Rule out shell trigger-kind selector path

artifacts/exports/rt3-1.06/function-map.csv

@@ -1230,7 +1230,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004d8120,1968,shell_event_conditions_window_refresh_condition_row_list_panel,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Heavier row-list refresh beneath `EventConditions.win`. The helper resolves the currently selected live event through `[this+0x84]`, walks the standalone condition-row list rooted at `[event+0x00]`, and repaints the condition-row panel rooted at `0x4eaf` by formatting special sentinel rows `-1` and `-2` through fixed localized ids `0x47e` and `0x47f` while ordinary rows derive their caption and comparator text from the condition tables rooted near `0x005f3de3` and `0x004d88cc`. The same pass also rebuilds the current selected-row index at `[this+0x94]`, maintains the per-row seen bitmap on the stack, and republishes the current selection row list through the generic control path before the surrounding condition-window refresh continues. Current grounded callers are the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, so this is the safest current owner for condition-row list repaint rather than a generic formatter.","objdump + caller correlation + local disassembly + condition-row-list correlation"
 0x004d88f0,1115,shell_event_conditions_window_refresh_selected_grouped_effect_row_list_panel,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation,3,"Grouped effect-row list refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]` to walk the grouped `0x28`-byte row list anchored at `[event + group*4 + 0x04]`, clears list control `0x4ed5`, and resets selected grouped row index `[this+0x98] = -1` before rebuilding the visible row band. Formatting is now tighter than a generic list repaint: ordinary grouped rows flow through the effect descriptor table at `0x006103a0` and RT3.lng `1154..1159` to build `Set %1 to FALSE/TRUE`, timed `for %1 months/years`, and scalar assignment lines, while opcode byte `+0x08 == 8` takes the wider multivalue path over fields `+0x11/+0x12/+0x14/+0x16` before publishing the finished text into `0x4ed5`. The helper finishes by re-enabling `0x4ed5` with active style when the selected grouped list is nonempty. Current grounded callers are the selected-event refresh family `0x004db120/0x004d9390/0x004dbf93` plus grouped effect add, edit, and remove verbs `0x004da7c0/0x004da860/0x004da920`, so this is the safest current read for selected grouped-effect row-list repaint rather than an anonymous formatter.","objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation + grouped-list-anchor correlation"
 0x004d8d50,320,shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small commit helper beneath `EventConditions.win` that snapshots the current grouped-effect summary editor state back into the selected live event before the grouped selector changes. The helper resolves the selected event through `[this+0x84]`, uses current grouped index `[this+0x9c]`, samples control `0x500a` into event byte lane `[event + group*4 + 0x7ff]`, maps the hidden mutually exclusive selector family rooted at `0x5006` into ordinal byte `[event + group + 0x7fb] = 0..8`, and stores current local selector state `[this+0x8c]` into event dword lane `[event + group*4 + 0x80f]`. The ordinal mapping is now explicit in the commit-side jump table: controls `0x5006..0x500e` store values `0..8`, and the refresh side later maps those same ordinals one-to-one onto visible controls `0x5014..0x501c`. Current evidence therefore reads `0x5006..0x500e` as the hidden canonical selector family and `0x5014..0x501c` as its visible display mirror, not as two distinct semantic families. The strongest current RT3.lng fit for the stored scope family is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`. Current grounded caller is the grouped-band dispatcher case at `0x004dbf93`, so this is the safest current read for grouped-effect summary-state commit before group switch rather than a generic editor helper.","objdump + caller xrefs + local disassembly + grouped-selector-state correlation + ordinal-mapping correlation + RT3.lng correlation"
-0x004d8ea0,1165,shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selected-event commit helper beneath `EventConditions.win` that snapshots the currently visible mode-strip text panels back into the live event record before selection, grouped-action, or grouped-band changes. The helper resolves the selected live event through `[this+0x84]`, samples active controls `0x4e8e`, `0x4e8f`, `0x4ed9`, `0x4edb`, `0x4edd`, and `0x4e91`, and uses those active-state checks to rewrite event mode byte `[event+0x7ee]` plus the fixed text bands at `[event+0x0e0]`, `[event+0x401]`, `[event+0x4ca]`, `[event+0x593]`, `[event+0x65c]`, and `[event+0x725]` from the current shell control payloads. Current grounded callers are selected-event previous and next navigation `0x004db520/0x004db5e0`, the selected-event id setter `0x004db6a0`, and the grouped-action selector case at `0x004dbfca`, so this is the safest current read for committing current selected-event text panels before selection change rather than another repaint helper.","objdump + caller xrefs + local disassembly + event-text-band correlation + selection-change correlation"
+0x004d8ea0,1165,shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selected-event commit helper beneath `EventConditions.win` that snapshots the currently visible editor-strip state back into the live event record before selection, grouped-action, or grouped-band changes. The helper resolves the selected live event through `[this+0x84]`, samples active controls `0x4e8e`, `0x4e8f`, `0x4ed9`, `0x4edb`, `0x4edd`, and `0x4e91`, and uses those active-state checks to rewrite event mode byte `[event+0x7ee]` plus the fixed text bands at `[event+0x0e0]`, `[event+0x401]`, `[event+0x4ca]`, `[event+0x593]`, `[event+0x65c]`, and `[event+0x725]` from the current shell control payloads. The same helper is now tighter than a text-only commit too: the fixed selector band `0x4e98..0x4ea2` writes trigger-kind byte `[event+0x7ef] = 0..10` one-to-one, controls `0x4fd7` and `0x4fd8` map back into modifier bytes `[event+0x7f9]` and `[event+0x7fa]`, control `0x4e93` toggles byte `[event+0x800]`, and the helper also snapshots current summary lanes `[event+0x7f5]` and `[event+0x7f0]` before re-entering grouped-state commit `0x004d8d50`. Current grounded callers are selected-event previous and next navigation `0x004db520/0x004db5e0`, the selected-event id setter `0x004db6a0`, and the grouped-action selector case at `0x004dbfca`, so this is the safest current read for committing the selected-event editor strip before selection change rather than another repaint helper.","objdump + caller xrefs + local disassembly + event-text-band correlation + trigger-kind-selector correlation + selection-change correlation"
 0x004d91e0,343,shell_event_conditions_window_commit_selected_event_summary_headers_and_group_mode,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Selected-event summary-header and grouped-mode commit helper beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, snapshots the active modifier bands rooted at `0x4fd7` and `0x4fd8` into event bytes `[event+0x7f9]` and `[event+0x7fa]`, stores the inverted toggle state of control `0x4e93` into event byte `[event+0x800]`, writes summary header control `0x4ead` into event dword `[event+0x7f5]`, mirrors window field `[this+0x88]` into event dword `[event+0x7f0]`, re-enters `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, and then commits one grouped-mode choice from controls `0x4eca/0x4ecb/0x4ecc` into event byte `[event+0x7f4]`. Current grounded caller is the broader selected-event strip refresh at `0x004db120`, so this is the safest current read for committing selected-event summary headers and grouped mode rather than another grouped-action helper.","objdump + local disassembly + caller correlation + control-band correlation + event-record-field correlation"
 0x004d9360,43,shell_event_conditions_window_remove_selected_event_and_refresh_selector,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Delete verb for the selected live event beneath `EventConditions.win`. When `[this+0x84]` holds a valid event id, the helper resolves collection `0x0062be18`, removes that live event through the collection vtable delete slot, and then immediately rebuilds the visible event selector through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`. Current grounded dispatcher caller is control `0x4e8a` through `0x004dbc48`, so this is the safest current read for selected-event deletion and selector refresh rather than a generic collection wrapper.","objdump + local disassembly + dispatcher correlation + collection-delete correlation"
 0x004d9390,1504,shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Mode-dependent detail-row switch beneath `EventConditions.win`. The helper samples which selected-event mode button is active across controls `0x4e8f`, `0x4e90`, `0x4e91`, and `0x4e92`, then shows or hides the corresponding detail-row families rooted at `0x4ed7..0x4edd` and `0x4fdb..0x4fe6` through the generic shell control path. The same pass also re-enters `shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances` `0x004d77b0`, resets grouped selection field `[this+0x9c]` when the chosen mode does not keep it, refreshes the grouped row list through `0x004d88f0`, and toggles the trailing affordance at `0x4fed`. Current grounded callers are the selected-event strip refresh `0x004d9f50`, the broader condition-window dispatcher `0x004dbb80`, and one nearby secondary dispatcher at `0x004daf40`, so this is the safest current read for selected-event mode-dependent detail rows rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + mode-button correlation + detail-row-band correlation + grouped-band-affordance correlation"
@@ -1252,7 +1252,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004dab60,212,shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation + grouped-band dispatch-table decode,3,"Refreshes the selected grouped-effect target-scope strip beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, reads current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible display family `0x5014..0x501c`. The surrounding enable logic is tighter too: grouped effect-row type mask bit `0x08` gates `0x5015` (`whole game`), bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x02` gates the player-target trio `0x501a..0x501c`, and bit `0x04` gates the paired territory-target lane `0x500b/0x5019`. When the territory lane is absent the helper falls back to local selector state `[this+0x8c]` for `0x500b`; and when any target-scope lane is active it first tries to re-enable one hidden selector from `0x5006..0x500e`, falling back to the persisted control id in `0x00622074` only when no current visible target-scope display row is already active. Current code now makes the hidden/display split firmer too: `0x5006..0x500e` are the canonical hidden selectors stored by `0x004d8d50`, while `0x5014..0x501c` are the visible one-to-one mirror rows republished by `0x004da9a0` and styled here. The grouped-band `0x4dc09c` table keeps the remaining boundary explicit: visible rows `0x5014..0x501c` do not dispatch to the target-scope selector case directly; they only re-enter the smaller `0x004d9d10` territory-target affordance path on the `0xcf` side, so this helper remains the safest current owner for the actual stored target-scope refresh rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + ordinal-mapping correlation + persisted-selection correlation + RT3.lng correlation + grouped-band dispatch-table decode"
 0x004daf40,367,shell_event_conditions_window_reset_selected_event_summary_placeholders,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selection-bootstrap helper beneath `EventConditions.win` that clears and republishes the dynamic-text placeholder band when the selected event changes or no live event is currently active. The helper writes the same fixed placeholder text block rooted at `0x005c87a8` back into controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`, then repaints those controls through the generic shell path before the broader selected-event refresh continues. Current grounded callers are `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and the callback-binding bootstrap `0x004db6f0`, so this is the safest current read for selected-event summary placeholder reset rather than another local dispatcher fragment.","objdump + caller xrefs + local disassembly + placeholder-control correlation"
 0x004da0f0,1350,shell_event_conditions_window_refresh_controls,shell,thiscall,inferred,objdump + caller xrefs + EventConditions.win correlation + RT3.lng correlation + grouped-band dispatch-table decode,3,"Shared refresh pass for `EventConditions.win`. The helper resolves the currently selected live event record from collection `0x0062be18`, samples grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, then consults the adjacent runtime-condition helpers `0x0042dff0`, `0x0042df30`, `0x0042df70`, and `0x0042dfb0` to decide which condition rows should be enabled, disabled, or summarized through the condition-side controls rooted at ids such as `0x5005..0x501c`. The selector pair `0x5001/0x5002` now has a tighter split here: `0x5001` gates the standalone condition test-scope side consumed by `0x004d9970`, with RT3.lng `1573` `Test against...` now the strongest current label fit, while `0x5002` gates the grouped-effect target-scope side, with RT3.lng `1606` `Apply effects...` now the strongest current label fit. On that `0x5002` branch, when control `0x4ed5` is active and the current condition aggregates permit it, the helper builds dynamic-text control `0x5014` from RT3.lng `1160..1164`, yielding `to the company/player/player (i.e. chairman)/territory for which the condition is TRUE`; current RT3.lng correlation then gives the strongest current label fit for the remaining visible target-scope display rows as `0x5015 = to the whole game`, `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories` with a stored target parameter, and `0x501a..0x501c = to all/human/AI players`. The same pass now has a tighter mask split too: grouped effect-row type flag bit `0x08` gates `0x5015`, bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x04` gates the territory-target lane `0x500b/0x5019`, and bit `0x02` gates the player-target trio `0x501a..0x501c`. The grouped-band `0x4dc09c` table now keeps the interaction boundary honest too: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into the grouped target-scope selector case `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` route only to the smaller `0x004d9d10` affordance path. The same pass also re-enters `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, and the smaller territory-target affordance helper `0x004d9d10` before finishing the common window-side repaint tail. Current grounded callers sit in the surrounding event-condition message family near `0x004dbce0`, which makes this the safest current owner for condition-window refresh rather than only a one-off formatter.","objdump + caller xrefs + EventConditions.win correlation + condition-helper correlation + grouped-effect-flag correlation + RT3.lng correlation + grouped-band dispatch-table decode"
-0x004db120,1024,shell_event_conditions_window_refresh_selected_event_strip_and_navigation,shell,thiscall,inferred,objdump + local disassembly + caller xrefs + event-selector correlation,3,"Broad selected-event repaint beneath `EventConditions.win`. The helper first enables or disables the selected-event strip rooted at `0x4e84..0x5077` depending on whether `[this+0x84]` holds a live event id, seeds grouped selector `[this+0x9c]` to `0`, re-enables the first grouped summary band `0x4fed`, republishes the persisted grouped target-scope selector id from `0x00622074`, and then resolves the selected live event through collection `0x0062be18` before re-entering `0x004dab60`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120`, and the grouped-row refresh tail `0x004d88f0`. The same pass also republishes the fixed selected-event selector band `0x4e98..0x4ea2` from event byte `[event+0x7ef]`, the summary headers `0x4ead/0x4eae` from `[event+0x7f5]` and `[event+0x7f0]`, the modifier bands `0x4ec0..0x4ec4` and `0x4eb6..0x4eb9` from `[event+0x7f9]` and `[event+0x7fa]`, and the grouped-mode trio `0x4eca..0x4ecc` from `[event+0x7f4]`. The closing count check against `0x0062be18` also gates navigation controls `0x4e85` and `0x4e86`, so this is the safest current owner for selected-event strip and navigation refresh rather than a generic repaint tail.","objdump + local disassembly + caller xrefs + event-record-field correlation + grouped-selection-bootstrap correlation + navigation-control correlation"
+0x004db120,1024,shell_event_conditions_window_refresh_selected_event_strip_and_navigation,shell,thiscall,inferred,objdump + local disassembly + caller xrefs + event-selector correlation,3,"Broad selected-event repaint beneath `EventConditions.win`. The helper first enables or disables the selected-event strip rooted at `0x4e84..0x5077` depending on whether `[this+0x84]` holds a live event id, seeds grouped selector `[this+0x9c]` to `0`, re-enables the first grouped summary band `0x4fed`, republishes the persisted grouped target-scope selector id from `0x00622074`, and then resolves the selected live event through collection `0x0062be18` before re-entering `0x004dab60`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120`, and the grouped-row refresh tail `0x004d88f0`. The same pass also republishes the fixed trigger-kind selector band `0x4e98..0x4ea2` one-to-one from event byte `[event+0x7ef] = 0..10`, the summary headers `0x4ead/0x4eae` from `[event+0x7f5]` and `[event+0x7f0]`, the modifier bands `0x4ec0..0x4ec4` and `0x4eb6..0x4eb9` from `[event+0x7f9]` and `[event+0x7fa]`, and the grouped-mode trio `0x4eca..0x4ecc` from `[event+0x7f4]`. The closing count check against `0x0062be18` also gates navigation controls `0x4e85` and `0x4e86`, so this is the safest current owner for selected-event strip and navigation refresh rather than a generic repaint tail.","objdump + local disassembly + caller xrefs + event-record-field correlation + trigger-kind-selector correlation + grouped-selection-bootstrap correlation + navigation-control correlation"
 0x004db520,192,shell_event_conditions_window_select_previous_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Backward selected-event stepping verb beneath `EventConditions.win`. When `[this+0x84]` holds a live event id, the helper resolves the current event record, queries the neighboring live event id through collection helper `0x005184f0(..., 2)`, and when a valid predecessor exists it clears staged condition selection through `0x004d8ea0`, copies the stepped event id into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, and re-enters the broader selected-event repaint `0x004db120`. It finally republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the first event-strip navigation case at `0x004dbc5c`, so this is the safest current read for selected-event previous-step and refresh rather than a generic collection walk.","objdump + local disassembly + dispatcher correlation + event-selector-list correlation"
 0x004db5e0,192,shell_event_conditions_window_select_next_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Forward selected-event stepping verb beneath `EventConditions.win`. The helper mirrors `0x004db520`, but after querying the stepped event id through `0x005184f0(..., 2)` it rejects the end-of-strip sentinel when the returned ordinal reaches current field `[this+0x90]`, then commits the next live event into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the sibling event-strip navigation case at `0x004dbc70`, so this is the safest current read for selected-event next-step and refresh rather than another generic list walk.","objdump + local disassembly + dispatcher correlation + end-of-strip-sentinel correlation"
 0x004db6a0,80,shell_event_conditions_window_set_selected_event_id_and_refresh_if_open,shell,cdecl,inferred,objdump + local disassembly + callback-binder correlation,3,"Shared selected-event setter beneath `EventConditions.win`. The helper accepts one live event id in `edx`, checks whether the global conditions-window singleton at `0x006cff84` is either inactive or ready for refresh through `0x004d8ea0`, and then writes the requested event id into `[window+0x84]`, re-enters `0x004daf40` plus the broader selected-event repaint `0x004db120`, and mirrors the same id into pending field `0x00622070`. Current grounded caller is the event-selector callback bound on control `0x4e84` from `0x004db6f0`, so this is the safest current owner for selected-event id publish and refresh rather than a generic global setter.","objdump + local disassembly + callback-binder correlation + pending-selection-field correlation"
@@ -1261,7 +1261,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
 0x004dba90,236,shell_event_conditions_window_rename_selected_event_via_name_modal,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Rename verb for the selected live event beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, copies the current name field `[event+0x18]`, opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x47d`, and on accept writes the edited name back into the live event record before rebuilding the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, restoring the selected id, re-entering `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishing control `0x4e84`. Current grounded dispatcher caller is control `0x4e89` through `0x004dbd6e`, so this is the safest current read for selected-event rename via name modal rather than another selector refresh tail.","objdump + local disassembly + dispatcher correlation + modal-rename correlation"
 0x004dbe7a,100,shell_event_conditions_window_open_choice_event_single_player_only_warning_modal,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + RT3.lng string correlation,3,"Small warning-modal branch beneath `EventConditions.win` reached from the `0x4ec6/0x4ec7` control pair. The helper first checks whether selected-event mode control `0x4e8f` is active, and only on that branch forces grouped-mode control `0x4eca` active before opening the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x0f2f` `3887`, whose grounded RT3.lng text warns that `Choice` events are single-player only and not allowed in multiplayer games. The branch does not otherwise mutate persistent event state, so this is the safest current read for a choice-event single-player-only warning modal rather than a grouped-action commit path.","objdump + local disassembly + switch-table decode + RT3.lng string correlation + mode-control correlation"
 0x004dbeeb,116,shell_event_conditions_window_publish_pending_shared_summary_text_triplet,shell,thiscall,inferred,objdump + local disassembly + switch-table decode,3,"Pending dynamic-text publish helper beneath `EventConditions.win` reached from control `0x4ed9` when global latch `0x006d07d8` is clear. The helper copies one current shell text payload into a local `0x7d0` buffer, republishes that same text into controls `0x4eac`, `0x4ed9`, and `0x4edb` through the generic type-`0x6f` dynamic-text path, and then clears `0x006d07d8`. This is therefore the safest current read for publishing one pending shared summary-text triplet rather than a generic selection refresh.","objdump + local disassembly + switch-table decode + dynamic-text-control correlation"
-0x004dbb80,1074,shell_event_conditions_window_dispatch_selected_event_strip_and_grouped_band_actions,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + control-id correlation + grouped-band dispatch-table decode,3,"Broader `EventConditions.win` command dispatcher above the selected-event strip and grouped-band controls. The helper switches on shell messages `0xca`, `0xcb`, and `0xcf`, then uses the decoded `0x4dc000`, `0x4dc018`, `0x4dc050`, and `0x4dc08c` tables to route control families rooted at `0x4e84..0x4ea1`, `0x4eac..0x4ed9`, and `0x4fed..0x501c`. The selected-event strip is now explicit on the `0xcb` side: controls `0x4e85/0x4e86` step previous or next events through `0x004db520/0x004db5e0`, `0x4e87/0x4e88` add a blank event or clone the selected event through `0x004db8b0(0/1)`, `0x4e89` renames the selected event through `0x004dba90`, and `0x4e8a` deletes it through `0x004d9360`. The `0xca` side also owns the selected-event mode strip rooted at `0x4e98..0x4ea1`, where the baseline band writes event byte `[event+0x7ee] = 0` before re-entering `0x004d9f50`, while control `0x4ea1` writes special mode `4` and then refreshes the same strip. The later grouped-band `0xcf` cases are now bounded more tightly by the `0x4dc09c` byte map: grouped summary controls `0x4fed..0x4ff0` route to `0x004dbf93`, selector pair `0x5001/0x5002` route to `0x004dbfca`, visible target-scope display rows `0x5014..0x501c` route only to `0x004dbf7f -> 0x004d9d10`, and the remaining `0x4ff1..0x5013` span falls through the default no-op case. This is therefore the safest current owner for selected-event strip and grouped-band action dispatch rather than leaving those bands distributed across unnamed case blocks.","objdump + local disassembly + switch-table decode + control-id correlation + grouped-band correlation + grouped-band dispatch-table decode"
+0x004dbb80,1074,shell_event_conditions_window_dispatch_selected_event_strip_and_grouped_band_actions,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + control-id correlation + grouped-band dispatch-table decode,3,"Broader `EventConditions.win` command dispatcher above the selected-event strip and grouped-band controls. The helper switches on shell messages `0xca`, `0xcb`, and `0xcf`, then uses the decoded `0x4dc000`, `0x4dc018`, `0x4dc050`, and `0x4dc08c` tables to route control families rooted at `0x4e84..0x4ea2`, `0x4eac..0x4ed9`, and `0x4fed..0x501c`. The selected-event strip is now explicit on the `0xcb` side: controls `0x4e85/0x4e86` step previous or next events through `0x004db520/0x004db5e0`, `0x4e87/0x4e88` add a blank event or clone the selected event through `0x004db8b0(0/1)`, `0x4e89` renames the selected event through `0x004dba90`, and `0x4e8a` deletes it through `0x004d9360`. The `0xca` side is wider than the earlier mode-only read too: controls `0x4e8e/0x4e8f/0x4e91/0x4e92` feed event mode byte `[event+0x7ee]` plus the paired summary text-band commit at `0x004d8ea0`, while the fixed selector family `0x4e98..0x4ea2` writes trigger-kind byte `[event+0x7ef] = 0..10` one-to-one before the same strip refreshes. The later grouped-band `0xcf` cases are now bounded more tightly by the `0x4dc09c` byte map: grouped summary controls `0x4fed..0x4ff0` route to `0x004dbf93`, selector pair `0x5001/0x5002` route to `0x004dbfca`, visible target-scope display rows `0x5014..0x501c` route only to `0x004dbf7f -> 0x004d9d10`, and the remaining `0x4ff1..0x5013` span falls through the default no-op case. This is therefore the safest current owner for selected-event strip and grouped-band action dispatch rather than leaving those bands distributed across unnamed case blocks.","objdump + local disassembly + switch-table decode + control-id correlation + trigger-kind-selector correlation + grouped-band correlation + grouped-band dispatch-table decode"
 0x004dbfca,32,shell_event_conditions_window_select_grouped_effect_target_scope_mode_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + RT3.lng correlation,3,"Grouped target-scope mode selector case beneath `EventConditions.win` on the `0xcf` grouped-band path. The helper first commits the currently visible selected-event text panels through `shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change` `0x004d8ea0`, then refreshes the grouped-effect target-scope strip through `shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip` `0x004dab60`, and finally stores the clicked control id into global `0x00622074` so the same target-scope selector can be re-enabled during later selected-event bring-up at `0x004db120`. The `0x4dc09c` dispatch table now keeps the control family honest: this case is only reached by controls `0x5001` and `0x5002`, not by visible rows `0x5014..0x501c`. Current RT3.lng adjacency gives those two controls their strongest current player-facing fit too: `0x5001` is the condition-side `Test against...` mode and `0x5002` is the grouped-effect-side `Apply effects...` mode. This is therefore the safest current read for grouped target-scope mode selection and refresh rather than for the whole visible target-scope display family.","objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + persisted-selection correlation + RT3.lng correlation"
 0x004dbf93,55,shell_event_conditions_window_select_grouped_effect_summary_band_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Grouped-band selector verb beneath `EventConditions.win`. The helper first commits the current grouped-effect summary editor state through `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, stores the newly chosen grouped selector ordinal `control_id - 0x4fed` into `[this+0x9c]`, refreshes the visible grouped rows through `0x004d88f0`, re-enters the surrounding condition-window repaint through `0x004da0f0`, and then finishes with the smaller grouped summary tail at `0x004da9a0`. Current grounded dispatcher caller is the `0x4fed..0x4ff0` case family under `0x004dbb80`, so this is the safest current read for grouped-effect summary band selection and refresh rather than a generic selector write.","objdump + local disassembly + dispatcher correlation + grouped-band-selector correlation"
 0x004c8670,11,shell_mark_custom_modal_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with the shared callback-driven custom modal family rooted at `0x006cfeb4`. The helper stores `1` into `0x006cfeac`, which current nearby call patterns treat as the custom-modal refresh or service request latch after the lower constructor at `0x004c86c0` and opener `shell_open_custom_modal_dialog_with_callbacks` have published a live modal object. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"

artifacts/exports/rt3-1.06/runtime-effect-kind8-late-bringup-note.md

@@ -125,6 +125,23 @@ So the active periodic-company/control-lane question narrows again:
 - and the currently grounded nonzero seed outside the scenario-name retags is the follow-on
   builder reached from the service/dispatch family rather than from the reload loop itself
 
+## Ruled-Out Shell Seed Table
+
+The large remaining direct writer table is bounded now too:
+
+- `0x004d8ea0`
+  - is the shell-side `EventConditions.win` commit helper already grounded in `function-map.csv`
+  - resolves the currently selected live event from the editor window
+  - writes `[event+0x7ef] = 0..10` from controls `0x4e98..0x4ea2`
+  - also commits neighboring editor-strip fields `[event+0x7f9]`, `[event+0x7fa]`,
+    `[event+0x7f5]`, and `[event+0x7f0]`
+- `0x004db120`
+  - is the paired shell refresh helper
+  - republishes that same `0x4e98..0x4ea2` selector band one-to-one from stored `[event+0x7ef]`
+
+So the broadest direct `0..10` trigger-kind seed family is real, but it belongs to the shell
+editor strip rather than to ordinary post-load simulation bringup.
+
 ## Post-Load Scenario Fixup
 
 - `shell_apply_scenario_name_specific_post_load_world_and_object_fixups` `0x00442c30`

docs/rehost-queue.md

@@ -12,6 +12,7 @@ This file is the short active queue for the current runtime and reverse-engineer
 
 - Keep the periodic-company trace as the main shellless simulation frontier, with the next concrete control-lane pass focused on the ordinary loaded runtime-effect strip `0x00444d92 -> 0x00432f40(kind 8) -> 0x004323a0 -> 0x00431b20`.
   The checked `rt3_105/maps` compact-dispatch corpus is now exported directly and partially mirrored into the periodic-company trace: `41` maps scanned, `38` with dispatch-strip rows, `318` nondirect rows total, the add-building subset is only `10` grouped occurrences across `7` descriptor keys, and the strongest broader nondirect families are now bounded too at `36` grouped occurrences across `18` maps for `nondirect-ge1e-h0001-0360-0004-0100-0200-p0000-0000-0000-ffff :: [864:4]` plus `27` across `14` maps for the mixed `[-1:4]` cluster. All of those checked rows still lack recovered trigger kind. The active open question is therefore which ordinary loaded rows acquire or bypass the missing trigger-kind control lane before they can reach placed-structure mutation opcodes.
+  The largest direct writer table is ruled out now too: `0x004d8ea0` is the shell-side `EventConditions.win` commit helper, where controls `0x4e98..0x4ea2` write `[event+0x7ef] = 0..10` on the currently selected live event, so that seed family does not explain shellless post-load bringup.
   Preserved checked control-lane detail now lives in [Periodic company control lane](rehost-queue/periodic-company-control-lane-2026-04-21.md).
 - Keep the next static Tier-2 building pass focused on the earlier seed/projection seam into `0x00412d70`, not another broad `BuildingTypes` sweep.
   The grounded owner strip is `0x004196c0 -> 0x00414490 -> 0x00416ce0 -> 0x00419230`, and the checked candidate-table exports now keep the concrete scenario-side families explicit too: among the `37` probe-bearing maps, `Port00/Warehouse00` stay at `35/43` on `30` maps and shift earlier to `10/18` on `7`, while `Port01..11` / `Warehouse01..11` stay fixed at `45..55` / `56..66` and the numbered trailer family splits independently at `0x00000001 -> 28 maps` versus `0x00000000 -> 9 maps`. The new crossover matrix stays mixed rather than collapsing to one side too: `35/43 :: 0x00000001 -> 25 maps`, `35/43 :: 0x00000000 -> 5 maps`, `10/18 :: 0x00000000 -> 4 maps`, and `10/18 :: 0x00000001 -> 3 maps`. The checked header-cluster export keeps the same root scan bounded to only `3` families: `0x00000000 / 0x00000000 -> 27 maps`, `0xcdcdcdcd / 0xcdcdcdcd -> 9 maps`, and `0x10000000 / 0x00009000 -> 1 map` (`Alternate USA.gmp`). The stock `BuildingTypes` side is narrower too: across `77` checked `.bca` files only `MachineShop.bca` carries nonzero selector bytes at `0xb8..0xbb`, while the broader nonzero stock signal lives in the `22`-file `.bty` alias-root family with `dword_0xbb = 0x000001f4`, especially the `TextileMill` branch that already covers `Port.bty` and `Warehouse.bty`. The active open question is therefore which earlier seed/projection path lifts that narrow stock-side signal and the fixed numbered cluster into nonzero live `[candidate+0xba/+0xbb]` before `0x00412d70` and `0x00419230` consume it.

docs/rehost-queue/periodic-company-control-lane-2026-04-21.md

@@ -178,3 +178,25 @@ So the remaining control-lane question is narrower again:
 - the late service strip gates strictly on `[event+0x7ef]`
 - and the currently grounded nonzero seed outside the scenario-name retags is the follow-on
   builder reached from the service/dispatch family rather than from the reload loop itself
+
+## Ruled-Out Shell Seed Table
+
+The largest remaining direct writer family is no longer ambiguous either:
+
+- `0x004d8ea0`
+  - is the shell-side `EventConditions.win` commit helper already grounded in `function-map.csv`
+  - resolves the currently selected live event from the editor window singleton, not from post-load
+    bringup
+  - writes `[event+0x7ef] = 0..10` from the fixed control family `0x4e98..0x4ea2`
+  - also commits neighboring editor-strip fields such as `[event+0x7f9]`, `[event+0x7fa]`,
+    `[event+0x7f5]`, and `[event+0x7f0]`
+- `0x004db120`
+  - is the paired shell refresh helper
+  - republishes that same `0x4e98..0x4ea2` family one-to-one from stored `[event+0x7ef]`
+
+So the active shellless queue head narrows again:
+
+- the broad `0..10` trigger-kind selector table is real
+- but it belongs to the shell editor strip rather than ordinary post-load simulation bringup
+- the remaining runtime question stays above ordinary reload `0x00433130` and below final service
+  `0x00432f40(kind 8)`, not inside the explicit shell editor commit path