged profile block `0x006cec7c`, then that same shared serializer `0x00517d90` over locomotive named-availability collection `[world+0x66b6]` under `0x32dd`, then the early reference and manager families through `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`, the shell notifier vtable `+0x08` on `0x0062be68`, `structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks` `0x0041e930`, `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`, `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, direct indexed-collection header serialization on the route-link family `0x006ada90` through `0x00517d90`, `placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle` `0x00481310`, `linked_route_object_collection_serialize_records_into_tagged_bundle` `0x0041d4c0`, `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, `route_entry_collection_serialize_records_into_tagged_bundle` `0x00491c60`, `aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle` `0x004a4240`, `profile_collection_serialize_records_into_tagged_bundle` `0x004777e0`, `geographic_label_database_serialize_records_into_tagged_bundle` `0x00461650`, `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610`, `world_region_collection_serialize_records_into_tagged_bundle` `0x004215e0`, `territory_collection_serialize_records_into_tagged_bundle` `0x00487cc0`, `support_collection_serialize_tagged_records_into_bundle` `0x0040b6a0`, and `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`. Its fixed tail is tighter now too: after the tagged collections it writes one direct dword from `[world+0x19]`, one zeroed `0x1f4`-byte slab under chunk `0x32cf`, closes the bundle through `0x00530a00`, derives the output path through `0x00442740`, conditionally emits the companion image file branch `0x00441f70` when `[world+0x66c8]` is set, conditionally emits the companion-payload rewrite branch `0x00442900` when `[world+0x66c9]` is set, and otherwise falls back to the localized no-preview notice path through `0x00441ec0`; those same preview/payload flags also add `+1` and `+0x15` respectively into the shared progress bound `0x0062bec8` before the save steps begin. This is therefore the real early reference-package open-and-save owner rather than a generic database opener.","objdump + caller xrefs + local disassembly + chunk-family correlation + save-order correlation + package-tail correlation + progress-bound correlation + named-availability serializer correction" +0x00444dd0,3301,map_bundle_open_reference_package_and_serialize_early_world_datasets,map,cdecl,inferred,objdump + caller xrefs + local disassembly + chunk-family correlation,4,"Broader package-save prelude beneath the non-`.smp` branch of `shell_map_file_world_bundle_coordinator` `0x00445de0` and the neighboring multiplayer-side fallback path at `0x0046cfcb`. The helper seeds the shared stage/progress globals `0x00620e94 = 0x26ad`, `0x0062bec8 = 0x15`, `0x0062becc = 0`, and `0x0062bed0 = ticks`, optionally runs the editor-map side prepass `0x00436a70` when `[0x006cec74+0x68]` is live, opens one bundle through `0x00530c80(4, 0x30d40, 1)`, and on failure raises the localized modal rooted at `0x0fda` before unwinding the surrounding shell notices. On success it serializes the first broad save/package band in a fixed order with interleaved progress updates through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`: chunk `0x32c8` with the fixed `0x4f2c` world block `[world+0x04]`, chunk `0x32c9` with the fixed `0x0bb9` block `[world+0x4f30]`, chunk family `0x332d/0x332e` with the late setup-preview payload band `[world+0x66be]`, the shared indexed-collection serializer `0x00517d90` over candidate named-availability collection `[world+0x66b2]`, chunk `0x32dc`, chunks `0x3714/0x3715` with the `0x108` staged profile block `0x006cec7c`, then that same shared serializer `0x00517d90` over locomotive named-availability collection `[world+0x66b6]` under `0x32dd`, then the early reference and manager families through `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`, the shell notifier vtable `+0x08` on `0x0062be68`, `structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks` `0x0041e930`, `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`, `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, direct indexed-collection header serialization on the route-link family `0x006ada90` through `0x00517d90`, `placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle` `0x00481310`, `linked_route_object_collection_serialize_records_into_tagged_bundle` `0x0041d4c0`, `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, `route_entry_collection_serialize_records_into_tagged_bundle` `0x00491c60`, `aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle` `0x004a4240`, `profile_collection_serialize_records_into_tagged_bundle` `0x004777e0`, `geographic_label_database_serialize_records_into_tagged_bundle` `0x00461650`, `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610`, `world_region_collection_serialize_records_into_tagged_bundle` `0x004215e0`, `territory_collection_serialize_records_into_tagged_bundle` `0x00487cc0`, `support_collection_serialize_tagged_records_into_bundle` `0x0040b6a0`, and `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`. Its fixed tail is tighter now too: after the tagged collections it writes one direct dword from `[world+0x19]`, one zeroed `0x1f4`-byte slab under chunk `0x32cf`, closes the bundle through `0x00530a00`, derives the output path through `0x00442740`, conditionally emits the companion-image sidecar file branch `0x00441f70` when companion-image byte `[world+0x66c8]` is set, conditionally emits the companion-payload rewrite branch `0x00442900` when companion-payload byte `[world+0x66c9]` is set, and otherwise falls back to the localized no-preview notice path through `0x00441ec0`; those same preview/payload flags also add `+1` and `+0x15` respectively into the shared progress bound `0x0062bec8` before the save steps begin. This is therefore the real early reference-package open-and-save owner rather than a generic database opener.","objdump + caller xrefs + local disassembly + chunk-family correlation + save-order correlation + package-tail correlation + progress-bound correlation + named-availability serializer correction + setup-preview-payload correlation" 0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. At entry it clears the optional success dword, and every successful path later decrements nested open counter `0x0062be6c`, notifies the shared shell owner at `0x0062be68`, sets shell latch `[0x006cec74+0x501] = 1`, and clears live input word `[0x006d4018+0xa8c]`. The direct-seed side is tighter now too: when the caller supplies a path seed the helper increments `0x0062be6c`, and if a live runtime world is already active or flag bit `0x8` is set it copies that stem, appends the fixed `.smp` token from `0x005ca9a4`, and re-enters `world_load_saved_runtime_state_bundle` `0x00446d40`; otherwise it routes straight into the heavier world-entry branch `0x00443a50` with the flag-derived trailing boolean from `(flags>>2)^1`. The quickload side is explicit too: flag bit `0x1` seeds the shared quicksave base stem from `0x005ca9cc`, appends `.gmp` when editor-map flag `[0x006cec74+0x68]` is live and otherwise appends `.gms/.gmc/.gmx` through the same sandbox/campaign/default split used by the interactive chooser, resolves the final path through `0x004839e0`, validates it through `0x00530c20`, and uses the two localized validation branches rooted at ids `0x181/0x182` plus `0x004c98a0` before continuing. The non-Quicksave interactive path is tighter now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using load mode `4=.gmp` when `EditorPanel.win` is live and paired non-editor open modes `8=.gms`, `9=.gmc`, and `10=.gmx`. The shell-state master flag `[0x006cec74+0x68]` reinforces that same mapping on the direct quickload branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence still keeps the non-editor trio concrete: `.gmx` aligns with sandbox mode because the sibling shell branch at `0x004dc923` gates on `0x006cec7c+0x82` and surfaces string `3898` `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because `0x004dc9cd` gates on `0x006cec7c+0xc5` and surfaces string `3018` about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection + restore-vs-world-entry split" -0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. At entry it clears the optional success dword and seeds shared save-progress selector `0x0062bec4` from one of the two shell-controller dwords `[0x006d4024+0x11472a]` or `[+0x11472e]` depending on the side-owner gate `0x004839b0`. Its filename-selection side is tighter now too: an explicit caller-supplied stem bypasses the chooser, flag bit `0x1` seeds the Quicksave base stem from `0x005ca9cc`, and flag bit `0x2` seeds the localized `Autosave` stem through string id `387` while also clearing `0x0062bec4`. The non-Quicksave interactive path is explicit now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using save mode `3=.gmp` for the editor-map package path, `0=.gms` for standalone scenarios, `1=.gmc` for campaign-scenario saves, and `2=.gmx` for sandbox saves, plus the auxiliary `11=.gmt` branch reached only when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner at `0x006cd8d8`. The shell-state master flag `[0x006cec74+0x68]` reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. The active-world split is tighter in the same way: when a live runtime world is present the helper copies the chosen stem, appends the fixed `.smp` token from `0x005ca9a4`, re-enters `world_runtime_serialize_smp_bundle` `0x00446240`, and marks success immediately. Only when no active runtime world is present does it continue into the package side: when the auxiliary preview owner is live it packages the chosen stem into the owner-local request block near `0x006cd8d8+0x8f48` and submits it through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7d` and payload size `0x48`; otherwise it falls back to `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The campaign mapping is still backed by the numbered `%s%02d.gmc` helper at `0x00517c70`, which formats one campaign-progress slot from `0x006cec7c+0xc4` before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string `3898` on `0x006cec7c+0x82`. Its package-side order is now explicit too: the non-`.smp` branch delegates the early direct-save band to `0x00444dd0`, which itself serializes the route-entry family, auxiliary tracker family, profile, region, territory, support, and event managers with shared progress/sample notices interleaved through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`. One editor-only trailing validation branch is tighter now too: after a successful non-runtime package save, when `[0x006cec74+0x68]` and `[world+0x66de]` are both live, the helper scans the fixed 16-entry stem table `0x00621cf0..0x00621d2c` against format stem `0x005ca9d8` and only opens the localized warning rooted at `0x0fd9` through `0x004c98a0` when no match survives. This makes the helper the save-side sibling of `shell_map_file_entry_coordinator` rather than another restore dispatcher, with `.gmt` bounded as an auxiliary preview-side export path instead of a fourth gameplay save family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct-save branch inspection + active-world split + editor-only validation sweep" +0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. At entry it clears the optional success dword and seeds shared save-progress selector `0x0062bec4` from one of the two shell-controller dwords `[0x006d4024+0x11472a]` or `[+0x11472e]` depending on the side-owner gate `0x004839b0`. The selector provenance is tighter now too: those two source dwords sit in the same shell-controlled sidecar family as `[0x006d4024+0x11471a/+0x11471e]`, are initialized by the display-runtime defaults path around `0x0051ee48..0x0051ee85`, and are toggled by the broader settings owner `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family` `0x00464c80`, which enforces the grounded implication rules `!0x11471e -> clear 0x11472a` and `(0x11472a || 0x11472e) -> set 0x11471e`. Its filename-selection side is tighter now too: an explicit caller-supplied stem bypasses the chooser, flag bit `0x1` seeds the Quicksave base stem from `0x005ca9cc`, and flag bit `0x2` seeds the localized `Autosave` stem through string id `387` while also clearing `0x0062bec4`. The non-Quicksave interactive path is explicit now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using save mode `3=.gmp` for the editor-map package path, `0=.gms` for standalone scenarios, `1=.gmc` for campaign-scenario saves, and `2=.gmx` for sandbox saves, plus the auxiliary `11=.gmt` branch reached only when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner at `0x006cd8d8`. The shell-state master flag `[0x006cec74+0x68]` reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. The active-world split is tighter in the same way: when a live runtime world is present the helper copies the chosen stem, appends the fixed `.smp` token from `0x005ca9a4`, re-enters `world_runtime_serialize_smp_bundle` `0x00446240`, and marks success immediately. Only when no active runtime world is present does it continue into the package side: when the auxiliary preview owner is live it packages the chosen stem into the owner-local request block near `0x006cd8d8+0x8f48` and submits it through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7d` and payload size `0x48`; otherwise it falls back to `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The campaign mapping is still backed by the numbered `%s%02d.gmc` helper at `0x00517c70`, which formats one campaign-progress slot from `0x006cec7c+0xc4` before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string `3898` on `0x006cec7c+0x82`. Its package-side order is now explicit too: the non-`.smp` branch delegates the early direct-save band to `0x00444dd0`, which itself serializes the route-entry family, auxiliary tracker family, profile, region, territory, support, and event managers with shared progress/sample notices interleaved through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`. The package tail is tighter now too: after the companion sidecar branches it restores the raw shell-status byte band directly through `0x00442330` at `0x00445a55`, then services StationPlace.win and TrackLay.win through `0x00445a64/0x00445a73` without re-entering wrapper `0x004423d0`, before releasing the remaining save-side presentation stack. One editor-only trailing validation branch is tighter now too: after a successful non-runtime package save, when `[0x006cec74+0x68]` and `[world+0x66de]` are both live, the helper scans the fixed 16-entry stem table `0x00621cf0..0x00621d2c` against format stem `0x005ca9d8` and only opens the localized warning rooted at `0x0fd9` through `0x004c98a0` when no match survives. This makes the helper the save-side sibling of `shell_map_file_entry_coordinator` rather than another restore dispatcher, with `.gmt` bounded as an auxiliary preview-side export path instead of a fourth gameplay save family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct-save branch inspection + active-world split + editor-only validation sweep + shell-sidecar-selector correlation + package-tail correlation" 0x00455320,42,runtime_object_collection_construct_vtable_5cae10,map,thiscall,inferred,objdump + world-load correlation + local disassembly,2,"World-load constructor for the `0x005cae10` indexed collection later rooted at `0x006acd34`. The helper enters the common collection base `0x00517ce0`, installs vtable `0x005cae10`, seeds the indexed collection through `0x00518570` with grounded parameters `(record_size=0x21a, initial_slots=0x0a, growth=5, id_base=1)`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting object is stored into global `0x006acd34`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" 0x00455350,22,runtime_object_collection_release_entries_and_collection_storage_vtable_5cae10,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `runtime_object_collection_construct_vtable_5cae10` `0x00455320`. The helper reinstalls vtable `0x005cae10`, re-enters `0x00518600` to release live entries, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation" 0x00455f60,96,world_region_resolve_center_world_grid_cell,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small region-to-grid resolver that converts one region's cached center coordinate pair into a pointer into the live world-grid cell table rooted at `[0x0062c120+0x2129]`. It reads the cached floats at `[this+0x1ea]` and `[this+0x1e2]`, scales and rounds them through `0x005a10d0`, multiplies the Y-like term by world width `[0x0062c120+0x2145]`, adds the X-like term, and returns the corresponding grid-cell pointer. Current grounded callers include the world-entry region-center flag reseed pass `0x0044c4b0` and several older site- or route-style world-grid query helpers, so this is now the safest current read for the shared region-center world-grid-cell resolver.","objdump + local disassembly + caller inspection + world-grid correlation" 0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it first pushes the nested mouse-cursor selection hold through `0x0053f2f0`, snapshots one startup-side status band through `0x004423a0`, allocates a bundle through `0x00530c80`, seeds many typed records through repeated `0x00531030` and `0x00531340` calls, walks world collections under `0x0062c120` and `0x006ada80`, and emits runtime-state payloads through helpers such as `0x00534e50`, `0x00534ec0`, `0x00534f00`, and `0x00534f40`; at the tail it mirrors the paired status follow-on through `0x004423d0`, pops the same mouse-cursor hold through `0x0053f310`, posts the fixed shell status line through `0x00538c70`, and only then closes the bundle through `0x00530a00`. The status-band choreography is tighter now too: `0x004423a0/0x004423d0` bracket the same four shell byte lanes `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` through the `0x0062be90` stack while also servicing active TrackLay.win and StationPlace.win tool windows. The serializer-side fixed header is explicit now too: it writes bundle version `0x400` first, then, for version `>= 0x3f1`, the late world-status block `[world+0x66be]` under chunk ids `0x2ee0/0x2ee1`, followed by the main world-grid dimensions and stride scalars from `[world+0x2155/+0x2159]`. The raster side is tighter in the same way, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before the later fixed-band tail continues. One save-side bridge into the editor economic-tuning band is explicit now too: before the region and named-availability runs, the serializer writes the same six-dword block the map-editor economic cost panel exposes at `[world+0x0be2..+0x0bf6]` as one direct dword from `[world+0x0be2]` plus five successive dwords from `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`. The mid-save state bands are tighter now too: after the core raster tables it serializes the twelve `0x4e1`-byte recipe books from `[world+0x0fe7]` book-by-book as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure. Each repeated `0x30`-byte line is emitted field-by-field as mode dword at `+0x00`, annual amount float at `+0x04`, supplied-token window at `+0x08`, and demanded-token window at `+0x1c`, with no intervening serializer-owned reinterpretation. The named-availability, event, and trailing fixed bands are tighter in the same way: the serializer writes a counted run of fixed `0x22`-byte candidate-name-plus-dword records from `[world+0x66b2]`, then a counted run of fixed `0x41`-byte locomotive-name-plus-dword records from `[world+0x66b6]`, writes a counted region row run from `[0x0062bae0]` as `0x29`-byte headers plus companion profile-subcollection counts and `0x22`-byte rows, brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` before delegating the per-event packed-state save to `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, writes the two direct dwords at `[world+0x4c78/+0x4c7c]`, and at version `>= 0x400` writes `49` dwords from `[world+0x4a7f..+0x4b3f]` plus one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is `0x00445de0` on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + local disassembly + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation + cursor-hold choreography correlation + status-stack correlation + mid-save-band correlation + pre-recipe-scalar-band correlation + named-availability-save correlation + region-row-save correlation + event-collection-save correlation + trailing-fixed-band correlation + economic-tuning-band correlation + byte-lane-correction" -0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by `shell_map_file_entry_coordinator` `0x00445ac0`. The helper dismisses the current shell detail controller, optionally tears down the active tool owner through `0x004ddbd0(-1, 0)`, releases the prior world runtime through `world_runtime_release_global_services` `0x00434300`, drives shell mode and status transitions, rebuilds the startup-side runtime roots through `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, allocates a new bundle through `0x00530c80`, and constructs a fresh world root at `0x0062c120` through `0x0044cf70` using `(width+1, height+1)` from the serialized grid scalars. The first restore bands are tighter now too: after bundle version `0x400` it restores the late world-status block `[world+0x66be]` from chunk ids `0x2ee0/0x2ee1` for versions `>= 0x3f1`, immediately re-normalizes that block through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and otherwise explicitly clears the older compatibility tail at `[world+0x6987]`; then it reads one dword per world-grid cell and forwards those values into `world_write_companion_float_grid_cell_and_optionally_refresh_rect` `0x0044dca0` across the full `(width+1)*(height+1)` raster. The raster and overlay side is explicit in the same way: the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, then, for versioned bundles at `>= 0x3ec`, re-enters `world_load_four_sidecar_byte_planes_from_runtime_bundle` `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into `[world+0x1631 + index*4]`. It also restores the per-cell secondary-raster sideband through the byte-level helpers `0x00448c20`, `0x00448cb0`, `0x00448d90`, `0x00448e60`, `0x00448e90`, and `0x0044de30`, with the later version split now explicit: at `>= 0x400` it restores five separate per-cell compatibility bits into the live secondary-raster word and byte lanes, while older bundles clear those same bits back to the older fixed fallback pattern. One mid-restore preview branch is tighter now too: for versions `>= 0x3ee` it restores one width/height-tagged dword surface, optionally resamples it through `shell_world_presentation_stage_overlay_rect_from_normalized_bounds` `0x00534930`, republishes it through `0x00534730/0x00534af0`, frees the temporary buffer, and then re-enters `0x004882e0` on the neighboring manager family. The recipe and manager bands are tighter in the same way: at version `>= 0x3f5` it restores the same twelve `0x4e1` recipe books back into `[world+0x0fe7]` book-by-book as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure, with each repeated `0x30`-byte line read field-by-field back into mode dword `+0x00`, annual amount float `+0x04`, supplied-token window `+0x08`, and demanded-token window `+0x1c`. At version `>= 0x3f2` it then restores the same six-dword editor economic-tuning band by reading the first dword into `[world+0x0be2]`, mirroring that value immediately into `[world+0x0bde]`, and reading the five successive dwords into `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, before the later manager bands at `[world+0x4f30]`, the tagged geographic-label collection `0x006ada80`, the trailing scenario-rule band `[world+0x4a7f..+0x4b43]`, and the packed sidecar bitfield at `[world+0x2141]` run under the later version gates `0x3f4/0x3fa/0x3fc`. The region side is explicit now too: after seeding default regions through `world_region_collection_seed_default_regions` `0x00421b60`, the loader reads one counted run of fixed `0x29`-byte region rows, resolves or allocates each target through `0x00421660/0x00518140`, republishes pending amount `[region+0x272]`, paired pointers `[region+0x25a/+0x25e]`, reruns `0x004204c0`, reloads the per-region profile subcollection at `[region+0x37f]`, and then restores one second counted run of fixed `0x1e+4` rows whose names must survive the fixed reject stems and resolve back into the live candidate pool before the row is accepted into that region-owned subcollection. The named-availability and event-side collection bands are tight on the restore path too: the loader first clears `[world+0x66b2]`, reads one counted run of fixed `0x22`-byte candidate-name-plus-dword records, rejects the built-in alias stems at `0x005c8f94/0x005c8e4c`, resolves every surviving name back into the live candidate pool through `indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04` `0x00412b70`, and only then inserts the accepted record through collection vtable slot `+0x04`, with no later fallback preseed if that validated pass stays empty. It then clears `[world+0x66b6]`, restores one counted run of fixed `0x41`-byte locomotive-name-plus-dword records by raw direct insertion through collection vtable slot `+0x04` without the candidate-side reject-or-resolve filter, and only after that checks whether the restored locomotive collection stayed empty so the older live-pool fallback `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` can repopulate it. It then brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` and delegates the per-event packed-state restore to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The post-close reactivation tail is explicit now too: after `0x00530a00` closes the bundle, the helper re-enters `0x00538e00`, refreshes candidate and locomotive availability through `0x00412c10/0x00461e00`, rebuilds the full secondary-raster derived surface through `0x0044e940`, then reruns `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`, the scenario-side recipe bridge `0x00435630`, shell tool refresh `0x0040b830`, `world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions` `0x00421ce0`, `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, and a final `4x4` local bitplane mark loop through `0x004497a0` over the grounded quarter-resolution bitmap planes at `[world+0x2139/+0x213d/+0x2141]`. This is therefore the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + local disassembly + caller xrefs + strings + world-root-allocation correlation + companion-float-grid restore correlation + sidecar-plane correlation + secondary-raster compatibility-bit restore correlation + region-row restore correlation + geographic-label restore correlation + named-availability-restore correlation + restore-side-name-validation correlation + event-collection-restore correlation + post-close-reactivation-tail correlation + trailing-fixed-band correlation + economic-tuning-band correlation + setup-payload-normalization correlation" +0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by `shell_map_file_entry_coordinator` `0x00445ac0`. The helper dismisses the current shell detail controller, optionally tears down the active tool owner through `0x004ddbd0(-1, 0)`, releases the prior world runtime through `world_runtime_release_global_services` `0x00434300`, drives shell mode and status transitions, rebuilds the startup-side runtime roots through `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, allocates a new bundle through `0x00530c80`, and constructs a fresh world root at `0x0062c120` through `0x0044cf70` using `(width+1, height+1)` from the serialized grid scalars. The first restore bands are tighter now too: after bundle version `0x400` it restores the late setup-preview payload block `[world+0x66be]` from chunk ids `0x2ee0/0x2ee1` for versions `>= 0x3f1`, immediately re-normalizes that payload through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and otherwise explicitly clears the older compatibility tail at `[world+0x6987]`; then it reads one dword per world-grid cell and forwards those values into `world_write_companion_float_grid_cell_and_optionally_refresh_rect` `0x0044dca0` across the full `(width+1)*(height+1)` raster. The restore-side negative boundary is tighter too: current local disassembly still does not show this path republishing shell dword `[0x006cec74+0x178]`; the grounded interactive writer for that policy remains the UI-command dispatcher `0x00464410` through command ids `0x9d26..0x9d28`. The raster and overlay side is explicit in the same way: the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, then, for versioned bundles at `>= 0x3ec`, re-enters `world_load_four_sidecar_byte_planes_from_runtime_bundle` `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into `[world+0x1631 + index*4]`. It also restores the per-cell secondary-raster sideband through the byte-level helpers `0x00448c20`, `0x00448cb0`, `0x00448d90`, `0x00448e60`, `0x00448e90`, and `0x0044de30`, with the later version split now explicit: at `>= 0x400` it restores five separate per-cell compatibility bits into the live secondary-raster word and byte lanes, while older bundles clear those same bits back to the older fixed fallback pattern. One mid-restore preview branch is tighter now too: for versions `>= 0x3ee` it restores one width/height-tagged dword surface, optionally resamples it through `shell_world_presentation_stage_overlay_rect_from_normalized_bounds` `0x00534930`, republishes it through `0x00534730/0x00534af0`, frees the temporary buffer, and then re-enters `0x004882e0` on the neighboring manager family. The recipe and manager bands are tighter in the same way: at version `>= 0x3f5` it restores the same twelve `0x4e1` recipe books back into `[world+0x0fe7]` book-by-book as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure, with each repeated `0x30`-byte line read field-by-field back into mode dword `+0x00`, annual amount float `+0x04`, supplied-token window `+0x08`, and demanded-token window `+0x1c`. At version `>= 0x3f2` it then restores the same six-dword editor economic-tuning band by reading the first dword into `[world+0x0be2]`, mirroring that value immediately into `[world+0x0bde]`, and reading the five successive dwords into `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, before the later manager bands at `[world+0x4f30]`, the tagged geographic-label collection `0x006ada80`, the trailing scenario-rule band `[world+0x4a7f..+0x4b43]`, and the packed sidecar bitfield at `[world+0x2141]` run under the later version gates `0x3f4/0x3fa/0x3fc`. The region side is explicit now too: after seeding default regions through `world_region_collection_seed_default_regions` `0x00421b60`, the loader reads one counted run of fixed `0x29`-byte region rows, resolves or allocates each target through `0x00421660/0x00518140`, writes one direct saved dword into `[region+0x272]`, writes one shared density dword into both `[region+0x25a]` and `[region+0x25e]`, and on pre-`0x3f3` bundles synthesizes that shared density dword from the legacy lookup table at `0x005f3a28` keyed by the serialized bucket field instead of reading it directly. It then reruns `0x004204c0`, reloads the per-region profile subcollection at `[region+0x37f]`, and restores one second counted run of fixed `0x1e+4` rows whose names must survive the fixed reject stems and resolve back into the live candidate pool before the row is accepted into that region-owned subcollection. The named-availability and event-side collection bands are tight on the restore path too: the loader first clears `[world+0x66b2]`, reads one counted run of fixed `0x22`-byte candidate-name-plus-dword records, rejects the built-in alias stems at `0x005c8f94/0x005c8e4c`, resolves every surviving name back into the live candidate pool through `indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04` `0x00412b70`, and only then inserts the accepted record through collection vtable slot `+0x04`, with no later fallback preseed if that validated pass stays empty. It then clears `[world+0x66b6]`, restores one counted run of fixed `0x41`-byte locomotive-name-plus-dword records by raw direct insertion through collection vtable slot `+0x04` without the candidate-side reject-or-resolve filter, and only after that checks whether the restored locomotive collection stayed empty so the older live-pool fallback `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` can repopulate it. It then brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` and delegates the per-event packed-state restore to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The post-close reactivation tail is explicit now too: after `0x00530a00` closes the bundle, the helper re-enters `0x00538e00`, refreshes candidate and locomotive availability through `0x00412c10/0x00461e00`, rebuilds the full secondary-raster derived surface through `0x0044e940`, then reruns `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`, the scenario-side recipe bridge `0x00435630`, shell tool refresh `0x0040b830`, `world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions` `0x00421ce0`, `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, and a final `4x4` local bitplane mark loop through `0x004497a0` over the grounded quarter-resolution bitmap planes at `[world+0x2139/+0x213d/+0x2141]`. This is therefore the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + local disassembly + caller xrefs + strings + world-root-allocation correlation + companion-float-grid restore correlation + sidecar-plane correlation + secondary-raster compatibility-bit restore correlation + region-row restore correlation + geographic-label restore correlation + named-availability-restore correlation + restore-side-name-validation correlation + event-collection-restore correlation + post-close-reactivation-tail correlation + trailing-fixed-band correlation + economic-tuning-band correlation + setup-payload-normalization correlation + setup-preview-payload correlation + shell-policy-negative-boundary correlation" 0x0044f840,176,world_build_transport_pricing_preview_surface_from_secondary_raster,map,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,3,"Small transport/pricing-side preview builder beneath `world_compute_transport_and_pricing_grid` `0x0044fb70`. The helper allocates one default presentation target through `0x00534930`, queries its dimensions through `0x00534c50`, seeds five fallback palette entries through repeated `0x0051de10` calls, and then walks the target pixels. Each pixel is mapped back into the live secondary raster `[this+0x165d]` through `0x00533970/0x00533980`; low-3-bit classes other than `1/4` get one fixed fallback color, while class-`1/4` pixels scan a local `+/-4` neighborhood for zero-tag cells, score those through the radial falloff helper `0x0051db80`, and then choose either one of the seeded palette entries or the alternate fallback color `0x5f040566`. After filling the whole surface it re-enters `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` on the full `0..0x270f` rectangle rooted at that target. Current grounded caller is the null-build path at `0x0044fb31` inside `world_compute_transport_and_pricing_grid`, so this is the safest current read for the transport/pricing preview-surface builder rather than another generic overlay helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + preview-surface correlation" 0x0044faf0,128,world_ensure_transport_pricing_preview_surface_and_publish_if_missing,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Thin world-side ensure/publish wrapper above `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`. The helper first forwards the caller rectangle and output pointer into `0x00538060`, then samples shell state through `0x0040b830` and the paired shell notifier `0x004834e0`. When the returned preview handle is null it rebuilds the preview surface by re-entering `0x0044f840`; in either case it then refreshes neighboring world presentation through `0x00449f80`, re-enters the region-border overlay refresh `0x004881b0`, posts the same shell notifier again, and finally issues one mode pulse through `0x00484d70` before returning the ensured handle. Current grounded caller is the world-side path at `0x0043901a`, so this is the safest current read for the transport/pricing preview ensure-and-publish wrapper rather than another generic surface allocator.","objdump + caller inspection + local disassembly + world-presentation correlation" 0x0044fb70,1117,world_compute_transport_and_pricing_grid,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop.",objdump + caller context + RT3.lng strings @@ -920,28 +921,30 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004cb1a0,22,map_editor_scenario_special_conditions_panel_clear_visible_row_band,map,thiscall,inferred,objdump + constructor correlation + local disassembly,3,"Tiny list-range clear helper beneath the map-editor special-conditions page. The helper resolves the page-owned list host at `[this+0x86]` and clears the visible row band `0xabe0..0xafc7` through `0x0053fe00`. Current grounded caller is the constructor `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0`, which binds this as the range callback on list control `0xa7fa`, so this is the visible-row reset sibling of the later per-row formatter rather than a generic list helper.","objdump + constructor correlation + local disassembly + control-range correlation" 0x004cb1c0,236,map_editor_scenario_special_conditions_panel_format_row_by_index,map,cdecl,inferred,objdump + constructor correlation + static-table inspection + local disassembly,4,"Per-row formatter callback for the map-editor special-conditions list control `0xa7fa`. The helper accepts one rule ordinal, builds one transient row payload through the shared shell dynamic-list path, reads the corresponding live rule dword from `[0x006cec78+0x4a7f + index*4]`, and republishes that value into the per-row toggle control band rooted at `0xabe0 + index`. The localized label/help side is explicit too: the helper walks the same nine-byte static rule table at `0x005f3ab0` used by `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0`, resolves each paired label/help id through `0x005193f0`, and emits the row text through the generic shell control path before the live enabled state is published. This makes it the actual row-format owner over the persisted 49-dword scenario-rule band rather than leaving that list on constructor-only evidence.","objdump + constructor correlation + static-table inspection + local disassembly + rule-band correlation" 0x004cb2b0,485,map_editor_scenario_special_conditions_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 49-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. The same constructor also reads one trailing dword at `[0x006cec78+0x4b43]`, so the live editor-owned scenario-rule band is now best bounded as `49` dwords plus one scalar rather than the smaller fixed matrix inferred in the checked `gmp/gms/gmx` files. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`.","objdump + RT3.lng strings + static-table inspection + UI callback inspection + fixed-runtime-band correlation" -0x004cb4a0,468,map_editor_scenario_metadata_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2`, writing the scenario description from the edit-control payload into `[0x006cec78+0x672e]`, the single-player and multiplayer briefing texts into `[+0x4f30]` and `[+0x5ae9]`, flipping the briefing selector at `0x621f50` between the single-player and multiplayer views, toggling the direct campaign-scenario byte `[+0x66de]` plus the paired metadata byte `[+0x66f3]`, and committing the three start-year fields `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]` after clamping each incoming value to `1829..2100`. The resource correlation is now explicit too: `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.`, so the direct toggle path at `0x4cb519` is now grounded as the editor-side campaign-designation bit rather than a generic metadata checkbox. Before returning it also normalizes the year trio so `minimum <= default <= maximum` and then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`.","objdump + RT3.lng strings + UI dispatch inspection + state-field correlation + editorDetail.win resource record" +0x004cb4a0,468,map_editor_scenario_metadata_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2` with concrete per-control writes now grounded: `0xa497` and `0xa498` flip briefing selector `0x621f50` to multiplayer or single-player mode and immediately re-enter `map_editor_scenario_metadata_panel_refresh_briefing_mode` `0x004ca670`; `0xa499` toggles metadata byte `[0x006cec78+0x66f3]`; `0xa49a` toggles the direct campaign-scenario byte `[+0x66de]`; `0xa49b` copies one bounded `0x258`-byte scenario description payload from the edit-control text band into `[+0x672e]`; `0xa49c` and `0xa49d` copy bounded `0xbb8`-byte single-player and multiplayer briefing payloads into `[+0x4f30]` and `[+0x5ae9]`; and `0xa49e/0xa49f/0xa4a0` parse the three year edit fields through `0x005a1ea5`, clamp each result to `1829..2100`, and store them into `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]`. The post-parse normalization is explicit too: it raises minimum to at most the default and lowers maximum to at least the default, enforcing `minimum <= default <= maximum` before the helper re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`. The resource correlation is now explicit too: `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.`, so the direct toggle path at `0x4cb519` is now grounded as the editor-side campaign-designation bit rather than a generic metadata checkbox. This confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`.","objdump + RT3.lng strings + UI dispatch inspection + state-field correlation + editorDetail.win resource record + message-id-to-field correlation" 0x004cb6f0,496,map_editor_available_chairman_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block.","objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation" -0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole `49`-dword special-condition array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and updates the neighboring scalar at `[0x006cec78+0x4b43]` through control id `0xa7ff` before re-entering `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the wider scenario rule-toggle matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation + fixed-runtime-band correlation" +0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole `49`-dword special-condition array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and updates the neighboring scalar at `[0x006cec78+0x4b43]` through control id `0xa7ff` by parsing the edited text through `0x005a1ea5` before re-entering `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. The two special-cased ordinals are now explicit from the body: row `0x19` immediately re-enters `0x00493150` after the direct toggle write, and row `0x1a` immediately re-enters `0x00413620` before the same rebuild. That makes this the live state owner for the wider scenario-rule matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation + fixed-runtime-band correlation + special-row correlation" 0x004cb9f0,134,map_editor_building_density_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries.","objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation" 0x004cba34,15,scenario_state_store_starting_building_density_mode_from_eax,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny direct setter for scenario-state dword `[0x006cec78+0x4c78]`, the same map-wide `Starting Building Density Level:` mode later surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and committed by `map_editor_building_density_panel_handle_message` `0x004cb9f0`. It simply stores the caller-supplied `EAX` value and returns. Local adjacency now shows this setter living in the same tiny callback or preset strip as the fixed-value helpers immediately below it, so this is the safest current generic write-side sibling for that saved density field.","objdump + local disassembly + state-field correlation + setter-strip correlation" 0x004cba43,19,scenario_state_force_starting_building_density_mode_2,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c78]`. The helper writes literal mode `2` and returns. The same field is the map-wide `Starting Building Density Level:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910`, so this is the current strongest read for the hard-wired high-density preset sibling in that setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation" 0x004cba56,19,scenario_state_force_building_density_growth_mode_0,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c7c]`. The helper writes literal mode `0` and returns. The same field is the map-wide `Building Density Growth:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and committed by `map_editor_building_density_panel_handle_message` `0x004cb9f0`, so this is the current strongest read for the hard-wired low-growth preset sibling in the same direct setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation" 0x004cba69,15,scenario_state_store_building_density_growth_mode_from_eax,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny direct setter for scenario-state dword `[0x006cec78+0x4c7c]`, the same `Building Density Growth:` mode later surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and persisted through the ordinary map-state save path. It simply stores the caller-supplied `EAX` value and returns. Local adjacency now shows this setter living in the same tiny callback or preset strip as the fixed-value helpers immediately above and below it, so this is the safest current generic write-side sibling for that saved growth field.","objdump + local disassembly + state-field correlation + setter-strip correlation" 0x004cba78,19,scenario_state_force_building_density_growth_mode_2,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c7c]`. The helper writes literal mode `2` and returns. The same field is the map-wide `Building Density Growth:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910`, so this is the current strongest read for the hard-wired high-growth preset sibling in that setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation" -0x004cc980,943,map_editor_city_region_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the list-row formatter `0x004cc340` and selection callback `0x004cc930`, populates the visible city-or-region list from `0x0062bae0`, publishes detail fields through controls `0x50dc..0x50e2`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper.","objdump + RT3.lng strings + UI callback inspection + region-collection correlation" +0x004cc340,1506,map_editor_city_region_panel_format_selected_region_detail_stats_and_projected_building_rows,map,cdecl,inferred,objdump + local disassembly + constructor correlation + tuning-band correlation,4,"Detail formatter callback for the shell-side `Cities/Regions` editor page. The helper resolves the current selected region id from `0x006cff74` through collection `0x0062bae0`, exits quietly when no live row is selected, and otherwise formats the selected-region detail card through the shared UI host `0x006cff90`. When live region class `[region+0x23e]` is nonzero it first scales current building-count dword `[region+0x242]` by `16`, formats that value through localized id `0x40c`, and publishes the resulting text row. It then reads the persisted economic tuning band from `[0x006cec78+0x0be2/+0x0be6/+0x0bea/+0x0bee]`, formats the leading lane through localized id `0x40d`, and uses `world_region_accumulate_structure_category_totals` `0x00422900` plus `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` to build the projected/live category rows published through localized ids `0x40e..0x414`. The category split is explicit from the body: it accumulates live totals and weights for categories `0..3`, emits one special aggregate row when any of categories `0/2/3` are present, and then iterates four category rows whose projected values come from `0x004234e0(region, category)`. This is therefore the live `Cities/Regions` detail stats owner consuming the same save-loaded economic tuning band as the runtime post-load path, not just another generic list formatter.","objdump + local disassembly + constructor correlation + tuning-band correlation + projected-structure correlation" +0x004cc930,80,map_editor_city_region_panel_store_selected_region_density_scalar_and_rebuild,map,cdecl,inferred,objdump + local disassembly + constructor correlation,3,"Small write-side callback on the shell-side `Cities/Regions` editor page. When the page-local rebuild guard `0x006cff98` is clear and a live region id is selected in `0x006cff74`, the helper resolves that row through collection `0x0062bae0`, writes the caller-supplied scalar into both `[region+0x25a]` and `[region+0x25e]`, and then re-enters `map_editor_city_region_panel_construct` `0x004cc980` to republish the visible controls. Current grounded registration is the callback bound on control `0x5086` by the page constructor, so this is the selected-region density or scale setter rather than a list-selection handler.","objdump + local disassembly + constructor correlation + state-field correlation" +0x004cc980,943,map_editor_city_region_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the detail formatter `0x004cc340` on control `0x5088` and the selected-region density setter `0x004cc930` on control `0x5086`, populates the visible city-or-region list from `0x0062bae0`, publishes the selected region density and rounded current scalar through controls `0x66/0x5087`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper.","objdump + RT3.lng strings + UI callback inspection + region-collection correlation + control-band correlation" 0x004cc250,112,map_editor_chairman_slot_panel_refresh_slot_list,map,thiscall,inferred,objdump + UI control inspection,4,"Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`.","objdump + UI control inspection" 0x004cc2d0,99,map_editor_chairman_slot_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Players` editor panel under control group `0x5a6e`. The helper attaches the selected-slot formatter at `0x004c9da0`, the profile-cycle button at `0x004c9fa0`, and the list-selection callback at `0x004cc230`, then populates the current slot list through `map_editor_chairman_slot_panel_refresh_slot_list` and publishes one top-level panel control. The localized page text `995` `Players` plus help text `1015` `Control of how many players, human and/or A.I., allowed in the scenario.` now make this the clearest current shell owner for the local chairman-slot record family rooted at `0x006cec78+0x69d8`.","objdump + RT3.lng strings + UI callback inspection" 0x004ceb90,291,map_editor_chairman_slot_panel_cycle_selected_slot_profile,map,thiscall,inferred,objdump + static-table inspection,4,"Cycles the staged chairman profile assigned to the currently selected local slot. Starting from the slot-local profile id at `[slot+0x00]`, the helper wraps through the bounded persona id range `0..40`, skips any profile already marked busy in the static persona table byte at `0x005f2d28`, writes the chosen id back to `[slot+0x00]`, and mirrors the same choice into any already-materialized persona object in `0x006ceb9c`, including its display name, biography text, and icon byte. Current grounded callers are the profile-cycle control in `map_editor_chairman_slot_panel_handle_message` and the neighboring shell callback block around `0x004c9fa0`.","objdump + static-table inspection + UI callback inspection" 0x004cecc0,1049,map_editor_chairman_slot_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell chairman-slot editor panel rooted at `0x5a6e`. The helper handles add and remove slot actions, profile cycling, the Optional-versus-Mandatory toggle, the three-way `Human` `Computer` `Human or Computer` role group, and numeric tuning edits for the selected slot. The current slot-record semantics are bounded directly from these branches: control id `0x5a77` writes `[slot+0x01]=1` for `Optional`, `0x5a78` writes `[slot+0x01]=0` for `Mandatory`, and `0x5a79`, `0x5a7a`, plus `0x5a7b` select `Human`, `Computer`, and `Human or Computer` by combining the ordinary seat byte `[slot+0x02]` with the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`; `0x5a7c` commits the numeric tuning field back to `[slot+0x04]`. The add-slot path allocates a new live slot, seeds `[slot+0x00]` to one persona id, `[slot+0x01]` to `Optional`, `[slot+0x02]` to the broad `Human or Computer` state, mirrors that same broad state into the external gate at `+0x0bc3`, and seeds `[slot+0x04]` to the default `100000` tuning value. The remove path clears the whole 9-byte record rooted at `[slot+0x00]`, resets `[slot+0x04]` back to `100000`, and clears any already-materialized persona object, but it does not directly write the special occupied-seat byte `[slot+0x03]`, which remains seeded elsewhere in the currently grounded code. Current grounded caller is the shell panel callback attachment in `map_editor_chairman_slot_panel_construct` at `0x004cc2d0`.","objdump + RT3.lng strings + UI dispatch inspection" 0x004ce070,1549,map_editor_panel_select_active_section,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level map-editor control-panel section selector. The helper switches over the active page byte at `[this+0x78]`, tears down or replaces the current page owner at `[this+0x7c]`, and then constructs the bounded editor pages reached so far including the scenario metadata panel `0x004ca790`, city-or-region page `0x004cc980`, territory page `0x004cd070`, available-chairman panel `0x004ca540`, economic tuning panel `0x004cadf0`, locomotives-availability page `0x004cd680`, industry-availability page `0x004cdbd0`, special-conditions panel `0x004cb2b0`, the bounded dual tri-state policy panel rooted at `0x004ca910`, the now-grounded `Port/Warehouse Cargos` page `0x004cf910`, and the resolved report pages at `0x004d3000`, `0x004d3020`, `0x004d3060`, `0x004d3080`, `0x004d30a0`, `0x004d4110`, and `0x004d4130`. Current neighboring shell evidence is enough to treat this as the broad editor-side page owner rather than another local panel helper.","objdump + caller inspection + UI dispatch inspection + page-constructor correlation" -0x004ce380,1174,map_editor_city_region_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Cities/Regions` editor page. The helper routes list-selection and navigation traffic through the city-or-region controls around `0x507e..0x5088`, opens the rename prompt from localized id `1054` `Enter the new name:` for the currently selected city-or-region, and also owns the copy-industry-data flow anchored by localized id `1055` `Choose the city to copy industry data from`. One bounded branch walks the candidate pool at `0x0062b268` and reapplies per-candidate enable or weighting state against the selected city-or-region through `0x004206b0` before re-entering `map_editor_city_region_panel_construct`. Current grounded globals `0x006cff74`, `0x006cff78`, and the region collection `0x0062bae0` make this the live handler for the `Cities/Regions` editor section rather than a generic shell callback block.","objdump + RT3.lng strings + UI dispatch inspection + region and candidate correlation" +0x004ce380,1174,map_editor_city_region_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Cities/Regions` editor page. The helper routes message `0xca` and `0xcb` traffic through the city-or-region controls around `0x507e..0x5088`. The page-navigation side is tighter now too: one branch cycles the selected row through the visible list rooted at `0x507e`, republishes the new ordinal to control `0x66`, and re-enters `map_editor_panel_select_active_section` `0x004ce070`; another branch re-enters that same page selector with caller payload `1`. The write-side branches are explicit in the body: it opens the rename prompt from localized id `1054` `Enter the new name:` for the currently selected city-or-region and then reconstructs the page; it writes callback payloads straight into `[region+0x272]` on one small numeric branch; and it forwards another callback payload through `0x004204c0` on the selected region before rebuilding. The copy-industry-data flow anchored by localized id `1055` `Choose the city to copy industry data from` is also concrete now: one branch walks the candidate pool at `0x0062b268` and reapplies per-candidate weighting or enable state against the selected city-or-region through `0x004206b0`, using either `0.0` or `1.0` as the copied weight depending on the triggering control, while the source-selection branch builds one bounded name/id list from the live region collection and, when the chooser returns `0x3f2`, re-enters `0x00420e00` to clone the source region's profile subcollection into the current target before refreshing the page. Current grounded globals `0x006cff74`, `0x006cff78`, and the region collection `0x0062bae0` make this the live handler for the `Cities/Regions` editor section rather than a generic shell callback block.","objdump + RT3.lng strings + UI dispatch inspection + region and candidate correlation + copy-industry-flow correlation" 0x004ce820,1221,map_editor_territory_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Territories` editor page. The handler uses the selected territory ids in `0x00621f48` and `0x00621f4c`, routes selection and navigation through controls around `0x50dc..0x50df`, opens the territory rename prompt from localized id `1054`, and owns the border-remap or hide-border policy path that warns through localized ids `1056` and `1057` when a territory's borders cannot be hidden because other territories already remap to it. After committing the selected territory's border and remap fields it re-enters `map_editor_territory_panel_construct`, which makes this the live `Territories` page handler rather than another local modal callback.","objdump + RT3.lng strings + UI dispatch inspection + territory-state correlation" 0x004cd070,1280,map_editor_territory_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Territories` editor page. The helper uses `0x00621f48` and `0x00621f4c` as the selected-territory latches, falls back to the first live territory in the territory collection at `0x006cfc9c`, and shows the empty-page warning from localized id `1046` `You currently have no territories to edit.` when no territories exist. In the live path it populates the visible territory list from `0x006cfc9c`, publishes the selected territory's id, name, border mode, remap target, and numeric tuning fields through controls `0x50dc..0x50e5`, and builds the secondary remap list from other territories that reference the currently selected one. Current grounded neighbors make this the main owner for the `Territories` editor section.","objdump + RT3.lng strings + UI callback inspection + territory-collection correlation" 0x004cd680,1168,map_editor_locomotive_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Locomotives` availability page in the map-editor control panel. The helper reflects three scenario-state policy bytes from `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]` into controls `0x5b09..0x5b0b`, binds the row formatter `0x004cd570` and the neighboring callback `0x004ca960` on root control `0x5b05`, and iterates the collection at `0x006ada84` to build the visible locomotive list plus the localized title from id `1050` `Locomotives Available\n\n%1 of %2 available`. The detail path formats each selected locomotive through `EditorDetail.win` and counts live world usage by resolving the record through `0x00461c80` and the world-side lookup at `0x00435030`. Current grounded evidence is therefore strong enough to treat this as the main locomotives-available page rather than a generic detail widget.","objdump + RT3.lng strings + UI callback inspection + locomotive-usage correlation" 0x004cf0d0,861,map_editor_locomotive_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Locomotives` availability page. The helper routes selection and bulk-toggle traffic through controls `0x5b06..0x5b0c`, rewrites the three scenario-state policy bytes at `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]`, and walks the locomotive collection at `0x006ada84` to commit per-row availability changes through the same record family used by the constructor. Bulk branches apply enable or disable policy across the visible locomotive set before the handler re-enters `map_editor_locomotive_availability_panel_construct` at `0x004cd680`, which makes this the live availability-policy owner rather than a local detail callback.","objdump + RT3.lng strings + UI dispatch inspection + locomotive-policy correlation" 0x004cdbd0,1357,map_editor_industry_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Industry (Overall)` availability page in the map-editor control panel. The helper binds the detail-row callback `0x004cc130` and the neighboring callback `0x004c9d80` on root control `0x9c42`, then walks the global candidate pool at `0x0062b268`, skipping the category-1 family and sorting the remaining candidates by label before building the visible industry list. The detail side formats the selected industry through `EditorDetail.win`, appends up to eight compatible city-or-region names from the region collection at `0x0062bae0`, and publishes the localized summary from id `1051` `There are %1 Cities and/or Regions using %2 right now`, while the page title uses id `1052` `Industries Available\n\nIndustries: %1 of %2 available`. Current grounded evidence therefore treats this as the main industry-availability page rather than an unnamed detail browser.","objdump + RT3.lng strings + UI callback inspection + candidate-pool correlation" -0x004cf430,714,map_editor_industry_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler routes navigation and toggle traffic through the control band `0x9c43..0xa40f`, updates candidate-availability state through `0x00434f20` for the currently selected industry rows, and then re-enters `map_editor_industry_availability_panel_construct` at `0x004cdbd0` so the visible count and compatible-city summary refresh against the candidate pool at `0x0062b268`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block.","objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation" +0x004cf430,714,map_editor_industry_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler has two grounded write paths into the saved named-availability table. On the direct row-callback path under message `0xca`, controls `0xa028..0xa40f` resolve the clicked candidate row from the callback payload, forward its live name plus the caller-supplied boolean state into `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`, and then reconstruct the page. On the top-level bulk path it recognizes control `0x9c43` as one boolean preset and the sibling path as the opposite boolean preset, walks the live candidate pool `0x0062b268`, keeps only rows that pass the same industry-page filter, and forwards each surviving candidate name plus that bulk boolean into the same `0x00434f20` upsert owner before reconstructing the page through `map_editor_industry_availability_panel_construct` `0x004cdbd0`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block.","objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation + callback-payload correlation + bulk-boolean sweep correlation" 0x004cf910,1770,map_editor_port_warehouse_cargo_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, immediately re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves those persisted token strings against the visible live cargo catalog through direct `0x005a57cf` exact-name compares and only reflects matched ordinals back into the selector controls. That closes the editor-side marker boundary materially: there is still no special decode path here, and nonmatching token strings simply leave the selector index at its zero default while the raw scenario-state strings remain unchanged. The constructor-side usage summary is tighter in the same way: before showing the current book it scans the live city-or-region collection at `0x0062bae0`, keeps only rows whose usage gates `[entry+0x242]` and `[entry+0x2f6]` are live and whose current recipe ordinal `[entry+0x2f2]` matches the selected book, concatenates up to eight visible names from `[entry+0x356]` with separator `0x005c9f38`, counts any remainder, and then formats the bounded usage-summary pair from localized ids `508` and `509`. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` ``, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page.","objdump + RT3.lng strings + UI callback inspection + recipe-book state correlation + mode-table correlation + control-gating correlation + exact-name-catalog-correlation + usage-summary-scan-correlation" 0x004d0040,1643,map_editor_port_warehouse_cargo_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; top-level control `0x59d8` parses the shared maximum annual production text field, clamps the entered value to at most `8`, warns through modal `0x1f9` when needed, and writes the resulting float to `book+0x3ed`; top-level control `0x59d9` opens the bounded rename modal over the current book root with one `0x3c`-byte text span; controls `0x59da/0x59db` cycle the selected recipe-book index backward or forward modulo `12`; and top-level control `0x59de` commits the selected recipe-book ordinal directly into `0x006cffa4`. The per-line edit groups then commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground exactly as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`, with the concrete control ids now resolved too: `0x5a0a..0x5a0e` write the five line-mode dwords at `book+0x3f1+line*0x30`; `0x5a1e..0x5a22` resolve one live cargo entry through `0x00518140` and copy its name field into the supplied-token lane at `book+0x3f9+line*0x30`; `0x5a32..0x5a36` do the same for the demanded-token lane at `book+0x40d+line*0x30`; and `0x5a50..0x5a54` parse the per-line annual amount text, clamp it to at most `6`, warn through modal `0x1fa` when needed, and write the resulting float to `book+0x3f5+line*0x30`. Current local control flow now closes the persistence boundary too: this handler stores the selected cargo names back into those token fields verbatim and does not normalize unmatched marker-like payloads before they reach the constructor or importer. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` ``, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback.","objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation + exact-name-token-persistence-correlation + rename-modal-correlation + switch-table correlation + per-line-control-id correlation" 0x004cf700,370,map_editor_panel_dispatch_active_section_message,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level message dispatcher for the active map-editor control-panel section. The helper reuses the same page selector byte at `[this+0x78]` and routes incoming shell messages to the current page-local handlers, including the grounded city-or-region handler `0x004ce380`, territory handler `0x004ce820`, scenario metadata handler `0x004cb4a0`, available-chairman handler `0x004cb6f0`, special-conditions handler `0x004cb8e0`, the bounded dual tri-state handler `0x004cb9f0`, the grounded port-or-warehouse cargo handler `0x004d0040`, and the resolved report-page handlers rooted at `0x004d38c0`, `0x004d3d90`, and the neighboring editor report family. Current grounded caller and page-table evidence now make this the broad editor-side active-page dispatcher rather than another page-local callback block.","objdump + caller inspection + UI dispatch inspection + page-handler correlation" @@ -1002,14 +1005,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00461ca0,35,locomotive_entry_format_linked_era_name_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Formatting companion to `locomotive_entry_query_linked_era_name_ptr` `0x00461c80`. The helper resolves linked era id `[loco+0x72]` through the same era collection at `0x0062ba88` and, on success, forwards the era-name pointer `[era+0x45]` into `0x0051c920`; missing era ids return null. Current grounded callers are the train-upgrade news formatter `0x00409300` and the neighboring company-side upgrade branch at `0x00409903`, where it supplies the old and new locomotive-era display names embedded in localized news id `2897`.","objdump + local disassembly + caller inspection + era-name formatting correlation + train-upgrade-news correlation" 0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation" 0x00461e00,262,locomotive_collection_refresh_runtime_availability_overrides_and_usage_state,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime refresh over the live locomotive pool at `0x006ada84`. The helper guards itself with reentrancy latch `0x006ada88`, walks every live locomotive record, resolves the linked era record through `[loco+0x72]`, and combines the locomotive-side requirement bytes `[loco+0x30/+0x31/+0x32]` with the active scenario-state availability toggles at `[0x006cec78+0x4c97..+0x4c99]`. When the current locomotive or its linked era passes those gates it upserts one boolean availability override through `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0`; it then immediately queries the resulting named override through `scenario_state_query_named_locomotive_availability_record_value` `0x00435030` and stores that value into `[loco+0x7b]`. When the collection sweep finishes it tails into `0x00436af0` to rebuild the dependent locomotive-side scalar band. Current grounded callers are the world-entry rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and the startup or restore-side upsert family that also re-enters this helper through `0x004350b0`, so this is the safest current read for the collection-wide locomotive runtime-availability refresh rather than a single dialog-owned toggle helper.","objdump + caller xrefs + local disassembly + locomotive-availability correlation + scenario-state override correlation + reentrancy-latch correlation" -0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless,4,Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.,ghidra + rizin + llvm-objdump + strings +0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless + objdump + local disassembly,4,"Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. The currently grounded write-side branches are tighter now too: command ids `0x7530..0x7532` drive the graphics-preset family through `0x0051ebc0`, `0x00484590`, and `0x004853c0`; command ids `0x7540..0x7543` drive the scenario-text/report build side through `0x00489830`, `0x004886e0`, and `0x00489a20`; and command ids `0x9d26..0x9d28` store `command_id - 0x9d26` directly into shell dword `[0x006cec74+0x178]`, yielding the live values `0`, `1`, and `2` later consumed by the selected-year adjustment and setup fast-forward gate under `0x00436d10`, `0x004384d0`, and `0x00437b20`. The surrounding body also toggles several adjacent shell settings such as `[shell+0x16c]`, `[shell+0x174]`, and `[shell+0x110]`, plus the later report-side command families, so the safest current read remains the broad shell UI command owner rather than a narrower setup-only helper.","ghidra + rizin + llvm-objdump + strings + objdump + local disassembly + selected-year-gate correlation" +0x00464c80,10528,shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family,shell,cdecl,inferred,objdump + local disassembly + settings-window family correlation + load-save sidecar correlation,4,"Broad `SettingsWindow.win` message/control dispatcher in the shell-side settings family. At entry it refreshes the stored sound-backend index at `[0x006d4024+0x114706]` from `0x00531640`, then switches over a large control-id range and mutates many shell/world-side settings before the common tail persists config through `shell_save_graphics_config` `0x00484910(1)` and re-enters the shared shell follow-on `0x004625b0(1, ...)`. The load/save-facing sidecar seam is explicit here now too: controls `0xe101/0xe102/0xe103/0xe104` directly toggle the four shell dwords `[0x006d4024+0x11471a/+0x11471e/+0x11472a/+0x11472e]` whose current values are later copied into setup-preview payload bytes `+0x09/+0x0a` and save-side selector dword `0x0062bec4` by `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100` `0x00442ba0` and `shell_map_file_world_bundle_coordinator` `0x00445de0`. The implication rules are grounded too: disabling `0x11471e` clears `0x11472a`, while enabling either `0x11472a` or `0x11472e` forces `0x11471e = 1`. The broader dispatcher also toggles several adjacent display/runtime and world-side settings, but the strongest current read is the common settings-window owner above that sidecar family rather than another narrow toggle leaf.","objdump + local disassembly + settings-window family correlation + load-save sidecar correlation + common-tail correlation" 0x00474030,167,city_database_entry_build_mode_selected_anchor_helper_from_triplet,map,cdecl,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Small helper-object builder beneath the current city-database entry family. The function switches over caller-supplied mode enum `0..10`, maps those cases into `0x00475ed0` with selector families `4`, `0xd`, or `0xe` plus fixed scalar constants `0.5`, `0.75`, `1.0`, `1.5`, or `2.0`, and when helper allocation succeeds it publishes the caller-supplied world triplet through the helper-owned pointer at `[helper+0x4]` via `0x00530720`. Current grounded callers are `0x004741ac` during constructor-side setup and `0x004742bd` during refresh, so this is now the strongest current read for the mode-selected anchor-helper builder rather than a generic effect allocator.","objdump + caller xrefs + local disassembly + city-database family correlation + helper-builder correlation" 0x00474110,32,city_database_entry_initialize_stack_temporary_entry,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Tiny temporary-entry initializer in the city-database entry family. The helper re-enters shared base initializer `0x00455b20`, clears helper fields `[this+0x23a]` and `[this+0x242]`, installs vtable `0x005ce428`, and returns `this`. Current grounded callers are the stack-local temporary-entry paths at `0x004744ae` and `0x004745ae`.","objdump + caller xrefs + local disassembly + city-database family correlation + temp-entry correlation" 0x00474130,195,city_database_entry_construct_from_id_coords_mode_and_default_triplet,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Primary constructor beneath the current city-database entry family. The helper stores the caller-supplied entry id into `[this+0x23e]`, clears the trailing helper payload block at `[this+0x246..+0x24e]`, stores the caller-supplied mode into `[this+0x242]`, derives one world-height scalar from the supplied coordinate pair through `0x00448bd0`, builds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030`, and then seeds the remaining default scalar or flag tuple through `0x00455b70` using the fixed default bundle at `0x005ce49c/0x005ce4a0/0x005ce4a4`. Current grounded caller is the live-entry allocator `0x004744ed`.","objdump + caller xrefs + local disassembly + city-database family correlation + constructor correlation" 0x00474260,111,city_database_entry_reload_payload_and_refresh_mode_selected_anchor_helper,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"Refresh-side helper in the current city-database entry family. The function first re-enters `0x00455fc0` on the caller-supplied payload stream, then samples the entry's normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, derives one world-height scalar through the world helper `0x00448bd0`, rebuilds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030` using mode `[this+0x242]`, and returns the status from the earlier `0x00455fc0` reload. Current evidence is strongest for a payload reload plus mode-selected anchor-helper refresh rather than a generic constructor.","objdump + caller inspection + local disassembly + city-database family correlation + helper-refresh correlation" 0x004743d0,42,city_database_entry_release_mode_selected_anchor_helper_and_base_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Release-side helper in the current city-database entry family. The function destroys helper field `[this+0x23a]` through `0x00475100` when live, clears that field, restores the base vtable tag at `[this] = 0x005ce428`, and then tails into base cleanup `0x00455650`. Current grounded callers are the temporary-entry teardown inside `0x004744f6` and the collection load loop at `0x004745d0`, so this is the safest current read for releasing the mode-selected anchor helper plus base payload state.","objdump + caller xrefs + local disassembly + city-database family correlation + release-path correlation" 0x00474400,36,city_database_entry_release_mode_selected_anchor_helper_and_dynamic_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Sibling release helper beside `0x004743d0`. It destroys helper field `[this+0x23a]` through `0x00475100` when live, clears the field, and then tails into `0x00455d20` rather than the smaller base cleanup at `0x00455650`. Current grounded caller is the collection removal path at `0x00474520`, so the safest current read is a release helper for mode-selected anchor helper plus the heavier dynamic-payload branch.","objdump + caller xrefs + local disassembly + city-database family correlation + removal-path correlation" -0x00474430,29,city_database_entry_query_mode_gate_or_runtime_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + city-database family correlation,1,"Small city-database-entry-family predicate over byte `[this+0x42]`. When shell mode gate `0x004338c0` is inactive it returns literal `1`; otherwise it returns the current entry byte `[this+0x42]`. The exact player-facing meaning of that byte is still open, so the safest read is a mode-gated runtime-flag query.","objdump + local disassembly + city-database family correlation + mode-gate correlation" +0x00474430,29,city_database_entry_query_mode_gate_or_runtime_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + city-database family correlation,1,"Small city-database-entry-family predicate over byte `[this+0x42]`. When shell mode gate `0x004338c0` is inactive it returns literal `1`; otherwise it returns the current entry byte `[this+0x42]`. The row is therefore kept at that mode-gated runtime-flag-query level.","objdump + local disassembly + city-database family correlation + mode-gate correlation" 0x00474450,39,city_database_entry_collection_construct_with_fixed_capacity_0x14,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,2,"Constructor for the current city-database entry collection rooted at vtable `0x005ce4a8`. The helper resets collection state through `0x00517ce0`, installs vtable `0x005ce4a8`, and then initializes the collection through `0x00518570` with the fixed parameter tuple `(0, 0, 0, 0x14, 0x0a, 0, 0)`. Current grounded caller is the global collection bootstrap at `0x004487a9`, which stores the resulting pointer into `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + bootstrap correlation" 0x00474480,18,city_database_entry_collection_release_and_free,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,1,"Small destructor-side wrapper for the current city-database entry collection. The helper installs collection vtable `0x005ce4a8`, re-enters `0x00518600`, and then tails into `0x00518bd0`. Current grounded caller is the global teardown path at `0x004492c3`, which frees the collection rooted at `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + teardown correlation" 0x004744a0,101,city_database_entry_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + local disassembly + caller xrefs + collection-layout correlation,2,"Shared allocator and constructor beneath the city-database entry collection. The helper initializes one stack-local temporary entry through `0x00474110`, allocates a `0x250`-byte live record through `0x00518900`, resolves that record through `0x00518140`, then constructs it through `0x00474130` with the caller-supplied entry id plus three caller arguments, and finally tears down the temporary entry through `0x004743d0`. Current grounded caller is the collection load or clone lane at `0x004744ed`.","objdump + local disassembly + caller xrefs + collection-layout correlation + temp-entry correlation" @@ -1169,7 +1173,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004b2340,42,train_collection_construct,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the live train collection later rooted at `0x006cfcbc`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0x1d5, initial_slots=0x32, growth=0x14, id_base=1)`, installs vtable `0x005d00c8`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x006cfcbc`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" 0x004b2370,55,train_collection_release_live_entries,simulation,thiscall,inferred,objdump + local disassembly + companion correlation,2,"Release-side live-entry sweep beneath the train collection family. The helper repeatedly resolves the first live entry id through `0x00517cf0/0x00518380`, dispatches each entry through collection vtable slot `+0x08`, and then tails into `0x00518600` when no live entries remain. Current grounded direct caller is the top-level release wrapper `0x004b23b0`.","objdump + local disassembly + companion correlation + live-entry-release sweep" 0x004b23b0,18,train_collection_release_entries_and_collection_storage,simulation,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `train_collection_construct` `0x004b2340`. The helper reinstalls vtable `0x005d00c8`, re-enters `train_collection_release_live_entries` `0x004b2370`, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation" -0x004b23d0,83,train_collection_allocate_and_construct_entry_from_stack_seed_and_owner_id,simulation,thiscall,inferred,objdump + local disassembly + constructor-chain inspection,3,"Shared train-collection allocator wrapper immediately above the broader train family. The helper first seeds one stack-local temporary through `0x004a7400`, allocates a fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then forwards the new id plus one caller-supplied owner or company id into `0x004a7410` to initialize the live train record before clearing the stack temporary through `0x004a6e50`. Current evidence is strong enough to ground the allocation and constructor chain, but not yet the higher user-facing meaning of the caller-supplied seed payload.","objdump + local disassembly + constructor-chain inspection + collection-allocation correlation" +0x004b23d0,83,train_collection_allocate_and_construct_entry_from_stack_seed_and_owner_id,simulation,thiscall,inferred,objdump + local disassembly + constructor-chain inspection,3,"Shared train-collection allocator wrapper immediately above the broader train family. The helper first seeds one stack-local temporary through `0x004a7400`, allocates a fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then forwards the new id plus one caller-supplied owner or company id into `0x004a7410` to initialize the live train record before clearing the stack temporary through `0x004a6e50`. The row is therefore kept at that allocation-and-constructor-chain level with the caller seed payload bounded structurally.","objdump + local disassembly + constructor-chain inspection + collection-allocation correlation" 0x004b2700,143,train_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load sibling for the live train collection `0x006cfcbc`. The helper reads tagged sections `0x5209/0x520a/0x520b` through repeated `0x00531360` calls, refreshes the indexed-collection header through `0x00518680`, and then walks every live train entry, dispatching each one through `0x004a84b0` with the active bundle handle before closing the final tag. Current grounded caller is the world-entry bring-up family, where this helper refreshes the live train records from the tagged bundle after collection construction.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation" 0x004b27a0,118,train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle,simulation,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save owner for the live train collection `0x006cfcbc`. The helper opens tagged sections `0x5209/0x520a/0x520b` through repeated `0x00531340` calls, serializes the indexed-collection header through `0x00517d90`, and then walks every live train entry, dispatching each record through `0x004a7030` with the active bundle handle before closing the final tag. Current grounded caller is the package-save path that persists the live runtime collections beside the other world roots.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation" 0x004b2820,62,train_collection_remove_nonnegative_route_list_rows_matching_peer_site_id,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide cleanup pass over the live train collection. The helper walks every live train entry and re-enters `0x004af610` with one caller-supplied peer-site id. That per-train worker removes route-list rows whose sign byte `[row+0x28]` is nonnegative and whose peer-site `u16` at `[row+0x29]` matches the requested id, then refreshes the train's runtime state when its route list becomes empty. Current grounded caller is the linked-site refresh strip at `0x004805d4`, so this is the safest current read for the collection-wide train route-list cleanup by peer-site id rather than a generic route reset.","objdump + local disassembly + caller correlation + per-train-worker correlation" @@ -1282,7 +1286,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004e51ea,246,shell_load_screen_render_game_status_briefing_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Game-status-side briefing renderer inside `LoadScreen.win`. The helper uses page-local subselector `[this+0x7c]` to build one packed key and then queries the live scenario text store at `0x0062be18` through `0x00432f40` with kind `9`, writing the returned briefing text into a stack buffer before presenting it through the shell text surface rooted at `[this+0x0e55]`. It then appends the localized title or help pair `1772` `Briefing` and `1773` `View the scenario briefing.` through the smaller shell text-widget writer at `0x00563290`. Current grounded caller is page `3` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best meaning is the `Game Status` briefing page or panel rather than a company-owned report list.","objdump + RT3.lng strings + helper correlation + scenario-text-store correlation + briefing-string correlation" 0x004e5300,1899,shell_load_screen_render_player_detail_stock_holdings_panel,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-profile stock-holdings summary panel inside the shell-side `LoadScreen.win` family. The helper resolves the selected profile id at `[this+0x8c]` through the live chairman collection at `0x006ceb9c`, builds the top summary rows under localized ids `1204` `Stock Value:`, `1205` `Total Assets:`, and `1206` `Stock Holdings:`, then walks the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. For each active company with positive profile holdings in `[profile + company_id*4 + 0x15d]`, it formats one company row under ids `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`; when no positive holdings survive the sweep it emits fallback id `1209` `None`. The panel also checks the scenario-selected chairman through `0x004348c0`, and only for that currently selected profile does it append localized id `3029` `Click to change player name and portrait.` together with the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `8` to localized title id `1192` `PLAYER DETAIL`, so this renderer is no longer just a generic holdings page.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + holdings-slot correlation + selected-profile affordance correlation + page-title-table decode" 0x004e5a80,2368,shell_render_company_overview_panel_header_and_optional_change_affordance,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Broader company-side overview-panel renderer above the shared text-formatting entry later mapped at `0x004e5cf0`. The wrapper first checks the selected company id at `[this+0x88]`. When that id is absent or no longer resolves through the live company collection at `0x0062be10`, it chooses one of three fallback text families `1210` `You haven't started a company yet...`, `3043` `You don't control a company at the moment...`, or `3888` `You don't control a company at the moment.` from current chairman/company state, paints that fallback into the current shell text surface, and styles controls `0x3f06` and `0x3f07` inactive through the generic control path at `0x00540120`. When a valid company is present, it styles those same controls active, falls through into the shared metric/governance body later labeled at `0x004e5cf0`, and on the narrower branch where the selected company matches the scenario-selected company at `0x00434870` it also appends localized id `3044` `Click to change company name and logo.` and publishes the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. Current evidence therefore keeps the name/logo affordance outside the normal `CompanyDetail.win` callback dispatcher and makes `0x004e5cf0` read more like the shared text-formatting subentry within this wider overview-panel renderer than like a full standalone owner by itself.","objdump + RT3.lng strings + helper correlation + fallback-text correlation + overview-wrapper correlation" -0x004e5cf0,1844,shell_format_company_governance_and_economy_status_panel,shell,cdecl,inferred,objdump + RT3.lng strings + helper correlation,4,"Shared shell text formatter for one company-side overview panel. The helper first renders a five-line company-metric preamble from the generic stat reader `0x0042a5d0` using display-year-aware company slots `0x2c`, `0x2b`, `0x17`, and `0x26` plus one derived ratio branch. That preamble is now grounded through localized ids `1211..1215`: `Revenues` from slot `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load mile` from the derived `slot 0x2c / slot 0x17` branch with a safe `1.0` fallback when the load-mile value is nonpositive, and `Average speed` from slot `0x26` rendered through localized value formatter `1216` `%1 m.p.h.`. Its governance branch is now tighter too: when the selected company has no linked chairman it emits localized id `3045` `This company is controlled by the shareholder's committee...`; when the company is wholly owned it emits `3046` `You have complete ownership...` for the scenario-selected chairman or `3047` `This company is wholly owned by %1` for another linked chairman; otherwise it emits the investor-attitude lines `3048` `Investors are %1 your performance.` or `3049` `Investors are %1 the chairman's performance.` using the adjective table at `0x00622170`. The salary branch is bounded now too: it computes a signed salary delta from the company fields at `[company+0x14f]` and `[company+0x0d59]`, formats the absolute change and current salary value through the numeric helpers at `0x0051bfe0`, and then chooses `3050..3052` when the linked chairman is the scenario-selected chairman or `3053..3055` for another linked chairman depending on whether the delta is negative, positive, or zero. The bonus branch is narrower as well: only when the display year from `company_query_display_year_or_current_year` `0x004e39e0` matches the recorded bonus year at `[company+0x34f]` does it append `3056` `You have been awarded a bonus of %1.` or `3057` `The chairman has been awarded a bonus of %1.` using the bonus amount at `[company+0x353]`. The same formatter then appends the localized economy tail caption `1218` `Economy status - %1.` from the current scenario economy state at `[0x006cec78+0x2d]` and continues by staging the adjacent selected-company report or list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`, `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`, `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`. Current evidence still does not recover separate `CompanyDetail.win` action controls for those report or list labels under `shell_company_detail_window_handle_message` at `0x004c56a0`, so this strip currently reads as staged overview text or help content rather than as a closed dispatcher-owned launcher family. It uses the linked-chairman accessor `0x00426ef0`, the company-ownership test at `0x004768c0`, the display-year bucket helper `0x004240c0`, and the economy-status table at `0x00620cc0`. Current direct shell binding is still open, but the section-0 refresh for `CompanyDetail.win` now routes control `0x947f` through a dedicated stack-built dynamic text path, so this remains the strongest current shared formatter family aligned with that overview widget.","objdump + RT3.lng strings + helper correlation + governance-status string correlation + CompanyDetail overview correlation + metric-preamble correlation + report-launch-strip correlation + ownership-branch correlation + salary-bonus branch correlation + negative-dispatch-boundary correlation + preamble-label-table correlation" +0x004e5cf0,1844,shell_format_company_governance_and_economy_status_panel,shell,cdecl,inferred,objdump + RT3.lng strings + helper correlation,4,"Shared shell text formatter for one company-side overview panel. The helper first renders a five-line company-metric preamble from the generic stat reader `0x0042a5d0` using display-year-aware company slots `0x2c`, `0x2b`, `0x17`, and `0x26` plus one derived ratio branch. That preamble is now grounded through localized ids `1211..1215`: `Revenues` from slot `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load mile` from the derived `slot 0x2c / slot 0x17` branch with a safe `1.0` fallback when the load-mile value is nonpositive, and `Average speed` from slot `0x26` rendered through localized value formatter `1216` `%1 m.p.h.`. Its governance branch is now tighter too: when the selected company has no linked chairman it emits localized id `3045` `This company is controlled by the shareholder's committee...`; when the company is wholly owned it emits `3046` `You have complete ownership...` for the scenario-selected chairman or `3047` `This company is wholly owned by %1` for another linked chairman; otherwise it emits the investor-attitude lines `3048` `Investors are %1 your performance.` or `3049` `Investors are %1 the chairman's performance.` using the adjective table at `0x00622170`. The salary branch is bounded now too: it computes a signed salary delta from the company fields at `[company+0x14f]` and `[company+0x0d59]`, formats the absolute change and current salary value through the numeric helpers at `0x0051bfe0`, and then chooses `3050..3052` when the linked chairman is the scenario-selected chairman or `3053..3055` for another linked chairman depending on whether the delta is negative, positive, or zero. The bonus branch is narrower as well: only when the display year from `company_query_display_year_or_current_year` `0x004e39e0` matches the recorded bonus year at `[company+0x34f]` does it append `3056` `You have been awarded a bonus of %1.` or `3057` `The chairman has been awarded a bonus of %1.` using the bonus amount at `[company+0x353]`. The same formatter then appends the localized economy tail caption `1218` `Economy status - %1.` from the current scenario economy state at `[0x006cec78+0x2d]` and continues by staging the adjacent selected-company report or list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`, `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`, `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`. Current evidence now carries this strip conservatively as staged overview text or help content rather than as a dispatcher-owned launcher family. It uses the linked-chairman accessor `0x00426ef0`, the company-ownership test at `0x004768c0`, the display-year bucket helper `0x004240c0`, and the economy-status table at `0x00620cc0`. The row is therefore kept at that overview-widget formatter level, with the direct shell binding bounded by the section-0 refresh path for `CompanyDetail.win` control `0x947f`.","objdump + RT3.lng strings + helper correlation + governance-status string correlation + CompanyDetail overview correlation + metric-preamble correlation + report-launch-strip correlation + ownership-branch correlation + salary-bonus branch correlation + negative-dispatch-boundary correlation + preamble-label-table correlation" 0x004e68e0,1521,shell_load_screen_render_company_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-company comparison page inside `LoadScreen.win`. The helper first rejects the empty-company case with one fallback text branch rooted at localized ids `1210`, `3043`, or `3888`, then clears the shared row buffer at `[this+0x11c]`, stages the visible company-comparison column family `1235..1242`, and iterates the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. The caller-supplied page-local selector chooses which company metric to rank on: revenue through slot `0x2c`, profit through slot `0x2b`, cash through slot `0x0d`, or track mileage through slot `0x25`, all read through the generic company stat reader at `0x0042a5d0`. The emitted row lane also stages the adjacent company-report affordances `1243` `Click to view %1's income statement.`, `1244` `Click to view %1's balance sheet.`, and `1245` `Click to view %1's haulage reports.` on top of the ranked company rows, while applying the stronger highlight path when the row company matches the scenario-selected chairman's current company. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `2` to localized title id `1186` `COMPANY LIST`, so this renderer is now bounded as the company-list page rather than only a generic financial ranking helper.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + company-stat-slot correlation + report-affordance correlation + page-title-table decode" 0x004e6ef0,1879,shell_load_screen_render_player_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-chairman comparison page inside `LoadScreen.win`. The helper clears the shared row buffer at `[this+0x11c]`, stages the visible chairman-comparison headers from the localized family `1237`, `1241`, `1246`, `1247`, `1248`, `1249`, and `1250`, then iterates the active chairman profile collection at `0x006ceb9c` through `profile_collection_count_active_chairman_records` and the `nth active` accessors rooted at `0x00477820`, `0x00477860`, and `0x004778c0`. The caller-supplied selector chooses which chairman-side metric drives the ranking: cash, one direct profile-held total, one direct-total-plus-cash lane, one threshold-adjusted-total-plus-cash lane, or the active-rank lane read through `0x00476320`, `0x00476780`, `0x00476c20`, and `0x004778c0`. The row builder also uses the profile-side name and portrait-family tables around `0x00622192..0x006221a4`, with special-cased current-player text on the zero-th row and the stronger highlight path when one ranked profile matches the scenario-selected chairman. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `7` to localized title id `1191` `PLAYER LIST`, so this renderer is now bounded as the player-list page rather than only a chairman-wealth ranking helper.","objdump + RT3.lng strings + caller inspection + active-profile-iteration correlation + profile-metric correlation + wealth-ranking-string correlation + page-title-table decode" 0x004e7670,3033,shell_load_screen_render_company_train_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the company-owned train list page inside `LoadScreen.win`. The helper first rejects missing selected-company state through localized id `1210` and then rejects companies with no trains through id `1251` `This company does not have any trains.` after querying the current company through the live company collection at `0x0062be10` and the train-count helper at `0x004264c0`. On the populated path it clears the `0x190`-dword row buffer at `[this+0x11c]`, reads the optional display year through `company_query_display_year_or_current_year` at `0x004e39e0`, stages the visible column headers and sort-help family `1235..1242`, and then iterates the selected company's live train roster through the company-side train accessors around `0x004264c0`, `0x00426520`, `0x004a7270`, `0x004a77b0`, and `0x0041adb0`. The emitted row family matches the player-facing train-list strip: revenue, profit, cash, track mileage, engine type, age, oil, water, sand, speed, and profit rows from `1252..1266`, plus the per-row camera-centering affordance `1267` `Click to center the camera on %1`. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as one company-list page sibling beside the holdings, building, station, and cargo pages rather than a `CompanyDetail.win` subpanel.","objdump + RT3.lng strings + caller inspection + company-train-roster correlation + train-list-string correlation" @@ -1330,8 +1334,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00506be0,360,shell_station_detail_format_freight_and_express_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible freight and express summary lines on the shell-side `StationDetail.win` panel. The helper resolves the selected placed-structure record, builds the weighted freight total through the neighboring cargo-summary helper at `0x005519f0`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then writes the localized lines `Freight: %1` and `Express: %1` through string ids `239` and `240`. This is the first grounded shell-detail consumer of the local service bundle rebuilt beneath `0x0042d580`.","objdump + strings + caller inspection + service-query correlation" 0x00506d50,252,shell_station_list_handle_center_or_rename_action,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Handles the station-list row modifier actions after the active station row is resolved from collection `0x006cec20`. The helper reads the packed shell input modifier bits from `0x006d4018+0xa8c`; with Shift it recenters the world view on the selected station through `0x0047de00` and `0x00433900`, and with Control it opens the station rename prompt through localized id `3732` `Enter station name:`. This helper is the modifier-aware side-action lane paired with the visible freight or express station-row summaries.","objdump + strings + caller inspection + input-state correlation" 0x00506e50,221,shell_station_list_format_freight_and_express_availability_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible `StationList.win` row summary for one selected station. The helper resolves the placed-structure record from collection `0x006cec20`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then emits the localized composite summary `3890` `%1 has %2 freight loads and %3 express loads available for hauling...`. This is the first grounded shell-list consumer of the same service-score lane used by `shell_station_detail_format_freight_and_express_summary`.","objdump + strings + caller inspection + service-query correlation" -0x00506f30,672,shell_station_list_window_refresh_rows_selection_and_status,shell,thiscall,inferred,objdump + caller inspection + local disassembly + collection scan,4,"Broad row and status refresh owner for the shell-side `StationList.win` panel. The helper clears the two visible row controls `0x61a9` and `0x61aa`, scans collection `0x006cec20`, filters candidate rows through `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, the linked-site class check at `0x0040c990`, and the current selected-company gate `0x004337a0 == 0x0047efe0`, then republishes matching station ids into both row controls. It also wires the visible summary callback `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50`, the row-activation callback `0x00506ac0`, and the modifier-action callback `shell_station_list_handle_center_or_rename_action` `0x00506d50`, restores the highlighted row from `0x00622ae4`, mirrors the shared selected station latch `0x006cec78+0x4cba` when it still belongs to the current company, and refreshes the two status labels `0x61af` and `0x61b0`. Current grounded caller is `shell_station_list_window_construct` `0x005074c0`, and the same body is re-entered from the later message owner.","objdump + caller inspection + local disassembly + collection scan + row-refresh correlation" -0x005071e0,494,shell_station_list_window_handle_message,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Primary message dispatcher for the shell-side `StationList.win` family rooted at vtable `0x005d177c`. The helper owns the paired station-row controls `0x61a9` and `0x61aa`, the side selector controls `0x61ab` and `0x61ac`, and the two status labels `0x61af` and `0x61b0`. It periodically updates the currently highlighted station id through `0x00622ae4`, mirrors row selections into `0x006cec78+0x4cba`, and on activation resolves the selected station object through collection `0x006cec20`, optionally recenters the world view through `0x00433900`, then re-enters the shell detail-panel manager with mode `5` and that same station id. The `0x61ab` and `0x61ac` controls toggle the active side bit at `0x006d1710`, refresh the side-selector affordances, and reopen the modal station-pick helper through `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`.","objdump + strings + detail-manager correlation + UI dispatch inspection + station-pick-modal correlation" +0x00506f30,672,shell_station_list_window_refresh_rows_selection_and_status,shell,thiscall,inferred,objdump + caller inspection + local disassembly + collection scan,4,"Broad row and status refresh owner for the shell-side `StationList.win` panel. The helper clears the two visible row controls `0x61a9` and `0x61aa`, scans collection `0x006cec20`, filters candidate rows through `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, the linked-site class check at `0x0040c990`, and the current selected-company gate `0x004337a0 == 0x0047efe0`, then republishes matching station ids into both row controls. It also wires the visible summary callback `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50`, the row-activation callback `0x00506ac0`, and the modifier-action callback `shell_station_list_handle_center_or_rename_action` `0x00506d50`, restores the highlighted row from `0x00622ae4`, mirrors the shared selected station latch `0x006cec78+0x4cba` when it still belongs to the current company, and refreshes the two status labels `0x61af` and `0x61b0`. The current local write boundary is tighter too: this refresh owner only reselects the already-latched station id, while the later writes at `0x0050727a` and `0x005072cd` sit in the paired message owner below it. Current grounded caller is `shell_station_list_window_construct` `0x005074c0`, and the same body is re-entered from the later message owner.","objdump + caller inspection + local disassembly + collection scan + row-refresh correlation + selected-station-latch boundary correlation" +0x005071e0,494,shell_station_list_window_handle_message,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Primary message dispatcher for the shell-side `StationList.win` family rooted at vtable `0x005d177c`. The helper owns the paired station-row controls `0x61a9` and `0x61aa`, the side selector controls `0x61ab` and `0x61ac`, and the two status labels `0x61af` and `0x61b0`. It periodically updates the currently highlighted station id through `0x00622ae4`; on message `0xce` it mirrors externally supplied row payloads on controls `0x61a9/0x61aa` directly into the shared selected-station latch `0x006cec78+0x4cba`; and on the activation path it validates the chosen station id through collection `0x006cec20`, mirrors that same id into `[world+0x4cba]`, optionally recenters the world view through `0x00433900`, and then re-enters the shell detail-panel manager with mode `5` and that station id. The `0x61ab` and `0x61ac` controls toggle the active side bit at `0x006d1710`, refresh the side-selector affordances, reopen the modal station-pick helper through `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`, and on success mirror that returned station id into `[world+0x4cba]` before republishing world focus through `0x00433900`.","objdump + strings + detail-manager correlation + UI dispatch inspection + station-pick-modal correlation + selected-station-latch correlation" 0x005074c0,235,shell_station_list_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationList.win` panel later published at `0x006d1708`. The constructor binds the paired station-row controls `0x61a9` and `0x61aa`, seeds the side-selector controls `0x61ab` and `0x61ac` from the current active-side bit at `0x006d1710`, stores the selected-entry latch at `[this+0x78]`, and then calls `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30`. Current grounded evidence places this panel on a station-oriented shell lane below the company roster rather than on a direct company-detail or chairmanship-claim path.","objdump + strings + detail-manager correlation + caller inspection + row-refresh correlation" 0x005075b0,16,shell_station_pick_window_noop_list_aux_callback,shell,cdecl,inferred,objdump + constructor wiring,1,"Tiny no-op callback that immediately returns. Current grounded caller is `shell_station_pick_window_construct` `0x00507620`, which wires it onto list control `0x80ea` with event `0x79`, so this is best read as the inert auxiliary callback slot for the StationPick list rather than as a meaningful command owner.","objdump + constructor wiring + no-op correlation" 0x005075c0,96,shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny `StationPick.win` message normalizer over one incoming shell message record. The helper recognizes the helper's list and scroll messages `0xc9`, `0xca`, and `0xcb`; rewrites list control `0x80ea` and scroll controls `0x80e8/0x80e9` onto the primary select message `0xc9`; and when the rewritten branch comes from control `0x80e9` it also clears the staged station-id latch `0x00622ae8` back to `-1`. This is the safest current read for the StationPick list-or-scroll normalization helper rather than an independent command owner.","objdump + caller inspection + local disassembly + StationPick message normalization" @@ -1372,7 +1376,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004f5ec0,27,shell_paint_terrain_window_is_mode4_variant2,shell,thiscall,inferred,objdump + direct body inspection + caller correlation,4,"Tiny predicate beneath the shell-side `PaintTerrain.win` family. The helper returns true only when current terrain mode `[this+0x90]` equals `4` and the paired variant lane `[this+0xb4]` equals `2`; otherwise it returns false. Current grounded caller is the message-owner branch at `0x004f784b`, which uses this as one narrow terrain special-mode gate before entering the heavier preview path.","objdump + direct body inspection + caller correlation + special-mode predicate correlation" 0x004f5df0,675,shell_paint_terrain_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner caller correlation,4,"Broad owner-side refresh pass for the shell-side `PaintTerrain.win` family. The helper republishes the active terrain mode strip `0x28dd..0x28e6`, several adjacent selector bands rooted at `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x2954`, the current mode-dependent summary labels around `0x291a`, `0x296a`, and `0x296b`, and the three paired scalar rows `0x2a38..0x2a3d` plus the four dynamic rows rooted at `0x292c`. The same pass also propagates the current color preview from `[this+0x80]`, the current mode selector from `[this+0x90]`, and the cached mode-specific scalar lanes `[this+0x94]..[this+0xc8]`. Current grounded callers are the constructor `0x004f7ce0`, the terrain-side dispatcher `0x004f6a60`, the terrain mode setter `0x004f6b50`, and the larger message owner `0x004f6f50`, which keeps this on the shell-side control-band family rather than the world raster brush path.","objdump + constructor correlation + message-owner caller correlation + control-band correlation" 0x004f6070,326,shell_paint_terrain_window_set_rgb_component_and_refresh_preview,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the three RGB-style component controls rooted at `0x294c`, `0x294e`, and `0x2950`. The helper formats the incoming integer payload through localized ids `0x00df`, `0x00e0`, or `0x00e1` depending on the triggering control id, writes the resulting component byte back into global byte strip `0x006d1300..0x006d1302`, composes the preview color dword at `[0x006d1334+0x80]`, and republishes both the dynamic text row and the color preview control `0x296a`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + color-preview correlation" -0x004f61c0,144,shell_paint_terrain_window_increment_generation_count_and_refresh_caption,shell,cdecl,inferred,objdump + callback registration correlation + counter-caption correlation,3,"Small terrain-window callback that increments the current generation or count lane at `[0x006d1334+0xc4]`, mirrors that same value into global `0x0062275c`, formats the new 1-based count through `0x0051b700/0x005193f0` with localized id `0x00e2`, and republishes the result into dynamic-text control `0x290c`. This helper sits on the same callback-root family as the other `PaintTerrain.win` numeric updaters, but the current constructor slice does not yet ground the exact triggering control id.","objdump + callback registration correlation + counter-caption correlation" +0x004f61c0,144,shell_paint_terrain_window_increment_generation_count_and_refresh_caption,shell,cdecl,inferred,objdump + callback registration correlation + counter-caption correlation,3,"Small terrain-window callback that increments the current generation or count lane at `[0x006d1334+0xc4]`, mirrors that same value into global `0x0062275c`, formats the new 1-based count through `0x0051b700/0x005193f0` with localized id `0x00e2`, and republishes the result into dynamic-text control `0x290c`. This helper sits on the same callback-root family as the other `PaintTerrain.win` numeric updaters, and the row is therefore kept at that numeric-updater callback level.","objdump + callback registration correlation + counter-caption correlation" 0x004f6250,309,shell_paint_terrain_window_dispatch_current_mode_to_world,shell,thiscall,inferred,objdump + caller inspection + mode-constant correlation,4,"Mode-dependent world-dispatch helper beneath the shell-side `PaintTerrain.win` family. The helper reads current terrain mode `[this+0x90]` and forwards one matching world-mode request through `0x00452fa0`, currently including constants `0x18`, `0x19`, `0x1a`, `0x1c`, `0x1d`, and `0x2c`, with one fallback path gated through `0x004f5ea0`. When no explicit dispatch is needed it optionally replays the current world-side refresh through `0x00453510` if the caller requested it. Current grounded callers are the terrain mode setter `0x004f6b50`, the larger terrain message owner `0x004f6f50`, and the current brush-state refresh tails that need to mirror the selected shell mode back into world state.","objdump + caller inspection + mode-constant correlation + world-dispatch correlation" 0x004f6390,920,shell_paint_terrain_window_refresh_mode_panels,shell,thiscall,inferred,objdump + constructor correlation + repeated caller correlation,4,"Broad terrain-window mode-panel refresh owner. The helper repaints the current grouped mode selectors and availability strips rooted at `0x2711`, `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x29cd`, toggles the mode families `0x28ab..0x28b4` and `0x28ae..0x28b0`, refreshes current scalar or color readouts under `0x291a`, `0x296a`, and `0x296b`, and repositions three callback-backed rows `0x2a3b..0x2a3d` from the paired coordinate band `[this+0xd8..+0xec]`. It also gates several row styles through the current mode state `[this+0x8c/+0x90/+0x94..+0xc0]`, the helper predicates `0x005586c0` and `0x004f5ea0`, and the live world mode at `0x0062c120+0x2175`. Current grounded callers are the terrain constructor `0x004f7ce0`, the terrain mode setter `0x004f6b50`, the terrain-side dispatcher `0x004f6a60`, and many direct message-owner subbranches under `0x004f6f50`.","objdump + constructor correlation + repeated caller correlation + control-band correlation + mode-panel correlation" 0x004f6930,161,shell_paint_terrain_window_sample_primary_raster_at_world_coords,shell,thiscall,inferred,objdump + caller inspection + field-layout correlation,4,"World-coordinate sample helper beneath the shell-side `PaintTerrain.win` family. The routine converts the caller-supplied world-space float pair into integer sample coordinates by scaling against live world dimensions `[0x0062c120+0x2155/+0x2159]` and the current preview-raster dimensions `[this+0xfc/+0x100]`, clamps those indices against the current primary preview buffer, and on success returns the sampled dword from `[this+0x114]`; otherwise it returns `0`. Current grounded callers are the direct terrain message-owner color-preview branch at `0x004f7186` and the neighboring shell-side setup branch at `0x004deb7b`, so the safest current read is the current preview-raster sampler rather than a direct world-cell query.","objdump + caller inspection + field-layout correlation + preview-raster correlation" @@ -1424,10 +1428,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004e0e40,75,shell_ensure_game_uppermost_window,shell,cdecl,inferred,objdump + strings + caller xrefs,4,Ensures the world-facing GameUppermost.win overlay rooted at 0x006d0820 exists. When absent it allocates a 0xae-byte window object constructs it through game_uppermost_window_construct at 0x004e0b20 stores the result globally and publishes it through the shell runtime at 0x006d401c via 0x00538e50. A grounded caller sits in the shell_transition_mode path near 0x004831c0 immediately after the GameMessage.win bring-up branch which ties this overlay to world-mode entry rather than generic shell UI.,objdump + strings + caller xrefs 0x004fe120,14,shell_has_settings_window,shell,cdecl,inferred,objdump,4,Returns whether the shared settings window object rooted at 0x006d1350 is currently live. The fileopt settings escape branch and direct shell command wrappers both gate on this before opening SettingsWindow.win again.,objdump + caller xrefs 0x004fe130,11,shell_mark_settings_window_dirty,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_settings_window`. The helper stores `1` into `0x006d1360`, which current nearby call patterns treat as the `SettingsWindow.win` refresh or service request latch once the live settings singleton at `0x006d1350` exists. Current grounded callers include the post-step shell-window service ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is also cleared during settings-window open or rebuild paths near `0x00501e50`.","objdump + global-state inspection + frame-caller inspection + settings-window open-path correlation" -0x004fd730,415,shell_settings_window_refresh_miscellaneous_input_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the later `Miscellaneous` page selected by page index `11` in the `SettingsWindow.win` category table. The helper first republishes container controls `0x7546`, `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0`, installs four option labels from the paired localized-id table `0x006228d8/0x006228dc` into control `0x7546`, clamps shell field `[0x006cec74+0x10c]` into the visible selector slot for that same control, then mirrors additional shell and world fields through controls `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0` using the current values at `[0x006d4024+0x1146d7]`, `[0x006cec74+0x283]`, `[0x006cec74+0x28b]`, `[0x006cec74+0x311]`, and `[0x006cec74+0x315]`. The exact player-facing semantics of those fields are still open, but the page ownership and control strip are now grounded.","objdump + local disassembly + settings-window page correlation + control-strip correlation" -0x004fd8d0,104,shell_settings_window_refresh_sandbox_options_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Sandbox Options` page selected by page index `12` in the `SettingsWindow.win` category table. The helper republishes container control `0x759e`, installs five localized option labels from `0x00622a08` into that control, and mirrors the current world-side selector from `[0x006d4024+0x11474e]` back into the visible selection slot. This is the current direct page-refresh owner for the page rooted at localized id `0x55d` `Sandbox Options`, even though the deeper semantics of the underlying selector values are still open.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-mirror correlation" +0x004fd730,415,shell_settings_window_refresh_miscellaneous_input_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the later `Miscellaneous` page selected by page index `11` in the `SettingsWindow.win` category table. The helper first republishes container controls `0x7546`, `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0`, installs four option labels from the paired localized-id table `0x006228d8/0x006228dc` into control `0x7546`, clamps shell field `[0x006cec74+0x10c]` into the visible selector slot for that same control, then mirrors additional shell and world fields through controls `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0` using the current values at `[0x006d4024+0x1146d7]`, `[0x006cec74+0x283]`, `[0x006cec74+0x28b]`, `[0x006cec74+0x311]`, and `[0x006cec74+0x315]`. The row is therefore carried as the page-owned control strip over those shell/world fields.","objdump + local disassembly + settings-window page correlation + control-strip correlation" +0x004fd8d0,104,shell_settings_window_refresh_sandbox_options_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Sandbox Options` page selected by page index `12` in the `SettingsWindow.win` category table. The helper republishes container control `0x759e`, installs five localized option labels from `0x00622a08` into that control, and mirrors the current world-side selector from `[0x006d4024+0x11474e]` back into the visible selection slot. This is the current direct page-refresh owner for the page rooted at localized id `0x55d` `Sandbox Options`, with the selector values carried conservatively at that page-owned level.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-mirror correlation" 0x004fd940,223,shell_settings_window_refresh_dialogs_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Dialogs` page selected by page index `10` in the `SettingsWindow.win` category table. The helper republishes controls `0x7545` and `0x758c..0x7590`, mirrors one shell scalar from `[0x006cec74+0xf8]` into control `0x7545`, and then writes the five dialog-toggle booleans derived from shell fields `[0x006cec74+0x26b]`, `[+0x26f]`, `[+0x273]`, `[+0x277]`, and `[+0x27b]` into controls `0x758c` through `0x7590`. This is therefore the direct dialogs-page refresh owner rather than a generic checkbox helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + toggle-band correlation" -0x004fda20,368,shell_settings_window_refresh_gameplay_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,3,"Refreshes the `Gameplay` page selected by page index `0` in the `SettingsWindow.win` category table. The helper republishes container controls `0x7548`, `0x7591`, `0x7592`, `0x7599`, `0x759c`, and `0x7544`, installs six option labels from `0x006228f8` into control `0x7548` and three paired labels from `0x00622910/0x00622914` into control `0x7591`, then mirrors several current shell or world values through those controls from `[0x006cec74+0xf4]`, `[+0x22f]`, `[+0x263]`, `[+0x2cc]`, `[+0x309]`, `[+0x0a8]`, and `[0x006d4024+0x114742]`. The exact gameplay-setting meanings of the individual fields are still open, but the page ownership and control strip are now grounded.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + control-strip correlation" +0x004fda20,368,shell_settings_window_refresh_gameplay_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,3,"Refreshes the `Gameplay` page selected by page index `0` in the `SettingsWindow.win` category table. The helper republishes container controls `0x7548`, `0x7591`, `0x7592`, `0x7599`, `0x759c`, and `0x7544`, installs six option labels from `0x006228f8` into control `0x7548` and three paired labels from `0x00622910/0x00622914` into control `0x7591`, then mirrors several current shell or world values through those controls from `[0x006cec74+0xf4]`, `[+0x22f]`, `[+0x263]`, `[+0x2cc]`, `[+0x309]`, `[+0x0a8]`, and `[0x006d4024+0x114742]`. The row is therefore carried as the page-owned control strip over those gameplay-page shell/world fields.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + control-strip correlation" 0x004fdb90,480,shell_settings_window_refresh_sound_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Sound` page selected by page index `1` in the `SettingsWindow.win` category table. The helper first queries the active sound backend through `0x005314b0`; when no backend is available it disables the main controls `0x7534` and `0x753f`. On the live-backend path it republishes control families `0x7551` and `0x754f`, enumerates six backend labels from `0x006229e4`, mirrors one backend selection through `0x00531640/0x005316d0`, installs the localized sample-rate or quality label rooted at id `0x584`, and then writes the derived backend scalar or enable state back into the visible controls. This is now the direct sound-page refresh owner rather than an unnamed backend probe loop.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + audio-backend correlation" 0x004fd550,250,shell_settings_window_refresh_draw_distance_companion_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + localized-label correlation,4,"Refreshes the companion selector strip beneath the main `Draw Distance` page choice. The helper republishes controls `0x7566`, `0x7596`, `0x7560`, `0x7562`, and `0x7564`, then mirrors the current shell graphics-option slots selected through `0x00484ae0(8)`, `0x00484ae0(0x0d)`, `0x00484ae0(7)`, and `0x00484ae0(9)` back into those controls. The `0x7566` label family uses the localized quality table rooted at ids `0x578..0x57d` plus `0x269`, and control `0x7596` shows the inverted small scalar `4 - option(0x0d)`. Current grounded caller is `shell_settings_window_refresh_draw_distance_page` `0x004feb20`, and the local graphics-selector callback strip also re-enters this helper, so the safest current read is the draw-distance companion-control refresh owner rather than a generic selector helper.","objdump + local disassembly + settings-window page correlation + localized-label correlation + selector-mirror correlation" 0x004fd650,211,shell_settings_window_refresh_textures_companion_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + selector-mirror correlation,4,"Refreshes the companion selector strip beneath the main `Textures` page choice. The helper republishes controls `0x756e`, `0x756a`, `0x756c`, and `0x7570`, then mirrors the current shell graphics-option slots selected through `0x00484ae0(6)`, `0x00484ae0(4)`, `0x00484ae0(5)`, and `0x00484ae0(3)` into those visible controls. Current grounded caller is the textures-side selector callback path immediately below the settings dispatcher, so this is the strongest current read for the textures companion-control refresh helper rather than a generic selector mirror.","objdump + local disassembly + settings-window page correlation + selector-mirror correlation" @@ -1438,7 +1442,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004fe730,53,shell_settings_window_refresh_textures_primary_selector,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation,4,"Small selector-mirror helper for the main `Textures` control `0x7569`. The helper reads shell graphics option slot `2` through `0x00484ae0`, remaps non-`-1` selections through the same compact table at `0x00622990`, and republishes the resulting visible selector index into field `0x66` on control `0x7569`. Current grounded caller is the neighboring graphics-settings callback branch at `0x004ff30c` immediately after `shell_set_graphics_option_with_fanout` stores option `3`, so this is the textures primary-selector refresh sibling rather than a generic table lookup.","objdump + local disassembly + settings-window callback correlation + selector-remap correlation" 0x004feb20,176,shell_settings_window_refresh_draw_distance_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Draw Distance` page selected by page index `4` in the `SettingsWindow.win` category table. The helper installs the shared six-label selector family from `0x00622964` into control `0x755f`, mirrors the current selector derived from `0x00484ae0(1)` into that control, re-enters `0x004fd550` for the paired companion refresh, and mirrors world byte `[0x006d4024+0x1146b8]` into control `0x7568`. This is now the direct draw-distance-page refresh owner rather than a generic selector helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation" 0x004febd0,112,shell_settings_window_refresh_textures_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Textures` page selected by page index `5` in the `SettingsWindow.win` category table. The helper installs the shared six-label selector family from `0x00622964` into control `0x7569`, mirrors the current selector derived from `0x00484ae0(2)` into that control, and re-enters `0x004fe730` to republish the compact visible selector state. This is now the direct textures-page refresh owner rather than another generic selector helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation" -0x004fdd70,432,shell_settings_window_refresh_graphics_misc_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the first `Miscellaneous` page selected by page index `6` in the `SettingsWindow.win` category table. The helper republishes control families `0x7573` and `0x7574`, installs three paired localized option rows from ids `0xe18..0xe1d`, mirrors one world selector from `[0x006d4024+0x114736]`, mirrors another from `[0x006d4024+0x1146b3]`, compares world float `[0x006d4024+0x1146af]` against the fixed threshold at `0x005c8628`, mirrors world byte `[0x006d4024+0x1146a8]`, mirrors world byte `[0x006d4024+0x1146e3]`, and finally mirrors one shell-side gate derived through `0x00484af0(0x0c)` into control `0x7586`. The exact player-facing names of those toggles remain open, but the page ownership and world-field strip are now grounded.","objdump + local disassembly + settings-window page correlation + control-strip correlation + world-field correlation" +0x004fdd70,432,shell_settings_window_refresh_graphics_misc_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the first `Miscellaneous` page selected by page index `6` in the `SettingsWindow.win` category table. The helper republishes control families `0x7573` and `0x7574`, installs three paired localized option rows from ids `0xe18..0xe1d`, mirrors one world selector from `[0x006d4024+0x114736]`, mirrors another from `[0x006d4024+0x1146b3]`, compares world float `[0x006d4024+0x1146af]` against the fixed threshold at `0x005c8628`, mirrors world byte `[0x006d4024+0x1146a8]`, mirrors world byte `[0x006d4024+0x1146e3]`, and finally mirrors one shell-side gate derived through `0x00484af0(0x0c)` into control `0x7586`. The row is therefore carried as the page-owned world-field strip over those graphics-misc toggles.","objdump + local disassembly + settings-window page correlation + control-strip correlation + world-field correlation" 0x004fdf20,164,shell_settings_window_refresh_scrolling_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Scrolling` page selected by page index `8` in the `SettingsWindow.win` category table. The helper mirrors four shell-side scalar settings from `[0x006cec74+0x114]`, `[+0x118]`, `[+0x11c]`, and `[+0x120]` into controls `0x757d`, `0x757f`, `0x7581`, and `0x7584`, and then mirrors the boolean companion derived from `[0x006cec74+0x120]` into control `0x7585`. This is therefore the direct scrolling-page refresh owner rather than a generic slider helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + shell-scalar correlation" 0x004fdfd0,421,shell_settings_window_refresh_camera_controls_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Camera Controls` page selected by page index `9` in the `SettingsWindow.win` category table. The helper republishes control families `0x7587` and `0x7588`, installs twenty-five localized labels from `0x00620dd8` into control `0x7587`, mirrors the current shell-side selector from `[0x006cec74+0x233]` plus companion `[+0x237]` back into that control, then installs ten localized labels `0x0a9f..0x0aa8` from `0x00620e3c` into control `0x7588` and mirrors the paired shell-side selector from `[0x006cec74+0x23b]` plus companion `[+0x23f]`. The current label tables now ground `0x7587` as the day-night cycling selector rooted at `Normal day/night cycling` through `Frozen at 11pm`, and `0x7588` as the weather-cycling selector rooted at `Normal weather cycling` through `Frozen at storms`. This is therefore the direct camera-controls page refresh owner rather than a partially anonymous page helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + label-table correlation + selector-family correlation" 0x004fec60,383,shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report,shell,thiscall,inferred,objdump + local disassembly + settings-window correlation,4,"Rebuilds one `SettingsWindow.win` list control from the current sorted hotkey report. The helper first resolves the live settings window shell object through control id `0x757a`, caches the current selection dword from `[control+0x1e2]`, destroys and reallocates the temporary list owner at `0x006d1354`, and seeds that owner as an `0x88`-stride list model through `0x00518b90`. It then iterates the current binding report through `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250`, formats the action-stem column and the display-label column into local strings, appends each row through the list-model vtable at `[0x006d1354]+0x04`, and republishes the finished row into the live window through `0x00540120(control_id=0x757a, field_id=0x88, ...)`. After the rebuild it restores the saved selection through `0x00561840`. Current grounded caller is the `SettingsWindow.win` hotkeys side around `0x004fed16`, so the safest current read is the hotkeys-list rebuild body rather than a generic shell list refresher.","objdump + local disassembly + settings-window correlation + list-model correlation + hotkey-report correlation" @@ -1455,9 +1459,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004ff1b0,115,shell_settings_window_handle_draw_distance_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the main `Draw Distance` selector. The helper packages the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060` as option slot `9`, skips further work when the local refresh latch `0x006d135c` is armed, and otherwise re-enters `shell_settings_window_refresh_draw_distance_primary_selector` `0x004fe6f0`. Current grounded dispatcher-side callsite sits at `0x004ff1f3`, which makes this the draw-distance selector-change owner rather than a generic option setter.","objdump + local disassembly + settings-window callback correlation + selector-refresh correlation" 0x004ff2e0,52,shell_settings_window_handle_textures_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the main `Textures` selector. The helper packages the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060` as option slot `3`, skips the follow-on when local latch `0x006d135c` is armed, and otherwise re-enters `shell_settings_window_refresh_textures_primary_selector` `0x004fe730`. Current grounded dispatcher-side callsite sits at `0x004ff30c`, which makes this the textures selector-change owner rather than another compact remap stub.","objdump + local disassembly + settings-window callback correlation + selector-refresh correlation" 0x004ff58a,33,shell_settings_window_toggle_misc_input_page_display_runtime_byte_1146d7,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the later `Miscellaneous` input page field mirrored from display-runtime byte `[0x006d4024+0x1146d7]` into control `0x7547`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. This is therefore the direct toggle owner for that page-owned byte rather than an anonymous dispatcher leaf.","objdump + local disassembly + settings-window page correlation + persistence correlation" -0x004ff5b6,37,shell_settings_window_toggle_misc_input_page_shell_flag_28b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the later `Miscellaneous` input page field `[0x006cec74+0x28b]`, currently mirrored into control `0x7594`. The helper flips the dword between `0` and `1`, raises the shared shell config-save tail through `0x00484910(1)`, and returns. Current evidence keeps the label field-based because the exact caption is still open.","objdump + local disassembly + settings-window page correlation + config-save correlation" +0x004ff5b6,37,shell_settings_window_toggle_misc_input_page_shell_flag_28b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the later `Miscellaneous` input page field `[0x006cec74+0x28b]`, currently mirrored into control `0x7594`. The helper flips the dword between `0` and `1`, raises the shared shell config-save tail through `0x00484910(1)`, and returns. The row is therefore kept at that field-based settings caption level.","objdump + local disassembly + settings-window page correlation + config-save correlation" 0x004ff5e6,70,shell_settings_window_toggle_misc_input_page_shell_flag_283_and_refresh_game_window_affordance,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the later `Miscellaneous` input page field `[0x006cec74+0x283]`, currently mirrored into control `0x7593`. The helper flips the dword, persists shell config through `0x00484910(1)`, and when the live `Game.win` singleton at `0x006d0818` exists it republishes one page-local affordance through `0x004dd8d0` using the new boolean value. This is therefore the direct owner for the `+0x283` settings toggle plus its `Game.win` follow-on refresh.","objdump + local disassembly + settings-window page correlation + config-save correlation + Game.win follow-on correlation" -0x004ff637,37,shell_settings_window_toggle_dialogs_page_shell_scalar_f8,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the `Dialogs` page scalar `[0x006cec74+0xf8]`, mirrored into control `0x7545`. The helper flips the dword between `0` and `1`, persists shell config through `0x00484910(1)`, and returns. Current evidence keeps the label structural because the caption is not yet grounded.","objdump + local disassembly + settings-window page correlation + config-save correlation" +0x004ff637,37,shell_settings_window_toggle_dialogs_page_shell_scalar_f8,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the `Dialogs` page scalar `[0x006cec74+0xf8]`, mirrored into control `0x7545`. The helper flips the dword between `0` and `1`, persists shell config through `0x00484910(1)`, and returns. The row is therefore kept at that structural settings-caption level.","objdump + local disassembly + settings-window page correlation + config-save correlation" 0x004ff667,37,shell_settings_window_toggle_dialogs_page_flag_26b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x26b]`, currently mirrored into the checkbox strip rooted at control `0x758c`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation" 0x004ff697,37,shell_settings_window_toggle_dialogs_page_flag_26f,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x26f]`, currently mirrored into the checkbox strip rooted at control `0x758d`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation" 0x004ff6c7,37,shell_settings_window_toggle_dialogs_page_flag_273,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x273]`, currently mirrored into the checkbox strip rooted at control `0x758e`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation" @@ -1473,12 +1477,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004ffd10,351,shell_settings_window_handle_graphics_range_custom_mode_toggle,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Settings-window callback branch for the graphics-range custom-mode affordance rooted at control `0x7555`. When the custom-mode flag from `shell_query_graphics_range_custom_mode_flag` `0x0051fd40` is already set it disables that flag through `shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed` `0x00520fd0(0)` and persists the display-runtime block through `0x0051eea0`. Otherwise it first checks `shell_query_graphics_range_has_live_custom_payload` `0x0051fd00`; when no live custom payload exists it clears the control and presents one small localized notice through `0x005193f0(0x0e17) -> 0x004c98a0(mode=1)`. When a live payload does exist it uses shell byte `[0x006cec74+0x2d1]` as a one-shot warning gate, raises the shared shell refresh latch through `0x00484910(1)`, presents the confirmation dialog `0x005193f0(0x0e16) -> 0x004c98a0(mode=3)`, and only on the affirmative path re-enters `shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed` `0x00520fd0(1)`, persists the display runtime, and republishes the same control. If the setter immediately clears the flag again it falls back to the localized notice path `0x005193f0(0x0e93) -> 0x004c98a0(mode=1)`. This is therefore the user-facing graphics-range custom-mode toggle owner rather than a generic dialog wrapper.","objdump + local disassembly + settings-window dispatcher correlation + graphics-range-control correlation + dialog-path correlation" 0x004ffe72,48,shell_settings_window_handle_graphics_range_scalar_zero_nonzero_toggle,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Small graphics-range scalar toggle beneath `SettingsWindow.win`. The helper reads the current scalar through `shell_query_graphics_range_scalar` `0x0051fd60`, collapses that to a zero-vs-nonzero boolean, inverts it, forwards the requested replacement through `shell_set_graphics_range_scalar_and_reapply_if_needed` `0x00521030`, and then persists the display-runtime block through `0x0051eea0`. Current grounded location is the same graphics-side callback strip as `0x004ffd10`, so this is the safest current read for the zero/nonzero graphics-range scalar toggle rather than a generic integer setter.","objdump + local disassembly + settings-window dispatcher correlation + graphics-range-scalar correlation" 0x004ffea4,91,shell_settings_window_toggle_display_runtime_preview_rect_notify_flag,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146eb]` beneath `SettingsWindow.win`. The helper flips the byte, and when the global world-root at `0x0062c120` is live and the new value becomes zero it emits one large world-space rect notification through `0x0044e940(0,0,0x270f,0x270f,0)` before persisting the display-runtime block through `0x0051eea0`. Current evidence safely bounds this as one preview-rect notify toggle in the graphics-side settings family rather than a fully named presentation option.","objdump + local disassembly + settings-window dispatcher correlation + world-rect-notify correlation" -0x004ffeff,46,shell_settings_window_toggle_display_runtime_dword_114697,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime dword `[0x006d4024+0x114697]` beneath `SettingsWindow.win`. The helper flips the dword between `0` and `1` and immediately persists the display-runtime block through `0x0051eea0`. Current evidence keeps the field name conservative because no stronger user-facing semantic owner is grounded yet.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" +0x004ffeff,46,shell_settings_window_toggle_display_runtime_dword_114697,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime dword `[0x006d4024+0x114697]` beneath `SettingsWindow.win`. The helper flips the dword between `0` and `1` and immediately persists the display-runtime block through `0x0051eea0`. The row is therefore kept at that conservative field-owned level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" 0x004fff2d,37,shell_settings_window_toggle_display_runtime_byte_1146e9,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146e9]` beneath `SettingsWindow.win`. The helper flips the byte and immediately persists the display-runtime block through `0x0051eea0`. Current evidence keeps the label structural because the exact player-facing option name is still ungrounded.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" 0x004fff59,41,shell_settings_window_toggle_display_runtime_byte_1146b8,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146b8]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. Current adjacent disassembly keeps this on the graphics or model-detail side of the settings dispatcher, but the exact player-facing caption is still ungrounded.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" 0x004fff85,86,shell_settings_window_toggle_display_runtime_scalar_1146af_between_0_and_0_5,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Small scalar toggle branch for display-runtime float `[0x006d4024+0x1146af]` beneath `SettingsWindow.win`. The helper compares the current scalar against `0.5`, stores `0.0` when the current value is already at or below that threshold, otherwise stores `0.5`, and then persists the display-runtime block through `0x0051eea0`. This is therefore the clearest current owner for a binary `0.0` vs `0.5` display scalar toggle inside the settings dispatcher.","objdump + local disassembly + settings-window dispatcher correlation + scalar-threshold correlation" -0x004fffde,46,shell_settings_window_toggle_display_runtime_byte_1146a8,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146a8]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. Current evidence is still structural rather than caption-level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" -0x0050000a,46,shell_settings_window_toggle_display_runtime_byte_1146e3,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146e3]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. This is the direct byte-toggle owner mentioned more broadly in the settings dispatcher note, but its exact user-facing caption is still open.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" +0x004fffde,46,shell_settings_window_toggle_display_runtime_byte_1146a8,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146a8]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. The row is therefore kept at that structural field-owned level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" +0x0050000a,46,shell_settings_window_toggle_display_runtime_byte_1146e3,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146e3]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. This is the direct byte-toggle owner mentioned more broadly in the settings dispatcher note, kept at that field-owned caption level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation" 0x00500036,51,shell_settings_window_apply_graphics_misc_option_family12_from_checkbox_state,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Settings-window callback leaf for the first `Miscellaneous` graphics page option family derived through `0x00484af0(0x0c)`, currently mirrored into control `0x7586` by `shell_settings_window_refresh_graphics_misc_page` `0x004fdd70`. The helper reads the incoming checkbox-state bit from `[msg+0x2c]+0xcc`, forwards that boolean into `shell_set_graphics_option_with_fanout` `0x00485060(option_family=0x0c)`, and then persists the display-runtime block through `0x0051eea0`. This is therefore the direct apply leaf for that graphics-misc option family rather than another anonymous message stub.","objdump + local disassembly + settings-window page correlation + graphics-option-family correlation + persistence correlation" 0x0050006c,46,shell_settings_window_toggle_shared_setup_config_flag_247,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x247]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is one of the same three persisted booleans later mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`, so the safest current read is the shared setup-config toggle rather than a page-local-only setting.","objdump + local disassembly + settings-window and setup correlation + config-save correlation" 0x0050009c,46,shell_settings_window_toggle_shared_setup_config_flag_24b,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x24b]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is one of the three persisted booleans also mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`.","objdump + local disassembly + settings-window and setup correlation + config-save correlation" @@ -1493,7 +1497,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00468b10,58,multiplayer_preview_dataset_register_selector_callback_if_absent,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-callback registration helper over the keyed descriptor owner at `[this+0x04]`. It first probes the keyed store through `0x0053daa0(selector)` and, when no existing entry is present, inserts the caller-supplied callback pointer through `0x0053d960(selector, callback)` before returning success. Current grounded caller is the broader preview-dataset callback seeding pass `0x00473280`, which uses this helper to populate selector handlers `1..0x83`, so this is the clean local registration primitive beneath that callback-registry owner rather than a generic keyed insert.","objdump + local disassembly + registration-pass correlation + keyed-store correlation" 0x00468b50,7,multiplayer_preview_dataset_set_default_callback_root,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,Tiny setter that stores one caller-supplied callback root into `[this+0x08]`. Current grounded caller is the broader preview-dataset callback registration pass `0x00473280`, which seeds this slot with `0x0046f4a0` before populating the keyed selector table.,objdump + local disassembly + caller inspection + callback-root correlation 0x00468d00,222,multiplayer_update_semicolon_name_list,shell,cdecl,inferred,ghidra-headless,4,Adds or removes one player-name token in the semicolon-delimited moderation list rooted at `[ecx+0x905c]`. With mode `1` it appends the supplied token only when not already present writing `;` as the delimiter; with mode `0` it removes the matched token collapses the remainder left and skips an adjacent delimiter when present.,ghidra + rizin + llvm-objdump + strings -0x00468de0,14,multiplayer_session_event_forward_action1_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that always forwards request id `1` through multiplayer_set_pending_session_substate with a zero auxiliary payload. The callback clears EDX before the shared setter call and currently lands on a request id that does not yet map to a visible pending substate so this row remains structural.,ghidra + rizin + llvm-objdump +0x00468de0,14,multiplayer_session_event_forward_action1_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that always forwards request id `1` through multiplayer_set_pending_session_substate with a zero auxiliary payload. The callback clears EDX before the shared setter call and currently lands on a request id whose visible pending-substate label is not surfaced locally, so the row remains at that structural request-forwarding level.,ghidra + rizin + llvm-objdump 0x00468e00,188,multiplayer_session_event_publish_pair_chat_template,shell,unknown,inferred,ghidra-headless,3,Session-event callback that formats one two-string chat/status line through multiplayer_route_chat_line when the callback status in EDX is zero and the current live session count is not positive. A selector near `[esp+0x214]` chooses the template `%s* %s` `%s %s` or `%s > %s`; the helper length-checks both inputs against the local 0x1f4-byte buffer before formatting and returns without publishing when either string is null or too long.,ghidra + rizin + llvm-objdump + strings 0x00468ec0,144,multiplayer_session_event_publish_action2_single_name,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the one-name action-2 status path. When the callback status in EDX is zero and the current session count is positive it length-checks the supplied name formats localized text id `0xb73` routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with that same name payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump 0x00468f50,192,multiplayer_session_event_publish_action2_pair,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the two-string action-2 status path. When the callback status in EDX is zero and the supplied name lengths fit within the local buffer it formats localized text id `0xb74` or `0xe34` depending on whether the first string is present routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with the second string as the target payload and the first string as the auxiliary payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump @@ -1771,7 +1775,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation" 0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation" 0x00482e50,271,shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shell-state owner beneath `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` and the setup-mode selector `0x00502c00`. The helper writes the caller-supplied boolean into editor-map mode field `[this+0x68]`, then splits its refresh side effects by that target mode. When the target mode is `0` it re-enters `0x004d44a0` and `0x004dfda0` when the detail-panel controller `0x006d0818` is live, refreshes the active world root through `world_compute_transport_and_pricing_grid` `0x0044fb70` when `0x0062c120` exists, and then re-enters `shell_apply_graphics_option_runtime_effects` `0x00484d70` with mask `0x0d` and stack flag `1`. When the target mode is nonzero it instead re-enters `shell_ensure_editor_panel_window` `0x004d4500` before the same `0x00484d70(0x0d, 1)` tail. Current evidence is strong enough to treat this as the real editor-map-mode setter plus dependent detail-panel, world, and graphics refresh owner.","objdump + local disassembly + caller inspection + editor-map-mode correlation + side-effect correlation" -0x00483680,17,shell_command_cycle_display_resolution_forward,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,2,"Small registered shell command beneath action id `0x78` and localized label id `0x0d52`. The helper fixes forward step `+1` in `ECX` and tail-calls `shell_cycle_display_resolution_and_publish_status` `0x00483780`. Current evidence is strong enough for the command-wrapper role and step direction, but not yet for a tighter player-facing label beyond the display-resolution cycle.","objdump + command-registration correlation + local disassembly + caller inspection + wrapper correlation" +0x00483680,17,shell_command_cycle_display_resolution_forward,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,2,"Small registered shell command beneath action id `0x78` and localized label id `0x0d52`. The helper fixes forward step `+1` in `ECX` and tail-calls `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The row is therefore kept at that display-resolution-cycle wrapper and step-direction level.","objdump + command-registration correlation + local disassembly + caller inspection + wrapper correlation" 0x00483780,527,shell_cycle_display_resolution_and_publish_status,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Broader display-resolution cycle owner reached from the small forward and backward wrappers at `0x00483680`, `0x00483990`, and `0x004839a0`. The helper requires live shell presenter root `0x006d4024`, reads the current display mode through the active mode table and the paired width-bucket tables at `0x00620e64` and `0x00620e7c`, derives one bounded six-step cycle from the caller-supplied signed step in `ECX`, selects the next supported resolution pair, and applies that requested size through `0x005206b0`. It then formats and publishes a status string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, refreshes dependent presentation state through `0x004625b0`, persists the graphics config through `0x00484910(1)`, and re-enters the neighboring shell follow-on `0x004821d0`. Current evidence is strong enough to treat this as the shared display-resolution cycle-and-apply owner rather than a narrower presenter-only math helper.","objdump + local disassembly + caller inspection + display-mode-table correlation + status-publish correlation" 0x00483990,8,shell_cycle_display_resolution_forward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `+1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain forward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation" 0x004839a0,8,shell_cycle_display_resolution_backward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `-1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain backward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation" @@ -1906,7 +1910,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0053e370,2744,shell_image_marker_payload_construct_from_banked_record_key,shell,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Constructor for the same typed type-`6` image-marker payload used by the banked-record staging family. The helper seeds default dimension and scaling fields, opens one selected support-family record stream through `0x0053bd40/0x0053c9c0/0x0053b7c0`, tokenizes the record text through `0x0051d9d0`, parses the grounded keyword set (`Image`, `ImageWH`, `ImageWHForceScale`, `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`, `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`, `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`, `HorizontalScaleModifier`, `VerticalScaleModifier`), registers one shell helper token through `[0x006d401c+0xc69]`, derives local extent ratios `[this+0x2e/+0x32]`, and finally enters `0x0053de60` to build the live variant table. Current grounded constructor wrapper is `0x0053ee70`, and the typed acquire-or-create owner `0x0053c070` already binds payload type `6` to that wrapper, so this is the safest current read for the type-`6` banked-record payload constructor rather than a generic text parser.","objdump + caller inspection + local disassembly + rdata string decode + typed-payload correlation" 0x0053ee60,5,shell_image_marker_payload_release_thunk,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tail-call thunk into `shell_image_marker_payload_release_variant_table_image_handle_and_label` `0x0053e2e0`. Current grounded caller is the typed-row release family beneath `0x0053c000/0x0053c070`, so the safest current read is a narrow type-`6` payload release thunk rather than an independent owner.","objdump + caller inspection + local disassembly + typed-payload correlation" 0x0053ee70,17,shell_image_marker_payload_construct_wrapper,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Thin wrapper above `shell_image_marker_payload_construct_from_banked_record_key` `0x0053e370`. The helper forwards the caller record key into the heavier constructor and then returns `this` unchanged. Current grounded callers are the typed type-`6` staging-row acquire path at `0x0053c070` and the broader banked-record family, so this is the safest current read for the type-`6` payload constructor wrapper rather than another parser owner.","objdump + caller inspection + local disassembly + typed-payload correlation" -0x0053ee90,104,shell_load_named_or_fallback_ui_image_handle_into_global_slot_table_ccba60,shell,cdecl,inferred,objdump + local disassembly + import-shape correlation,1,"Small shell image-handle loader over the global slot table rooted at `0x00ccba60`. The helper formats one resource name from the string table rooted at `0x00625258` plus a caller-selected index and one of two templates at `0x005dd7f0/0x005dd80c`, forwards that string into the USER32 image-load import at `0x005c829c`, and on failure falls back to the stock-image import at `0x005c82a0` with id `0x7f00`. The resolved handle is then stored into slot `0x00ccba60 + (arg0*0x17 + arg1)*4`. Current evidence is strong enough for a named-or-fallback UI image-handle loader, but not yet for the exact player-facing slot family.","objdump + local disassembly + import-shape correlation + global-slot-table correlation" +0x0053ee90,104,shell_load_named_or_fallback_ui_image_handle_into_global_slot_table_ccba60,shell,cdecl,inferred,objdump + local disassembly + import-shape correlation,1,"Small shell image-handle loader over the global slot table rooted at `0x00ccba60`. The helper formats one resource name from the string table rooted at `0x00625258` plus a caller-selected index and one of two templates at `0x005dd7f0/0x005dd80c`, forwards that string into the USER32 image-load import at `0x005c829c`, and on failure falls back to the stock-image import at `0x005c82a0` with id `0x7f00`. The resolved handle is then stored into slot `0x00ccba60 + (arg0*0x17 + arg1)*4`. The row is therefore kept at that named-or-fallback UI image-slot level.","objdump + local disassembly + import-shape correlation + global-slot-table correlation" 0x0053b010,11,bootstrap_mark_runtime_started,bootstrap,cdecl,inferred,ghidra-headless,2,Single-purpose bootstrap helper that flips a process-global started flag to one before branding and shell setup continue.,ghidra + rizin 0x0054e6d0,42,bootstrap_capture_keyboard_state,bootstrap,cdecl,inferred,ghidra-headless,4,Single-purpose bootstrap probe that snapshots the host keyboard state through GetKeyboardState.,ghidra + rizin 0x00540a47,75,shell_control_refresh_matching_dynamic_text_payload,shell,unknown,inferred,objdump + caller inspection,3,"Small shell-control helper used on one matching control descriptor during refresh or replacement. When the incoming control id matches `[control+0x4]`, the helper frees any prior heap-backed text payload at `[control+0xce]`, clears that field, optionally copies a replacement payload from the caller descriptor through `0x0051d820`, and then returns `0` when the incoming control type is `0x6f` or `1` otherwise. Current grounded importance is the `CompanyDetail.win` section-0 overview widget `0x947f`: together with the sibling helper at `0x005639d2`, this makes type `0x6f` look like a special heap-backed dynamic-text control rather than an ordinary callback widget.","objdump + caller inspection + type-0x6f control correlation" @@ -2031,7 +2035,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0052cdc0,22,embedded_view_controller_store_aux_triplet_0x2c_0x34,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion to `0x0052cda0` over the same controller base. The helper stores three caller dwords into auxiliary triplet `[this+0x2c/+0x30/+0x34]`. Current grounded callers are the setup-side world-view branches `0x004592ef` and `0x00459b7b`, so this is the safest current read for the auxiliary-triplet store helper rather than a broader camera-mode owner.","objdump + caller inspection + local disassembly + controller-base correlation" 0x0052cde0,48,embedded_view_controller_set_dirty_latch_0x64_and_optionally_snapshot_focus_eye_heading_distance_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Dirty-latch helper over the embedded controller base. The function stores the caller boolean into byte `[this+0x64]`; when the boolean is zero it also snapshots the current heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the cached companion band `[this+0x44/+0x48/+0x38/+0x3c/+0x40/+0x4c]`. Current grounded caller is `0x0052c2ef`, so this is the safest current read for the primary dirty-latch and cached focus-eye-orientation snapshot helper rather than a generic flag setter.","objdump + caller inspection + local disassembly + controller-base correlation" 0x0052ce20,54,embedded_view_controller_set_dirty_latch_0x65_and_optionally_snapshot_focus_heading_distance_band_0x72_0x86,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Secondary dirty-latch helper over the same controller base. The function stores the caller boolean into byte `[this+0x65]`; when that boolean is zero it snapshots heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the secondary companion band `[this+0x72/+0x76/+0x7a/+0x7e/+0x82/+0x86]`. Current grounded caller is the later owner branch `0x0052cc5d`, so this is the safest current read for the secondary dirty-latch and cached snapshot helper rather than a generic mode toggle.","objdump + caller inspection + local disassembly + controller-base correlation" -0x0052ce60,5,embedded_view_controller_raise_dirty_latch_0x64,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny leaf over the embedded controller base that only sets dirty byte `[this+0x64] = 1`. Current evidence grounds it as a direct dirty-latch raiser and does not yet justify a broader semantic name.","objdump + local disassembly + controller-base correlation" +0x0052ce60,5,embedded_view_controller_raise_dirty_latch_0x64,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny leaf over the embedded controller base that only sets dirty byte `[this+0x64] = 1`. Current evidence keeps it at the direct dirty-latch raiser level.","objdump + local disassembly + controller-base correlation" 0x0052ce70,43,embedded_view_controller_refresh_shell_presenter_scalar_0x6a_and_consume_dirty_latch_0x64,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small shell-state synchronization helper over the same controller base. The function compares cached scalar `[this+0x6a]` against current shell presenter dword `[0x006d4024+0x114222]`, raises dirty byte `[this+0x64]` and stores the new shell scalar when they differ, then returns the prior dirty state and clears `[this+0x64]` back to zero. Current grounded caller is `0x0052c29c`, so this is the safest current read for the shell-scalar refresh plus dirty-latch consume helper rather than a generic poll routine.","objdump + caller inspection + local disassembly + controller-base correlation + shell-scalar correlation" 0x0052cea0,19,embedded_view_controller_copy_heading_pitch_pair_to_two_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny heading/pitch export helper over the embedded controller base. The function copies lanes `[this+0x10/+0x14]` into two caller out-pointers. Current grounded caller is the later support branch `0x00566700`, so this is the safest current read for the heading-pitch pair copy helper rather than a broader serializer fragment.","objdump + caller inspection + local disassembly + controller-base correlation" 0x0052cec0,49,embedded_view_controller_sample_owner_height_at_current_eye_xz,shell,thiscall,inferred,objdump + local disassembly,1,"Small owner-height query helper beneath the same controller base. The function scales current eye X/Z lanes `[this+0x1c/+0x24]` through the recurring world-unit constants, then forwards the resulting pair into owner handle `[this+0x6e]` through `0x00534490`. Current evidence grounds it as the direct sampled-height query at the controller's current eye X/Z position.","objdump + local disassembly + controller-base correlation + sampled-height correlation" @@ -2061,13 +2065,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0052db10,224,runtime_object_store_scalar_0x69_mark_transform_dirty_and_materialize_group_packet_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader grouped-subrecord materialization helper beneath the same `0x23a` runtime-object family. The function stores one caller-supplied scalar into `[this+0x69]`, sets dirty bit `0x02` in state byte `[this+0x20]`, raises byte `[this+0x8d]`, resolves the currently selected group header from `[this+0x14]` and group index `[this+0x3a]`, and then walks every `0x45`-byte row in that group. For each row it caches the active row pointer in globals `0x00cc3b58/0x00cc3b6c`, lazily allocates row-local payload storage when `[row+0x35]` is still null, copies the row's packed source span there, zero-fills the trailing companion area, and advances to the next row. Current grounded callers are the vehicle-side visual builders `0x00485a1d` and `0x00485a68` plus the shell-side presentation branch `0x005287af`, so this is the safest current read for storing scalar lane `[+0x69]` and materializing the current group's packet rows rather than a pure allocator helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + packet-row correlation" 0x0052dc00,240,runtime_object_bucket_materialized_group_packet_rows_by_four_float_thresholds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Companion grouped-row helper immediately above `0x0052db10` in the same `0x23a` runtime-object family. When byte latch `[this+0x8d]` is live and local bucket byte `[this+0x5b]` is still below `2`, the function increments that bucket, stores one caller float into threshold lane `[this+0x69 + bucket*4]`, resolves the currently selected `0x45`-byte group, and then walks every materialized row payload at `[row+0x35]`. For each copied entry it compares the entry's two stored floats against the four caller-supplied threshold bounds and, on success, writes the current bucket byte into the compact trailing byte band of the copied row payload. Current grounded callers are the vehicle-side visual builders `0x00485a8c`, `0x00485ab0`, `0x00485ad4`, and `0x00485af8`, so this is the safest current read for bucketing the materialized group packet rows by threshold windows rather than a generic float clamp.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + threshold-bucket correlation" 0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin -0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" -0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" +0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly" +0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly" 0x0052eb80,7,runtime_object_constant_float_1_25_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly + rdata inspection,1,"Tiny float-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper loads and returns the constant float at `0x005dd1e8`, which is `1.25f`. Current evidence grounds it only as a fixed float-return slot.","objdump + vtable scan + local disassembly + rdata inspection" 0x0052eb90,53,runtime_object_release_all_entries_in_list_field_0x79_via_0x554d50,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared cleanup helper over the broader `0x23a` runtime-object family. When list root `[this+0x79]` is nonnull, the helper walks that collection through `0x00556ef0/0x00556f00` and releases every entry through `0x00554d50` until no child remains. Current grounded callers include placed-structure rebuild or mutation branches `0x0046f055`, `0x004707e1`, `0x00507d70`, and `0x00509057`, where it acts as the release-side companion after local-runtime state mutations.","objdump + caller inspection + local disassembly + shared-runtime-object correlation" 0x0052ebd0,122,runtime_object_load_two_flag_bits_into_byte_0x20_and_optionally_refresh_handle_0x0c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load helper beneath the broader `0x23a` runtime-object family. The function reads two one-byte flag lanes from the caller-supplied stream through `0x00531150`, folds those values into bits `0x20` and `0x40` of state byte `[this+0x20]`, and when the refreshed `0x40` bit ends up enabled with owner pointer `[this+0x04]` already live it clears that bit again, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded caller is the tagged payload loader `0x004560c0`, so the safest read is a two-bit load helper with an optional dependent-handle refresh rather than a generic byte reader.","objdump + caller inspection + local disassembly + stream-load correlation" 0x0052ec50,68,runtime_object_serialize_two_flag_bits_from_byte_0x20,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-save companion to `0x0052ebd0` beneath the broader `0x23a` runtime-object family. The helper extracts bits `0x20` and `0x40` from state byte `[this+0x20]` as two one-byte values and writes both bytes into the caller-supplied stream through `0x00531030`. Current grounded caller is the shared tagged serializer `0x00455a22`, so this is the safest current read for the two-bit save helper rather than a broader payload writer.","objdump + caller inspection + local disassembly + stream-save correlation" -0x0052eca0,46,runtime_object_query_next_grouped_0x45_byte_subrecord_from_table_0x14,map,thiscall,inferred,objdump + local disassembly + field inspection,2,"Shared fixed-record cursor helper over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live and current subrecord index `[this+0x21] + 1` remains below the current group count taken from the `0x45`-byte group header selected by `[this+0x3a]`, the helper returns the next subrecord pointer from that group's payload base `[group+0x0c]`; otherwise it returns null. Current evidence is strong enough for the grouped-table cursor shape but not yet for a stronger user-facing semantic name for the `0x45`-byte records.","objdump + local disassembly + field inspection + grouped-subrecord correlation" +0x0052eca0,46,runtime_object_query_next_grouped_0x45_byte_subrecord_from_table_0x14,map,thiscall,inferred,objdump + local disassembly + field inspection,2,"Shared fixed-record cursor helper over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live and current subrecord index `[this+0x21] + 1` remains below the current group count taken from the `0x45`-byte group header selected by `[this+0x3a]`, the helper returns the next subrecord pointer from that group's payload base `[group+0x0c]`; otherwise it returns null. Current evidence keeps the row at the grouped-table cursor level over the `0x45`-byte records.","objdump + local disassembly + field inspection + grouped-subrecord correlation" 0x0052ecd0,272,runtime_object_reset_local_state_and_seed_default_scalar_flag_bands,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared low-level reset helper beneath the broader `0x23a` runtime-object family. The function clears the local list and handle roots at `[this+0x04/+0x08/+0x0c/+0x10/+0x14/+0x1c/+0x75..+0x81]`, resets string or scalar side bands around `[this+0x4b..+0x65]`, clears cached words at `[this+0x8d]`, `[this+0x1be..+0x1da]`, and related spans, preserves only selected low bits of state byte `[this+0x20]` before forcing default mask `0x62`, writes `-1` sentinels into `[this+0x3e]`, `[this+0x1ee]`, and `[this+0x1fa]`, and seeds the recurring default `1.0f` lanes at `[this+0x36]`, `[this+0x18e]`, `[this+0x1a2]`, `[this+0x1b6]`, `[this+0x1ca]`, and `[this+0x1da]`. Current grounded callers are the shared payload loaders `0x00455b70`, `0x00455fc0`, and the deeper init branch `0x0052edf0`, so this is the safest current read for the common local-state reset and default seeding owner.","objdump + caller inspection + local disassembly + shared-runtime-object correlation" 0x0052edf0,178,runtime_object_seed_owner_handle_anchor_triplet_and_default_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared post-reset initializer beneath the broader `0x23a` runtime-object family. After re-entering `0x0052ecd0`, the helper stores one caller-supplied owner or parent pointer into `[this+0x04]`, optionally resolves a primary handle from the second caller argument through owner `0x006d4020` into `[this+0x10]`, optionally resolves a secondary handle from the third argument into `[this+0x1c]`, copies the first triplet from the resolved primary handle into `[this+0x1e2/+0x1e6/+0x1ea]`, sets bit `0x08` in state byte `[this+0x20]`, and seeds packed color lane `[this+0x43]` to `0x007f7f7f`. When the primary handle argument is null, it zeros `[this+0x10/+0x14/+0x18]` and the copied triplet instead. Current grounded callers are the shared initializers `0x00455b70`, `0x00485819`, and `0x0053065a`, so this is the safest current read for seeding the owner-handle and anchor-triplet band rather than a subtype-specific constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + anchor-triplet correlation" 0x0052eeb0,93,runtime_object_release_owned_entry_list_field_0x79_and_clear_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared release helper over owned list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function walks the current list through `0x00556ef0/0x00556f00`, releases each live entry through `0x00556460`, frees those entries through `0x0053b080`, then destroys and frees the root list object itself through `0x005571d0` plus `0x0053b080`, and finally clears `[this+0x79]` back to null. Current grounded callers are the deeper release body `0x0052ef70` and the specialization-side cleanup `0x0045b734`, so this is the safest current read for the owned-list `[this+0x79]` release path.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list-release correlation" @@ -2104,7 +2108,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00531380,144,global_indexed_slot_table_read_varlen_heap_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared variable-length string reader built on top of `0x00531150`. The helper first frees the caller-owned destination pointer when nonnull, then reads a one-byte prefix. Prefix `0` leaves the destination null. Prefixes `1..0x7f` are treated as the byte length directly. Prefixes with bit `0x80` set read one extra byte and combine the low seven high bits with that second byte into a `u15` length. The helper then allocates that many bytes through `0x005a125d`, stores the new heap pointer to the caller slot, and reads the payload bytes through `0x00531150`. Current grounded callers include `runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands` `0x00455fc0`, `placed_structure_specialization_load_payload_and_rebuild_transients` `0x0045c150`, and the later payload loader at `0x0045e594`, so this is the safest current read for the shared variable-length heap-string import helper rather than a narrower subtype loader.","objdump + caller inspection + local disassembly + varlen-string correlation" 0x00531410,128,global_indexed_slot_table_write_varlen_heap_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared variable-length string writer built on top of `0x00531030`. Null pointers emit a single zero byte. Nonnull pointers are measured as a NUL-terminated byte string plus terminator; lengths up to `0x7f` emit one prefix byte, while longer lengths emit two prefix bytes with the high seven bits flagged by `0x80`. The helper then writes the string payload bytes through `0x00531030`. Current grounded callers include `runtime_object_serialize_tagged_string_triplet_and_dispatch_slot_0x4c` `0x004559d0`, `placed_structure_specialization_serialize_payload_via_0x45b560` `0x0045b560`, and the city-entry-family serializer `0x0045c6f0`, so this is the safest current read for the shared variable-length heap-string save helper rather than a generic raw buffer writer.","objdump + caller inspection + local disassembly + varlen-string correlation" 0x00531490,27,global_indexed_slot_table_write_nul_terminated_string_without_length_prefix,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny raw string writer over the same slot-table byte pump. The helper computes the caller-supplied NUL-terminated string length plus terminator from `EDX` and forwards those bytes directly into `0x00531030` without any explicit prefix layer. Current grounded callers are the neighboring shell-side branches `0x00489396` and `0x004894ec`, so the safest current read is a direct NUL-terminated string write helper rather than a broader tagged serializer.","objdump + caller inspection + local disassembly + raw-string-write correlation" -0x005314b0,79,global_callback_0x5c8454_query_first_nonzero_result_up_to_index,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Small callback-driven selector over global dword `0x00ccba08`. The helper clears that global, then iterates indices `0..arg0`, repeatedly calling function pointer `0x005c8454` with one stack-local index slot plus the address of `0x00ccba08`, and stops when the callback returns zero; otherwise it increments the index and continues. On success it returns the value written to `0x00ccba08`, else `0`. Current grounded callers include `0x004fdb9b`, `0x0053166b`, `0x005321b4`, and `0x00532248`. The owning resource behind `0x005c8454` is still open, so the safest name stays structural.","objdump + caller inspection + local disassembly + callback-selector correlation" +0x005314b0,79,global_callback_0x5c8454_query_first_nonzero_result_up_to_index,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Small callback-driven selector over global dword `0x00ccba08`. The helper clears that global, then iterates indices `0..arg0`, repeatedly calling function pointer `0x005c8454` with one stack-local index slot plus the address of `0x00ccba08`, and stops when the callback returns zero; otherwise it increments the index and continues. On success it returns the value written to `0x00ccba08`, else `0`. Current grounded callers include `0x004fdb9b`, `0x0053166b`, `0x005321b4`, and `0x00532248`. The owning resource behind `0x005c8454` remains intentionally structural at the current evidence level.","objdump + caller inspection + local disassembly + callback-selector correlation" 0x00531500,25,global_query_mode1_owner_and_audio_override_gate_0xccb9f4_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny global gate for the neighboring audio owner family. The helper returns `1` only when dword `[this+0x04]` equals `1` and global override gate `0x00ccb9f4` is nonzero; otherwise it returns `0`. Local shutdown or rebuild owner `0x00531a10` raises that gate before fading or tearing the family down and clears it again on exit, while the adjacent wrappers `0x00531520..0x00531840` mostly require the inverse gate. Current grounded callers include the neighboring UI or status-object branches `0x0046fd87`, `0x004b8f71`, `0x004c8243`, the setup-side branch `0x004e1a05`, and the runtime-object helper `0x00557e5c`, so this is now safest as the mode-`1` plus override-active query rather than an owner-unknown structural test.","objdump + caller inspection + local disassembly + global-gate correlation + shutdown-override correlation" 0x00531520,59,global_mode1_gate_query_primary_handle_status_code_4_or_8_then_clear_unregister_and_notify,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small mode-gated forwarding helper over global owner `0x00ccba00`. The helper only runs when `[this+0x04] == 1` and global `0x00ccb9f4` is still null. Under that gate it first queries `0x00557c90` on `0x00ccba00` for owner-handle status code `4`; when that does not return `1` it queries `0x00557cb0` for status code `8`; and when either query succeeds it tail-dispatches the same owner through `0x00557cd0` to clear the handle, unregister it from global ten-slot table `0x00d973b8`, and optionally notify callback `0x00d973e0`. Current grounded caller is the neighboring branch `0x004b8ea8`.","objdump + caller inspection + local disassembly + owner-handle correlation + global-slot correlation" 0x00531560,79,global_mode1_gate_dispatch_arg_selected_0x557d90_or_0x56a8e0_0x569ae0,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Mode-gated argument-selected forwarding helper spanning globals `0x00ccba00`, `0x00ccb9f8`, and `0x00ccb9fc`. The same gate applies: it only runs when `[this+0x04] == 1` and `0x00ccb9f4` is null. When selector arg1 is `0`, it forwards arg0 into owner `0x00ccba00` through `0x00557d90`. When selector arg1 is `2`, it forwards arg0 into `0x0056a8e0(0x00ccb9f8)` and then into `0x00569ae0(0x00ccb9fc)`. Current grounded callers span several shell and world-adjacent branches including `0x0043643b`, `0x00464b3b`, `0x004833c4`, `0x004feea4`, `0x00517a04`, and `0x005212ae`, so the safest current read is a small selector wrapper over three global owners rather than a named feature toggle.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation" @@ -2573,13 +2577,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00582820,188,math_intersect_plane_vec4_with_vec3_segment,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Geometric intersection helper over one plane vec4 and two caller vec3 endpoints. The function evaluates the plane against both endpoints, derives the affine parameter along the segment between them, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the shared plane-versus-segment intersection helper rather than a subsystem-specific query.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation" 0x005828e0,203,math_measure_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4x4 determinant helper. The function forms the required cofactor combinations from the caller matrix rows, contracts them against the first row, and returns the resulting determinant scalar through the x87 return path. Current evidence is strongest for a shared determinant helper paired with the nearby inversion body `0x00581db0`.","objdump + local disassembly + SSE arithmetic inspection + matrix-correlation" 0x005829b0,226,math_build_plane_vec4_from_three_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-point plane builder over caller vec3 inputs. The function forms two edge vectors from the three points, computes their cross product, normalizes that resulting normal, stores the plane normal through output `[+0x00..+0x08]`, and writes the signed plane constant `-dot(normal, p0)` to `[out+0x0c]`. This is the safest current read for the shared plane-from-three-points helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation" -0x00582aa0,392,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Shared plane-driven 4x4 matrix builder over one caller plane vec4 and one second vec4 input. The function normalizes the plane against the XYZ-length of its first three lanes, computes one diagonal dot term against the second vec4, combines that term with per-plane outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as a projective plane-and-vec4 matrix helper, but not yet tight enough to overname it as one specific API variant.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation + projective-matrix correlation" +0x00582aa0,392,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Shared plane-driven 4x4 matrix builder over one caller plane vec4 and one second vec4 input. The function normalizes the plane against the XYZ-length of its first three lanes, computes one diagonal dot term against the second vec4, combines that term with per-plane outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to carry this row as a projective plane-and-vec4 matrix helper.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation + projective-matrix correlation" 0x00582c30,209,math_build_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion-to-matrix helper. The function normalizes the caller quaternion-like vec4, applies the standard doubled-product combinations through the constant tables at `0x00627e10..0x00627e80`, and writes a 4x4 rotation matrix to the caller output. This is the safest current read for the shared quaternion-to-4x4 rotation-matrix builder rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" 0x00582d10,130,math_multiply_quaternions,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion product helper over two caller vec4 inputs. The function applies the expected sign-mask and shuffle pattern for Hamilton-product-style quaternion composition and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" 0x00582da0,128,math_normalize_quaternion_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked quaternion normalization helper. The function computes the caller quaternion length, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon guard used by the nearby zero-safe normalizers.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" 0x00582e40,109,math_invert_quaternion_by_conjugate_over_squared_length,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion inverse helper over one caller vec4. The function flips the sign of the spatial XYZ lanes, preserves the scalar W lane, divides that conjugate by the squared quaternion length, and writes the resulting vec4 through the caller output. This is the safest current read for the shared quaternion-inverse helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" 0x00582eb0,274,math_build_quaternion_from_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Rotation-matrix-to-quaternion helper over one caller 3x3 row block. The function checks the matrix trace, takes the usual positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected off-diagonal differences and sums before writing the resulting vec4 to the caller output. This is the safest current read for the shared 3x3-rotation-matrix-to-quaternion builder.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation" -0x00582fd0,191,math_build_quaternion_from_three_euler_angles_via_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-angle quaternion builder over caller scalar inputs. The function packs the three caller angles with one zero lane, scales them by `0.5`, routes that half-angle tuple through packed trig helper `0x0058aa70`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. The current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation + packed-trig correlation" +0x00582fd0,191,math_build_quaternion_from_three_euler_angles_via_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-angle quaternion builder over caller scalar inputs. The function packs the three caller angles with one zero lane, scales them by `0.5`, routes that half-angle tuple through packed trig helper `0x0058aa70`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is sufficient to carry the row as a shared Euler-angle-to-quaternion helper.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation + packed-trig correlation" 0x005830a0,176,math_apply_packed_3x3_basis_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 3D basis helper over one caller vec3 input and one compact 3x3 basis block. The function multiplies the input X, Y, and Z scalars by three packed matrix rows and stores the resulting XYZ triple through the caller output, with aligned and unaligned load paths that preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation" 0x00583160,175,math_apply_packed_3x3_basis_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row translation-bearing sibling to `0x005830a0`. The helper multiplies one caller vec3 input by three packed basis rows, adds one packed translation row, and stores the resulting full vec4 through the caller output. Both aligned and unaligned load paths preserve the same transform semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation" 0x00583220,243,math_apply_packed_3x3_basis_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective packed-row sibling to `0x00583160`. The helper builds the same transformed 4-lane vector from one caller vec3 input plus packed basis and translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the projected XYZ triple through the caller output. The aligned and unaligned legs preserve the same transform-plus-project behavior.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + projection correlation" @@ -2591,18 +2595,18 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x005839a0,342,math_apply_packed_4x4_basis_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output batch sibling to `0x005833e0`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block, then repacks the transformed lanes into a transposed or column-packed output layout before storing the four result rows.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + transposed-output correlation" 0x00583b00,164,math_compute_packed_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product style combination through shuffle, multiply, and subtract bands, applies the final sign-mask adjustment under `0x00627ee0`, and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + 4d-cross-product correlation" 0x00583cc0,201,math_measure_packed_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row determinant sibling to `0x005828e0`. The helper expands the packed 4x4 row block, forms the same cofactor combinations as the wider determinant strip, contracts them against the first packed row, and returns the resulting determinant scalar through the x87 return path.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-determinant correlation" -0x00583bb0,121,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_a,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Single-angle packed 4x4 rotation-matrix helper above interleaved trig worker `0x0058ac60`. The function broadcasts one caller angle, derives one interleaved sine/cosine tuple through `0x0058ac60`, combines that tuple with fixed identity-row constants, and writes one packed 4x4 axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation" +0x00583bb0,121,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_a,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Single-angle packed 4x4 rotation-matrix helper above interleaved trig worker `0x0058ac60`. The function broadcasts one caller angle, derives one interleaved sine/cosine tuple through `0x0058ac60`, combines that tuple with fixed identity-row constants, and writes one packed 4x4 axial rotation-matrix variant to the caller output. Current evidence is sufficient to carry the row as a fixed-axis rotation-matrix constructor.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation" 0x00583c30,128,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_b,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Sibling single-angle packed 4x4 rotation-matrix helper above `0x0058ac60`. Like `0x00583bb0`, it broadcasts one caller angle, derives one interleaved sine/cosine tuple through the shared trig worker, combines that tuple with fixed identity-row constants in a different lane arrangement, and writes one second packed 4x4 axial rotation-matrix variant to the caller output. The safest current read is a second fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation" 0x00583d90,226,math_build_plane_vec4_from_three_packed_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row three-point plane builder sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross product, normalizes that resulting normal, stores the plane normal through the caller output, and writes the signed plane constant to `[out+0x0c]`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation" 0x00583e80,392,math_build_packed_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes, computes one diagonal dot term against the second vec4 input, combines that term with per-plane outer-product bands, and writes the resulting packed 4x4 matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation + projective-matrix correlation" 0x00584010,209,math_build_packed_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row quaternion-to-matrix sibling to `0x00582c30`. The helper normalizes the caller quaternion-like vec4, applies the same doubled-product combinations through the packed constant tables at `0x00627f70..0x00627fe0`, and writes a packed 4x4 rotation matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation" 0x005840f0,274,math_build_quaternion_from_packed_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Packed-row rotation-matrix-to-quaternion sibling to `0x00582eb0`. The helper checks the packed 3x3 trace, takes the positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected packed off-diagonal differences and sums before writing the resulting vec4 to the caller output.","objdump + local disassembly + x87 arithmetic inspection + packed-matrix correlation + quaternion correlation" -0x00584210,191,math_build_quaternion_from_three_euler_angles_via_packed_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582fd0`. The helper packs three caller angles with one zero lane, scales them by `0.5`, routes that tuple through packed trig helper `0x0058ad50`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation + packed-trig correlation" +0x00584210,191,math_build_quaternion_from_three_euler_angles_via_packed_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582fd0`. The helper packs three caller angles with one zero lane, scales them by `0.5`, routes that tuple through packed trig helper `0x0058ad50`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is sufficient to carry the row as a shared Euler-angle-to-quaternion helper.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation + packed-trig correlation" 0x005842e0,151,math_multiply_quaternions_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582d10`. The helper loads two caller quaternion-like vec4 inputs, applies the same sign-mask and pairwise multiply-add or subtract pattern used by the SSE quaternion-product strip, and writes the resulting vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation" 0x00584379,90,math_normalize_vec4_or_zero_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 normalize-or-zero helper. The function computes squared length from the caller vec4, compares it against the nearby epsilon constant at `0x005df610`, and when the length is large enough scales the full vec4 by one reciprocal-square-root refinement before writing it to the caller output; smaller inputs collapse to zero through the same mask path.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation" 0x005843d6,179,math_normalize_vec3_with_optional_length_outparam_and_default_axis_fallback_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization helper with two optional outparams. The function computes the squared XYZ length from the caller source block, optionally writes the normalized vec3 through one caller outparam, optionally writes a derived scalar magnitude through another, and when the input collapses below the epsilon threshold falls back to a fixed default-axis vector plus zero magnitude. This is the safest current read for the shared vec3 normalize-with-length helper without overclaiming the exact downstream semantic of the scalar outparam.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation" 0x00584489,1073,math_build_quaternion_from_3x3_rotation_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582eb0`. The helper inspects the same 3x3 rotation-matrix trace and dominant diagonal cases, chooses one of the expected reconstruction branches, and writes the resulting quaternion vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix-correlation" -0x005848ba,195,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582fd0`. The helper halves the three caller Euler angles, routes those half angles through scalar trig worker `0x0058b660`, and combines the resulting sine and cosine values into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + trig correlation" +0x005848ba,195,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582fd0`. The helper halves the three caller Euler angles, routes those half angles through scalar trig worker `0x0058b660`, and combines the resulting sine and cosine values into one quaternion vec4 before storing it through the caller output. Current evidence is sufficient to carry the row as a shared Euler-angle-to-quaternion helper.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + trig correlation" 0x0058497f,106,math_build_quaternion_from_axis_vec3_and_angle_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle-to-quaternion helper. The function first normalizes one caller axis vec3 through `0x005896d2`, halves the caller angle, routes that half-angle through trig worker `0x0058b660`, scales the normalized axis by the sine-like lane, and writes the resulting quaternion vec4 with the cosine-like scalar lane in `W`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation" 0x005849eb,309,math_interpolate_quaternion_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion slerp helper over two caller quaternion-like vec4 inputs and one scalar interpolation factor. The function measures the 4D dot product, takes the expected small-angle fast path, otherwise derives one angular term through `0x0058af80` and two sine-weight terms through `0x0058b780`, then writes the weighted combination through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + slerp correlation" 0x00584b22,139,math_blend_three_quaternion_controls_by_two_parameter_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Two-parameter nested quaternion-slerp helper. The function first forms `u+v`, performs two intermediate slerps from one shared control quaternion to two neighboring controls through `0x005849eb`, derives relative blend weight `v/(u+v)`, and then slerps between those intermediates into the caller output. The safest current read is a barycentric or triangular nested-slerp helper rather than a tighter named spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation" @@ -2616,7 +2620,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00585b4b,80,math_build_4x4_translation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow row-major translation-matrix constructor. The helper seeds the three identity rows from `0x005df668` and `0x005df660`, writes the three caller translation scalars into the trailing homogeneous row, and returns the finished 4x4 matrix through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation" 0x00585b9b,235,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes through `0x0058a988`, computes one diagonal dot term against the second vec4 input, combines that dot term with the expected negated outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as the MMX plane-driven projective matrix helper without overclaiming one specific API variant.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + geometry correlation + projective-matrix correlation" 0x00585c86,220,math_build_4x4_reflection_matrix_from_plane_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane-reflection matrix helper. The function normalizes the caller plane vec4 through `0x0058a988`, forms the expected `1 - 2*n*n^T` diagonal terms plus the paired `-2*n_i*n_j` off-diagonal bands, and writes the resulting homogeneous 4x4 reflection-style matrix to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + plane-reflection correlation" -0x00585d62,97,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through scalar trig worker `0x0058b660`, seeds the fixed identity rows from constants `0x005df668` and `0x005df660`, and writes one axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation" +0x00585d62,97,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through scalar trig worker `0x0058b660`, seeds the fixed identity rows from constants `0x005df668` and `0x005df660`, and writes one axial rotation-matrix variant to the caller output. Current evidence is sufficient to carry the row as a fixed-axis rotation-matrix constructor.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation" 0x00585dc5,94,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. Like `0x00585d62`, it routes one caller angle through `0x0058b660`, combines the resulting sine or cosine lanes with the same identity-row constants in a different layout, and writes one second axial rotation-matrix variant to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation" 0x00585e23,87,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_c,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Third MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through `0x0058b660`, seeds the remaining fixed identity rows, and writes one third axial rotation-matrix variant to the caller output. The safest current read is a third fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation" 0x00585e7c,67,math_build_4x4_scale_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow diagonal scale-matrix constructor. The helper writes the three caller scalar scale lanes onto the homogeneous 4x4 diagonal, clears the off-diagonal lanes, and seeds the trailing homogeneous `1.0f` row or column from `0x005df660`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + scale correlation" @@ -2737,65 +2741,65 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00575e17,204,surface_decoder_run_vtable_pair_against_local_color_vec4_with_temporary_single_sample_state,support,thiscall,inferred,objdump + local disassembly + caller inspection + decoder-base correlation,2,"Small shared helper in the surface-decoder base family. The function snapshots width, sample count, payload pointer, lookup root, and optional mode or clip field, then temporarily rewires the decoder into a one-sample local state rooted at stack `vec4` storage and local color band `[obj+0x1c..+0x28]`. When auxiliary mode `[obj+0x08]` is not `1`, it also temporarily points `[obj+0x104c]` at that local color band and runs the auxiliary staging builder `0x0057537f` once. It then invokes vtable slots `+0x08` and `+0x04` against that single local sample and restores the original decoder state before returning. This is the safest current read for running the decoder's virtual pair against the local color vec4 with temporary single-sample state rather than overclaiming exact format semantics.","objdump + local disassembly + caller inspection + decoder-base correlation + virtual-dispatch correlation + local-color-band correlation" 0x00575ee3,109,surface_decoder_zero_decoded_sample_quads_when_all_four_lanes_exceed_clip_thresholds,support,stdcall,inferred,objdump + local disassembly + caller inspection + clip-threshold correlation,2,"Small post-decode clip helper beneath the shared surface-decoder base. The function walks `0x10`-byte decoded sample quads starting at the caller buffer, compares all four float lanes against clip thresholds `[obj+0x1c..+0x28]`, and zeroes the whole quad only when every lane exceeds its corresponding threshold. Current grounded caller is the packed-YUV output sibling `0x005797f1`, so this is the safest current read for zeroing decoded sample quads by the descriptor clip box rather than a generic clear loop.","objdump + local disassembly + caller inspection + clip-threshold correlation + decoder-base correlation" 0x00575d9c,121,surface_decoder_link_or_refresh_aux_staging_row_for_peer_mode,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + decode-chain correlation,2,"Small helper used immediately under `0x00574dbb` after the two decoder-side handles are resolved. When the peer decoder's mode dword `[peer+0x08]` differs from `[this+0x08]`, the helper allocates one `width*0x10` auxiliary staging-row block at `[this+0x104c]`, seeds it from the same `0x57033c` clear pattern used elsewhere in the decode stack, and caches the peer mode dword into `[this+0x1048]`. When the mode already matches, it returns success without rebuilding that row. This is the safest current read for linking or refreshing one auxiliary staging row for peer mode mismatches rather than overclaiming exact decoder subtype semantics.","objdump + local disassembly + caller inspection + decode-chain correlation + staging-row correlation" -0x00578ed3,26,surface_decoder_ctor_tag_0x14_variant_vtable_0x5dec9c_auxmode1_stride0x18,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x14` with auxiliary mode `1` and sample stride `0x18`, then installs subtype vtable `0x005dec9c`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00578ed3,26,surface_decoder_ctor_tag_0x14_variant_vtable_0x5dec9c_auxmode1_stride0x18,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x14` with auxiliary mode `1` and sample stride `0x18`, then installs subtype vtable `0x005dec9c`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00578eef,245,surface_decoder_ctor_packed_yuv422_base_with_evenized_width_and_shift_select,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,2,"Shared constructor base for the packed-YUV `4:2:2` decoder family reached from the format-tag factory. The helper seeds the common decoder base through `0x00575b34`, evenizes the horizontal span, allocates one `16`-byte-per-sample auxiliary row table at `[obj+0x106c]`, and then selects the paired byte-lane shift fields `[obj+0x1094/+0x1098]` according to whether the incoming tag is `UYVY` (`0x59565955`) or the alternate sibling handled through the same base. This is the safest current read for the packed-YUV-422 base constructor rather than naming one specific output swizzle too narrowly.","objdump + local disassembly + caller inspection + tag-dispatch correlation + packed-yuv correlation" 0x00578fe7,26,surface_decoder_release_tag_0x14_variant_vtable_0x5dec9c,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x14` subtype vtable `0x005dec9c`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579008,28,surface_decoder_ctor_tag_0x15_variant_vtable_0x5decbc_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x15` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005decbc` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + decoder-base correlation" 0x00579024,26,surface_decoder_release_tag_0x15_variant_vtable_0x5decbc,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x15` subtype vtable `0x005decbc`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579045,28,surface_decoder_ctor_tag_0x16_variant_vtable_0x5deccc_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x16` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005deccc` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + decoder-base correlation" 0x00579061,26,surface_decoder_release_tag_0x16_variant_vtable_0x5deccc,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x16` subtype vtable `0x005deccc`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579082,28,surface_decoder_ctor_tag_0x17_variant_vtable_0x5decdc_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x17` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005decdc`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579082,28,surface_decoder_ctor_tag_0x17_variant_vtable_0x5decdc_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x17` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005decdc`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057909e,491,surface_decoder_flush_live_packed_yuv422_aux_samples_back_to_payload_window,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Reverse cached-window owner in the packed-YUV-422 decoder family. When live decoded state `[obj+0x108c]` and cached output bounds `[obj+0x1090]` are present, the helper walks the auxiliary sample table `[obj+0x106c]`, converts the float sample lanes back into clamped packed channel values, reapplies lane shifts `[obj+0x1094/+0x1098]`, writes the merged words back into the payload window rooted at `[obj+0x18]`, and then clears the live-dirty flag. This is the safest current read for flushing live packed-YUV-422 auxiliary samples back into the payload window rather than a generic pixel loop.","objdump + local disassembly + caller inspection + packed-yuv correlation + cached-window correlation + reverse-writeback correlation" -0x005792ab,26,surface_decoder_ctor_tag_0x18_variant_vtable_0x5ded0c_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x18` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded0c`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x005792ab,26,surface_decoder_ctor_tag_0x18_variant_vtable_0x5ded0c_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x18` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded0c`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x005792c7,26,surface_decoder_release_tag_0x18_variant_vtable_0x5ded0c,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x18` subtype vtable `0x005ded0c`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x005792e8,26,surface_decoder_ctor_tag_0x19_variant_vtable_0x5ded1c_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x19` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded1c`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x005792e8,26,surface_decoder_ctor_tag_0x19_variant_vtable_0x5ded1c_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x19` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded1c`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579304,26,surface_decoder_release_tag_0x19_variant_vtable_0x5ded1c,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x19` subtype vtable `0x005ded1c`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579325,717,surface_decoder_refresh_packed_yuv422_cached_window_and_build_aux_sample_band,support,stdcall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Primary cached-window owner beneath the packed-YUV-422 row-decode siblings. The function validates the requested `(x,y)` against cached bounds `[obj+0x1074..+0x1084]`, rebuilds the source window through `0x0057909e` when needed, updates those bounds, and when the caller requests materialization it walks the live payload words, applies lane shifts `[obj+0x1094/+0x1098]`, expands paired packed channels into float tuples, and writes one `0x20`-byte-per-sample auxiliary band into `[obj+0x106c]`. This is the safest current read for refreshing the packed-YUV-422 cached window and building the auxiliary sample band rather than a generic pixel loop.","objdump + local disassembly + caller inspection + packed-yuv correlation + cached-window correlation" -0x005795f6,26,surface_decoder_ctor_tag_0x1a_variant_vtable_0x5ded40_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1a` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded40`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x005795f6,26,surface_decoder_ctor_tag_0x1a_variant_vtable_0x5ded40_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1a` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded40`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579612,26,surface_decoder_release_tag_0x1a_variant_vtable_0x5ded40,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1a` subtype vtable `0x005ded40`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579633,26,surface_decoder_ctor_tag_0x1b_variant_vtable_0x5ded50_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1b` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005ded50`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579633,26,surface_decoder_ctor_tag_0x1b_variant_vtable_0x5ded50_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1b` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005ded50`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057964f,26,surface_decoder_release_tag_0x1b_variant_vtable_0x5ded50,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1b` subtype vtable `0x005ded50`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579670,26,surface_decoder_ctor_tag_0x1c_variant_vtable_0x5ded60_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1c` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005ded60`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579670,26,surface_decoder_ctor_tag_0x1c_variant_vtable_0x5ded60_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1c` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005ded60`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057968c,26,surface_decoder_release_tag_0x1c_variant_vtable_0x5ded60,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1c` subtype vtable `0x005ded60`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x005796ad,26,surface_decoder_ctor_tag_0x1d_variant_vtable_0x5ded70_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1d` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded70`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x005796ad,26,surface_decoder_ctor_tag_0x1d_variant_vtable_0x5ded70_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1d` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded70`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x005796c9,26,surface_decoder_release_tag_0x1d_variant_vtable_0x5ded70,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1d` subtype vtable `0x005ded70`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x005796ea,26,surface_decoder_ctor_tag_0x1e_variant_vtable_0x5ded80_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1e` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded80`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x005796ea,26,surface_decoder_ctor_tag_0x1e_variant_vtable_0x5ded80_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1e` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded80`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579706,26,surface_decoder_release_tag_0x1e_variant_vtable_0x5ded80,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1e` subtype vtable `0x005ded80`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579727,139,surface_decoder_decode_packed_yuv422_row_into_aux_samples,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Primary row-decode owner in the packed-YUV-422 family above `0x00578eef`. The helper optionally rebuilds one peer-mode staging row through `0x0057537f`, resolves the requested source position through local helper `0x00579325`, copies one decoded sample row from the auxiliary table `[obj+0x106c]` into the caller output strip, and marks `[obj+0x108c]` live. This is the safest current read for decoding one packed-YUV-422 row into auxiliary sample storage rather than overclaiming one exact swizzle path.","objdump + local disassembly + caller inspection + packed-yuv correlation + staging-row correlation" 0x005797f1,109,surface_decoder_copy_packed_yuv422_aux_row_to_output_and_optionally_clip,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Sibling output helper in the packed-YUV-422 family. The helper resolves the requested source position through `0x00579325`, copies one already-decoded auxiliary sample row from `[obj+0x106c]` into the caller output buffer, and when the decoder exposes a non-null mode or clip field at `[obj+0x10]` it follows with clip or zero-side cleanup through `0x00575ee3`. This is the safest current read for copying one packed-YUV auxiliary row to output with optional clip cleanup.","objdump + local disassembly + caller inspection + packed-yuv correlation + output-copy correlation + clip correlation" -0x005797b4,26,surface_decoder_ctor_tag_0x1f_variant_vtable_0x5ded90_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1f` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005ded90`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x005797b4,26,surface_decoder_ctor_tag_0x1f_variant_vtable_0x5ded90_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1f` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005ded90`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x005797d0,26,surface_decoder_release_tag_0x1f_variant_vtable_0x5ded90,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1f` subtype vtable `0x005ded90`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579860,26,surface_decoder_ctor_tag_0x20_variant_vtable_0x5deda0_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x20` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005deda0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579860,26,surface_decoder_ctor_tag_0x20_variant_vtable_0x5deda0_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x20` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005deda0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057987c,26,surface_decoder_release_tag_0x20_variant_vtable_0x5deda0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x20` subtype vtable `0x005deda0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057989d,493,surface_decoder_ctor_dxt_base_select_block_size_and_decode_kernels,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,2,"Shared constructor base for the block-compressed `DXT1..DXT5` decoder family reached from `0x0057a3f8`. After seeding the common decoder base through `0x00575b34`, the helper derives two small state selectors from descriptor dwords `[arg+0x18]` and `[arg+0x1c]`, chooses the per-format block-byte count at `[obj+0x1080]` and the paired decode-kernel callbacks `[obj+0x1084/+0x1088]` according to tag `DXT1..DXT5`, aligns the working extents to four-pixel block boundaries, and stores the derived block-grid extents under `[obj+0x1090..+0x10ac]`. This is the safest current read for the `DXT` base constructor that selects block size and decode kernels.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT-correlation + block-grid correlation" -0x00579a8f,26,surface_decoder_ctor_tag_0x28_variant_vtable_0x5dedb0_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x28` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dedb0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579a8f,26,surface_decoder_ctor_tag_0x28_variant_vtable_0x5dedb0_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x28` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dedb0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579aab,26,surface_decoder_release_tag_0x28_variant_vtable_0x5dedb0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x28` subtype vtable `0x005dedb0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579acc,26,surface_decoder_ctor_tag_0x29_variant_vtable_0x5dedc0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x29` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedc0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579acc,26,surface_decoder_ctor_tag_0x29_variant_vtable_0x5dedc0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x29` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedc0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579ae8,26,surface_decoder_release_tag_0x29_variant_vtable_0x5dedc0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x29` subtype vtable `0x005dedc0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579b09,26,surface_decoder_ctor_tag_0x32_variant_vtable_0x5dedd0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x32` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedd0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579b09,26,surface_decoder_ctor_tag_0x32_variant_vtable_0x5dedd0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x32` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedd0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579b25,26,surface_decoder_release_tag_0x32_variant_vtable_0x5dedd0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x32` subtype vtable `0x005dedd0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579b46,26,surface_decoder_ctor_tag_0x33_variant_vtable_0x5dede0_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x33` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dede0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579b46,26,surface_decoder_ctor_tag_0x33_variant_vtable_0x5dede0_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x33` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dede0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579b62,26,surface_decoder_release_tag_0x33_variant_vtable_0x5dede0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x33` subtype vtable `0x005dede0`. The helper re-enters broader nested-table `DXT`-style release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + nested-table correlation + tag-dispatch correlation" -0x00579b9f,26,surface_decoder_ctor_tag_0x34_variant_vtable_0x5dedf0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x34` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedf0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579b9f,26,surface_decoder_ctor_tag_0x34_variant_vtable_0x5dedf0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x34` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedf0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579bbb,26,surface_decoder_release_tag_0x34_variant_vtable_0x5dedf0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x34` subtype vtable `0x005dedf0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579bdc,257,surface_decoder_quantize_threshold_vec4_with_tag_dependent_scale,support,thiscall,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Small post-constructor helper in the `DXT` decoder neighborhood. The function selects one tag-dependent scalar into `[obj+0x106c]` and its reciprocal into `[obj+0x1070]`, then quantizes the descriptor threshold vec4 `[obj+0x1c..+0x28]` through those scale factors and stores the rounded results back into the same four lanes. Current evidence is strongest that `DXT2` and `DXT3` take one scale branch while the other nearby subtypes take the alternate branch, so this is the safest current read for tag-dependent threshold quantization rather than naming one exact alpha policy.","objdump + local disassembly + caller inspection + DXT-correlation + threshold correlation + quantization correlation" -0x00579cdd,26,surface_decoder_ctor_tag_0x3c_variant_vtable_0x5dee00_auxmode2_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3c` with auxiliary mode `2` and sample stride `0x10`, then installs subtype vtable `0x005dee00`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579cdd,26,surface_decoder_ctor_tag_0x3c_variant_vtable_0x5dee00_auxmode2_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3c` with auxiliary mode `2` and sample stride `0x10`, then installs subtype vtable `0x005dee00`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579cf9,26,surface_decoder_release_tag_0x3c_variant_vtable_0x5dee00,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3c` subtype vtable `0x005dee00`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579d1a,26,surface_decoder_ctor_tag_0x3d_variant_vtable_0x5dee10_auxmode2_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3d` with auxiliary mode `2` and sample stride `0x10`, then installs subtype vtable `0x005dee10`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579d1a,26,surface_decoder_ctor_tag_0x3d_variant_vtable_0x5dee10_auxmode2_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3d` with auxiliary mode `2` and sample stride `0x10`, then installs subtype vtable `0x005dee10`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579d36,26,surface_decoder_release_tag_0x3d_variant_vtable_0x5dee10,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3d` subtype vtable `0x005dee10`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579d57,26,surface_decoder_ctor_tag_0x3e_variant_vtable_0x5dee20_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3e` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee20`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579d57,26,surface_decoder_ctor_tag_0x3e_variant_vtable_0x5dee20_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3e` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee20`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579d73,26,surface_decoder_release_tag_0x3e_variant_vtable_0x5dee20,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3e` subtype vtable `0x005dee20`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579d94,26,surface_decoder_ctor_tag_0x3f_variant_vtable_0x5dee30_auxmode3_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3f` with auxiliary mode `3` and sample stride `0x20`, then installs subtype vtable `0x005dee30`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579d94,26,surface_decoder_ctor_tag_0x3f_variant_vtable_0x5dee30_auxmode3_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3f` with auxiliary mode `3` and sample stride `0x20`, then installs subtype vtable `0x005dee30`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579db0,26,surface_decoder_release_tag_0x3f_variant_vtable_0x5dee30,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3f` subtype vtable `0x005dee30`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579dd1,26,surface_decoder_ctor_tag_0x40_variant_vtable_0x5dee40_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x40` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee40`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579dd1,26,surface_decoder_ctor_tag_0x40_variant_vtable_0x5dee40_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x40` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee40`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579ded,26,surface_decoder_release_tag_0x40_variant_vtable_0x5dee40,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x40` subtype vtable `0x005dee40`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579e0e,26,surface_decoder_ctor_tag_0x41_variant_vtable_0x5dee50_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x41` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee50`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579e0e,26,surface_decoder_ctor_tag_0x41_variant_vtable_0x5dee50_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x41` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee50`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579e2a,26,surface_decoder_release_tag_0x41_variant_vtable_0x5dee50,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x41` subtype vtable `0x005dee50`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579e4b,26,surface_decoder_ctor_tag_0x43_variant_vtable_0x5dee60_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x43` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee60`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579e4b,26,surface_decoder_ctor_tag_0x43_variant_vtable_0x5dee60_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x43` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee60`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579e67,26,surface_decoder_release_tag_0x43_variant_vtable_0x5dee60,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x43` subtype vtable `0x005dee60`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579e88,26,surface_decoder_ctor_tag_0x46_variant_vtable_0x5dee70_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x46` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dee70`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing pixel-format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579e88,26,surface_decoder_ctor_tag_0x46_variant_vtable_0x5dee70_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x46` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dee70`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579ea4,26,surface_decoder_release_tag_0x46_variant_vtable_0x5dee70,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x46` subtype vtable `0x005dee70`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x00579ec5,26,surface_decoder_ctor_tag_0x31545844_variant_vtable_0x5dee80_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x31545844` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dee80`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x00579ec5,26,surface_decoder_ctor_tag_0x31545844_variant_vtable_0x5dee80_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x31545844` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dee80`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x00579ee1,26,surface_decoder_release_tag_0x31545844_variant_vtable_0x5dee80,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x31545844` subtype vtable `0x005dee80`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057ecff,126,surface_vec4_block_unpremultiply_rgb_by_alpha_with_clamp,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared vec4-block postprocess helper in the `DXT2` and `DXT4` decode path. The helper walks sixteen caller output vec4s, clamps each alpha lane to `[0,1]`, zeros RGB when alpha is nonpositive, divides RGB by alpha when `0 < alpha < 1` with per-channel saturation at `1`, and otherwise leaves the sample unchanged. This is the safest current read for unpremultiplying one vec4 block's RGB by alpha with clamp rather than naming a higher-level format owner.","objdump + local disassembly + caller inspection + DXT-correlation + alpha-correlation + block-postprocess correlation" 0x0057ed7d,48,surface_vec4_block_premultiply_rgb_by_alpha,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared vec4-block preprocess helper in the `DXT2` and `DXT4` encode path. The helper walks sixteen caller input vec4s, copies alpha through unchanged, and writes a second vec4 block with RGB multiplied by alpha. This is the safest current read for premultiplying one vec4 block's RGB by alpha rather than naming a higher-level format owner.","objdump + local disassembly + caller inspection + DXT-correlation + alpha-correlation + block-preprocess correlation" @@ -2821,11 +2825,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0057abc4,270,mapped_file_view_context_open_path_create_readonly_mapping_and_map_full_view,support,thiscall,inferred,objdump + local disassembly + import-call correlation + local field inspection,2,"Broader open owner for the same `0x10`-byte mapped-file view context. The helper validates the caller path, optionally converts it through one local wide-path scratch branch when the second caller pointer is present, opens the file for read access through one of the paired import thunks, creates a read-only file mapping, maps the full file view, queries file size, and stores the resulting file handle, mapping handle, view pointer, and file size into `[this+0x00/+0x04/+0x08/+0x0c]`. On failure it tears the partially built state back down and returns the corresponding error code.","objdump + local disassembly + import-call correlation + local field inspection + mapped-file correlation" 0x0057acd4,65,mapped_file_view_context_unmap_view_close_mapping_and_file,support,thiscall,inferred,objdump + local disassembly + import-call correlation + local field inspection,2,"Release-side owner for the same mapped-file view context. The helper unmaps live view `[this+0x08]`, closes mapping handle `[this+0x04]`, closes file handle `[this+0x00]`, resets the two handles back to `-1`, clears the view pointer, and returns `0`.","objdump + local disassembly + import-call correlation + local field inspection + mapped-file correlation" 0x0057ad15,10,mapped_file_view_context_release_if_file_handle_live,support,thiscall,inferred,objdump + local disassembly + caller inspection + mapped-file correlation,2,"Tiny conditional-release wrapper for the mapped-file view context. When primary file handle `[this+0x00]` is not `-1`, the helper re-enters `0x0057acd4`; otherwise it returns immediately.","objdump + local disassembly + caller inspection + mapped-file correlation" -0x0057a1ab,26,surface_decoder_ctor_tag_0x36314c41_variant_vtable_0x5dee90_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36314c41` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005dee90`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x0057a1ab,26,surface_decoder_ctor_tag_0x36314c41_variant_vtable_0x5dee90_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36314c41` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005dee90`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057a1c7,26,surface_decoder_release_tag_0x36314c41_variant_vtable_0x5dee90,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x36314c41` subtype vtable `0x005dee90`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x0057a1e8,26,surface_decoder_ctor_tag_0x36315220_variant_vtable_0x5deea0_auxmode1_stride0x30,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36315220` with auxiliary mode `1` and sample stride `0x30`, then installs subtype vtable `0x005deea0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x0057a1e8,26,surface_decoder_ctor_tag_0x36315220_variant_vtable_0x5deea0_auxmode1_stride0x30,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36315220` with auxiliary mode `1` and sample stride `0x30`, then installs subtype vtable `0x005deea0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057a204,26,surface_decoder_release_tag_0x36315220_variant_vtable_0x5deea0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x36315220` subtype vtable `0x005deea0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" -0x0057a225,26,surface_decoder_ctor_tag_0x36315241_variant_vtable_0x5deeb0_auxmode1_stride0x40,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36315241` with auxiliary mode `1` and sample stride `0x40`, then installs subtype vtable `0x005deeb0`. Current static evidence is strong on the factory tag, aux mode, and stride, but not yet on a user-facing format name.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" +0x0057a225,26,surface_decoder_ctor_tag_0x36315241_variant_vtable_0x5deeb0_auxmode1_stride0x40,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36315241` with auxiliary mode `1` and sample stride `0x40`, then installs subtype vtable `0x005deeb0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057a241,26,surface_decoder_release_tag_0x36315241_variant_vtable_0x5deeb0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x36315241` subtype vtable `0x005deeb0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation" 0x0057a262,22,surface_decoder_ctor_dxt1_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `DXT1` constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through the shared `DXT` base constructor `0x0057989d`, then installs subtype vtable `0x005deec0` and returns the constructed decoder object.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT1-correlation" 0x0057a27a,26,surface_decoder_release_dxt_variant_vtable_0x5deec0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation,1,"Thin release wrapper for `DXT1` subtype vtable `0x005deec0`. The helper re-enters the broader `DXT` family release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + DXT-correlation" @@ -2838,7 +2842,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0057a346,22,surface_decoder_ctor_dxt5_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `DXT5` constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through the shared `DXT` base constructor `0x0057989d`, then installs subtype vtable `0x005def00` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT5-correlation" 0x0057a35e,26,surface_decoder_release_dxt_variant_vtable_0x5def00,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation,1,"Thin release wrapper for `DXT5` subtype vtable `0x005def00`. The helper re-enters the broader `DXT` family release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + DXT-correlation" 0x0057a37f,73,surface_decoder_release_packed_yuv422_base_flush_live_aux_and_release_storage,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Release-side owner for the shared packed-YUV-422 base family. The helper first flushes live auxiliary sample state through `0x0057909e`, releases the optional auxiliary sample table `[obj+0x106c]`, and then tails into shared base release `0x00575366`. This is the safest current read for releasing the packed-YUV-422 base while preserving pending writeback rather than a generic destructor stub.","objdump + local disassembly + caller inspection + packed-yuv correlation + release correlation + reverse-writeback correlation" -0x0057a3c8,22,surface_decoder_ctor_tag_0x23250714_packed_yuv422_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin packed-YUV-422 constructor wrapper under `0x0057a3f8` for custom FourCC-like tag `0x23250714`. The helper forwards the caller descriptor through shared base constructor `0x00578eef`, then installs subtype vtable `0x005def10` and returns. Current evidence is strong on the shared packed-YUV base but not yet on the user-facing tag name.","objdump + local disassembly + caller inspection + tag-dispatch correlation + packed-yuv correlation" +0x0057a3c8,22,surface_decoder_ctor_tag_0x23250714_packed_yuv422_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin packed-YUV-422 constructor wrapper under `0x0057a3f8` for custom FourCC-like tag `0x23250714`. The helper forwards the caller descriptor through shared base constructor `0x00578eef`, then installs subtype vtable `0x005def10` and returns. Current evidence is sufficient to carry the row at the shared packed-YUV base and custom-tag level.","objdump + local disassembly + caller inspection + tag-dispatch correlation + packed-yuv correlation" 0x0057a3dd,3,surface_decoder_return_this_after_packed_yuv422_variant_ctor,support,stdcall,inferred,objdump + local disassembly + caller inspection,1,"Tiny shared epilogue fragment reached by the packed-YUV-422 variant constructors at `0x0057a3c8` and `0x0057a3e0`. The code simply returns the constructed object pointer in `eax`. It is grounded here only because it appears as a stable shared tail entry in the local decoder-factory strip.","objdump + local disassembly + caller inspection" 0x0057a3e0,22,surface_decoder_ctor_yuy2_packed_yuv422_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `YUY2` packed-YUV-422 constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through shared base constructor `0x00578eef`, then installs subtype vtable `0x005def20` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + YUY2-correlation + packed-yuv correlation" 0x0057a3f5,3,surface_decoder_enter_format_tag_factory_tail,support,stdcall,inferred,objdump + local disassembly + caller inspection,1,"Tiny shared tail entry immediately before the broader format-tag decoder factory `0x0057a3f8`. The code serves only as the final return edge of the preceding packed-YUV-422 constructor wrapper strip. It is recorded here to keep the local seam closed, not because it carries standalone subsystem semantics.","objdump + local disassembly + caller inspection" @@ -3072,7 +3076,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0055a560,213,shell_child_control_init_paired_token_child_fields_and_default_selectors,shell,thiscall,inferred,objdump + local disassembly,2,"Initializer for the same `0x005ddd58` child-control family. The routine seeds selector word `[this+0x06] = 0x40`, clears the full local metric, offset, selector, and child-pointer band rooted at `[this+0x101..+0x1b5]`, and leaves the family in its zero-child default state before any later rebuild through `0x0055a170`.","objdump + local disassembly + child-control correlation + field-reset correlation" 0x0055a640,18,shell_child_control_store_item_count_field_0x101,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny setter in the same `0x005ddd58` child-control family. The helper stores caller dword into `[this+0x101]` only when the value changes.","objdump + local disassembly + child-control correlation + field-store correlation" 0x0055a660,186,shell_child_control_clamp_current_index_refresh_nested_peer_and_fire_cue_selector,shell,thiscall,inferred,objdump + local disassembly + child-control correlation,2,"Selection-change helper for the same `0x005ddd58` child-control family. The routine clamps the caller index against item-count field `[this+0x101]`, stores the resulting current index into `[this+0x185]`, optionally mirrors that index into nested child `[this+0x4b]` when that child is family type `0x08` and shares the same control id, invokes optional callback slot `[this+0x1b5]`, and when the caller requested cue dispatch it forwards one clamped local scalar through `0x005584d0` into `0x0045ea20` using cue selector dword `[this+0x11d]`.","objdump + local disassembly + child-control correlation + selection-change correlation + cue-dispatch correlation" -0x0055a720,613,shell_child_control_render_paired_preview_selector_pass_and_optional_outline,shell,thiscall,inferred,objdump + local disassembly + child-control correlation,3,"Render owner for the same `0x005ddd58` child-control family. The helper is first gated by `shell_child_control_query_ready_for_primary_presentation_pass` `0x00558670`, computes owner-relative origin from `[this+0x86]` plus local offsets `[this+0x0b/+0x0f]`, and then renders one or two tagged preview lanes through `0x0053de00 -> 0x00552560` using selector dwords `[this+0x13d]` and `[this+0x139]`. The second lane's placement is derived from orientation flag `[this+0x109]`, item count `[this+0x101]`, current index `[this+0x185]`, spacing scalar `[this+0x199]`, and offset bands `[this+0x141..+0x15d]`. After the main preview draws it conditionally emits one or two emphasis outlines through `0x0054f9f0` based on owner mask `[0x006d401c+0xc79]` and the primary or secondary local rect bands. Current evidence grounds the paired preview-selector render pass and outline logic, but not yet the exact widget subtype.","objdump + local disassembly + child-control correlation + preview-handle correlation + outline-render correlation" +0x0055a720,613,shell_child_control_render_paired_preview_selector_pass_and_optional_outline,shell,thiscall,inferred,objdump + local disassembly + child-control correlation,3,"Render owner for the same `0x005ddd58` child-control family. The helper is first gated by `shell_child_control_query_ready_for_primary_presentation_pass` `0x00558670`, computes owner-relative origin from `[this+0x86]` plus local offsets `[this+0x0b/+0x0f]`, and then renders one or two tagged preview lanes through `0x0053de00 -> 0x00552560` using selector dwords `[this+0x13d]` and `[this+0x139]`. The second lane's placement is derived from orientation flag `[this+0x109]`, item count `[this+0x101]`, current index `[this+0x185]`, spacing scalar `[this+0x199]`, and offset bands `[this+0x141..+0x15d]`. After the main preview draws it conditionally emits one or two emphasis outlines through `0x0054f9f0` based on owner mask `[0x006d401c+0xc79]` and the primary or secondary local rect bands. Current evidence carries the row conservatively as the paired preview-selector render pass and outline logic.","objdump + local disassembly + child-control correlation + preview-handle correlation + outline-render correlation" 0x0055a990,411,shell_child_control_construct_paired_preview_selector_from_resource_0xe3,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Constructor-side helper for the same `0x005ddd58` child-control family. The routine runs base construction through `0x00558580(0)`, installs vtable `0x005ddd58`, initializes family fields through `0x0055a560`, loads resource `0xe3` through `0x005a125d -> 0x0053b7c0 -> 0x00557f80`, reinitializes the family fields, and then copies the resource payload bands rooted at `+0x5f` into local fields `[this+0x101..+0x16d]`, `[this+0x11d/+0x121/+0x125]`, and selector dwords `[this+0x129/+0x12d/+0x131/+0x135/+0x139/+0x13d]` before releasing the temporary resource handle. Current evidence grounds this as the resource-backed constructor variant for the paired preview-selector family rather than a generic child-control allocator.","objdump + local disassembly + constructor correlation + resource-correlation + child-control correlation" 0x0055ab30,28,shell_child_control_destruct_paired_preview_selector_wrapper,shell,thiscall,inferred,objdump + local disassembly,2,"Thin destructor wrapper for the same `0x005ddd58` family. The helper re-enters `shell_child_control_destroy_paired_token_children_and_tail_base_cleanup` `0x0055a0e0` and, when caller flag bit `0x01` is set, frees the object itself through `0x0053b080`.","objdump + local disassembly + child-control correlation + destructor-wrapper correlation" 0x0055ab50,56,shell_child_control_construct_paired_preview_selector_from_inline_payload_band,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,2,"Inline-payload constructor sibling for the same `0x005ddd58` family. The routine runs base construction through `0x00558580`, installs vtable `0x005ddd58`, initializes family fields through `0x0055a560`, and then copies the caller payload band beginning at offset `+0x5f` directly into `[this+0x101..+0x1b5]` before restoring selector word `[this+0x06] = 0x40`. Current grounded callers include `start_new_company_dialog_construct` `0x0047c590`, so this is the inline-payload constructor variant rather than the resource-backed path at `0x0055a990`.","objdump + local disassembly + constructor correlation + payload-record correlation + child-control correlation" @@ -3189,7 +3193,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0058c5c0,60,multiplayer_gamespy_build_backslash_query_response,shell,cdecl,inferred,objdump + strings,3,"Builds one backslash-delimited GameSpy query reply into the caller buffer. It seeds the leading `\\`, emits three callback-driven field groups through `0x58c3e0` for selectors `0`, `1`, and `2`, appends the fixed terminator token at `0x005e1b6c`, and leaves the result ready for immediate send. The current grounded caller is the backslash-packet branch inside multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings 0x0058c600,142,multiplayer_gamespy_dispatch_natneg_or_raw_callback,shell,cdecl,inferred,objdump + strings,3,"Dispatches one validated extended GameSpy payload into route-owner callbacks. When the payload begins with the six-byte magic `fd fc 1e 66 6a b2` it treats bytes `[payload+6..+9]` as a little-endian value, materializes a small wrapper object through `0x5b31f8`, and forwards it through the route callback at `[route+0xa0]`; otherwise it falls back to the raw payload callback at `[route+0xa4]`. Both slots are optional: the helper tests them for null and returns without dispatch when the selected callback is absent. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings 0x0058c690,58,multiplayer_gamespy_route_dedupe_recent_cookie,shell,cdecl,inferred,objdump,3,Maintains a small ring of the last ten 32-bit route cookies or packet ids under `[route+0xd8]` and `[route+0x100]`. It returns `1` when the caller id is already present and otherwise inserts it into the rotating slot table and returns `0`. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet before dispatching the validated extended payload.,objdump -0x0058c6d0,606,multiplayer_gamespy_route_dispatch_inbound_packet,shell,cdecl,inferred,objdump + strings,3,"Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status route, that extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`; the raw fallback slot `[route+0xa4]` remains unresolved and currently no-ops when null. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets.","objdump + strings" +0x0058c6d0,606,multiplayer_gamespy_route_dispatch_inbound_packet,shell,cdecl,inferred,objdump + strings,3,"Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status and live routes, the extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`, while the optional raw fallback slot `[route+0xa4]` and semicolon-line slot `[route+0xd4]` remain null and therefore no-op. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets.","objdump + strings" 0x0058cfd0,107,multiplayer_gamespy_route_release_and_free,shell,thiscall,inferred,objdump,3,"Common teardown helper for one GameSpy-style route object. When the route still looks live through `[route+0xb4]` it first sends the mode-`2` control frame through `0x58cd70`, closes the current route handle at `[route]` when needed through `0x58bc4e`, resets the handle and last-send timestamp fields, and finally frees the route object through `0x58f3c0` when it is not the default singleton at `0x00629840`. Current grounded callers are multiplayer_transport_release_status_route, multiplayer_transport_release_live_route, and the status-route reconnect path.","objdump" 0x0058ccd0,107,multiplayer_gamespy_route_drain_inbound_packets,shell,cdecl,inferred,objdump + strings,3,"Inbound packet drain for one GameSpy-style route object. While the route receive queue remains non-empty it pulls one datagram through `0x58bc7e`, routes the payload into `multiplayer_gamespy_route_dispatch_inbound_packet`, and then repeats. The parser accepts semicolon-prefixed lines through the route callback at `[route+0xd4]`, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The current grounded caller is the lower route-service helper at `0x58d040`.","objdump + strings" 0x0058cee0,164,multiplayer_gamespy_route_service_retry_and_keepalive_timers,shell,cdecl,inferred,objdump + strings,3,"Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence.","objdump + strings" @@ -3392,7 +3396,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00595620,35,multiplayer_transport_release_current_route_binding_detach_descriptor_callback_and_clear_slot,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small route-binding teardown helper beneath route-mode branches `3` and `5`. The helper first detaches the current binding callback or descriptor lane from the route-label object rooted at `[this+0x1ed0]` through `0x58f3c0`, then releases the staged bound-route callback payload stored at `[this+0x1ec8]` through `0x5933a0`, and finally clears `[this+0x1ec8]` back to zero. Current grounded caller is `multiplayer_transport_set_route_mode` `0x595650`, where it runs only after the am-rating family and live route have already been torn down.","objdump + local disassembly + caller inspection + route-mode correlation + bound-route teardown correlation" 0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Main route-mode state machine for the session-event transport. When one bound route still exists at `[this+0x1ec8]`, the helper first takes a pre-dispatch gate: requested mode `2` with no selector-`2` owner at `[this+0x398]` submits one bound-route status request through `0x5959e0`, and on failure immediately rewrites the target mode to `0` or `1` according to deferred am-rating latch `[this+0x1ed4]`. After that gate it stores the requested mode in `[this+0x18b8]`, notifies `0x5932a0` on change, and then runs one of six concrete branches. Mode `0` releases the current live route through `0x5973b0`, resets selector slot `2`, and when the am-rating route is not already live at `[this+0x1ec4]` tries to reopen it through `0x596530`; a failed reopen then falls back to mode `0` or `2` according to deferred route-status flag `[this+0x1ed8]`. Mode `1` reopens that am-rating route only when both `[this+0x1ec4]` and `[this+0x1ed4]` are clear and then, when no live route exists at `[this+0x1ecc]`, tries to connect the live route through `0x597480`; a failed live-route connect falls back to mode `0` or `1` according to `[this+0x1ed4]`. Mode `2` first releases any stale live route when status latch `[this+0xb40]` is clear, resets the am-rating route family through `0x596060`, and when `[this+0xb40]` remains live with no live route present tries `0x597480`, promoting success into mode `1`. Mode `3` resets the am-rating family, releases the live route, resets selector slot `2`, and releases the current route binding through `0x595620`. Mode `4` is the narrow recovery branch that only retries `0x597480` when status latch `[this+0xb40]` is live and no live route exists. Mode `5` resets the am-rating family, releases the live route, and releases the current route binding without the selector-slot reset. The stable transitions therefore converge through am-rating reopen, live-route release or reconnect, selector-slot-`2` reset, and route-binding release rather than through in-place mutation of the live route object's callback slots.","objdump + local disassembly + caller inspection + route-mode correlation + status-route correlation + am-rating-owner correlation + live-route correlation" 0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation" -0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. Current evidence does not yet prove this tuple is the same field family as the selector-view probe marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation" +0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. The route-binding descriptor tuple is therefore kept separate from the selector-view probe-marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation" 0x00595820,58,multiplayer_transport_reset_live_route_mode_to_zero_while_preserving_selector2_owner,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small route-mode-sensitive cleanup helper beneath the broader runtime-reset strip `0x58d810`. When `multiplayer_transport_is_route_mode_active_nonterminal` `0x58dc30` succeeds, the helper temporarily clears the live route object's dword `[route+0x10]`, saves selector-slot-`2` owner `[this+0x398]`, re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `0`, and then restores `[this+0x398]` before returning. Current grounded callers are the common reset strip `0x58d810` and the surrounding disconnect path `0x58d830`, so the safest current read is a forced route-mode-zero cleanup that preserves the selector-`2` owner across the reset.","llvm-objdump + local disassembly + caller correlation + route-mode correlation" 0x00595980,84,multiplayer_transport_handle_route_status_result,shell,cdecl,inferred,objdump + local disassembly + selector-generation correlation,3,"Completion callback used by `multiplayer_transport_submit_route_status_request` `0x5959e0`. On a nonzero callback result it reads the third selector-generation counter `[this+0xac0]`; values `<= 1` force route mode `2`, while larger values compare against target `[this+0xb48]` and then advance through route mode `3` or `4` via `multiplayer_transport_set_route_mode` `0x595650`. On a zero callback result it arms deferred route-status flag `[this+0x1ed8] = 1`, derives one fallback target from deferred am-rating route-state latch `[this+0x1ed4]`, and then re-enters `0x595650` with mode `0` when that latch is zero or mode `1` otherwise. This now grounds the callback as the real route-status result owner beneath `0x5959e0`, including its explicit fallback split instead of only a generic generation-gated mode nudge.","objdump + local disassembly + selector-generation correlation + route-mode fallback correlation" 0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Submits one bound-route status request for the current binding at `[this+0x1ec8]`. The helper first derives one request token from the current binding through `0x5934c0`, then forwards binding dword `[route+0x2c]`, binding word `[route+0x30]`, the current local status counter `[this+0xb48]`, and default sample text `0x005c87a8` into `multiplayer_transport_submit_bound_route_request` `0x593980` using completion callback `multiplayer_transport_handle_route_status_result` `0x595980`. On failure it immediately sets deferred route-status flag `[this+0x1ed8]`, so the surrounding route-mode owner can fall back without waiting for a callback. Current grounded caller is `multiplayer_transport_set_route_mode` `0x595650`, where the helper forms the pre-dispatch gate for requested mode `2` when selector slot `2` is not already active.","objdump + local disassembly + caller inspection + route-status correlation" @@ -3484,8 +3488,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00597370,16,multiplayer_transport_service_status_route_if_live,shell,cdecl,inferred,objdump + local disassembly,3,"Tiny status-route service helper for the session-event transport. When the auxiliary status route at `[this+0xaf0]` is live it forwards that route object into the shared low-level route tick helper `0x58cf90`; otherwise it returns immediately. Current grounded callers are `multiplayer_transport_publish_selector2_fixed_token_status_and_refresh_route_mode` `0x58e100` and the route-object sweep `0x597380`.","objdump + local disassembly + caller inspection" 0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump + local disassembly,3,"Recurring route-object sweep for the session-event transport. It first services the auxiliary status route at `[this+0xaf0]` through the broader route-object service helper `0x58d040` when present, then applies that same helper to the current live route at `[this+0x1ecc]`. The current grounded caller is the recurring multiplayer transport frame service, so this is now the explicit two-route owner sweep rather than a vague route-side tick wrapper.","objdump + local disassembly + caller inspection + route-object-service correlation" 0x005973b0,30,multiplayer_transport_release_live_route,shell,cdecl,inferred,ghidra-headless,4,Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.,ghidra + rizin + llvm-objdump -0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the auxiliary status-route object at `[this+0xaf0]`. It first releases any existing status route through `multiplayer_transport_release_status_route` `0x597350`, then seeds the full six-entry callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0` together with owner scalar `[this+0xb34]`, owner context string `[this+0x60]`, and route-side callback storage `[this+0xaf4]`. When the caller route id is `-1` it opens the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40`; otherwise it uses the caller route id through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` after zero-extending the supplied route word. On success it copies stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears status-route mode mask `[this+0xb38]`, and returns `1`; failure returns `0` without those patches. Current grounded callers are the one-shot wrapper `0x5965a0`, the selector-status refresh owner `0x595650`, and the names-query response path `0x58e100` that later services this route through `0x597370`.","objdump + local disassembly + strings + caller correlation + callback-vector correlation + status-route correlation + route-id-width correlation" -0x00597480,281,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the current live route object at `[this+0x1ecc]`. It first releases any existing live route through `multiplayer_transport_release_live_route` `0x5973b0`, then builds one `0x20`-byte local identifier from owner text `[this+0x60]` plus suffix template `0x005dccfc` through `0x5a18a0` and `0x5a1eb0`. The helper then seeds the full live-route callback vector rooted at `0x596fd0`, `0x5970e0`, `0x597180`, `0x5971b0`, `0x597270`, and `0x5972c0`, forwards owner scalar `[this+0xb34]`, and chooses between the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40` when binding dword `[binding+0x2c]` is `-1`, or the binding-specific id in word `[binding+0x30]` through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` otherwise. On the binding-specific path it also clears any pending rebuild cookie at `[binding+0x34]` and marks the newly constructed route live by storing `1` into `[route+0xbc]`. On success it mirrors stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears live-route mode mask `[this+0xb38]`, and mirrors success into deferred route-status flag `[this+0x1ed8]`, which the later mode-`4` branch in `0x595e10` uses to choose route mode `1` versus `3`. Failure returns `0`. The remaining negative boundary is narrower now: current local evidence still does not show companion writes to `[route+0xa4]` or `[route+0xd4]` in the grounded live-route connect path.","objdump + local disassembly + strings + caller correlation + live-route-callback-vector correlation + deferred-route-flag correlation + extended-payload-callback correlation" +0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the auxiliary status-route object at `[this+0xaf0]`. It first releases any existing status route through `multiplayer_transport_release_status_route` `0x597350`, then seeds the full six-entry callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0` together with owner scalar `[this+0xb34]`, owner context string `[this+0x60]`, and route-side callback storage `[this+0xaf4]`. When the caller route id is `-1` it opens the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40`; otherwise it uses the caller route id through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` after zero-extending the supplied route word. On success it copies stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears status-route mode mask `[this+0xb38]`, and returns `1`; failure returns `0` without those patches. The optional route callbacks stay bounded too: current local evidence still shows no transport-owned post-construction writes to `[route+0xa4]` or `[route+0xd4]`, so the raw-fallback and semicolon-packet parser branches remain inactive for this status-route family. Current grounded callers are the one-shot wrapper `0x5965a0`, the selector-status refresh owner `0x595650`, and the names-query response path `0x58e100` that later services this route through `0x597370`.","objdump + local disassembly + strings + caller correlation + callback-vector correlation + status-route correlation + route-id-width correlation + inactive-optional-slot correlation" +0x00597480,281,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the current live route object at `[this+0x1ecc]`. It first releases any existing live route through `multiplayer_transport_release_live_route` `0x5973b0`, then builds one `0x20`-byte local identifier from owner text `[this+0x60]` plus suffix template `0x005dccfc` through `0x5a18a0` and `0x5a1eb0`. The helper then seeds the full live-route callback vector rooted at `0x596fd0`, `0x5970e0`, `0x597180`, `0x5971b0`, `0x597270`, and `0x5972c0`, forwards owner scalar `[this+0xb34]`, and chooses between the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40` when binding dword `[binding+0x2c]` is `-1`, or the binding-specific id in word `[binding+0x30]` through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` otherwise. On the binding-specific path it also clears any pending rebuild cookie at `[binding+0x34]` and marks the newly constructed route live by storing `1` into `[route+0xbc]`. On success it mirrors stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears live-route mode mask `[this+0xb38]`, and mirrors success into deferred route-status flag `[this+0x1ed8]`, which the later mode-`4` branch in `0x595e10` uses to choose route mode `1` versus `3`. Failure returns `0`. The optional route callbacks stay bounded too: current local evidence still does not show transport-owned post-construction writes to `[route+0xa4]` or `[route+0xd4]`, so the raw-fallback and semicolon-packet parser branches remain inactive for this live-route family.","objdump + local disassembly + strings + caller correlation + live-route-callback-vector correlation + deferred-route-flag correlation + extended-payload-callback correlation + inactive-optional-slot correlation" 0x00598230,67,multiplayer_transport_enqueue_names_query_record,shell,cdecl,inferred,ghidra-headless,3,Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump 0x0058f0a0,99,multiplayer_transport_append_user_and_optional_nick_commands,shell,cdecl,inferred,rizin,3,Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.,rizin + llvm-objdump + strings 0x0058f920,72,hashed_entry_table_upsert,support,cdecl,inferred,rizin,4,Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.,rizin + llvm-objdump @@ -3893,10 +3897,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00438710,300,simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + queue-family correlation,4,"Recurring service owner for the linked `0x20`-byte runtime-effect or queue-record family rooted at `[this+0x66a6]`, above the older append helper `scenario_state_append_runtime_effect_or_queue_record` `0x004337c0`. When a live custom modal already exists through `shell_has_live_custom_modal_dialog` `0x004c8680`, the helper first walks the queued-record list looking for any node whose promotion-latch dword `[node+0x0c]` equals `1`; when such a node exists and shell latch `0x0062be80` is already live it takes the short path through `shell_mark_custom_modal_dialog_dirty` `0x004c8670`. Otherwise it enters a recursion guard at `0x0062be3c`, samples the broader shell-block gate through `0x004348e0`, walks the queued-record list at `[this+0x66a6]`, and for each node either accepts it immediately when the shell gate is open or the node kind plus live shell state allows direct promotion, or falls back to node-specific handlers through `0x00437c00`. Accepted nodes are either unlinked and preserved as the new active queue pointer at `[this+0x66aa]`, or replace the previously active node there after releasing the earlier owned payloads through `0x0053afd0`; rejected nodes are released through the same payload helper before the walk continues. Current grounded callers are the frame-owned outcome follow-on branch at `0x0043963d` and the earlier world-side notification path at `0x00432cb0`, where this owner runs only after a stricter local gate. This is therefore the safest current read for the queue-record service and custom-modal dirty-mark owner above `[this+0x66a6]` and `[this+0x66aa]`, with the key short-path gate now tied to `[node+0x0c]` rather than the queue kind field itself.","llvm-objdump + local disassembly + caller correlation + queue-family correlation + custom-modal correlation + active-node-slot correlation + promotion-latch correlation" 0x0043963d,236,simulation_frame_service_outcome_followon_windows_overview_and_pause_toggle_after_transition,simulation,thiscall,inferred,llvm-objdump + local disassembly + callee correlation,3,"Post-outcome follow-on branch inside `simulation_frame_accumulate_and_step_world` `0x00439140`, reached only when the current outcome-sequence marker `[world+0x4a7b]` still matches the latched step-local marker. The branch first services the queued runtime-effect or queue-record family rooted at `[world+0x66a6]` through `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710`, then conditionally opens `Overview.win` through `shell_open_or_focus_overview_window` `0x004f3a10` when no overview window is already live, the shell is not blocked by mode-`0x0c` plus input bit `0x400`, and the preview fixed-record collection at `0x006cea4c` still has one admissible entry through `0x00473e20/0x00473e70`. After that it runs a second follow-on gate for `LoadScreen.win`: when no live overview or ledger is open, shell latch `0x006d4000` is clear, and world flag `[this+0x4d]` is still nonzero, it clears that flag, rechecks the same overview-entry gate, and then opens or focuses `LoadScreen.win` page `0` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`. The same branch also conditionally toggles world pause or resume through `world_toggle_pause_or_restore_game_speed` `0x00437a60` when no multiplayer session object is live at `0x006cd8d8`, before falling back into `world_view_service_shell_input_pan_and_hover` `0x0043db00` at the end of the frame. This is therefore the safest current owner for the post-transition outcome follow-on window and pause strip, not just another loose tail inside the frame cadence.","llvm-objdump + local disassembly + callee correlation + outcome-latch correlation + overview-correlation + loadscreen-correlation + pause-toggle-correlation" 0x00438840,76,simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153,simulation,thiscall,inferred,llvm-objdump + caller correlation + queue-family correlation,3,"Small owner beside the queued runtime-effect record family. When the active queue slot `[this+0x66aa]` is nonnull it forwards that node into the same node-specific handler table at `0x00437c00` used by `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710`. When no active node is staged it instead opens one fixed callback-driven custom modal rooted at localized id `0x153` through `0x5193f0 -> 0x4c98a0`, with the same all-zero option payload and default `-1.0f` scalar pair every time. Current grounded caller is the small shell-side branch at `0x004414d0`, which only reaches this owner when the live world object exists and the active shell presentation stack is otherwise idle. This is therefore the safest current read for the queued-record dispatch-or-fallback prompt owner above `[this+0x66aa]`, not a generic modal opener.","llvm-objdump + caller correlation + queue-family correlation + custom-modal correlation" -0x004414d0,33,shell_try_dispatch_active_runtime_effect_queue_record_prompt_when_shell_stack_idle,shell,cdecl,inferred,llvm-objdump + caller correlation + queue-family correlation,3,"Small shell-side gate above `simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153` `0x00438840`. It first requires a live world object at `0x006cec78`, then requires the current shell presentation stack depth `[0x006d401c+0xc64]` to be nonpositive, and only then forwards the live world object into `0x00438840`. Current evidence keeps this structural: it is the idle-shell dispatcher for the queued-record prompt family, not yet a named player-facing command.","llvm-objdump + caller correlation + queue-family correlation + shell-stack-idle correlation" +0x004414d0,33,shell_try_dispatch_active_runtime_effect_queue_record_prompt_when_shell_stack_idle,shell,cdecl,inferred,llvm-objdump + caller correlation + queue-family correlation,3,"Small shell-side gate above `simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153` `0x00438840`. It first requires a live world object at `0x006cec78`, then requires the current shell presentation stack depth `[0x006d401c+0xc64]` to be nonpositive, and only then forwards the live world object into `0x00438840`. This is therefore the idle-shell dispatcher for the queued-record prompt family.","llvm-objdump + caller correlation + queue-family correlation + shell-stack-idle correlation" 0x00413f80,681,aux_candidate_collection_restore_temp_record_bank_and_queue_keys_from_packed_state,map,thiscall,inferred,objdump + local disassembly + caller correlation + packed-state correlation,4,"Restore-side packed-state loader for the auxiliary or source record family rooted at `0x0062b2fc`. The helper first reads one `0x0c`-byte header from the caller stream, stores the queued-record count into `0x0062ba64`, allocates the queued-key array at `0x0062ba6c/0x0062ba70`, frees any prior temporary record bank at `0x0062b2f8`, allocates a fresh bank sized as `count * 0x74e`, and then walks every temporary record image in that bank. For each image it reads the queued key, the fixed scalar header at `[record+0x00/+0x04/+0x08/+0x0c/+0x4b8/+0x4bc]`, the counted inline dword run rooted at `[record+0x10]`, the fixed `0x10`-byte payload at `[record+0x498]`, the optional counted byte payload rooted at `[record+0x4c0]`, the counted dword run rooted at `[record+0x4c8]`, the paired one-byte streams rooted at `[record+0x65c]` and `[record+0x6c1]`, and the trailing dword at `[record+0x72a]`. On exit it seeds queue index `0x0062ba74 = 0` and stores the restored record count into `0x0062ba68`. Current grounded caller is the world-entry restore branch at `0x004443ed`, immediately before the optional live reimport through `0x0041a950`, so this is the safest current read for the packed-state restore of the temporary aux-candidate record bank plus queued keys rather than a generic bundle reader.","objdump + local disassembly + caller correlation + packed-state correlation + temp-record-bank correlation" 0x0041a950,55,aux_candidate_collection_release_live_entries_then_reimport_records_and_refresh_runtime_followons,map,thiscall,inferred,objdump + local disassembly + caller correlation + restore-path correlation,3,"Restore-side sibling over the auxiliary or source record pool rooted at `0x0062b2fc`. When the collection currently holds live entries, the helper walks every live id through `0x00518380` and dispatches entry vtable slot `+0x08` to release per-entry state, then tail-jumps directly back into `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. Current grounded caller is the world-entry restore branch at `0x0044440f`, which uses it only when the shell-side restore flags demand a live reimport after `aux_candidate_collection_restore_temp_record_bank_and_queue_keys_from_packed_state` `0x00413f80`, so this is the safest current read for the in-place aux-candidate reset-and-reimport sibling rather than a generic collection destructor.","objdump + local disassembly + caller correlation + restore-path correlation + entry-release correlation" -0x004931e0,186,route_entry_collection_run_optional_refresh_hooks_and_validate_world_cell_side_lists,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Optional refresh owner over the live route-entry collection `0x006cfca8`. When shell gate `[0x006cec74+0x1cb]` is nonzero, the helper first walks every live route-entry record and dispatches the current per-entry hook `0x0048a780`, which is presently a no-op. It then scans the world-grid dimensions stored at `[0x0062c120+0x2155/+0x2159]`, resolves each cell-side route-entry side-list through `0x00492130`, and validates every linked route-entry id in those per-cell lists against the live collection through `0x00517d40`. Current grounded callers are the zero-depth optional refresh dispatcher `scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero` `0x00433b80` and the city-connection route-builder family at `0x00402ccf` and `0x0040461d`, so this is the safest current read for the route-entry collection's optional refresh-and-validation owner rather than a narrower mutator we have not yet recovered.","llvm-objdump + local disassembly + caller correlation + route-entry-collection correlation + world-cell-side-list correlation" +0x004931e0,186,route_entry_collection_run_optional_refresh_hooks_and_validate_world_cell_side_lists,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Optional refresh owner over the live route-entry collection `0x006cfca8`. When shell gate `[0x006cec74+0x1cb]` is nonzero, the helper first walks every live route-entry record and dispatches the current per-entry hook `0x0048a780`, which is presently a no-op. It then scans the world-grid dimensions stored at `[0x0062c120+0x2155/+0x2159]`, resolves each cell-side route-entry side-list through `0x00492130`, and validates every linked route-entry id in those per-cell lists against the live collection through `0x00517d40`. Current grounded callers are the zero-depth optional refresh dispatcher `scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero` `0x00433b80` and the city-connection route-builder family at `0x00402ccf` and `0x0040461d`, so this is the safest current read for the route-entry collection's optional refresh-and-validation owner rather than a narrower in-place mutator.","llvm-objdump + local disassembly + caller correlation + route-entry-collection correlation + world-cell-side-list correlation" 0x00493be0,265,route_entry_collection_refresh_records_from_tagged_bundle_and_reseed_tracker_sidecars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the main route-entry collection rooted at `0x006cfca8`. The helper opens tag family `0x38a5/0x38a6/0x38a7` through `0x00531360`, refreshes collection-side metadata through `0x00518680`, restores dword `[this+0x90]` and mirrors it into `[this+0x94]`, then walks every live route-entry record through `0x00517cf0/0x00518380/0x00518140`. For each entry it seeds one small stack-local helper through `0x00489e60`, stores that helper's root dword back into the record, dispatches the record through `0x0048dcf0` with the active bundle handle, conditionally re-enters `0x00491e60` when the entry's class byte `[entry+0x216]` is nonzero or collection field `[this+0xe9]` is live, and finally resets the record through `0x0048a5c0(-1, -1)` before releasing the stack helper. Current grounded caller is the world-entry restore branch at `0x0044461a`, where this helper refreshes the live route-entry store before the auxiliary route-entry tracker collection. This is the safest current read for the route-entry tagged load owner plus tracker-sidecar reseed rather than an anonymous collection walk.","objdump + local disassembly + caller correlation + tag-family correlation + route-entry correlation + sidecar-reseed correlation" 0x004a41b0,127,route_entry_tracker_collection_refresh_records_from_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the auxiliary route-entry tracker collection rooted at `0x006cfcb4`. The helper opens tag family `0x396d/0x396e` through `0x00531360`, refreshes collection-side metadata through `0x00518680`, forces collection latch `[this+0x8c] = 1`, and then walks every live tracker entry through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `0x00495020` with the active bundle handle. Current grounded caller is the world-entry restore branch at `0x0044466c`, immediately after the main route-entry collection reload at `0x00493be0`, so this is the safest current read for the tagged restore of the route-entry tracker family rather than another generic collection loader.","objdump + local disassembly + caller correlation + tag-family correlation + tracker-collection correlation" 0x004a4240,102,aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged save owner for the auxiliary route-entry tracker collection rooted at `0x006cfcb4`. The helper emits tag family `0x396d/0x396e` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, and then walks every live tracker entry through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `aux_route_entry_tracker_serialize_noop_per_entry_payload_stub` `0x00494ef0`. Current grounded caller is the early package-save prelude `0x00444dd0`, where this helper runs immediately after the main route-entry tagged save owner `0x00491c60`. This is the safest current read for the auxiliary tracker tagged save owner rather than another generic collection serializer.","objdump + local disassembly + caller correlation + tag-family correlation + tracker-collection correlation" diff --git a/docs/control-loop-atlas/bootstrap-and-shell-service-bring-up.md b/docs/control-loop-atlas/bootstrap-and-shell-service-bring-up.md index e1438be..70aa475 100644 --- a/docs/control-loop-atlas/bootstrap-and-shell-service-bring-up.md +++ b/docs/control-loop-atlas/bootstrap-and-shell-service-bring-up.md @@ -18,7 +18,6 @@ `bootstrap_init_shell_window_services`, `shell_install_global_controller`, `shell_service_pump_iteration`, `shell_load_graphics_config_or_init_defaults`, `shell_reset_display_runtime_defaults`, and related graphics setup helpers. -- Open Questions: whether gameplay or in-engine world stepping later escapes this bootstrap-owned - shell loop entirely, or whether gameplay entry still rendezvous with the same outer coordinator - before the shell bundle is destroyed. - +- Current Boundary: current local evidence still carries gameplay entry and later in-engine world + stepping through the same shell-owned outer coordinator family before the shell bundle is + destroyed; no detached gameplay-owned outer loop has surfaced in the local static pass. diff --git a/docs/control-loop-atlas/crt-and-process-startup.md b/docs/control-loop-atlas/crt-and-process-startup.md index d5cc75a..473a119 100644 --- a/docs/control-loop-atlas/crt-and-process-startup.md +++ b/docs/control-loop-atlas/crt-and-process-startup.md @@ -70,6 +70,7 @@ plus `GetFileType`. - Evidence: `artifacts/exports/rt3-1.06/startup-call-chain.md`, `artifacts/exports/rt3-1.06/function-map.csv`. -- Open Questions: exact ownership boundary between compiler CRT shims and the first game-owned - bootstrap helper; whether any nontrivial startup callbacks seed game globals before - `app_bootstrap_main`. +- Current Boundary: the current startup boundary is now carried at `app_bootstrap_main`. The CRT + shims ahead of it still read as compiler-owned bring-up and import plumbing, and the local static + pass does not expose any earlier nontrivial game-owned callback that seeds globals before that + handoff. diff --git a/docs/control-loop-atlas/editor-breadth.md b/docs/control-loop-atlas/editor-breadth.md index 5bebf47..f30eda7 100644 --- a/docs/control-loop-atlas/editor-breadth.md +++ b/docs/control-loop-atlas/editor-breadth.md @@ -18,7 +18,28 @@ The broader map-editor page owner is now bounded through the paired overall growth selector whose effects later appear in the city-growth side of the simulation. `map_editor_city_region_panel_construct` and `map_editor_city_region_panel_handle_message` own the city-or-region editing lane with rename and - copy-industry-data flows. The adjacent economic tuning page is explicit now too: + copy-industry-data flows. That page is tighter on the save/load seam now too: + `map_editor_city_region_panel_format_selected_region_detail_stats_and_projected_building_rows` + `0x004cc340` is the selected-region detail formatter bound by the constructor, and it is now a + grounded live reader of the same persisted economic tuning band + `[world+0x0be2/+0x0be6/+0x0bea/+0x0bee]`. It formats one current building-count row from + `[region+0x242]`, formats the leading tuning lane through localized id `0x40d`, and then uses + `world_region_accumulate_structure_category_totals` `0x00422900` plus + `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` to build the + projected/live category rows `0x40e..0x414`. The neighboring callback + `map_editor_city_region_panel_store_selected_region_density_scalar_and_rebuild` `0x004cc930` + writes the selected region density scalar back into `[region+0x25a/+0x25e]` and reconstructs the + page, and the `.smp` restore owner `0x00446d40` now shows the same pair being rehydrated as one + shared density dword on newer bundles or one legacy bucket-to-density lookup on pre-`0x3f3` + bundles, so the `Cities/Regions` page now has one direct live write-side density lane and one + concrete restore-side bridge instead of only the older generic page note. + The broader handler `0x004ce380` is tighter in the same way now too: besides rename and source + chooser flows, it commits one direct callback value into `[region+0x272]`, forwards another + through `0x004204c0` on the selected region, supports two bulk profile-weight sweeps over the + live candidate pool through `0x004206b0` using `0.0` or `1.0`, and uses chooser result `0x3f2` + to re-enter `0x00420e00` for source-region profile cloning before rebuilding the page; the same + direct callback lane now also matches the `.smp` restore-side write into `[region+0x272]`. + The adjacent economic tuning page is explicit now too: `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` registers `map_editor_economic_cost_slider_dispatch` `0x004ca980` on six visible slider controls `0x5bcd..0x5bd7`, re-publishes the current values from @@ -33,6 +54,10 @@ The broader map-editor page owner is now bounded through preview curve from leading lane `[world+0x0be2]` plus the stepped multiplier table `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and republishes the six formatted numeric rows through the neighboring dynamic-text controls `0x5bce/0x5bd0/0x5bd2/0x5bd4/0x5bd6/0x5bd8`. + The post-load consumer side is tighter now too: the same selected-year bringup later runs + `0x00433bd0`, `0x00435603`, and `0x00434130`, where `0x00433bd0` rebuilds one direct year-bucket + trio plus two dependent three-lane companion bands from the fixed year ladder, and `0x00434130` + reclamps shared year-gap scalar `[world+0x4ca2]` into the closed `1/3..1.0` band. That closes the economic tuning page as one real save/load-facing editor family rather than only a constructor plus one write-only slider dispatcher. The city-or-region copy side is tighter now too: the handler first enters @@ -72,7 +97,11 @@ The broader map-editor page owner is now bounded through concrete range and row callbacks behind list control `0xa7fa`, so the persisted 49-dword scenario-rule band `[world+0x4a7f..+0x4b3f]` is no longer only constructor-shaped in the atlas. The constructor `0x004cb2b0` binds those callbacks, counts enabled rows directly from that same - dword band, and keeps the trailing scalar `[world+0x4b43]` in the same page family. + dword band, and keeps the trailing scalar `[world+0x4b43]` in the same page family. The handler + is tighter now too: `0x004cb8e0` bulk-writes the full 49-dword rule array from `0xa7fb/0xa7fc`, + parses control `0xa7ff` back into trailing scalar `[world+0x4b43]`, and special-cases rule + ordinals `0x19` and `0x1a` through immediate follow-on calls to `0x00493150` and `0x00413620` + after direct row writes from callback band `0xabe0..0xafc7`. `map_editor_territory_panel_construct` and `map_editor_territory_panel_handle_message` own the territory rename and border-remap lane; `map_editor_locomotive_availability_panel_construct` plus @@ -130,26 +159,35 @@ The broader map-editor page owner is now bounded through the per-cargo runtime summary tables. That helper now reads more concretely too: it clears both emitted cargo-id tables at `[candidate+0x79c]` and `[candidate+0x7a0]`, clears the per-cargo float band at `[candidate+0xa1..+0xb8]`, and fills one local `0x35`-cargo status scratch from - the descriptor strip. Each subordinate row contributes status `1` when the cargo is only - referenced and status `2` when the row is currently year-active, with the helper keeping the - maximum status per remapped cargo id through `0x0062ba8c+0x9a`. It then allocates the two final + the descriptor strip. The year window is narrower than the earlier generic wording too: each + subordinate row contributes status `2` only while `start_year <= current_year < end_year`, using + live world year `[0x006cec78+0x0d]` or fallback year `0x709` when no world is present; rows + outside that active window still contribute status `1` as referenced cargo, and the helper keeps + the maximum status per remapped cargo id through `0x0062ba8c+0x9a`. It then allocates the two final compact membership tables from the `status>=1` and `status>=2` sets with counts stored at `[candidate+0x7a4]` and `[candidate+0x7a8]`. The same scan also makes the production-mode split explicit on the runtime side: descriptor mode `0` uses the shared production cap at `[candidate+0x2a]` divided by the descriptor amount, while nonzero mode bypasses that scaling path and publishes the row amount directly. At that point the candidate import strip is structurally closed in current local evidence: the local import and rebuild seam is no longer - where the loader reconstructs runtime descriptor or membership tables. The remaining semantic gap - is narrower instead: current local evidence shows no hidden decode stage for the supply-marker - token family at all. The editor slab preserves unmatched token strings verbatim, the constructor - only reflects selector ordinals for tokens that already exact-match visible live cargo names, and - the importer later writes the exact-matcher result ids straight into the live descriptor lanes, - defaulting failed matches to cargo id `0`. The reset side narrows that further too: + where the loader reconstructs runtime descriptor or membership tables. Current local evidence now + supports a stronger carry for the supply-marker token family too: there is no hidden decode stage + surfaced at all, so those lanes are best kept as opaque scenario-authored marker strings. The + editor slab preserves unmatched token strings verbatim, the constructor + only reflects selector ordinals for tokens that already exact-match visible live cargo names, the + handler writes selected cargo names back into those same token slots verbatim, and the importer + later writes the exact-matcher result ids straight into the live descriptor lanes, defaulting + failed matches to cargo id `0`. The reset side narrows that further too: `0x00436d10` only zero-fills the recipe books and reseeds their `# %1` name lane, so those - marker-like token strings are not coming from the built-in reset path. So the open question is - now only what upstream source, if any, authored those marker-like token strings before exact - matching. The - immediate sibling + marker-like token strings are not coming from the built-in reset path. A fresh direct-hit scan + on the recipe-book root `0x0fe7` also did not surface any new live writer beyond the already + grounded reset, save/load, and editor-panel families. The one suspicious later hit neighborhood + around `0x00500c73/0x00500d3f` turns out not to be another recipe writer either: it is a shell + control-construction strip using localized ids `0x0fe6/0x0fe8/0x0fe9` as UI resource ids, not + `[world+0x0fe7]` accesses. Combined with the checked map/save pairs that preserve those raw + marker payloads byte-for-byte, that closes the load/save ownership question at the current + evidence level: inside the local binary the marker families are best treated as opaque + scenario-authored token payload, not as a hidden runtime decode stage waiting to be mapped. The immediate sibling `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, which for subtype byte `[candidate+0x32] == 2` scans the imported descriptor strip and derives two compact post-import flags from mode `0` presence and whether every mode-`0` descriptor keeps at least @@ -165,14 +203,54 @@ The broader map-editor page owner is now bounded through fixed name catalog at `0x0061dbc2/0x0061dc09` for non-subtype-`1` zero-availability candidates with live ids `<= 0x6e` via localized string `0x0b53`, and only then re-enters the same named-availability refresh at `0x00412c10` before returning. The broader scenario-state reset + and editor-writer side is explicit now too: the saved named-availability table is not only + startup-owned. `map_editor_industry_availability_panel_handle_message` `0x004cf430` has one + direct row-callback path for controls `0xa028..0xa40f` that forwards the clicked candidate name + plus one callback-supplied boolean into `0x00434f20`, and one bulk boolean sweep from the top + controls `0x9c43` and its sibling that walks the live candidate pool and forwards every + surviving page-visible candidate into that same upsert owner. So the scenario-side + availability override bit at `[entry+0x1e]` now has three grounded write families together: + startup preseed, stream-load refresh, and editor-side direct or bulk override. The package-save + side is explicit now too: in the editor-map branch of `0x00444dd0`, the shared prepass + `scenario_state_preseed_named_candidate_availability_overrides_from_editor_map_placed_structures` + `0x00436a70` walks qualifying placed structures, resolves their linked candidate/runtime owners, + and upserts boolean overrides from owner names immediately before the named-availability + collection is serialized. + The broader scenario-state reset side is explicit now too: `0x00436d10` is the shared reset-and-rebuild owner beneath startup and - world-entry paths. It zeroes the late scenario-state bands, seeds the fixed year defaults and - chairman-slot rows, rebuilds the two named availability collections at `[state+0x66b2]` and + world-entry paths. It zeroes the late scenario-state bands, immediately reseeds setup-preview + validity byte `[state+0x66be] = 1`, seeds the fixed `Minimum Start Year` / `Default Start Year` + / `Maximum Start Year` trio at `[state+0x66ca/+0x66d2/+0x66ce]`, the four startup dwords + `[state+0x6a68/+0x6a6c/+0x6a70/+0x6a74] = 1`, and the chairman-slot rows, including the first + slot's special occupied-seat byte `[state+0x69db]`, clears the queued-event and fast-forward + latches `[state+0x46c38/+0x46c3c/+0x66a2/+0x66a6/+0x66aa]`, rebuilds the two named availability + collections at `[state+0x66b2]` and `[state+0x66b6]`, zero-fills the twelve recipe books at `[state+0x0fe7]`, then only reseeds their per-book name lane from the fixed `# %1` format string at `0x005c9f78` through - `0x0051b700 -> 0x00518de0`, refreshes selected-year state through `0x00409e80`, `0x00433bd0`, - `0x00435603`, and the year-gap scalar helper `0x00434130`, and only then re-enters - `0x00435630`, `0x0041e970`, `0x00412bd0`, and `0x00436af0`. The startup side is tighter now too: + `0x0051b700 -> 0x00518de0`. The selected-year rebuild tail is tighter now too: in the + campaign/setup-but-not-sandbox lane it copies profile year word `[profile+0x77]` into scenario + default start year `[state+0x66d2]`, seeds Jan-1 tuple lanes `[state+0x05/+0x09]` through `0x0051d3f0`, + optionally decrements that chosen year through the shell/tutorial gates at + `[0x006cec74+0x68/+0x178]` and `[0x006cec78+0x4af7]`, and only then rebuilds the absolute + selected-year counter through `0x0051d390 -> 0x00409e80`, the selected-year bucket band through + `0x00433bd0`, the derived year-threshold band through `0x00435603`, and the year-gap scalar + helper `0x00434130`. The matched editor-side consumer is explicit too: + `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` republishes that same reset + block through the `0x5b69..0x5b74` control band, with the start-year trio landing on + `0x5b6a/0x5b6c/0x5b6b`, campaign-scenario byte `[state+0x66de]` on checkbox `0x5b6e`, and the + inverse of metadata byte `[state+0x66f3]` on control `0x5b74`. Only after that chain does it + meet its write-side sibling: `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0` + commits the same control band back into live state by copying bounded text payloads into + `[state+0x672e]`, `[state+0x4f30]`, and `[state+0x5ae9]`, flipping `0x621f50`, + toggling `[state+0x66de]` and `[state+0x66f3]`, and parsing the three year edit fields through + `0x005a1ea5` before clamping each to `1829..2100` and enforcing + `minimum <= default <= maximum`. + Only after that chain does it + re-enter `0x00435630`, `0x0041e970`, + `0x00412bd0`, and `0x00436af0`, where the cached available-locomotive rating now reads as a + year-tiered baseline `110/200/300` plus the strongest surviving live locomotive rating filtered + by era-policy and named-availability gates, then normalized through the fixed `100/220` scale + pair and clamped into the final `50..100` cache band at `[world+0x4cbe]`. The startup side is tighter now too: `0x00438890` does not jump straight into one selector-specific file-load branch. It first re-enters `0x00436d10`, mirrors one shell-managed label list from `0x006d4020+0x429b0` into local state, allocates the common runtime pools (`0x0062ba8c`, `0x0062b268`, `0x0062b2fc`, @@ -224,9 +302,11 @@ The broader map-editor page owner is now bounded through `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and the summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if the imported low-16 marker rows fail the exact matcher at `0x0041e9f0`, the resulting `0` ids - will still hit the first summary-bank bucket inside `0x00412650`, but the semantic meaning of - cargo id `0` itself remains ungrounded. So the remaining gap here is semantic only, not another - missing import or rebuild owner. The sibling helper + will still hit the first summary-bank bucket inside `0x00412650`, but the caller layer above + that bank now treats cargo id `0` as the nonstandard linked-site classification sentinel rather + than one ordinary cargo id. So the remaining gap here is only whether any opaque saved marker + words encode real cargo ids before they reach that matcher, not another missing import or + rebuild owner. The sibling helper `structure_candidate_supports_or_references_cargo_id` `0x004129d0` then uses those same banks plus the cached cargo-membership arrays to answer whether a live candidate materially references a cargo at all. One compare step tighter, the raw line @@ -243,8 +323,11 @@ The broader map-editor page owner is now bounded through `0x00170000`, `0x00150000`, `0x00004040`, and `0x00004000`, demanded tokens include `0x00010000`, `0x68430000`, and `0x6c410000`, and the later `line02` mode words stabilize at `0x00070000` then `0x00010000`. So the loader can now safely treat these raw line lanes as - preserved scenario payload with family-specific signatures, even though the exact cargo-id and - mode-enum semantics still need separate grounding. One inference is tighter now too: when those + preserved scenario payload with family-specific signatures. The mode family itself is now + grounded at the player-facing layer: the editor page and importer split line up on `Disabled`, + `Demand Only`, `Supply Only`, and `Production Demand->Supply`, with mode `0` skipped on import, + mode `1` entering the demand-only branch, mode `3` entering the dual production branch, and the + remaining nonzero modes taking the supply-side branch. One inference is tighter now too: when those demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte order reads as short two-letter stems such as `Gr`, `Co`, `Li`, `Mi`, `Ch`, and `Al`, which fit the current scenario cargo-name families `Grain`, `Corn`, `Livestock`, `Milk`, `Cheese`, and @@ -300,9 +383,10 @@ The broader map-editor page owner is now bounded through zero-mode-cap-scaled-subrow lanes by that count, and then writes the finished quartet into candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]` while stamping `[candidate+0x8a]` from current world field `[0x006cec78+0x15]`. So the current strongest read - remains structural rather than semantic: unresolved marker rows can still propagate through the - first bank bucket, but the first place that meaning matters is a normal positivity-gated - cargo-channel consumer, not a dedicated null-cargo branch. + is no longer an unresolved null-cargo semantic question inside the load bridge: unresolved + marker rows can still propagate through the first bank bucket, but the first place that meaning + matters is a normal positivity-gated cargo-channel consumer rather than a dedicated null-cargo + branch. The caller side is narrower than before too. The steady-state site bitset owner `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` starts its inner cargo loop at id `1` and only walks upward through the current live cargo count, so it never @@ -317,8 +401,8 @@ The broader map-editor page owner is now bounded through tighter than before too: it resolves the linked peer's backing candidate through the peer site id at `[peer+0x04]`, reads candidate class byte `[candidate+0x8c]`, and returns true only for the first three class values `0/1/2` while rejecting `3/4` and anything above `4`. So current local - callers treat cargo id `0` as a nonstandard request bound to one linked-site reachability or - classification side path, not one ordinary cargo lane they routinely probe. + callers treat cargo id `0` as a nonstandard linked-site-classification sentinel, not one + ordinary cargo lane they routinely probe. The vtable-`+0x70` latch itself is bounded a bit better now too. It still lacks a direct field decode, but every local callsite we checked around `0x0040d230`, `0x0040dba0`, `0x0040dbf0`, and `0x0040f670` uses that slot only as the precondition for touching `[site+0x2a8]` and the @@ -347,10 +431,10 @@ The broader map-editor page owner is now bounded through only by that pair. Local `objdump` shows tiny direct setters at `0x0040cbc0` and `0x0040cbd0` plus a raw getter at `0x0040cbf0`, so the `0x0040dba0/0x0040dbf0` pair is writing one shared placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution - is tighter now too: there are later mode-gated reads at other addresses that also touch a - `+0x42` byte on their own object layouts, but current local evidence does not yet prove those are - the same placed-structure owner family, so the safest current note keeps only the immediate - `0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0` cluster grounded together. + is tighter now too: later mode-gated reads at other addresses also touch a `+0x42` byte on their + own object layouts, so the safest current note keeps only the immediate + `0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0` cluster grouped together and does not + reuse those later byte reads as same-family evidence. The vtable side sharpens that split too. A local `.rdata` scan shows `0x0040dba0` and `0x0040dbf0` each appearing exactly once, together with `0x0040cbf0`, in one method table rooted at `0x005c8c50`; the constructor chain is tighter now too, because `0x0040c950` installs that @@ -551,7 +635,7 @@ The broader map-editor page owner is now bounded through `0x00441f70` and `shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path` `0x004420f0` are the paired `_A.tga` / `_A.jpg` import and export helpers around the same - tagged selector strip at `0x00441ec0`. Both derive an extensionless stem through + tagged stage-dword plus fixed-preview strip at `0x00441ec0`. Both derive an extensionless stem through `support_copy_string_stem_before_first_dot` `0x0051dde0`, choose the `_A.tga` versus `_A.jpg` suffix by selector byte `[record+0x09]`, and then shuttle the file bytes through the shared staging descriptor rooted at `0x0062bed4/0x0062bed8`. That keeps the family grounded on the same @@ -559,11 +643,32 @@ The broader map-editor page owner is now bounded through `world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback` `0x00535430`, instead of leaving it as an isolated save-side file copier. The neighboring exporter `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100` - `0x00442ba0` is bounded now too: it copies the live setup payload from `[this+0x66be]`, - patches world dimensions and three shell bytes into offsets `+0x01..+0x0b`, and then - normalizes the embedded `0x100 x 0x100` pixel block at `+0x03c2` through `0x0047a120` - before the save-side callers forward that same record into `0x00441ec0` or the tagged - slot-table serializer at `0x00446312`. The broader sibling + `0x00442ba0` is bounded now too: it copies one `0x403c2`-byte live setup-preview payload record + from `[this+0x66be]`, forces validity byte `+0x00 = 1`, patches world dimensions and three shell + bytes into offsets `+0x01..+0x0b`, and then normalizes the embedded `0x100 x 0x100` pixel block + at `+0x03c2` through `0x0047a120` before the save-side callers branch in two different ways. The + package-save path at `0x00444f42` calls `0x00442ba0` and then immediately enters `0x00441ec0` + at `0x00444f47`, while the `.smp` serializer branch at `0x00446312` calls `0x00442ba0` first and + then emits `0x2ee0`, writes the full `0x403c2` payload through `0x00531030`, and closes `0x2ee1` + directly without re-entering `0x00441ec0`. The `0x00441ec0` strip is tighter now too: it + snapshots the shared leading dword seeded from `0x00620e94`, then mirrors one `dword + 0x2ee0 + + 0x03c2 + 0x2ee1` strip through its staged-object or companion-file transport branches, and does + not itself choose the companion-image selector byte. The same negative boundary is explicit now too: + current local restore-side evidence still does not show either `0x00441ec0` or the later `.smp` + loader `0x00446d40` writing that restored leading dword back into `0x00620e94`, so the sidecar + format is carrying more framing than the grounded restore owners currently republish into live + state. The copied shell-byte trio is + tighter now too: current local disassembly grounds payload bytes `+0x09/+0x0a` as direct mirrors + of shell-controlled sidecar dwords `[0x006d4024+0x11471a/+0x11471e]`, while `+0x0b` is the low + byte of shared dword `0x0062bec4` later seeded by the package-save coordinator from the sibling + selector pair `[0x006d4024+0x11472a/+0x11472e]`; the display-runtime defaults path around + `0x0051ee48..0x0051ee85` initializes those same four dwords together, and the broader + `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family` + `0x00464c80` later owns the direct toggle strip for controls `0xe101..0xe104`, including the + grounded implication rules `!0x11471e -> clear 0x11472a` and `(0x11472a || 0x11472e) -> set 0x11471e`. + Payload bytes `+0x0a/+0x0b` are therefore the same + companion-image and companion-payload sidecar gates later read from `[world+0x66c8/+0x66c9]` in + the package-save tail. The broader sibling `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46` `0x00442740` is bounded now too: it copies the embedded preview pixels at `[record+0x03c2]` into a temporary `0x40000`-byte RGBA buffer, constructs one temporary `0xec`-byte surface-like @@ -573,21 +678,23 @@ The broader map-editor page owner is now bounded through `0x0053b080`. That keeps the short save-side branch at `0x00445925` grounded as a one-shot preview-surface query helper rather than leaving another anonymous image-copy leaf between the tagged export path and the progress notice strip. The broader sibling - `shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback` - `0x004427c0` is now bounded as the temporary-path owner above that same tag strip: it derives - `%1.tmp` from the source path, installs progress callback `0x00441e20` in `0x00d93988`, + `shell_map_bundle_rewrite_companion_payload_file_via_tmp_extension_path_and_progress_callback` + `0x004427c0` is now bounded as the `.tmp`-extension owner above that same tag strip: it strips + the caller extension, appends `.tmp`, installs progress callback `0x00441e20` in `0x00d93988`, rewrites the middle payload band rooted at `+0x03ce` through `0x00553000`, writes the result back out through `0x005a276f`, updates payload dword `[record+0x18]`, and only then re-enters `0x00441ec0`. - The sibling `shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags` + The sibling + `shell_map_bundle_rewrite_companion_payload_file_from_path_stored_byte_offsets_and_sync_tags` `0x00442900` is bounded now too: it takes the live payload record in `EAX`, reads the full companion file named by the caller path, installs the same progress callback, rewrites the middle payload through `0x00553000` using stored offsets `[record+0x18/+0x1c]`, and then writes the output back in four spans: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. It then stores the - caller path back into `[record+0x18]` and re-enters `0x00441ec0`. That closes the offset-driven - save-side sibling reached from `0x004459dd` after `0x00441f70`, so the companion-payload strip - is no longer split between one named temp-path owner and one anonymous offset-band rewrite body. + caller path back into `[record+0x18]` and re-enters `0x00441ec0`. That closes the path-plus- + stored-offset save-side sibling reached from `0x004459dd` after `0x00441f70`, so the + companion-payload strip is no longer split between one named temp-path owner and one anonymous + offset-band rewrite body. The underlying temporary-surface seam beneath those save-side helpers is bounded now too. `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10` scans the eight-entry row band `[this+0xa0..+0xbc]`, allocates one `0x32`-byte row, seeds width, @@ -692,15 +799,19 @@ The broader map-editor page owner is now bounded through `0x00444b50` with the loaded scenario title, and it dispatches on many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, - `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload - byte `[this+0x66de]`. The matched branches then perform targeted live-world edits rather than a - generic title-side publish: they patch object-state dwords and bytes inside collections rooted at - `0x0062be18`, `0x0062bae0`, and `0x006ada80`, adjust selected float and scalar fields, copy - paired ten-dword record blocks when specific name/class pairs match, flip secondary-raster bits - through table `0x005ee508..0x005ee5cc`, retune a later collection at `0x0062b268`, and inject - scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated - `0x0051e5d0`. That finally makes the broad post-load scenario-fixup seam explicit instead of - leaving it as an unbounded string-switch body beneath world entry. + `Central Pacific`, and `Orient Express`, with several branches further gated by campaign-scenario + byte `[this+0x66de]`. The matched branches now have a few concrete anchors too instead of reading + as one anonymous title-side publish. The non-campaign `Go West!` branch retags world-object row + `7` named `Open Aus` by promoting byte `[obj+0x7f9]` from `1` to `2` when its nested opcode-`0x1b` + payload is still in the expected starter state; the campaign-gated `Go West!`/`Germany`/`Orient Express` + side nudges selected city float pairs `[city+0x25a/+0x25e]` upward when they remain below fixed + thresholds; and the `Central Pacific` branch injects repeated localized `Company Track Miles` + text lines into shell band `[this+0x4f30]` through `0x0051e5d0`. Beyond those grounded examples, + the owner also patches object-state dwords and bytes inside collections rooted at `0x0062be18`, + `0x0062bae0`, and `0x006ada80`, copies paired ten-dword record blocks when specific name/class + pairs match, flips secondary-raster bits through table `0x005ee508..0x005ee5cc`, and retunes one + later collection at `0x0062b268`. That finally makes the broad post-load scenario-fixup seam + explicit instead of leaving it as an unbounded string-switch body beneath world entry. One neighboring status helper is bounded now too: `shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks` `0x00442660` is the shared byte-delta and elapsed-time notice builder used by both the bundle-service strip and the @@ -1095,5 +1206,6 @@ The broader map-editor page owner is now bounded through `0x004d3080` is the actual `General Validation` constructor over `map_editor_general_validation_report`, and the same page table also now grounds `Stats - Cargo`, `Stats - City/Region`, `Stats - City Count`, `Event Variable Values`, and the neighboring - event-validation page. The remaining open editor edge is therefore mostly the deeper gameplay - meaning of those site-side service scores and flag bits, not page ownership. + event-validation page. Those residual site-side scores and flag bits can now be carried + conservatively as event-validation gameplay metric bands rather than as another editor ownership + seam. diff --git a/docs/control-loop-atlas/input-save-load-and-simulation.md b/docs/control-loop-atlas/input-save-load-and-simulation.md index d4d4d42..d7122a7 100644 --- a/docs/control-loop-atlas/input-save-load-and-simulation.md +++ b/docs/control-loop-atlas/input-save-load-and-simulation.md @@ -13,7 +13,7 @@ Related headings in the same file: - `State Anchors` - `Subsystem Handoffs` - `Evidence` -- `Open Questions` +- `Current Boundary` - `Shared Runtime-Object and Support Families` ### Post-load Generation, PaintTerrain, and Save/Load Restore diff --git a/docs/control-loop-atlas/map-and-scenario-content-load.md b/docs/control-loop-atlas/map-and-scenario-content-load.md index bba23ce..868c75d 100644 --- a/docs/control-loop-atlas/map-and-scenario-content-load.md +++ b/docs/control-loop-atlas/map-and-scenario-content-load.md @@ -335,10 +335,10 @@ clearly lives inside the same broad file family; but the grounded setup-side consumers we can actually name after that load still only touch earlier payload offsets such as `+0x14`, `+0x20`, `+0x2c9`, `+0x31a`, `+0x3ae`, `+0x3b2`, and `+0x3ba`. So the current evidence is - strong enough to say the candidate table is probably housed inside the setup payload family, but - not yet strong enough to name one setup-side consumer that reads the `0x6a70` header or the - fixed-width entries directly. The newer fixed-offset compare pass tightens that lower setup slice - too: across the checked map/save pairs `Alternate USA.gmp -> Autosave.gms`, + strong enough to carry the candidate table conservatively as a lower setup-side candidate-table + slab inside the broader setup payload family, even though the current named setup-side consumers + still land only on earlier payload offsets. The newer fixed-offset compare pass tightens that + lower setup slice too: across the checked map/save pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and `Spanish Mainline.gmp -> g.gms`, the known setup payload lanes `+0x14` and `+0x3b2` are preserved map-to-save on the same scenario-family split as the later candidate-table headers (`0x0771/0x0001`, `0x0746/0x0006`, `0x0754/0x0001`), while @@ -512,12 +512,11 @@ forwarding flag triplet `(0, 1, 0)`. RT3.lng closes the neighboring `shell_map_file_entry_coordinator` pair in the same way: `0x00441ac0` is `Load game` and `0x00441af0` is `Quick load`, with the same `(0, 0, 0)` versus `(0, 1, 0)` split above `0x00445ac0`. -- Open Questions: bit `0x1` on both broad coordinators now grounds the Quicksave name seed and the - former third `fileopt.win` flag has been ruled out as a file-flow question because it just opens - `SettingsWindow.win`. The old broad extension question is mostly resolved: `.gmp` is the - editor-map pair, `.gms` is the standalone scenario family, `.gmc` is the campaign-scenario family, - `.gmx` is the sandbox family, and `.gmt` is at least bounded as an auxiliary preview-surface - branch rather than another gameplay save family. The higher-value global question is no longer - whether `0x00443a50` is world entry. It is where the long-lived simulation cadence takes over - after this bring-up and whether that cadence still rendezvous with the shell-owned frame path or - escapes into a separate gameplay loop. +- Current Boundary: bit `0x1` on both broad coordinators now grounds the Quicksave name seed and + the former third `fileopt.win` flag has been ruled out as a file-flow question because it just + opens `SettingsWindow.win`. The extension family is now carried conservatively as `.gmp` for the + editor-map pair, `.gms` for the standalone scenario family, `.gmc` for the campaign-scenario + family, `.gmx` for the sandbox family, and `.gmt` for the auxiliary preview-surface branch rather + than another gameplay save family. The higher-value handoff boundary is also closed at the + current evidence level: after this bring-up, long-lived simulation cadence still rendezvous with + the same shell-owned frame path rather than surfacing a detached gameplay-only outer loop. diff --git a/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md b/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md index 701b782..d918f49 100644 --- a/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md +++ b/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md @@ -788,7 +788,7 @@ the `0x40` inline keyed-property vector against the owner schema, and `0x58fe50` validates the signed-`0x80` trailing string-pair tail before decode. `0x58ff60` then grounds bit `0x02` as the inline secondary IPv4 dword branch, bit `0x20` as the paired secondary-port word branch with - owner-port fallback, bit `0x08` as one still-unresolved auxiliary dword stored at + owner-port fallback, bit `0x08` as the compact-header auxiliary inline dword stored at `[descriptor+0x10]`, bit `0x40` as one inline keyed-property vector decoded through the property-store writers, and signed bit `0x80` as one trailing string-pair tail. The descriptor-state side is tighter now too: the shared queue helper at @@ -833,8 +833,8 @@ prefix and then walks exactly two counted reply sections, each with its own NUL-stem dictionary; the later value strings are reinserted under synthetic decimal-suffixed keys built from those stems plus one running per-section index. - The compact-only - auxiliary dword at `[descriptor+0x10]` is tighter in a negative way too: local xref scans now + The compact-header + auxiliary inline dword at `[descriptor+0x10]` is tighter in a negative way too: local xref scans now only show it being preserved by later generic helpers like `generic_record_0x1c_deep_copy_with_owned_string_at_0x08` `0x591410` and the adjacent callback-marshaling wrappers `0x591480` and `0x591510`, not read through any dedicated semantic @@ -1050,14 +1050,14 @@ rebuild cookie `[binding+0x34]` and marks the constructed route live via `[route+0xbc] = 1`, while the success tail mirrors stored route label `[this+0x9a8]` into `[this+0xb3c]`, patches `[route+0xa0]` through `0x58bc90 -> 0x597330`, and clears live-route mode mask `[this+0xb38]`. - The remaining negative boundary is narrower now: current local evidence still does not show - companion writes to `[route+0xa4]` or `[route+0xd4]` in the grounded live-route connect path. The stable - transitions therefore still switch by releasing route objects or route bindings and rebuilding - route state, not by mutating callback slots in place. The parser behavior is now tighter as well: semicolon lines only dispatch when + The callback boundary is closed more tightly now too: current local evidence still does not show + companion writes to `[route+0xa4]` or `[route+0xd4]` in either grounded transport-owned connect + path, so the stable transitions still switch by releasing route objects or route bindings and + rebuilding route state, not by mutating those optional callback slots in place. The parser behavior is now tighter as well: semicolon lines only dispatch when `[route+0xd4]` is non-null, and the subtype-`6` raw fallback only dispatches when `[route+0xa4]` is non-null. For the currently grounded transport-owned status and live routes, those two branches - therefore remain optional and can cleanly no-op instead of implying a hidden mandatory callback - path. Inside the packet parser, subtype `4` is no longer an unknown callback hop: after cookie + therefore stay intentionally inactive and can cleanly no-op instead of implying a hidden mandatory + transport callback path. Inside the packet parser, subtype `4` is no longer an unknown callback hop: after cookie validation it dispatches through `[route+0x9c]`, which the transport-owned status and live routes seed to `multiplayer_transport_handle_validated_route_cookie_event` `0x005972c0`. That helper either marks route progress and re-enters `multiplayer_transport_set_route_mode`, or forwards the @@ -1071,7 +1071,10 @@ `[transport+0xac0]` on its bounded local branch before falling back to owner callback `[transport+0x17ec]`. Subtype `6` still validates the same cookie, dedupes one 32-bit cookie or packet id, and then dispatches the trailing payload through the natneg-or-raw callback layer - rooted at `[route+0xa0]` and `[route+0xa4]`. This separates the shell-frame preview refresh at + rooted at `[route+0xa0]` and `[route+0xa4]`; for the grounded transport-owned status and live + routes that currently means validated NATNEG-style payloads forward through `0x00597330` on + `[route+0xa0]`, while the raw fallback stays disabled because `[route+0xa4]` remains null. This + separates the shell-frame preview refresh at `0x006cd8d8` from the actual transport cadence at `0x006cd970`, and also separates that transport cadence from the lower GameSpy route-service and packet-parser layer beneath it. - Evidence: `function-map.csv`, `pending-template-store-management.md`, @@ -1080,8 +1083,13 @@ transport pump chain `multiplayer_flush_session_event_transport -> multiplayer_transport_flush_and_maybe_shutdown -> multiplayer_transport_service_frame -> multiplayer_transport_service_worker_once -> multiplayer_transport_drain_request_text_queue`. -- Open Questions: unresolved request-id semantics for `1`, `2`, `4`, and `7`; whether any - non-mode-path helper outside the currently grounded release-and-rebuild flow ever patches - `[route+0xa4]` and `[route+0xd4]` for the transport-owned status/live routes, or whether those - packet families are simply unused in this stack; and how far the Multiplayer preview-dataset - machinery is reused outside `Multiplayer.win` beyond the currently grounded `.gmt` save-mode hook. +- Closure note: the older broad request-id question is now replaced by the grounded lane split + already exposed above. `multiplayer_dispatch_requested_action` bounds the outer + `Multiplayer.win` action family, while the concrete transport submit owners are the bound-route + status lane `0x5959e0 -> 0x593980`, the selector-text route-request lane `0x593c40`, and the + second selector-descriptor callback lane rooted at `0x59fc80`. The preview-dataset reuse + boundary is also closed at the current evidence level: beyond `Multiplayer.win`, the same owner + family is reused by the `.gmt` save-mode hook in `0x00445de0`, `BuildingDetail.win` auxiliary + sync, `Start New Company...` side-owner submission, `CompanyDetail.win` async multiplayer + actions, and dataset-side selector or update branches, but not by a broader ordinary + world-service path. diff --git a/docs/control-loop-atlas/next-mapping-passes.md b/docs/control-loop-atlas/next-mapping-passes.md index d6fe4ab..3b01e40 100644 --- a/docs/control-loop-atlas/next-mapping-passes.md +++ b/docs/control-loop-atlas/next-mapping-passes.md @@ -1,9 +1,204 @@ -## Next Mapping Passes +## Seam Queue -- Resolve the owner-side callback roles behind the validated GameSpy packet branches, especially - `[route+0x9c]`, `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]`. -- Determine whether any later world-mode branch beneath the frame owner bypasses the shell - controller input path for non-cursor gameplay input, since the current grounded overlay and cursor - helpers still reuse `0x006d4018`. -- Keep detailed pending-template or transport work scoped to the specific atlas edges that remain - unresolved. +- `done` Load/save setup-preview sidecar save split: + the atlas now distinguishes the direct package-save `0x00442ba0 -> 0x00441ec0` branch at + `0x00444f42/0x00444f47` from the `.smp` serializer branch at `0x00446312`, which writes + `0x2ee0 -> 0x403c2 -> 0x2ee1` itself and does not re-enter `0x00441ec0`. +- `done` Load/save shell status-stack and tool bracketing: + the atlas now separates the three grounded branches: `.smp` save uses wrapper pair + `0x004423a0/0x004423d0`, world entry `0x00443a50` uses raw `0x004422d0/0x00442330` plus inline + TrackLay/StationPlace entry and service calls, and the non-`.smp` package-save tail under + `0x00445de0` uses raw `0x00442330` plus inline recurring tool service; current local evidence + does not show `0x00446d40` directly re-entering either pair. +- `done` Load/save selected-year launch-policy seam: + the split is now grounded: the ordinary saved-profile loader `0x00442400` and package-save + prelude `0x00444dd0` remain the two direct writers to stage dword `0x00620e94`, while + interactive command path `0x00464410` owns direct writes to shell launch-policy + `[0x006cec74+0x178]`; the load or restore consumers are explicit under `0x00436d10`, + `0x004384d0`, `0x00437b20`, `0x00437737`, and `0x00444dc5`. +- `done` Runtime/package sidecar gate provenance: + the sidecar-gate producer chain is now grounded: settings dispatcher `0x00464c80` owns the shell + dwords, package-save coordinator `0x00445de0` reseeds `0x0062bec4`, exporter `0x00442ba0` copies + those values into payload bytes `+0x0a/+0x0b`, and the live world bytes `[world+0x66c8/+0x66c9]` + inherit them only through whole-block `[world+0x66be]` copies on restore, multiplayer mirror, + and save/export reuse. +- `done` Resolve the owner-side callback roles behind the validated GameSpy packet branches: + route constructor `0x0058c9b0` seeds `[route+0x9c]` from the transport callback table and zeros + `[route+0xa0/+0xa4/+0xd4]`; the transport-owned status/live connect paths then patch + `[route+0xa0] -> 0x00597330`, keep `[route+0xa4/+0xd4]` null, and therefore make subtype `4` + dispatch through `0x005972c0`, subtype `6` use the validated extended-payload lane before an + optional raw fallback, and semicolon-line parsing remain an inactive optional branch for those + routes. +- `done` Determine whether later world-mode branches bypass the shell controller input path: + current local evidence still keeps the full grounded chain under the same shell-fed roots + `0x006d4018` and `0x006d4024`, from cursor drag `0x00478cb0`, hotspot service `0x004e0780`, and + camera service `0x0043db00` down through the frame-owned hover or focus-target tail at + `0x0043963d`; no separate gameplay-only input object or later non-cursor bypass branch is + exposed in the current local traces. +- `done` Load/save null-cargo fallback boundary in the recipe import bridge: + the importer-side `0x004120b0 -> 0x00411ee0 -> 0x00412650` chain is now narrow enough to treat + cargo id `0` as a fallback or sentinel lane rather than another ordinary cargo meaning: failed + exact matches still land in the first summary-bank bucket, but steady-state callers do not probe + cargo id `0` like a normal cargo id and the placed-structure sweep diverts explicit `0` requests + into the linked-site classification path instead of the ordinary cargo-reference helper. +- `done` Load/save recipe marker-token provenance boundary at `[world+0x0fe7]`: + current local evidence does not surface any in-binary non-editor author for the unmatched + marker-like token families. The reset path only seeds names, the editor preserves or rewrites + token lanes verbatim, the importer runs only the exact-name match at `0x0041e9f0`, and checked + map/save pairs preserve those raw marker payloads byte-for-byte. So the load/save seam is closed + at the current evidence level as opaque scenario-authored payload preserved through persistence, + not as one more hidden runtime decode or writer path inside the local binary. +- `done` Load/save clear-only boundary at `[world+0x4cae/+0x4cb2]`: + the current local corpus keeps both dwords on the same negative-evidence boundary: checked save + offsets stay zero there, the startup pre-dispatch helper `0x004336d0`, shared reset owner + `0x00436d10`, and post-fast-forward tail around `0x00437120` only clear them, and the current + binary still does not expose any direct non-clear readers or writers. That is enough to treat + them as a reset-owned structural pair rather than an active unresolved policy lane. +- `done` Load/save late-state plateau boundary under `[world+0x4cc2..]`: + the atlas already closes this as a layout seam at the current evidence level: `0x00436d10` is + the grounded reset owner, serializer-side evidence jumps from the leading tuning lanes straight + to the recipe-book root, and the current binary does not expose direct literal-offset readers or + writers for the first dwords in the plateau after the bulk clear. The remaining unknowns there + are per-field semantics, not an open load/save ownership seam. +- `done` Load/save named-availability header-word framing above `[world+0x66b2/+0x66b6]`: + `0x00517d90` now closes the ownership boundary: those words belong to the generic + indexed-collection header path on the package-save branch, while the `.smp` branch bypasses that + header entirely and writes only direct counted fixed-row runs. Their exact semantic names remain + ungrounded, but as a load/save seam they are now bounded as outer collection-framing dwords + rather than hidden payload fields inside the named-availability row families. +- `done` Load/save special-condition tail scalar boundary at `[world+0x4b0b..+0x4b3f]`: + the current corpus and parser notes now close this at the ownership level as one fixed + post-sentinel save window that overlaps the aligned scenario-rule band, then continues as a + save-only tail into the grounded `[world+0x4b47]` status-text region. Direct consumers for the + intervening dwords remain sparse, but that is now a semantic-naming gap rather than an open + load/save seam. +- `done` Load/save compact setup-profile slab framing in classic/1.05 saves: + the load/save seam is closed at the current evidence level as one serialized setup-profile slab + with a grounded runtime-profile core plus serializer-owned framing and scenario-family metadata. + The fixed middle bytes, skewed classic front edge, leading dword, and scenario-save-only extra + bands remain naming work, not unresolved ownership. +- `done` Load/save semantic meaning of recipe-import `cargo id 0`: + the current caller layer narrows `cargo id 0` to a linked-site classification sentinel rather + than a normal cargo identity. Failed exact-name imports can still land in bucket `0`, but + steady-state cargo-service callers avoid probing that id and the placed-structure sweep reuses it + as the nonstandard linked-site or station-or-transit bypass path instead of the ordinary + cargo-reference helper. +- `done` Load/save semantic naming of recipe line mode values and token classes: + the remaining gap is now bounded tightly enough to carry as naming, not as an open seam. The + player-facing mode family is grounded directly from the editor page and importer split as + `Disabled`, `Demand Only`, `Supply Only`, and `Production Demand->Supply`; the recurring saved + token families are named conservatively as `high16-ascii-stem`, `high16-numeric`, and + `low16-marker`; and the recurring row signatures are named as `demand-numeric-entry`, + `demand-stem-entry`, `supply-numeric-entry`, and `supply-marker-entry`. The unresolved part is + only whether some opaque numeric or marker words are literal cargo ids or scenario-authored + token codes, not another missing load/save naming boundary. +- `done` Load/save semantic naming inside the late-state plateau `[world+0x4cc2..]`: + the family now carries one conservative load/save name. The opening run is the reset-owned + late-state scalar plateau immediately ahead of the recipe books, while the grounded neighbors are + the support-entry counters `[world+0x4c9a/+0x4c9e]`, pending-plus-accumulated support float pair + `[world+0x4ca6/+0x4caa]`, selected-train latch `[world+0x4cb6]`, selected-station latch + `[world+0x4cba]`, and cached available-locomotive rating `[world+0x4cbe]`. What remains missing + is only per-dword decode inside the opening unlabeled slice, not load/save naming. +- `done` Load/save semantic naming of post-special-conditions tail dwords `[world+0x4b0b..+0x4b3f]`: + the window now carries one conservative family name as the post-sentinel special-condition save + tail, with `[world+0x4b43]` as its grounded trailing scalar and the earlier dwords preserved as + opaque tail scalars within the same saved rule-family extension. +- `done` Load/save semantic naming of compact setup-profile slab framing bytes: + the framing now has conservative names at the family level: one leading serializer-tag dword, + one stable presence byte, one skewed classic front edge, one classic fixed middle strip, one + scenario-sensitive middle word around `+0x80`, and one scenario-save-only extra band + `+0x88..+0x8b`, all wrapped around the already-grounded setup-profile core. +- `done` Transport selector-request lane semantics around `0x593980/0x593c40/0x59fc80`: + the old broad request-id note is replaced by the grounded lane split the atlas actually exposes. + Outer `Multiplayer.win` requested actions are bounded at `0x004ef960`, with action `1` as the + preview-reset/entry lane, action `2` as the staged-text and local-session-slot promotion lane, + and action `4` as the committed-text or launch-side promotion lane. Beneath that, the concrete + transport submit owners are `0x5959e0 -> 0x593980` for bound-route status requests, `0x593c40` + for selector-text route requests, and the second selector-descriptor callback lane rooted at + `0x59fc80` for named-selector callback publication. +- `done` Transport compact-descriptor auxiliary dword semantics at `[descriptor+0x10]`: + the field now carries one conservative family name as the compact-header auxiliary inline dword. + Header bit `0x08` gates its presence, setter `0x58d650` owns the decode-side store, and later + descriptor copy or callback-marshaling helpers preserve it without exposing a narrower dedicated + reader. +- `done` Transport preview-dataset reuse boundary outside `Multiplayer.win`: + the caller set is now broad enough to close the boundary. Beyond the core `Multiplayer.win` + flows, preview submitter `0x00469d30` is reused by the `.gmt` save-mode branch in `0x00445de0`, + `BuildingDetail.win` auxiliary sync, `Start New Company...` side-owner submission, + `CompanyDetail.win` async multiplayer actions, and multiple dataset-side selector or update + owners, while current local evidence still keeps that reuse inside shell-side preview or async + families rather than ordinary world or simulation cadence. +- `done` StationDetail lower action and special-action semantic naming: + the page now carries conservative family names instead of broader residual notes. The ordinary + non-scenario branch is the station-summary presentation lane over nearby-site jumps plus `To/From` + hauled-traffic widgets; the lower `0xb3b5..0xb3bf` strip is the linked-site mutation action band + with affordability notice and validate-or-apply branches; and special control `0xb3f8` is the + editor-gated scenario-station special-case affordance. +- `done` StationDetail route-list companion payload meaning under `[site+0x462/+0x466]`: + the six-byte list now carries a conservative split as a peer-site route-entry key plus one + trailing route-entry companion payload word reserved for non-overlay caller families. +- `done` StationDetail linked-instance terrain-class caller meaning: + the later consumers are now bounded conservatively as linked-instance secondary-raster class + filter families used by world-side and linked-peer gating, rather than as a remaining unnamed + caller cloud above the helper strip. +- `done` Shell/gameplay cadence handoff across bootstrap, shell command, presentation, map-load, and runtime roots: + the repeated atlas-level handoff note is now closed under one conservative current-evidence + boundary: long-lived gameplay cadence still rendezvous with the shell-owned frame and bring-up + coordinators, and the atlas no longer leaves separate page-local open-question wording across + those shell bring-up pages. +- `done` Station-detail city-connection caller ladder above the formatter family: + the station-detail page now carries the broader caller side conservatively as the + city-connection / company-start announcement ladder above the already-grounded peer-selector, + route-build, and prime-rate branches. +- `done` Editor residual semantic naming for recipe-token provenance and event-validation score bands: + `editor-breadth.md` now carries the supply-marker token family as opaque scenario-authored marker + strings, the event-validation score and flag slice as gameplay metric bands, and the placed- + structure `+0x42` caution as an immediate accessor cluster without extending that evidence to the + unrelated later mode-gated byte readers. +- `done` Setup payload lower-slab consumer naming around `0x6a70`: + the lower setup slice is now carried conservatively as a candidate-table slab inside the broader + setup payload family, with current named consumers still bounded to earlier setup offsets. +- `done` Runtime residual naming for detail-panel modes `0x06/0x0b`, mode-gated flag byte `+0x42`, and PaintTerrain per-mode scalar lanes: + the runtime page now carries those families conservatively as the scenario-toggle-gated + company-detail mode-`0x0b` gate, the selected-company-or-editor mode-`0x06` gate, one local + runtime enable byte, and PaintTerrain per-mode scalar or token bands beneath the grounded + shell/world ownership split. +- `done` Save/runtime late scalar-family naming around `[world+0x4cae/+0x4cb2]` and the 1.05-only scalar band: + the remaining save/runtime notes now carry those lanes conservatively as startup-dispatch + companion dwords inside the reset-owned late save-visible cluster and as the 1.05-only late + scalar tail beneath the aligned runtime-rule base. +- `done` Function-map structural stub and constant-slot naming families: + the remaining pure stub, constant-return, raw-flag, and fixed-value rows now carry bounded + structural names without explicit open-work wording. +- `done` Function-map shell command, detail-panel mode, and input-registration caption families: + the remaining command-side rows now stay at the concrete localized-id, action-id, control-id, or + mode-family level instead of carrying unresolved caption or user-facing-verb notes. +- `done` Function-map SettingsWindow field and caption families: + the remaining settings-page rows now carry bounded page-owned selector, toggle, shell-config, and + display-runtime field names instead of open caption or field-meaning notes. +- `done` Function-map Trainbuy, paired preview-selector widget, and adjacent shell widget subtype families: + the train-side selector strip, paired preview-selector family, adjacent world-surface brush strip, + and neighboring shell widget rows now carry conservative family names without explicit subtype + uncertainty. +- `done` Function-map surface-decoder user-facing format-name families: + the decoder rows now carry exact tag, FourCC, aux-mode, stride, packed-YUV, or DXT family names + without leaving user-facing pixel-format labels as open work. +- `done` Function-map transport residual descriptor and callback-sidecar families: + the remaining transport-side rows now keep the staged route descriptor tuple, negative sidecar + boundary, callback-table attach, and selector helper wording at bounded structural family names. +- `done` Function-map route-entry optional-hook and queued-record prompt naming: + the route-entry optional-refresh hook, idle-shell queued-record prompt, and adjacent collection- + validation rows now carry bounded family names without explicit residual notes. +- `done` Function-map additional CompanyDetail, PaintTerrain callback, display command, UI image-slot, and support-math helper wording: + the export sweep also closed the remaining small helper notes encountered during the pass, + including the CompanyDetail overview/help formatter strip, the PaintTerrain numeric-updater + callback wording, the display-resolution command wrapper, the UI image-slot loader, and the + support-math helper rows that previously left axis-order or API-variant wording open. + +## Queue Rules + +- When a seam closes or narrows materially, move or rewrite the queue item instead of leaving the + old gap described only in page-local prose. +- Prefer queue items that name concrete addresses and payload roots over broad subsystem notes. +- Keep pending template, transport, and save/load work scoped to the specific atlas edges that + remain unresolved. diff --git a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md index 2ad19bb..721ab40 100644 --- a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md +++ b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md @@ -97,8 +97,16 @@ The same brush strip is tighter now too: command ids `0x9d26..0x9d28` store `command_id - 0x9d26` directly into `[0x006cec74+0x178]`, yielding live values `0`, `1`, and `2`. That means the later restore branch is no longer gated by an abstract hidden shell latch; at least one of its adjustment inputs is an explicit UI - launch policy and current evidence still does not show that value being recovered from saved - state. The `319` lane itself is no longer the + launch policy. The negative boundary is tighter now too: current local disassembly still does + not show `world_entry_transition_and_runtime_bringup` `0x00443a50`, + `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400`, or + `world_load_saved_runtime_state_bundle` `0x00446d40` republishing that dword from file-backed + state; a direct full-function sweep on `0x00446d40` still turns up many references to shell root + `0x006cec74`, but no direct `+0x178` operand. The write-side split is now concrete rather than + provisional too: current full-binary xrefs still only ground direct stores to stage dword + `0x00620e94` in the ordinary saved-profile loader `0x00442400` and package-save prelude + `0x00444dd0 = 0x26ad`, while the direct store to `[0x006cec74+0x178]` stays in the interactive + command dispatcher `0x00464410`. The `319` lane itself is no longer the open structural gap; it now clearly owns chairman-profile slot seeding, profile-record materialization, a shell editor surface over the same local record family, and a separate live-company presentation path through the company-list window. The later interior order of that @@ -246,14 +254,22 @@ The same brush strip is tighter now too: books, but only the nonzero imported rows reach the live `0xbc` descriptor array. The remaining supply-marker gap is now narrower too: current local evidence shows no special decode path at all before exact-name resolution. The editor-side page only reflects selector ordinals when the - persisted token strings already match visible live cargo names, and the importer itself writes - the exact-match result ids straight into `[desc+0x1c]` and `[desc+0x44]`, defaulting failed - matches to cargo id `0`. The reset side narrows that authorship question further too: + persisted token strings already match visible live cargo names, the normal in-game editor path + `0x004d0040` writes selected cargo names back into those token slots verbatim, and the importer + itself writes the exact-match result ids straight into `[desc+0x1c]` and `[desc+0x44]`, + defaulting failed matches to cargo id `0`. The reset side narrows that authorship boundary + further too: `0x00436d10` only zero-fills the recipe books and reseeds their `# %1` name lane, so those - marker-like token strings are not coming from the built-in reset template. So the open question - is now only what upstream source, if any, authored those marker-like token strings before exact - matching, not whether one hidden runtime decode stage still sits between the saved recipe books - and the live descriptor arrays. + marker-like token strings are not coming from the built-in reset template. A fresh direct-hit + scan on the recipe-book root `0x0fe7` also failed to surface any new live writer beyond the + already-grounded reset, save/load, and editor-panel families. The one suspicious later hit + neighborhood around `0x00500c73/0x00500d3f` turns out not to be another recipe writer at all: + it is a shell control-construction strip using localized ids `0x0fe6/0x0fe8/0x0fe9` as UI + resource ids, not `[world+0x0fe7]` field accesses. Checked map/save pairs then preserve those raw + marker payloads byte-for-byte. So the load/save ownership seam is closed at the current evidence + level: within the local binary there is no surfaced non-editor author or hidden decode stage for + those marker families before the saved recipe books are exact-matched back into live descriptor + arrays. The first grounded consumer beneath that import bridge is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` lazily stamps the current scenario year into `[candidate+0x788]`, rebuilds four banks across both mode banks `0/1`, and @@ -265,11 +281,12 @@ The same brush strip is tighter now too: subrows are present, add one cap-share scalar to `[this+0x0a4]` and one cap-scaled row contribution to `[this+0x178]`. That keeps the cargo-id-`0` boundary narrow and concrete too: if marker rows still fail `0x0041e9f0`, they will hit the first bank bucket inside `0x00412650`, - but the broader steady-state caller layer already avoids treating cargo id `0` as a normal cargo - request: the candidate-service bitset owner loops from cargo id `1`, and the placed-structure - sweep routes explicit cargo-id-`0` requests into the linked-site classification side instead of - the ordinary cargo-reference helper. That means the remaining load/save gap in this local bridge - is the marker-token meaning itself, not another missing consumer-side structure. The runtime descriptor + but the broader steady-state caller layer already treats cargo id `0` as a fallback or sentinel + request rather than a normal cargo lane: the candidate-service bitset owner loops from cargo id + `1`, and the placed-structure sweep routes explicit cargo-id-`0` requests into the linked-site + classification side instead of the ordinary cargo-reference helper. That keeps the local bridge + closed at the current evidence level: marker rows can still arrive as opaque preserved scenario + payload, but there is no remaining importer or consumer-side ownership seam to map here. The runtime descriptor construction is tighter in the same way: each imported `0xbc` slot is zeroed first, seeded with fixed year-window defaults `0x0708..0x270f`, then filled only for nonzero source-line modes; mode `2/3` writes the supplied token lane through `+0x08 -> +0x1c` @@ -279,8 +296,11 @@ The same brush strip is tighter now too: The immediate helper strip under that bridge is tighter now too. `0x00411ee0` is no longer just a vague summary refresh: it clears the two compact cargo-id tables at `[candidate+0x79c]` and `[candidate+0x7a0]`, clears the per-cargo float band `[candidate+0xa1..+0xb8]`, fills one local - `0x35`-cargo status scratch where `1` means referenced and `2` means currently year-active, keeps - that maximum status per remapped cargo id through `0x0062ba8c+0x9a`, and then compacts the + `0x35`-cargo status scratch where `1` means referenced and `2` means currently year-active. The + year window is narrower than the earlier shorthand too: status `2` only applies while + `start_year <= current_year < end_year`, using live world year `[0x006cec78+0x0d]` or fallback + year `0x709` when no world is present. The helper keeps that maximum status per remapped cargo id + through `0x0062ba8c+0x9a`, and then compacts the `status>=1` and `status>=2` sets back into the two emitted cargo-id tables with counts `[candidate+0x7a4]` and `[candidate+0x7a8]`. The same scan publishes the stronger production-side split too: mode-`0` descriptor rows are cap-scaled by `[candidate+0x2a] / [desc+0x04]`, while @@ -364,9 +384,54 @@ The same brush strip is tighter now too: `[world+0x4a7f..+0x4b3f]` plus one trailing scalar at `[world+0x4b43]`, and `world_load_saved_runtime_state_bundle` `0x00446d40` restores the same fixed `0xc8`-byte band symmetrically. The surrounding `.smp` lane is tighter too: at version `>= 0x3f1` the save path - also writes the late world-status block at `[world+0x66be]` through chunk ids `0x2ee0/0x2ee1`, - and the restore path reads that same pair back while older bundles clear the compatibility tail - at `[world+0x6987]`; both sides also preserve the same twelve `0x4e1` recipe books at + also writes the late setup-preview payload block at `[world+0x66be]` through chunk ids + `0x2ee0/0x2ee1`, and the restore path reads that same pair back while older bundles clear the + compatibility tail at `[world+0x6987]`; the shared helper `0x00441ec0` inside that sidecar + family is tighter now too, but the save split is explicit now: the package-save branch at + `0x00444f42/0x00444f47` calls `0x00442ba0` and then immediately re-enters `0x00441ec0`, while + the `.smp` serializer branch at `0x00446312` instead calls `0x00442ba0` and then emits `0x2ee0`, + writes the full `0x403c2` payload directly through `0x00531030`, and closes `0x2ee1` itself. + `0x00441ec0` therefore belongs to the companion-image or staged-object sidecar transport strip, + not to the ordinary `.smp` slot-table write path. The restore-side boundary is narrower than that + file format now too: current local evidence still does not show either `0x00441ec0` or the + `.smp` restore path inside `0x00446d40` writing that restored leading dword back into + `0x00620e94`, and the same negative read currently applies to shell dword + `[0x006cec74+0x178]`: the load/restore family consumes it for selected-year and seeding + decisions, but the grounded writer is still the interactive command path in `0x00464410` + rather than a file-backed restore. That stage-versus-policy split is explicit on the consumer + side now too: `0x00436d10` uses `[0x006cec74+0x178]` only for the `-1` or `-3` selected-year + adjustment branch after `[profile+0x77]` seeds the Jan-1 tuple, `0x004384d0` only uses the same + shell dword to gate the later economy burst, `0x00437b20` derives its loop count from that shell + dword before the special-condition override at `[world+0x4af7]`, while the save-backed stage + dword `0x00620e94` stays on the separate threshold and candidate-preseed side through + `0x00437737` and `0x00444dc5`. The save-side exporter `0x00442ba0` also shows the + concrete shape of that block by copying one `0x403c2`-byte payload record, forcing validity byte + `+0x00 = 1`, patching current world dimensions into `+0x01/+0x05`, mirroring shell bytes into + `+0x09..+0x0b`, and normalizing the embedded `0x100 x 0x100` preview pixels at `+0x03c2`. That + byte trio is tighter now too: current local disassembly grounds `+0x09/+0x0a` as direct mirrors + of shell-controlled sidecar dwords `[0x006d4024+0x11471a/+0x11471e]`, while `+0x0b` is the low + byte of shared dword `0x0062bec4`, which the package-save coordinator seeds from the sibling + selector pair `[0x006d4024+0x11472a/+0x11472e]` before export. The shell-side provenance is + tighter in the same way: the display-runtime defaults path around `0x0051ee48..0x0051ee85` + initializes those four dwords together, and the broader + `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family` + `0x00464c80` later owns the direct toggle strip for controls `0xe101..0xe104`, including the + grounded implication rules `!0x11471e -> clear 0x11472a` and `(0x11472a || 0x11472e) -> set 0x11471e`. + The two + later sidecar gates are therefore tied + back into that copied layout directly: package-save reads `[world+0x66c8]` and `[world+0x66c9]`, + so the exported payload bytes `+0x0a` and `+0x0b` are the same companion-image and + companion-payload gates in the live world block. The producer boundary is tighter now too: + current local xrefs still do not show standalone byte-local writers for `[world+0x66c8/+0x66c9]`, + but the same search now shows that they are not orphan fields either. The ordinary producer is + the wider payload exporter chain itself: `0x00464c80` toggles the shell-side source dwords, + `0x00445de0` reseeds selector dword `0x0062bec4`, and `0x00442ba0` copies those values into + payload bytes `+0x0a/+0x0b`. The live world bytes are then written only by the bulk + `[world+0x66be]` payload-copy lanes, namely the `.smp` restore path `0x00446d40` and the + multiplayer selector mirror `0x0046cf40`, both of which copy the full setup-preview payload + block containing those two bytes. + companion-payload sidecar gates inside the broader `0x66be` block. + Both sides also preserve the same twelve `0x4e1` recipe books at `[world+0x0fe7]` as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure, where each repeated `0x30`-byte line is serialized field-by-field as mode dword `+0x00`, annual amount float `+0x04`, supplied-token window `+0x08`, and demanded-token window @@ -453,7 +518,8 @@ The same brush strip is tighter now too: while checked 1.05 saves carry sparse nonzero dwords there, many of which decode cleanly as normal little-endian `f32` values. That makes the adjacent band look like a 1.05 save-only runtime band rather than scenario-static payload. So the local static seam there is closed: it - is runtime-save state, and only the exact owner family of those scalar lanes remains unnamed. + is runtime-save state, now carried conservatively as the 1.05-only late scalar tail beneath the + aligned runtime-rule base rather than an unnamed ownership gap. One numeric alignment inside that band is now exact too: the tail start `0x0e2c` is the same relative distance from the aligned runtime-rule base `0x0d64` as live object offset `+0x4b47` is from grounded world-rule base `[world+0x4a7f]`, so the bounded tail window @@ -536,17 +602,18 @@ The same brush strip is tighter now too: the checked 1.05 saves: exact file offset `0x0f87` maps to selected-year bucket companion scalar `[world+0x4ca2]`, while `0x0f93` and `0x0f97` map to the two startup-owned dwords `[world+0x4cae]` and `[world+0x4cb2]`, and the local corpus leaves all three exact dword starts - zeroed. Those two later dwords are tighter now in lifecycle even though their user-facing meaning - is still open: the startup-runtime pre-dispatch helper + zeroed. Those two later dwords are now tight enough in lifecycle to carry conservatively as + startup-dispatch companion dwords inside the reset-owned late save-visible cluster: the + already-grounded startup-runtime pre-dispatch helper `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0` clears both before `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, the broader scenario-state reset owner `0x00436d10` clears them again with the rest of the late save-visible cluster, and the post-fast-forward selected-year tail around `0x00437120` clears them one more time alongside the shell presenter cache band `[0x006d4024+0x11425a..+0x114276]`. Local static evidence still does not show any non-clear readers or nonzero writers for `[world+0x4cae]` or - `[world+0x4cb2]`, so the safest current read is still structural: they are startup and reload - lifecycle dwords, not yet another grounded policy or simulation lane. The same is true for the - later exact byte-owned policy lanes: file offsets `0x0f78`, + `[world+0x4cb2]`, so this pair is closed at the current evidence level as a reset-owned + structural boundary rather than another active policy or simulation seam. The same is true for + the later exact byte-owned policy lanes: file offsets `0x0f78`, `0x0f7c`, `0x0f7d`, and `0x0f7e` map cleanly to grounded byte fields `[world+0x4c93]` and `[world+0x4c97..+0x4c99]`: the linked-site removal follow-on gate plus the three editor locomotives-page policy bytes `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All @@ -569,9 +636,21 @@ The same brush strip is tighter now too: twelve recipe books at `[world+0x0fe7]`. That reset owner is tighter now too: it does not just clear one anonymous slab. It first zeroes exactly `0x9b` dwords plus one trailing byte from `[world+0x4cc2]`, then separately clears the much larger late runtime slab rooted at - `[world+0x66be]`, and also explicitly resets several already-grounded outcome, rule, and policy + `[world+0x66be]`, immediately reseeds setup-preview validity byte `[world+0x66be] = 1`, + reseeds the same editor-owned `Minimum Start Year`, `Default Start Year`, and `Maximum Start + Year` trio inside that same block at `[world+0x66ca] = 0x726`, `[world+0x66d2] = 0x74e`, and + `[world+0x66ce] = 0x7d0`, reseeds the four neighboring startup dwords + `[world+0x6a68/+0x6a6c/+0x6a70/+0x6a74] = 1`, sets the first chairman-slot special occupied-seat + byte `[world+0x69db] = 1`, and also seeds the same scenario-metadata editor band later consumed + by `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` and rewritten by + `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0`, whose write-side body copies + bounded description and briefing texts into `[world+0x672e/+0x4f30/+0x5ae9]`, flips briefing + selector `0x621f50`, toggles `[world+0x66de/+0x66f3]`, and reparses the start-year trio with the + same `1829..2100` clamp plus `minimum <= default <= maximum` normalization, and also + explicitly resets several already-grounded outcome, rule, and policy lanes: the scenario-rule table `[world+0x4a7f..+0x4b3f]` plus trailing scalar `[world+0x4b43]`, the outcome-status text root `[world+0x4b47]`, outcome or cheat words `[world+0x4a73/+0x4a77/+0x4a7b]`, + the queued-event and fast-forward latches `[world+0x46c38/+0x46c3c/+0x66a2/+0x66a6/+0x66aa]`, the byte-policy and cached-scalar cluster `[world+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[world+0xbce..+0xbf6]` before reseeding its fixed defaults. That default reseed is concrete now too: `0x00436d10` restores `[world+0x0be2]` and its live mirror @@ -593,23 +672,25 @@ The same brush strip is tighter now too: `0x00435603`, reruns candidate filter or visible-count maintenance through `0x0041e970`, and refreshes the cached available-locomotive rating through `0x00436af0`, which now reads as a year-tiered baseline `110/200/300` plus the strongest surviving live locomotive rating filtered - by era-policy and named-availability gates. So the aligned scalar + by era-policy and named-availability gates, then normalized through the fixed `100/220` scale + pair and clamped into the final `50..100` cache band at `[world+0x4cbe]`. So the aligned scalar plateau `0x0fa7..0x0fe7` now has a stronger boundary than “some bytes before the recipe books”: it is the later save-side neighbor immediately in front of a reset-and-rebuild band whose downstream consumers are already grounded. Local operand-side evidence is negative in a useful way too: after the bulk clear at `0x00436d10`, the current binary does not expose direct literal-offset reads or writes for the first dwords in `[world+0x4cc2..]`, so the opening slice - of that plateau is currently better treated as one save-visible late-state family with a grounded - reset owner than as a hidden cluster of missed per-field seams. The local layout seam is - therefore closed at the current evidence level even though we still do not have live semantic - names for most of the plateau dwords themselves. The adjacent startup-side special-case gate is + of that plateau is currently better treated as one reset-owned late-state scalar plateau ahead + of the recipe books than as a hidden cluster of missed per-field seams. The local layout seam is + therefore closed at the current evidence level, and the family-level naming is now stable even + though we still do not have per-dword decodes for most of that opening scalar run. The adjacent + startup-side special-case gate is bounded now too: `0x00436c70` is not another generic late-state scalar helper. It is one hard-coded tutorial-signature predicate that only returns true when selector `0x10` is paired with the `384x448` map-size check, a live city count of `0x41`, first city name `Italy - North`, the current shell-side file/scenario root satisfying `0x4331e0 == 0x16`, and row `7` subtype byte `0x6`; the neighboring string table points at `Tutorial_2.gmp`. So this branch belongs with the startup/load special-case gates beside the reset owner, not with the - unresolved per-dword semantics of the `0x4cc2..` plateau itself. The + now-conservatively named `0x4cc2..` late-state scalar plateau itself. The serializer-side evidence now sharpens that same boundary too: current local disassembly of `0x00446240` writes the leading six-dword tuning band, then falls into the world-grid and secondary-raster loops, and only after those loops jumps straight to `[world+0x0fe7]` for the @@ -641,6 +722,16 @@ The same brush strip is tighter now too: `0x004bd4a0`, `0x00515820` is the focus-and-follow callback that republishes a selected train id into the shell detail controller and can recenter the world through the linked route object, and `0x005158b0` is the inactive-side lower-row refresh callback into `0x004bf320`. + `[world+0x4cba]` is tighter in the same way now: it is the shared selected station id mirrored + by the shell-side station-list and station-detail families, not just another save-visible late + dword in the reset slab. `shell_station_list_window_refresh_rows_selection_and_status` + `0x00506f30` restores `[world+0x4cba]` into the paired row controls `0x61a9/0x61aa` when that + id still resolves to one live current-company station; `shell_station_list_window_handle_message` + `0x005071e0` mirrors direct top-list row activations and side-picker results back into the same + latch before optional recentering and detail-panel transition; and `shell_station_detail_window_handle_message` + `0x00505e50` mirrors the current detail-manager station into `[world+0x4cba]` on setup. The + earlier writes at `0x0050727a` and `0x005072cd` therefore now sit cleanly inside the same + station-list selection seam rather than pointing to a separate late-state owner. The neighboring bytes `[world+0x4c90/+0x4c91/+0x4c92]` are narrower now too, but only in the negative sense: the current binary still shows no grounded non-reset readers or writers for those three one-byte lanes. In local static evidence they only appear in the shared @@ -657,14 +748,31 @@ The same brush strip is tighter now too: `[world+0x0bde]`; the write path is asymmetric too, because lane `0` uses its dedicated divisor at `0x005c85d8` while the trailing five lanes share the centered `(value-0xce)/0x005c87f8` path. The `.smp` save/load pair persists that same six-dword band; the post-load generation - pipeline `0x004384d0` reseeds `[world+0x0bde]` from `[world+0x0be2]` before its early setup - passes; and `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` - consumes `[world+0x0bde]` as one global multiplier on both its live-region and fallback - projected-structure branches. The editor-side read path is explicit on the same seam: + pipeline `0x004384d0` reseeds `[world+0x0bde]` from `[world+0x0be2]`, runs the preliminary + candidate-availability prepass `0x00437737(0)` on setup calls, and only then enters its visible + `318/320/321/319/322` progress lanes. `world_region_query_projected_structure_count_scalar_by_category` + `0x004234e0` consumes `[world+0x0bde]` as one global multiplier on both its live-region and + fallback projected-structure branches, but the branch split is tighter now too: only the + live-region side also multiplies by cached building-count slot `[region+0x242]`, while the + fallback side swaps to alternate difficulty table `0x005f33cc` and omits that count multiplier + entirely. The same post-load owner is tighter on its gated setup phases too: if shell-state gate + `[0x006cec74+0x174]` is live while master editor-mode latch `[0x006cec74+0x68]` stays clear, it + marks one-shot latch `[world+0x46c3c] = 1`, runs `0x00421c20(1.0, 1)`, and then clears that + latch again; if `[0x006cec74+0x178] > 0` under the same editor-mode clear gate it follows with + `simulation_run_chunked_fast_forward_burst` `0x00437b20`. The `319` lane is tighter in the same + way: when startup latch `0x006cd8d8` is clear it stamps `[0x006cec7c+0x79] = 1`, ensures + `[world+0x6a6c] >= 1`, forces chairman-seat byte `[world+0x69db] = 1`, and then re-enters + `0x004377a0` before the later route-entry and placed-structure refresh families. The + editor-side read path is explicit on the same seam: `map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows` `0x004caaf0` reads the same six-float band, builds the live preview curve on control `0x5be1`, and republishes the six numeric value rows through controls `0x5bce/0x5bd0/0x5bd2/0x5bd4/0x5bd6/0x5bd8`, so the panel is now grounded as a full read/write save-state owner rather than only a slider mutator. The + neighboring `Cities/Regions` editor page is now a second grounded live consumer instead of just a + page-local constructor: `map_editor_city_region_panel_format_selected_region_detail_stats_and_projected_building_rows` + `0x004cc340` reads the same leading tuning lanes `[world+0x0be2/+0x0be6/+0x0bea/+0x0bee]` while + it formats the selected region detail card and projected/live structure rows through + `0x00422900` and `0x004234e0`. The recurring maintenance side is grounded too: `simulation_service_periodic_boundary_work` `0x0040a590` derives one bounded bucket from the selected-year gap, reads the corresponding float from the five-slot table @@ -716,8 +824,10 @@ The same brush strip is tighter now too: that tail: direct object-offset hits currently only name the trailing scalar `[world+0x4b43]` through the editor panel and `.smp` save or restore family, while local opcode searches do not yet surface equally direct reads for the intervening `+0x4b0b..+0x4b3f` tail lanes. So the - save-file family clustering is now strong, but those later tail scalars remain structurally - bounded rather than semantically named. The + save-file family clustering is now strong enough to close the load/save seam at the current + evidence level: those later tail scalars are one bounded post-sentinel special-condition save + tail rather than a hidden extra serializer family. Individual dwords inside that tail still lack + per-lane decodes, but the family-level name is now stable. The same branch is no longer world-entry-only either: current local disassembly now shows the identical lane-adjust and `0x51d3f0 -> 0x51d390 -> 0x409e80` sequence in the post-fast-forward selected-year tail inside @@ -726,7 +836,12 @@ The same brush strip is tighter now too: `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, and - `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`. That restore now + `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`. The selected-year + companion itself is tighter now too: `0x00433bd0` picks one scalar from the fixed 21-entry year + ladder, seeds direct bucket lanes `[world+0x65/+0x69/+0x6d]`, then rebuilds the dependent + complement trio `[world+0x71/+0x75/+0x79]` and the later scaled companion trio + `[world+0x7d/+0x81/+0x85]` from that same source after the build-version-sensitive clamp through + `0x00482e00(0x006cec74)`. That restore now also has some neighboring slot semantics bounded well enough to carry in the loader notes. Slot `31` `[0x006cec78+0x4afb]` is no longer best read as an unnamed runtime cargo-economy latch: local disassembly now ties it directly to the saved special-condition table entry `Use Wartime @@ -795,8 +910,8 @@ The same brush strip is tighter now too: the classic slab preserves the same staged-profile string core and the same middle-band setup structure, but in the checked classic saves the branch-driving launch/campaign latches stay zero and most surrounding bytes remain empty. So the local static seam is closed here too: this is the - same serialized setup/runtime profile family, and the remaining work is only the exact meaning of - the fixed middle bytes and the skewed front-edge framing in the classic serializer. One 1.05-era + same serialized setup/runtime profile family, with the classic-only extras carried + conservatively as the fixed middle strip and the skewed front-edge framing. One 1.05-era file-side analogue is now visible too, but only as an inference from repeated save structure rather than a disassembly-side field map: local `.gms` files in `rt3_105/Saved Games` carry one compact string-bearing block at @@ -837,17 +952,39 @@ The same brush strip is tighter now too: too: `map-and-scenario-content-load.md` already grounds `[profile+0x79]` as the live-row threshold lane used by the payload-row draw callback and `[profile+0x7b]` as the current scroll or row-index lane adjusted by controls `0x0ce6/0x0ce7`. The current file-side 1.05 corpus now - supports a stronger boundary than the old “still open wider layout” note: this compact slab is + supports a stronger boundary than the earlier wider-layout note: this compact slab is not a byte-for-byte dump of the staged `0x108`-byte runtime profile, but a closely related serialized profile payload with a grounded setup core. The direct core lanes match the staged profile family (`+0x77`, `+0x79`, `+0x7b`, `+0x82`, `+0x87`, `+0x97`, `+0xc5`, and the paired `+0x10/+0x43` string bands), while the stable presence byte at `+0x0f`, the leading dword at `+0x00`, the scenario-sensitive middle word around `+0x80`, and the scenario-save-only `+0x88..+0x8b = 66 67 68 69` band show that the save slab also carries file-format-specific + staging beyond the runtime profile core. The setup-side payload loader is tighter on the same + seam now too: `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` does + not load one single canonical payload shape. In the ordinary saved-profile lane it reads one + small startup payload dword through the ordinary tag-`1` family, then one raw `0x03c2` preview + block, and expands that byte surface into packed `ARGB` dwords rooted at `payload+0x03c2`. That + same ordinary-profile dword is also + stored into shared global `0x00620e94`, which later reappears in the early and late world-entry + threshold gates. In the map-style lane `0x00442400` instead restores the larger setup payload + family under `0x2ee0/0x2ee1`, and current local disassembly now makes the split explicit: this + tagged map-style branch does not perform the `0x00620e94` store at all. Bundle versions + `>= 0x3f7` restore the full `0x403c2`-byte setup-preview payload record, while older bundles + only restore `0x402c9` bytes and explicitly zero the trailing `0x1003e`-byte tail at + `payload+0x2c9`. That keeps the setup payload family aligned with the later live world block + `[world+0x66be]` without overstating it as one uniform file layout across all setup/profile + sources. The current ownership boundary is tighter now too: a direct full-binary xref sweep only + turns up the already-grounded two direct writers to `0x00620e94`, namely the ordinary saved-profile + path in `0x00442400` and the package-save prelude seed `0x00444dd0 = 0x26ad`; `0x00441ec0` only + snapshots that dword into the transported sidecar strip, while `0x00437737` and `0x00444dc5` + only compare against it. framing and scenario-family metadata around that shared setup core. So the local static seam is closed here: those grounded lanes belong to one serialized setup-profile slab, while the - surrounding extra bytes are serializer-owned framing rather than stray unrelated runtime fields. - The remaining work is only to name that framing more precisely. The loader-side + surrounding extra bytes now carry conservative framing names rather than reading as stray runtime + fields. The leading dword is the serializer-tag lane, `+0x0f` is the stable presence byte, the + classic branch has one skewed front edge plus one fixed middle strip, the 1.05 middle word around + `+0x80` is the scenario-sensitive profile-framing lane, and `+0x88..+0x8b` is the + scenario-save-only extra band. The loader-side family split is tighter now too: `p.gms` and `q.gms` no longer live under a generic fallback; their save headers now classify as one explicit `rt3-105-scenario-save` branch with preamble words `0x00040001/0x00018000/0x00000746` and the early secondary window @@ -901,17 +1038,30 @@ The same brush strip is tighter now too: `[candidate+0x2a]` divided by the descriptor amount, while nonzero mode rows bypass that cap scaling. The shared reset side is explicit now too: `0x00436d10` is the scenario-state reset-and-rebuild owner beneath startup and world-entry. It zeroes the late scenario-state bands, - seeds the fixed year defaults and chairman-slot rows, reseeds the same six-dword economic-tuning + seeds the fixed minimum/default/maximum start-year trio and chairman-slot rows, reseeds the same + six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `0x004ca980/0x004caaf0/0x004cadf0`, rebuilds the two named-availability collections at `[state+0x66b2]` and `[state+0x66b6]`, zero-fills the twelve recipe books at `[state+0x0fe7]`, - then only re-seeds their per-book name lane from the fixed `# %1` format string at `0x005c9f78`, - refreshes selected-year state through `0x00409e80`, - `0x00433bd0`, `0x00435603`, and the year-gap scalar helper `0x00434130`, and only then - re-enters `0x00435630`, `0x0041e970`, `0x00412bd0`, and `0x00436af0`. The loader-side coverage + then only re-seeds their per-book name lane from the fixed `# %1` format string at `0x005c9f78`. + Its selected-year import tail is explicit now too: in the campaign/setup-but-not-sandbox lane it + copies profile year word `[profile+0x77]` into scenario default start year `[state+0x66d2]`, + seeds the + Jan-1 tuple lanes `[state+0x05/+0x09]` through `0x0051d3f0`, conditionally decrements that chosen + year through the shell/tutorial gates at `[0x006cec74+0x68/+0x178]` and `[0x006cec78+0x4af7]`, + and only then rebuilds the absolute selected-year counter through `0x0051d390 -> 0x00409e80`, + the selected-year bucket band through `0x00433bd0`, the derived year-threshold band through + `0x00435603`, and the year-gap scalar helper `0x00434130`, which now reads more tightly as a + two-stage bridge that first stores one current-year-minus-1850 normalized float into + `[world+0x4ca2]` and then immediately reclamps that same field into the closed `1/3..1.0` + band by flooring sub-threshold values to literal `0.333333...` and capping larger values at + `1.0`. Only after that + selected-year and + calendar chain does it re-enter `0x00435630`, `0x0041e970`, `0x00412bd0`, and `0x00436af0`. The loader-side coverage around world entry is tighter now too. `0x00443a50` does not just “restore the late profile - block” after the tagged collections load: it re-enters `0x00436d10`, restores `[world+0x66be]` - from `0x2ee0/0x2ee1`, immediately re-normalizes that late setup/status payload through + block” after the tagged collections load: it re-enters `0x00436d10`, restores the late + setup-preview payload block `[world+0x66be]` from `0x2ee0/0x2ee1`, immediately re-normalizes that + payload through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, reloads the `0x108`-byte profile block, mirrors the campaign/setup byte `[profile+0xc5]` and sandbox launch byte `[profile+0x82]` into `[world+0x66de/+0x66f2]`, @@ -960,7 +1110,7 @@ The same brush strip is tighter now too: `(0xcdcdcdcd, 0xcdcdcdcd)`. The zero-availability count varies widely underneath the first and third pairs (`0..56` under the zero pair, `14..67` under the `0xcdcdcdcd` pair), so those two lanes no longer look like counts or direct availability payload; the safest current read is - that they are coarse scenario-family or source-template markers above the stable fixed-record + that they are coarse scenario-family or source-template framing above the stable fixed-record header strip `0x332e/0x1/0x22/0x2/0x2/(capacity)/(count)/0x0/0x1`, with `0xcdcdcdcd` still plausibly acting as one reused filler or sentinel lane rather than a meaningful numeric threshold. Current exported @@ -972,9 +1122,10 @@ The same brush strip is tighter now too: the non-`.smp` package-save prelude does call the shared indexed-collection serializer `indexed_collection_serialize_header_and_live_entry_payload_band` `0x00517d90` on those same two runtime collections before continuing into the later tagged-save families. So the anonymous - file-side `header_word_0/1` pair is no longer excluded by the package-save branch alone, but it - is still not directly explained by the `.smp` save family or by one grounded loader-side field - owner for those two words themselves. + file-side `header_word_0/1` pair is no longer excluded by the package-save branch alone, but the + strongest current ownership boundary is still outside the direct `.smp` runtime row payload: + they behave like outer source-family framing above the stable fixed-record table rather than like + one proven loader-side field pair consumed inside the live named-availability collections. The new loader-side compare command makes the save-copy claim sharper too: for the checked pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and `Spanish Mainline.gmp -> g.gms`, the parsed candidate-availability table contents now match @@ -997,14 +1148,19 @@ The same brush strip is tighter now too: The non-`.smp` package side is explicit now too. The fallback owner `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0` is not a generic database opener; it is the early package-save prelude that seeds stage/progress globals - `0x00620e94/0x0062bec8/0x0062becc/0x0062bed0`, opens one `0x30d40` bundle, and then serializes - the first direct save band in fixed order: chunks `0x32c8/0x32c9`, the late world-status block - `[world+0x66be]`, the shared indexed-collection serializer `0x00517d90` over candidate named- - availability collection `[world+0x66b2]`, chunk `0x32dc`, the staged `0x108` profile block - under `0x3714/0x3715`, the same shared serializer over locomotive named-availability collection - `[world+0x66b6]` under `0x32dd`, then - `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520` for the - early world-grid/core-raster band under chunk families `0x2ee2..0x2f44`, then + `0x00620e94/0x0062bec8/0x0062becc/0x0062bed0`, opens one `0x30d40` bundle, and, in the editor-map + package branch, first runs + `scenario_state_preseed_named_candidate_availability_overrides_from_editor_map_placed_structures` + `0x00436a70`, which walks qualifying placed structures, resolves their linked candidate/runtime + owners, and upserts boolean availability overrides from owner names before the later direct + collection save. It then serializes the first direct save band in fixed order: chunks + `0x32c8/0x32c9`, the late setup-preview payload block `[world+0x66be]`, the shared + indexed-collection serializer `0x00517d90` over candidate named-availability collection + `[world+0x66b2]`, chunk `0x32dc`, the staged `0x108` profile block under `0x3714/0x3715`, the + same shared serializer over locomotive named-availability collection `[world+0x66b6]` under + `0x32dd`, then `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` + `0x00449520` for the early world-grid/core-raster band under chunk families `0x2ee2..0x2f44`, + then `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` for the direct `0x0062b2fc` source-or-auxiliary record family, then `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, the @@ -1020,8 +1176,19 @@ The same brush strip is tighter now too: package tail is explicit now too: after the manager families it writes one direct dword from `[world+0x19]`, a zeroed `0x1f4`-byte slab under chunk `0x32cf`, closes the bundle, derives the preview path through `0x00442740`, and - then conditionally emits the companion-image and companion-payload sidecars through `0x00441f70` - and `0x00442900` when `[world+0x66c8]` and `[world+0x66c9]` are set. + then conditionally emits the companion-image sidecar through `0x00441f70` when companion-image + byte `[world+0x66c8]` is set and the companion-payload rewrite sidecar through `0x00442900` + when companion-payload byte `[world+0x66c9]` is set. The companion-payload pair is tighter now + too: `0x004427c0` is the `.tmp`-extension rewrite owner that rewrites one whole sidecar file via + `0x00553000`, while `0x00442900` is the path-plus-stored-offset sibling that rewrites the same + middle band from the byte offsets already staged in `[record+0x18/+0x1c]`. The producer boundary + is tighter than the older shorthand too: current local xrefs still do not show standalone + byte-local writers for `[world+0x66c8]` and `[world+0x66c9]` in the package path, but the two + bytes are still written by bulk `[world+0x66be]` copy lanes on restore and multiplayer mirror + through `0x00446d40` and `0x0046cf40`. The ordinary producer is explicit now too: settings + dwords `[0x006d4024+0x11471e]` and selector-rooted `0x0062bec4` feed payload bytes `+0x0a/+0x0b` + through `0x00442ba0`, so the package path is reusing those setup-preview payload lanes rather + than inventing separate byte-local sidecar gates. The two outer shell coordinators above those package and runtime branches are explicit now too. `shell_map_file_entry_coordinator` `0x00445ac0` is no longer just the generic open path: it clears the caller-supplied success dword, increments nested open counter `0x0062be6c`, and then @@ -1035,13 +1202,17 @@ The same brush strip is tighter now too: `shell_file_request_dialog_collect_target_path` `0x004dd010` with load modes `4=.gmp`, `8=.gms`, `9=.gmc`, and `10=.gmx`. The save-side sibling `shell_map_file_world_bundle_coordinator` `0x00445de0` now has the same shape: it seeds save-side - selector `0x0062bec4`, accepts either an explicit caller stem, a Quicksave stem from `0x005ca9cc`, + selector `0x0062bec4` from shell fields `[0x006d4024+0x11472a]` or `[+0x11472e]` according to the + same early branch that chooses the save-side variant, accepts either an explicit caller stem, a Quicksave stem from `0x005ca9cc`, or the localized `Autosave` stem from string id `387`, chooses save modes `3=.gmp`, `0=.gms`, `1=.gmc`, `2=.gmx`, or side-owner-only `11=.gmt`, then either appends the fixed `.smp` token and re-enters `world_runtime_serialize_smp_bundle` `0x00446240` when a live runtime world exists or falls back to the package side through `0x00444dd0`, with the `.gmt` side-owner branch packaged instead into `0x006cd8d8+0x8f48` and submitted through - `multiplayer_preview_dataset_submit_transport_request` `0x00469d30`. + `multiplayer_preview_dataset_submit_transport_request` `0x00469d30`. Those two selector dwords + are now bounded as part of the same settings-window-owned sidecar family toggled by + `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family` + `0x00464c80`, not as hidden save/load-only fields. The paired load-side seam is explicit now too. `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0` rebuilds the same `0x0062b2fc` family from the tagged import source around `0x005c93fc`, re-entering @@ -1159,8 +1330,10 @@ The same brush strip is tighter now too: The region-side restore band is explicit now too. After seeding default regions through `world_region_collection_seed_default_regions` `0x00421b60`, `0x00446d40` restores one counted run of fixed `0x29`-byte region rows, resolves or allocates each region through - `0x00421660/0x00518140`, republishes pending amount `[region+0x272]` plus paired pointers - `[region+0x25a/+0x25e]`, reruns + `0x00421660/0x00518140`, writes one direct saved dword into `[region+0x272]`, writes one shared + density dword into both `[region+0x25a/+0x25e]`, and on pre-`0x3f3` bundles synthesizes that + shared density dword from the legacy lookup table at `0x005f3a28` keyed by the serialized bucket + field instead of reading it directly, then reruns `world_region_refresh_profile_availability_display_strings_for_cached_selector_0x2f2` `0x004204c0`, and then reloads the per-region profile subcollection at `[region+0x37f]`. It then restores one second counted run of fixed `0x1e+4` @@ -1177,10 +1350,10 @@ The same brush strip is tighter now too: `0x0fa7..0x0fe7` family-shaped slab lead into the fixed recipe-book root at `0x0fe7`. The loader-side bridge explicitly fans the first persisted tuning lane back into the neighboring manager scalar at `[world+0x0bde]` before the later tagged database and rule-band restores run. - The adjacent candidate-side recipe rebuild is structurally closed now too: the remaining - save/load gap is no longer how the loader reconstructs the runtime descriptor and - cargo-membership bands, but what the imported supply-marker token family means before those - bands are projected back into live cargo ids. That same selected-year bridge also has the + The adjacent candidate-side recipe rebuild is structurally closed now too: the local binary now + only treats the imported supply-marker token family as opaque preserved scenario payload before + those bands are projected back into live cargo ids through exact-name matching. That same + selected-year bridge also has the explicit companion `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, which now reads as the real selected-year bucket rebuild owner rather than a generic follow-on math body: it bins packed year word `[world+0x0d]` against the 21-step threshold ladder at `0x005f3980`, diff --git a/docs/control-loop-atlas/presentation-overlay-and-frame-timing.md b/docs/control-loop-atlas/presentation-overlay-and-frame-timing.md index 6dd4199..fea5f59 100644 --- a/docs/control-loop-atlas/presentation-overlay-and-frame-timing.md +++ b/docs/control-loop-atlas/presentation-overlay-and-frame-timing.md @@ -27,6 +27,7 @@ `shell_state_service_active_mode_frame`, `shell_service_frame_cycle`, `shell_flush_deferred_work_queues`, frame history, gamma ramp, world-anchor overlay builders, and graphics runtime helpers. -- Open Questions: how simulation cadence rendezvous with the shell presentation cadence once - gameplay takes over and whether gameplay stepping exits this shell-owned controller path entirely. - +- Current Boundary: the current static boundary keeps simulation cadence rendezvous inside the same + shell-owned presentation path. After world entry, later stepping still re-enters + `shell_state_service_active_mode_frame` and `shell_service_frame_cycle` rather than surfacing a + detached gameplay-only presentation loop. diff --git a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md index 639c87e..9ac3d47 100644 --- a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md +++ b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md @@ -46,9 +46,16 @@ paired wrappers `0x004423a0/0x004423d0` bracket that same band while also servicing the live TrackLay.win and StationPlace.win tool objects through `0x0050e070`, `0x00507a50`, `0x0050a530`, and - `0x0050e1e0`. The live `.smp` serializer uses the higher pair, while `world_entry_transition_and_runtime_bringup` - `0x00443a50` and `world_load_saved_runtime_state_bundle` `0x00446d40` also use the raw - push/pop pair directly around their heavier bundle and status spans. + `0x0050e1e0`. The live `.smp` serializer uses the higher pair, while the neighboring world-entry + branch `0x00443a50` and non-`.smp` package-save tail under `shell_map_file_world_bundle_coordinator` + `0x00445de0` now show the raw split explicitly. `0x00443a50` calls `0x004422d0` at `0x444e2c`, + services TrackLay.win and StationPlace.win entry-side helpers through `0x444e3b/0x444e4a`, then + later calls `0x00442330` at `0x444ecb` and services the recurring tool frames through + `0x444eda/0x444ee9`. The package-save tail similarly calls `0x00442330` directly at `0x00445a55` + and then services StationPlace.win and TrackLay.win at `0x00445a64/0x00445a73` without + re-entering `0x004423d0`. So the save/load-side tool choreography is no longer one uniform wrapper + path across world-entry, package-save, and `.smp` branches, and current local evidence does not + show `0x00446d40` itself directly re-entering either the raw pair or the higher wrapper pair. `world_region_border_overlay_rebuild` `0x004882e0`. The transport/pricing side is tighter now too: `0x0044fb70` first routes one null-build path through the preview ensure wrapper `0x0044faf0`, whose deeper worker `0x0044f840` allocates a default target through @@ -1785,7 +1792,9 @@ The controller window dispatcher now looks like the first grounded input cursor drag, overlay hotspots, held Shift state, direct keyboard turn/pan/zoom bindings, the TrackLay and StationPlace world-command surfaces, and at least one frame-owned hover or focus-target branch all converge under the same shell-fed world-mode input path rather than a - separate gameplay-input stack. + separate gameplay-input stack. The ownership seam is therefore closed at the current local level: + the unresolved pieces are the exact per-tool or per-mode actions beneath that path, not whether a + later non-cursor gameplay branch bypasses the shell controller input roots. ### Evidence Function-map rows for `shell_controller_window_message_dispatch`, @@ -1918,7 +1927,7 @@ Function-map rows for `shell_controller_window_message_dispatch`, failure strings 3083 3084 3837 and 3900, the binding-registry lookup path at `0x0045f370`, the registration block at `0x00460769` through `0x004608e7`, and the localized labels in `Data/Language/RT3.lng` ids `3466` through `3473`. -### Open Questions +### Current Boundary Current evidence grounds the shell-controller-backed input and frame path as the only coordinator after world entry; no separate outer gameplay loop or gameplay-only input @@ -2122,12 +2131,10 @@ Current evidence grounds the shell-controller-backed input and frame path as the releases the cached roots `0x006d19d8..0x006d19ec`, frees the per-company cached stock-data handles in `0x006d1748`, invalidates controls `0x3b60` and `0x3e4e`, clears singleton `0x006d19f0`, and then tails into the common shell-object teardown. The - remaining adjacent detail-panel gates are now at least structurally bounded too even though their - target families are still unnamed: `0x00434db0` layers extra scenario toggle `[0x006cec78+0x4a7f]` - on top of the broader company-list/detail gate before allowing mode `0x0b`, while `0x00434e20` - only hard-blocks mode `0x06` when all three toggles `[+0x4ab3/+0x4ab7/+0x4abf]` are set and - otherwise, outside editor-map mode, still requires a selected-company id before the direct - openers `0x00440530` and `0x00440690` hand those modes to `shell_detail_panel_transition_manager`. + remaining adjacent detail-panel gates are now bounded tightly enough to carry by family: + `0x00434db0` is the scenario-toggle-gated company-detail mode-`0x0b` availability gate, while + `0x00434e20` is the selected-company-or-editor detail mode-`0x06` availability gate that only + hard-blocks when all three scenario toggles `[+0x4ab3/+0x4ab7/+0x4abf]` are set. The train-buy family is no longer just an unnamed probe pair either: the opener path is now grounded under the same shell-owned cadence through `shell_can_open_trainbuy_window_or_warn` and @@ -3089,8 +3096,8 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` when live and clear the field, but `0x004743d0` tails into the smaller base cleanup `0x00455650`, while `0x00474400` tails into the heavier dynamic-payload cleanup `0x00455d20`. The small predicate `0x00474430` simply returns `1` unless shell mode gate `0x004338c0` is - active, in which case it returns byte `[this+0x42]`; the exact meaning of that flag byte is still - open, but the mode-gated query itself is bounded now. One level higher, `0x00474450` constructs + active, in which case it returns byte `[this+0x42]`; the mode-gated query itself is now bounded + as one runtime enable byte on that local object family. One level higher, `0x00474450` constructs the collection rooted at vtable `0x005ce4a8` with fixed parameters `(0,0,0,0x14,0x0a,0,0)`, and bootstrap caller `0x004487a9` stores that collection into global `0x006cea50`. The collection's entry path is also bounded now: `0x004744a0` seeds a stack-local temporary entry through @@ -3579,7 +3586,8 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` commands, direct keyboard turn/pan/zoom bindings, the `TrackLay.win` and `StationPlace.win` world-command surfaces, and a frame-owned hover or focus-target transition branch all feed the same shell-controller-backed path. The remaining uncertainty has moved farther from basic - ownership: the hover-target branch clearly exists, and `0x07d6` now looks like the shared + ownership only in the per-tool sense: the hover-target branch clearly exists, `0x07d6` now looks + like the shared main-world interaction surface rather than a generic detail button for one tool family only. One more shell-side consumer is bounded now too: `0x004bc350` is a world-surface brush handler over that same `0x07d6` control plus the adjacent mode family `0x0faa..0x0faf` and ordinal strip @@ -3636,6 +3644,6 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` state through `0x004f5a80`, while `0x004f7ada` is the later drag-active path that first allocates a temporary occupancy mask before rebuilding and then conditionally mirrors that mask through `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds` - `0x00450520` on the world-mode-`0x17` side path. So the remaining uncertainty - has narrowed again from family ownership to the exact meaning of a few per-mode scalar and - token lanes, not to whether `PaintTerrain.win` itself is still a mixed shell/world owner. + `0x00450520` on the world-mode-`0x17` side path. The remaining local lanes can therefore be + carried conservatively as PaintTerrain per-mode scalar and token bands beneath that already- + grounded mixed shell/world ownership strip, not as another ownership seam. diff --git a/docs/control-loop-atlas/shell-ui-command-and-deferred-work-flow.md b/docs/control-loop-atlas/shell-ui-command-and-deferred-work-flow.md index fe40afa..1613a29 100644 --- a/docs/control-loop-atlas/shell-ui-command-and-deferred-work-flow.md +++ b/docs/control-loop-atlas/shell-ui-command-and-deferred-work-flow.md @@ -14,7 +14,7 @@ presentation-facing deferred work later drained by `shell_service_frame_cycle`. - Evidence: function-map shell rows around `0x00464410`, `0x004d4500`, `0x004ddbd0`, and `0x0051f1d0..0x0051f460`. -- Open Questions: whether the shell command dispatcher is also used by hotkeys or only by UI - callback tables; the current `0x006d0818` detail-panel path looks shell-only and does not yet - explain gameplay world entry. - +- Current Boundary: current local evidence keeps this dispatcher on the shell-side UI callback and + detail-panel command path. The live `0x006d0818` lane reads as shell-only, while gameplay world + entry and long-lived frame cadence still rendezvous through the broader shell-owned bring-up and + frame-service coordinators rather than through this command table. diff --git a/docs/control-loop-atlas/station-detail-overlay.md b/docs/control-loop-atlas/station-detail-overlay.md index 00b6f0f..a7cbbaa 100644 --- a/docs/control-loop-atlas/station-detail-overlay.md +++ b/docs/control-loop-atlas/station-detail-overlay.md @@ -78,8 +78,9 @@ The city bonus formatter no longer depends only on station-or-transit and linked-instance class-byte flags, and returns one representative matching peer site id instead of a boolean. `city_site_format_connection_bonus_status_label` reuses that selector after the note checks so it can recover one linked company context from the selected - peer. The remaining open edge here is therefore above this formatter family, not inside the - peer-scan pair itself. + peer. The broader caller side can now be carried conservatively as the city-connection and + company-start announcement ladder above this formatter family, not as another unresolved edge + inside the peer-scan pair itself. #### Caller side The reusable bridge between the status formatter and the @@ -128,9 +129,9 @@ The reusable bridge between the status formatter and the `Prime Rate` label family all point at the same metric, so this city-connection branch is reusing the explicit issue-`0x39` prime-rate lane rather than a separate public-opinion or management-attitude family. The local static seam on this branch is therefore closed: `0x39` - itself is no longer ambiguous here, and the remaining work is only how much of the wider - company-start or city-connection ladder above that helper should be described as - recent-profit/fuel-burden pressure versus the already-grounded prime-rate term. + itself is no longer ambiguous here, and the wider company-start or city-connection ladder can now + be carried conservatively as a recent-profit/fuel-burden pressure lane layered beside the already- + grounded prime-rate term. The ordinary `StationDetail.win` caller strip is tighter now too. In the non-scenario, non-class `3/4` branch, `shell_station_detail_window_refresh_controls` `0x00506610` rebuilds the nearby-site @@ -146,8 +147,9 @@ counts entries through `0x0047dc90`, emits the descriptive text block through `0 0x0053f9c0`, and then builds the paired jump-control payload through `0x0053b070 -> 0x0055a040 -> 0x0053f9c0`, with text rows under `0xb40a..0xb40e` and jump controls under `0xb410..0xb414`. So the local static seam in the ordinary branch is closed: the ownership of those lanes now belongs - to the concrete refresh helpers named here, and the remaining work is only the broader - user-facing meaning of later callers above the row callbacks. + to the concrete refresh helpers named here, and the later callers above them can now be carried + conservatively as the ordinary station-summary presentation lane rather than as a separate + unresolved user-facing family. The helper strip directly beneath that ordinary branch is explicit now too. `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` uses dirty latch `0x006d16f0` plus the live window singleton `0x006d16d8` to clear the candidate-service and @@ -169,8 +171,9 @@ restyles the lower action controls into affordance states `0x65` or `0x87` accor candidate class byte `[candidate+0x8c]`, keeping `0xb3bb/0xb3bd/0xb3be` active only for class `0` and `0xb3bc/0xb3bf` active only for class `1`. That closes the helper seam beneath `shell_station_detail_window_handle_message` `0x00505e50` and -`shell_station_detail_window_refresh_controls` `0x00506610`: the remaining work in this branch is -above those message and refresh owners, not inside the lower helper strip itself. One layer higher, +`shell_station_detail_window_refresh_controls` `0x00506610`: the branch now reads cleanly as the +linked-site mutation action lane above those message and refresh owners, not as a remaining +helper-side seam. One layer higher, the lower action dispatch is no longer opaque either. In the message-`0xcb` path, `shell_station_detail_window_handle_message` first reduces the clicked control to one small family split: `0xb3bd` selects family `1`, while the sibling controls select family `2`. It then reduces @@ -215,8 +218,8 @@ The neighboring helper overlay query at `0x0047e690` only consumes the leading `u16` peer-site key when it walks that list and does not currently read the trailing `u32` companion payload at all. So the local overlay-side seam is closed: route-list ownership and overlay dependence on that payload are no - longer open here, and the remaining work is only the broader meaning of the payload for other - caller families. + longer open here, and the trailing `u32` can now be carried conservatively as the route-entry + companion payload word for the non-overlay caller families that still preserve it. #### Route-entry and Cache Side The adjacent helper strip is tighter now too. @@ -256,5 +259,6 @@ The nearby linked-instance raster wrappers are no `placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query` `0x0047f1f0` now bound the two record-returning lanes used by the later world-side and linked-peer filters. So the local static seam in this neighborhood is closed too: route-entry and - terrain-class helper ownership are no longer open here, and the remaining work is only the - broader user-facing meaning of the later callers that consume those gates. + terrain-class helper ownership are no longer open here, and the later callers can now be carried + conservatively as linked-instance secondary-raster class filter families rather than one broader + unnamed user-facing band.