From 5c192b0fa4575adf640af6e303b683ae6a5b92a4 Mon Sep 17 00:00:00 2001 From: Jan Petykiewicz Date: Mon, 6 Apr 2026 20:34:16 -0700 Subject: [PATCH] Tighten multiplayer transport callback ownership --- artifacts/exports/rt3-1.06/function-map.csv | 225 +++++++++---- docs/atlas/company-and-ledger.md | 47 ++- docs/atlas/multiplayer.md | 180 ++++++++++- docs/atlas/route-entry-and-trackers.md | 15 +- docs/control-loop-atlas.md | 333 +++++++++++++++++--- 5 files changed, 684 insertions(+), 116 deletions(-) diff --git a/artifacts/exports/rt3-1.06/function-map.csv b/artifacts/exports/rt3-1.06/function-map.csv index 1bb8df1..964ffa7 100644 --- a/artifacts/exports/rt3-1.06/function-map.csv +++ b/artifacts/exports/rt3-1.06/function-map.csv @@ -5,7 +5,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00401940,152,company_reset_linked_transit_caches_and_reseed_empty_train_routes,simulation,thiscall,inferred,objdump + callsite inspection + linked-transit correlation,2,"Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep.","objdump + callsite inspection + linked-transit correlation + train-route-reset correlation" 0x004019e0,611,company_service_periodic_city_connection_finance_and_linked_transit_lanes,simulation,thiscall,inferred,objdump + callsite inspection + caller correlation + RT3.lng strings,2,"Broader periodic company-side service pass above the currently grounded city-connection, finance, and linked-transit lanes. The helper first rejects inactive or special-case companies through `[this+0x3f]` and `0x00425b90`, clears the transient company-side latches at `[this+0x0d17]`, `[this+0x0d18]`, and `[this+0x0d56]`, and temporarily mirrors one locomotive-derived byte from `[this+0x0d17]` into scenario field `[0x006cec78+0x4c74]` while the earlier route-building side of the body runs, restoring the original scenario value on exit. Current evidence now bounds those byte latches more narrowly: `[this+0x0d17]` is this transient route-search preference override, currently seeded only when `company_select_preferred_available_locomotive_id` `0x004078a0` resolves one locomotive whose engine-type dword `[record+0x10]` equals `2`; wider engine-type evidence now makes that best-read as the electric lane, since the linked approval helper around `0x0041d550` dispatches the same `0/1/2` field across three scenario opinion slots while the local language family `706..709` and help text `3848` bound the player-facing triplet as `Steam`, `Diesel`, and `Electric`. The route-search side is tighter now too: this mirrored byte is not just reusing a display preference slot abstractly, it feeds the same initial path-sweep branch in `route_entry_collection_run_initial_candidate_path_sweep` `0x0049bd40` that explicit route-policy byte `4` uses, selecting the larger `1.8` quality multiplier instead of `1.4` before the later acceptance checks. `[this+0x0d18]` is the city-connection announcement-side latch reused by `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; and `[this+0x0d56]` is the linked-transit train-service latch later set by the train-add, train-upgrade, and route-builder-side cache-refresh family around `0x00409830`, `0x00409300`, and `0x0040457e -> 0x004093d0`. The ordering matters too: this owner clears those latches up front, runs the city-connection and linked-transit branches first, and only later enters `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, so the finance helper is reading same-cycle side-channel state rather than stale long-lived flags. It then gates and schedules several narrower service families: the city-connection announcement side through `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` and `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; the acquisition-side sibling through `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`; the linked-transit train side through `company_balance_linked_transit_train_roster` `0x00409950`; the broader annual finance and governance helper through `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`; and the linked-transit cache refresh tail through either `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` or `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` depending on current scenario mode byte `[0x006cec78+0x0f]`. This name stays intentionally conservative: it is the broader periodic owner above those lanes, not a fully split policy map yet.","objdump + callsite inspection + caller correlation + RT3.lng strings + linked-transit correlation + city-connection correlation + acquisition correlation + latch correlation + sequencing correlation + temporary-route-preference correlation + locomotive-choice correlation + engine-type correlation + route-search-threshold correlation" 0x004078a0,815,company_select_preferred_available_locomotive_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one preferred locomotive id for the current company from the live locomotive collection at `0x006ada84`. The helper iterates the live locomotive records, applies company-and-chairman availability gating through the linked approval family around `0x0041d550`, accumulates one weighted preference score from locomotive fields `[record+0x20]`, `[+0x28]`, `[+0x18]`, `[+0x1c]`, `[+0x0c]`, and the linked class or era record at `[record+0x72]`, and keeps the strongest surviving locomotive id, falling back to `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0` when no scored candidate survives. Current grounded callers are the periodic company service pass `0x004019e0`, the temporary route-side mode chooser around `0x00402d5f`, the linked-transit train-upgrade news helper `0x00409300`, and the linked-transit train-add helper `0x00409830`. Current evidence now also bounds one route-policy side effect above it: `0x004019e0` only arms its temporary `[company+0x0d17] -> [0x006cec78+0x4c74]` override when the chosen locomotive record carries engine-type value `2` in `[record+0x10]`, which now best aligns with the electric lane rather than an unnamed class slot.","objdump + caller xrefs + callsite inspection + locomotive-collection correlation + preferred-choice correlation + engine-type correlation" -0x00401c50,3016,company_evaluate_annual_finance_policy_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of shareholder-facing metrics through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating slot `0x2b`, counting one three-year failure condition from slot `0x2c`, selecting one negative debt-pressure ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring current public support from `company_compute_public_support_vote_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resulting factor in one `800000` stock-value gate and one public-support times factor times `1000` times `1.2` affordability gate, requires enough unassigned shares through `company_count_unassigned_shares_after_active_chairman_holdings` `0x004261b0`, and then commits repeated `1000`-share repurchases through `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`; this is the current strongest threshold owner behind RT3.lng `2887`. The sequencing above this helper now bounds those two latch reads more clearly: `0x004019e0` clears them first, then the city-connection and linked-transit branches may set them earlier in the same periodic pass, so the bond and repurchase lanes are currently best read as same-cycle reaction policy rather than long-term company-state policy. The later stock-issue lane is tighter too: after the earlier debt or bankruptcy outcomes stay inactive, with the bond and stock toggles `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since founding, it derives one 1000-share batch with floor `2000`, requires public support at least `22`, requires the public-support times batch product to clear `55000`, and then checks a piecewise approval ladder pairing one candidate-side scalar against a normalized support ratio: `0.07/1.3`, `0.08/1.2`, `0.09/1.1`, `0.10/0.95`, `0.11/0.8`, `0.12/0.62`, `0.13/0.5`, and `0.14/0.35` before the share-issue commit path proceeds. The dividend-side branch is now bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be clear, scenario mode `0x0c`, at least `1` year since `[this+0x0d2d]`, and at least `2` years since founding; it then averages the last three years of slot `0x2b`, folds in the unassigned-share pool from `company_count_unassigned_shares_after_active_chairman_holdings` `0x004261b0`, the current slot `0x0d` band, and the map-editor building-density growth setting `[0x006cec78+0x4c7c]`. Current grounded postblend behavior is: growth setting `1` scales the existing dividend by `0.66`, growth setting `2` zeros it, computed deltas at or below `0.1` collapse to zero, larger deltas are quantized in tenths, and the final value is clamped against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. The tail also refreshes `CompanyDetail.win` when the selected company matches `[0x006cfe4c]`. This now grounds the main finance verbs and most first-layer threshold constants under the annual policy pass, though some lower policy semantics still remain open.","objdump + callsite inspection + RT3.lng strings + finance-policy correlation + bankruptcy/debt-news correlation + repurchase-news correlation + finance-mutator correlation + threshold correlation + latch correlation + sequencing correlation" +0x00401c50,3016,company_evaluate_annual_finance_policy_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of derived finance lanes through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating the net-profits lane `0x2b`, counting one three-year failure condition from the revenue aggregate `0x2c`, selecting one negative cash-and-debt stress ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking the current fuel-cost lane in slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The helper also has one later deep-distress fallback bankruptcy lane on the no-action fallthrough before the build-`1.03+` stock-issue branch: with the same bankruptcy toggle clear, current cash below `-300000`, at least `3` years since founding, no recent automatic finance action already chosen, the first three recent net-profits lanes each at or below `-20000`, and at least `5` years since the last bankruptcy stamp, it commits the same bankruptcy path and news family again. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The message-side tail is tighter now too: it accumulates total retired principal in one counter and total newly issued principal in another, then chooses the debt headline family by comparing those two totals directly: equal -> `2882` refinance only, issued greater -> `2883` refinance plus extra borrowing, retired greater -> `2884` refinance plus additional payoff, issued zero -> `2885` debt payoff only, and retired zero with issued positive -> `2886` straight new borrowing. The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resulting factor in one `800000` stock-value gate and one support-adjusted share-price scalar times factor times `1000` times `1.2` affordability gate, requires enough unassigned shares through `company_count_unassigned_shares_after_active_chairman_holdings` `0x004261b0`, and then commits repeated `1000`-share repurchases through `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`; this is the current strongest threshold owner behind RT3.lng `2887`. The repurchase tail also now reads cleanly: it accumulates the total repurchased public-share count in a dedicated counter and publishes `2887` from that total after the debt headline branch. The sequencing above this helper now bounds those two latch reads more clearly: `0x004019e0` clears them first, then the city-connection and linked-transit branches may set them earlier in the same periodic pass, so the bond and repurchase lanes are currently best read as same-cycle reaction policy rather than long-term company-state policy. The later stock-issue lane is tighter too: it only opens on build `1.03+`, only after the earlier bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since founding. It derives one prospective equity tranche from roughly one-tenth of the current outstanding-share count, rounded down to `1000`-share lots with floor `2000`, trims that tranche downward until the support-adjusted share-price scalar times tranche no longer exceeds the `55000` proceeds gate, requires that scalar at least `22`, resolves the highest-coupon live bond slot through `company_query_highest_coupon_bond_slot_index` `0x0042a0e0`, and then uses current cash from stat-family `0x2329/0x0d` as a gating threshold against that slot's principal plus a small fixed buffer before the approval ladder proceeds. The actual approval ladder now reads like a valuation-versus-borrowing screen: it compares the chosen bond coupon against one normalized price-to-book-style ratio built from the same support-adjusted share-price scalar and current `Book Value Per Share` from stat-family `0x2329/0x1d`, using the piecewise ladder `0.07/1.3`, `0.08/1.2`, `0.09/1.1`, `0.10/0.95`, `0.11/0.8`, `0.12/0.62`, `0.13/0.5`, and `0.14/0.35`. On success it issues two same-sized public-share tranches through repeated `company_issue_public_shares_and_raise_capital` `0x00427450` calls and formats a separate equity-offering news family rooted at localized id `4053`, not the earlier `2882..2887` debt-or-buyback headlines. The dividend-side branch is now bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be clear, scenario mode `0x0c`, at least `1` year since `[this+0x0d2d]`, and at least `2` years since founding; it then converts a weighted `3/2/1` blend of the last three net-profits lanes `0x2b` into one tentative dividend-per-share target, supplements that target with current cash only on the tiny-unassigned-share branch below `1000`, and still folds in the map-editor building-density growth setting `[0x006cec78+0x4c7c]`. Current grounded postblend behavior is: growth setting `1` scales the existing dividend by `0.66`, growth setting `2` zeros it, computed deltas at or below `0.1` collapse to zero, larger deltas are quantized in tenths, and the final value is clamped against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. The tail also refreshes `CompanyDetail.win` when the selected company matches `[0x006cfe4c]`. This now grounds the main finance verbs and most first-layer threshold constants under the annual policy pass, though some lower policy semantics still remain open.","objdump + callsite inspection + RT3.lng strings + finance-policy correlation + bankruptcy/debt-news correlation + repurchase-news correlation + equity-offering-news correlation + finance-mutator correlation + threshold correlation + latch correlation + sequencing correlation + stock-data-label correlation + highest-coupon-bond correlation + income-statement-row correlation + derived-report-metric correlation + valuation-vs-borrowing correlation + weighted-dividend-target correlation + deep-distress-bankruptcy correlation + debt-headline-tail correlation + repurchase-headline-tail correlation" 0x00402c90,19,placed_structure_resolve_linked_candidate_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Tiny placed-structure-to-candidate resolver over the global candidate collection at `0x0062b268`. The helper reads one candidate id from `[this+0x173]`, re-enters the shared indexed-collection record resolver at `0x00518140`, and returns the resulting candidate record pointer. Current grounded caller is the BuildingDetail-side branch at `0x00506441`, where it is used immediately after resolving one placed-structure record from `0x0062b2fc`. This now looks like the direct placed-structure linked-candidate accessor rather than another anonymous local helper.","objdump + caller xrefs + callsite inspection + collection-resolver correlation" 0x00402cb0,3457,city_connection_try_build_route_with_optional_direct_site_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Shared heavy route-builder and optional direct-placement helper beneath the city-connection route and news family. The function starts at a clean prologue at `0x00402cb0`, seeds one builder-state latch band at `[this+0xf5]`, `[this+0xf6]`, `[this+0xf8]`, `[this+0xfa]`, `[this+0xfc]`, and `[this+0x10a]`, and then splits into three grounded internal lanes. The first is an early route-entry search or synthesis lane through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` over the global route-entry store `0x006cfca8`, which can seed the builder-state block and succeed without placing a new site. The second is a single-endpoint direct-placement lane around `0x00403d92..0x00403ef3`: it scans the live placed-structure collection `0x0062b2fc` for `Maintenance` and `ServiceTower` stems, projects one candidate placement through `0x00417840`, validates it through `0x004197e0`, and then commits through the first direct placement branch `0x00403ed5 -> placed_structure_collection_allocate_and_construct_entry` `0x004134d0` -> `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`. The third is a later paired-endpoint fallback lane around `0x00403f41..0x00404489`: it seeds two endpoint candidates from the same `Maintenance` and `ServiceTower` stem scan, builds one temporary route-entry candidate list, iterates that list against span and year-scaled step terms, projects trial placements through `0x00417840`, and on success commits through the second direct placement branch `0x0040446b -> 0x004134d0 -> 0x0040ef10` before clearing a small exclusion window in the temporary list. Outside those lanes it also re-enters geometry, region, and route-store helpers around `0x004423a0`, `0x00482e00`, `0x004931e0`, `0x00494310`, and the global route-entry stores `0x006cfcb4` / `0x006cfca8`, and it can still unwind through route-state cleanup without committing new placed structures. Current grounded external callers are still entirely in the city-connection family: the compact region-entry wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` `0x00404640`, the peer-route candidate builder `city_connection_bonus_build_peer_route_candidate` `0x004046a0`, the direct region-entry pair wrapper `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`. This now bounds the old unresolved `0x00403xxx..0x00404631` placement chooser as one shared city-connection route or placement helper with a cleaner internal policy split, even though some lower helper semantics remain open.","objdump + caller xrefs + callsite inspection + placement-correlation + route-builder correlation + Maintenance/ServiceTower scan correlation + route-entry search correlation" 0x004046a0,1388,city_connection_bonus_build_peer_route_candidate,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable candidate builder beneath the city-connection bonus news and status family. The helper starts from one region or city entry in the collection at `0x0062bae0`, samples that entry's two derived coordinate terms through `0x00455800` and `0x00455810`, then re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` with both selector flags forced on so it can recover one representative connected peer site. When a peer is found it samples the peer's derived coordinates through `0x0047df30` and `0x0047df50`; when an explicit caller-owned route anchor is present it first tries the heavier route builder at `0x00402cb0`, otherwise it falls back to the smaller helper at `0x00404640`. If neither early path succeeds the function collects one local candidate band from the two global route-entry stores at `0x006cfcb4` and `0x006cfca8`, filters those entries against the current city id and several route-state predicates, computes one compact bounding window around each surviving candidate, and then chooses the best remaining candidate by smallest span before retrying `0x00402cb0`. Current grounded callers are the wider company-side city-connection bonus sweep at `0x00406050` and one neighboring branch at `0x00406b73`, which together make this look like the shared peer-route candidate builder above the city bonus peer-selector family rather than a direct UI formatter.","objdump + caller xrefs + callsite inspection + peer-selector correlation + route-builder correlation" @@ -14,16 +14,16 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00404ce0,3124,simulation_try_select_and_publish_company_start_or_city_connection_news,simulation,fastcall,inferred,objdump + caller inspection + RT3.lng strings,3,"Broad fastcall city-pair chooser and news publisher above `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`. When the stack company-id argument is zero the helper sweeps up to `0xa0` region-or-city entries from `0x0062bae0`; when it is nonzero it first validates that company through collection `0x0062be10`, stat family `0x2329` mode `0x0d` via `0x0042a5d0`, and the territory-access gate `0x00424010`. Eligible city entries are filtered through `city_connection_bonus_exists_matching_peer_site` `0x00420030`, weighted through `city_compute_connection_bonus_candidate_weight` `0x004010f0`, damped by map-size terms, territory access, and current region flags, and stored into temporary score bands. The helper then builds one dense pair matrix, repeatedly re-enters `0x00404c60` to validate candidate city pairs, can update one company-side selected endpoint pair through `0x00426f20`, and finally publishes shell news through `0x004554e0`. Current grounded publication ids are `2889` `%1 has started a new company - the %2` and `2890` `%1 has connected %2 to %3.`. Current grounded callers are `0x00401455`, which temporarily clears region-state dwords `[0x006cfc9c+0x2d]` before a global pass, and `0x00401b36`, which re-enters the same chooser with the active company and linked chairman after the smaller company-side city-connection bonus lane falls through. This now looks like the broader company-start-or-city-connection headline chooser above the smaller city-connection bonus sweep at `0x00406050` rather than another anonymous route-builder.","objdump + caller inspection + RT3.lng strings + route-builder correlation + pair-selection correlation + publication-path correlation" 0x00405920,189,company_query_min_linked_site_distance_to_xy,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Queries the minimum distance from one company to an input X or Y point pair. The helper walks the live placed-structure collection at `0x006cec20`, keeps only sites whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, samples each surviving site's derived coordinates through `0x0047ded0` and `0x0047df00`, and then computes one scalar distance against the caller-supplied coordinate pair through `0x0051dbe0`. It returns the minimum observed distance across all linked sites, clamped to a floor of `1.0` when a closer or degenerate result would go lower. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where this helper provides the distance term later blended into each city candidate score.","objdump + caller xrefs + callsite inspection + distance-term correlation" 0x00406050,2966,company_evaluate_and_publish_city_connection_bonus_news,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Broader company-side city-connection bonus sweep above `city_connection_bonus_build_peer_route_candidate` at `0x004046a0`. The function starts by building one announcement-value floor from several company-side support or governance helpers: the generic metric readers at `0x0042a5d0` and `0x00426ef0`, the linked transit-site counter `company_count_linked_transit_sites` at `0x00426590`, the small bonus-lane gate at `0x00427590`, and the longer company value ladder at `0x00425320`. Once that floor is high enough it walks the region-or-city collection at `0x0062bae0` and computes one per-city opportunity score from three terms: the city-side opportunity weight from `city_compute_connection_bonus_candidate_weight` at `0x004010f0`, the minimum linked-site distance from `company_query_min_linked_site_distance_to_xy` at `0x00405920`, and one city-side coordinate or spacing term around `0x00455800` and `0x00455810`. Those city scores are then adjusted by rival-company presence, chairman-profile scaling, the map-editor building-density setting at `0x006cec78+0x4c78`, and a linked-transit-site-count cap before the function keeps up to ten city ids in the persistent band at `[this+0x0d42]`. It repeatedly re-enters `city_connection_bonus_build_peer_route_candidate` to validate the best remaining entry, and when one validated winner survives it formats company and city names into the localized news strings `2888` `%1 has connected to %2.`, `2890` `%1 has connected %2 to %3.`, or `2921` `%1 has put a station in %2, but to win the %3 connection bonus, this station must be connected to ANOTHER city.` before publishing the result through the shell news helper at `0x004554e0`. When no winner survives it sets the byte latch at `[this+0x0d18]` instead. This is now the first grounded announcement owner above the city-connection bonus status formatter and peer-selector pair rather than just an anonymous caller around `0x004064c0`.","objdump + caller inspection + RT3.lng strings + peer-route candidate correlation + publication-path correlation + score-component correlation" -0x00407bd0,1697,company_rebuild_linked_transit_autoroute_site_score_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rolls candidate-local service metrics into those floats. The first phase uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to collect bounded candidate-local metric and scaling bands; the second phase re-enters the per-site peer buffer at cache `+0x06`, compares each peer's stored route-step delta against the live site-side service words from `0x0047de20`, and accumulates the surviving weighted contributions back into `+0x0e` and `+0x12` before promoting the strongest grouped result into `+0x16`. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call.","objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation" +0x00407bd0,1697,company_rebuild_linked_transit_autoroute_site_score_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rebuilds those lanes from two phases. First it uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to populate bounded candidate-local amount bands at stack `0x1a0..` and normalized scaling bands at `0x350..`. Then it re-enters the per-site peer buffer at cache `+0x06`, resolves each peer site's live service words through `0x0047de20`, and only keeps candidate lanes whose local amount still exceeds the peer baseline. The surviving excess amount accumulates raw into cache float `+0x12`, while the continuity share at peer float `+0x09` and route-step count at peer dword `+0x05` feed a second step-biased weighted accumulator in cache float `+0x0e` through the local `+0x28` denominator bias. A later grouped promotion pass chooses the strongest adjacent candidate bands and folds their weighted contribution into cache float `+0x16`, which is the final site-ranking lane consumed by the downstream site selector. That split now matters for the tracker compatibility question too: the pre-`1.03` versus `1.03+` pair-metric dispatcher at `0x004a65b0` can perturb peer step counts and continuity share, but on current evidence that only flows into the weighted `+0x0e` and promoted `+0x16` lanes, not the raw `+0x12` amount total. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call.","objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation + linked-transit consumer correlation + version-compatibility impact correlation" 0x00408280,255,company_select_best_owned_linked_transit_site_by_autoroute_score,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one owned linked transit site from the company-side autoroute cache family. The helper walks the live placed-structure collection, keeps only sites whose company cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the station-or-transit gate `0x0047fd50`. It then ranks the surviving sites by cache float `[cell+0x16]`, applying a small bonus when the placed-structure-side lanes `[site+0x5c1]` and `[site+0x5c5]` are both clear, and returns the winning site id or `-1` when no candidate survives. Current grounded caller is `company_build_linked_transit_autoroute_entry` `0x00408380`, where this helper provides the fallback start site when the caller does not already supply one.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation" -0x00408380,3215,company_build_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query.","objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation" -0x00408f70,864,company_compute_owned_linked_transit_site_score_total,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Aggregates one company-side linked-transit site score total from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the float at cache offset `+0x12` across the surviving sites while also retaining one or two representative site pointers for neighboring callers. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run.","objdump + caller xrefs + callsite inspection + linked-transit score-total correlation" +0x00408380,3215,company_build_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. The downstream effect boundary is tighter now too: because this builder ranks peer-site candidates from the weighted peer-derived bands rather than the raw site totals, the pre-`1.03` versus `1.03+` tracker metric split is now best read as perturbing autoroute peer choice and seeded route-entry selection here, not the later company-wide train-pressure target at `0x00408f70`. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query.","objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation + version-compatibility impact correlation" +0x00408f70,864,company_compute_owned_linked_transit_site_score_total,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Aggregates one company-side linked-transit train-pressure target from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the raw site score float at cache offset `+0x12` across the surviving sites while also retaining the first two representative site pointers and the eligible-site count. It then converts that raw total into the returned roster target through a year-dependent divisor ladder, later year-side multipliers, and site-count bands. On build `1.03+`, when exactly two eligible sites survive, it also measures the inter-site distance between those retained sites and applies an extra distance-side scaling branch before the final train-balance comparison. The compatibility boundary is now tighter too: because this helper sums cache `+0x12` rather than the weighted `+0x0e` or promoted `+0x16` lanes, current evidence says the pre-`1.03` versus `1.03+` tracker metric split does not directly change this company-wide roster target except through any earlier coarse candidate-survival effects, not through the step-count or continuity-weighting lanes themselves. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run.","objdump + caller xrefs + callsite inspection + linked-transit score-total correlation + linked-transit consumer correlation + version-compatibility impact correlation" 0x00409300,200,company_publish_train_upgrade_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter.","objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation" 0x004093d0,837,company_rebuild_linked_transit_site_peer_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`.","objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation" 0x00409720,80,company_service_linked_transit_site_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper.","objdump + caller xrefs + callsite inspection + timed-service correlation" 0x00409770,88,train_try_append_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation" 0x00409830,274,company_try_add_linked_transit_train_and_publish_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead.","objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation" -0x00409950,923,company_balance_linked_transit_train_roster,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate site score through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, and uses current-year age terms from `[train+0x0d4]` plus the aggregate site score to decide whether old trains should be removed outright through the train collection vtable or upgraded in place through `company_publish_train_upgrade_news` `0x00409300`. After pruning, if the owned-train count still trails the target implied by the linked-site score, the helper repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830`. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass.","objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation" +0x00409950,923,company_balance_linked_transit_train_roster,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate train-pressure target through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, derives one year-dependent age scalar from current scenario year `[0x006cec78+0x0d]`, and applies that scaled age against two thresholds. Very old trains above the upper band are either removed outright through the train collection vtable when the roster already exceeds target, or upgraded in place through `company_publish_train_upgrade_news` `0x00409300` when the target still needs capacity. Mid-age trains above the lower band can trigger one narrower upgrade branch when the roster is still below target. After pruning, it computes the remaining deficit between the aggregate target and the owned-train count, then repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830` until that deficit collapses, with one later add-train retry branch when the residual target is still high enough. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass.","objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation + linked-transit consumer correlation" 0x004264c0,96,company_count_owned_trains,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the live trains owned by the current company. The helper walks the train collection at `0x006cfcbc`, compares each record's owning company byte at `[train+0x51]` against `[this+0x00]`, and returns the number of matches. Current grounded callers are the linked-transit train-roster balancer at `0x00409950` and the `LoadScreen.win` company train-list page at `0x004e7670`, where the count gates the no-trains fallback before the detailed roster rows are built.","objdump + caller xrefs + callsite inspection + company-owned train count correlation" 0x00426590,135,company_count_linked_transit_sites,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps.","objdump + caller xrefs + callsite inspection + connection-bonus count correlation" 0x00427590,47,company_connection_bonus_lane_is_unlocked,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate above `company_compute_connection_bonus_value_ladder` at `0x00425320`. The helper rejects immediately when the scenario-state flag at `0x006cec78+0x4a8b` is set or when the company age-like counter at `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument connection-bonus value ladder through `0x00425320` and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the later mid-function gate around `0x004064a9`, so current best meaning is one unlock or eligibility gate for the stronger city-connection bonus lane rather than a generic support predicate.","objdump + caller xrefs + callsite inspection + connection-bonus correlation" @@ -111,23 +111,28 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00423ec0,33,company_adjust_available_track_laying_capacity_with_floor_zero,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter.","objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation" 0x004240a0,28,company_query_available_track_laying_capacity_or_unlimited,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement.","objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation" 0x00424010,29,company_has_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`.","objdump + caller inspection + territory-access table correlation" +0x00423e40,112,company_compute_weighted_average_bond_interest_rate,simulation,thiscall,inferred,objdump + caller xrefs + debt-record inspection,4,"Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier.","objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation" +0x00423eb0,6,company_query_cached_share_price_scalar,simulation,thiscall,inferred,objdump + caller xrefs + per-share panel correlation,3,"Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read.","objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation" 0x00424030,22,company_set_territory_access_rights_byte,simulation,thiscall,inferred,objdump + caller inspection,4,"Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted.","objdump + caller inspection + territory-access table correlation" 0x004241e0,23,company_sum_control_transfer_offer_policy_fields_raw,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation.","objdump + caller inspection + merger-offer dialog correlation" 0x00424200,37,company_sum_control_transfer_offer_policy_fields_scaled_tenths,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function.","objdump + caller inspection + takeover and merger dialog correlation" -0x004248d0,759,company_compute_cached_recent_performance_support_score,simulation,thiscall,inferred,objdump + caller inspection,3,"Builds one cached company-side support score from recent yearly metric history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it walks the recent year window above the founding year at `[this+0x157]`, queries multiple yearly stat ids through `0x0042a5d0` including `0x1f`, `0x1e`, `0x20`, and `0x1d`, blends those results with recency weights and one difficulty table under `0x005f33b8`, clamps intermediate ratios, stores one bounded subscore into `[this+0x0d19]`, and finally caches the resulting float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded callers are the public-support blend helper at `0x00424fd0` and nearby company telemetry or policy branches.","objdump + caller inspection + cache-field correlation" -0x00425a90,194,company_declare_bankruptcy_and_halve_bond_debt,simulation,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path.","objdump + RT3.lng strings + caller inspection + finance-field correlation" +0x004248d0,759,company_compute_cached_recent_per_share_performance_subscore,simulation,thiscall,inferred,objdump + caller inspection,3,"Builds one cached company-side per-share performance subscore from recent yearly stock-data history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it first walks up to five recent years above founding year `[this+0x157]`, weighting yearly `Revenue Per Share` from slot `0x1e` and yearly `Earnings Per Share` from slot `0x1f` through `0x0042a5d0`. It then runs a second trend pass over `Dividend Per Share` slot `0x20`, rewarding surviving years where the sampled value does not fall below the previous year. The tail blends those weighted yearly lanes with current `Book Value Per Share` from slot `0x1d`, applies one difficulty-table scalar under `0x005f33b8`, applies a post-bankruptcy smoothing factor from the years since `[this+0x163]`, stores one bounded intermediate subscore into `[this+0x0d19]`, and finally caches the resulting float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded caller is `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, where this helper now reads as the recent per-share performance feeder rather than a generic governance-support history walker.","objdump + caller inspection + cache-field correlation + stock-data-family correlation + per-share-panel correlation" +0x00425a90,194,company_declare_bankruptcy_and_halve_bond_debt,simulation,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path.","objdump + RT3.lng strings + caller inspection + finance-field correlation" 0x004261b0,74,company_count_unassigned_shares_after_active_chairman_holdings,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run.","objdump + caller inspection + takeover and merger vote correlation" 0x00426260,607,company_compute_board_approved_dividend_rate_ceiling,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one nonnegative per-share dividend ceiling for the selected company. The helper starts from the current support or governance lane `0x2329/0x0d`, normalizes that value by the current outstanding-share band at `[this+0x47]`, then scans a bounded recent-year window relative to the founding year `[this+0x157]` and current scenario year `[0x006cec78+0x0d]`, taking minima from the shareholder-facing slots `0x2b` and `0x2c`. In the early-company path it also folds in `[this+0x57]` and the previous-year slot `0x1c`, applies several scale constants, and clamps the result at zero before returning the final per-share ceiling. Current grounded shell caller is `shell_company_detail_handle_change_dividend_rate_dialog_message` at `0x004c5140`, where this is the direct board-approval limit behind localized id `991` when the player tries to raise the dividend too far.","objdump + caller inspection + dividend-ceiling correlation" -0x004273c0,132,company_repurchase_public_shares_and_reduce_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current public-support scalar from `company_compute_public_support_vote_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline.","objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation" -0x00427450,224,company_issue_public_shares_and_raise_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_vote_scalar` `0x00424fd0`, the current stock-valuation helper at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, optionally snapshots the prior year and tick into `[this+0x16b..0x177]`, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side.","objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation" +0x004273c0,132,company_repurchase_public_shares_and_reduce_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline.","objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation" +0x00427450,224,company_issue_public_shares_and_raise_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, the current stock-valuation helper at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, optionally snapshots the prior year and tick into `[this+0x16b..0x177]`, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side.","objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation" 0x00427540,76,company_compute_bond_interest_rate_quote,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Computes one company-specific bond interest-rate quote from the requested term and current support or credit state. When the company is active it combines the zero-argument value ladder from `0x00425320`, the current rating helper at `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one.","objdump + caller xrefs + callsite inspection + bond-rate correlation" 0x004275c0,255,company_issue_bond_and_record_terms,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons.","objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation" 0x00426890,68,company_find_collection_index_by_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`.","objdump + caller inspection + company collection correlation" 0x00426be0,53,company_can_purchase_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt.","objdump + caller inspection + RT3.lng strings + territory-flag correlation" 0x00426d60,393,company_deactivate_and_clear_chairman_share_links,simulation,thiscall,inferred,objdump + caller inspection + collection-state correlation,4,"Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper.","objdump + caller inspection + collection-state correlation + CompanyDetail control correlation" 0x00426ef0,43,company_get_linked_chairman_profile_record,simulation,thiscall,inferred,objdump + caller inspection,4,"Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text.","objdump + caller inspection + chairman-link correlation" -0x0042a2e0,645,company_read_control_transfer_metric_slot,simulation,thiscall,inferred,objdump + caller inspection,3,"Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, and annual governance logic. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_vote_scalar` at `0x00424fd0`, while nearby governance callers also use slots such as `0x1f`, `0x29`, `0x2b`, and `0x2c` in the annual shareholder-revolt and creditor-warning lane surfaced by localized ids `300..304`. Wider shell-side xrefs now tighten `0x2b` and neighboring slots `0x2c`, `0x2e`, and `0x2f` into the same shareholder-facing per-share or history family reused by a CompanyDetail formatter beside localized text including `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-governance metric dispatcher rather than a merger-only issue reader.","objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation" -0x0042a5d0,131,company_read_year_or_control_transfer_metric_value,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula.","objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation" +0x0042a0e0,77,company_query_highest_coupon_bond_slot_index,simulation,thiscall,inferred,objdump + caller inspection + debt-record layout correlation,3,"Returns the live bond-slot index with the highest coupon rate from the debt table rooted at `[this+0x5f]`. The helper walks the current bond count at `[this+0x5b]`, compares each slot's rate field at `[this+0x67 + slot*0xc]`, and returns the zero-based index of the strongest surviving slot or `-1` when no bond slots are live. Current grounded caller is the annual finance-policy helper at `0x00401c50`, where this picks the reference bond used by the build-`1.03+` stock-issue lane before it checks current cash against that slot's principal plus a small fixed buffer.","objdump + caller inspection + debt-record layout correlation + annual-finance correlation" +0x0042a040,55,company_add_delta_into_stat_series_and_current_slot,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the company stat-family series lane selected by the requested slot id. The helper increments both the year-indexed series rooted at `[this+0x0d7f]` and the current aggregate lane rooted at `[this+0x1c47]`, but does not touch the broader cash-side shadow totals. Current grounded callers include bond repayment `0x00423d70`, bankruptcy `0x00425a90`, stock buyback `0x004273c0`, territory-access purchase `0x004c5fc9`, and several placement or world-service mutations, so this now reads as the shared company stat poster without the optional cash-side follow-on.","objdump + caller xrefs + field-write correlation + finance-mutator correlation" +0x0042a080,95,company_add_delta_into_stat_series_current_slot_and_optional_cash_totals,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized.","objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation" +0x0042a2e0,645,company_read_control_transfer_metric_slot,simulation,thiscall,inferred,objdump + caller inspection,3,"Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader.","objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation" +0x0042a5d0,131,company_read_year_or_control_transfer_metric_value,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula.","objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation" 0x0042c690,311,placed_structure_rebuild_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path.","objdump + caller xrefs + callsite inspection + cargo-summary correlation" 0x0042c8f0,112,placed_structure_refresh_linked_candidate_flag4,map,thiscall,inferred,objdump + caller xrefs + linked-instance inspection,3,"Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open.","objdump + caller xrefs + linked-instance inspection + candidate-flag correlation" 0x0042cab0,117,placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link,map,thiscall,inferred,objdump + caller inspection + route-style remap inspection,3,"Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests.","objdump + caller inspection + route-style remap inspection + peer-link emission correlation" @@ -138,11 +143,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0042ce00,1394,placed_structure_rebuild_candidate_local_service_tables,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper.","objdump + caller xrefs + callsite inspection + table-layout correlation" 0x0042d580,26,placed_structure_refresh_local_service_score_bundle,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`.","objdump + caller xrefs + wrapper inspection" 0x00428a10,22,company_clear_selected_chairman_if_current_profile,simulation,thiscall,inferred,objdump + caller inspection,4,"Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation.","objdump + caller inspection + chairman-link correlation" -0x00424fd0,751,company_compute_public_support_vote_scalar,simulation,thiscall,inferred,objdump + caller inspection,3,"Computes one bounded public-support scalar used by company policy, takeover or merger voting, and the adjacent annual governance lane. The helper starts from `company_compute_cached_recent_performance_support_score` at `0x004248d0`, blends that score with the company-side field `[this+0x57]`, applies extra startup or age smoothing when the current year is still within five years of `[this+0x157]`, and optionally updates the mutable support field `[this+0x4f]` when the caller supplies nonzero control arguments. It then folds in company value `[this+0x47]`, one profile or company affinity term from `0x00436590`, the current linked chairman id `[this+0x3b]`, and one difficulty table under `0x005f33b8`, clamps the result into a bounded 0-to-positive range, and returns the final float. Current grounded callers include the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual shareholder-revolt or creditor-pressure path that surfaces localized ids `300..304`. The direct scenario-state issue lane here uses issue id `0x37`, which now looks like the broader company-management or public-sentiment slot rather than the narrower merger-only management-attitude slot.","objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation" -0x00424580,82,company_compute_issue39_opinion_bias_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small company-side float helper beneath the city-connection bonus lane. It first reads one normalized scenario baseline from `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 opinion total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers are the wrapper at `0x00427540` and the mid-ladder branch inside `company_compute_connection_bonus_value_ladder` at `0x00425425`, so current best meaning is the issue-39 opinion bias scalar beneath city-connection bonus and announcement scoring rather than a generic company-support helper.","objdump + caller xrefs + callsite inspection + issue-39 correlation + connection-bonus correlation" -0x00425880,64,company_compute_negative_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the issue-39 opinion bias scalar from `company_compute_issue39_opinion_bias_scalar` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection" -0x004258c0,396,company_compute_positive_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same issue-39 opinion bias scalar at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation" -0x00425320,607,company_compute_connection_bonus_value_ladder,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Builds one bounded company-side value scalar beneath the city-connection bonus lane. The helper returns `0` when the company-active flag at `[this+0x3f]` is clear; otherwise it walks a four-step recent-year window relative to the current scenario year at `0x006cec78+0x0d` and the company founding year at `[this+0x157]`, reads one pair of support-or-governance slots through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with ids `0x2b` and `0x09`, accumulates their weighted differences with descending weights `4..1`, averages that ladder, blends in the current stat-family `0x2329` mode `0x12` term, and multiplies the result through the neighboring company-side multiplier at `0x00423e40`. When the current support lane `0x2329` mode `0x0d` is high enough, it also folds in the active scenario issue-opinion multiplier at `0x00436710` for issue id `0x39` using the current company and linked chairman ids. Wider xrefs now tighten `0x2b` into the same rolling shareholder-facing performance lane reused by the annual shareholder-revolt or creditor-pressure checks and a CompanyDetail per-share/history formatter; `0x09` remains narrower and currently looks like a current governance-pressure term that is only read after those broader yearly trend and public-support gates succeed. The tail then clamps the result through a bounded piecewise ladder with extra startup smoothing across roughly the first five years after founding. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, the smaller wrapper at `0x00427540`, and the boolean unlock gate at `0x00427590`, so current best meaning is the company-side connection-bonus value ladder rather than a generic public-support scalar.","objdump + caller xrefs + callsite inspection + issue-slot correlation + connection-bonus correlation + governance-lane correlation" +0x00424fd0,751,company_compute_public_support_adjusted_share_price_scalar,simulation,thiscall,inferred,objdump + caller inspection,3,"Computes one bounded investor-support and share-price scalar used by stock-capital policy, cached share-price readouts, and adjacent governance or control-transfer vote lanes. The helper starts from `company_compute_cached_recent_per_share_performance_subscore` at `0x004248d0`, blends that score with the company-side field `[this+0x57]`, applies extra startup or age smoothing when the current year is still within five years of `[this+0x157]`, and interprets the first caller argument as one normalized share-count pressure term against current outstanding shares `[this+0x47]`, clamping that delta into a small bounded band. When the caller supplies nonzero control arguments it can also refresh the mutable support field `[this+0x4f]` from that staged pressure term. The tail then folds in company value and share-count state, one profile or company affinity term from `0x00436590`, the current linked chairman id `[this+0x3b]`, and one difficulty table under `0x005f33b8`, clamps the final float into a bounded positive range, and optionally snapshots it into the cached share-price field `[this+0x0d7b]` when the second control argument is nonzero. Current grounded callers include the cached share-price accessor `0x00423eb0`, the stock buyback and stock issue mutators `0x004273c0` and `0x00427450`, the bankruptcy recompute path `0x00425a90`, the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual creditor-pressure or shareholder-policy lane that surfaces localized ids `300..304`. The direct scenario-state issue lane here uses issue id `0x37`, which still looks like the broader company-management or public-sentiment slot rather than the narrower merger-only management-attitude slot.","objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation + stock-buyback correlation + stock-issue correlation + share-price-cache correlation + per-share-performance correlation" +0x00424580,82,company_compute_prime_rate_from_issue39_scenario_baseline,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small company-side rate helper that produces the current prime-rate-style baseline from scenario state plus issue `0x39`. It first reads one normalized scenario baseline through `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers now bound the player-facing meaning more tightly: the bond-interest quote wrapper at `0x00427540`, the negative and positive cash interest helpers at `0x00425880` and `0x004258c0`, and the CompanyDetail capital summary row labeled `954` `Prime Rate:` at `0x004c23a0`. This now reads as the shared prime-rate or market-rate helper rather than a generic company-support scalar.","objdump + caller xrefs + callsite inspection + issue-39 correlation + prime-rate correlation + bond-quote correlation" +0x004246b0,544,company_compute_five_year_weighted_shareholder_return,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Computes the stock-data lane surfaced as `5 Year Weighted Return`. Inactive companies fall back to the fixed scalar at `0x005c8598`; otherwise the helper walks up to five recent years above founding year `[this+0x157]`, samples yearly `Share Price` from slot `0x1c`, measures year-over-year price appreciation against the prior sample, blends that with the paired historical shareholder-payout lane from slot `0x23`, and weights recent years more heavily through the same scenario-side year weighting byte at `[0x006cec78+0x0f]`. Current evidence now bounds that paired lane more tightly: slot `0x23` falls back to direct company field `[this+0x53]` on the current-company path and is only consumed here, so the strongest current read is the historical dividend-per-share or shareholder-payout component paired with yearly price appreciation. The tail normalizes the accumulated weighted return by the accumulated weights and returns one bounded annualized-style float. Current grounded caller is `company_read_control_transfer_metric_slot` at `0x0042a2e0` for slot `0x21`, which matches the stock-data label `942` `5 Year Weighted Return:` and tooltip `936`.","objdump + caller inspection + RT3.lng strings + stock-data-label correlation + weighted-return correlation + shareholder-payout-lane correlation" +0x00425880,64,company_compute_negative_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation" +0x004258c0,396,company_compute_positive_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation" +0x00425320,607,company_compute_connection_bonus_value_ladder,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Builds one bounded company-side value scalar beneath the city-connection bonus lane. The helper returns `0` when the company-active flag at `[this+0x3f]` is clear; otherwise it walks a four-step recent-year window relative to the current scenario year at `0x006cec78+0x0d` and the company founding year at `[this+0x157]`, reads one pair of slots through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with ids `0x2b` and `0x09`, accumulates their weighted differences with descending weights `4..1`, averages that ladder, blends in the current stat-family `0x2329` mode `0x12` term, and then scales the result by the weighted average bond interest rate from `company_compute_weighted_average_bond_interest_rate` `0x00423e40`. When the current support lane `0x2329` mode `0x0d` is high enough, it also folds in the current prime-rate baseline from `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` together with the active scenario issue-39 total. Wider xrefs now tighten `0x2b` into the rolling net-profits lane reused by the annual finance checks and CompanyDetail per-share/history formatter, while the report-history descriptor table aligns `0x09` with the Income Statement fuel-cost lane surfaced by tooltip `1309`. So the ladder is currently best read as recent net profits minus recent fuel burden, then adjusted by current company borrowing conditions rather than by a vague governance-pressure term. The tail then clamps the result through a bounded piecewise ladder with extra startup smoothing across roughly the first five years after founding. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, the smaller wrapper at `0x00427540`, and the boolean unlock gate at `0x00427590`, so current best meaning is the company-side connection-bonus value ladder rather than a generic public-support scalar.","objdump + caller xrefs + callsite inspection + issue-slot correlation + connection-bonus correlation + income-statement-row correlation + derived-report-metric correlation + average-interest correlation + prime-rate correlation" +0x00429c70,976,company_read_derived_financial_report_metric_slot,simulation,thiscall,inferred,objdump + caller inspection + shell-label correlation,3,"Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper.","objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation" 0x00429990,86,company_collection_get_nth_active_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows.","objdump + caller inspection + active-company roster correlation" 0x004299f0,84,company_collection_count_active_companies_before_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`.","objdump + caller inspection + active-company roster correlation" 0x00429a50,62,company_collection_count_active_companies,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math.","objdump + caller inspection + active-company roster correlation" @@ -215,7 +222,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004a6360,592,aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Owner-side adjacent-group refresh beneath the auxiliary route-entry tracker family at `0x006cfcb4`. Starting from one owner route-entry id, the helper validates the current tracker, requires its tracker-side enable byte `+0x1d` to be nonzero, resolves the two bound endpoint entries from tracker slots `+0x04` and `+0x08`, and first requires those endpoint entries to agree on the boolean class state derived from route-entry byte `+0x44`. It then inspects adjacent route-entry links hanging off both endpoint sides through the `+0x206/+0x20a` family and, whenever a neighboring route entry belongs to a different tracker group, runs `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate` `0x004a4c00` before re-entering `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate that compatible adjacent chain into the owner's tracker group. Current grounded caller is `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0`, which invokes this helper only when the tracker's boolean class latch at `+0x1c` changes. This now looks like the owner-adjacent compatible-group refresh path triggered by latch changes rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-refresh correlation + compatibility-gate correlation" 0x004a62c0,79,aux_route_entry_tracker_query_tracker_component_labels_match,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small dirty-aware equality test over tracker component labels in the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids, the helper first refreshes stale labels through `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when collection dirty latch `[this+0x8c]` is set, resolves both tracker records, and returns `1` only when both ids are live and tracker field `+0x0c` matches across the pair. Invalid tracker ids return `0`. Current grounded callers include the alternate recursive pair-metric branch at `0x004a5900`, where this helper gates same-component recursion before adjacent-neighbor expansion.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label equality correlation" 0x004a6320,64,aux_route_entry_tracker_collection_query_component_label_by_tracker_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Dirty-aware query helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper first checks collection dirty latch `[this+0x8c]` and re-enters `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when the cached component labels are stale. It then validates the caller-supplied tracker id through the collection, resolves the live tracker record, and returns the connected-component label stored in tracker field `+0x0c`; invalid tracker ids return `-1`. Current grounded callers are the heavier pair-selection family around `0x004a6630`, where this helper is the reusable query side of the component-label sweep rather than another traversal owner.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label query correlation" -0x004a65b0,128,aux_route_entry_tracker_dispatch_route_entry_pair_metric_query,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Version-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, so this branch is no longer best-read as a time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the exact algorithm split between the `0x004a5280` and `0x004a5900` branches remains open.","objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation" +0x004a65b0,128,aux_route_entry_tracker_dispatch_route_entry_pair_metric_query,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Build-compatibility-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, and the version source itself can come from either the local `RT3.EXE` version resource or the multiplayer session-side companion path at `0x0046a4b0`, so this branch now reads most safely as a pre-`1.03` versus `1.03+` route-metric compatibility dispatcher rather than any gameplay time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the deeper user-facing meaning of the returned metric still lives mostly in the linked-transit and route-validation consumers rather than inside this switch itself.","objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation + multiplayer-session-version correlation" 0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation" 0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation" 0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation" @@ -263,7 +270,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00434870,23,scenario_state_get_selected_chairman_company_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane.","objdump + global-state inspection + caller correlation" 0x00434890,35,scenario_state_set_selected_chairman_profile,map,thiscall,inferred,objdump + global-state inspection,4,"Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id.","objdump + global-state inspection + caller correlation" 0x004348c0,23,scenario_state_get_selected_chairman_profile_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`.","objdump + global-state inspection + caller correlation" -0x00436590,372,scenario_state_compute_issue_opinion_multiplier,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the public-support blend helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier.","objdump + caller inspection + issue-table correlation + merger-text correlation" +0x00436590,372,scenario_state_compute_issue_opinion_multiplier,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the broader support-adjusted share-price helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier.","objdump + caller inspection + issue-table correlation + merger-text correlation" 0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation" 0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation" 0x00437a60,41,world_toggle_pause_or_restore_game_speed,simulation,thiscall,inferred,objdump + strings,3,"Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`.","objdump + RT3.lng strings" @@ -360,6 +367,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00489830,496,scenario_text_export_report_language_file,scenario,cdecl,inferred,ghidra-headless,3,Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled.,ghidra + rizin + llvm-objdump + strings 0x00489a20,1085,scenario_text_export_batch_process_maps,scenario,cdecl,inferred,ghidra-headless,4,Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog.,ghidra + rizin + llvm-objdump + strings 0x004bfb30,956,shell_format_company_financial_summary_card,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Reusable shell company financial-summary formatter shared by `CompanyDetail.win` and the company-list row lane. The helper resolves the linked chairman and current selected profile through `0x006cec78` and `0x006ceb9c`, highlights the card when the company belongs to the selected chairman, formats the visible company header text, and then renders a compact three-row finance block under localized ids `633` `Cash:`, `607` `Revenue:`, and `925` `Profits:`. The grounded metric mapping is now tighter too: `Cash:` comes from `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with slot `0x0d` and stat-family selector `0x2329`, `Revenue:` comes from the same reader with slot `0x2c`, and `Profits:` comes from slot `0x2b`; the revenue and profit rows also switch color when the readback is negative. Grounded callers are `shell_company_detail_render_company_summary_card` at `0x004c1ab0` and `shell_company_list_format_company_or_start_row` at `0x004c6b40`.","objdump + RT3.lng strings + caller inspection + shared shell formatter correlation + compact-metric-row correlation" +0x004c0160,2214,shell_format_company_stock_data_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Shared shell stock-data formatter used by `LoadScreen.win` page `6`. The helper resolves the selected company through the live collection at `0x0062be10`, builds the section headers `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`, ranks the top positive active-chairman holdings for that company through the profile collection at `0x006ceb9c`, and renders up to four shareholder rows with the current share counts from `[profile + company_id*4 + 0x15d]`. It then formats the full six-row per-share block: help texts `931..936` and labels `937..942`, with `Share Price` from stat-family `0x2329/0x1c`, `Book Value Per Share` from `0x2329/0x1d`, `Revenue Per Share` from `0x2329/0x1e`, `Earnings Per Share` from `0x2329/0x1f`, `Dividend Per Share` from `0x2329/0x20`, and `5 Year Weighted Return` from `0x2329/0x21` via `company_compute_five_year_weighted_shareholder_return` `0x004246b0`. Current grounded caller is `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`.","objdump + RT3.lng strings + caller inspection + shareholder-ranking correlation + stock-data-label correlation + per-share-metric correlation + weighted-return correlation" 0x004c1610,48,shell_company_detail_bind_bond_row_band_for_active_panel,shell,cdecl,inferred,objdump + caller inspection,4,"Tiny CompanyDetail helper that binds one contiguous debt-row control band to whichever bond panel is active. When the source control id is `0x947e` it enables the upper row band `0x94e8..0x950f`; otherwise it enables the sibling row band `0x9510..0x9537`. Current grounded owner is the CompanyDetail refresh path at `0x004c2ca0`, where this helper sits beside the shared bond readout callback for controls `0x947d` and `0x947e` and makes those two controls read as twin bond-slot list owners rather than as one-off buttons.","objdump + caller inspection + bond-row-band correlation" 0x004c16b0,35,shell_company_detail_copy_selected_company_debt_slot_triplet,shell,cdecl,inferred,objdump + caller inspection,3,"Small CompanyDetail helper that copies one 12-byte triplet from the currently selected company's debt-record band near `[company+0x5f + slot*0xc]` into a caller-supplied output buffer. Current grounded callers use it while building the bond maturity and repay readout lane and the adjacent action-message debt checks.","objdump + caller inspection + debt-slot correlation" 0x004c16f0,59,shell_company_detail_resolve_selected_company,shell,cdecl,inferred,objdump + caller inspection,4,"Resolves the current `CompanyDetail.win` company into the live company collection and returns the validated company record pointer or null. The helper reads the selected company id from shell detail owner `0x006d0818+0x90`, rejects nonpositive ids, verifies existence through company collection `0x0062be10`, and then returns the concrete record through `0x00518140`. It is the common shared accessor beneath the CompanyDetail read-side panels, finance actions, territory-access lane, and company-governance flows.","objdump + caller inspection + shared CompanyDetail accessor correlation" @@ -370,8 +378,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004c1b60,462,shell_company_detail_refresh_selected_territory_access_summary,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the selected-territory status summary in `CompanyDetail.win`. The helper caches the active territory id in `0x006cfe5c`, resolves the territory through `0x006cfc9c`, and formats one of three localized status texts for the current selected company: id `946` when the company already has access rights, id `947` when rights are unavailable but purchasable, or id `948` when the company cannot purchase rights at all. It also republishes the selected-territory control rooted at `0x948c`. Current grounded callers are the territory-summary callbacks at `0x004c1d30`, `0x004c1d70`, and `0x004c22e0`.","objdump + RT3.lng strings + caller inspection + territory-status correlation" 0x004c1ec0,587,shell_company_detail_render_bond_maturity_and_repay_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific bond readout callback bound to controls `0x947d` and `0x947e`. The helper resolves the currently selected company through `0x006d0818`, indexes one 12-byte debt-record slot from the selected company near `[company+0x5f + slot*0xc]`, formats the maturity caption through localized id `949` `Due %1`, formats the current bond amount or value through the shared numeric formatter family at `0x0051c000`, and then renders the repay affordance through localized id `950` `Repay this bond.`. In the surrounding refresh path this panel is paired with `shell_company_detail_bind_bond_row_band_for_active_panel` at `0x004c1610`, so the two controls now read as the owners of twin repayable bond-slot row bands `0x94e8..0x950f` and `0x9510..0x9537` rather than as isolated text widgets. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback onto the adjacent debt-panel controls rather than onto the territory or finance-history lanes.","objdump + RT3.lng strings + caller inspection + debt-panel correlation + bond-row-band correlation" 0x004c22e0,56,shell_company_detail_sync_selected_territory_from_picker,shell,cdecl,inferred,objdump + caller inspection,4,"Small `CompanyDetail.win` territory-sync callback for control `0x948c`. The helper resolves the current territory-picker widget through the live CompanyDetail window at `0x006cfe4c`, reads the currently focused territory id from `[widget+0x117]` when a picker row is present, and then forwards that territory id into `shell_company_detail_refresh_selected_territory_access_summary` at `0x004c1b60`. When no picker row is active it falls back to territory id zero before refreshing the same summary.","objdump + caller inspection + picker-sync correlation" -0x004c23a0,1259,shell_company_detail_render_capital_and_dividend_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific summary callback bound to control `0x9488`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing finance-summary block under localized ids `951` `Total Debt:`, `952` `Credit Rating:`, `953` `Average Interest Rate:`, `954` `Prime Rate:`, `955` `Market Cap:`, `956` `Annual Dividend:`, and `957` `Annual Dividend Payments:`. Current grounded logic uses the company metric readers at `0x0042a5d0`, `0x00423e40`, and `0x00423eb0`, the credit-rating text table at `0x00620d00..0x00620d14`, and the outstanding-share count at `[company+0x47]` when deriving the rendered values. The CompanyDetail refresh path wires this callback onto the same read-side tab family as the bond and per-share panels.","objdump + RT3.lng strings + caller inspection + finance-summary correlation" -0x004c2720,1394,shell_company_detail_render_per_share_metrics_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific per-share metrics callback bound to control `0x948a`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing per-share block under localized ids `937` `Share Price:`, `938` `Book Value Per Share:`, `939` `Revenue Per Share:`, `940` `Earnings Per Share:`, `941` `Dividend Per Share:`, and `942` `5 Year Weighted Return:`. It also formats the dated caption lane through localized id `943` `Dec-%1` and uses the same current-company metric helpers as the surrounding CompanyDetail summary family. Current grounded owner is the CompanyDetail refresh path, which binds this panel beside the debt/capital summary block rather than inside the action-message dispatcher.","objdump + RT3.lng strings + caller inspection + per-share panel correlation" +0x004c23a0,1259,shell_company_detail_render_debt_credit_and_rate_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific summary callback bound to control `0x9488`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing debt and rate block under localized ids `951` `Total Debt:`, `952` `Credit Rating:`, `953` `Average Interest Rate:`, and `954` `Prime Rate:`. Current grounded logic now has concrete helper ownership for the rate rows: `company_compute_weighted_average_bond_interest_rate` `0x00423e40` feeds `Average Interest Rate`, `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds `Prime Rate`, the credit-rating text table at `0x00620d00..0x00620d14` is chosen from the rounded city-connection bonus ladder at `0x00425320`, and the leading debt total comes from the current metric family through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` using stat-family `0x2329` and slot `0x12`. The CompanyDetail refresh path wires this callback onto the same read-side tab family as the bond and stock-summary panels.","objdump + RT3.lng strings + caller inspection + finance-summary correlation + average-interest correlation + prime-rate correlation + debt-total correlation" +0x004c2720,1394,shell_company_detail_render_share_value_and_dividend_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific stock-summary callback bound to control `0x948a`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing share-value and payout block under localized ids `937` `Share Price:`, `724` `Shares Outstanding:`, `955` `Market Cap:`, `956` `Annual Dividend:`, and `957` `Annual Dividend Payments:`. Current grounded helper ownership is tighter now too: `company_query_cached_share_price_scalar` `0x00423eb0` feeds `Share Price`, the outstanding-share count comes from `[company+0x47]`, `Market Cap` multiplies those two lanes together, `Annual Dividend` comes from the current-year stat-family read `0x2329/0x20`, and `Annual Dividend Payments` multiplies that dividend-per-share lane by the outstanding-share count. The broader six-row per-share data family `938..942` instead sits in the shared stock-data formatter `shell_format_company_stock_data_panel` at `0x004c0160`. Current grounded owner is the CompanyDetail refresh path, which binds this panel beside the debt or credit or rate summary block rather than inside the action-message dispatcher.","objdump + RT3.lng strings + caller inspection + stock-summary correlation + share-price correlation + dividend-payout correlation" 0x004c3470,621,shell_company_detail_step_selected_active_company_delta,shell,cdecl,inferred,objdump + caller inspection,4,"CompanyDetail-specific company-navigation helper. The routine resolves the currently selected company id through the detail owner at `0x006d0818`, converts it to an active-company ordinal through `company_collection_count_active_companies_before_company_id` `0x004299f0`, wraps `ordinal + delta` modulo the active-company count from `company_collection_count_active_companies` `0x00429a50`, resolves the replacement company id through `company_collection_get_nth_active_company_id` `0x00429990`, writes it back through detail-manager setter `0x004dd8a0`, refreshes the visible panel through `shell_company_detail_window_refresh_controls` `0x004c2ca0`, notifies the detail manager through `0x004dd410`, and resets territory picker control `0x948c` through `0x00538e00`. Current grounded wrappers are the next and previous company selectors at `0x004c3540` and `0x004c3550`.","objdump + caller inspection + CompanyDetail navigation correlation" 0x004c3540,5,shell_company_detail_select_next_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `+1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation" 0x004c3550,5,shell_company_detail_select_previous_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `-1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation" @@ -448,7 +456,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004e45d0,757,shell_load_screen_profile_stock_holdings_page_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + control-id inspection,4,"Page-specific message handler for the `LoadScreen.win` stock-holdings slice. The handler owns controls `0x3ef6..0x3f1d` while page-kind `[this+0x80]` selects this branch from the outer dispatcher at `0x004e3a80`. Current grounded state includes the selected profile id `[this+0x8c]`, selected company id `[this+0x88]`, optional display year `[this+0x9c]`, and a local row index `[this+0x118]`. Controls `0x3ef6` and `0x3ef7` step `[this+0x118]` backward or forward within a bounded `0..10` band before re-entering `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`; `0x3ef8`, `0x3efb`, and `0x3efc` reuse that same helper to activate or step the current company row and page-local selector state. The later jump-table lane rooted at `0x3f07` also cycles the selected profile through the active-chairman collection at `0x006ceb9c` using `profile_collection_count_active_chairman_records` at `0x00477820`, `0x005184f0`, and `0x00518380`, then refreshes the current page through `0x004e2c10`. The same page branch adjusts the display year `[this+0x9c]` through the company-step helper `0x004e3a00` and the fallback reader `company_query_display_year_or_current_year` at `0x004e39e0`. Current grounded meaning is the stock-holdings page handler beneath `LoadScreen.win`, not the outer window dispatcher.","objdump + RT3.lng strings + control-id inspection + active-profile-cycle correlation + year-step correlation + row-selection correlation" 0x004e4b10,720,shell_load_screen_reset_runtime_state_and_seed_selection,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,3,"Lower reset or seed helper used by the `LoadScreen.win` opener before the visible ledger loop begins. The helper clears page state `[this+0x78]`, page-local substate `[this+0x7c]`, display year `[this+0x9c]`, selected company `[this+0x88]`, selected chairman profile `[this+0x8c]`, the page-kind cache `[this+0x80]`, the page-strip history stack rooted at `[this+0x0a0]`, and several presentation-side pointers including `[this+0x0b2d]` and `[this+0x0b31]`. It then seeds the selected company and chairman from the current scenario state through `0x004337a0` and `0x004337b0`, allocates the main text surface at `[this+0x0e55]`, builds several descriptor or name caches under `[this+0x0b25]`, `[this+0x0b29]`, `[this+0x0761..]`, `[this+0x0995..]`, and `[this+0x0b35..]`, binds three callback-style controls `0x3ee4`, `0x3ef4`, and `0x3ee5` through the generic shell control path at `0x00540120`, and stores the caller-selected display year into `[this+0x9c]`. Current grounded caller is the higher `LoadScreen` opener at `0x004e4ee0`, which later enters the page-selection refresh path. This now reads as the runtime reset and cache-seed helper beneath ledger opening rather than as a page renderer.","objdump + caller inspection + state-flow correlation + cache-seed correlation" 0x004e4ee0,406,shell_open_or_focus_load_screen_page,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings + launch-flow correlation,4,"Shared higher-level opener for the shell-side `LoadScreen.win` ledger family. The caller supplies one requested page id in `ECX`. When sandbox flag byte `[0x006cec7c+0x82]` is set the helper does not open the ledger; instead it raises a simple shell modal through `shell_open_custom_modal_dialog_with_callbacks` using localized id `3899` `The ledger is not available in sandbox mode.`. Outside sandbox it first checks for an existing live ledger runtime at `0x006d10a8`: when one is already open and the requested page id is nonzero it simply re-enters `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10` with that page; when the live runtime exists and the requested page id is zero it leaves the current page unchanged. When no live runtime exists it allocates the transient ledger object into `0x006d10a8`, resets and seeds it through `shell_load_screen_reset_runtime_state_and_seed_selection` at `0x004e4b10`, enters the visible shell modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell presentation state. Current grounded callers include the world-frame command path at `0x0043970f`, the grouped shell command stubs at `0x0044070e..0x0044086e` for pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, and the shell detail-side launcher at `0x004de82b`; no current recovered opener in that family requests page `0x0b` or `0x0d`. This now reads as the shared open-or-focus ledger-page owner rather than an unnamed helper beside the page family.","objdump + caller inspection + RT3.lng strings + launch-flow correlation + sandbox-guard correlation" -0x004e5130,186,shell_load_screen_render_company_stock_data_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Selected-company stock-data page renderer inside `LoadScreen.win`. The helper first validates the current company id at `[this+0x88]` through the live company collection at `0x0062be10`. When no company is active it emits localized id `1299` `No stocks to view at this time...` through the shell text presenter and restyles control `0x3efd` inactive. On the populated path it falls through into the shared stock-data builder at `0x004c0160` using the temporary holdings buffer at `[this+0x995]`, current row or subselector state at `[this+0x0b25]` and `[this+0x0b29]`, and the stock-data descriptor table rooted at `0x00622098`. That lower helper iterates the active chairman roster, ranks the largest positive holders for the selected company, and formats the `Largest Shareholders`, `Shares`, and `Per Share Data` family under localized ids `928..930`. Current grounded caller is page `7` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best page meaning is the `Stock Data` slice rather than another generic company list.","objdump + RT3.lng strings + helper correlation + shareholder-ranking correlation + stock-data fallback correlation" +0x004e5130,186,shell_load_screen_render_company_stock_data_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Selected-company stock-data page renderer inside `LoadScreen.win`. The helper first validates the current company id at `[this+0x88]` through the live company collection at `0x0062be10`. When no company is active it emits localized id `1299` `No stocks to view at this time...` through the shell text presenter and restyles control `0x3efd` inactive. On the populated path it falls through into the shared stock-data builder at `0x004c0160` using the temporary holdings buffer at `[this+0x995]`, current row or subselector state at `[this+0x0b25]` and `[this+0x0b29]`, and the stock-data descriptor table rooted at `0x00622098`. That lower helper iterates the active chairman roster, ranks the largest positive holders for the selected company, and formats the `Largest Shareholders`, `Shares`, and `Per Share Data` family under localized ids `928..930`, with the first three per-share rows now bounded as `Share Price`, `Book Value Per Share`, and `Revenue Per Share` from stat-family slots `0x1c..0x1e`. Current grounded caller is page `7` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best page meaning is the `Stock Data` slice rather than another generic company list.","objdump + RT3.lng strings + helper correlation + shareholder-ranking correlation + stock-data fallback correlation + per-share-label correlation" 0x004e51ea,246,shell_load_screen_render_game_status_briefing_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Game-status-side briefing renderer inside `LoadScreen.win`. The helper uses page-local subselector `[this+0x7c]` to build one packed key and then queries the live scenario text store at `0x0062be18` through `0x00432f40` with kind `9`, writing the returned briefing text into a stack buffer before presenting it through the shell text surface rooted at `[this+0x0e55]`. It then appends the localized title or help pair `1772` `Briefing` and `1773` `View the scenario briefing.` through the smaller shell text-widget writer at `0x00563290`. Current grounded caller is page `3` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best meaning is the `Game Status` briefing page or panel rather than a company-owned report list.","objdump + RT3.lng strings + helper correlation + scenario-text-store correlation + briefing-string correlation" 0x004e5300,1899,shell_load_screen_render_player_detail_stock_holdings_panel,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-profile stock-holdings summary panel inside the shell-side `LoadScreen.win` family. The helper resolves the selected profile id at `[this+0x8c]` through the live chairman collection at `0x006ceb9c`, builds the top summary rows under localized ids `1204` `Stock Value:`, `1205` `Total Assets:`, and `1206` `Stock Holdings:`, then walks the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. For each active company with positive profile holdings in `[profile + company_id*4 + 0x15d]`, it formats one company row under ids `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`; when no positive holdings survive the sweep it emits fallback id `1209` `None`. The panel also checks the scenario-selected chairman through `0x004348c0`, and only for that currently selected profile does it append localized id `3029` `Click to change player name and portrait.` together with the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `8` to localized title id `1192` `PLAYER DETAIL`, so this renderer is no longer just a generic holdings page.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + holdings-slot correlation + selected-profile affordance correlation + page-title-table decode" 0x004e5a80,2368,shell_render_company_overview_panel_header_and_optional_change_affordance,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Broader company-side overview-panel renderer above the shared text-formatting entry later mapped at `0x004e5cf0`. The wrapper first checks the selected company id at `[this+0x88]`. When that id is absent or no longer resolves through the live company collection at `0x0062be10`, it chooses one of three fallback text families `1210` `You haven't started a company yet...`, `3043` `You don't control a company at the moment...`, or `3888` `You don't control a company at the moment.` from current chairman/company state, paints that fallback into the current shell text surface, and styles controls `0x3f06` and `0x3f07` inactive through the generic control path at `0x00540120`. When a valid company is present, it styles those same controls active, falls through into the shared metric/governance body later labeled at `0x004e5cf0`, and on the narrower branch where the selected company matches the scenario-selected company at `0x00434870` it also appends localized id `3044` `Click to change company name and logo.` and publishes the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. Current evidence therefore keeps the name/logo affordance outside the normal `CompanyDetail.win` callback dispatcher and makes `0x004e5cf0` read more like the shared text-formatting subentry within this wider overview-panel renderer than like a full standalone owner by itself.","objdump + RT3.lng strings + helper correlation + fallback-text correlation + overview-wrapper correlation" @@ -737,6 +745,26 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00565110,600,shell_rebuild_layout_state_and_optional_texture_report,shell,thiscall,inferred,ghidra-headless,3,Rebuilds the active shell layout-state branch when the current mode requires a deeper reset and optionally publishes the texture budget report through 0x00527650. The routine checks the current layout mode through 0x00545e00 tears down and recreates layout-state services through 0x0055dd80 and 0x0055e2b0 optionally notifies global shell services and when the caller flag is set emits the report then commits one layout refresh step through 0x00545d60.,ghidra + rizin + llvm-objdump + strings 0x0058bc90,23,multiplayer_gamespy_route_set_extended_payload_callback,shell,thiscall,inferred,objdump,3,"Tiny callback-slot helper for one GameSpy-style route object. It stores the caller callback pointer in `[route+0xa0]`, or in the default route singleton at `0x00629948` when `ecx` is null. The current grounded transport-side caller is multiplayer_transport_try_connect_status_route, which patches the status route's validated extended-payload callback slot to `0x597330` after route construction.",objdump 0x0058c9b0,404,multiplayer_gamespy_route_construct_and_seed_callback_vector,shell,thiscall,inferred,objdump,3,"Constructs or replaces one 0x108-byte GameSpy-style route object and seeds its callback vector. The helper allocates the route object when the caller owner slot is non-null, copies two caller strings into the local route buffers at `+0x04` and `+0x44`, stores the supplied callback table across `[route+0x88]` through `[route+0x9c]`, records the owner context at `[route+0x104]`, initializes the route cookie state and recent-cookie ring, and explicitly zeroes the secondary callback slots `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. Current grounded callers are multiplayer_transport_try_connect_status_route and multiplayer_transport_try_connect_live_route through the wrapper at `0x58cc40` or the constructor directly.","objdump" +0x0058d170,40,multiplayer_gamespy_server_descriptor_query_string_property_or_fallback,shell,cdecl,inferred,objdump,3,"Looks up one string property on a compact GameSpy-style server or route descriptor and falls back to the caller default string when the property is missing. It probes the descriptor-owned key store at `[this+0x18]` through `0x58f9c0`; on success it returns the matched value pointer at `[entry+0x04]`, and on failure it returns the fallback string from the stack. Current grounded callers use keys such as `hostname` and `gamever` when formatting route and selector status text.","objdump + caller inspection + strings" +0x0058d5b0,112,multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record,shell,cdecl,inferred,objdump,3,"Allocates one 0x24-byte compact server-descriptor record and seeds its primary endpoint fields from the caller tuple. It allocates the descriptor body through `tracked_heap_alloc_with_header`, allocates the owned property-store block at `[entry+0x18]` through `0x58f840`, writes the primary IPv4 dword to `[entry+0x00]`, writes the raw primary port word to `[entry+0x04]`, and zero-initializes state byte `[entry+0x14]`, flag byte `[entry+0x15]`, both endpoint-extension fields, and the age or timestamp lanes at `[entry+0x1c]` and `[entry+0x20]`. Current grounded caller is the primary-endpoint table seed path around `0x590dc0`.","objdump + caller inspection + descriptor-allocation correlation" +0x0058d1f0,3,multiplayer_gamespy_server_descriptor_query_primary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint IPv4 dword from `[this+0x00]` without byte-order conversion. Current grounded consumers pair it with the raw primary port getter `0x58d210` as the compact identity key in `0x5903a0`, and pair it with the host-order port getter `0x58d200` when building route-binding payloads and compatibility checks.","objdump + caller inspection + WSOCK32 byte-order correlation" +0x0058d200,13,multiplayer_gamespy_server_descriptor_query_primary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port from `[this+0x04]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers use this host-order port in route-binding payload formatting and compatibility checks when no secondary endpoint flag is present.","objdump + caller inspection + WSOCK32 ntohs correlation" +0x0058d210,5,multiplayer_gamespy_server_descriptor_query_primary_port_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port word from `[this+0x04]` without byte-order conversion. Current grounded consumer `0x5903a0` pairs it with raw primary IPv4 `0x58d1f0` as the compact lookup key in the descriptor collection.","objdump + caller inspection + raw-key correlation" +0x0058d1c0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit0,shell,cdecl,inferred,objdump,3,"Returns state bit `0x1` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners rather than one: queue service can promote pending field-cache state `0x4` into ready bit `0x1`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x1` after the inline keyed-property vector path gated by source header bit `0x40` completes. Current grounded caller `0x595a6d` uses it to skip reinsertion into the field-cache family.","objdump + caller inspection + queue-state correlation + compact-decode correlation" +0x0058d1d0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit1,shell,cdecl,inferred,objdump,3,"Returns state bit `0x2` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners too: queue service can promote pending `gsi_am_rating` descriptor state `0x8` into ready bit `0x2`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x2` after the signed trailing string-pair tail runs to completion. Current grounded callers in the `gsi_am_rating` route branch use bit `0x2` as the split between immediate transition handling and reinsertion into the queued-descriptor family.","objdump + caller inspection + am-rating-branch correlation + queue-state correlation + compact-decode correlation" +0x0058d220,9,multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag,shell,cdecl,inferred,objdump,3,"Returns bit `0x2` from descriptor flag byte `[this+0x15]`. Current grounded callers use it to decide whether the descriptor exposes a secondary endpoint tuple at `[this+0x08]/[this+0x0c]` and therefore whether route-binding payload and compatibility checks should use the secondary port getter `0x58d250` instead of the primary port getter `0x58d200`.","objdump + caller inspection + secondary-endpoint correlation" +0x0058d230,9,multiplayer_gamespy_server_descriptor_query_flag_byte15_bit0,shell,cdecl,inferred,objdump,3,"Returns source-side header bit `0x1` from descriptor flag byte `[this+0x15]`. Current evidence now bounds this bit more tightly than before: it is not generated by queue service, is explicitly set during the raw primary-endpoint seed refresh around `0x590dc0` together with bit `0x10` before insertion into `[transport+0x18bc]`, and is also preserved by the compact descriptor decode path at `0x58ff60`. The strongest current read is therefore one primary-endpoint-seed or endpoint-only source marker: grounded transport callers still only use it in the `gsi_am_rating` branch, where clear routes a richer descriptor through direct primary-endpoint handling at `[transport+0x18bc]` via `0x00591330`, while set routes the descriptor through the queued-descriptor family at `[transport+0x1e7c]` via `0x005a09a0` and later suppresses the direct `0x595dc0` transition even after ready bit `0x2` is present. Current evidence is strong enough to reject a queue-generated meaning and to treat this as the source-side marker for descriptors that still need later queue-backed enrichment before direct transition.","objdump + caller inspection + am-rating-branch correlation + endpoint-table correlation + queue-state correlation + compact-decode correlation + transition-suppression correlation + raw-endpoint-seed correlation" +0x0058d240,4,multiplayer_gamespy_server_descriptor_query_secondary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint IPv4 dword from `[this+0x08]` without byte-order conversion. Current grounded callers only use it when `multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag` reports bit `0x2` set in `[this+0x15]`, which makes this the current strongest match for an optional secondary address tuple rather than another scalar field.","objdump + caller inspection + secondary-endpoint correlation" +0x0058d250,13,multiplayer_gamespy_server_descriptor_query_secondary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint port from `[this+0x0c]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers only use it when flag bit `0x2` in descriptor byte `[this+0x15]` is set, and then compare it against bound-route word `[binding->route+0x30]` in the route-binding compatibility gate.","objdump + caller inspection + WSOCK32 ntohs correlation + secondary-endpoint correlation" +0x0058d260,3,multiplayer_gamespy_server_descriptor_store_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Stores one intrusive next-descriptor link into field `[this+0x20]`. Current grounded caller `0x590410` uses it to prepend one descriptor onto the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation" +0x0058d270,3,multiplayer_gamespy_server_descriptor_query_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Returns intrusive next-descriptor link field `[this+0x20]`. Current grounded caller `0x590490` uses it to walk and release the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation" +0x0058d630,3,multiplayer_gamespy_server_descriptor_store_flag_byte15,shell,cdecl,inferred,objdump,2,"Stores one source-side compact header flag byte into descriptor field `[this+0x15]`. Current grounded callers are the compact descriptor decode helper `0x58ff60`, which copies the source header byte verbatim through this setter, and the raw primary-endpoint seed path `0x590dc0`, which stamps literal `0x11` into the same field for seeded descriptors.","objdump + caller inspection + compact-header correlation" +0x0058d640,13,multiplayer_gamespy_server_descriptor_store_secondary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Stores one secondary endpoint tuple into descriptor fields `[this+0x08]/[this+0x0c]`. The caller supplies the secondary IPv4 dword in `edx` and the secondary port word on the stack. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter after header bit `0x02` selects an inline secondary IPv4 dword and header bit `0x20` either supplies the paired secondary port word or falls back to the owner default port at `[caller+0x498]`.","objdump + caller inspection + compact-header correlation" +0x0058d650,4,multiplayer_gamespy_server_descriptor_store_auxiliary_inline_dword10,shell,cdecl,inferred,objdump,2,"Stores one inline auxiliary dword into descriptor field `[this+0x10]`. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter only when source header bit `0x08` is present. A local xref scan across the multiplayer descriptor family now makes the negative result tighter too: no dedicated semantic reader has been recovered yet. Current evidence only shows the field being preserved by later descriptor-record copy or callback marshaling helpers around `0x591410`, `0x591480`, and `0x591510`, not branched on or formatted through a dedicated accessor. So the field ownership and header-bit gate are explicit, while the higher-level meaning remains open.","objdump + caller inspection + compact-header correlation + local-xref scan + descriptor-copy correlation" +0x0058d660,3,multiplayer_gamespy_server_descriptor_store_state_byte14,shell,cdecl,inferred,objdump,2,"Stores one state byte into descriptor field `[this+0x14]`. Current grounded callers include queue-service paths that promote pending descriptor tags into ready bits and the compact decode helper `0x58ff60`, which ORs in bit `0x1` after the inline keyed-property vector path and bit `0x2` after the signed trailing string-pair tail.","objdump + caller inspection + queue-state correlation + compact-decode correlation" +0x0058d670,3,multiplayer_gamespy_server_descriptor_query_state_byte14,shell,cdecl,inferred,objdump,2,"Returns descriptor state byte `[this+0x14]` unchanged. Current grounded caller is the compact decode helper `0x58ff60`, which reads the existing state before OR-ing in bits `0x1` or `0x2` and writing the result back through `0x58d660`.","objdump + caller inspection + compact-decode correlation" +0x0058d5a0,3,multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c,shell,cdecl,inferred,objdump,2,"Returns special numeric scalar field `[this+0x1c]` unchanged. Current grounded callers are the special-key fallback path inside `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0`, where both `queryid` and `ping` currently collapse onto this field, and the multiplayer session-event capacity-entry updater around `0x469251`, which copies the same scalar into entry field `[entry+0x118]` alongside `numplayers`, `maxplayers`, and the primary-endpoint text.","objdump + caller inspection + strings" +0x0058d6d0,66,multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback,shell,cdecl,inferred,objdump,3,"Looks up one numeric property on a compact GameSpy-style server or route descriptor and falls back to the caller default integer when the property is missing. For ordinary keys it probes the descriptor string-key store through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` and parses the resulting decimal text through `0x5a1ea5`. It also has two fixed-key special cases for `queryid` and `ping`, both currently routed through `multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c` `0x58d5a0` instead of the generic property store. Current grounded callers use it for fields such as `numplayers`, `maxplayers`, `maxwaiting`, `numservers`, `numwaiting`, and `gsi_am_rating`.","objdump + caller inspection + strings + rdata-key correlation" 0x0058d7a0,55,multiplayer_transport_set_local_name,shell,thiscall,inferred,ghidra-headless,3,Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330.,ghidra + rizin + llvm-objdump 0x0058d830,40,multiplayer_transport_disconnect,shell,thiscall,inferred,ghidra-headless,3,Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4].,ghidra + rizin + llvm-objdump 0x0058d860,59,multiplayer_transport_release_worker_and_reset_runtime_state,shell,cdecl,inferred,rizin,3,Small runtime-reset wrapper for the outer session-event transport object. When the owned worker pointer at [this] is present it first tears that worker down through multiplayer_transport_worker_shutdown_gracefully then clears the worker pointer the configured flag byte at [this+0x04] the text-stream owner slots at [this+0x44] and [this+0x48] reruns 0x00593370 and the shared reset block at 0x0058d810 and finally clears the live route and deferred-runtime fields at [this+0x180c] [this+0x1810] and [this+0x1edc].,rizin + llvm-objdump @@ -752,7 +780,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0058cee0,164,multiplayer_gamespy_route_service_retry_and_keepalive_timers,shell,cdecl,inferred,objdump + strings,3,"Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence.","objdump + strings" 0x0058d040,37,multiplayer_gamespy_route_service_frame,shell,cdecl,inferred,objdump + strings,3,"Low-level recurring service step for one GameSpy-style route object. When the route handle state at `[route+0xb4]` is live it first services retry and keepalive timers through `multiplayer_gamespy_route_service_retry_and_keepalive_timers` and then drains inbound packets through `multiplayer_gamespy_route_drain_inbound_packets`. Current grounded callers are `multiplayer_transport_service_status_and_live_routes`, which uses the same helper for both the auxiliary status route at `[transport+0xaf0]` and the current live route at `[transport+0x1ecc]`.","objdump + strings" 0x0058d960,7,multiplayer_transport_select_status_route,shell,thiscall,inferred,ghidra-headless,3,Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing.,ghidra + rizin + llvm-objdump -0x0058d970,89,multiplayer_transport_subscribe_field_callback_set,shell,thiscall,inferred,ghidra-headless,3,Registers one field-subscription callback set on the session-event transport. When the transport is active byte [this+0x60] is set it stores the caller metadata at [this+0x176c] and [this+0x1770] then forwards the field-id list string callback and context into multiplayer_transport_register_field_subscription_bundle; on failure it falls back through multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump +0x0058d970,89,multiplayer_transport_subscribe_field_callback_set,shell,thiscall,inferred,ghidra-headless,3,"Registers one field-subscription callback set on the session-event transport. When active byte `[this+0x60]` is set it stores the caller callback pair into `[this+0x176c]` and `[this+0x1770]`, then forwards the field-id list string plus callback and context into `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`; on failure it falls back through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`. Current evidence now makes this the closest explicit lifecycle owner for the replay-band fields immediately below the still-unrecovered sidecar pointer at `[this+0x1778]`.","ghidra + rizin + llvm-objdump + local disassembly + field-subscription correlation" 0x0058d9e0,55,multiplayer_transport_send_selector_text,shell,thiscall,inferred,ghidra-headless,3,Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101].,ghidra + rizin + llvm-objdump 0x0058da60,75,multiplayer_transport_register_selector_callback,shell,thiscall,inferred,ghidra-headless,3,Registers or dispatches one selector callback against the transport slot table rooted at [this+0x390]. When the selected slot is absent it directly invokes the supplied callback with mode -1 and null payloads; otherwise it packages the caller context on the stack and walks the registered slot through 0x00594ac0 using helper 0x0058da20.,ghidra + rizin + llvm-objdump 0x0058db00,23,multiplayer_transport_request_status_pump,shell,thiscall,inferred,ghidra-headless,3,Marks the session-event transport status path dirty by setting [this+0xb44] to 1 and then calling multiplayer_transport_service_status_pump when the transport is active.,ghidra + rizin + llvm-objdump @@ -761,9 +789,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0058dc30,22,multiplayer_transport_is_route_mode_active_nonterminal,shell,cdecl,inferred,ghidra-headless,3,Tiny predicate over the route-mode field at [this+0x18b8]. It returns false when the mode is zero or terminal mode `5` and true for the other active route modes. Current grounded callers use it to decide whether route callbacks can run inline or whether route work must be re-enqueued.,ghidra + rizin + llvm-objdump 0x0058de90,95,multiplayer_transport_shutdown,shell,thiscall,inferred,ghidra-headless,3,Shuts down the session-event transport object and either marks deferred-close state or tears the object down immediately. It preserves [this+0x178c] across the common shutdown helper at 0x0058de50 disconnects active routes through multiplayer_transport_disconnect and when no outstanding work remains drops into the reset path at 0x0058d8a0; otherwise it latches deferred-close flag [this+0x1ee0].,ghidra + rizin + llvm-objdump 0x0058def0,40,multiplayer_transport_flush_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Flushes the transport state through 0x0058d8d0 with selector -1 and when deferred-close flag [this+0x1ee0] is set and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump -0x0058df20,131,multiplayer_transport_submit_text_record,shell,thiscall,inferred,ghidra-headless,3,Submits one prepared text record through the session-event transport using a caller-supplied callback wrapper. The helper allocates a transient transport record through multiplayer_transport_next_work_sequence sends it through multiplayer_transport_try_submit_text_record_fastpath and when that fast path declines packages the caller callback mode and payload into 0x00593170. When the caller requested immediate draining it also services the transport queue through 0x0058d8d0 and 0x0058d720 and may fall into multiplayer_transport_shutdown when deferred close is armed.,ghidra + rizin + llvm-objdump +0x0058d720,35,multiplayer_transport_context_id_is_absent_from_queued_and_active_collections,shell,cdecl,inferred,objdump + caller inspection,2,"Small immediate-drain quiescence gate for one transport context id carried in `ESI`. It first checks the transient work-record collection at `[transport+0x1780]` through `multiplayer_transport_queued_work_collection_lacks_context_id` `0x593400`, then checks the active opcode-record collection at `[transport+0x17fc]` through `multiplayer_transport_active_opcode_record_collection_lacks_context_id` `0x592970`, and returns success only when both collections lack that same id. Current grounded callers are the immediate-drain tails in `multiplayer_transport_submit_text_record` `0x58df20`, the neighboring formatted selector-text publish root at `0x58dfb0`, and `multiplayer_transport_register_callback_table` `0x58e200`.","objdump + caller inspection + immediate-drain correlation + collection-quiescence correlation" +0x0058df20,131,multiplayer_transport_submit_text_record,shell,thiscall,inferred,ghidra-headless,3,"Submits one prepared text record through the session-event transport using a caller-supplied callback wrapper. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`, then tries the text fastpath through `multiplayer_transport_try_submit_text_record_fastpath` `0x593d60`; when that fast path declines it packages the caller callback mode and payload into `0x593170` together with the same context id. When the caller requested immediate draining it services the transport queue through `0x58d8d0` and waits in `0x58d720` until that same id disappears from both queued work field `+0x0c` and active opcode-record field `+0x14`, then may fall into `multiplayer_transport_shutdown` when deferred close is armed.","ghidra + rizin + llvm-objdump" 0x0058e100,230,multiplayer_transport_publish_fixed_token_message,shell,thiscall,inferred,ghidra-headless,3,Publishes one fixed-token status message through selector `2` on the session-event transport. The helper requires the transport to be active and fully configured builds a formatted status line from the caller token plus internal fields such as [this+0x282] and [this+0x54] sends that line through multiplayer_transport_send_selector_text sets [this+0xb44] to 1 reruns the status pump and when appropriate nudges the downstream mode helper at 0x00595650 or the auxiliary object paths 0x00597350 and 0x00597370.,ghidra + rizin + llvm-objdump + strings -0x0058e200,211,multiplayer_transport_register_callback_table,shell,thiscall,inferred,ghidra-headless,3,Registers or refreshes the session-event transport callback table and descriptor block. When the transport is not yet fully configured it copies the local name into [this+0x04] stores the callback-table pointers at [this+0x4c] and [this+0x5c] sets [this+0x44] active and forwards the descriptor block plus caller metadata into multiplayer_transport_attach_callback_table_descriptor. It then routes the resolved table through multiplayer_transport_dispatch_callback_table_binding and optionally drains queued work through 0x0058d8d0 and 0x0058d720 before honoring deferred-close state.,ghidra + rizin + llvm-objdump +0x0058e200,211,multiplayer_transport_register_callback_table,shell,thiscall,inferred,ghidra-headless,3,"Registers or refreshes the session-event transport callback table and descriptor block. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`. When the transport is not yet fully configured it copies the local name into `[this+0x04]`, stores the callback-table pointers at `[this+0x4c]` and `[this+0x5c]`, sets `[this+0x44]` active, and forwards the descriptor block plus caller metadata into `multiplayer_transport_attach_callback_table_descriptor` `0x593650` with that same context id. It then routes the resolved table through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40`, and when immediate draining is requested it pumps `0x58d8d0` until `0x58d720` confirms that same id has disappeared from both the queued work and active opcode collections before honoring deferred-close state.","ghidra + rizin + llvm-objdump" 0x0058e2e0,38,multiplayer_transport_reset_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Resets the common transport state through 0x0058de50 and when deferred-close flag [this+0x1ee0] is armed and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump 0x0058e370,33,multiplayer_transport_is_request_pending,shell,cdecl,inferred,ghidra-headless,3,Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms.,ghidra + rizin + llvm-objdump 0x0058e3f0,137,multiplayer_transport_drain_request_text_queue,shell,cdecl,inferred,ghidra-headless,3,Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470.,ghidra + rizin + llvm-objdump + strings @@ -787,11 +816,63 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0058f3c0,43,tracked_heap_free_with_header,support,cdecl,inferred,ghidra-headless,4,Releases one heap block previously returned by tracked_heap_alloc_with_header. It reads the stored payload size from the 4-byte header decrements the shared allocation counters at 0x00dba4c8 and 0x00dba4cc and frees the underlying base pointer through 0x005a1145.,rizin + llvm-objdump 0x0058f3f0,94,tracked_heap_resize_with_header,support,cdecl,inferred,ghidra-headless,4,Resizes one header-tracked heap block to a new payload size. Null plus nonzero size falls through to tracked_heap_alloc_with_header; nonnull plus zero size frees through tracked_heap_free_with_header; and the main path reallocates through 0x005a5922 while preserving and re-accounting the payload size tracked in the 4-byte header.,rizin + llvm-objdump 0x0058f460,8,system_sleep_milliseconds,support,cdecl,inferred,ghidra-headless,4,Tiny wrapper over `Sleep` that forwards the caller millisecond delay in `ecx`. Current grounded callers use it as the 10 ms backoff inside immediate transport-drain loops.,rizin + llvm-objdump +0x0058fb10,24,memory_query_bounded_nul_terminated_byte_span_length,support,cdecl,inferred,objdump,3,"Scans one caller-supplied byte span for the first NUL terminator and returns the terminating length in bytes. The helper walks forward from the caller base pointer in `ecx` until it either finds a zero byte and returns the consumed count, or exhausts the caller byte budget in `edx` and returns `-1`. Current grounded callers use it as the bounded string-length primitive under compact descriptor tail validation and decode helpers such as `0x58fe50`, `0x58fe90`, and `0x58ff60`.","objdump + caller inspection + bounded-string correlation" +0x0058fe20,44,multiplayer_gamespy_server_descriptor_query_minimum_fixed_compact_header_byte_count,shell,cdecl,inferred,objdump,3,"Computes the minimum fixed byte count required by one compact descriptor header before any variable-length property or string tails are considered. The helper starts from `5` bytes for the source header byte plus the always-present primary IPv4 dword, then adds `4` when header bit `0x02` carries a secondary IPv4 dword, adds `4` when bit `0x08` carries the auxiliary inline dword stored at `[descriptor+0x10]`, adds `2` when bit `0x10` carries an inline primary port word, and adds `2` when bit `0x20` carries an inline secondary port word. Current grounded caller `0x5907d0` uses this as the first fixed-shape precheck above the heavier compact payload validators `0x58fe90` and `0x58fe50`.","objdump + caller inspection + compact-header correlation" +0x0058fe50,56,multiplayer_gamespy_server_descriptor_validate_signed_string_pair_tail_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length trailing tail used when the compact descriptor source header carries signed bit `0x80`. The helper repeatedly scans one bounded NUL-terminated string through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`, advances twice per loop to cover an alternating string pair, and only succeeds when the remaining byte budget ends on one final empty-string terminator. Current grounded caller `0x5907d0` uses this as the signed-tail shape precheck above the heavier decode path `0x58ff60`.","objdump + caller inspection + compact-header correlation + bounded-string correlation" +0x0058fe90,135,multiplayer_gamespy_server_descriptor_validate_inline_keyed_property_vector_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length inline keyed-property vector used when compact descriptor source header bit `0x40` is present. It walks the owner descriptor schema at `[owner+0x08]` through `0x59e110/0x59e120` and checks that the caller payload can supply each declared property item in sequence: one-byte entries for descriptor type `1`, two-byte entries for descriptor type `2`, and either one-byte dictionary selectors or bounded inline strings prefixed by `0xff` for descriptor type `0`, with the inline string lengths verified through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`. Current grounded caller `0x5907d0` uses this as the `0x40`-vector shape precheck before `0x58ff60` decodes the same property vector into the descriptor store.","objdump + caller inspection + compact-header correlation + bounded-string correlation" +0x0058ff20,52,multiplayer_gamespy_server_descriptor_preparse_compact_primary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Pre-parses the compact descriptor payload just far enough to recover the primary endpoint key used by the keyed-upsert decode lane. When the payload is at least `5` bytes long it reads the header byte at offset `0`, always copies the primary IPv4 dword from payload offset `+1` into one caller out slot, and then either copies the inline primary port word from payload offset `+5` when header bit `0x10` is present or falls back to the owner-side default port at `[caller+0x498]` when that bit is clear. Current grounded callers are the larger compact decode owners `0x5907d0` and `0x590d00`. This is the strongest current proof that compact descriptors always carry the primary IPv4 dword and that header bit `0x10` only gates the inline primary port word.","objdump + caller inspection + compact-header correlation" +0x00590140,78,multiplayer_gamespy_server_descriptor_compare_numeric_property_or_special_scalar,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries that key on both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0` with zero fallback, subtracts the two integer-like results, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `0`.","objdump + caller inspection + descriptor-sort correlation" +0x00590190,138,multiplayer_gamespy_server_descriptor_compare_double_parsed_property,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on double-parsed property values. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `0x58d1a0` with `0.0` fallback, compares the resulting doubles against zero, and returns `-1/0/1` with optional sign inversion driven by the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `1`.","objdump + caller inspection + descriptor-sort correlation" +0x00590220,130,multiplayer_gamespy_server_descriptor_compare_string_property_lexicographically_inline,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on string properties. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares the two strings bytewise inlined, and optionally flips the result through the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `2`.","objdump + caller inspection + descriptor-sort correlation" +0x005902b0,88,multiplayer_gamespy_server_descriptor_compare_string_property_via_crt_compare,shell,cdecl,inferred,objdump,3,"Alternate string-property comparator for descriptor-collection sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares them through the CRT string-compare helper at `0x5a57cf`, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator modes above `2`.","objdump + caller inspection + descriptor-sort correlation" +0x00590310,76,multiplayer_gamespy_server_descriptor_collection_sort_by_property_mode,shell,cdecl,inferred,objdump,3,"Sorts one compact-descriptor collection by a caller-selected property comparator mode. The helper stores the chosen property-key pointer into global scratch slot `0x00db8c6c+0x488`, stores the reverse-sort latch into `0x00db8c6c+0x48c`, picks one comparator callback from `0x590140`, `0x590190`, `0x590220`, or `0x5902b0` according to the caller mode, and then sorts the backing vector at `[this+0x04]` through `generic_vector_sort` `0x59e170`. Current grounded caller `0x595f70` uses mode `1` with key `gsi_am_rating` before selecting the head descriptor from the primary-endpoint table.","objdump + caller inspection + descriptor-sort correlation + caller correlation" +0x00590370,45,multiplayer_gamespy_server_descriptor_collection_append_and_notify_owner,shell,cdecl,inferred,objdump,3,"Appends one descriptor pointer into the caller collection and immediately notifies the route-callback-table owner. It inserts the descriptor into the backing vector at `[this+0x04]` through `0x59e4d0`, then invokes the owner callback at `[this+0x480]` with mode `0`, passing the appended descriptor plus cookie `[this+0x484]`. Current grounded callers are the compact append paths `0x5907d0`, `0x590d00`, and the raw primary-endpoint seed path `0x590dc0`. This is now the clearest generic append-notify owner-callback lane for route-callback tables, and the capacity-descriptor owner `0x595bc0` uses that same mode-`0` branch for its populated live publish path.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + capacity-owner-mode correlation" +0x005903a0,97,multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Searches one descriptor collection for an entry whose compact primary endpoint key matches the caller tuple. It walks the backing collection at `[this+0x04]`, compares each candidate descriptor's raw primary IPv4 dword through `0x58d1f0`, and then compares its raw primary port word through `0x58d210`. It returns the matching collection index or `-1` when no descriptor carries that same primary endpoint pair. This is the current strongest proof that descriptor fields `[0x00]` and `[0x04]` form the compact identity key for the server or route descriptor family.","objdump + caller inspection + descriptor-key correlation" +0x00590410,24,multiplayer_transport_route_callback_table_stage_descriptor_on_intrusive_list,shell,cdecl,inferred,objdump,2,"Prepends one descriptor pointer onto the route-callback table's staged intrusive list headed at `[this+0x5bc]`. It writes the prior head into descriptor field `+0x20` through `multiplayer_gamespy_server_descriptor_store_intrusive_next_link` `0x58d260`, then replaces `[this+0x5bc]` with the staged descriptor. Current grounded callers are the generic remove-notify lane `0x590430` and the active-collection release pass `0x5904d0`.","objdump + caller inspection + intrusive-list correlation" +0x00590430,57,multiplayer_gamespy_server_descriptor_collection_remove_index_notify_owner_and_stage_intrusive_link,shell,cdecl,inferred,objdump,3,"Removes one descriptor pointer from the caller collection by index, notifies the route-callback-table owner, and stages the removed descriptor onto the intrusive list head at `[this+0x5bc]`. It resolves the indexed descriptor through `0x59e120`, publishes owner callback mode `2` with that descriptor plus cookie `[this+0x484]`, erases the vector slot through `0x59e3d0`, and then prepends the removed descriptor onto the intrusive list through `0x590410`. Current grounded caller is the `gsi_am_rating` maintenance lane `0x595f70` when a descriptor fails the openstaging capacity gate. This is now the clearest generic remove-notify-and-stage owner-callback lane for route-callback tables, distinct from the append-notify mode-`0` path at `0x590370`.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + generic-mode-split correlation" +0x00590470,8,multiplayer_gamespy_server_descriptor_collection_count,shell,cdecl,inferred,objdump,2,"Returns the live descriptor count in the caller collection by forwarding `[this+0x04]` into `generic_vector_count` `0x59e110`. Current grounded callers include the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation" +0x00590480,11,multiplayer_gamespy_server_descriptor_collection_get_nth,shell,cdecl,inferred,objdump,2,"Returns the descriptor pointer stored at one zero-based collection index by forwarding the caller index into `generic_vector_get_nth` `0x59e120` on `[this+0x04]`. Current grounded callers include the keyed upsert path `0x590d00` and the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation" +0x00590490,55,multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list,shell,cdecl,inferred,objdump,3,"Releases the staged intrusive descriptor list headed at `[this+0x5bc]` for one route-callback table. It repeatedly reads the next-link through `multiplayer_gamespy_server_descriptor_query_intrusive_next_link` `0x58d270`, destroys the current staged descriptor through `0x58d0d0`, and advances the head until the intrusive list is empty. Current grounded callers are the broader active-collection teardown `0x5904d0` and the recurring table service helper `0x591290`, which now uses this to clear staged removals before the next state-driven service pass.","objdump + caller inspection + intrusive-list correlation + descriptor-destroy correlation" +0x005904d0,59,multiplayer_transport_route_callback_table_release_active_descriptor_collection,shell,cdecl,inferred,objdump,3,"Releases the active descriptor vector rooted at `[this+0x04]` for one route-callback table. It walks every live descriptor, stages each one onto the intrusive head at `[this+0x5bc]` through `0x590410`, clears the backing vector through `0x59e4b0`, and then destroys the staged intrusive list through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`. Current grounded callers are the broader runtime destroy helper `0x5907a0` and `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`, which uses it to drop prior active descriptors before rebuilding the field-subscription table.","objdump + caller inspection + descriptor-collection correlation + intrusive-list correlation + field-subscription correlation" +0x0058d680,14,multiplayer_gamespy_server_descriptor_matches_special_global_record,shell,cdecl,inferred,objdump,2,Returns 1 only when the caller descriptor pointer is exactly the special global descriptor stored at `0x00db8b4c`. Current grounded compact-descriptor owners use this as a hard reject before insertion so the shared global record does not get appended into normal descriptor collections.,objdump + caller inspection +0x005907d0,222,multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_new,shell,cdecl,inferred,objdump,3,"Decodes and appends one compact descriptor payload into the caller collection when the payload is self-consistent and not one special global descriptor. It first validates the payload length against the compact-header precheck helpers at `0x58fe20`, `0x58fe90`, and `0x58fe50`, then parses the header shape through `0x58ff20`, allocates one fresh descriptor through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680`, decodes the header and property payload through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `1`, and finally inserts the surviving descriptor through `0x590370`. Unlike the keyed upsert lane at `0x590d00`, this path always allocates a fresh descriptor after the precheck succeeds.","objdump + caller inspection + compact-descriptor correlation" +0x00590540,95,multiplayer_route_callback_runtime_acquire_shared_string_copy,shell,cdecl,inferred,objdump,3,"Acquires one refcounted shared string copy for the route-callback-table runtime. It lazily initializes the global shared-string pool through `0x58d6a0`, probes that pool by exact string through `0x58f9c0`, increments the stored refcount and returns the pooled string pointer on hit, and otherwise duplicates the caller string through `0x58f4a0` and inserts a new `{string, refcount=1}` pair through `0x58f920`. Current grounded callers are the route-callback receive/decode state machine `0x5908c0`, which uses this helper while materializing schema-owned dictionary strings.","objdump + caller inspection + shared-string-pool correlation" +0x005905a0,58,multiplayer_route_callback_runtime_release_shared_string_copy,shell,cdecl,inferred,objdump,3,"Releases one refcounted shared string copy from the route-callback-table runtime. It probes the global shared-string pool through `0x58d6a0/0x58f9c0`, decrements the stored refcount on hit, and removes the backing entry through `0x58f970` once the refcount reaches zero. Current grounded callers are the runtime teardown helpers `0x5906f0` and `0x5906c1` beneath the route-callback-table family.","objdump + caller inspection + shared-string-pool correlation" +0x005905e0,194,multiplayer_transport_route_callback_table_construct,shell,cdecl,inferred,objdump,3,"Constructs one transport-owned route callback table runtime. The helper seeds table state to `1`, clears the intrusive-head slot at `[this+0x5bc]`, copies three caller strings into local buffers `[this+0x0c]`, `[this+0x2c]`, and `[this+0x4c]`, stores the owner callback and cookie at `[this+0x480]/[this+0x484]`, seeds default strings at `[this+0x488]` and `[this+0x49c]`, zeroes staged companion fields `[this+0x490]/[this+0x494]`, resets live socket and receive-buffer state at `[this+0x4a0]`, `[this+0x74]`, and `[this+0x78]`, stores the caller schema or descriptor owner pointer at `[this+0x4a8]`, and initializes the decoded schema dictionary lanes rooted at `[this+0x08]` and `[this+0x478/0x47c]`. Current grounded callers are the callback-table initialization paths under `0x590ed0` and the larger transport table bring-up family.","objdump + caller inspection + route-callback-table correlation" +0x005906b0,53,multiplayer_transport_route_callback_table_release_schema_shared_string_slots,shell,cdecl,inferred,objdump,3,"Releases the table-local shared schema-string slot array rooted at `[this+0x7c]` with live count `[this+0x478]`. It walks each stored shared-string pointer through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0` and then clears the live count back to zero. Current grounded callers are the broader live-route reset helper `0x590740` and the decode-side teardown paths that abandon schema materialization midstream.","objdump + local disassembly + caller inspection + shared-string-slot correlation" +0x005906f0,68,multiplayer_transport_route_callback_table_release_decoded_schema_dictionary,shell,cdecl,inferred,objdump,3,"Releases the decoded schema-dictionary runtime rooted at `[this+0x08]` for one route callback table. It walks every stored shared-string pointer through the collection at `[this+0x08]`, releases each one through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0`, destroys the backing collection through `0x59e330`, and clears the owner slot afterward. Current grounded callers are the larger route-callback receive/decode and teardown paths.","objdump + caller inspection + route-callback-table correlation" +0x00590740,84,multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime,shell,cdecl,inferred,objdump,3,"Resets the live route and decode-side runtime for one route-callback table without destroying the outer table object. It frees the staged receive buffer at `[this+0x74]`, closes the live route handle at `[this+0x4a0]` when present, restores table state to sentinel `1`, releases the decoded schema dictionary through `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary` `0x5906f0`, resets schema companion field `[this+0x47c]` to `-1`, and releases the table-local shared schema-string slots through `multiplayer_transport_route_callback_table_release_schema_shared_string_slots` `0x5906b0`. Current grounded callers are the disconnect-publication helper `0x590ea0`, the one-shot resend wrapper `0x5912c0`, and the broader destroy path `0x5907a0`.","objdump + local disassembly + caller inspection + route-callback-table correlation" +0x005907a0,43,multiplayer_transport_route_callback_table_destroy_runtime_and_release_descriptor_collection,shell,cdecl,inferred,objdump,3,"Destroys the full route-callback-table runtime. It first resets the live route and decode-side state through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, then releases the active descriptor collection through `0x5904d0`, performs one remaining shared multiplayer cleanup call through `0x58d0a0`, destroys the backing descriptor vector at `[this+0x04]` through `0x59e330` when present, and clears that owner slot afterward. Current grounded callers are the larger transport teardown lanes and the auxiliary capacity-descriptor cache cleanup family.","objdump + local disassembly + caller inspection + route-callback-table correlation + descriptor-collection correlation" +0x005908c0,804,multiplayer_transport_route_callback_table_service_receive_decode_state_machine,shell,cdecl,inferred,objdump,3,"Services the live receive/decode state machine for one transport-owned route callback table using staged buffer `[this+0x74]/[this+0x78]` and state dword `[this+0x5b8]`. The current bounded model is: state `0` validates the leading route companion header, stores the first dword into `[this+0x490]`, stores the first word or sentinel into `[this+0x498]`, can publish owner callbacks in modes `6` and `5`, and either enters a terminal route-mode branch or continues into schema decode; states `1..3` build the table-owned descriptor schema and shared-string dictionaries under `[this+0x08]` and `[this+0x7c..]` through `0x59e0b0`, `0x590540`, and `0x59e4d0`; and state `4` repeatedly hands the remaining compact payload stream to `multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_new` `0x5907d0` until the staged receive buffer is exhausted. Decode failures return `5`, while successful progress updates the staged-buffer pointers and leaves the remaining byte count back in `[this+0x78]`. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` in table states `2/3`.","objdump + caller inspection + route-callback-table correlation + compact-descriptor correlation" +0x00590ea0,34,multiplayer_transport_route_callback_table_publish_disconnect_and_reset,shell,cdecl,inferred,objdump,3,"Publishes one route-callback-table disconnect event and then tears the live route side down. It invokes the owner callback at `[this+0x480]` in mode `4`, passing the special global descriptor at `0x00db8b4c` plus cookie `[this+0x484]`, and then tails into the broader table reset helper `0x590740`. Current grounded callers are the state-`2/3` receive-service helper `0x5911e0`, the connect-or-send wrapper `0x5912c0`, and failure paths beneath the route-table open helper `0x590ed0`.","objdump + caller inspection + route-callback-table correlation + owner-callback correlation" +0x00590ed0,531,multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state,shell,cdecl,inferred,objdump,3,"Opens or reopens the live route side for one transport-owned callback table. The helper validates the caller-supplied route-name strings, resets temporary builder state, seeds a small descriptor schema block in stack scratch, copies the chosen route labels into the table-local buffers `[this+0x0c]` and `[this+0x2c]`, stages one outbound request payload into the local send buffer rooted at `[this+0x6c]`, opens the live route handle into `[this+0x4a0]` through `0x5b3216`, and on success sets table state to `3`, clears decode-substate `[this+0x5b8]`, allocates the initial receive buffer at `[this+0x74]` when needed, and zeroes the staged receive count `[this+0x78]`. Failure paths return `3`, `5`, or `6` and can tear the live route side back down through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded callers are the reconnect wrapper `0x5912c0`, the direct `gsi_am_rating` upsert path `0x591330`, and the larger transport-owned route bring-up paths around `0x5964e1` and `0x59655f`.","objdump + caller inspection + route-callback-table correlation + live-route-handle correlation + caller correlation" +0x005911e0,332,multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine,shell,cdecl,inferred,objdump,3,"Services one open route-callback-table socket in states `2/3`. It polls the live route handle at `[this+0x4a0]`, reads newly available bytes into the staged receive buffer `[this+0x74]/[this+0x78]` through `0x5b321c`, grows that backing buffer through `0x59e750` when the staged byte count would overflow the current capacity, enters the heavier decode state machine `0x5908c0` once the table is in state `3`, compacts any unconsumed tail back to the start of the buffer, and tears the route side down through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0` on closure or decode failure. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` for table states `2/3`.","objdump + caller inspection + route-callback-table correlation + staged-buffer correlation" +0x00590dc0,155,multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list,shell,cdecl,inferred,objdump,3,"Rebuilds the transport-owned primary-endpoint table from the raw endpoint list exposed by the live route handle at `[this+0x4a0]`. It first probes list availability through `0x58f4e0`, then repeatedly reads one endpoint tuple through `0x58bc7e` record type `0x1f3`, skips tuples already present in the table through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`, allocates fresh descriptor records through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects one special global descriptor through `0x58d680`, then stamps descriptor flag byte `[entry+0x15]` with `0x11` and inserts the surviving record into the table through `0x590370`. That makes this the strongest current source-side writer for header bit `0x1`, and it also ties bit `0x10` to the same source-header family later decoded as the inline primary-port-present branch in `0x58ff20/0x58ff60`. Current grounded caller is the recurring table service helper `0x591290` when the table sits in state `0`.","objdump + local disassembly + caller inspection + endpoint-table correlation + header-flag correlation + compact-header correlation" +0x0058ff60,432,multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload,shell,cdecl,inferred,objdump,3,"Decodes one compact server-descriptor header and trailing property payload into the caller descriptor record. The helper copies the source header byte into descriptor flag byte `[entry+0x15]` through `0x58d630`, then conditionally consumes endpoint and scalar fields according to header bits `0x02`, `0x08`, `0x10`, `0x20`, `0x40`, and signed bit `0x80`. Current grounded split is tighter now: the primary IPv4 dword is always present immediately after the header byte; bit `0x10` only marks the inline primary port word branch, otherwise the helper falls back to the owner default port at `[caller+0x498]`; bit `0x02` supplies the secondary IPv4 dword; bit `0x20` supplies the paired secondary port word, otherwise the helper again falls back to the owner default port; bit `0x08` supplies one still-unresolved auxiliary dword through `[entry+0x10]`; bit `0x40` enables one inline keyed-property vector decoded through `0x59e110/0x59e120` plus the property-store writers rooted at `0x58d0f0` and `0x58d130`, after which the helper ORs descriptor state byte `[entry+0x14]` with bit `0x1`; and signed bit `0x80` enables one trailing NUL-terminated string-pair tail decoded through repeated `0x58d0f0` stores, after which the helper ORs state byte `[entry+0x14]` with bit `0x2`. Current grounded callers are the larger compact decode paths at `0x5907d0` and `0x590d00`. This remains the strongest proof that byte-`0x15` bit `0x1` is a source-side descriptor header bit rather than a queue-generated flag.","objdump + caller inspection + compact-decode correlation + header-flag correlation + secondary-endpoint correlation + state-byte correlation" +0x00590d00,184,multiplayer_transport_decode_compact_descriptor_payload_upsert_by_primary_endpoint_and_notify_owner,shell,cdecl,inferred,objdump,3,"Decodes one compact descriptor payload into the transport-owned primary-endpoint family while reusing an existing descriptor when the compact primary endpoint key already exists. After one short header-shape precheck through `0x58ff20`, it looks up the descriptor by primary IPv4 and port through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`. If no match exists it allocates a fresh record through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680`, and later inserts the new descriptor through `0x590370`; otherwise it reuses the existing record through `0x590480`. It then decodes the compact header and property payload through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `0`, and finally notifies the owner callback at `[this+0x480]` in mode `1` with the updated descriptor plus cookie `[this+0x484]`.","objdump + caller inspection + compact-descriptor correlation + owner-callback correlation" +0x00591290,43,multiplayer_transport_service_route_callback_table_once,shell,cdecl,inferred,objdump,3,"Shared recurring service helper for one transport-owned route callback or descriptor table. It first clears the staged intrusive descriptor list at `[this+0x5bc]` through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`, then switches on table state dword `[this+0x00]`: state `0` seeds the primary-endpoint side through `multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list` `0x590dc0`; states `2` and `3` service the live receive path rooted at socket `[this+0x4a0]` by appending new bytes into the staging buffer at `[this+0x74]/[this+0x78]`, growing the backing buffer through `0x59e750` when needed, and invoking the heavier decode state machine `0x5908c0` once buffered data is available in state `3`; other states return immediately. Receive failure or closure tears the live route side down through `0x590ea0` and returns status `3`. Current grounded caller is `multiplayer_transport_service_route_callback_tables` `0x596210`, which uses this helper on the route tables at `[transport+0xba4]`, `[transport+0x1164]`, and `[transport+0x18bc]`.","objdump + caller inspection + route-table-service correlation + intrusive-list correlation" +0x005912c0,108,multiplayer_transport_route_callback_table_send_payload_with_one_reopen_retry,shell,cdecl,inferred,objdump,3,"Attempts one outbound send on the live route handle at `[this+0x4a0]` and performs at most one full reopen retry on failure. It forwards the caller payload pointer and byte count into `0x5b3216`; if that first send fails it resets the live route side through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, reopens the route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `2`, retries the same send once, and on persistent failure publishes disconnect plus reset through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded callers are the keyed primary-endpoint upsert lane `0x591330` and the direct route-send family under the callback-table transport block.","objdump + local disassembly + caller inspection + route-send correlation" +0x00591330,96,multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Upserts one compact descriptor record into the `gsi_am_rating` primary-endpoint table rooted at `[transport+0x18bc]`. When the table is still in sentinel state `1` it first reinitializes it through `0x590ed0` mode `2`; afterward it converts the caller host-order port through `0x58bc5a`, builds a 9-byte stack record with tag byte `1`, primary IPv4 dword, and primary port word, and forwards that record into `0x5912c0` for keyed insertion or replacement. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode` when descriptor flag byte `0x15` bit `0x1` is clear.","objdump + caller inspection + endpoint-table correlation" +0x005913f0,25,generic_callback_invoke_record2_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a two-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0], inner[1], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly" +0x00591410,85,generic_record_0x1c_deep_copy_with_owned_string_at_0x08,support,cdecl,inferred,objdump,2,"Deep-copies one `0x1c`-byte record whose fields are `u32` at `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` plus one owned string pointer at `+0x08`. It copies the scalar fields verbatim, duplicates the optional string through `0x58f4a0`, and returns failure only when the source string is nonnull and duplication fails. Current evidence now makes this one of the generic preservation helpers that can carry descriptor-adjacent payload fields such as a copied `+0x10` scalar without interpreting them.","objdump + local disassembly + preservation-path correlation" +0x00591480,45,generic_callback_invoke_record7_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a seven-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..6], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly" +0x005914b0,69,generic_record_0x14_deep_copy_with_owned_string_at_0x00,support,cdecl,inferred,objdump,2,"Deep-copies one `0x14`-byte record whose leading field `+0x00` is an owned string pointer and whose remaining fields at `+0x04/+0x08/+0x0c/+0x10` are copied verbatim. It duplicates the optional leading string through `0x58f4a0` and fails only when that duplication is required but returns null.","objdump + local disassembly" +0x00591510,37,generic_callback_invoke_record5_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a five-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..4], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly" +0x005927b0,77,multiplayer_transport_service_and_retire_nth_active_opcode_record,shell,cdecl,inferred,objdump,3,"Services one active opcode record by ordinal from the collection rooted at `[this+0x17fc]`. It marks the selected record busy at `+0x18`, increments in-flight counter `[this+0x1808]`, dispatches through the opcode-specific service callback table rooted at `0x005e200c`, then clears the busy flag, decrements `[this+0x1808]`, increments completed count `[this+0x1804]`, and removes the serviced record from the active collection through `0x59e3d0`.","objdump + local disassembly + opcode-table correlation + active-collection correlation" +0x00592800,147,multiplayer_transport_remove_active_opcode_records_by_context_or_idle,shell,cdecl,inferred,objdump,3,"Removes records from the active opcode-record collection rooted at `[this+0x17fc]`. With `EDX != -1` it scans for records whose dword field `+0x14` matches the requested context id or whose opcode type dword at `+0x00` is `0x17`, then retires them through `multiplayer_transport_service_and_retire_nth_active_opcode_record` `0x5927b0`. With `EDX == -1` it instead retires every non-busy record whose in-flight flag at `+0x18` is clear.","objdump + local disassembly + active-collection correlation + immediate-drain correlation" 0x005928a0,189,multiplayer_transport_enqueue_opcode_record,shell,cdecl,inferred,ghidra-headless,3,Common allocator and queue-submit helper for session-event transport opcode records. It allocates a zeroed caller-sized record through tracked_heap_alloc_with_header invokes the opcode-specific initializer from the handler table at 0x005e2004 plus opcode times 0x10 packages the resulting payload together with caller metadata into 0x0059e4d0 and increments [this+0x1800] on success. Allocation or initializer failure releases the temporary record through tracked_heap_free_with_header and returns -1.,ghidra + rizin + llvm-objdump -0x00592a40,40,multiplayer_transport_dispatch_callback_table_binding,shell,cdecl,inferred,ghidra-headless,2,Small binding-dispatch wrapper over multiplayer_transport_enqueue_opcode_record with opcode `4`. Current grounded callers use it after preparing callback-table descriptor fields from a live transport registration object and then continue through the common transport cleanup or release path.,ghidra + rizin + llvm-objdump -0x00592a70,109,multiplayer_transport_probe_or_enqueue_route_record,shell,cdecl,inferred,ghidra-headless,2,Small route-probe wrapper over multiplayer_transport_enqueue_opcode_record. It first calls multiplayer_transport_is_route_mode_active_nonterminal and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode `1` record built from the caller callback and payload fields.,ghidra + rizin + llvm-objdump -0x00592ae0,111,multiplayer_transport_enqueue_descriptor_block_record,shell,cdecl,inferred,ghidra-headless,2,Copies one caller-supplied seven-dword descriptor block into a local buffer and enqueues it through multiplayer_transport_enqueue_opcode_record as a 0x1c-byte opcode `2` record. Current grounded callers come from the deeper callback-table registration path.,ghidra + rizin + llvm-objdump -0x00592b50,226,multiplayer_transport_enqueue_field_snapshot_record,shell,cdecl,inferred,ghidra-headless,3,Builds and enqueues one field-snapshot transport record through multiplayer_transport_enqueue_opcode_record using opcode `3` and a 0x14-byte payload. Depending on the caller mode it can first remove prior matching entries through 0x005929f0 then normalizes the `hostname` field against `(No Name)` samples the `gamemode` field and compares it against `openstaging` computes a 0 to 100 progress scalar from counters around [this+0x1734] [this+0x1740] and [this+0x1774] and packages the subscribed callback pointers from [this+0x176c] and [this+0x1770].,ghidra + rizin + llvm-objdump + strings +0x005929a0,69,multiplayer_transport_remove_active_opcode_records_by_type,shell,cdecl,inferred,objdump,3,"Removes active opcode records of one requested type from the collection rooted at `[this+0x17fc]`. It walks the live records in reverse ordinal order, compares opcode dword `+0x00` against the requested type in `EBX`, and removes each match through `0x59e3d0`. Current grounded caller `multiplayer_transport_clear_progress_field_cache` `0x595b80` uses it with opcode type `3`, which corrects that helper as an active field-snapshot cleanup rather than a queued-work sweep.","objdump + local disassembly + caller inspection + active-collection correlation" +0x005929f0,78,multiplayer_transport_remove_active_field_snapshot_records_by_callback_pair,shell,cdecl,inferred,objdump,3,"Removes active field-snapshot opcode records keyed by one subscribed callback pair. It walks the active opcode-record collection at `[this+0x17fc]` in reverse ordinal order, filters for opcode type `3`, resolves the opcode payload pointer at record `+0x10`, and removes records whose payload dword `+0x04` matches the requested callback or context dword in `EBX`. Current grounded caller `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50` uses it before building a fresh opcode-`3` snapshot entry.","objdump + local disassembly + caller inspection + opcode-3 correlation + active-collection correlation" +0x00592970,41,multiplayer_transport_active_opcode_record_collection_lacks_context_id,shell,thiscall,inferred,objdump + caller inspection,2,"Predicate over the active opcode-record collection rooted at `[this+0x17fc]`. It performs a comparator-driven collection search through `0x59e420` using comparator `0x592960`, which orders records by dword field `+0x14`, and returns `1` only when no active opcode record carries the requested context id. Current grounded caller is the immediate-drain completion gate `0x58d720`, so current evidence now bounds active field `+0x14` specifically as the active-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + caller inspection + collection-search correlation + immediate-drain correlation" +0x00592a40,40,multiplayer_transport_dispatch_callback_table_binding,shell,cdecl,inferred,ghidra-headless,2,"Small deferred callback-table binding wrapper over `multiplayer_transport_enqueue_opcode_record` with opcode `4`. It packages the caller binding fields into the 0x08-byte opcode-`4` record builder at `0x592c40`; current grounded callback-table owners now show the staged work-record triplet more concretely as `(callback fn @ +0x10, callback companion @ +0x18, drain context id @ +0x0c)`, with the final dword still aligned to the shared `0x5934c0`-seeded immediate-drain context later waited on through `0x58d720`.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation" +0x00592a70,109,multiplayer_transport_probe_or_enqueue_route_record,shell,cdecl,inferred,ghidra-headless,2,"Small route-probe or deferred route-record wrapper over `multiplayer_transport_enqueue_opcode_record`. It first calls `multiplayer_transport_is_route_mode_active_nonterminal` and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode-`1` record built from the caller callback and payload fields. Current grounded callers now show the staged work-record triplet more concretely as `(callback fn @ +0x10, callback companion @ +0x18, drain context id @ +0x0c)` with extra route-mode control bytes layered on top, and the final dword again aligned to the shared `0x5934c0`-seeded drain context used by the deferred path.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation" +0x00592ae0,111,multiplayer_transport_enqueue_descriptor_block_record,shell,cdecl,inferred,objdump + local disassembly,3,"Copies one caller-supplied seven-dword descriptor-block payload into a local `0x1c` buffer and enqueues it through `multiplayer_transport_enqueue_opcode_record` `0x5928a0` as opcode `2`. The deeper opcode-`2` initializer family rooted at `0x591410/0x591470/0x591480` now bounds that payload more tightly: it stores dwords `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` verbatim and duplicates the optional string pointer at `+0x08` into owned heap storage. Current grounded callers are now broader than the earlier callback-registration-only note: the helper is also the enqueue tail beneath `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`, where live mode supplies a populated descriptor payload but replay modes `3/5` intentionally pass an all-zero seven-dword payload while reusing separate sidecar metadata slots from the cached work record.","objdump + local disassembly + opcode-record table correlation + descriptor-block initializer correlation + capacity-descriptor correlation" +0x00592b50,226,multiplayer_transport_enqueue_field_snapshot_record,shell,cdecl,inferred,ghidra-headless,3,"Builds and enqueues one field-snapshot transport record through `multiplayer_transport_enqueue_opcode_record` using opcode `3` and a `0x14`-byte payload. Depending on the caller mode it can first remove prior matching entries through `0x5929f0`, then normalizes the `hostname` field against `(No Name)`, samples the `gamemode` field and compares it against `openstaging`, computes one 0-to-100 progress percentage from cached progress slot `[this+0x1774]` plus counters `[this+0x1734]` and `[this+0x1740]` and the current active descriptor count under `[this+0xba4]`, and packages the subscribed callback pointers from `[this+0x176c]` and `[this+0x1770]`. Current grounded caller `0x596500` seeds `[this+0x1774]` to `1` immediately before the first mode-`3` snapshot under `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`.","ghidra + rizin + llvm-objdump + strings + local disassembly + caller inspection" +0x00593330,57,multiplayer_transport_construct_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,3,"Constructs the transient transport work-record collection at `[this+0x1780]`. It clears counters `[this+0x1784]` and `[this+0x1788]`, allocates one vector-like owner through `0x59e0b0` using cleanup shim `0x5932f0`, stores the resulting collection root at `[this+0x1780]`, and returns success when that root is nonnull.","objdump + local disassembly + work-queue correlation" +0x00593370,16,multiplayer_transport_clear_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Thin clearer for the transient transport work-record collection rooted at `[this+0x1780]`. When that collection exists it tailcalls the generic clear helper `0x59e4b0`; otherwise it returns immediately.","objdump + local disassembly + work-queue correlation" +0x00593380,30,multiplayer_transport_destroy_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the transient transport work-record collection rooted at `[this+0x1780]`. When the collection exists it destroys that vector owner through `0x59e330`, then clears `[this+0x1780]` to null.","objdump + local disassembly + work-queue correlation" +0x005933a0,83,multiplayer_transport_remove_queued_work_record_by_pointer,shell,thiscall,inferred,objdump + local disassembly,3,"Scans the transient transport work-record collection at `[this+0x1780]` for one exact record-pointer match and removes that vector slot through `generic_vector_remove_index` `0x59e3d0`. Successful removal also increments the released-or-completed work counter at `[this+0x1788]`. Current grounded callers include the callback-table binding result helper `0x593570`, route-binding release `0x595620`, and the names or bound-route or selector-text completion lanes when they drop stale or finished work records.","objdump + local disassembly + caller inspection + work-queue correlation" +0x00593400,90,multiplayer_transport_queued_work_collection_lacks_context_id,shell,thiscall,inferred,objdump + local disassembly,2,"Predicate over the same transient work-record collection at `[this+0x1780]`. It returns `1` when no queued work record carries the requested dword context id in field `+0x0c`, and returns `0` on the first match. Current grounded caller is the small transport gate at `0x58d720`, which uses this uniqueness test immediately before `0x592970`; that now bounds queued field `+0x0c` specifically as the queued-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + local disassembly + caller inspection + work-queue correlation + immediate-drain correlation" 0x00592c40,54,multiplayer_transport_enqueue_callback_binding_record,shell,cdecl,inferred,ghidra-headless,2,Builds and enqueues one 0x08-byte opcode `4` callback-binding record through multiplayer_transport_enqueue_opcode_record. The helper uses the registered callback-table pointer at [this+0x4c] and is the direct worker beneath multiplayer_transport_dispatch_callback_table_binding.,ghidra + rizin + llvm-objdump 0x00592c80,80,multiplayer_transport_enqueue_callback_slot9_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `9` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1790] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump 0x00592cd0,85,multiplayer_transport_enqueue_callback_slot10_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x14-byte opcode `10` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1794] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump @@ -804,23 +885,28 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00592f70,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs" 0x00592fc0,50,multiplayer_transport_enqueue_callback_slot20_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump" 0x00593000,69,multiplayer_transport_enqueue_callback_slot21_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump" -0x00593050,77,multiplayer_transport_enqueue_callback_slot22_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` marker pair or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple.","objdump + caller xrefs" +0x00593050,77,multiplayer_transport_enqueue_callback_slot22_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple.","objdump + caller xrefs" 0x005930a0,50,multiplayer_transport_enqueue_callback_slot23_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`.","objdump + caller xrefs" 0x005930e0,62,multiplayer_transport_enqueue_callback_slot24_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane.","objdump + caller xrefs" 0x00593120,72,multiplayer_transport_enqueue_callback_slot25_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs" +0x00593200,78,multiplayer_transport_enqueue_callback_slot28_record,shell,cdecl,inferred,objdump + local disassembly,2,"Gated callback-slot wrapper that enqueues one `0x10`-byte opcode `28` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are `multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28` `0x59fbd0` and its helper `0x596b90`.","objdump + local disassembly + caller inspection" 0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump -0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump +0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,"Gated callback-slot wrapper that enqueues one `0x08`-byte opcode `16` record through `multiplayer_transport_enqueue_opcode_record` when byte `[this+0x17ac]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded caller `0x59f440` forwards the staged route-callback payload handle from `[this+0xb50]` together with fixed text at `0x00db9dd8` through this lane just before `multiplayer_transport_set_route_mode` forces mode `5`, so slot `16` is no longer just an abstract callback-slot wrapper.","ghidra + rizin + llvm-objdump + caller inspection" 0x0059f2e0,64,multiplayer_transport_is_selector_control_line,shell,cdecl,inferred,objdump,2,"Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes.","objdump + caller xrefs + strings" 0x0059f320,131,multiplayer_transport_split_selector_payload_token_and_tail,shell,cdecl,inferred,objdump,2,"Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`.","objdump + caller xrefs + strings" 0x0059f5e0,111,multiplayer_transport_sync_selector_view_nfo_r_flag,shell,cdecl,inferred,objdump,3,"Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot.","objdump + caller xrefs + strings" 0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump +0x005934e0,130,multiplayer_transport_allocate_and_enqueue_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Allocates one zeroed `0x3c` transient transport work record and appends it into the work collection at `[this+0x1780]`. The helper stores the owner transport pointer at `+0x00`, caller-supplied type and metadata dwords at `+0x04`, `+0x08`, `+0x0c`, `+0x10`, and `+0x18`, clears bookkeeping field `+0x20` and stale latch `+0x38`, inserts the finished pointer through `generic_vector_push_back` `0x59e4d0`, and increments `[this+0x1784]` on success. Current grounded callers include callback-table descriptor attach, bound-route request submission, selector-text route request submission, and the type-`9` text fastpath. The wider caller set now proves one stronger boundary on the metadata triplet itself: these three dwords are shared transport wrapper metadata reused across type `0/1/2/9` work records, not one capacity-only or route-only cache tuple. Current direct consumers now bound that triplet more concretely as `drain context id @ +0x0c`, deferred callback function pointer @ `+0x10`, and callback companion or context @ `+0x18`; the callback-table lane still gives the cleanest concrete subcase because it intentionally duplicates the same caller metadata dword into both `+0x0c` and `+0x18` while preserving the callback pointer in `+0x10`.","objdump + local disassembly + caller inspection + work-queue correlation + metadata-triplet correlation + cross-type work-record correlation + callback-dispatch correlation" +0x00593570,160,multiplayer_transport_publish_callback_table_binding_result_and_release_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Consumes one transient callback-table attach work record. It resolves the owner transport from work field `+0x00`, conditionally downgrades a nominal success when the current live transport probe through `0x58d7e0/0x58d810` fails, stores the final boolean result into `[transport+0x48]`, and on the success branch also stamps tick field `[transport+0x50]` plus copies one callback-table label string into the local transport name buffer at `[transport+0x04]`. Both the success and failure tails then publish opcode-`4` callback-binding state through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40` using work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)`; the failure tail additionally arms deferred reset latch `[transport+0x1edc]`. The helper always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`.","objdump + local disassembly + caller inspection + callback-binding correlation + work-queue correlation + callback-triplet correlation" 0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings -0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump +0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Completion callback for `multiplayer_transport_submit_bound_route_request`. If the request is already stale at `+0x38` it just unlinks through `0x5933a0`. On nonzero result it can publish `[req+0x24]` through `multiplayer_transport_publish_mode_key_status_line` and then schedules `multiplayer_transport_handle_names_query_response` through `multiplayer_transport_submit_names_query_with_callback`. On zero result it resets selector slot `2` and falls back to `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-specific route-mode pair before unlinking the request.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation" 0x00594620,106,multiplayer_transport_reset_selector_view_entry_runtime_state,shell,cdecl,inferred,objdump,2,"Clears the extended runtime fields of one selector-view entry. When the transport-side selector-view layer is present through `[this+0xac8]` it zeroes the entry block from `+0x68` through `+0xa8`, including the dirty or refresh flags at `+0xa0`, `+0xa4`, and `+0xa8`, then returns success. Current grounded caller is the selector-view snapshot export path at `0x594ee0`.","objdump" 0x00594690,76,multiplayer_transport_mark_selector_slot_views_dirty,shell,cdecl,inferred,ghidra-headless,2,"Marks one selector slot dirty in the transport-side selector-view layer rooted at `[this+0xab4]` with backing arrays around `[this+0xad0]..[this+0xae4]`. It sets slot-specific dirty bits at `+0xa0` and `+0xa4` when the matching backing arrays are populated and also sets `+0xa8` for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry.","ghidra + rizin + llvm-objdump" 0x005949a0,80,multiplayer_transport_ensure_selector_view_store,shell,thiscall,inferred,objdump,3,"Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`.","objdump + caller xrefs" 0x005949f0,56,multiplayer_transport_release_selector_view_store,shell,thiscall,inferred,objdump,3,"Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`.","objdump + caller xrefs" +0x00594a30,11,multiplayer_transport_remove_selector_view_entry_from_store,shell,cdecl,inferred,objdump + local disassembly,3,"Tiny selector-view store remover. It tailcalls the keyed-container erase helper `0x58f970` against the selector-view store rooted at `[this+0xab4]` using the caller entry pointer in `edx`. Current grounded callers are `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0` and `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`.","objdump + local disassembly + caller inspection" 0x00594a40,80,multiplayer_transport_find_selector_view_entry_by_name,shell,cdecl,inferred,objdump,3,"Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers.","objdump + caller xrefs" +0x00594e30,52,multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match,shell,cdecl,inferred,objdump + local disassembly,3,"Counts selector-view entries in the keyed store rooted at `[this+0xab4]` whose per-slot flag dword at `[entry+0x5c+slot*4]` carries bit `0x20`. When the optional caller string is nonnull it first requires that string to match the entry's leading name field through `0x5a57cf`; otherwise it counts every entry that passes the same flag test. Current grounded callers are the staged route-callback submit-result handler `0x595860` and the later selector-view decision helper at `0x59f9c0`, where both use slot `2` and the current transport name buffer at `[this+0x04]`.","objdump + local disassembly + caller inspection + selector-view-store correlation" 0x00594d50,28,multiplayer_transport_selector_view_entry_slot_has_presence_mask,shell,cdecl,inferred,objdump,3,"Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector.","objdump + caller xrefs" 0x00594d70,21,multiplayer_transport_selector_view_entry_has_gml_disconnect_gate,shell,cdecl,inferred,objdump,3,"Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`.","objdump + caller xrefs + strings" 0x0059f5c0,20,multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23,shell,cdecl,inferred,objdump,2,"Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23.","objdump + caller xrefs" @@ -829,9 +915,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00594320,115,multiplayer_transport_collect_refreshable_selector_view_entries,shell,cdecl,inferred,objdump,3,"Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries.","objdump + caller xrefs" 0x005940d0,61,multiplayer_transport_finish_selector_view_refresh_probe_if_matching,shell,cdecl,inferred,objdump,3,"Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success.","objdump + caller xrefs" 0x00594110,48,multiplayer_transport_dispatch_selector_view_refresh_probe_result,shell,cdecl,inferred,objdump,3,"Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe.","objdump + caller xrefs" -0x00593f00,171,multiplayer_transport_commit_selector_view_refresh_probe_success,shell,cdecl,inferred,objdump,3,"Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned sample value into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes the averaged sample through multiplayer_transport_enqueue_callback_slot24_record.","objdump + caller xrefs" -0x00594b60,104,multiplayer_transport_arm_selector_view_probe_tracking,shell,cdecl,inferred,objdump,3,"Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed marker request id at `[entry+0x50]`, stores the parsed companion value at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`.","objdump + caller xrefs" -0x005943a0,231,multiplayer_transport_stage_selector_view_progress_snapshot,shell,cdecl,inferred,objdump,3,"Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, formats one `PNG %s %d` line around the selector-view sample string rooted at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`.","objdump + caller xrefs + strings" +0x00593f00,171,multiplayer_transport_commit_selector_view_refresh_probe_success,shell,cdecl,inferred,objdump,3,"Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned probe sample into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current averaged millisecond sample into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes that averaged `ms` value through multiplayer_transport_enqueue_callback_slot24_record.","objdump + caller xrefs" +0x00594b60,104,multiplayer_transport_arm_selector_view_probe_tracking,shell,cdecl,inferred,objdump,3,"Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed probe request id at `[entry+0x50]`, stores the parsed displayed version/build companion integer at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`.","objdump + caller xrefs" +0x005943a0,231,multiplayer_transport_stage_selector_view_progress_snapshot,shell,cdecl,inferred,objdump,3,"Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, rebuilds the local core `X%sX` probe marker from request id `[entry+0x50]` through multiplayer_transport_format_selector_view_probe_marker_core, formats one `PNG %s %d` line around that marker and the averaged millisecond sample at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. Current evidence still does not show the wider `|%d` companion suffix being emitted on this path.","objdump + caller xrefs + strings + marker-format correlation" 0x00594490,83,multiplayer_transport_pick_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot.","objdump + caller xrefs" 0x005944f0,69,multiplayer_transport_select_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle.","objdump + caller xrefs" 0x00594540,214,multiplayer_transport_service_selector_view_refresh_cycle,shell,thiscall,inferred,objdump,3,"Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`.","objdump + caller xrefs" @@ -844,6 +930,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00594cb0,65,multiplayer_transport_merge_selector_mode_mask,shell,cdecl,inferred,ghidra-headless,3,Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump + strings 0x00594d00,72,multiplayer_transport_set_selector_presence_mask,shell,cdecl,inferred,ghidra-headless,3,Overwrites the selector presence bits 0x20 and 0x40 in [entry+0x5c] from one caller byte mask while preserving the rest of the selector-slot flags. The helper then commits the new value through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump 0x00594f20,142,multiplayer_transport_upsert_selector_name_entry,shell,cdecl,inferred,ghidra-headless,3,Looks up or creates one selector-name entry for the requested selector slot. It resolves the current slot entry through 0x594a40 allocates a new entry through 0x594e70 when no match exists marks the selector index active at [entry+0x40+slot*4] increments the per-slot generation counter at [this+0xab8+slot*4] applies the caller flag bits 0x20 and 0x40 into [entry+0x5c+slot*4] and then marks the slot views dirty through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers come from multiplayer_transport_handle_names_query_response and multiplayer_transport_handle_selector_update_response.,ghidra + rizin + llvm-objdump +0x00594fb0,93,multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty,shell,cdecl,inferred,objdump + local disassembly,3,"Resolves one selector-view entry by name, clears the requested selector-slot ownership pointer at `[entry+0x40+slot*4]`, decrements the paired generation counter at `[this+0xab8+slot*4]`, clears the corresponding slot-flag dword at `[entry+0x5c+slot*4]`, and refreshes selector-view side effects through `0x594790`. When all three slot ownership pointers at `[entry+0x40]`, `[entry+0x44]`, and `[entry+0x48]` are then null it removes the whole keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30` before notifying `0x596900`. Current grounded callers are the later selector-view callback root at `0x59f9c0` and the keyed store-walk helper at `0x5950a0`.","objdump + local disassembly + caller inspection" +0x00595010,102,multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime,shell,cdecl,inferred,objdump + local disassembly,3,"Rekeys one selector-view entry under a new bounded name while preserving its slot-local runtime block. It resolves the old entry by name, copies the `0x1b`-dword runtime band rooted at `[entry+0x40]` into stack scratch, removes the old keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30`, allocates or resolves the replacement entry through `0x594e70`, restores the copied runtime band into `[new_entry+0x40]`, and then refreshes the surrounding selector-name side through `0x596c10`. Current grounded caller is the adjacent selector callback root at `0x59fab0`.","objdump + local disassembly + caller inspection" +0x005950a0,36,multiplayer_transport_clear_selector_view_slot_from_all_entries,shell,cdecl,inferred,objdump + local disassembly,3,"Walks the keyed selector-view store at `[this+0xab4]` and clears one selector slot from every entry that still owns it. The local store-walk callback `0x595080` checks `[entry+0x40+slot*4]` and, when present, forwards into `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`. Current grounded callers are `multiplayer_transport_reset_selector_slot` `0x5954b0` and the later callback root `0x59fb60`.","objdump + local disassembly + caller inspection" 0x005950d0,101,multiplayer_transport_reset_selector_tables,shell,cdecl,inferred,ghidra-headless,4,Resets the three selector registration tables rooted at [this+0x80] [this+0x390] and [this+0x39c] together with state at [this+0x9a8] and [this+0x9ac]. When [this+0xab0] is set it preserves selector slot `0`; otherwise it clears all three selector slots.,ghidra + rizin + llvm-objdump 0x00595140,89,multiplayer_transport_set_selector_name,shell,cdecl,inferred,ghidra-headless,4,Copies one selector name into the fixed 0x101-byte selector-name slot at [this+0x80+index*0x101] when the caller string fits. It then marks the selector present at [this+0x384+index*4] and clears the paired transient pointer at [this+0x99c+index*4].,ghidra + rizin + llvm-objdump 0x005951a0,67,multiplayer_transport_find_selector_name,shell,cdecl,inferred,ghidra-headless,4,Scans the three selector-name slots rooted at [this+0x80] for an exact string match and returns the matching selector index through the caller pointer. The callback-slot wrapper family uses this helper before enqueueing several selector-bound opcode records.,ghidra + rizin + llvm-objdump @@ -852,39 +941,57 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump 0x00595620,35,multiplayer_transport_release_route_binding,shell,cdecl,inferred,ghidra-headless,3,Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].,ghidra + rizin + llvm-objdump 0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The currently grounded mode transitions converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.,ghidra + rizin + llvm-objdump + strings -0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,2,Builds one staged route-callback payload from the caller route object and transport-local text buffer at [this+0x60]. It extracts several caller fields through the 0x58d1f0 0x58d240 0x58d220 and 0x58d250 or 0x58d200 helpers packs them through multiplayer_transport_format_gsp_payload submits the staged text through multiplayer_transport_submit_selector_text_route_request and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at [this+0xb50].,ghidra + rizin + llvm-objdump + strings -0x00595980,84,multiplayer_transport_handle_route_status_result,shell,cdecl,inferred,ghidra-headless,2,Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the live status counters at [this+0xac0] and [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4].,ghidra + rizin + llvm-objdump +0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation" +0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. Current evidence does not yet prove this tuple is the same field family as the selector-view probe marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation" +0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller payload's primary descriptor dword through `0x58d1f0` against bound-route field `[binding+0x54]`; when payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires getter `0x58d240` to match `[binding+0x58]` and getter `0x58d250` to match word `[binding->route+0x30]`; otherwise it falls back to getter `0x58d200` against that same route word. Current grounded caller is multiplayer_transport_check_openstaging_capacity_gate at `0x595d60`, where this tuple check can short-circuit the broader capacity path. This row is now intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + caller inspection + descriptor-getter correlation + route-binding-layout correlation" +0x00595980,84,multiplayer_transport_handle_route_status_result,shell,cdecl,inferred,ghidra-headless,2,Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the third selector-generation counter at [this+0xac0] against the current route-status target at [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4].,ghidra + rizin + llvm-objdump + selector-generation correlation 0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,ghidra-headless,3,Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately.,ghidra + rizin + llvm-objdump 0x00596270,70,multiplayer_transport_clone_staged_callback_payload,shell,cdecl,inferred,ghidra-headless,3,Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump -0x00597720,96,multiplayer_transport_format_gsp_payload,shell,cdecl,inferred,ghidra-headless,3,Formats one transport text payload with the `#GSP!%s!%c%s%c` template at 0x005e2358. Depending on whether the global formatter state at 0x00dba4c4 is present it builds either a 0x58-byte or 0x4d-byte intermediate fragment through 0x597590 or 0x5976c0 and then emits the final string through 0x5a19c4. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump + strings -0x005977b0,127,multiplayer_transport_parse_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward the parsed request id and companion value into multiplayer_transport_arm_selector_view_probe_tracking.","objdump + caller xrefs + format string" -0x00597840,30,multiplayer_transport_format_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Formats one selector-view probe marker in the local `X%sX|%d` family. It encodes the caller request id through `0x597590`, then wraps the result with sentinel `X` bytes and a trailing `|%d` suffix into the destination buffer. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines.","objdump + caller xrefs + format string" -0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_gsp_payload allocates a type `1` transient request record through 0x5934e0 stores route and callback metadata on that record publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].,ghidra + rizin + llvm-objdump + strings -0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,Follow-up callback used by multiplayer_transport_handle_selector_text_route_request. When the callback succeeds it initializes or repopulates selector slot [req+0x1c] through multiplayer_transport_init_selector_slot and multiplayer_transport_upsert_selector_name_entry. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through multiplayer_transport_probe_or_enqueue_route_record and unlinking the request through 0x5933a0.,ghidra + rizin + llvm-objdump +0x00597720,96,multiplayer_transport_format_route_binding_gsp_payload,shell,cdecl,inferred,ghidra-headless,3,"Formats one route-binding or callback payload with the `#GSP!%s!%c%s%c` template at `0x005e2358`. It takes the caller text payload in `esi`, then wraps one encoded descriptor fragment with either `X...X` or `M...M` depending on whether the global formatter state at `0x00dba4c4` is present. On the simpler branch it encodes the primary descriptor dword through `0x597590` and chooses wrapper char `0x58` (`X`); on the mixed branch it folds two dwords plus one normalized word through `0x5976c0` and chooses wrapper char `0x4d` (`M`). It then emits the final `#GSP!` line through `0x5a19c4`. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.","ghidra + rizin + llvm-objdump + strings + route-binding-payload correlation" +0x005977b0,127,multiplayer_transport_parse_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers as `(probe request id, displayed version/build integer)`. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward that tuple into multiplayer_transport_arm_selector_view_probe_tracking.","objdump + caller xrefs + format string" +0x00597840,30,multiplayer_transport_format_selector_view_probe_marker_core,shell,cdecl,inferred,objdump,3,"Formats the core `X%sX` wrapper used inside the selector-view probe marker family. It encodes the caller request id through `0x597590`, wraps the result with sentinel `X` bytes, and terminates the destination buffer at byte `0x0a`. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines. The trailing `|%d` companion integer from the wider `X%sX|%d` family is parsed by `0x5977b0`, but current evidence does not show it being emitted here.","objdump + caller xrefs + format string + staged-progress correlation" +0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_route_binding_gsp_payload allocates a type `1` transient request record through 0x5934e0 and stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` on the completion side publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation" +0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,"Follow-up callback used by `multiplayer_transport_handle_selector_text_route_request`. When the callback succeeds it initializes or repopulates selector slot `[req+0x1c]` through `multiplayer_transport_init_selector_slot` and `multiplayer_transport_upsert_selector_name_entry`. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-local selector slot id at `+0x1c`, then unlinking the request through `0x5933a0`.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation" 0x00593bb0,144,multiplayer_transport_handle_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump -0x00593c40,177,multiplayer_transport_submit_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Builds and submits one selector-text route request. It validates the caller text defaults the sample text to 0x005c87a8 allocates a type `2` transient request record through 0x5934e0 stores the selector id at +0x1c refreshes selector naming through 0x59fc80 and multiplayer_transport_set_selector_name and then submits the request through 0x58e720 using multiplayer_transport_handle_selector_text_route_request.,ghidra + rizin + llvm-objdump + strings -0x00595a40,245,multiplayer_transport_dispatch_field_snapshot_mode,shell,cdecl,inferred,ghidra-headless,3,Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Depending on the mode it can enqueue hostname or gamemode snapshots clear the progress scalar at [this+0x1774] reset the callback payload to zero or copy one dword from [eax+0x490] into [this+0x54] while updating the local field cache rooted at [this+0x1724].,ghidra + rizin + llvm-objdump + strings +0x00593c40,177,multiplayer_transport_submit_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one selector-text route request. It validates the caller text defaults the sample text to 0x005c87a8 allocates a type `2` transient request record through 0x5934e0 stores the selector id at +0x1c stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` refreshes selector naming through 0x59fc80 and multiplayer_transport_set_selector_name and then submits the request through 0x58e720 using multiplayer_transport_handle_selector_text_route_request.","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation" +0x00595a40,245,multiplayer_transport_dispatch_field_snapshot_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Current grounded cases are tighter now: mode `0` enqueues one descriptor-backed snapshot and, when descriptor ready bit `0x1` is still clear, also inserts that descriptor into the local field-cache family `[this+0x1724]` with pending tag `0x4`; mode `1` enqueues the same snapshot without cache insertion; mode `2` removes descriptors carrying pending state bits `0x04/0x08` from that local field-cache family before enqueueing; mode `3` clears progress scalar `[this+0x1774]` and resets the callback payload to zero; mode `4` enqueues one empty selector snapshot through mode `0`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the local field cache rooted at `[this+0x1724]`. Queue service later promotes pending tag `0x4` into ready bit `0x1`.","ghidra + rizin + llvm-objdump + strings + queue-state correlation + caller inspection" 0x00595b60,25,multiplayer_transport_enqueue_field_snapshot_mode1_if_enabled,shell,cdecl,inferred,ghidra-headless,2,Tiny field-snapshot wrapper that enqueues one mode-1 field snapshot only when the caller enable flag is zero. The helper is a thin front end over multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump -0x00595b80,50,multiplayer_transport_clear_progress_field_cache,shell,cdecl,inferred,ghidra-headless,3,Clears the progress-related field cache rooted at [this+0xba0] and then clears the local field cache at [this+0x1724]. It finishes by forwarding mode `3` into 0x005929a0 to remove the matching queued field-snapshot records.,ghidra + rizin + llvm-objdump + strings -0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,ghidra-headless,3,Builds and enqueues one descriptor-block transport record tied to the capacity or progress cache at [this+0x1778]. One branch forwards cached descriptor fields directly through multiplayer_transport_enqueue_descriptor_block_record while the live branch samples hostname openstaging gamemode and numplayers strings from the current transport object before enqueueing the same opcode-2 descriptor record.,ghidra + rizin + llvm-objdump + strings -0x00595ce0,22,multiplayer_transport_clear_capacity_descriptor_cache,shell,cdecl,inferred,ghidra-headless,3,Clears the auxiliary capacity-descriptor cache when [this+0xba0] is present by forwarding the embedded object at [this+0xba4] into 0x00590740. Current grounded callers use this before disconnect or larger route-state cleanup.,ghidra + rizin + llvm-objdump +0x00595b80,50,multiplayer_transport_clear_progress_field_cache,shell,cdecl,inferred,ghidra-headless,3,Clears the progress-related field cache rooted at [this+0xba0] and then clears the local field cache at [this+0x1724]. It finishes by forwarding opcode type `3` into 0x005929a0 to remove matching active field-snapshot records from the active opcode collection at [this+0x17fc].,ghidra + rizin + llvm-objdump + strings + local disassembly +0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,objdump,3,"Builds and enqueues one opcode-`2` descriptor-block record tied to the local capacity or occupancy sidecar at `[this+0x1778]`. Current evidence now bounds that sidecar more tightly: it behaves as one cached pointer into the transient transport work-record family rooted at `[this+0x1780]`, because every meaningful branch in this helper first reads that pointer and then consumes the familiar work-record metadata triplet at `+0x0c/+0x10/+0x18`. Mode `0` is the live append-notify branch, lining up directly with the generic descriptor owner callback at `0x590370`: it samples the current descriptor's primary IPv4, `hostname`, `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` properties through `0x58d1f0`, `0x58d170`, and `0x58d6d0`, then packs a populated seven-dword descriptor payload through `multiplayer_transport_enqueue_descriptor_block_record` `0x592ae0` while also carrying the same outer callback-wrapper triplet as `(drain context id [cache+0x0c], callback fn [cache+0x10], callback companion [cache+0x18])`. Modes `3` and `5` are the live receive-state callbacks sourced by `multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine` `0x5911e0` and its inner decode state machine `0x5908c0`: they deliberately enqueue an all-zero seven-dword descriptor payload, forward only that same stored callback-wrapper triplet in the outer slots, and then unlink the cached work record through `0x5933a0`, using `EDX=1` for mode `3` and `EDX=0` for mode `5`. Other owner-callback modes fall through without staging a descriptor block here, and the negative result is stronger now too: direct local field-xref scans hit neighboring lifecycle fields `[this+0x176c]`, `[this+0x1770]`, `[this+0x1774]`, `[this+0x177c]`, `[this+0x1780]`, and `[this+0x1784]`, but `[this+0x1778]` still appears only as this helper's single read; broader local text scans also fail to show any obvious `lea`-based replay-band writer. So the sidecar writer remains upstream of this leaf family and is not one ordinary direct or nearby derived-address field store in local text. Mode `2` stays separate as the generic remove-notify-and-stage path at `0x590430`, not one of this helper's own branches. Current evidence therefore bounds this as a real capacity or occupancy descriptor publisher over one cached work record, not a vague route-progress helper or a custom replay-scalar blob.","objdump + local disassembly + strings + capacity-cache correlation + work-record correlation + descriptor-block correlation + mode split correlation + opcode2-payload correlation + generic-owner-mode correlation + negative-xref correlation + callback-triplet correlation + neighboring-field-lifecycle correlation + live-receive-owner correlation + negative-derived-address-scan" +0x00595ce0,22,multiplayer_transport_clear_capacity_descriptor_route_callback_table,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the auxiliary capacity-descriptor route callback table when `[this+0xba0]` is present by forwarding the embedded runtime at `[this+0x1164]` into `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`. Current grounded callers use this before disconnect or larger route-state cleanup. The helper does not target the field-subscription table at `[this+0xba4]`; current evidence ties it specifically to the callback table whose owner handler is `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`.","objdump + local disassembly + caller inspection + route-callback-table correlation" 0x00595d60,84,multiplayer_transport_check_openstaging_capacity_gate,shell,cdecl,inferred,ghidra-headless,2,Checks whether the current transport object still matches the cached openstaging-like descriptor and whether numplayers remains below maxplayers. When the cached route object at [this+0x1ecc] already matches the current transport identifiers it returns success immediately; otherwise it compares the current maxplayers and numplayers fields and on success falls into 0x00592710 for the caller's route transition path.,ghidra + rizin + llvm-objdump + strings -0x00595dc0,79,multiplayer_transport_try_transition_after_capacity_gate,shell,cdecl,inferred,ghidra-headless,2,Rejects when [this+0x1e8c] or selector slot [this+0x38c] is busy then runs multiplayer_transport_check_openstaging_capacity_gate refreshes route-side state through 0x5973b0 and 0x5954b0 forwards the caller event into 0x5958e0 and on success transitions through 0x595650 mode `0`.,ghidra + rizin + llvm-objdump -0x00595e10,321,multiplayer_transport_dispatch_route_event_mode,shell,cdecl,inferred,ghidra-headless,2,Dispatches route-event modes for the callback branch rooted at [this+0x18bc]. Depending on the mode it may update [this+0x18bc] or [this+0x1e7c] reuse multiplayer_transport_try_transition_after_capacity_gate force mode `2` through 0x595650 or copy a selected descriptor pointer into [this+0x54]. Current surrounding evidence ties this branch to the `gsi_am_rating` route table.,ghidra + rizin + llvm-objdump -0x00595f70,237,multiplayer_transport_dispatch_am_rating_route_callback,shell,cdecl,inferred,ghidra-headless,3,Callback handler for the `gsi_am_rating` route branch rooted at [this+0x18bc]. Mode `0` forwards directly into multiplayer_transport_try_transition_after_capacity_gate while mode `2` prunes stale route entries against multiplayer_transport_check_openstaging_capacity_gate updates surviving entries through 0x58d130 with the `gsi_am_rating` token and either forces mode `2` or forwards the surviving head entry into 0x5958e0 before transitioning through 0x595650 mode `0`.,ghidra + rizin + llvm-objdump + strings -0x00596060,48,multiplayer_transport_reset_am_rating_route_state,shell,cdecl,inferred,ghidra-headless,3,Small reset helper for the active `gsi_am_rating` route state. When [this+0xba0] is set it clears the route callback table at [this+0x18bc] resets [this+0x1ec4] to zero and clears the auxiliary route cache at [this+0x1e7c].,ghidra + rizin + llvm-objdump + strings -0x00596090,272,multiplayer_transport_init_route_callback_tables,shell,cdecl,inferred,ghidra-headless,3,Initializes route callback tables at [this+0xba4] [this+0x1724] [this+0x1164] [this+0x18bc] and [this+0x1e7c]. Installs handlers 0x00595a40 0x00595b60 0x00595bc0 0x00595e10 and multiplayer_transport_dispatch_am_rating_route_callback seeds default selector text from static tables and sets [this+0xba0].,ghidra + rizin + llvm-objdump -0x005961b0,92,multiplayer_transport_teardown_route_callback_tables,shell,cdecl,inferred,ghidra-headless,4,Clears progress and capacity caches destroys the callback tables at [this+0xba4] [this+0x1164] and [this+0x18bc] clears the related caches at [this+0x1724] and [this+0x1e7c] and resets [this+0x1ec4] to zero.,ghidra + rizin + llvm-objdump -0x00596210,71,multiplayer_transport_service_route_callback_tables,shell,cdecl,inferred,objdump,3,"Recurring service sweep for the transport-owned callback tables and field caches. When route callback plumbing is enabled at `[this+0xba0]` it services the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through the shared table-service helper `0x591290`, services the cache blocks at `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0c80`, and otherwise returns immediately. The current grounded caller is multiplayer_transport_service_frame, which makes this the callback-table side of the recurring multiplayer transport cadence.",objdump -0x005962e0,583,multiplayer_transport_register_field_subscription_bundle,shell,cdecl,inferred,ghidra-headless,3,Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump -0x00596530,101,multiplayer_transport_try_seed_am_rating_route_table,shell,cdecl,inferred,ghidra-headless,2,Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4].,ghidra + rizin + llvm-objdump + strings +0x00595dc0,79,multiplayer_transport_try_transition_after_capacity_gate,shell,cdecl,inferred,ghidra-headless,2,"Rejects when `[this+0x1e8c]` or selector slot `[this+0x38c]` is busy, then runs `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, refreshes route-side selector state through `0x5973b0` and `multiplayer_transport_reset_selector_slot` `0x5954b0` on slot `2`, forwards the caller descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and on success transitions through `multiplayer_transport_set_route_mode` `0x595650` mode `0`. Current grounded callers are the ready-descriptor branch in `0x595e10` mode `1` and the mode-`0` fastpath in `0x595f70`.","ghidra + rizin + llvm-objdump + caller inspection" +0x00595e10,321,multiplayer_transport_dispatch_am_rating_route_event_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches route-event modes for the `gsi_am_rating` callback branch rooted at the primary-endpoint table `[this+0x18bc]` and the queued descriptor family `[this+0x1e7c]`. Current grounded cases are tighter now: mode `0` uses descriptor flag-byte-`0x15` bit `0x1` to choose between direct primary-endpoint handling through `multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port` `0x00591330` and queued insertion through `multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag` `0x005a09a0`; mode `1` uses descriptor state-byte ready bit `0x2` to choose between immediate transition handling through `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0` and reinsertion into that same queue family, but then applies one second guard through flag bit `0x1`, which suppresses the direct transition path even when ready bit `0x2` is already present; mode `2` removes descriptors still carrying pending state bits `0x04/0x08` from the queued family through `0x005a0cd0`; mode `3` forces route mode `2` when the primary-endpoint table at `[this+0x18bc]` is empty; mode `4` updates `[this+0x1ed4]` and can switch transport mode based on the callback-table sentinel at `[this+0x18b8]` plus deferred descriptor pointer `[this+0x1ed8]`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the local field cache rooted at `[this+0x1724]`. The strongest current read is that flag byte `0x15` bit `0x1` marks primary-endpoint-seed or endpoint-only descriptors: those descriptors can be staged and enriched through the queue family, but they do not take the richer direct transition path used by clear-bit descriptors.","ghidra + rizin + llvm-objdump + am-rating-owner correlation + endpoint-table correlation + queued-descriptor correlation + queue-state correlation + caller inspection + transition-suppression correlation + raw-endpoint-seed correlation" +0x00595f70,237,multiplayer_transport_dispatch_am_rating_route_callback,shell,cdecl,inferred,ghidra-headless,3,"Callback handler for the `gsi_am_rating` route branch rooted at the primary-endpoint table `[this+0x18bc]`. Mode `0` forwards directly into multiplayer_transport_try_transition_after_capacity_gate. Mode `2` now has a cleaner ownership split: it walks the primary-endpoint table through `0x590470/0x590480`, prunes stale entries against multiplayer_transport_check_openstaging_capacity_gate, updates surviving entries through `0x58d130` using the `gsi_am_rating` key, and then either forces transport mode `2` when the table empties or forwards the surviving head descriptor into `0x5958e0` before transitioning through `0x595650` mode `0`.","ghidra + rizin + llvm-objdump + strings + endpoint-table correlation" +0x00596060,48,multiplayer_transport_reset_am_rating_route_state,shell,cdecl,inferred,ghidra-headless,3,"Small reset helper for the active `gsi_am_rating` route state. When `[this+0xba0]` is set it clears the primary-endpoint callback table at `[this+0x18bc]` through `0x590740`, resets `[this+0x1ec4]` to zero, and clears the queued descriptor family at `[this+0x1e7c]` through `0x5a0950`.",ghidra + rizin + llvm-objdump + strings +0x00596090,272,multiplayer_transport_init_route_callback_tables,shell,cdecl,inferred,ghidra-headless,3,"Initializes the transport-owned route callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` together with the descriptor caches at `[this+0x1724]` and `[this+0x1e7c]`. Current evidence now bounds the constructor lanes more tightly than the earlier handler-table note: it constructs `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, shared owner cookie `this`, route-label buffers rooted at `[this+0xb58]` and `[this+0xb78]`, and schema or descriptor-owner pointer `[this+0xb98]`; it seeds the local field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60`; it constructs `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; and it constructs `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` before seeding `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70`. On success it also clears the staged route-callback payload slot `[this+0xb50]` and sets callback-table enable latch `[this+0xba0]` to `1`.","ghidra + rizin + llvm-objdump + handler-table correlation + local disassembly + constructor-argument correlation + latch-state correlation" +0x005961b0,92,multiplayer_transport_teardown_route_callback_tables,shell,cdecl,inferred,ghidra-headless,4,"Full teardown for the transport-owned route callback tables. It first clears progress and local field-cache state through `0x595b80`, resets the capacity-descriptor route callback table at `[this+0x1164]` through `0x595ce0`, and then, when callback-table plumbing latch `[this+0xba0]` is set, destroys the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through `0x5907a0`, clears the related caches at `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0970`, and resets `[this+0x1ec4]` to zero. Current grounded caller is `multiplayer_transport_disconnect` `0x58d830`.","ghidra + rizin + llvm-objdump + caller inspection + route-callback-table correlation" +0x00596210,71,multiplayer_transport_service_route_callback_tables,shell,cdecl,inferred,objdump,3,"Recurring service sweep for the transport-owned callback tables and descriptor caches. When route callback plumbing is enabled at `[this+0xba0]` it services the callback tables at `[this+0xba4]`, `[this+0x1164]`, and the `gsi_am_rating` primary-endpoint table `[this+0x18bc]` through the shared table-service helper `0x591290`, services the cache blocks at `[this+0x1724]` and the companion queued descriptor family `[this+0x1e7c]` through `multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition` `0x005a0c80`, and otherwise returns immediately. Current evidence now bounds those queue families more tightly too: service promotes pending descriptor state tags `0x4/0x8` into ready bits `0x1/0x2` before the higher transport-owned branches consume them. The current grounded caller is multiplayer_transport_service_frame, which makes this the callback-table side of the recurring multiplayer transport cadence.",objdump + am-rating-owner correlation + queue-state correlation +0x005962c0,32,multiplayer_transport_clear_staged_route_callback_payload,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the cloned staged route-callback payload handle at `[this+0xb50]`. When that slot is non-null the helper forwards the embedded owned object slot through `0x58d0d0`, then zeroes `[this+0xb50]`. Current grounded callers are the stale-request branch in `multiplayer_transport_handle_selector_text_route_request` `0x593bb0` and the selector-slot-`2` reset path around `0x595561`.","objdump + local disassembly + caller inspection + payload-slot correlation" +0x005962e0,583,multiplayer_transport_open_field_subscription_route_callback_table,shell,cdecl,inferred,objdump,3,"Builds and opens the field-subscription route callback table rooted at `[this+0xba4]`. After clearing the progress field cache through `0x595b80` and releasing any prior active descriptors through `0x5904d0`, it builds one route-label string from the optional suffix text plus the static route stem family at `0x005e22a0..0x005e22d0`, seeds the local field-cache family `[this+0x1724]` with the initial callback keys through `0x5a0cc0`, appends per-field selector names from the caller field-id list through the string table at `0x00629958`, and then opens the live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `4`. On success it seeds cached progress percentage `[this+0x1774]` to `1` and immediately enqueues one mode-`3` field snapshot through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`; on failure it falls back through the same progress-cache clear path. This is the strongest current upstream owner above the `[transport+0xba4]` route-callback table.","objdump + local disassembly + caller inspection + field-cache correlation + route-callback-table correlation" +0x00596530,101,multiplayer_transport_try_open_am_rating_route_callback_table_from_stored_route_label,shell,cdecl,inferred,objdump,3,"Tries to reopen the `gsi_am_rating` route callback table rooted at `[this+0x18bc]` from the stored route label at `[this+0x1ed0]`. It first resets the am-rating route state through `multiplayer_transport_reset_am_rating_route_state` `0x596060`, releases any prior active descriptors through `0x5904d0`, and then opens one mode-`4` live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` with a null companion route string. Success clears `[this+0x1ed4]`, sets `[this+0x1ec4]` to `1`, and leaves the primary-endpoint table ready for later raw-endpoint seeding through `0x590dc0`; failure reverts through the same reset path and sets `[this+0x1ed4]`. Current grounded caller is the larger route-mode setter around `0x595650`.","objdump + local disassembly + caller inspection + am-rating-owner correlation + route-callback-table correlation" 0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,ghidra-headless,3,Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump -0x00596970,404,multiplayer_transport_handle_profile_key_query_result,shell,cdecl,inferred,objdump,3,"Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed marker pair or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert.","objdump + strings + caller context" +0x00596970,404,multiplayer_transport_handle_profile_key_query_result,shell,cdecl,inferred,objdump,3,"Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert.","objdump + strings + caller context" +0x00596b90,72,multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success,shell,cdecl,inferred,objdump + local disassembly,3,"Small helper above the generic per-key profile query path. Using the caller selector slot in `edx`, it indexes one per-slot built-in string pair from `[this+0x189c+slot*4]` and `[this+0x18ac+slot*4]`, forwards that pair plus the caller selector name and fallback text into `multiplayer_transport_handle_profile_key_query_result` `0x596970` with its publication flag enabled, and, when that lower helper returns success, also publishes callback slot `28` through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. Current grounded callers are the selector callback root `0x59fbd0` and the later multi-entry sweep around `0x596d33`.","objdump + local disassembly + caller inspection" 0x00596da0,497,multiplayer_transport_submit_profile_key_query_bundle,shell,cdecl,inferred,rizin,2,Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty.,rizin + llvm-objdump + strings 0x00596fa0,19,multiplayer_transport_submit_profile_key_query_bundle_with_context,shell,cdecl,inferred,rizin,2,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0.,rizin + llvm-objdump 0x00596fc0,14,multiplayer_transport_submit_profile_key_query_bundle_default,shell,cdecl,inferred,rizin,3,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60.,rizin + llvm-objdump 0x0059f8b0,260,multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys,shell,cdecl,inferred,objdump,3,"Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`.","objdump + caller xrefs + strings" +0x0059f9c0,239,multiplayer_transport_callback_clear_named_selector_view_slot_publish_slot18_and_maybe_set_route_mode,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the second transport-side selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`; when selector `2` is active and the route is live, it derives one follow-on route-mode request from the current selector-view state by combining the route-status latch at `[this+0xb40]`, the slot-`2` flag-`0x20` count from `multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match` `0x594e30`, and the third selector-generation gate `[this+0xac0]` versus target `[this+0xb48]`. It then clears the named selector-view slot membership through `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`, publishes callback slot `18` through `0x592f20` using the selector name plus either the default sample `0x005c87a8`, the alternate token `0x005e24e0` for selectors `2/3`, or the caller text when present, and finally re-enters `multiplayer_transport_set_route_mode` `0x595650` when the earlier route-mode decision armed a transition. This now bounds the helper as the named selector-view slot-clear and callback-slot-`18` publication lane rather than an anonymous route-mode side effect.","objdump + local disassembly + callback-table install correlation + caller inspection" +0x0059fab0,58,multiplayer_transport_callback_rekey_named_selector_view_entry_and_publish_slot21,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the same selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`, rekeys the named selector-view entry through `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`, and then publishes callback slot `21` through `0x593000` using the old and new selector names plus the caller context in `edx`. Current grounded role is the rename or relabel sibling next to the slot-clear lane, not a generic selector-text setter.","objdump + local disassembly + callback-table install correlation" +0x0059faf0,98,multiplayer_transport_callback_set_selector_slot_sample_text_and_refresh_active_object,shell,cdecl,inferred,objdump + local disassembly,2,"Callback-root helper adjacent to `0x59fab0`. After resolving the caller selector name into one slot index through `0x5951a0`, it copies up to `0x200` bytes of caller text into the fixed selector sample buffer at `[this+0x39c+slot*0x200]`, clears the trailing byte at `[this+0x59b+slot*0x200]`, and, when an active selector object is still present at `[this+0x390+slot*4]`, refreshes that object through `0x592d30`. This currently bounds the helper as the selector-sample-text update lane rather than a broader selector-table mutator.","objdump + local disassembly + selector-buffer correlation" +0x0059fb60,104,multiplayer_transport_callback_replace_selector_slot_name_set_request_default_profile_keys_and_publish_slot20,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x24` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, clears that selector slot from every selector-view entry through `multiplayer_transport_clear_selector_view_slot_from_all_entries` `0x5950a0`, then iterates one caller-supplied name list and re-upserts each name into that slot through `multiplayer_transport_upsert_selector_name_entry` `0x594f20` using the paired caller-side flag words. After the replacement sweep it requests the default profile-key bundle for that selector slot through `0x596fc0` and publishes callback slot `20` through `0x592fc0`.","objdump + local disassembly + callback-table install correlation + caller inspection" +0x0059fbd0,69,multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x28` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, forwards the caller trio into `multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success` `0x596b90`, and then publishes the same trio through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. This currently bounds the helper as the built-in per-slot profile-key query sibling next to the selector-set replacement lane, rather than another generic selector-text path.","objdump + local disassembly + callback-table install correlation + helper correlation" +0x005a0950,18,multiplayer_gamespy_server_descriptor_queue_clear_active_and_pending_lists,shell,cdecl,inferred,objdump,3,"Clears both linked lists in one compact server-descriptor queue family by forwarding the active list at `[this+0x08]` and pending list at `[this+0x14]` into the shared list-clear helper `0x5a07b0`. Current grounded caller is `multiplayer_transport_reset_am_rating_route_state`, which uses it to clear the queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation" +0x005a0970,48,multiplayer_gamespy_server_descriptor_queue_destroy_and_release_owned_buffer,shell,cdecl,inferred,objdump,2,"Destructor-side helper for one compact server-descriptor queue family. It releases the owned scratch buffer or stream handle at `[this+0x20]` through `0x58bc4e`, resets that slot to `-1`, and then clears the active and pending lists through the same lower list-clear helper used by `0x005a0950`. Current grounded caller is the queued-descriptor family teardown path beneath the multiplayer transport callback-table shutdown.","objdump + caller inspection + queue-family correlation" +0x005a09a0,84,multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag,shell,cdecl,inferred,objdump,3,"Inserts one compact server descriptor into a queue family while stamping a pending state tag into descriptor byte `[entry+0x14]`. The helper first clears transient state bits `0x4/0x8/0x10`; then its second stack argument chooses pending bit `0x4` or `0x8`, which later service code promotes into ready bits `0x1` or `0x2`. The first stack argument chooses whether insertion goes through the pending-list path at `[this+0x14]` or the active-list path at `[this+0x08]`. If the family is full it grows storage through `0x5a07c0`. Current grounded callers use pending tag `0x4` for the local field-cache family at `[transport+0x1724]` and pending tag `0x8` for the `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-state correlation" +0x005a0c80,79,multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition,shell,cdecl,inferred,objdump,3,"Recurring service helper for one compact server-descriptor queue family. When the family still owns descriptors it runs the heavier refresh pass at `0x5a0b40`, the age or expiry sweep at `0x5a0c00`, and the compaction pass at `0x5a0c50`; if the family becomes empty afterward it notifies the owner callback at `[this+0x40]` with mode `2` and null entry. Current grounded callers are `multiplayer_transport_service_route_callback_tables`, which services the transport-owned field-cache family at `[transport+0x1724]` and the companion `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation" +0x005a0cd0,35,multiplayer_gamespy_server_descriptor_queue_remove_matching_entry,shell,cdecl,inferred,objdump,3,"Removes one matching compact descriptor from a queue family by probing the active list at `[this+0x08]` first and falling back to the pending list at `[this+0x14]` when no active match is found. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode`, which removes descriptors carrying pending state bits `0x4/0x8` from the `gsi_am_rating` queued family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation" 0x00596fd0,441,multiplayer_transport_dispatch_status_route_event,shell,cdecl,inferred,rizin,3,Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8].,rizin + llvm-objdump + strings +0x005970e0,156,multiplayer_transport_status_route_publish_selector_name_or_probe_average_or_forward_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback helper from the six-entry route vector seeded by `multiplayer_transport_try_connect_status_route`. When the transport is active and the status-route gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, event id `0x15` resolves the active selector-view entry through `0x594dc0` mode `2` and appends the returned selector text through `0x58bce0`, while event id `0x18` resolves that same entry and publishes the averaged probe sample from `[entry+0x80]` through `0x58cd40`. When no active entry is available it falls back to the fixed text token at `0x005c87a8`. Outside those bounded cases it forwards the same `(event id, payload)` pair into the owner callback at `[this+0x17e0]` with context `[this+0x17f8]`. This is currently the strongest safe role for one status-route callback-vector lane, while the exact user-facing label of the averaged sample remains open.","objdump + caller correlation + strings + selector-view correlation" +0x00597180,40,multiplayer_transport_status_route_forward_owner_event_payload,shell,cdecl,inferred,objdump + caller correlation,3,"Thin owner-forwarding lane in the status-route callback vector. It forwards the caller event id in `ecx` and payload pointer in `edx` into the owner callback at `[this+0x17e4]` with context `[this+0x17f8]` when that callback is present, and otherwise returns immediately. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation" +0x005971b0,192,multiplayer_transport_status_route_seed_control_id_list_and_notify_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback-vector lane that seeds one control-id list into the caller byte builder through `0x58bcb0`. In its first grounded mode it appends the currently available local status-control ids, including the always-on `8` lane plus conditional ids `1`, `0x0b`, `0x13`, `0x14`, and `0x0a` according to the current status-route state at `[this+0x1ecc]`, `[this+0xb4c]`, `[this+0xb3c]`, and `[this+0xb48]`; in its second grounded mode it emits the smaller pair `0x15` and `0x18`. After seeding that local list it optionally forwards the same mode plus builder into the owner callback at `[this+0x17e8]` with context `[this+0x17f8]`. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + control-id-list correlation" +0x00597270,80,multiplayer_transport_status_route_query_third_selector_generation_or_forward_owner_scalar,shell,cdecl,inferred,objdump + caller correlation,2,"Small scalar-query lane in the status-route callback vector. When the caller event id is `1` and the transport-side status gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, the helper returns the third selector-slot generation counter at `[this+0xac0]`. Otherwise it forwards the same selector or scalar query into the owner callback at `[this+0x17ec]` with context `[this+0x17f8]`, returning zero when that callback is absent. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + selector-generation correlation" 0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump" 0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump" 0x00597350,30,multiplayer_transport_release_status_route,shell,cdecl,inferred,ghidra-headless,3,Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state.,ghidra + rizin + llvm-objdump @@ -939,9 +1046,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0059de40,96,multiplayer_transport_stage_registered_name_callback_payload,shell,cdecl,inferred,rizin,3,Resolves one nested callback-entry record by secondary key from the caller registered-name entry then copies a 0x18-byte payload block into `[subentry+0x80]` and a 0x40-byte payload block into `[subentry+0x98]` null-terminates both copied regions and sets the active flag at `[subentry+0xd8]` to one.,rizin + llvm-objdump 0x0059dea0,96,multiplayer_transport_stage_registered_name_callback_payload_for_name,shell,cdecl,inferred,rizin,3,Looks up one primary registered-name entry then fans helper multiplayer_transport_stage_registered_name_callback_payload across the registered-name store through generic_callback_list_for_each using the caller secondary key plus the two payload buffers. Current grounded role is a primary-name keyed payload staging wrapper for nested callback-entry records.,rizin + llvm-objdump 0x0059df00,96,multiplayer_transport_try_resolve_registered_name_callback_payload,shell,cdecl,inferred,rizin,4,Fast resolver for one nested callback-entry payload. When the descriptor either has no selector string or matches the shared two-byte default token at 0x005e1e1c it looks up the nested callback-entry record by key from `[entry+0x134]` and if the entry is active at `[subentry+0xd8]` marks the descriptor successful and returns pointers to the staged payload blocks at `[subentry+0x80]` and `[subentry+0x98]`.,rizin + llvm-objdump -0x005934c0,30,multiplayer_transport_next_work_sequence,shell,thiscall,inferred,ghidra-headless,3,Returns the next monotonically increasing transport work-sequence value by incrementing dword [this+0x177c] and clamping negative wraparound back to zero. Current grounded callers use the returned value when allocating transient transport records for text submission registration and related async work.,ghidra + rizin + llvm-objdump -0x00593650,229,multiplayer_transport_attach_callback_table_descriptor,shell,cdecl,inferred,ghidra-headless,3,Builds one transport-side callback-table descriptor from the caller table pointers and metadata. The helper allocates a temporary registration object through 0x005934e0 installs callback vectors from the 0x0059f5c0 and 0x0059f650 tables copies the caller transport pointer into the local stack frame and finishes by linking the result through 0x0058f2f0 and 0x005933a0. The current grounded caller is multiplayer_transport_register_callback_table.,ghidra + rizin + llvm-objdump -0x00593d60,66,multiplayer_transport_try_submit_text_record_fastpath,shell,cdecl,inferred,ghidra-headless,3,Attempts the fast submission path for one prepared transport text record. It allocates a type-9 transient record through 0x005934e0 and when that succeeds forwards the caller callback and payload through 0x0058e510 with callback shim 0x00593d00. The current grounded caller is multiplayer_transport_submit_text_record.,ghidra + rizin + llvm-objdump +0x005934c0,30,multiplayer_transport_next_work_sequence,shell,thiscall,inferred,ghidra-headless,3,"Returns the next monotonically increasing transport work-sequence value by incrementing dword `[this+0x177c]` and clamping negative wraparound back to zero. Current grounded callers now bound this more tightly than a generic work-sequence source: the returned dword is also the shared immediate-drain context id later copied into queued work field `+0x0c`, mirrored into active opcode-record field `+0x14`, and waited on through `0x58d720` by the text-submission and callback-table registration roots.","ghidra + rizin + llvm-objdump" +0x00593650,229,multiplayer_transport_attach_callback_table_descriptor,shell,cdecl,inferred,ghidra-headless,3,"Builds one transport-side callback-table descriptor from the caller table pointers and metadata. The helper first allocates one transient work record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`, and this lane now constrains that staged metadata more tightly: it uses work-record type `0`, leaves field `+0x08` zero, duplicates one caller metadata dword into both fields `+0x0c` and `+0x18`, and carries the remaining caller callback function pointer in field `+0x10` for later replay through `multiplayer_transport_publish_callback_table_binding_result_and_release_work_record` `0x593570 -> 0x592a40`. It then installs callback vectors from `0x59f5c0` and `0x59f650`, copies the caller transport pointer into the local descriptor frame, and finishes by linking the result through `multiplayer_transport_worker_create` `0x58f2f0`. Failure unlinks the staged work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. The current grounded caller is `multiplayer_transport_register_callback_table`.","ghidra + rizin + llvm-objdump + local disassembly + work-queue correlation + callback-binding-triplet correlation" +0x00593d60,66,multiplayer_transport_try_submit_text_record_fastpath,shell,cdecl,inferred,ghidra-headless,3,"Attempts the fast submission path for one prepared transport text record. It allocates a type-`9` transient record through `0x005934e0`, again staging the shared transport wrapper triplet as `(drain context id +0x0c, callback fn +0x10, callback companion +0x18)`, and when that succeeds forwards the caller callback and payload through `0x0058e510` with callback shim `0x00593d00`. That shim copies the returned text into `[transport+0x04]` and, when work field `+0x10` is nonnull, re-emits one follow-on callback record through `0x00593170` using the staged callback pointer and companion plus the same drain context id. The current grounded caller is `multiplayer_transport_submit_text_record`.","ghidra + rizin + llvm-objdump + work-record-triplet correlation + local disassembly" 0x00598d50,496,multiplayer_transport_handle_registered_name_callback_bind_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side wrapper for record mode 1 in the registered-name branch. It parses the mode prefix from the secondary key string at record field `+0x08` checks whether the primary name matches the local transport name at `[this+0x36c]` and either seeds one local registered-name entry through multiplayer_transport_upsert_registered_name_entry plus multiplayer_transport_set_registered_name_status_text or upserts one nested callback-entry record through multiplayer_transport_upsert_registered_name_callback_entry and emits follow-up opcode 6 or opcode 12 notifications when the target name entry is already marked dirty.,rizin + llvm-objdump 0x00598f40,255,multiplayer_transport_handle_registered_name_callback_remove_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record mode 1. It resolves the primary and secondary key strings from the caller record removes the matching nested callback-entry through multiplayer_transport_remove_registered_name_callback_entry and then emits opcode 7 or opcode 12 notifications from the current registered-name owner callbacks when the target entry is dirty.,rizin + llvm-objdump 0x00599040,308,multiplayer_transport_handle_registered_name_callback_remove_record_mode23,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record modes 2 and 3. It removes one nested callback-entry record by secondary key and then branches on whether the primary name matches the local transport name. The local-owner branch can emit opcode 5 and remove the whole registered-name entry through multiplayer_transport_remove_registered_name_entry while the remote branch emits opcode 7 subtype notifications through the installed owner callbacks.,rizin + llvm-objdump diff --git a/docs/atlas/company-and-ledger.md b/docs/atlas/company-and-ledger.md index 35d1f3b..951849e 100644 --- a/docs/atlas/company-and-ledger.md +++ b/docs/atlas/company-and-ledger.md @@ -43,7 +43,50 @@ What this note is for: - City-connection announcement and bonus lanes - Annual finance-policy thresholds and same-cycle reaction latches +Current bounded linked-transit cache outputs: + +- peer row `+0x05`: route-step count from the tracker metric chooser +- peer row `+0x09`: normalized continuity share `(steps - mismatches) / max(steps, 1)` +- site cache `+0x12`: raw surviving linked-transit site-score total +- site cache `+0x0e`: continuity-and-step-weighted companion total +- site cache `+0x16`: promoted final autoroute site-ranking lane +- `company_compute_owned_linked_transit_site_score_total`: converts summed site `+0x12` totals + into the train-roster target through year and site-count ladders, plus the special build-`1.03+` + two-site distance branch + +Current bounded compatibility impact: + +- the pre-`1.03` versus `1.03+` tracker metric split mainly perturbs peer continuity and weighted + site ranking +- that means it can change which site `0x00408280` prefers and which peer `0x00408380` seeds into + a train route +- current evidence says it does not directly move the company train-pressure target in + `0x00408f70`, because that target sums raw site cache `+0x12` rather than the weighted `+0x0e` + or promoted `+0x16` lanes + Highest-value open edge: -- The remaining semantic meaning of the annual finance ladders and governance-support slots, not - ownership of the verbs or shell windows. +- The remaining semantic meaning of the annual finance ladders is now narrower: + stat-family `0x2329/0x1d` is now bounded as current `Book Value Per Share` in the stock-issue + denominator path, `0x2329/0x0d` is now bounded there as the current cash gate before the + bond-rate-versus-support ladder, the broader support-adjusted share-price or public-support lane + is now bounded through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, + and its immediate feeder is now bounded as + `company_compute_cached_recent_per_share_performance_subscore` `0x004248d0`, which weighs recent + `Revenue Per Share`, `Earnings Per Share`, and `Dividend Per Share` lanes `0x1e/0x1f/0x20` + against current `Book Value Per Share`, while `0x21` now routes through + `company_compute_five_year_weighted_shareholder_return` `0x004246b0` and its paired hidden + shareholder-payout lane `0x23`, + raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`, and + derived slot `0x2b` now reads as the rolling net-profits lane. The main remaining gap is the + lower policy interpretation of how those lanes are blended inside the annual bankruptcy, + dividend, and city-connection ladders. The current strongest read is: + bankruptcy = sustained revenue-band-selected cash-and-debt stress plus repeated net-profit + failures and fuel burden, with one later deep-distress fallback when cash is below `-300000` + and the first three recent profit years all sit at or below `-20000`; stock issuance = a + valuation-versus-borrowing screen over + support-adjusted price-to-book against the highest live coupon band; dividend adjustment = a + weighted recent-profit-per-share target with a small-unassigned-share cash supplement before the + board ceiling clamp. The debt-news tail is also now explicit: it compares total retired versus + newly issued principal to pick `2882..2886`, and the stock-buyback tail separately publishes + `2887` from the accumulated repurchased-share count. diff --git a/docs/atlas/multiplayer.md b/docs/atlas/multiplayer.md index e8adb28..5bcf6b8 100644 --- a/docs/atlas/multiplayer.md +++ b/docs/atlas/multiplayer.md @@ -33,5 +33,181 @@ What this note is for: Highest-value open edge: -- The remaining owner-side callback roles behind the validated GameSpy packet branches and the - exact user-facing meaning of the selector-view sample or companion fields. +- The remaining multiplayer edge is narrower now: + the status-route callback vector is bounded through selector-text or averaged-sample publication, + control-id-list seeding, scalar-query forwarding, and the validated cookie or extended-payload + callbacks. The selector-view sidecar is tighter too: `[entry+0x80]` now reads as the averaged + millisecond probe sample and `[entry+0x54]` as the displayed version/build companion integer from + the local `X...X|%d` marker family. Separately, the route-callback side now has its own compact + GameSpy-style server or route descriptor family with primary and optional secondary endpoint + tuples plus keyed fields like `hostname`, `gamever`, `numplayers`, and `numservers`, feeding the + route-binding compatibility gate. The compact decode owners are tighter too: `0x5907d0` is now + the allocate-and-append lane for self-consistent compact payloads, while `0x590d00` is the keyed + upsert-by-primary-endpoint lane that reuses an existing descriptor when one already matches and + then notifies the transport owner callback. The route-callback-table runtime above that decode + path is tighter too: `0x5905e0` now constructs one transport-owned callback-table block, + `0x5906f0` tears down the decoded schema dictionary rooted at `[this+0x08]`, `0x590540/0x5905a0` + acquire and release refcounted shared schema strings through the global pool, and `0x5908c0` + now reads as the live receive/decode state machine serviced by `0x591290` in table states `2/3`. + The higher transport bring-up split is tighter too: `0x596090` now clearly constructs + `[transport+0xba4]` through `0x5905e0` with owner callback `0x595a40`, then seeds the local + field-cache family `[transport+0x1724]` through `0x5a08f0` with helper `0x595b60`, and then + constructs `[transport+0x1164]` through the same `0x5905e0` path but with owner callback + `0x595bc0`. + The live-route lifecycle above it is tighter too: `0x590740` now cleanly resets one table's live + route plus decode-side runtime without destroying the outer object, `0x5907a0` is the broader + destroy path that also releases the active descriptor collection, `0x590ed0` opens the route + handle into `[this+0x4a0]`, stages the initial outbound request, and seeds state `3` plus the + receive buffer, `0x5911e0` is the state-`2/3` socket-service wrapper above `0x5908c0`, + `0x5912c0` is the one-shot send-with-reopen-retry helper, and `0x590ea0` is the shared + disconnect publication and reset tail. The recurring service helper `0x591290` is tighter too: + it now first clears the staged intrusive descriptor list through `0x590490` before entering the + state-driven seed-or-receive branch. The upstream openers are tighter now too: `0x5962e0` is the + field-subscription route-table owner above `[transport+0xba4]`, while `0x596530` is the + `gsi_am_rating` reopen path above `[transport+0x18bc]`. On that latter branch, `0x590dc0` is now + bounded as the state-`0` raw-endpoint seed pass over the live route handle, repeatedly pulling + endpoint tuples through `0x58bc7e` record type `0x1f3` before stamping descriptor flag byte + `0x15` with `0x11`. That makes the remaining flag-bit question much narrower too: current + evidence now supports reading byte-`0x15` bit `0x1` as a primary-endpoint-seed or endpoint-only + source marker. In the `gsi_am_rating` dispatcher, clear-bit descriptors can take the richer + direct transition lane, while set-bit descriptors are pushed through the queued enrichment path + and later still suppress that direct transition even when the ready bit is present. + The adjacent capacity-descriptor side is tighter too: `0x595bc0` no longer reads as a vague + progress helper. Mode `0` is now clearly the live publish lane, and it lines up with the generic + descriptor append-notify owner callback at `0x590370`: it samples `hostname`, + `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` from the current descriptor before + publishing an opcode-`2` descriptor block, while still carrying three cached side scalars from + the local capacity sidecar at `[transport+0x1778]`. That sidecar is tighter now too: current + evidence says it behaves as one cached pointer into the transient work-record family at + `[transport+0x1780]`, because every meaningful branch in `0x595bc0` reads the same + `+0x0c/+0x10/+0x18` metadata triplet and the replay modes later consume the pointer through + `0x5933a0`. The negative result is stronger too: local text-side xrefs still show no direct + store to `[transport+0x1778]`, and a wider sweep also failed to show any obvious `lea`-based + replay-band writer. So the sidecar writer remains upstream of this leaf capacity publisher. The + payload split is tighter too: + `0x592ae0` now grounds opcode `2` as a seven-dword descriptor payload with an owned string slot + at `+0x08`, so live mode supplies a populated payload while modes `3` and `5` deliberately + enqueue an all-zero payload and reuse only the sidecar metadata in the wrapper. Those two modes + are tighter now too: they are not generic replay guesses, they are the live receive-state owner + callbacks emitted by `0x5911e0 -> 0x5908c0`. So they are best read as delayed metadata replays + over one cached work record, not over a standalone custom cache object. The producer side is + tighter now too: callback-table attach, + bound-route requests, selector-text route requests, and the type-`9` text fastpath all stage + that same `+0x0c/+0x10/+0x18` triplet through `0x5934e0`, so the capacity replay sidecar is + clearly reusing one broader transport work-record family. The generic owner-callback split above that family is tighter now + too: `0x590370` is the shared append-notify lane in mode `0`, while `0x590430` is the distinct + remove-notify-and-stage lane in mode `2`. So `0x595bc0` only owns the live append-style publish + path plus delayed replay modes `3/5`, not the remove path. The neighboring transient work queue + is tighter too: + `0x593330/0x593370/0x593380` now bound `[transport+0x1780]` as a real construct/clear/destroy + collection owner, while `0x5933a0`, `0x5934e0`, and `0x593570` now ground the remove, allocate, + and completion side over that same family. The small sibling `0x593400` is tighter too: it is a + pure uniqueness predicate over work-record field `+0x0c`. Its caller is tighter now too: + `0x58d720` is an immediate-drain quiescence gate over one transport context id, using + `0x593400` for the queued work family at `[transport+0x1780]` and `0x592970` for the active + opcode-record collection at `[transport+0x17fc]`. The strongest current read is that + `0x5934c0` seeds that shared drain context id first, then the transport copies it into queued + work field `+0x0c` and active opcode-record field `+0x14` before the immediate-drain roots wait + on one shared disappearance test rather than one vague “drain until something settles” loop. The + currently grounded roots are `0x58df20`, the neighboring formatted selector-text publish path at + `0x58dfb0`, and callback-table registration at `0x58e200`. The callback-table attach side now + has a tighter active-opcode owner stack too: `0x5927b0` services and retires one active opcode + record, `0x592800` performs the broader context-or-idle retirement sweep, `0x5929a0` removes + active records by opcode type, and `0x5929f0` removes only opcode-`3` field-snapshot records + keyed by the subscribed callback-pair payload. That also corrects `0x595b80`: its final cleanup + is not a queued field-snapshot drain, but an active opcode-type-`3` purge beneath the field + cache reset. + The adjacent route-callback descriptor-table lifecycle is tighter too: `0x590410` now grounds + `[table+0x5bc]` as a real staged intrusive descriptor-list head, `0x590430` is the generic + remove-notify-and-stage path, `0x590490` releases that staged list, and `0x5904d0` releases the + active descriptor collection before tearing the staged list down. That also tightens + `0x5962e0`: its earlier “release active descriptors” step is now explicitly this same + `0x5904d0` family, not a vague collection clear. + The callback-table attach side now + constrains the same work-record metadata family a little further too: `0x593650` deliberately + duplicates one caller metadata dword into both work fields `+0x0c` and `+0x18`, while preserving + the remaining caller callback function pointer in `+0x10`. The lower opcode wrappers are tighter + now too: both `0x592a40` and `0x592a70` consume that staged triplet in the order `( callback fn + +0x10, callback companion +0x18, drain context id +0x0c )`. So the replay-side triplet is + clearly a broader transport callback-wrapper family, not one fixed route-only tuple. The type-`9` + text fastpath confirms the same split from the other side too: `0x593d00` only emits the + follow-on callback lane when work field `+0x10` is nonnull, and then forwards `(+0x10, +0x18, + +0x0c)` into `0x593170` as callback function, callback companion, and trailing drain context. + The nearby field-subscription side is tighter too: `0x592b50` now clearly uses + `[transport+0x1774]` as a cached progress percentage under the `[transport+0xba4]` callback + table, and `0x5962e0` seeds that percentage to `1` just before the first immediate mode-`3` + snapshot. The nearby route-callback-table lifecycle is tighter now too: `0x596090` seeds + `[transport+0xba0]` as the callback-plumbing enable latch, clears staged payload slot + `[transport+0xb50]`, and constructs the three owner branches rooted at `[transport+0xba4]`, + `[transport+0x1164]`, and `[transport+0x18bc]`. The matching local cleanup is tighter too: + `0x5962c0` is the explicit staged route-callback payload clear on `[transport+0xb50]`, while + `0x595ce0` now clearly resets only the capacity-descriptor route callback table at + `[transport+0x1164]`, not the field-subscription table at `[transport+0xba4]`. The only + meaningful gap left on the capacity side is the still-unrecovered writer that stages + `[transport+0x1778]`. The carried sidecar fields are no longer anonymous: current evidence now + says they are just the same cached callback-wrapper triplet reused by other work-record families, + namely drain context id `+0x0c`, callback function `+0x10`, and callback companion `+0x18`. + The negative result is stronger now too: the neighboring replay-band fields + `[transport+0x176c]`, `[transport+0x1770]`, `[transport+0x1774]`, `[transport+0x177c]`, + `[transport+0x1780]`, and `[transport+0x1784]` all have direct local lifecycle owners, but + `[transport+0x1778]` still only appears as the single read in `0x595bc0`. So the remaining + writer is upstream and indirect rather than one ordinary direct field store in the local text + cluster. One adjacent staged-route callback is + tighter now too: `0x595860` is the submit-result handler below + `0x5958e0`, using the already-grounded third selector-generation counter at `[transport+0xac0]` + plus the target at `[transport+0xb48]` to choose whether staged route-callback traffic can + advance the route-mode state machine from mode `2` into `3` and later `4`. The counter beneath + that decision is tighter too: `0x594e30` now reads as a selector-view entry counter for slot `2` + flag bit `0x20`, optionally filtered by the current transport name buffer. The selector-view + mutation side beneath that callback family is tighter too: `0x594a30` is now the direct keyed + store remover, `0x594fb0` clears one selector-slot ownership pointer plus its slot-local flag + dword and drops the whole entry when no slots remain, `0x595010` rekeys one selector-view entry + under a new name while preserving the `0x40..` runtime band, and callback root `0x59f9c0` is now + bounded as the lane that clears one named selector-view slot, publishes callback slot `18`, and + can still re-enter the route-mode setter from the same slot-`2` state and generation gates. The + next adjacent callback roots are tighter now too: `0x5950a0` clears one selector slot from every + selector-view entry in the keyed store, `0x59fab0` is the rename or relabel sibling above + `0x595010`, `0x59faf0` updates one selector slot's fixed sample-text buffer and refreshes the + active selector object when present, and `0x59fb60` replaces one selector slot's name set, + requests the default profile-key bundle for that slot, and publishes callback slot `20`. Slot + `16` is tighter now too: current grounded caller `0x59f440` forwards the staged route-callback + payload handle from `[transport+0xb50]` through `0x592ea0` just before route mode `5`. The last + adjacent callback root in that block is tighter now too: `0x59fbd0` is the built-in + per-slot profile-key query sibling. It resolves the caller selector name into one slot index, + forwards the caller trio into `0x596b90`, and then publishes callback slot `28`; that lower + helper indexes one slot-specific built-in string pair from `[transport+0x189c]` and + `[transport+0x18ac]`, reuses the generic per-key handler `0x596970`, and only republishes slot + `28` when that lower query path succeeds. + The compact-header side is tighter too: `0x58fe20` and `0x58ff20` now show that compact payloads + always carry the primary IPv4 dword and that header bit `0x10` only gates whether the primary + port word is inline or inherited from the owner default port. The variable tails are tighter too: + `0x58fe90` now validates the `0x40` inline keyed-property vector against the owner schema, and + `0x58fe50` validates the signed-`0x80` trailing string-pair tail before decode. `0x58ff60` then + grounds bit `0x02` as the inline secondary IPv4 dword branch, bit `0x20` as the paired + secondary-port word branch with owner-port fallback, bit `0x08` as one still-unresolved + auxiliary inline dword stored at `[descriptor+0x10]`, bit `0x40` as one inline keyed-property + vector decoded through the property-store writers, and signed bit `0x80` as one trailing + string-pair tail. The descriptor-state side is tighter too: queue insertion now cleanly splits + pending tags `0x4/0x8` from serviced-ready bits `0x1/0x2`, and the `gsi_am_rating` lane now + separates direct primary-endpoint handling from queued-descriptor handling. Current evidence now + also says byte `[descriptor+0x14]` is not queue-only: `0x58ff60` can also OR in bit `0x1` after + the inline keyed-property vector and bit `0x2` after the signed string-pair tail. Byte + `[descriptor+0x15]` bit `0x1` is source-side too, not queue-generated: it is explicitly seeded + by the primary-endpoint refresh path and preserved by the compact descriptor decode path before + the transport later uses it in the `gsi_am_rating` lane both to choose direct-vs-queued handling + and to suppress the direct `0x595dc0` transition even after ready bit `0x2` is present. The + descriptor body is tighter too: `[descriptor+0x20]` is now the intrusive next-link used by the + transport-owned primary-endpoint list, and `[descriptor+0x1c]` is now the special numeric scalar + behind the current `queryid`/`ping` fallback pair. The compact-only auxiliary dword at + `[descriptor+0x10]` is tighter in a different way: a local xref scan now shows it being preserved + by later generic preservation helpers such as + `generic_record_0x1c_deep_copy_with_owned_string_at_0x08` `0x591410` and the callback-marshaling + wrappers `0x591480` and `0x591510`, but still no dedicated semantic reader has been recovered. + So the main remaining uncertainty is the exact higher-level meaning of header bit + `[descriptor+0x15] & 0x1`, plus whether `[descriptor+0x10]` ever matters outside that + preservation path. The route-event dispatcher side is cleaner too: + the mode-`5` tails in both callback families do not copy a descriptor-local field. They mirror the + transport-staged companion dword at `[this+0x490]` into `[this+0x54]` and the local field-cache + family instead. The `gsi_am_rating` maintenance lane is tighter now too: it sorts the + primary-endpoint descriptor table through `0x590310` in mode `1` with key `gsi_am_rating`, then + selects the new head through `0x590480` rather than treating the table as pure insertion order. diff --git a/docs/atlas/route-entry-and-trackers.md b/docs/atlas/route-entry-and-trackers.md index 3e52ed7..c34c9b3 100644 --- a/docs/atlas/route-entry-and-trackers.md +++ b/docs/atlas/route-entry-and-trackers.md @@ -65,6 +65,13 @@ Current bounded time-side cutover: delegates through `0x0046a4b0` - the recovered `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` caller pattern now lines up with executable build values `1.03`, `1.04`, `1.05`, and `1.06` +- that makes the tracker cutover read more cleanly too: + `0x004a65b0` is now best treated as a pre-`1.03` versus `1.03+` route-metric compatibility + dispatcher, not as any gameplay-time or era-side mode switch +- the branch source is session-aware too: + when multiplayer state is active, the same cutover can follow the session-side build path rather + than only the local executable version, so mixed-version compatibility is now the strongest + current explanation for why this lower metric split exists at all - nearby callers now make two more compatibility reads concrete: build `1.04+` keeps one `Recycling Plant` stem-specific branch alive inside `0x004101e0`, and build `1.05+` skips one older descriptor-side attenuation fallback in that same rebuild family @@ -120,6 +127,8 @@ What this note is for: Highest-value open edge: -- The remaining semantic edge is why build `1.03+` selects the weighted tracker branch in - `0x004a65b0`, now that the version gate itself is grounded and the linked-transit peer-cache side - is tighter as step count plus normalized continuity share rather than a generic ratio. +- The remaining semantic edge here is narrower now: + whether the pre-`1.03` versus `1.03+` tracker metric split has any meaningful downstream effect + beyond ranked linked-transit site choice and seeded peer-route choice, since current evidence + says the company train-pressure target still sums raw site cache `+0x12` rather than the + weighted lanes fed by step count and continuity. diff --git a/docs/control-loop-atlas.md b/docs/control-loop-atlas.md index f31ef98..5296201 100644 --- a/docs/control-loop-atlas.md +++ b/docs/control-loop-atlas.md @@ -226,7 +226,7 @@ transition. is narrower now too: the entry-side match key `[entry+0x50]` is no longer just an opaque request field. The profile-key callback lanes feed `multiplayer_transport_parse_selector_view_probe_marker`, which decodes one local `X%sX|%d` marker - into a request id plus companion value, and + into a probe request id plus displayed version/build integer, and `multiplayer_transport_arm_selector_view_probe_tracking` stores those into `[entry+0x50]` and `[entry+0x54]` before arming the live probe gate at `[entry+0x58]`. The current-selector callback root at `0x59f8b0` is now bounded as well: it resolves and upserts the active selector name, @@ -248,17 +248,194 @@ transition. `[entry+0x98]`, clears `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, appends the returned sample into the short rolling history at `[entry+0x84..]`, grows the bounded sample-count `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, and then publishes - that averaged sample through `multiplayer_transport_enqueue_callback_slot24_record`. So the - publication boundary is explicit and the request-id ownership is explicit, even though the exact - user-facing meaning of the sample and the companion value at `[entry+0x54]` is still open. The + that averaged `ms` sample through `multiplayer_transport_enqueue_callback_slot24_record`. So the + publication boundary is explicit and the request-id ownership is explicit: `[entry+0x80]` now + reads as the averaged millisecond probe sample and `[entry+0x54]` as the displayed version/build + companion integer. The adjacent route-callback side is tighter too, but it is now kept separate: + the staged route-callback path at `0x5958e0` and the later compatibility gate at + `multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple` `0x595d00` operate + on a compact GameSpy-style server or route descriptor family with a primary endpoint tuple at + `[descriptor+0x00]/[+0x04]`, an optional secondary endpoint tuple at `[descriptor+0x08]/[+0x0c]`, + string-key lookups such as `hostname` and `gamever`, and numeric-key lookups such as + `numplayers`, `numservers`, `numwaiting`, and `gsi_am_rating`. The route-binding side uses that + descriptor family's primary dword and host-order port plus the optional secondary tuple against + route-binding offsets `+0x54/+0x58` and route word `+0x30`. Current evidence still does not prove + that descriptor tuple is the same field family as the selector-view marker companion integer at + `[entry+0x54]`. The higher compact decode owners are tighter now too: `0x5907d0` is the + allocate-and-append lane for one self-consistent compact payload, while `0x590d00` is the keyed + upsert-by-primary-endpoint lane that reuses an existing descriptor when possible and then notifies + the owner callback. The route-callback-table runtime above that decode side is tighter now too: + `multiplayer_transport_route_callback_table_construct` `0x5905e0` seeds one transport-owned + table block, `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary` + `0x5906f0` tears down the decoded schema dictionary rooted at `[this+0x08]`, + `multiplayer_route_callback_runtime_acquire_shared_string_copy` `0x590540` and + `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0` now bound the shared + string pool used by that decoded schema, and the higher bring-up owner `0x596090` now clearly + splits between `[transport+0xba4]` with owner callback `0x595a40`, the local field-cache family + `[transport+0x1724]` seeded through `0x5a08f0/0x595b60`, and `[transport+0x1164]` with owner + callback `0x595bc0`, while + `multiplayer_transport_route_callback_table_service_receive_decode_state_machine` `0x5908c0` + is the current live receive/decode state machine serviced by `0x591290` in table states `2/3`. + The route-handle lifecycle above that decode path is tighter now too: `0x590740` cleanly resets + one table's live route plus decode-side runtime without destroying the outer object; `0x5907a0` + is the broader destroy path that also releases the active descriptor collection; `0x590ed0` + opens the live route handle into `[this+0x4a0]`, stages the initial outbound request, and seeds + state `3` plus the staged receive buffer; `0x5911e0` is the state-`2/3` socket-service wrapper + that reads new bytes, grows the staged buffer, and re-enters `0x5908c0`; `0x5912c0` is the + one-shot send-with-reopen-retry helper; and `0x590ea0` is the shared disconnect publication and + reset tail. The recurring service helper `0x591290` is tighter too: it now first clears the + staged intrusive descriptor list through `0x590490` before entering the state-driven seed-or- + receive branch. The upstream owners are tighter too: `0x5962e0` is now the field-subscription + route-table opener above `[transport+0xba4]`, while `0x596530` is the `gsi_am_rating` reopen + path above `[transport+0x18bc]`. On that latter branch, `0x590dc0` is now bounded as the + state-`0` raw-endpoint seed pass over the live route handle, repeatedly pulling endpoint tuples + through `0x58bc7e` record type `0x1f3` before stamping descriptor flag byte `0x15` with `0x11`. + That makes the remaining source-flag meaning narrower too: current evidence now supports reading + byte-`0x15` bit `0x1` as a primary-endpoint-seed or endpoint-only marker. In the `gsi_am_rating` + dispatcher, clear-bit descriptors can take the richer direct transition lane, while set-bit + descriptors are staged through the queued enrichment path and still suppress that direct + transition even after the ready bit arrives. + The adjacent capacity-descriptor side is tighter too: `0x595bc0` now clearly publishes a + descriptor block from live descriptor properties `hostname`, `numwaiting`, `maxwaiting`, + `numservers`, and `numplayers` plus three carried sidecar scalars. That sidecar at + `[transport+0x1778]` is tighter now too: current evidence says it behaves as one cached pointer + into the transient work-record family at `[transport+0x1780]`, because every meaningful branch + in `0x595bc0` reads the same `+0x0c/+0x10/+0x18` metadata triplet and replay modes later consume + the pointer through `0x5933a0`. The negative result is stronger too: local text-side xrefs still + show no direct store to `[transport+0x1778]`, and a wider local sweep also failed to show any + obvious `lea`-based replay-band writer, so the sidecar writer remains upstream of this leaf + publisher. Mode `0` is now also tied more cleanly to the generic descriptor append-notify lane + at `0x590370`, while mode `2` stays outside this helper as the separate + remove-notify-and-stage path at `0x590430`. The opcode-`2` payload boundary is tighter too: + `0x592ae0` now grounds that payload + as a seven-dword block with an owned string slot at `+0x08`, so live mode supplies a populated + payload while modes `3` and `5` deliberately enqueue an all-zero payload and reuse only + the wrapper-side sidecar metadata. Those two modes are tighter now too: they are the live + receive-state owner callbacks emitted by `0x5911e0 -> 0x5908c0`, not loose generic replay + guesses. So those paths are better read as delayed metadata replays over one cached work record, + not over a separate anonymous cache blob. The neighboring + work queue is tighter too: `0x593330/0x593370/0x593380` now bound `[transport+0x1780]` as the + construct/clear/destroy owner family, while `0x5933a0`, `0x5934e0`, and `0x593570` ground the + remove, allocate, and completion side over that same collection. The small sibling `0x593400` is + tighter too: it is a pure work-record uniqueness predicate over field `+0x0c`. Its caller is + tighter now too: `0x58d720` is an immediate-drain quiescence gate over one transport context id, + using `0x593400` for the queued work family at `[transport+0x1780]` and `0x592970` for the + active opcode-record collection at `[transport+0x17fc]`. The strongest current read is that + `0x5934c0` seeds that shared drain context id first, then the transport copies it into queued + work field `+0x0c` and active opcode-record field `+0x14` before the immediate-drain roots wait + on one shared disappearance test rather than on a vague settle loop. The currently grounded + roots are `0x58df20`, the neighboring formatted selector-text publish path at `0x58dfb0`, and + callback-table registration at `0x58e200`. The active-opcode side is tighter too: `0x5927b0` + now bounds the per-record service-and-retire path, `0x592800` the wider context-or-idle sweep, + `0x5929a0` the remove-by-opcode-type sweep, and `0x5929f0` the narrower opcode-`3` + field-snapshot removal keyed by the subscribed callback-pair payload. That also corrects + `0x595b80`, whose final cleanup is an active field-snapshot purge rather than a queued-work + drain. The adjacent route-callback descriptor-table lifecycle is tighter too: `0x590410` now + grounds `[table+0x5bc]` as the staged intrusive descriptor-list head, `0x590430` is the generic + remove-notify-and-stage lane, `0x590490` releases the staged list, and `0x5904d0` releases the + active descriptor collection before tearing that staged list down. That also makes the earlier + `0x5962e0` “release active descriptors” step explicit. The callback-table attach side now constrains the + same work-record metadata family a little further too: `0x593650` deliberately duplicates one + caller metadata dword into both fields `+0x0c` and `+0x18`, while preserving the remaining + caller callback function pointer in `+0x10`. The lower opcode wrappers are tighter now too: + `0x592a40` and `0x592a70` both consume that staged triplet in the order `( callback fn +0x10, + callback companion +0x18, drain context id +0x0c )`. The producer side is tighter too: + bound-route requests, selector-text route requests, and the type-`9` text fastpath also stage + that same triplet through `0x5934e0`, and the fastpath shim `0x593d00` now gives the cleanest + proof of the callback split by only re-emitting the follow-on lane when `+0x10` is nonnull and + then forwarding `(+0x10, +0x18, +0x0c)` into `0x593170` as callback function, callback + companion, and trailing drain context. So the replay-side triplet is clearly a broader + transport callback-wrapper family, not one fixed route-only tuple. The nearby + field-subscription side is tighter too: `0x592b50` now clearly uses `[transport+0x1774]` as a + cached progress percentage under `[transport+0xba4]`, and `0x5962e0` seeds that percentage to + `1` just before the first immediate mode-`3` snapshot. The nearby route-callback-table + lifecycle is tighter now too: `0x596090` seeds `[transport+0xba0]` as the callback-plumbing + enable latch, clears staged payload slot `[transport+0xb50]`, and constructs the three owner + branches rooted at `[transport+0xba4]`, `[transport+0x1164]`, and `[transport+0x18bc]`. The + matching local cleanup is tighter too: `0x5962c0` is the explicit staged route-callback payload + clear on `[transport+0xb50]`, while `0x595ce0` now clearly resets only the capacity-descriptor + route callback table at `[transport+0x1164]`, not the field-subscription table at + `[transport+0xba4]`. The remaining gap on the capacity side is + therefore narrower: mainly the still-unrecovered writer that stages `[transport+0x1778]`. The + carried sidecar fields themselves now read more cleanly as the cached callback-wrapper triplet + reused elsewhere (`drain context id +0x0c`, `callback fn +0x10`, `callback companion +0x18`), + and the negative result is stronger too: nearby replay-band fields `[transport+0x176c]`, + `[transport+0x1770]`, `[transport+0x1774]`, `[transport+0x177c]`, `[transport+0x1780]`, and + `[transport+0x1784]` all have direct local owners while `[transport+0x1778]` still appears only + as the single read in `0x595bc0`. So the remaining writer looks upstream and indirect rather + than like one missing ordinary field store in the local cluster. The adjacent staged-route + callback side is tighter too: `0x595860` is now bounded as the + submit-result handler beneath `0x5958e0`, and the old `[transport+0xac0]` ambiguity there is now + gone. That branch is using the already-grounded third selector-generation counter at `[0xac0]` + together with target `[0xb48]` to decide whether staged route-callback traffic can push the + multiplayer route-mode ladder from `2` into `3` and later `4`. The selector-view counter beneath + that gate is tighter now too: `0x594e30` counts slot-`2` entries whose flag dword carries bit + `0x20`, optionally filtered by the current transport name buffer. The selector-view mutation + family under that same lane is tighter too: `0x594a30` is now the direct keyed-store remover, + `0x594fb0` clears one selector-slot ownership pointer plus its slot-local flag dword and drops + the whole entry when no slots remain, `0x595010` rekeys one selector-view entry under a new name + while preserving the `0x40..` runtime band, and callback root `0x59f9c0` now reads as the + sibling lane that clears one named selector-view slot, publishes callback slot `18`, and may + still re-enter the route-mode setter from the same slot-`2` status and generation gates. The + neighboring callback roots are tighter now too: `0x5950a0` clears one selector slot from every + selector-view entry in the keyed store, `0x59fab0` is the rename or relabel sibling above + `0x595010`, `0x59faf0` updates one selector slot's fixed sample-text buffer and refreshes the + active selector object when present, and `0x59fb60` replaces one selector slot's name set, + requests the default profile-key bundle for that slot, and publishes callback slot `20`. Slot + `16` is tighter now too: current grounded caller `0x59f440` forwards the staged route-callback + payload handle from `[transport+0xb50]` through `0x592ea0` just before route mode `5`. The + last adjacent callback root in that block is tighter now too: `0x59fbd0` is the built-in + per-slot profile-key query sibling. It resolves the caller selector name into one slot index, + forwards the caller trio into `0x596b90`, and then publishes callback slot `28`; that lower + helper indexes one slot-specific built-in string pair from `[transport+0x189c]` and + `[transport+0x18ac]`, reuses the generic per-key handler `0x596970`, and only republishes slot + `28` when that lower query path succeeds. + The compact-header side is tighter now too: `0x58fe20` and `0x58ff20` now show that compact + payloads always carry the primary IPv4 dword and that header bit `0x10` only gates whether the + primary port word is inline or inherited from the owner default port. `0x58fe90` now validates + the `0x40` inline keyed-property vector against the owner schema, and `0x58fe50` validates the + signed-`0x80` trailing string-pair tail before decode. `0x58ff60` then grounds bit `0x02` as + the inline secondary IPv4 dword branch, bit `0x20` as the paired secondary-port word branch with + owner-port fallback, bit `0x08` as one still-unresolved auxiliary dword stored at + `[descriptor+0x10]`, bit `0x40` as one inline keyed-property vector decoded through the + property-store writers, and signed bit `0x80` as one trailing string-pair tail. The + descriptor-state side is tighter now too: the shared queue helper at + `0x005a09a0` stamps pending state `0x4` for the local field-cache family `[transport+0x1724]` + and pending state `0x8` for the `gsi_am_rating` queued-descriptor family `[transport+0x1e7c]`, + while later service through `0x005a0c80` promotes those pending tags into ready bits `0x1` and + `0x2` in descriptor byte `[entry+0x14]`. That makes the current transport-side tests cleaner: + `0x58d1c0` is the field-cache ready gate, `0x58d1d0` is the `gsi_am_rating` queued-descriptor + ready gate, and `0x58d230` is the remaining flag-byte split between direct primary-endpoint + handling at `[transport+0x18bc]` and the queued path at `[transport+0x1e7c]`. That byte-`0x14` + story is no longer queue-only either: `0x58ff60` can also OR in bit `0x1` after the inline + keyed-property vector and bit `0x2` after the signed string-pair tail. The flag-byte split is no + longer purely behavioral either: current evidence now says byte `[descriptor+0x15]` bit `0x1` is + a source-side descriptor header bit, explicitly seeded during the primary-endpoint table refresh + around `0x590dc0` and preserved by the compact descriptor decode path at `0x58ff60`, rather than + a queue-generated runtime state. The `gsi_am_rating` dispatcher side is tighter too: that same + bit no longer just looks like a direct-versus-queued routing split, because `0x595e10` also uses + it to suppress the direct `0x595dc0` transition even after queued ready bit `0x2` is present. + The descriptor body is tighter too: `[descriptor+0x20]` is now the intrusive next-link used by + the transport-owned primary-endpoint list headed at `[table+0x5bc]`, and `[descriptor+0x1c]` is + now the special numeric scalar behind the current `queryid`/`ping` fallback pair. The compact-only + auxiliary dword at `[descriptor+0x10]` is tighter in a negative way too: local xref scans now + only show it being preserved by later generic helpers like + `generic_record_0x1c_deep_copy_with_owned_string_at_0x08` `0x591410` and the adjacent + callback-marshaling wrappers `0x591480` and `0x591510`, not read through any dedicated semantic + accessor yet. The route-event dispatcher side is tighter too: the mode-`5` tails in both + callback families do not copy a descriptor-local field but instead mirror the transport-staged + companion dword at `[this+0x490]` into `[this+0x54]` and the local field-cache family. The + `gsi_am_rating` maintenance lane is tighter now too: after pruning failed descriptors it sorts + the surviving primary-endpoint table through `0x590310` in mode `1` with key `gsi_am_rating`, + then selects the new head through `0x590480` before re-entering the route-transition path. The same service loop also owns a slower sidecar lane keyed off `[entry+0xa4]`: `multiplayer_transport_select_stale_selector_view_progress_entry` walks the store through `multiplayer_transport_pick_stale_selector_view_progress_entry`, picks one stale entry whose progress latch `[entry+0x9c]` is clear and whose last progress tick `[entry+0x70]` is old enough, and then hands it to `multiplayer_transport_stage_selector_view_progress_snapshot`. That helper - now looks more bounded too: it rebuilds the marker text from `[entry+0x50]` through - `multiplayer_transport_format_selector_view_probe_marker`, formats one `PNG %s %d` line around - that marker and the entry-local selector-view sample at `[entry+0x80]`, appends bounded + now looks more bounded too: it rebuilds the core `X%sX` marker text from `[entry+0x50]` through + `multiplayer_transport_format_selector_view_probe_marker_core`, formats one `PNG %s %d` line + around that marker and the entry-local averaged millisecond sample at `[entry+0x80]`, appends bounded selector-slot `PNG` fragments for live overlapping slots, marks progress-snapshot state in flight at `[entry+0x9c]`, and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. So the selector-view sidecar no longer looks like one undifferentiated @@ -322,7 +499,14 @@ transition. seed to `multiplayer_transport_handle_validated_route_cookie_event` `0x005972c0`. That helper either marks route progress and re-enters `multiplayer_transport_set_route_mode`, or forwards the event id plus payload into the owner callback at `[transport+0x17f0]` with context - `[transport+0x17f8]`. Subtype `6` still validates the same cookie, dedupes one 32-bit cookie or + `[transport+0x17f8]`. The surrounding status-route callback vector is tighter now too: + `0x005970e0` publishes either the active selector text or the averaged probe sample at + `[entry+0x80]` and otherwise falls back to owner callback `[transport+0x17e0]`; + `0x00597180` is a straight owner-forwarding lane through `[transport+0x17e4]`; + `0x005971b0` seeds the local status-control id list and can then notify owner callback + `[transport+0x17e8]`; and `0x00597270` returns the third selector-slot generation counter + `[transport+0xac0]` on its bounded local branch before falling back to owner callback + `[transport+0x17ec]`. Subtype `6` still validates the same cookie, dedupes one 32-bit cookie or packet id, and then dispatches the trailing payload through the natneg-or-raw callback layer rooted at `[route+0xa0]` and `[route+0xa4]`. This separates the shell-frame preview refresh at `0x006cd8d8` from the actual transport cadence at `0x006cd970`, and also separates that transport @@ -505,10 +689,11 @@ transition. resolver is tighter now too: `scenario_state_compute_issue_opinion_multiplier` `0x00436590` is no longer just an abstract issue table lookup because its merger callsite uses issue id `0x3a`, which lines up directly with localized id `726` saying merger votes depend on public attitude toward the - management of the two companies. By contrast the public-support helper - `company_compute_public_support_vote_scalar` `0x00424fd0` uses the broader issue id `0x37`, which - currently looks like a more general company-management or public-sentiment slot rather than the - merger-only attitude term. The supporting stat layer is bounded more cleanly now too: the + management of the two companies. By contrast the broader support-adjusted share-price helper + `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` uses the broader issue + id `0x37`, which currently looks like a more general company-management or public-sentiment slot + rather than the merger-only attitude term. The supporting stat layer is bounded more cleanly now + too: the surrounding `0x0b` setup in the merger and takeover offer builders is formatter mode rather than a player-facing issue number, while the company-side stat wrapper `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` now reads as a generic @@ -1025,8 +1210,10 @@ transition. shared hundredths-scaled build-version query `runtime_query_hundredths_scaled_build_version` `0x00482e00` over `0x006cec74`. The current caller thresholds `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` now line up with executable - build values `1.03`, `1.04`, `1.05`, and `1.06`, so this split is no longer best-read as a - time- or era-side cutover at all. That lower split is tighter now too: + build values `1.03`, `1.04`, `1.05`, and `1.06`, and the version source itself can come from + the multiplayer companion path as well as the local executable, so this split is no longer + best-read as a time- or era-side cutover at all. It now reads more cleanly as a pre-`1.03` + versus `1.03+` route-metric compatibility dispatcher. That lower split is tighter now too: `0x004a5280` is the weighted recursive branch with heuristic ordering, per-tracker best-cost cache `0x006cfcac`, and prune threshold `0x006cfcb0`, while `0x004a5900` is the alternate recursive neighbor-walk branch that stays within compatible component labels through @@ -1137,9 +1324,17 @@ transition. `0x00407bd0` was only revisited on the longer interval. That heavier sibling is now bounded too: `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` no longer looks like a - generic tail refresh. It reuses the fast peer tables, rolls candidate-local service metrics and - peer-route deltas back into three per-site cache floats at `+0x0e`, `+0x12`, and `+0x16`, and - then feeds the neighboring selectors + generic tail refresh. It reuses the fast peer tables, rebuilds candidate-local amount bands plus + normalized issue-opinion scales, and then folds the peer-side route metrics back into three + per-site cache floats with a cleaner split: + `+0x12` is the raw surviving site-score total, + `+0x0e` is the continuity-and-step-weighted companion total, + and `+0x16` is the promoted final site-ranking lane chosen from the strongest grouped candidate + bands. + That also closes most of the cross-version impact question: + the pre-`1.03` versus `1.03+` tracker metric split now looks like it mainly perturbs the weighted + `+0x0e` lane and the promoted `+0x16` lane, not the raw `+0x12` total. + That final lane then feeds the neighboring selectors `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280` and `company_build_linked_transit_autoroute_entry` `0x00408380`. That makes the company-side follow-on read more like a linked-transit autoroute cache family than a generic company maintenance pass. @@ -1160,9 +1355,19 @@ transition. its live roster through `company_count_owned_trains` `0x004264c0`, measure one aggregate linked transit site pressure through `company_compute_owned_linked_transit_site_score_total` `0x00408f70`, and then rebalance that roster through - `company_balance_linked_transit_train_roster` `0x00409950`. Current grounded evidence says that - pass prunes or upgrades older company-owned trains, then fills any remaining deficit by either - packaging multiplayer opcode `0x75` or locally re-entering + `company_balance_linked_transit_train_roster` `0x00409950`. + The aggregate helper no longer reads as a raw sum either: + it starts from the site-cache `+0x12` totals, converts that into one tentative roster target + through year and site-count ladders, and on build `1.03+` adds one special distance-side scaling + branch when exactly two eligible linked transit sites survive. + Because it consumes `+0x12` rather than `+0x0e` or `+0x16`, current evidence now says the tracker + compatibility split is more important for seeded route choice and ranked site choice than for the + final company train-count target itself. + The balancer then applies two age bands to company-owned trains: + very old trains are removed when the roster already exceeds target or upgraded when it still + needs capacity, while the mid-age band can trigger one narrower upgrade pass. + After that it fills any remaining deficit by either packaging multiplayer opcode `0x75` or + locally re-entering `company_try_add_linked_transit_train_and_publish_news` `0x00409830`. The two visible news helpers under it are bounded too: `0x00409830` emits RT3.lng `2896` for a newly added train, while `company_publish_train_upgrade_news` `0x00409300` emits RT3.lng `2897` for the upgrade @@ -1228,12 +1433,15 @@ transition. `company_issue_public_shares_and_raise_capital` `0x00427450`. The threshold side is tighter now too. The earliest creditor-pressure lane requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since `[company+0x163]`, and at least - `4` years since founding year `[company+0x157]`; it then scans the last three years of slots - `0x2b` and `0x2c`, chooses one negative pressure ladder `-600000 / -1100000 / -1600000 / - -2000000` from the current slot-`0x2c` bands around `120000 / 230000 / 340000`, requires public - support at least `15` or `20` depending on whether all three sampled years failed, checks slot - `0x09` against `0.08` times that ladder, and requires the three-year slot-`0x2b` total to clear - one final `-60000` gate before it falls into the bankruptcy commit and RT3.lng `2881` headline. + `4` years since founding year `[company+0x157]`; it then scans the last three years of the + derived net-profits and revenue lanes `0x2b` and `0x2c`, chooses one negative pressure ladder + `-600000 / -1100000 / -1600000 / + -2000000` from the current slot-`0x2c` bands around `120000 / 230000 / 340000`, requires the + broader support-adjusted share-price or public-support scalar at least `15` or `20` depending on + whether all three sampled years failed, checks the current fuel-cost lane in slot `0x09` against + `0.08` times that ladder, and requires the + three-year slot-`0x2b` total to clear one final `-60000` gate before it falls into the + bankruptcy commit and RT3.lng `2881` headline. The middle debt-capital layer is split more clearly now too. With `[+0x4a8b]` clear, one annual bond lane first simulates full repayment through `company_repay_bond_slot_and_compact_debt_table` and then uses the post-repayment cash window with fixed `-250000` and `-30000` thresholds plus @@ -1243,24 +1451,35 @@ transition. suppress it, and `[+0x4a87]` is clear, it starts from one `1000`-share batch, can replace its default `1.0` factor with one linked-chairman personality scalar, scales that by `1.6` when growth setting `1` is active, and then runs one `800000` stock-value gate plus one - support-times-factor-times-`1000`-times-`1.2` affordability gate before the repeated `1000`-share - buyback commits behind RT3.lng `2887`. The ordering above this helper is tighter now too: + support-adjusted-share-price-times-factor-times-`1000`-times-`1.2` affordability gate before the + repeated `1000`-share buyback commits behind RT3.lng `2887`. The ordering above this helper is + tighter now too: `company_service_periodic_city_connection_finance_and_linked_transit_lanes` clears those latches first, runs the city-connection and linked-transit branches, and only then enters the annual finance helper, so these look like same-cycle reaction gates rather than long-lived balance-sheet flags. After the earlier debt or bankruptcy outcomes stay inactive, the later stock-capital lane also - has a bounded first threshold layer: with the bond and stock toggles `[+0x4a8b]` and `[+0x4a87]` - clear, at least two bond slots live, and at least one year since founding, it derives one - 1000-share batch with floor `2000`, requires public support at least `22`, requires the support - times batch product to clear `55000`, and then uses a piecewise approval ladder - `0.07/1.3 -> 0.14/0.35` before the share-issue path proceeds. + has a tighter bounded shape now too: it only opens on build `1.03+`, only after the earlier + bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles + `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since + founding. It derives one issue batch from outstanding shares rounded down to `1000`-share lots + with floor `2000`, trims that batch until the broader support-adjusted share-price scalar times + batch no longer exceeds the `55000` gate, requires that scalar at least `22`, resolves the + highest-coupon live bond slot, and then uses current cash from `0x2329/0x0d` as a gate against + that slot's principal plus a small fixed buffer before it compares the chosen bond-rate lane + against a normalized scalar ratio built from the same support-adjusted share-price lane and + current `Book Value Per Share` from `0x2329/0x1d` through the piecewise approval ladder + `0.07/1.3 -> 0.14/0.35`. On success it issues two + same-sized tranches through repeated `company_issue_public_shares_and_raise_capital` calls and + publishes a separate equity-offering news family rooted at localized id `4053`, not the earlier + debt or buyback headline family. The dividend side is bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be clear, mode `0x0c`, at least `1` year since `[company+0x0d2d]`, and at least `2` years since - founding, then averages the last three years of slot `0x2b`, folds in the unassigned-share pool - and the current `0x0d` band, applies the map-editor building-growth setting `[0x006cec78+0x4c7c]`, - treats growth setting `1` as a `0.66` scale-down and setting `2` as a zeroing pass on the current - dividend, quantizes surviving adjustments in tenths, and finally clamps against + founding, then averages the last three years of the net-profits lane `0x2b`, folds in the + unassigned-share pool and the current `0x0d` band, applies the map-editor building-growth + setting `[0x006cec78+0x4c7c]`, treats growth setting `1` as a `0.66` scale-down and setting `2` + as a zeroing pass on the current dividend, quantizes surviving adjustments in tenths, and + finally clamps against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. The linked-transit route-seeding side has one tighter sibling now too: `company_reset_linked_transit_caches_and_reseed_empty_train_routes` `0x00401940`. It clears the @@ -1507,9 +1726,11 @@ transition. `shell_format_company_financial_summary_card` through `shell_company_detail_render_company_summary_card`, controls `0x947d` and `0x947e` now ground a bond maturity and repay panel through `shell_company_detail_render_bond_maturity_and_repay_panel`, - control `0x9488` now grounds the debt or capital or dividend summary block through - `shell_company_detail_render_capital_and_dividend_summary_panel`, control `0x948a` now grounds the - per-share metrics block through `shell_company_detail_render_per_share_metrics_panel`, and the + control `0x9488` now grounds the debt or credit or rate summary block through + `shell_company_detail_render_debt_credit_and_rate_summary_panel`, control `0x948a` now grounds the + share-value and dividend-payout block through + `shell_company_detail_render_share_value_and_dividend_summary_panel`, while the broader six-row + per-share stock-data family is now bounded under `shell_format_company_stock_data_panel`, and the adjacent territory selector lane is bounded through `shell_company_detail_select_territory_access_row`, `shell_company_detail_render_territory_access_row`, @@ -1523,10 +1744,13 @@ transition. `shell_resolve_chairmanship_takeover_vote_and_commit_outcome`, `shell_present_chairmanship_takeover_vote_outcome_dialog`, `shell_resolve_merger_vote_and_commit_outcome`, and `shell_present_merger_vote_outcome_dialog`. - The remaining company-side uncertainty is therefore narrower than before: the public-support side - is now tighter too because `company_compute_cached_recent_performance_support_score` and - `company_compute_public_support_vote_scalar` bound the recent-performance and public-support blend - beneath those vote resolvers, `scenario_state_compute_issue_opinion_multiplier` now bounds the + The remaining company-side uncertainty is therefore narrower than before: the broader support and + valuation side is now tighter too because + `company_compute_cached_recent_per_share_performance_subscore`, + `company_compute_five_year_weighted_shareholder_return`, and + `company_compute_public_support_adjusted_share_price_scalar` bound the recent per-share + performance and investor-support/share-price blend beneath those vote resolvers, + `scenario_state_compute_issue_opinion_multiplier` now bounds the next layer of optional company, chairman, and territory-specific opinion overrides on the active scenario state, and the broader stat-reader family around `company_read_control_transfer_metric_slot` and @@ -1916,15 +2140,24 @@ transition. weight, `company_query_min_linked_site_distance_to_xy` at `0x00405920` provides the nearest linked-site distance term, `company_count_linked_transit_sites` at `0x00426590` provides one of the company-side caps, `company_compute_connection_bonus_value_ladder` at `0x00425320` supplies - the bounded company-side value scalar, `company_compute_issue39_opinion_bias_scalar` at - `0x00424580` contributes one smaller issue-`0x39` opinion term, + the bounded company-side value scalar, and + `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580` now bounds the + shared prime-rate-side helper that this lane reuses beside the raw issue-`0x39` total, `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` now bounds the raw additive issue-total helper beneath that term, and `company_connection_bonus_lane_is_unlocked` at `0x00427590` is the small boolean gate above the ladder. Wider governance and CompanyDetail xrefs - now tighten slot `0x2b` into a rolling shareholder-facing performance lane reused by annual - shareholder-revolt or creditor-pressure checks and a per-share/history formatter, while `0x09` - remains the narrower current governance-pressure term read after those broader gates. The wider - sibling news owner above the same city-pair route family is bounded now too: + now tighten slot `0x2b` into the rolling net-profits lane reused by annual finance checks and a + per-share/history formatter, while the report-history descriptor table now aligns raw slot `0x09` + with the Income Statement fuel-cost lane surfaced by tooltip `1309`. The wider result now reads + more like recent net profits minus recent fuel burden than a governance-pressure term. That now + also sharpens the annual finance lane at `0x00401c50`: the first bankruptcy branch reads as + sustained cash-and-debt stress over recent profits and fuel burden, the later fallback branch as + a deeper `-300000` cash / three bad years cleanup trigger, and the later stock-issue branch reads + as a price-to-book-versus-coupon approval ladder rather than a generic support vote. The tail is + cleaner now too: it compares total retired versus newly issued principal to choose the `2882..2886` + debt headline family, then publishes `2887` separately from the accumulated repurchased-share + count. The sibling news owner above the same + city-pair route family is bounded now too: `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` filters and scores candidate city entries, re-enters the same shared heavy builder through `city_connection_try_build_route_between_region_entry_pair` `0x00404c60` for the dense pair