From 7b44279d7e834c303cb9f86d30bf7562d678fc6e Mon Sep 17 00:00:00 2001 From: Jan Petykiewicz Date: Mon, 13 Apr 2026 23:35:17 -0700 Subject: [PATCH] Extend atlas seam annotations across load/save and transport --- artifacts/exports/rt3-1.06/function-map.csv | 280 ++++-- docs/control-loop-atlas/editor-breadth.md | 140 ++- .../map-and-scenario-content-load.md | 145 ++- .../multiplayer-session-and-transport-flow.md | 180 ++-- ...tion-paintterrain-and-save-load-restore.md | 881 ++++++++++++++++-- ...ntime-roots-camera-and-support-families.md | 52 +- .../station-detail-overlay.md | 102 +- 7 files changed, 1450 insertions(+), 330 deletions(-) diff --git a/artifacts/exports/rt3-1.06/function-map.csv b/artifacts/exports/rt3-1.06/function-map.csv index 4e061d3..6577f3f 100644 --- a/artifacts/exports/rt3-1.06/function-map.csv +++ b/artifacts/exports/rt3-1.06/function-map.csv @@ -1,5 +1,6 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,confidence,notes,verified_against 0x004010f0,521,city_compute_connection_bonus_candidate_weight,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Computes one city-side weight for the connection-bonus news and placement lanes. The helper rejects early when the city subtype field `[this+0x23e]` is nonzero, then builds a base float from the city-side scalar fields `[this+0x306]`, `[this+0x30a]`, and `[this+0x30e]`. When the optional stack company id is nonzero it also resolves the city's derived coordinates through `0x00455800` and `0x00455810`, probes the live world root at `0x0062c120` through `0x0044e270`, and rejects the city unless the selected company passes the follow-on world-side ownership or access check through `0x00424010`. The helper then scans the live placed-structure collection at `0x006cec20`, filters peers through `0x0041f6e0` plus the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, counts qualifying linked sites in the city, and detects whether one rival company already has an eligible linked site there. The final weight is scaled down by the inverse of `(qualifying_site_count + 1)` and then further damped when rival ownership is present, so the current grounded meaning is a city connection-bonus opportunity weight rather than a simple population or size score. Current grounded callers are the company-side news sweep at `0x00406050` and one neighboring setup-side branch at `0x00404d90`.","objdump + caller xrefs + callsite inspection + city-bonus correlation" +0x004013f0,177,world_run_company_start_or_city_connection_chooser_with_region_field_0x2d_temporarily_cleared_if_rule_0x4b07,map,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small world-side wrapper above the broader chooser `0x00404ce0`. When scenario slot `[0x006cec78+0x4b07]` is nonzero, the helper walks all `0x18` live region records in `0x006cfc9c`, snapshots dword `[region+0x2d]` into one stack buffer, and temporarily zeros that field across every live entry. It then runs `0x00404ce0(1, 0, 0)` and restores the original `[region+0x2d]` values before returning the chooser result. Current grounded caller is the startup-side branch at `0x00407592`, and current atlas correlation ties slot `0x4b07` to the editor rule `AI Ignore Territories At Startup`, so this is the safest current read for the temporary territory-field suppression wrapper rather than a generic region iterator.","llvm-objdump + local disassembly + caller correlation + region-collection correlation + scenario-rule correlation" 0x004014b0,1194,company_try_buy_unowned_industry_near_city_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Company-side acquisition and headline helper beneath the broader periodic company service pass at `0x004019e0`. The function requires at least two linked transit sites through `company_count_linked_transit_sites` `0x00426590`, rejects when scenario finance toggle `[0x006cec78+0x4abf]` is set, and then scans the live building or structure collection at `0x0062b26c` for the best current acquisition target. Current grounded candidate filters are: the record must not already have an owner in `[site+0x276]`, its linked candidate subtype gate through `0x0040d360` must identify subtype `4`, the company-specific price or affordability metric from `0x0040d540` must stay below the current company metric window, and the record must be at least three years old from `[site+0x3d5]`. Surviving candidates are scored through local profitability or demand helpers around `0x0040cac0`, `0x0042c820`, `0x00455f60`, and the current company support scalar, and the best surviving site id is then committed through `0x004269b0`. On success the helper localizes the acquired structure type through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`, resolves the nearby city or region entry through `0x004220b0`, and emits RT3.lng `2880` `%1 has bought a %2 near %3` through the shell news helper at `0x004554e0`. This is now the strongest current match for the acquisition-side sibling beneath the broader company periodic pass, though some lower structure-side helper semantics remain open.","objdump + callsite inspection + RT3.lng strings + acquisition-news correlation + structure-scan correlation" 0x00401860,221,company_query_cached_linked_transit_route_anchor_entry_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns one cached route-entry anchor id used by the linked-transit company cache family. The helper first validates the cached id at `[this+0x0d35]` against the live route-entry collection `0x006cfca8`, requiring the resolved record to carry this company id in word `[entry+0x22e]` and byte value `2` in `[entry+0x216]`; otherwise it clears the cache to `-1`. When the cache is empty but the three company-side count lanes `[this+0x7664]`, `[this+0x7668]`, and `[this+0x766c]` still sum positive, it scans the route-entry collection for the first record that satisfies those same owner and class predicates and then caches the record's linked anchor id from `[entry+0x202]`. Current grounded caller is `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`, where the returned route-entry id is used as the company-side anchor for the narrower linked-transit reachability gate.","objdump + caller xrefs + callsite inspection + route-entry-anchor correlation" 0x00401940,152,company_reset_linked_transit_caches_and_reseed_empty_train_routes,simulation,thiscall,inferred,objdump + callsite inspection + linked-transit correlation,2,"Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep.","objdump + callsite inspection + linked-transit correlation + train-route-reset correlation" @@ -28,8 +29,16 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00426590,135,company_count_linked_transit_sites,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps.","objdump + caller xrefs + callsite inspection + connection-bonus count correlation" 0x00427590,47,company_credit_rating_score_meets_threshold_5,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate over the bounded company credit-rating score at `0x00425320`. The helper rejects immediately when scenario-state flag `0x006cec78+0x4a8b` is set or when the company-side count or age-like field `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument credit-rating score and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the neighboring branch around `0x004064a9`, so this is currently safest as a small reusable threshold gate over the same debt-market or company-strength score rather than a dedicated shell-only bond predicate.","objdump + caller xrefs + callsite inspection + credit-rating correlation + threshold-gate correlation" 0x00409e80,192,world_set_selected_year_and_refresh_calendar_presentation_state,simulation,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-side year setter beneath the periodic step family and the later world-entry staged-profile rehydrate band. The helper stores the caller-supplied selected absolute calendar counter at `[this+0x15]`, resolves the paired mixed-radix calendar-point tuple through `0x0051d460` into `[this+0x0d/+0x11]`, recomputes several derived year-fraction or presentation scalars rooted at `[this+0x0bfa]`, refreshes the live shell controller at `0x006d4024` through `0x0051f070`, `0x00527c70`, and `0x00527c20`, and updates the controller's cached doubled-year field at `[controller+0x2c]`. When the unpacked year field at `[this+0x0d]` actually changes it also re-enters `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`. Current grounded callers are the smaller periodic-step wrapper at `0x0040a150`, the larger simulation-advance family through `0x0040a590/0x0040ab50`, and the late staged-profile rehydrate lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared selected-year/calendar refresh helper rather than a one-off world-entry setter.","objdump + caller inspection + local disassembly + periodic-step correlation + world-entry rehydrate correlation + year-bucket-companion correlation + calendar-counter model correlation" -0x0040a590,892,simulation_service_periodic_boundary_work,simulation,cdecl,inferred,objdump + analysis-context,3,"Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.",objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation +0x0040a590,892,simulation_service_periodic_boundary_work,simulation,cdecl,inferred,objdump + analysis-context,3,"Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. The pre-recipe scalar seam is tighter here now too: after the year and threshold refresh strip, the helper derives one bounded bucket from the selected-year gap `[world+0x0d] - [world+0x05]`, reads the corresponding float from the five-slot table `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, applies the later bucket-specific scale cuts, adds one fixed bias, and multiplies the running scalar `[world+0x0bde]` by that result before it refreshes the live company and profile collections. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.",objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation + pre-recipe-scalar-table correlation 0x0040ab50,339,simulation_advance_to_target_calendar_point,simulation,cdecl,inferred,objdump + analysis-context,3,"Advances the active world state toward one caller-selected mixed-radix calendar target while guarded by the recursion counter at `0x0062b240`. The helper compares the current local calendar-point tuple fields `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and `[this+0x14]` against a target resolved through `0x0051d550` and `0x0051d5f0`, then either recurses in larger `0x168`-sized chunks or advances through the smaller periodic step family rooted at `0x00409e80` and `0x0040a9c0`. Current tuple evidence now bounds this as the same mixed-radix counter family used by `0x0051d3c0/0x0051d460`: a packed year-plus-subfield calendar point rather than a plain year or month-only target. Each successful step notifies the live world root at `0x0062c120` through `0x00450030`. Grounded callers include the frame-time accumulator at `0x00439140`, the larger fast-forward helper at `0x00437b20`, and one shell UI command path.","objdump + analysis-context + caller xrefs + calendar-counter model correlation" +0x0040aeb0,79,support_collection_construct_seed_counters_and_clear_large_sideband,map,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the support family later published at `0x0062b244`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0, initial_slots=5, growth=0x0a, id_base=0)`, installs vtable `0x005c8a0c`, clears the large sideband rooted at `[this+0x90]`, seeds `[this+0x8c] = 0x270f` and `[this+0x88] = 0`, and then tails into `0x0040acb0` for the remaining local initialization. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting object is stored into global `0x0062b244`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" +0x0040af00,146,support_collection_release_entry_and_decrement_world_type_counters,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly + field xrefs,3,"Per-entry release helper beneath the support collection rooted at `0x0062b244`. After resolving the live entry through `0x00518140`, the helper uses entry byte `[entry+0x261]` to choose which live world counter to decrement: nonzero entries decrement `[0x006cec78+0x4c9e]`, zero entries decrement `[0x006cec78+0x4c9a]`. Both counters are then clamped back to nonnegative. When the released entry matches the active world-view side subject at `[0x0062be68+0x60]`, the helper clears that focus through `0x004349f0(0, 0)` before releasing the entry's local runtime through `0x004584e0` and erasing it from the collection through `0x00518a30`. Current grounded caller is `support_collection_release_entries_and_collection_storage` `0x0040b720`, which uses this as the collection-side release callback on old-world teardown.","objdump + world-shutdown correlation + local disassembly + field xrefs + support-entry-release correlation" +0x0040b010,77,support_collection_find_first_live_entry_matching_stem_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small support-collection lookup helper over the fixed sideband at `[this+0x90]`. The helper scans up to `0x20` live `0x5c`-byte sideband rows, compares the caller-supplied zero-terminated stem against each row through `0x005a57cf`, and returns the first matching entry id by tail-calling `support_collection_allocate_entry_from_sideband_slot` `0x0040afa0` with the matching slot index. When no sideband row matches it returns `0`. Current grounded callers are the two goose-side owners `0x0040b0b0` and `0x0040b2d0`, both of which query the stem literal at `0x005c8a2c` `goose`.","objdump + caller inspection + local disassembly + sideband-layout correlation + stem-literal correlation" +0x0040b0b0,540,support_collection_try_spawn_goose_entry_in_primary_counter_lane,map,thiscall,inferred,objdump + caller inspection + local disassembly + stem-literal correlation,3,"Periodic support-entry owner beneath `simulation_advance_to_target_calendar_point` `0x0040ab50`. The helper rejects when scenario gate `[0x006cec78+0x46c38]` is live, derives one year-bucket quota from current year `[0x006cec78+0x0d]`, optionally scales that quota down for larger map areas from `[0x0062c120+0x2155/+0x2159]`, and then refuses to continue when the current live primary counter `[0x006cec78+0x4c9a]` already exceeds that quota. It next walks the collection sideband and selects the strongest empty `goose` row whose year window admits the current year, using one random threshold branch before the final choice. On success it materializes a live entry through `support_collection_allocate_entry_from_sideband_slot` `0x0040afa0`, increments `[0x006cec78+0x4c9a]`, seeds one world-space triplet from the selected entry through `0x00455800`, `0x00455810`, `0x0051b700`, and `0x00518de0`, and then forwards the finished local payload into the runtime-object collection at `0x006acd34` through `0x004554e0`. Current grounded caller is the year-step branch at `0x0040ab04`, where this owner runs beside the selector sibling `0x0040b2d0` and the collection-wide entry service pass `0x0040b060`.","objdump + caller inspection + local disassembly + stem-literal correlation + year-window correlation + counter-field correlation" +0x0040b2d0,675,support_collection_select_or_spawn_goose_entry_id,map,thiscall,inferred,objdump + caller inspection + local disassembly + command-caller correlation,3,"Selector-side sibling of `support_collection_try_spawn_goose_entry_in_primary_counter_lane` `0x0040b0b0`. The helper first rejects under the same scenario gate `[0x006cec78+0x46c38]`; when the caller-supplied force flag is clear it additionally requires live counter `[0x006cec78+0x4c9e] <= 0x60` and one random float branch against the caller-supplied threshold. It then resolves the first live `goose` sideband row through `support_collection_find_first_live_entry_matching_stem_string` `0x0040b010`, increments `[0x006cec78+0x4c9e]`, derives one world-space triplet and heading window from the created entry, and returns the selected live support-entry id to the caller after seeding the same runtime-object follow-on family. Current grounded callers are the shell focus command `shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0` `0x00441360`, the matching command-registration branch at `0x0046461d`, and the periodic year-step lane at `0x0040ab12`, so this is the strongest current read for the support-side selector or spawn owner that feeds shell focus and open commands rather than a pure periodic spawner.","objdump + caller inspection + local disassembly + command-caller correlation + stem-literal correlation + counter-field correlation" +0x0040b5d0,199,support_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load sibling for the support family rooted at `0x0062b244`. The helper reads tagged sections `0x2af9/0x2afa/0x2afb` through repeated `0x00531360` calls, refreshes the collection-side metadata through `0x00518680`, and then walks every live entry, dispatching each record through entry vtable slot `+0x40` with the active bundle handle before closing the final tag. Current grounded callers are the world-entry runtime bringup strip `0x00443a50` and the neighboring tagged world-load family, where this support collection is rehydrated beside the region, territory, and event managers.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation" +0x0040b6a0,118,support_collection_serialize_tagged_records_into_bundle,map,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save sibling for the support family rooted at `0x0062b244`. The helper opens the three tagged sections `0x2af9/0x2afa/0x2afb` through repeated `0x00531340` calls, serializes the collection payload through `0x00517d90`, and then walks every live entry, dispatching each record through entry vtable slot `+0x44` with the active bundle handle before closing the final tag. Current grounded caller is `shell_map_file_world_bundle_coordinator` `0x00445de0`, which emits this family in the fixed package-save order.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation" +0x0040b720,59,support_collection_release_entries_and_collection_storage,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,3,"Release-side companion to `support_collection_construct_seed_counters_and_clear_large_sideband` `0x0040aeb0`. The helper reinstalls vtable `0x005c8a0c`, walks all live entries, releases each one through `0x0040af00`, re-enters `0x00518600`, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation + live-entry-release sweep" 0x0040c950,18,placed_structure_construct_concrete_specialization_vtable_5c8c50,map,thiscall,inferred,objdump + allocator caller correlation + constructor chain inspection,2,"Small constructor thunk used by the shared placed-structure allocator `0x004134d0`. The helper first re-enters `0x0045b680`, which seeds the common placed-structure base table `0x005cb4c0`, clears the derived field band `[this+0x23a..+0x26a]`, and re-enters the older base initializer `0x00455610`; it then installs the concrete placed-structure specialization table `0x005c8c50` and returns `this`. Current grounded callers are the live allocator path at `0x004134d0` and the temporary stack-object path at `0x00413363`, so this is the safest current read for the concrete placed-structure constructor thunk beneath the shared placement family rather than a standalone helper object constructor.","objdump + allocator caller correlation + constructor chain inspection + vtable install correlation" 0x0040c970,11,placed_structure_reset_concrete_specialization_to_base_vtable_5cb4c0,map,thiscall,inferred,objdump + allocator caller correlation + destructor chain inspection,2,"Small cleanup or destructor-style thunk paired with `0x0040c950`. The helper briefly reinstalls the concrete specialization table `0x005c8c50`, then immediately tails into `0x0045b040`, which demotes the record back to the common base table `0x005cb4c0` and re-enters the base cleanup path `0x00455650`. Current grounded callers are the stack-object teardown sites at `0x00413363` and `0x0041353a`, both immediately before freeing or unwinding the temporary placed-structure object, so this is the safest current read for the specialization-to-base cleanup thunk rather than another constructor.","objdump + allocator caller correlation + destructor chain inspection + vtable demotion correlation" 0x0040c980,5,placed_structure_serialize_concrete_specialization_payload_via_0x45b560,map,thiscall,inferred,objdump + vtable scan + serializer chain inspection,2,"Tiny serializer thunk in the concrete placed-structure specialization table `0x005c8c50`. The helper simply tails into `0x0045b560`, which first re-enters the common base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1/0x5dc2` over fields `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. This is the safest current read for the specialization-side serializer entry rather than an independent data-writer.","objdump + vtable scan + serializer chain inspection" @@ -58,6 +67,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0040d1b0,56,placed_structure_release_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Release-side companion to `0x0040d170`. The helper resolves the same candidate chain from cached stem id `[this+0x3cc]`, reads dword flag `[candidate+0x4b]`, and when that flag is nonzero tail-calls `placed_structure_specialization_release_primary_transient_handle_and_siblings` `0x0045c3c0`; otherwise it returns immediately. Current evidence grounds this as the candidate-flag-gated release hook for the primary specialization transient rather than a generic cleanup entry.","objdump + local disassembly + candidate-flag correlation + transient-release correlation" 0x0040d1f0,23,placed_structure_resolve_linked_peer_record_from_cached_site_id,map,thiscall,inferred,objdump + local disassembly,3,"Tiny cached-record resolver over linked site id `[this+0x2a8]`. When that id is nonzero the helper resolves and returns the linked placed-structure record through collection `0x006cec20`; otherwise it returns null. Current grounded callers include the contextual status publisher `0x0040e4e0` and the linked-anchor service family, so this is the safest current read for the direct linked-peer resolver rather than another boolean gate.","objdump + local disassembly + linked-peer resolver correlation" 0x0040d210,26,placed_structure_resolve_owner_record_from_cached_owner_id,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over owner id `[this+0x276]`. When that id is nonzero the helper resolves and returns the corresponding record through collection `0x0062be10`; otherwise it returns null. Current local callers sit on the UI-facing specialization side near `0x0040e9d0`, so the safest current read is one direct owner-record resolver rather than a wider ownership test.","objdump + local disassembly + owner-resolver correlation" +0x0040dc40,1047,placed_structure_validate_station_detail_aux_candidate_action_and_optionally_apply_linked_site_mutation,map,thiscall,inferred,objdump + local disassembly + caller correlation + callsite inspection,4,"World-side validator and optional commit owner beneath the lower `StationDetail.win` action band. The helper first requires the current linked peer id `[this+0x2a8]` to resolve and pass `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, then resolves the auxiliary candidate id from `0x0062b2fc`, the linked candidate root from `0x0062b268`, and computes one projected float cost scalar from candidate field `[candidate+0x22]`, the current owner company at `[this+0x276]`, current site coordinates through `0x00455800/0x00455810`, world scalar query `0x0044ad60`, and scenario-side scale owner `0x00436590(0x3b, ...)`. When the caller supplies the optional float out-pointer, that scalar is returned there. When the caller supplies the optional notice sink and the current owner company exists, the helper compares that scalar against company metric `(0x0d, 0x2329)` through `0x0042a5d0`; on failure it formats localized notice `0x0b52` through `0x005193f0` and returns failure without mutating local runtime state. The success-side path is tighter too: it derives projected offsets from the linked peer through `0x0047df30/0x0047df50`, materializes a packed projected cell list through `0x00417840`, replays that list into compact-grid mode `2` around `placed_structure_validate_projected_candidate_placement` `0x004197e0`, and then restores the temporary compact-grid bits through `0x004142c0/0x004142d0`. When placement fails it returns false; when placement succeeds and the optional notice sink is null it commits the linked-site mutation through `0x0040d1f0`, `0x00480710`, transient teardown or rebuild `0x0045b160/0x0045b9b0`, display-name or source refresh `0x00455750/0x0040cd70`, and local-runtime record rebuild `0x00418be0`, then posts the signed scalar into the owner company through `0x0042a040` and accumulates the running total in `[this+0x27a]`. Even on the validate-only path it still republishes the linked site anchor through `0x0040d1f0 -> 0x00480710` when the caller requested the confirmation-modal preview branch. Current grounded caller is the lower action dispatch inside `shell_station_detail_window_handle_message` `0x00505e50`.","objdump + local disassembly + caller correlation + callsite inspection + affordability-notice correlation + projected-placement correlation + linked-site-mutation correlation" 0x0040d230,60,placed_structure_has_linked_station_or_transit_peer,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean linked-peer gate over one placed structure. The helper first requires the placed-structure vtable `+0x70` latch, then resolves optional linked site id `[this+0x2a8]` through the live placed-structure collection `0x006cec20`, and finally re-enters `placed_structure_is_station_or_transit_site_class` `0x0047fd50` on that linked peer. Current local callers include the broader `cargo id 0` bypass family and several neighboring linked-site maintenance branches, so this is the safest current read for the narrower linked-peer station-or-transit gate rather than a cargo-reference helper.","objdump + caller xrefs + local disassembly + linked-peer gate correlation" 0x0040d2d0,128,placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Linked-peer visual or state refresh beneath the broader placed-structure rebuild family. The helper first re-enters placed-structure vtable `+0x54` with stack argument `0`, then requires scenario latch `[0x006cec78+0x4ae7]`, the placed-structure vtable `+0x70` linked-site-capable latch, and the narrower linked-peer class gate `0x0047fd50` over optional linked site id `[this+0x2a8]`. When the resolved linked peer carries nonzero byte `[peer+0x5bc]`, it re-enters placed-structure vtable `+0x58` on the current site with literal arguments `(0x5f, 0x5f, 0xff)`. Current grounded caller is `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, so this is the safest current read for a linked-peer-dependent overlay or status refresh rather than a cargo-side helper.","objdump + caller xrefs + local disassembly + linked-peer flag correlation" 0x0040d350,16,placed_structure_query_linked_instance_candidate_flag_byte_b9,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Tiny linked-instance candidate-field accessor adjacent to the linked-site helpers. The helper resolves one linked instance through `0x0047de00`, follows that instance's vtable `+0x80` owner chain, and returns signed candidate byte `[candidate+0xb9]`. Current grounded caller is the collection-side subtype-`4` sweep `0x00413b40`, where the returned byte is only tested against zero, so the note stays deliberately raw rather than overnaming candidate byte `0xb9`.","objdump + local disassembly + caller correlation + candidate-byte-field correlation" @@ -101,8 +111,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00419200,41,world_grid_query_projected_rect_scratch_cell_dword_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Tiny projected-rectangle scratch-bank getter over the temporary dword cell-value bank rooted at `0x0062b300`. When that bank exists, the helper flattens the caller-supplied cell coordinates through live world width `[0x0062c120+0x2155]` and returns the corresponding dword from the bank; otherwise it returns `0`. Current grounded caller is the later world-side branch at `0x0048af99`, which uses the returned nonzero test as one score or gating input, so this is the safest current read for the projected-rect scratch-cell dword getter rather than another permanent world-grid query.","objdump + caller xrefs + local disassembly + projected-rect correlation + scratch-bank correlation" 0x0041ab50,6,city_database_entry_constant_38_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" 0x0041ab60,6,city_database_entry_constant_34_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence does not justify a higher semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" -0x0041ab70,5,city_database_entry_load_tagged_payload_via_0x45c6f0,map,thiscall,inferred,objdump + vtable correlation + local disassembly,2,"Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `map_load_city_database` `0x00474610` iterates its loaded records and dispatches vtable slot `+0x44`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot.","objdump + vtable correlation + local disassembly + city-database loader correlation" -0x0041ab80,127,city_database_entry_refresh_named_handle_and_return_scaled_primary_float,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle is still open, but the owning family now aligns structurally with the city-database collection loaded by `0x00474610`.","objdump + caller inspection + local disassembly + city-database family correlation" +0x0041ab70,5,city_database_entry_load_tagged_payload_via_0x45c6f0,map,thiscall,inferred,objdump + vtable correlation + local disassembly,2,"Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540` iterates its loaded records and dispatches vtable slot `+0x40`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot.","objdump + vtable correlation + local disassembly + city-database loader correlation" +0x0041ab80,127,city_database_entry_refresh_named_handle_and_return_scaled_primary_float,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle is still open, but the owning family now aligns structurally with the city-database collection refreshed by `0x00474540` and serialized by `0x00474610`.","objdump + caller inspection + local disassembly + city-database family correlation" 0x0041ac00,3,city_database_entry_false_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041ac10,3,city_database_entry_false_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" 0x0041ac20,3,city_database_entry_false_stub_vtable_5c9750_slot2,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Third tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly" @@ -126,15 +136,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0041f8d0,55,world_region_clear_linked_structure_site_chain_from_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small chain-clear helper over region cached head word `[region+0x383]`. Starting from that `u16` head id, the helper repeatedly resolves each live placed-structure record through collection `0x0062b26c`, follows link word `[site+0x270]`, and clears both `[site+0x26e]` and `[site+0x270]` on every traversed record until the chain reaches zero. Current grounded caller is the release-side helper `0x00420670`, which uses this pass immediately before tailing into base cleanup `0x00455d20`.","objdump + caller xrefs + local disassembly + region-link-chain correlation" 0x0041f910,46,runtime_object_query_mode_gate_or_flag_byte_0x42_when_class0,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query adjacent to the sibling runtime-object family. It first checks shell mode gate `0x004338c0` on the active scenario root `0x006cec78`; when that gate is inactive it returns literal `1`. When the gate is active it also returns `1` for nonzero class dword `[this+0x23e]`, and only on the class-0 path does it return byte `[this+0x42]`. This keeps the current note structural around the mode-gated runtime-flag query rather than overnaming the flag itself.","objdump + local disassembly + mode-gate correlation + field inspection" 0x00412af0,117,indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small indexed-collection lookup by casefolded name. The helper walks the live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the first byte of the caller string against entry field `[entry+0x04]` after normalizing both through `0x0051d660`, and then falls back to full string comparison through `0x005a57cf`. On the first exact match it returns that live entry id; otherwise it returns `0`. Current grounded caller is `0x00412b70`, which uses it over the structure-candidate pool `0x0062b268`.","objdump + local disassembly + caller correlation + collection-name-lookup correlation" -0x00412b70,35,indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small resolve-by-name wrapper over `indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04` `0x00412af0`. It searches the current collection for the caller-supplied casefolded name, and when a live id is found it resolves and returns the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`; otherwise it returns null. Current grounded callers are the region-profile helpers `0x0041f940` and `0x0041f9b0`, where it resolves structure-candidate records from region-profile labels against the global candidate pool `0x0062b268`.","objdump + local disassembly + caller correlation + collection-name-lookup correlation" +0x00412b70,35,indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small resolve-by-name wrapper over `indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04` `0x00412af0`. It searches the current collection for the caller-supplied casefolded name, and when a live id is found it resolves and returns the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`; otherwise it returns null. Current grounded callers are the region-profile helpers `0x0041f940` and `0x0041f9b0`, where it resolves structure-candidate records from region-profile labels against the global candidate pool `0x0062b268`, plus the `.smp` restore lane inside `world_load_saved_runtime_state_bundle` `0x00446d40`, where each restored named candidate-availability record is kept only when its copied stem survives the fixed built-in rejects and resolves back into that same live candidate pool.","objdump + local disassembly + caller correlation + collection-name-lookup correlation + restore-side-name-validation correlation" 0x00412ba0,32,structure_candidate_collection_remove_entry_by_id_release_runtime_descriptor_tables,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small collection-side removal helper for the live structure-candidate pool. It resolves the caller-supplied candidate id through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, releases that candidate's dependent runtime descriptor and cargo-membership tables through `structure_candidate_release_runtime_descriptor_and_cargo_membership_tables` `0x00411cb0`, and then removes the id from the collection through `0x00518a30`. Current grounded callers sit in the same candidate rebuild and load strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow remove-and-release sibling for runtime-backed candidate records rather than a generic collection erase helper.","objdump + local disassembly + caller correlation + candidate-runtime-release correlation" -0x00412bd0,56,structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live structure-candidate pool that simply re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes each candidate's runtime cargo-membership tables and scaled rate bands from the already-materialized `0xbc` descriptor strip. Current grounded callers sit in the same rebuild and load family as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side cargo-summary rebuild sibling rather than a broader scenario projection owner.","objdump + local disassembly + caller correlation + cargo-summary-sweep correlation" +0x00412bd0,56,structure_candidate_collection_rebuild_cargo_membership_tables_counts_and_scaled_rate_bands_for_all_live_records,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live structure-candidate pool that simply re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes each candidate's two compact cargo-membership tables at `[candidate+0x79c/+0x7a0]`, the paired counts at `[candidate+0x7a4/+0x7a8]`, and the scaled runtime rate band at `[candidate+0xa1..+0xb8]` from the already-materialized `0xbc` descriptor strip. Current grounded callers sit in the same rebuild and load family as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side cargo-summary rebuild sibling rather than a broader scenario projection owner.","objdump + local disassembly + caller correlation + cargo-summary-sweep correlation + candidate-table-field correlation" 0x00412c10,144,structure_candidate_collection_refresh_named_availability_latch_0x7ac_and_tail_into_cargo_economy_filter_refresh,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide refresh of candidate availability latch `[candidate+0x7ac]` beneath the startup and editor availability family. When scenario state `0x006cec78` exists, the helper walks every live candidate through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Candidates whose paired availability bytes `[candidate+0xba]` or `[candidate+0xbb]` are already nonzero, or whose subtype byte `[candidate+0x32]` is not `2`, are forced to `[candidate+0x7ac] = 1`. The remaining subtype-`2` candidates query the scenario-side named availability table through `scenario_state_query_named_candidate_availability_record_value` `0x00434ea0` using the candidate stem at `[candidate+0x04]`, and store that returned override bit into `[candidate+0x7ac]`. When the live structure collection `0x0062ba8c` exists, the helper then tails into `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`, so the strongest current read is one candidate-availability refresh followed immediately by the dependent cargo-economy filter rebuild. Current grounded caller is `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`, and the same startup-side candidate filter family later writes the same latch.","objdump + local disassembly + caller correlation + named-availability correlation + cargo-economy-followon correlation" 0x00412fb0,561,structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Broader collection-load owner for the live structure-candidate pool rooted at `0x0062b268`. The helper opens one repeated tagged import source around the fixed stem `0x005c93fc` through the callback trio at `0x005c8190/0x005c8194/0x005c819c`, allocates or resolves each live candidate id through collection vtable slot `+0x04`, and then re-enters `structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state` `0x004120b0` for every imported record. After the per-record loop it reprojects the scenario-side recipe runtime back into the same pool through `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, reruns the stem-policy sweep `0x00412ab0`, clears the collection aggregate quintet `[this+0x8c..+0x9c]`, and then accumulates the subtype-`3` record summary lanes `[candidate+0x8d/+0x91/+0x95/+0x99/+0x9d]` back into that collection-level band. A later fixed name-catalog sweep is tighter now too: for every non-subtype-`1` candidate whose availability bytes `[candidate+0xba]` and `[candidate+0xbb]` are both zero and whose live id stays within `0x6e`, the helper localizes the candidate stem at `[candidate+0x4f]` through `0x51c920`, formats localized string id `0x0b53`, copies up to `0x46` bytes into row `0x0061dbc2 + id*0x6e`, and stores that same live id into dword slot `0x0061dc09 + id*0x6e`. Only after that catalog rebuild does it re-enter `structure_candidate_collection_refresh_named_availability_latch_0x7ac_and_tail_into_cargo_economy_filter_refresh` `0x00412c10`. Current grounded caller is the constructor-side load owner `0x004131f0`, which stores the resulting collection at `0x0062b268`.","objdump + local disassembly + caller correlation + tagged-import-source correlation + collection-aggregate correlation + named-catalog correlation" 0x004131f0,49,structure_candidate_collection_construct_and_stream_load_runtime_records,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Constructor-side load owner for the live structure-candidate collection rooted at `0x0062b268`. The helper runs the shared collection base initializer `0x00517ce0`, installs vtable `0x005c93cc`, seeds the collection through `0x00518570` with literal configuration `(1, 0x7c8, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability` `0x00412fb0`. Current grounded caller is the world bring-up load branch at `0x00438c8e`, which allocates a `0xa0`-byte object and stores the result into global `0x0062b268`.","objdump + local disassembly + caller correlation + collection-constructor correlation" 0x00413230,39,placed_structure_collection_construct_empty_runtime_pool,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Constructor for the live placed-structure collection rooted at `0x0062b26c`. The helper runs the shared collection base initializer `0x00517ce0`, installs vtable `0x005c9414`, and seeds the collection through `0x00518570` with literal configuration `(0, 0, 0x0a, 0x14, 0, 0, 0)` before returning `this`. Current grounded caller is the world-entry bring-up branch at `0x00448871`, which allocates an `0x8c`-byte object and stores the result into global `0x0062b26c`.","objdump + local disassembly + caller correlation + collection-constructor correlation" 0x00413260,22,placed_structure_collection_release_and_free,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small destructor-side wrapper for the live placed-structure collection rooted at `0x0062b26c`. The helper reinstalls collection vtable `0x005c9414`, re-enters the shared collection release body `0x00518600`, and then tails into common collection teardown `0x00518bd0`. Current grounded caller is the world-release lane at `0x0044933d`, which clears the same global collection root during teardown.","objdump + local disassembly + caller correlation + collection-layout correlation" -0x00413280,291,placed_structure_collection_stream_load_tagged_entries_and_publish_progress,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tagged stream-load owner for the live placed-structure collection at `0x0062b26c`. The helper reads the three tagged section markers `0x36b1`, `0x36b2`, and `0x36b3` through `0x00531360`, seeds the collection header through `0x00518680`, and then walks every live placed-structure entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. For each entry it snapshots the current entry vtable through `0x0040c950`, dispatches the load-side entry virtual `slot+0x40` with the caller bundle, advances the shared progress scalar `0x00ccb9e8` in one evenly distributed step, and re-enters `0x004834e0` on the active world root. Current grounded caller is the larger world-entry load path at `0x00444467`, where this helper is the concrete collection-side import owner rather than one bare tagged reader.","objdump + local disassembly + caller correlation + tagged-stream correlation + progress-publish correlation" +0x00413280,291,placed_structure_collection_stream_load_tagged_entries_and_publish_progress,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tagged stream-load owner for the live placed-structure collection at `0x0062b26c`. The helper reads the three tagged section markers `0x36b1`, `0x36b2`, and `0x36b3` through `0x00531360`, seeds the collection header through `0x00518680`, snapshots the current global progress scalar `0x00ccb9e8`, and then walks every live placed-structure entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. For each entry it materializes one temporary stack-local entry shim through `0x0040c950`, dispatches the load-side entry virtual `slot+0x40` with the caller bundle, advances `0x00ccb9e8` in one evenly distributed step from that saved base, re-enters `0x004834e0` on the active world root, and then tears the temporary shim back down through `0x0040c970`. Current grounded caller is the larger world-entry load path at `0x00444467`, where this helper is the concrete collection-side import owner rather than one bare tagged reader.","objdump + local disassembly + caller correlation + tagged-stream correlation + progress-publish correlation + temporary-entry-shim correlation" 0x00413440,129,placed_structure_collection_stream_save_tagged_entries,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tagged stream-save owner for the live placed-structure collection at `0x0062b26c`. The helper writes the section markers `0x36b1`, `0x36b2`, and `0x36b3` through `0x00531340`, serializes the collection header through `0x00517d90`, emits the fixed side records at `0x005c9438` and `0x005c9420` through `0x00442660`, and then walks every live placed-structure entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each entry's save-side virtual `slot+0x44` with the caller bundle. Current grounded caller is the world-save path at `0x004452f5`, so this is the collection-side tagged save owner paired with `0x00413280` rather than another generic collection iterator.","objdump + local disassembly + caller correlation + tagged-stream correlation + collection-save correlation" 0x0041f940,88,world_region_count_structure_profiles_passing_availability_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70` and passes the neighboring availability gate `0x0041f998`. The helper walks the live subcollection backward through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, increments the running count only for candidates that survive both gates, and returns that total. Current grounded caller is the editor-side region panel family around `0x004cbe19`, where it acts as the ungated companion to the stricter year-filtered counter `0x0041f9b0`.","objdump + local disassembly + caller correlation + region-subcollection correlation" 0x0041f998,23,structure_candidate_availability_gate_reject_subtype2_without_availability_word_or_recipe_runtime,map,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Tiny flag-setting predicate over one structure-candidate record. Candidates whose subtype byte `[candidate+0x32]` is not `2` pass immediately. Subtype-`2` candidates only pass when availability word `[candidate+0xba]` is nonzero or runtime recipe latch `[candidate+0x7ac]` is nonzero; when both are zero the helper leaves the zero flag set so its callers reject the candidate. Current grounded callers are the two region-profile counters `0x0041f940` and `0x0041f9b0`.","objdump + local disassembly + caller correlation + candidate-availability correlation" @@ -164,6 +174,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004560c0,53,runtime_object_query_nested_lookup_float_via_fields_0x14_0x3a_0x21,map,thiscall,inferred,objdump + local disassembly + field-chain correlation,1,"Small shared float query over the broader `0x23a` runtime-object family. When lookup root `[this+0x14]` is nonnull, the helper derives one nested table offset from `[this+0x3a]` and `[this+0x21]`, follows that chain, and returns the float at the resolved record's `+0x18`; otherwise it returns `0.0`. Current evidence grounds the lookup chain but not the higher semantic meaning of those fields, so the note stays deliberately structural.","objdump + local disassembly + field-chain correlation" 0x00418a60,372,placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan.","objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation" 0x00418be0,346,placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper.","objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation" +0x00419230,851,aux_candidate_collection_rebank_or_clone_records_by_availability_pass_and_refresh_owner_links,map,thiscall,inferred,objdump + local disassembly + caller correlation + collection-layout correlation,4,"Broader post-load follow-on refresh for the auxiliary or source record pool rooted at `0x0062b2fc`, reached directly from `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. The helper first requires live scenario state `0x006cec78` and live structure-candidate pool `0x0062b268`, then runs two full passes keyed by the paired candidate availability bytes `[candidate+0xba]` and `[candidate+0xbb]`. Within each pass it scans the full auxiliary collection to find one current-bank template source record through owner-candidate dword `[entry+0x173]`, while separately trying to reuse one target slot whose prior ordinal field `[entry+0x187]` already equals the current ordinal. When no reusable slot exists it clones the current template body into the local stack image and allocates one fresh collection entry through vtable slot `+0x04`; otherwise it resolves the reusable target directly. If the chosen target differs from the current template source, the helper deep-copies the full fixed record body plus up to four optional heap payload planes at `[entry+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, with byte counts derived from footprint bytes `[entry+0xb8]` and `[entry+0xb9]` scaled by `<< 5`. It then stamps the current ordinal back into `[entry+0x187]`, formats one built-in label root from `0x005c93e8` for pass `0` or `0x005c93d8` for pass `1` into display buffer `[entry+0x22]` through `0x005a19c4`, mirrors that final text into the stem field at `[entry+0x04]`, scans the live candidate pool for an exact stem match, and stores the resolved owner-candidate id back into `[entry+0x173]`. The loop repeats for ordinals `0..11` in both passes. Current grounded caller is `0x004196c0`, so this is the safest current read for the load-side rebank-or-clone refresh that reprojects the imported `0x0062b2fc` records against live candidate availability rather than a generic collection copy helper.","objdump + local disassembly + caller correlation + collection-layout correlation + availability-pass correlation + ordinal-reuse correlation + deep-copy correlation + owner-link refresh correlation" +0x00419590,227,aux_candidate_collection_find_entry_id_by_station_detail_action_index_and_family,map,thiscall,inferred,objdump + local disassembly + caller correlation + station-detail-action correlation,3,"Resolves one auxiliary-candidate collection entry id from a small station-detail action key. The helper first formats one localized action stem by indexing the fixed string table at `0x005f3c6c` with the caller action index, then formats one second family-dependent string root from `0x005f3c80` with the caller family selector, concatenates those two local strings, and scans the live auxiliary collection for the first entry whose stem at `[entry+0x04]` matches that combined text through `0x005a57cf`. On success it returns the matching live entry id; otherwise it returns `0`. Current grounded caller is the lower `StationDetail.win` action band inside `shell_station_detail_window_handle_message` `0x00505e50`, where control `0xb3bd` selects family `1`, the sibling controls select family `2`, and the action index itself is derived from linked-site flag bits `[entry+0xc3]` before the resulting auxiliary id feeds the later world-side action query and confirmation-modal path.","objdump + local disassembly + caller correlation + station-detail-action correlation + localized-stem-table correlation" +0x00419680,46,aux_candidate_collection_release_templates_queues_and_indexed_storage,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Destructor-side wrapper for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper first reinstalls vtable `0x005c9718`, re-enters `0x00416950` to walk and release every live entry plus the local-runtime scratch globals `0x0062b2f8`, `0x0062b300`, `0x0062ba58..0x0062ba74`, and the two owned helper bands at `[this+0x88]`, `[this+0x8c]`, and `[this+0x90]`, and only then tails into the shared indexed-collection teardown `0x00518bd0`. Current grounded caller is the world-release strip at `0x00434460`, where the same global root is cleared during runtime teardown, so this is the safest current read for the release-side companion to the `0x0062b2fc` collection load/save family rather than a generic collection destructor.","objdump + local disassembly + caller correlation + scratch-global correlation + teardown-order correlation" +0x004196c0,280,aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons,map,thiscall,inferred,objdump + local disassembly + caller correlation + tagged-import correlation,4,"Load-side constructor and import owner for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper builds two temporary tagged import contexts around the fixed stem `0x005c93fc` through the callback trio `0x005c8190/0x005c8194/0x005c819c`, then repeatedly opens the next imported payload and re-enters `0x00414490` to decode one fixed source record into the local stack image. When that decode succeeds it dispatches the collection's allocate-or-insert vtable slot `+0x04` with the decoded record body, posts shell progress through `0x004834e0`, and continues until the tagged source is exhausted. After the import loop it re-enters `0x00419230` for the broader runtime follow-on refresh. Current grounded caller is the world-entry load branch at `0x00438c70`, where the resulting object is stored into global `0x0062b2fc`, so this is the safest current read for the load-side constructor plus stream-import companion to `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` rather than a generic constructor wrapper.","objdump + local disassembly + caller correlation + tagged-import correlation + decode-owner correlation" +0x0041a990,184,aux_candidate_collection_allocate_helper_bands_and_tail_into_stream_load_refresh,map,thiscall,inferred,objdump + local disassembly + caller correlation + helper-band correlation,3,"Lower helper beneath the `0x0062b2fc` constructor family. The function clears scratch global `0x0062b304`, allocates and zero-initializes three owned helper bands, stores them into `[this+0x88]`, `[this+0x90]`, and `[this+0x8c]`, seeds those bands through `0x53dbf0` and `0x53dcf0` with literal capacities `0x65`, `0x08`, and `0x74e`, and then tail-jumps directly into `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. Current grounded caller is the outer constructor `0x0041aa50`, so this is the safest current read for the helper-band allocator and import tail beneath the auxiliary or source record pool rather than a standalone collection owner.","objdump + local disassembly + caller correlation + helper-band correlation + import-tail correlation" +0x0041aa50,130,aux_candidate_collection_construct_seed_globals_and_helper_bands_then_import_records,map,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c9718`, clears constructor-side globals `0x0062b2f0`, `0x0062b2f4`, and `0x0062b2f8`, zeroes the owned helper pointers `[this+0x88]`, `[this+0x8c]`, `[this+0x90]`, seeds `[this+0x98] = 1`, `[this+0x9c] = 0`, and the fixed float-like pair `[this+0xa0/+0xa4]`, resets shell-side dword `[0x006cec74+0x4fd]`, seeds the indexed-collection configuration through `0x00518570` with literal tuple `(1, 0x1a7, 0x0a, 5, 1, 0, 0)`, and then re-enters `aux_candidate_collection_allocate_helper_bands_and_tail_into_stream_load_refresh` `0x0041a990`. Current grounded caller is the world-entry load branch at `0x00438cc5`, which stores the finished object into global `0x0062b2fc`, so this is the current safest read for the real constructor above the `0x0062b2fc` load/import family rather than a generic collection allocator.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation" 0x004197e0,5232,placed_structure_validate_projected_candidate_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`.","objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation" 0x00480210,448,placed_structure_construct_linked_site_record_from_anchor_and_coords,map,thiscall,inferred,objdump + caller inspection + constructor inspection,3,"Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`.","objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation" 0x0048a1e0,336,runtime_object_attach_infrastructure_child_with_optional_first_child_triplet_clone,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata correlation,2,"Shared `Infrastructure` child-attach helper over the broader `0x23a` runtime-object family. The function first checks the caller's child list at `[this+0x08]`. When that list holds more than one child, it samples the first child's two triplet scalar bands through `0x0052e880` and `0x0052e720`, destroys the caller-selected prior child through vtable slot `+0x18(0)`, allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, attaches it back to the owner through `0x005395d0`, and republishes the sampled triplets through `0x0052e8b0` and `0x00530720`. When the owner has at most one child, it still allocates and seeds the same `Infrastructure` object but attaches it through `0x0053a5d0` without the cloned-triplet republish. Current grounded callers are the repeated builder branches around `0x004a2cde..0x004a37d9`, so this is the safest current read for attaching one seeded `Infrastructure` child with an optional first-child triplet clone rather than a subtype-specific UI helper.","objdump + caller xrefs + local disassembly + rdata correlation + child-attach correlation" @@ -175,7 +191,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0048e160,24,runtime_object_resolve_route_entry_from_field_0x20a,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x20a]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2d15` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation" 0x0048e180,24,runtime_object_resolve_route_entry_from_field_0x20e,map,thiscall,inferred,objdump + local disassembly + route-entry-field correlation,2,"Tiny direct resolver over owner dword `[this+0x20e]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. It is the third direct sibling of `0x0048e140` and `0x0048e160` over the same triplet-backed route-entry field family.","objdump + local disassembly + route-entry-field correlation" 0x00490a3c,123,runtime_object_attach_optional_infrastructure_child_and_seed_three_position_lanes,map,thiscall,inferred,objdump + local disassembly + rdata correlation,2,"Optional `Infrastructure` child-attach branch beneath the same broader runtime-object family. When the caller-supplied payload stem is nonnull, the helper allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, and attaches it back to the current owner through `0x005395d0`. It then publishes two caller-supplied position lanes through `0x00539530`, one third lane through `0x0053a5b0`, and optionally stores the new child into owner field `[this+0x248]` when the trailing pointer argument is nonnull. The safest current read is therefore an optional `Infrastructure` child attach plus three-lane seed helper rather than a broader constructor for the whole owner object.","objdump + local disassembly + rdata correlation + child-attach correlation" -0x00413580,160,placed_structure_collection_refresh_quarter_subset_route_style_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper computes a start index from the scenario time byte at `0x006cec78+0x11` modulo `4`, then walks every fourth live placed-structure record in the collection, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass.","objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation" +0x00413580,160,placed_structure_collection_refresh_quarter_subset_route_style_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper derives one four-way start bucket from scenario byte `[0x006cec78+0x11]` through the local divide-by-seven ladder, then walks every fourth live placed-structure record in the collection from that starting slot, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass.","objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation + start-bucket correlation" 0x00414fa0,118,world_grid_count_flagged_cells_and_collect_float_samples,map,cdecl,inferred,objdump + callsite inspection,3,"Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues.","objdump + callsite inspection + world-grid scan correlation" 0x00415020,1968,world_grid_refresh_flagged_region_float_extrema_and_mean,map,cdecl,inferred,objdump + caller inspection,3,"Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper.","objdump + caller inspection + version-gate correlation + world-grid scan correlation" 0x004153f0,384,projected_rect_profile_slot_probe_template_cells_and_height_span,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Shared probe beneath the projected-rectangle profile-slot selector `0x00415570`. The helper scans one fixed `8x8` template mask from `0x005edd30 + slot*8`, aligned around the current projected-rectangle origin, rejecting immediately when any required cell is out of bounds, already occupied in the temporary dword cell-value bank at `0x0062b300`, or fails the paired world-grid acceptance gates `0x00448af0(mode 0)` and `0x004499c0`. For every surviving required cell it samples the companion float grid through `0x00448aa0`, tracks local min and max values, and finally requires the sampled height span to exceed a threshold scaled from `0x005c9680`, using `1.0` or `5.0` depending on manager state `[0x0062bae0+0x88]`. Current grounded callers are the cached and iterative search paths inside `0x00415570`, so this is the strongest current read for the template-and-height-span acceptance probe rather than a generic float-range helper.","objdump + caller xrefs + local disassembly + projected-rect correlation + float-span correlation" @@ -183,39 +199,45 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00415f20,403,placed_structure_recursive_collect_connected_component_tile_bounds,map,thiscall,inferred,objdump + caller inspection,3,"Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls.","objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation" 0x004160c0,168,placed_structure_collect_connected_component_tile_bounds_with_version_gate,map,cdecl,inferred,objdump + caller inspection,3,"Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper.","objdump + caller inspection + version-gate correlation + connected-component correlation" 0x00416170,345,placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk.","objdump + caller inspection + local disassembly + connected-component-map correlation" +0x00416830,164,aux_candidate_record_chain_callback_collect_unique_link_keys_into_save_queue,map,cdecl,inferred,objdump + local disassembly + caller correlation + queue-correlation,3,"Save-side callback beneath `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`. The helper walks the caller record's linked chain rooted at `[entry+0x04]`, follows each node's forward link at `[node+0x04]` to the terminal node, and then chooses one dedupe key from either the raw terminal id or the transformed key `0x7fffffff - id` depending on the callback mode dword at `[arg+0x00]`. It probes the temporary scored-node set rooted at `0x0062ba58` through `0x53d440`, pushes only unique keys through `0x53d320`, and increments the queued-count latch at `0x0062ba64`. Current grounded caller is the save-side collection walk inside `0x00416a70`, so this is the safest current read for the unique link-key gather callback that seeds the temporary save queue rather than a generic chain iterator.","objdump + local disassembly + caller correlation + queue-correlation + dedupe-key correlation" +0x004168e0,106,aux_candidate_collection_release_entry_optional_mask_planes_and_erase,map,thiscall,inferred,objdump + local disassembly + caller correlation + field-layout correlation,3,"Per-entry release helper beneath the `0x0062b2fc` auxiliary or source record pool. The helper resolves one live entry by id through the collection vtable, frees any optional plane allocations still owned by that record at `[entry+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, and then erases the entry through the shared indexed-collection removal path `0x00518a30`. Current grounded caller is the broader collection teardown body `0x00416950`, so this is the safest current read for the per-entry optional-mask-plane release plus erase helper rather than a generic indexed-collection callback.","objdump + local disassembly + caller correlation + field-layout correlation + erase-path correlation" +0x00416950,283,aux_candidate_collection_release_live_entries_scratch_roots_and_helper_bands,map,thiscall,inferred,objdump + local disassembly + caller correlation + teardown-order correlation,4,"Broader release body beneath `aux_candidate_collection_release_templates_queues_and_indexed_storage` `0x00419680`. The helper walks every live entry in the `0x0062b2fc` collection, re-enters `0x004168e0` to free the per-entry optional planes and erase the slot, clears the shared scratch root `0x0062b300`, releases the temporary scored-node family rooted at `0x0062ba58..0x0062ba74`, and then tears down the three owned helper bands at `[this+0x88]`, `[this+0x8c]`, and `[this+0x90]` through the `0x53dbe0/0x53dcb0` release pair before freeing their backing roots. Current grounded caller is the destructor-side wrapper `0x00419680`, so this is the safest current read for the real live-entry plus scratch-band teardown body rather than a generic collection cleanup.","objdump + local disassembly + caller correlation + teardown-order correlation + helper-band correlation" +0x00416a70,621,aux_candidate_collection_serialize_records_into_bundle_payload,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-save correlation,4,"Save-side collection owner for the auxiliary or source record pool rooted at `0x0062b2fc`, reached directly from the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The helper first allocates one temporary scored-node queue at `0x0062ba58`, clears the queued-count latch `0x0062ba64`, and walks collection field `[this+0x88]` through `0x53db20` with callback `0x00416830`, which scans each record's linked chain at `[entry+0x04]`, deduplicates the chain nodes through `0x53d440`, and pushes unique nodes into the queue through `0x53d320` while counting them in `0x0062ba64`. It then writes one leading `0x0c`-byte header whose first dword is the fixed tag `0xbabe`, derives one normalized world-space float pair through `0x00415370`, and drains the queued nodes through `0x53d390`. For each popped live record it serializes the fixed dword band at `[record+0x74a]`, `[+0x04]`, `[+0x08]`, `[+0x0c]`, `[+0x4b8]`, and `[+0x4bc]`, the counted inline dword run rooted at `[record+0x10]` with count `[record+0x49c]`, the fixed `0x10`-byte payload at `[record+0x4a0]`, the optional counted byte payload `[record+0x4c0]` with count `[record+0x4c4]`, the counted dword run rooted at `[record+0x4c8]` with count `[record+0x65c]`, the paired one-byte streams rooted at `[record+0x664]` and `[record+0x6c9]` with count `[record+0x72e]`, and the trailing dword at `[record+0x732]`. When the queue drains it releases the temporary scored-node queue and clears the scratch globals `0x0062ba58..0x0062ba74` plus cache slot `0x005ee030`. Current grounded caller is the fixed save-order branch at `0x0044528c`, immediately before chunk `0x3315`, so this is the safest current read for the direct package-save serializer over the `0x0062b2fc` record family rather than another tagged collection wrapper.","objdump + caller inspection + local disassembly + bundle-save correlation + scored-queue correlation + scratch-global correlation" 0x00416e20,156,indexed_collection_resolve_live_entry_id_by_stem_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop.","objdump + caller inspection + local disassembly + stem-compare correlation" 0x00416ec0,1867,placed_structure_build_projected_runtime_scratch_from_candidate_and_coords,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator.","objdump + caller inspection + local disassembly + projected-footprint correlation" 0x00418040,1168,placed_structure_render_local_runtime_overlay_payload_from_projected_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep.","objdump + caller inspection + local disassembly + overlay-payload correlation" 0x00414470,10,placed_structure_cache_projected_rect_profile_slot_id,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`.","objdump + caller inspection + local disassembly + global-cache correlation" +0x00414490,1063,aux_candidate_record_stream_decode_fixed_fields_and_optional_mask_planes,map,cdecl,inferred,objdump + local disassembly + caller correlation + field-layout correlation,4,"Low decode body beneath the `0x0062b2fc` auxiliary or source record import family. The helper reads the fixed record header and six `0x1e`-byte string bands into the caller record image at `[record+0x04]`, `[+0x22]`, `[+0x40]`, `[+0x5e]`, `[+0x7c]`, and `[+0x9a]`, imports the small scalar tail at `[+0xb8/+0xb9/+0xba/+0xbb/+0xbf/+0xc3/+0xc7/+0xcb/+0xcd]`, applies the two exact-stem fixups that rewrite `[record+0xcd]` to `0x81` or `0x9d`, and then derives one footprint-sized plane length from `[record+0xb8] * [record+0xb9] << 5`. It allocates and zeroes up to four optional heap planes at `[record+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, decodes the packed nibble or bitplane payload into those four buffers, stamps the corresponding presence latches at `[record+0x177]`, `[+0x17b]`, `[+0x17f]`, and `[+0x183]`, frees any plane whose decode path stayed empty, seeds `[record+0x1a3] = 1.0f`, and returns a success flag. Current grounded caller is `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`, so this is the current safest read for the fixed record decode plus optional mask-plane materializer rather than a generic stream helper.","objdump + local disassembly + caller correlation + field-layout correlation + optional-plane correlation" 0x00416620,521,placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail.","objdump + caller inspection + local disassembly + projected-rectangle-global correlation" 0x00415570,317,placed_structure_try_select_projected_rect_profile_slot,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; one fallback seeds the same search from localized id `11` through `0x00518be0`; and one final iterative path scans slots `0..11` until the probe accepts. On success the helper writes the chosen slot id into `0x0062ba3a`, and the cache fast path also clears `0x005ee030` back to `-1` after consuming it. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper.","objdump + caller inspection + local disassembly + rectangle-probe correlation" 0x00414e10,200,world_grid_refresh_projected_rect_surface_and_region_byte_tables,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan.","objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation" 0x00494240,195,route_entry_collection_query_rect_window_passes_entry_type_gate,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan.","objdump + caller inspection + local disassembly + route-entry-window correlation" 0x00411cb0,30,structure_candidate_release_runtime_descriptor_and_cargo_membership_tables,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny release-side helper beneath the port-or-warehouse candidate runtime family. The helper clears the two cargo-membership pointer tables at `[this+0x79c]` and `[this+0x7a0]` and then clears the descriptor-array pointer at `[this+0x37]`, all through the shared release helper `0x0053afd0`. Current grounded callers sit in the same candidate rebuild and teardown strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the safest current read for the narrow descriptor-and-membership release sibling rather than a generic pointer scrub.","objdump + local disassembly + caller correlation + release-helper correlation" -0x00411ce0,99,structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Post-import mode-flag classifier immediately beneath `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`. The helper clears candidate dwords `[this+0x78c]` and `[this+0x790]`, then only runs its descriptor scan when byte `[this+0x32]` equals `2`. In that mode it starts with `[this+0x78c] = 1`, walks every live `0xbc` runtime descriptor in `[this+0x37]`, sets `[this+0x790] = 1` when it finds any mode-`0` descriptor, and clears `[this+0x78c]` when it finds any descriptor whose subordinate-row count at `[desc+0x2c]` is nonzero. If the scan finishes without ever seeing a mode-`0` descriptor, it forces `[this+0x78c]` back to `1`. So the strongest current static read is a two-flag summary over the freshly imported recipe runtime strip: `[this+0x790]` records whether any direct mode-`0` runtime descriptor exists, while `[this+0x78c]` stays armed only for the subtype-`2` cases that have no subordinate-row descriptors or no mode-`0` descriptors at all. Current grounded caller is `0x00412d70`.","objdump + local disassembly + caller correlation + descriptor-scan correlation" +0x00411ce0,99,structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Post-import mode-flag classifier immediately beneath `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`. The helper clears candidate dwords `[this+0x78c]` and `[this+0x790]`, then only runs its descriptor scan when byte `[this+0x32]` equals `2`. In that mode it starts with `[this+0x78c] = 1`, walks every live `0xbc` runtime descriptor in `[this+0x37]`, sets `[this+0x790] = 1` when it finds any mode-`0` descriptor, and clears `[this+0x78c]` when it finds any mode-`0` descriptor whose subordinate-row count at `[desc+0x2c]` is zero. If the scan finishes without ever seeing a mode-`0` descriptor, it forces `[this+0x78c]` back to `1`. So the strongest current static read is a two-flag summary over the freshly imported recipe runtime strip: `[this+0x790]` records whether any mode-`0` runtime descriptor exists, while `[this+0x78c]` stays armed only for subtype-`2` cases where every mode-`0` descriptor carries at least one subordinate row, or where no mode-`0` descriptors exist at all. Current grounded caller is `0x00412d70`.","objdump + local disassembly + caller correlation + descriptor-scan correlation" 0x00411d50,58,structure_candidate_query_all_runtime_descriptors_are_mode0_and_any_direct_descriptor_exists,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Predicate over the candidate's current `0xbc` runtime descriptor strip. It walks all descriptors in `[this+0x37]` and returns true only when every descriptor keeps mode dword `[desc+0x00] == 0` and at least one descriptor also has subordinate-row count `[desc+0x2c] == 0`; any nonzero mode descriptor forces immediate failure. Current grounded callers are editor-side summary passes `0x004cbb3b` and `0x004d26d4`, where it acts as a narrower descriptor-pattern gate than the broader post-import flags `[this+0x78c/+0x790]`.","objdump + local disassembly + caller inspection + descriptor-pattern correlation" +0x00411d90,1,structure_candidate_post_collection_construct_noop_placeholder,map,thiscall,inferred,objdump + caller correlation,1,"Bare `ret` placeholder in the candidate bringup strip. Current grounded caller is the world-entry load branch at `0x00438ca0`, immediately after the live candidate pool `0x0062b268` is constructed and before the auxiliary candidate collection at `0x0062b2fc` is allocated. Current local evidence does not show any side effects beyond preserving that callsite boundary.","objdump + caller correlation + world-entry load-strip correlation" 0x00411da0,111,structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_pair,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Reads one fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When that slot is not `-1` and the row's leading name pointer at `+0x04` is nonnull, the helper copies the pointed zero-terminated string to the caller buffer and writes the two adjacent scalar dwords from row offsets `+0x0c` and `+0x10` to the caller outparams before returning `1`; otherwise it returns `0`. Current grounded caller is the placed-structure specialization service around `0x0045b245`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-pair accessor rather than a more specific asset-label decode.","objdump + local disassembly + caller inspection + fixed-table inspection" 0x00411e10,50,structure_candidate_try_query_positive_fixed_profile_slot_0x798_scalar_and_trailing_value,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Queries the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and the row dword at offset `+0x14` is positive, the helper writes row dword `+0x20` to the caller outparam and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, where it acts as a prerequisite gate before the heavier fixed-row payload copy sibling `0x00411e50`.","objdump + local disassembly + caller inspection + fixed-table inspection" 0x00411e50,133,structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_triplet,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Reads the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and row dword `+0x14` is positive, the helper copies the pointed zero-terminated string at row offset `+0x04` to the caller buffer, writes row dwords `+0x18`, `+0x1c`, and `+0x14` to the caller outparams, and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-triplet accessor rather than a narrower effect-family decoder.","objdump + local disassembly + caller inspection + fixed-table inspection" -0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection,3,"Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + scenario-state correlation + cargo-collection correlation" -0x004120b0,1119,structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Stream-load owner for one live structure candidate record beneath the broader collection load path at `0x00412fb0`. The helper seeds runtime id `[this+0xe4]` from its first caller argument, clears the cargo-membership pointers and mode-summary band at `[this+0x79c..+0x7b0]`, sets the cached summary year `[this+0x788] = -1`, opens one named bundle slot through `0x00530c80`, and then reads the packed candidate body through repeated `0x00531150` calls. That load covers the fixed header fields at `[this+0x04..+0x32]`, the runtime descriptor count at `[this+0x33]`, the descriptor strip itself into a freshly allocated `[this+0x37]`, the later scalar and word bands at `[this+0x3b..+0x4f]`, the four-channel summary quartet at `[this+0x8c..+0xa0]`, the per-cargo float lanes at `[this+0xa1..+0xb8]`, the selector bytes `[this+0xb9..+0xbb]`, and the mode-sensitive trailer at `[this+0xc0]` with the special `[this+0x43]` rescale path when `[this+0x4b]` is nonzero. After the raw load it re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, resets stem index `[this+0x798]` to `-1`, then resolves that index by matching the loaded stem string at `[this+0x04]` against the fixed table `0x005ed338..0x005edca4`. Current grounded caller is the collection-wide stream-load path at `0x00412fb0`.","objdump + local disassembly + caller correlation + bundle-slot correlation + stem-table correlation" +0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection + local disassembly,3,"Rebuilds the per-candidate cargo-membership tables and scaled per-cargo rate band after one runtime descriptor array has been materialized. The helper clears the two compact cargo-id tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and the thirteen-dword per-cargo accumulator band rooted at `[this+0x0a1]`, then fills one local `0x35`-byte scratch status array from the live `0xbc` descriptor strip in `[this+0x37]`. Each subordinate cargo row is classified against the current scenario year at `[0x006cec78+0x0d]` into status `1` when that cargo is only referenced and status `2` when the row is currently year-active; the helper keeps the maximum status seen per remapped cargo id through `0x0062ba8c+0x9a`. The scaled-rate side is tighter now too: for descriptor mode `0` it multiplies each subordinate row amount by the shared production-cap float `[this+0x2a]` and divides by the descriptor amount `[desc+0x04]`, while nonzero-mode descriptors bypass that normalization and publish their row amount directly. After the scan it counts every cargo with scratch status `>= 1` into `[this+0x7a4]`, every cargo with status `>= 2` into `[this+0x7a8]`, allocates the two final `u16` id tables, zeroes them, and compacts the `status>=1` and `status>=2` sets into `[this+0x79c]` and `[this+0x7a0]` respectively. That keeps the stronger current split narrow and concrete: the first table is the referenced-cargo set, the second is the currently active-cargo set, and the per-cargo float band at `[this+0x0a1..+0x0b8]` is the same cap-scaled runtime rate band later queried by `0x004129d0`. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + local disassembly + scenario-state correlation + cargo-collection correlation + membership-table compaction correlation" +0x004120b0,1119,structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Stream-load owner for one live structure candidate record beneath the broader collection load path at `0x00412fb0`. The helper seeds runtime id `[this+0xe4]` from its first caller argument, clears the cargo-membership pointers and mode-summary band at `[this+0x79c..+0x7b0]`, sets the cached summary year `[this+0x788] = -1`, opens one named bundle slot through `0x00530c80`, and then reads the packed candidate body through repeated `0x00531150` calls. The fixed header import is tighter now too: it reads one outer dword header, then the candidate stem or display band at `[this+0x04]` length `0x1e`, the scalar fields at `[this+0x22]`, `[this+0x2a]`, and `[this+0x2e]`, the year words `[this+0x26/+0x28]`, byte `[this+0x32]`, and runtime descriptor count `[this+0x33]`. The descriptor strip itself is allocated as `count*0xbc + 1` bytes into `[this+0x37]`, then every `0xbc` slot is zeroed before the raw read. Descriptor import is tighter in the same way: mode-`0` descriptors immediately resolve their primary token string at `+0x08` back into cargo id `[desc+0x1c]`, subordinate-row descriptors resolve each row token at `+0x30 + row*0x1c` back into `[desc+0x44 + row*0x1c]`, and both paths clamp the descriptor start-year word `[desc+0x20]` upward to the resolved cargo availability floor at `[cargo+0x21]`. The later import band is explicit too: bundles at `>= 0x3ed` load `[this+0x3b..+0xbb]`, including the scalar strip `[this+0x3b/+0x3f/+0x43/+0x47/+0x4b]`, label band `[this+0x4f]`, summary quartet `[this+0x8c..+0xa0]`, per-cargo float lanes `[this+0xa1..+0xb8]`, and selector bytes `[this+0xb9..+0xbb]`; bundles at `>= 0x3f2` then load the wider `0x24`-byte trailer at `[this+0xc0]`, while older bundles keep that trailer in its narrow `0x02`-byte form. When `[this+0x4b]` is nonzero the helper also forces `[this+0x47] = 1.0`, rescales `[this+0x43]` from `[this+0x22]` through `0x005a10d0`, and clamps the final value to at least `0x1388`. After closing the slot through `0x00530a00` it re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, resets stem index `[this+0x798]` to `-1`, normalizes the candidate stem through the two built-in aliases at `0x005c8f94` and `0x005c8e4c`, and then scans the fixed row table `0x005ed338..0x005edca4` until it finds the matching stem index. Current grounded caller is the collection-wide stream-load path at `0x00412fb0`.","objdump + local disassembly + caller correlation + bundle-slot correlation + descriptor-year-floor correlation + stem-table correlation + version-gate correlation + field-width correlation" 0x00412510,72,structure_candidate_is_enabled_for_current_runtime_year_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small enable-or-year gate beneath the live candidate cargo-summary family. The helper first requires latch `[this+0x7ac]` to be nonzero. When shell state `[0x006cec74+0x17c]` is already armed it returns true immediately; otherwise it consults the scenario-side runtime gate at `[0x006cec78+0x46c38]` and compares the current effective year from `[0x006cec78+0x05]` or `[0x006cec78+0x0d]` against candidate word `[this+0x26]`, returning true only when the scenario year has reached that threshold. Current grounded callers are the collection-side wrapper at `0x00413de0` and the linked-count cargo-summary accumulator at `0x0041e795`, so this is the safest current read for the candidate-side availability gate above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` rather than a general profile or editor predicate.","objdump + local disassembly + caller correlation + year-gate correlation" -0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-collection correlation + special-condition correlation" -0x004125f0,87,structure_candidate_count_active_scaled_supply_descriptors,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors.","objdump + caller xrefs + callsite inspection" -0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into the bank rooted at `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor cap share into `[this+0x0a4]` and the subrow-scaled production outputs into `[this+0x178]`. The bank ownership is tighter now too because the return epilogue reads one caller-selected cargo lane back out of those exact roots as four distinct out channels: direct supply from `[this+0x03a]`, cap-normalized supply from `[this+0x0a4]`, demand or input from `[this+0x10e]`, and scaled production output from `[this+0x178]`. The index lanes are tighter in the same way: the no-subrow paths use the resolved cargo id at `[desc+0x1c]` directly, and the subordinate-row loop indexes each output lane directly from `[desc+0x44+row*0x1c]`, with no post-resolution failure guard in this consumer. So the strongest current read is that unresolved imported marker rows would still fall into the first summary-bank bucket here, while the semantic meaning of cargo id `0` itself remains ungrounded. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + local disassembly + callsite inspection + scenario-state correlation" +0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_selected_mode_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by requiring the primary cargo id at `[desc+0x1c]` to map through the live cargo-availability latch at `0x0062ba8c[cargo].+0x16e`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the inclusive descriptor year window `[desc+0x20]..[desc+0x22]`. The selected-bank split is tighter now too: when caller bank `0` is active the helper rejects descriptors whose dword gate `[desc+0x24]` is nonzero, while caller bank `1` rejects descriptors whose dword gate `[desc+0x28]` is nonzero. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to keep that same live cargo-availability latch `[cargo+0x16e]` nonzero. Current grounded callers are `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-availability-latch correlation + selected-bank-gate correlation + special-condition correlation" +0x004125f0,87,structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the currently active mode-`0` runtime descriptors that still own at least one subordinate row for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, keeps only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active mode-`0` descriptors that contribute cap-shared subordinate-row output.","objdump + caller xrefs + callsite inspection + cap-share-bank correlation" +0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it stamps the current scenario year into `[this+0x788]`, clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, and then walks every live `0xbc` descriptor across both mode banks `0` and `1` through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. The bank split is tighter now too because it is driven first by descriptor mode and then by whether subordinate rows exist. Mode-`0` descriptors with no subordinate rows accumulate their primary cargo scalar `[desc+0x04]` into the direct primary-cargo bank rooted at `[this+0x03a]`, keyed by resolved cargo id `[desc+0x1c]`. Mode-`0` descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, then publish that cap share into the primary-cargo bank rooted at `[this+0x0a4]`, again keyed by `[desc+0x1c]`, and finally scale each subordinate row amount `[desc+0x48+row*0x1c]` into the zero-mode subrow bank rooted at `[this+0x178]`, keyed by `[desc+0x44+row*0x1c]`. Nonzero-mode descriptors bypass the primary-cargo banks entirely and accumulate their subordinate-row amounts directly into the nonzero-mode subrow bank rooted at `[this+0x10e]`, keyed by `[desc+0x44+row*0x1c]`. The return epilogue reads one caller-selected cargo lane back out of those exact roots as four distinct out channels: direct primary-cargo scalar from `[this+0x03a]`, cap-share primary-cargo scalar from `[this+0x0a4]`, nonzero-mode subrow scalar from `[this+0x10e]`, and zero-mode cap-scaled subrow scalar from `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and this consumer, so unresolved imported marker rows would still fall into the first summary-bank bucket here while the semantic meaning of cargo id `0` itself remains ungrounded. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + local disassembly + callsite inspection + scenario-state correlation + year-stamp correlation" 0x00412960,49,structure_candidate_query_direct_and_normalized_supply_channels,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the sum of the wrapper's two supply-side out lanes rather than exposing all four summary channels directly. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the direct-supply-side cargo presence test. The wrapper does not add any post-query special case for unresolved cargo bucket `0`; it just sums the returned supply-side floats.","objdump + callsite inspection + wrapper-correlation" 0x004129a0,45,structure_candidate_query_scaled_production_output_channel,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the single scaled production-output subrow channel without combining it with the neighboring supply lanes. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the scaled-supply or production-side cargo presence test. Like the sibling wrapper at `0x00412960`, it does not special-case unresolved cargo bucket `0` after the underlying query returns.","objdump + callsite inspection + wrapper-correlation" -0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation" +0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned nonzero-mode subrow channel plus zero-mode cap-scaled subrow channel are positive. One final fallback follows the global cargo remap at `0x0062ba8c+0x9a`: if the requested cargo has a valid remap target, the helper checks the two cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` for that remapped index before deciding. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation" 0x00412a90,22,structure_candidate_collection_destructor_reset_vtable_and_release_indexed_storage,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small destructor-side wrapper for the live structure-candidate pool rooted at `0x0062b268`. The helper first resets the collection vtable to `0x005c93cc`, then releases the indexed live-entry storage through `indexed_collection_release_slot_storage` `0x00518600` and tails into the common indexed-collection cleanup `0x00518bd0`. Current grounded caller is the global teardown branch at `0x00434480`, where the current candidate pool is destroyed immediately before the backing object is freed through `0x0053b080`.","objdump + local disassembly + caller correlation + global-pool-teardown correlation" -0x004128e0,119,structure_candidate_refresh_stem_overridable_policy_dword_0xbc,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small stem-table policy refresh beneath the candidate collection support family. The helper seeds `[this+0xbc]` with default `0x1869f`, changes that default to `3` when `[this+0x78c]` is armed, or to `4` when subtype byte `[this+0x32] == 2`, and then walks the fixed `(stem, value)` table at `0x005edca8..0x005edd20`. When the candidate stem string at `[this+0x04]` matches any table stem through `0x005a5f26`, it overwrites `[this+0xbc]` with the paired table value. Current grounded caller is the collection-wide sweep `0x00412ab0`, so this is the safest current read for a stem-overridable policy or timeout dword refresh rather than a broader candidate rebuild owner.","objdump + local disassembly + caller correlation + stem-table correlation" +0x004128e0,119,structure_candidate_refresh_stem_overridable_policy_dword_0xbc,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small stem-table policy refresh beneath the candidate collection support family. The helper seeds `[this+0xbc]` with default `0x1869f`, overrides that default to `3` when post-import flag `[this+0x78c]` is armed, or to `4` when subtype byte `[this+0x32] == 2`, and then walks the fixed eight-byte `(stem_ptr, value)` table at `0x005edca8..0x005edd20`. Each row compares the candidate display stem at `[this+0x04]` against the table stem through `0x005a5f26`, and on the first exact match it overwrites `[this+0xbc]` with the paired table dword before returning. Current grounded caller is the collection-wide sweep `0x00412ab0`, so this is the safest current read for a stem-overridable policy dword refresh rather than a broader candidate rebuild owner.","objdump + local disassembly + caller correlation + stem-table correlation + post-import-flag correlation" 0x004128d4,12,aux_candidate_collection_find_entry_id_by_runtime_owner_id_e4,map,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Tiny resolver over the auxiliary collection at `0x0062b2fc`. The helper scans that collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares each live entry's owner or runtime id dword at `[entry+0x173]` against the caller candidate's runtime id `[candidate+0xe4]`, and returns the matching collection id or `0` when none match. Current grounded caller is the wrapper at `0x00413dd0`, so this is the safest current read for the auxiliary-record lookup by candidate runtime owner id rather than a broader collection service owner.","objdump + local disassembly + caller correlation + collection-scan correlation" 0x00413d80,68,aux_candidate_entry_query_owner_subtype1_grid_basis_pair_words_0xcb_0xcd,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small auxiliary-entry helper beneath the projected-footprint placement family. It resolves the owning structure candidate from the auxiliary entry's runtime-owner id dword `[entry+0x173]` through the live candidate pool `0x0062b268`, requires the resolved candidate subtype byte `[candidate+0x32]` to equal `1`, and on success copies candidate words `[candidate+0xcb]` and `[candidate+0xcd]` into the caller output pointers before returning `1`; all other cases return `0`. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, where those two words act as the local grid basis pair beneath rotated footprint projection.","objdump + local disassembly + caller correlation + auxiliary-owner correlation + projected-footprint correlation" 0x00413dd0,18,aux_candidate_entry_owner_candidate_is_enabled_for_current_runtime_year_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny availability wrapper over one auxiliary candidate entry. The helper resolves the owning structure candidate from auxiliary dword `[entry+0x173]` through the live candidate pool `0x0062b268`, then tail-jumps into `structure_candidate_is_enabled_for_current_runtime_year_gate` `0x00412510`. Current grounded caller is the neighboring summary family around `0x00413de0`, so this is the narrow auxiliary-entry year-visibility gate rather than a broader collection query.","objdump + local disassembly + caller correlation + auxiliary-owner correlation + year-gate correlation" 0x00413df0,183,projected_rect_packed_cell_list_try_append_unique_xy_with_optional_highbit_flag_and_expand_quarter_bounds,map,fastcall,inferred,objdump + caller xrefs + local disassembly + global-field correlation,3,"Shared packed-cell cache helper beneath the projected-runtime scratch and placement-validator families. The helper treats `ECX` and `EDX` as one world-cell pair, combines them with the caller-supplied boolean or small mode in `EAX` into one packed dword, and then scans the temporary list rooted at `0x0062b318` for an existing entry whose low `31` bits already match the same cell pair. When no duplicate exists it appends the new packed dword, terminates the list with `-1`, and expands the coarse quarter-resolution bounds at `0x0062b7a8..0x0062b7b4` from the same cell pair shifted right by `2`. The top bit is deliberately ignored by the duplicate test, so the third argument is best read as an optional per-cell high-bit mark rather than part of the spatial key. Current grounded callers are the projected-footprint scan inside `0x004174dd..0x00417529`, the projected-runtime scratch builder `0x00416ec0`, and the later placement-validator subtype branch around `0x00419ee4`.","objdump + caller xrefs + local disassembly + projected-runtime correlation + global-field correlation" 0x00413bc0,435,station_place_format_preview_description_block_from_profile_text_and_rule_tables,map,thiscall,inferred,objdump + local disassembly + caller correlation + string-table correlation,3,"Formats the multiline description block consumed by the StationPlace preview panel. The helper starts by publishing the current placement record's text at `[record+0x40]` through `0x00518de0`, then uses repeated casefolded compares against record text `[record+0x7c]` and several fixed string tables rooted at `0x005f3c80`, `0x005c94c4`, `0x005c94a0`, and `0x005c947c` to decide which explanatory lines still need to be appended through the same text-publish path. One early branch also selects between format roots `0x005c94d4` and `0x005c94ec` based on dword `[record+0x141]`. Current grounded caller is `station_place_format_preview_panel` `0x00508730`, where this helper owns the paired description block for preview control `0x6984`. The safest current read is therefore a preview-description formatter over one placement profile and several fixed rule tables, rather than a generic message-box or region helper.","objdump + local disassembly + caller correlation + string-table correlation + StationPlace preview correlation" 0x00413eb0,95,placed_structure_lookup_projected_rect_profile_record_by_label_at_field_0x123,map,cdecl,inferred,objdump + local disassembly + caller correlation + table-layout correlation,3,"Lookup helper beneath the projected-rectangle profile-slot family. It walks the fixed `0x5ef3f0` table in `0xb0`-byte steps, compares each entry's active label pointer against the caller record text rooted at `[arg+0x123]` through `0x005a57cf`, and on the first match returns the enclosing table record base. When no match exists it returns null. Current grounded caller is `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, which uses the returned record to derive companion value `0x0062ba3e` before probing the projected rectangle. This is therefore the safest current read for the fixed projected-rectangle profile-record lookup rather than a broader string-table scan.","objdump + local disassembly + caller correlation + table-layout correlation + projected-rectangle correlation" -0x00412ab0,56,structure_candidate_collection_refresh_stem_overridable_policy_dword_0xbc,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live candidate manager that simply re-enters `structure_candidate_refresh_stem_overridable_policy_dword_0xbc` `0x004128e0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes the per-candidate dword `[candidate+0xbc]` from the current stem table. Current grounded callers sit in the same load and collection-service strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side owner above that stem policy refresh.","objdump + local disassembly + caller correlation + collection-sweep correlation" -0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + local disassembly + caller xrefs + callsite inspection,4,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062b268`. The helper runs two banked passes keyed by the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]`, and within each bank it steps through the twelve scenario-side recipe books at offsets `0x0fe7 + ordinal*0x4e1`. For each ordinal it scans the live candidate collection twice conceptually: one path remembers the last availability-qualified candidate in the current bank as the template source record, while the parallel reuse path looks for a candidate whose prior ordinal field `[candidate+0x794]` already equals the current ordinal so that same live slot can be reused. When no reusable target exists it allocates one fresh candidate record and zeroes its `0x1f2`-dword body; otherwise it resolves the reusable target and clears its dependent pointer fields `[candidate+0x79c]`, `[candidate+0x7a0]`, and `[candidate+0x37]`. When the chosen target differs from the bank template source, it clones the full `0x1f2`-dword template body first. It then seeds the rebuilt candidate from the active scenario state rooted at `0x006cec78`: `[candidate+0x794]` becomes the current ordinal, `[candidate+0xe4]` keeps the live collection id, `[candidate+0x33]` takes the imported recipe-line count from `[state+0x1024]`, `[candidate+0x2a]` takes the shared production-cap float from `[state+0x13d4]`, and `[candidate+0x37]` receives a freshly allocated copy of the packed `0xbc` descriptor array from `[state+0x1028]`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. After that projection it refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and the neighboring mode-flag pass `0x00411ce0`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and the larger collection load path at `0x00412fb0`, so this is the candidate-side bridge that projects editor recipe-book state into live runtime records rather than a generic collection copy loop.","objdump + local disassembly + caller xrefs + callsite inspection + scenario-state correlation + ordinal-reuse correlation + template-clone correlation" +0x00412ab0,56,structure_candidate_collection_refresh_stem_overridable_policy_dword_0xbc,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live candidate manager that simply re-enters `structure_candidate_refresh_stem_overridable_policy_dword_0xbc` `0x004128e0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes the per-candidate dword `[candidate+0xbc]` from the current stem table and the current post-import flag state at `[candidate+0x78c]` plus subtype byte `[candidate+0x32]`. Current grounded callers sit in the same load and collection-service strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side owner above that stem policy refresh.","objdump + local disassembly + caller correlation + collection-sweep correlation + post-import-policy correlation" +0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + local disassembly + caller xrefs + callsite inspection,4,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062b268`. The helper runs two banked passes keyed by the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]`, and within each bank it steps through the twelve scenario-side recipe books at offsets `0x0fe7 + ordinal*0x4e1`. For each ordinal it scans the live candidate collection twice conceptually: one path remembers the last availability-qualified candidate in the current bank as the template source record, while the parallel reuse path looks for a candidate whose prior ordinal field `[candidate+0x794]` already equals the current ordinal so that same live slot can be reused. When no reusable target exists it allocates one fresh candidate record through collection vtable slot `+0x04` and zeroes its `0x1f2`-dword body; otherwise it resolves the reusable target and clears its dependent pointer fields `[candidate+0x79c]`, `[candidate+0x7a0]`, and `[candidate+0x37]`. When the chosen target differs from the bank template source, it clones the full `0x1f2`-dword template body first. It then seeds the rebuilt candidate from the active scenario state rooted at `0x006cec78`: `[candidate+0x794]` becomes the current ordinal, `[candidate+0xe4]` keeps the live collection id, `[candidate+0x33]` takes the imported recipe-line count from `[state+0x1024]`, `[candidate+0x2a]` takes the shared production-cap float from `[state+0x13d4]`, and `[candidate+0x37]` receives a freshly allocated copy of the packed `0xbc` descriptor array from `[state+0x1028]`. The label side is narrower than earlier notes too: this rebuild owner does not consult the scenario-side recipe-book name at `[state+0x0fe8]`. Instead it formats display stem `[candidate+0x04]` directly from one of the two fixed built-in roots `0x005c93d8` or `0x005c93e8`, chosen by availability bit `[candidate+0xba] & 1`, together with the current ordinal. After that projection it refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and the neighboring mode-flag pass `0x00411ce0`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and the larger collection load path at `0x00412fb0`, so this is the candidate-side bridge that projects editor recipe-book state into live runtime records rather than a generic collection copy loop.","objdump + local disassembly + caller xrefs + callsite inspection + scenario-state correlation + ordinal-reuse correlation + template-clone correlation + display-stem-correction" 0x00412ca0,192,world_region_pick_commercial_profile_label_by_region_rank,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`.","objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings" 0x004133b0,132,placed_structure_collection_refresh_local_runtime_records_and_position_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b2fc` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep.","objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation" 0x00413f50,47,placed_structure_local_runtime_site_id_queue_pop_next,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt.","objdump + caller inspection + local disassembly + local-runtime-queue correlation" @@ -226,14 +248,28 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004142d0,12,world_set_packed_projected_cell_list_into_compact_grid_mode2,map,cdecl,inferred,objdump + caller xrefs + wrapper inspection,2,"Tiny set-side wrapper over `world_replay_packed_projected_cell_list_into_compact_grid_mode2_with_set_or_clear` `0x00414270`. It forwards the caller's packed projected-cell list with stack flag `1`, which sets each covered bit in compact-grid bank `2`. Current grounded caller is the placement-validator cleanup path around `0x0040def8`.","objdump + caller xrefs + wrapper inspection + compact-grid correlation" 0x004142e0,102,packed_projected_cell_list_query_bounds_rect,map,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Bounds helper over one sentinel-terminated packed projected-cell list. The helper scans each packed cell dword, extracts the low and high `15`-bit coordinates, tracks inclusive minima and maxima, and writes the finished rectangle into the caller output struct as `(min_x, min_y, max_x, max_y)`. Current grounded callers are `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, the neighboring projected-payload path at `0x0041852c`, the multiplayer callback root `0x0046df75`, and the small rect-copy wrapper `0x00414450`, so this now reads as the shared bounds extractor for projected-cell lists rather than an anonymous geometry helper.","objdump + caller xrefs + local disassembly + projected-cell-list correlation" 0x00414480,6,placed_structure_local_runtime_site_id_queue_count,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh.","objdump + caller inspection + local disassembly + local-runtime-queue correlation" -0x0041e8e0,63,structure_candidate_collection_write_filter_and_year_visible_summary_blocks,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state write wrapper over the live structure-candidate collection at `0x0062ba8c`. The helper opens two tagged packed blocks through `0x00531360` with ids `0x6979` and `0x697a`, forwards the caller's packed-state sink plus side flag into `0x00518680`, and returns the combined emitted size. Current grounded caller is the later world-entry or restore-side branch at `0x00444375`, immediately after the candidate-count refresh family has run, so this is the safest current read for the candidate-summary packed-state write sibling rather than a direct count recompute helper.","objdump + local disassembly + caller correlation + packed-state correlation" -0x0041e930,48,structure_candidate_collection_read_filter_and_year_visible_summary_blocks,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state read wrapper over the same structure-candidate summary family at `0x0062ba8c`. The helper opens the tagged blocks `0x6979` and `0x697a` through `0x00531340`, forwards the caller's packed-state source plus side flag into `0x00517d90`, and returns after both reads complete. Current grounded caller is the neighboring world-entry-side branch at `0x00445226`, which uses this read-side companion after shell service and before later post-load status updates, so this is the safest current read for the candidate-summary packed-state import sibling rather than a direct filter refresh helper.","objdump + local disassembly + caller correlation + packed-state correlation" +0x0041aae0,28,linked_route_object_temp_record_construct_vtable_5c9748,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation,2,"Tiny constructor-side helper for the stack-local temporary linked-route-object record used by the tagged bundle refresh owner `0x0041d3f0`. The helper re-enters the shared base initializer `0x0045c890` and then installs vtable `0x005c9748` before returning. Current grounded caller is the per-entry loop inside `linked_route_object_collection_refresh_records_from_tagged_bundle` `0x0041d3f0`, so this is the safest current read for the temporary `0x5c9748` record constructor rather than a reusable live collection owner.","objdump + local disassembly + vtable correlation + caller correlation" +0x0041ab00,14,linked_route_object_temp_record_reset_to_vtable_5c9748_and_release_base_payload,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation,2,"Tiny release-side helper paired with `linked_route_object_temp_record_construct_vtable_5c9748` `0x0041aae0`. The helper restores vtable `0x005c9748` on the temporary stack-local record and then tails into the shared base release path `0x0045c460`. Current grounded caller is the per-entry loop inside `linked_route_object_collection_refresh_records_from_tagged_bundle` `0x0041d3f0`, where it tears the temporary record down after the destination entry consumes it through virtual slot `+0x40`.","objdump + local disassembly + vtable correlation + caller correlation" +0x0041d7a0,22,locomotive_era_collection_release_tagged_records_and_collection_storage,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Release-side wrapper for the locomotive-era collection rooted at `0x0062ba88`. The helper restores vtable `0x005c9824`, re-enters `0x00518600` to release collection-side entry state, and then tails into the shared indexed-collection teardown `0x00518bd0`. Current grounded caller is the world teardown owner `0x00434300`, where the same global root is cleared and freed during runtime shutdown, so this is the safest current read for the release companion to the era-collection load/save family rather than a generic collection destructor.","objdump + local disassembly + caller correlation + collection-teardown correlation" +0x0041d7c0,1520,locomotive_era_collection_stream_load_tagged_records_import_engine_type_content_and_seed_runtime_sidecars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tagged-import correlation,4,"Broader tagged import owner for the locomotive-era collection rooted at `0x0062ba88`, reached directly from constructor `0x0041e170`. The helper runs two outer passes over the repeated tagged source opened through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stem `0x005c993c`, validates one fixed field set against the built-in tag strings `0x005c9934..0x005c9884`, and when the record layout passes it dispatches collection vtable slot `+0x04` into `locomotive_era_collection_allocate_entry_import_tagged_record_and_seed_named_sidecar_handles` `0x0041de60` to allocate or insert one live `0x88`-byte era record. The imported live record keeps its fixed scalar and string bands in-place, owns one nested collection at `[entry+0x196]`, and the import owner seeds that nested collection by matching imported strings against the global named table at `[0x006d4020+0x429b8]` and pushing the resolved rows through `0x0053d110`. Current grounded caller is `locomotive_era_collection_construct_and_stream_load_tagged_records` `0x0041e170`. Current package-save inspection has still found no mirrored early world-bundle serializer for `0x0062ba88`, so the safest current read remains a world-load or content-import owner rather than a save-side collection twin.","objdump + local disassembly + caller correlation + tagged-import correlation + nested-sidecar correlation + era-collection correlation + package-save-order correlation" +0x0041e170,49,locomotive_era_collection_construct_and_stream_load_tagged_records,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the locomotive-era collection rooted at `0x0062ba88`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c9824`, seeds the collection through `0x00518570` with literal tuple `(1, 0x266, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `locomotive_era_collection_stream_load_tagged_records_and_seed_runtime_sidecars` `0x0041d7c0`. Current grounded caller is the world-entry load branch at `0x00438cf7`, which stores the finished object into global `0x0062ba88`, so this is the current safest read for the constructor above the era-collection tagged load seam rather than a generic collection allocator.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation" +0x0041d3f0,197,linked_route_object_collection_refresh_records_from_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + collection-family correlation,3,"Collection-wide tagged load owner for the linked-route-object family rooted at `0x0062ba84`. The helper opens the `0x4a39/0x4a3a/0x4a3b` bracket through `0x00531360`, refreshes collection-side metadata through `0x00518680`, then walks every live linked-route-object record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. For each live record it seeds one stack-local temporary entry through `0x0041aae0`, copies that temporary vtable into the destination record root, dispatches the destination record through virtual slot `+0x40`, and then tears the temporary record down through `0x0041ab00` before closing tag `0x4a3b`. Current grounded caller is the world-entry bringup branch at `0x0044452b`, where this helper runs directly on `0x0062ba84` between the placed-structure dynamic-side-buffer bundle lane and the live train collection load. This is the safest current read for the linked-route-object tagged load owner rather than another anonymous `0x5c9748`-family collection walk.","objdump + local disassembly + caller correlation + collection-family correlation + tag-family correlation" +0x0041d4c0,118,linked_route_object_collection_serialize_records_into_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + collection-family correlation,3,"Collection-wide tagged save owner for the linked-route-object family rooted at `0x0062ba84`. The helper emits tag family `0x4a39/0x4a3a/0x4a3b` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, then walks every live linked-route-object record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each record through virtual slot `+0x44` with the caller bundle. Current grounded caller is the early package-save prelude at `0x00445433`, where it runs directly on `0x0062ba84` between the placed-structure dynamic-side-buffer tagged save and the live train collection serializer. This is the safest current read for the linked-route-object tagged save owner rather than another anonymous `0x5c9748`-family collection walk.","objdump + local disassembly + caller correlation + collection-family correlation + tag-family correlation" +0x0041ddc0,160,locomotive_era_collection_remove_entry_by_id_release_nested_sidecars_and_erase,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation + caller correlation,3,"Per-entry release owner for the locomotive-era collection rooted at `0x0062ba88`, reached through vtable `0x005c9824` slot `+0x08`. The helper resolves the current live entry through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, releases the main sidecar handle at `[entry+0x12a]`, drops the nested handle band rooted at `[entry+0x19a]` through repeated `0x0053c000`, destroys the nested collection at `[entry+0x196]`, and then erases the live entry id through `0x00518a30`. Current grounded callers are the collection vtable and the broader release wrapper `0x0041d7a0`, so this is the safest current read for the era-entry remove-and-release owner rather than a generic collection delete leaf.","objdump + local disassembly + vtable correlation + caller correlation + nested-sidecar correlation" +0x0041de60,789,locomotive_era_collection_allocate_entry_import_tagged_record_and_seed_named_sidecar_handles,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation + string correlation,3,"Per-record import allocator for the locomotive-era collection rooted at `0x0062ba88`, reached through vtable `0x005c9824` slot `+0x04` from `0x0041d7c0`. The helper allocates or inserts one live `0x88`-byte era entry through `0x00518900`, loads the engine-type content payload identified by the fixed stem `Data/EngineTypes/%1.cgo`, seeds one nested collection at `[entry+0x196]`, and resolves imported named rows against the global table at `[0x006d4020+0x429b8]` before committing the live sidecar handles. Current local strings and callers make this a content-import owner for one era record rather than a package-save restore sibling.","objdump + local disassembly + vtable correlation + string correlation + caller correlation + engine-type-content correlation" +0x0041e010,234,locomotive_era_collection_publish_intro_notice_and_service_current_year_type2_entries,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + year-gate correlation,3,"Immediate world-load follow-on over the locomotive-era collection rooted at `0x0062ba88`. When the early-year gate sees current year `[0x006cec78+0x0d] == 0x770` with start year `[+0x05] < 0x770` and runtime branch `[+0x46c38] == 0`, the helper first publishes the paired introductory text ids `0xcb/0xcc` through `0x00473f80`. It then only continues when the current year is at least `0x726`, scans every live era entry, keeps only records whose threshold year `[entry+0x105]` exactly matches the current year and whose type dword `[entry+0x41]` equals `2`, derives the current company or issue context through `0x004337b0/0x004337a0`, re-enters `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, and on success publishes the linked locomotive or era-side notice through `0x004337c0` with fixed text stem `0x005c87a8`. Current grounded caller is the same world-load and setup-side phase family that services the era collection after import, so this is the safest current read for the early intro-notice plus current-year type-`2` era-record service pass rather than a generic collection walk.","objdump + local disassembly + caller correlation + year-gate correlation + notice-publish correlation" +0x0041e100,103,locomotive_era_collection_find_first_live_entry_matching_type_and_current_year_window,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + year-window correlation,3,"Small live-entry query over the locomotive-era collection rooted at `0x0062ba88`. The helper walks every live entry through `0x00518380/0x00518140`, keeps only records whose type dword `[entry+0x41]` matches the caller-supplied selector, and then compares the current scenario year `[0x006cec78+0x0d]` against the record window `[entry+0x105..+0x109]`. On the first match it returns the corresponding live entry id through `0x00518380`; otherwise it returns zero. Current grounded callers sit in the neighboring era-collection policy and chooser strip, so this is the safest current read for the first-matching type-and-year-window query rather than a generic collection search helper.","objdump + local disassembly + caller correlation + year-window correlation + entry-type correlation" +0x0041e8e0,63,structure_candidate_collection_refresh_filter_and_year_visible_summary_blocks_from_packed_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state load wrapper over the live structure-candidate collection at `0x0062ba8c`. The helper opens two tagged packed blocks through `0x00531360` with ids `0x6979` and `0x697a`, forwards the caller's packed-state source plus side flag into `0x00518680`, and returns the combined consumed size. Current grounded caller is the later world-entry or restore-side branch at `0x00444375`, immediately after the candidate-count refresh family has run, so this is the safest current read for the candidate-summary packed-state load sibling rather than a direct count recompute helper.","objdump + local disassembly + caller correlation + packed-state correlation" +0x0041e930,48,structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state save wrapper over the same structure-candidate summary family at `0x0062ba8c`. The helper opens the tagged blocks `0x6979` and `0x697a` through `0x00531340`, forwards the caller's packed-state sink plus side flag into `0x00517d90`, and returns after both writes complete. Current grounded caller is the early package-save prelude `0x00444dd0`, which emits this save-side companion before the later tagged collection serializers, so this is the safest current read for the candidate-summary packed-state save sibling rather than a direct filter refresh helper.","objdump + local disassembly + caller correlation + packed-state correlation" +0x0041ede0,1784,structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands,map,thiscall,inferred,objdump + local disassembly + caller correlation + collection-layout correlation,4,"Broader tagged import owner for the live structure-candidate collection rooted at `0x0062ba8c`, reached directly from constructor `0x0041f4e0` and the later reset-side sibling `0x0041f530`. The helper first clears the three named candidate id slots `[this+0x88/+0x8a/+0x8c]`, opens the repeated tagged source through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stems `0x005c9a08/0x005c9a10`, and reads up to `0x1f3` fixed `0xc9`-byte source records into one local stack array. It then lexicographically reorders that local array through repeated `0x005a57cf` compares before walking the sorted records and materializing live `0xd0`-byte candidate entries through collection vtable slot `+0x04`. For each live record it stamps the resolved id into `[entry+0x3e]`, derives the float-like policy triplet `[entry+0x4a/+0x4e/+0x52]` from imported scalar lanes and current shell mode, marks the three built-in named candidates through bytes `[entry+0x46..+0x49]` when the imported stem at `[entry+0x04]` matches `0x005c99f0`, `0x005c99d8`, or `0x005c99d0`, and writes the matching ids back into collection slots `[this+0x8a]`, `[this+0x88]`, and `[this+0x8c]`. The same import pass also seeds the fixed display-name catalogs rooted at `0x0061312c`, `0x00613173`, `0x006150f8`, and the twelve-row band rooted at `0x005f7f9f`. When the insertion sweep finishes it clears `[this+0x8e/+0x92/+0x96]` plus the full `[this+0x9a]` class-index band, rescans every live candidate name, stores the ids of the three built-in named candidates into `[this+0x92]`, `[this+0x8e]`, and `[this+0x96]`, writes the corresponding class markers `1/0/2` into `[this+0x9a + id*4]`, and then tails into `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Current grounded callers are `0x0041f4e0` and `0x0041f530`, so this is the safest current read for the real structure-candidate tagged load plus fixed-name catalog seed owner rather than a generic collection parser.","objdump + local disassembly + caller correlation + collection-layout correlation + tagged-import correlation + fixed-name-catalog correlation" 0x0041e970,121,structure_candidate_collection_refresh_filter_and_year_visible_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide counter refresh over the live structure-candidate pool at `0x0062ba8c`. The helper clears aggregate counts `[this+0x242]` and `[this+0x31a]`, then walks all `0x35` candidate slots through the collection accessors. For each live slot it stores the cargo-economy or editor-filter flag `[entry+0x56]` into one per-slot band rooted at `[this+0x246]`, increments `[this+0x31a]` when that flag is nonzero, re-enters `structure_candidate_is_enabled_for_current_year` `0x0041e220`, stores that result into the paired per-slot band rooted at `[this+0x16e]`, and increments `[this+0x242]` when the year-visible gate succeeds. Current grounded callers include the periodic boundary-service path at `0x0040a56a`, the post-fast-forward setup tail at `0x00437192`, the cargo-economy filter refresh family at `0x0041eac0/0x0041f584`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring locomotive-side bridge at `0x00464aa8`, so this is the safest current read for the shared candidate-collection filter and year-visible count rebuild rather than a one-off world-entry helper.","objdump + local disassembly + caller correlation + candidate-count correlation + year-visible correlation" +0x0041f4e0,77,structure_candidate_collection_construct_and_stream_load_records_then_refresh_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the live structure-candidate collection rooted at `0x0062ba8c`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c997c`, clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, seeds the collection through `0x00518570` with literal tuple `(1, 0xd0, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0` plus `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded caller is the world-entry load branch at `0x00438c5c`, which stores the finished object into global `0x0062ba8c`, so this is the safest current read for the constructor above the structure-candidate tagged load seam rather than a generic collection allocator.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation" +0x0041f530,89,structure_candidate_collection_release_live_entries_reimport_tagged_records_and_refresh_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation + reset-path correlation,3,"Reset-side sibling over the live structure-candidate collection at `0x0062ba8c`. When the collection currently holds live entries, the helper walks every live id through `0x00518380/0x00518140` and dispatches entry vtable slot `+0x08` to release per-entry state, then clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0`, and finally reruns `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded callers are the later post-load count-refresh family and nearby world-entry restore branches, so this is the safest current read for the in-place candidate reset or reimport sibling rather than a standalone destructor.","objdump + local disassembly + caller correlation + reset-path correlation + entry-release correlation" 0x0041e9f0,87,cargo_collection_find_entry_by_exact_name,map,thiscall,inferred,objdump + local disassembly + collection-correlation,3,"Exact string matcher over the live cargo collection at `0x0062ba8c`. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the caller-supplied token string against each entry name at `[cargo+0x04]` through `0x005a57cf`, and returns the first matching cargo entry pointer or null. Current grounded callers are the recipe-runtime importer `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and its neighboring collection service branches around `0x0041ea50`, so this now looks like the shared live cargo-name resolver beneath recipe import and setup-side cargo text matching rather than an anonymous collection walk.","objdump + local disassembly + collection-correlation + caller correlation" -0x0041ea50,179,world_setup_building_collection_phase,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. The helper iterates the building-related collection at `0x0062ba8c`, chooses either the full pass or one modulo-selected bucket from the current world byte at `[0x006cec78+0x0f]`, resolves each entry through `0x00518380` and `0x00518140`, and then dispatches the selected record into the lower setup worker at `0x0041e2b0`. Current grounded callsite is the early collection sweep inside world_run_post_load_generation_pipeline immediately before the localized progress update `Setting up Players and Companies...`, so this looks like the collection-owned building-setup staging phase rather than one of the later player-speed or shell-frame loops.",objdump + caller context + RT3.lng strings +0x0041ea50,179,structure_candidate_collection_run_post_load_local_service_setup_phase,map,cdecl,inferred,objdump + local disassembly + caller context,3,"Post-load world-generation subphase over the live structure-candidate collection at `0x0062ba8c`. The helper derives one modulo-`6` bucket from current world byte `[0x006cec78+0x0f]`, then walks the full collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. When the caller-supplied phase flag is zero it only dispatches candidates whose loop ordinal falls into that current modulo bucket; otherwise it runs the full pass. Every selected candidate is then forwarded into `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0`. Current grounded callsite is the early candidate sweep inside `world_run_post_load_generation_pipeline` `0x004384d0` immediately before the localized progress update `Setting up Players and Companies...`, so this is a candidate-local post-load setup phase rather than a building-collection owner.","objdump + local disassembly + caller context + collection-correlation + modulo-bucket correlation" 0x0041e220,52,structure_candidate_is_enabled_for_current_year,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper.","objdump + caller xrefs + callsite inspection + cargo-economy filter correlation" 0x0041e650,142,structure_candidate_query_route_style_or_local_availability_metric,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + collection-correlation,3,"Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader.","objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation" -0x0041e7be,261,structure_candidate_accumulate_positive_cargo_summary_channels_scaled_by_link_count,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Broader world-side accumulator above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. For one caller-selected cargo id and mode bank it first queries the four returned summary channels, rejects immediately unless direct supply, cap-normalized supply, demand or input, and scaled production output are all strictly positive, then queries one linked-instance count through `0x00413940`. When that count is positive it multiplies each of the four channel values by the linked-instance count and accumulates those four scaled results into caller-owned floats before finally copying the finished quartet into candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]`; it also stamps the current scenario tick or year field from `[0x006cec78+0x15]` into `[candidate+0x8a]` after the outer loop completes. Current grounded callers are the broader placed-structure cargo service and world-side rebuild paths above the candidate projection family, so this is now the strongest current read for the first positivity-gated consumer that treats the four cargo-summary banks as one linked-count-scaled quartet rather than as independent query outputs.","objdump + local disassembly + caller inspection + cargo-summary correlation + link-count correlation" +0x0041e7be,261,structure_candidate_accumulate_positive_cargo_summary_channels_scaled_by_link_count,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Broader world-side accumulator above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. For one caller-selected cargo id and mode bank it first queries the four returned summary channels, rejects immediately unless the direct primary-cargo scalar, cap-share primary-cargo scalar, nonzero-mode subrow scalar, and zero-mode cap-scaled subrow scalar are all strictly positive, then queries one linked-instance count through `0x00413940`. When that count is positive it multiplies each of the four channel values by the linked-instance count and accumulates those four scaled results into caller-owned floats before finally copying the finished quartet into candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]`; it also stamps the current scenario tick or year field from `[0x006cec78+0x15]` into `[candidate+0x8a]` after the outer loop completes. Current grounded callers are the broader placed-structure cargo service and world-side rebuild paths above the candidate projection family, so this is now the strongest current read for the first positivity-gated consumer that treats the four cargo-summary banks as one linked-count-scaled quartet rather than as independent query outputs.","objdump + local disassembly + caller inspection + cargo-summary correlation + link-count correlation" 0x00467eb0,104,placed_structure_route_link_attach_site_owner,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Attaches one `0x006ada90` route-link record onto the owner chain of one placed structure. The helper first detaches the current record through `0x00467df0`, stages the caller-supplied placed-structure id into route-link field `+0x0a`, links the record into the placed-structure-owned chain at `[site+0x272]` through route-link field `+0x04`, and then re-enters `0x00467c30` to recompute the route-link flag byte at `+0x12` against neighboring site pairs. When that flag byte keeps bit `0x2` set, the helper also projects one class-indexed signed contribution through `0x0040fa50` and accumulates it into the placed structure through `0x0042b310`. Current grounded caller is the route-link allocator path at `0x00468067`, which makes this the clearest current owner bridge from one freshly allocated `0x006ada90` record into the site-linked chain later scanned by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` and `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650`.","objdump + caller xrefs + chain-layout inspection + route-link-correlation" 0x00467df0,183,placed_structure_route_link_detach_current_owner_chain,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Detaches one `0x006ada90` route-link record from whichever owner chain currently anchors it. The helper first checks route-link field `+0x08`; when nonzero it treats that field as one route-node-like owner id in collection `0x006cfcbc` and unlinks the record through owner field `+0x04` plus route-node link slot `+0x29`. Otherwise it falls back to the placed-structure owner path, using route-link field `+0x0a` as one site id in collection `0x0062b26c`, optionally applying the same class-indexed signed contribution rollback through `0x0040fa50` and `0x0042b310` when flag byte `+0x12` keeps bit `0x2` set, and then unlinking through `[site+0x272]`. Current grounded callers are the site-owner attach path at `0x00467eb0`, the route-node attach path at `0x00467f20`, and the route-link destructor path at `0x004680b0`, so this now looks like the shared detach helper beneath all owner-chain rewrites for the route-link family.","objdump + caller xrefs + chain-layout inspection + owner-slot correlation" 0x00467c30,443,placed_structure_route_link_recompute_endpoint_pair_state,map,thiscall,inferred,objdump + caller xrefs + endpoint-pair inspection,3,"Recomputes the route-link state byte at `+0x12` from the active site-endpoint pair and updates the linked site contribution when that state flips. The helper only runs on the site-owned branch where route-link field `+0x08` is zero; it resolves the two endpoint site ids from fields `+0x0a` and `+0x0e` through collection `0x0062b26c`, clears the prior bit-`0x2` state, then compares the two endpoint-side route-entry chains through `0x00455f60`, `0x0047de00`, `0x0040c990`, and `0x0047f2d0` until it finds a compatible shared peer. On the first match it restores bit `0x2` in the state byte. If the boolean substate derived from bit `0x1` changes across the recomputation, the helper applies one signed class-indexed contribution through candidate class byte `+0x10`, the class-weight table at `0x0062ba8c+0x8e`, and `0x0042b310` against the first endpoint owner. Current grounded callers are the site-owner attach path `0x00467eb0`, the route-link rebuild sweep around `0x004682e6`, and the route-link allocator path at `0x0046809b`, so this now looks like the endpoint-pair state reconciler beneath the route-link family rather than a generic chain walk.","objdump + caller xrefs + endpoint-pair inspection + shared-peer correlation" @@ -246,7 +282,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00468260,84,placed_structure_route_link_collection_remove_links_by_route_node_id,map,thiscall,inferred,objdump + caller xrefs + field-match inspection,3,"Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose route-node owner field at `+0x08` matches one caller-supplied id. The helper walks the live route-link collection, compares each record's `u16` field `+0x08` against the requested route-node id, and erases matching records through the same collection vfunc used by the broader cleanup paths. Current grounded caller is the neighboring runtime teardown at `0x004acf03`, which keeps this as the route-node-side cleanup companion to `placed_structure_route_link_collection_remove_links_touching_site_id` rather than another site sweep.","objdump + caller xrefs + field-match inspection + route-node-cleanup correlation" 0x004682c0,58,placed_structure_route_link_collection_recompute_all_endpoint_pair_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path.","objdump + caller inspection + collection-iteration inspection + recompute-helper correlation" 0x00468300,235,placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state,map,thiscall,inferred,objdump + caller inspection + world-grid correlation + collection-iteration inspection,3,"Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk.","objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation" -0x0041e2b0,589,structure_candidate_rebuild_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `world_setup_building_collection_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate.","objdump + caller xrefs + callsite inspection + world-grid correlation" +0x0041e2b0,589,structure_candidate_rebuild_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `structure_candidate_collection_run_post_load_local_service_setup_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate.","objdump + caller xrefs + callsite inspection + world-grid correlation" +0x0042da90,129,scenario_event_prepare_runtime_record_text_bands_for_packed_state_save,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small pre-save sweep over one live runtime event record immediately beneath the `.smp` event-collection serializer `0x00433060`. The helper re-enters `0x0042d820` six times with save-side flag `1` over the fixed text-band families rooted at `[record+0x0e0]`, `[+0x401]`, `[+0x4ca]`, `[+0x593]`, `[+0x65c]`, and `[+0x725]`, using size `0x320` for the first band and `0xc8` for the remaining five. Current grounded caller is the first event-collection sweep inside `0x00433060`, so this is the safest current read for the text-band preparation pass that runs before the packed runtime-record stream is emitted rather than for a standalone serializer.","objdump + local disassembly + caller correlation + fixed-text-band correlation" 0x0042db20,1040,scenario_event_refresh_runtime_record_from_packed_state,scenario,thiscall,inferred,objdump + caller inspection + local disassembly + shell-event-window correlation,2,"Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper.","objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation" 0x0042d700,59,scenario_event_query_standalone_condition_row_list_class_and_modifier_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan.","objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation" 0x0042d740,87,scenario_event_query_grouped_effect_row_list_type_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper.","objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation" @@ -258,6 +295,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0042c1b0,886,placed_structure_redistribute_local_service_pressure_from_neighbors,map,thiscall,inferred,objdump + caller xrefs + neighborhood sweep inspection,3,"Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop.","objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation" 0x0041eac0,794,structure_candidate_collection_refresh_cargo_economy_filter_flags,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + rdata strings,3,"Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and the live copy of special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]`; when that slot is set the branch at `0x0041ed37` further tests the wartime cargo family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and `Diesel` before writing the resulting enabled-or-filtered state into `[entry+0x56]` and re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule plus the `Use Wartime Cargos` scenario rule into live structure-candidate filtering rather than a purely editor-side helper.","objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation" 0x00421b60,180,world_region_collection_seed_default_regions,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup.","objdump + RT3.lng strings + caller xrefs + callsite inspection" +0x00421ce0,55,world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small collection-wide region overlay pass. The helper walks every live region entry through `indexed_collection_get_nth_live_entry_id` `0x00518380` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass` `0x0041fb00` on each record. Current grounded caller is the late `.smp` restore tail inside `world_load_saved_runtime_state_bundle` `0x00446d40`, immediately after `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730` and the broader post-close world/tool refresh strip.","objdump + local disassembly + caller correlation + region-overlay-pass correlation" 0x00421c20,187,world_region_collection_run_building_population_pass,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup.","objdump + caller xrefs + callsite inspection" 0x0042b2d0,52,route_entry_list_contains_key,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Boolean membership test over the compact six-byte route-entry list rooted at `[this+0xeb]/[this+0xef]`. The helper linearly scans the current rows and returns true when any leading `u16` key matches the caller-supplied id; otherwise it returns false. Current grounded callers include the linked-site support strip at `0x0040d27f`, the region or profile-side query family at `0x0041f6e7`, `0x0042007c`, `0x0042011a`, `0x0042020c`, `0x004202ba`, `0x004208b6`, and the later placed-structure branch at `0x004adecf`, so this is the safest current read for the shared contains-key helper beneath the same six-byte route-entry list family.","objdump + caller xrefs + local disassembly + six-byte-record correlation" 0x00422320,1320,world_region_normalize_cached_structure_balance_scalars,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Collection-wide region normalization pass over the live region manager `0x0062bae0`. The helper first early-outs in sandbox/editor-side mode through `[0x006cec7c+0x82]` and the active-mode latch `[0x006cec78+0x4aef]`, then runs one per-region prepass through `0x00420d40`, and finally performs two cohort sweeps split by region live byte `[region+0x23e]`. Across those sweeps it accumulates the cached scalar bands `[region+0x2b2/+0x2b6/+0x2ba/+0x2be/+0x2c2/+0x2c6]`, derives bounded normalization ratios, and writes the resulting cached growth-balance band back to `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. The player-facing meaning is tighter now from the editor growth report at `0x004d1d60`: `[region+0x2e2]` is the cached weighted-profit-margin scalar and `[region+0x2ee]` is the cached annual-density-adjust scalar later formatted as a percent, while `[region+0x2e6]` and `[region+0x2ea]` are the intermediate normalized-delta and clamped companion slots beneath that final annual-density adjust. The helper also uses world_region_count_linked_placed_structures_by_category `0x004228b0` as the direct category-count companion during the writeback sweep, and it applies one final live-value adjustment into `[region+0x25e]` when the shell latch `[0x006cec78+0x46c38]` is clear. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a265` inside `simulation_service_periodic_boundary_work` `0x0040a590`, so this is now the safest current read for the region cached growth-balance normalization pass rather than a one-time setup helper.","objdump + local disassembly + caller inspection + recurring-maintenance correlation + editor-growth-report correlation" @@ -268,11 +306,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00422be0,768,world_region_count_placed_structures_for_category,map,thiscall,inferred,objdump + callsite inspection,3,"Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen.","objdump + callsite inspection" 0x00422ee0,884,world_region_try_place_candidate_structure,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family.","objdump + caller xrefs + callsite inspection" 0x004235c0,1887,world_region_balance_structure_demand_and_place_candidates,map,thiscall,inferred,objdump + callsite inspection,4,"Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, queries projected structure-count scalars through `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0`, and then computes target demand for three structure categories by comparing those projected totals against live placed counts plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop.","objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation + projected-demand correlation" -0x004234e0,211,world_region_query_projected_structure_count_scalar_by_category,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Returns one projected structure-count scalar for the requested region and category family. On the live-region branch `[region+0x23e] != 0`, the helper indexes the category table at `0x005ee1b0` by `(live_region_class, category)`, scales it by scenario difficulty and the normalized region-density field `[region+0x25e]`, then multiplies by the cached building-count slot `[region+0x242]`. On the fallback branch it instead derives one region bucket from `[region+0x25e]`, combines the two static tables `0x005ee138` and `0x005ee1b0`, and applies the alternate scenario-difficulty scale before returning the final float. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator.","objdump + local disassembly + caller correlation + city-count-stats correlation" +0x004234e0,211,world_region_query_projected_structure_count_scalar_by_category,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Returns one projected structure-count scalar for the requested region and category family. On the live-region branch `[region+0x23e] != 0`, the helper indexes the category table at `0x005ee1b0` by `(live_region_class, category)`, scales it by scenario difficulty and the normalized region-density field `[region+0x25e]`, multiplies by the global pre-recipe scalar `[world+0x0bde]`, and then multiplies by the cached building-count slot `[region+0x242]`. On the fallback branch it instead derives one region bucket from `[region+0x25e]`, combines the two static tables `0x005ee138` and `0x005ee1b0`, applies the alternate scenario-difficulty scale, and again multiplies by `[world+0x0bde]` before returning the final float. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator.","objdump + local disassembly + caller correlation + city-count-stats correlation + pre-recipe-scalar correlation" 0x00423d30,51,world_region_refresh_cached_category_totals_and_weight_slots,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Refreshes one small cached region summary band rooted at `[this+0x27a]`. The helper forwards three out-pointers `+0x27a/+0x27e/+0x282` plus one return slot `+0x286` into world_region_accumulate_structure_category_totals `0x00422900`, forcing the remaining category outputs and optional aggregate pointers to zero. Current grounded caller is the post-load seeding-burst tail around `0x00437bdc`, which sweeps the live region collection `0x0062bae0` after simulation_run_chunked_fast_forward_burst `0x00437b20`. This is therefore the narrow cached-category-summary refresher beneath that region-side setup and maintenance family rather than a company debt-table helper.","objdump + local disassembly + caller inspection + post-load caller correlation" 0x00423d70,176,company_repay_bond_slot_and_compact_debt_table,simulation,thiscall,inferred,objdump + caller inspection,4,"Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper.","objdump + caller inspection + finance-field correlation" 0x00423ec0,33,company_adjust_available_track_laying_capacity_with_floor_zero,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter.","objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation" 0x004240a0,28,company_query_available_track_laying_capacity_or_unlimited,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement.","objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation" +0x00424000,3,company_serialize_tagged_runtime_payload_noop,simulation,thiscall,inferred,objdump + local disassembly + company-save correlation,2,"Tiny current no-op callback beneath the company collection package-save strip. The helper simply returns zero and performs no per-company tagged payload write. Current grounded caller is `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, so this is best read as the present save-side per-company payload stub rather than a standalone company mutation helper.","objdump + local disassembly + company-save correlation + callback-role correlation" 0x00424010,29,company_has_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`.","objdump + caller inspection + territory-access table correlation" 0x00423e40,112,company_compute_weighted_average_bond_interest_rate,simulation,thiscall,inferred,objdump + caller xrefs + debt-record inspection,4,"Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier.","objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation" 0x00423eb0,6,company_query_cached_share_price_scalar,simulation,thiscall,inferred,objdump + caller xrefs + per-share panel correlation,3,"Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read.","objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation" @@ -288,6 +327,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00427540,76,company_compute_bond_interest_rate_quote,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Computes one company-specific bond interest-rate quote from the requested term and current credit or rate state. When the company is active it combines the current company credit-rating score from `0x00425320`, the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one.","objdump + caller xrefs + callsite inspection + bond-rate correlation + credit-rating correlation + prime-rate correlation" 0x004275c0,255,company_issue_bond_and_record_terms,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons.","objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation" 0x00426890,68,company_find_collection_index_by_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`.","objdump + caller inspection + company collection correlation" +0x004268e0,103,company_refresh_post_load_year_clamp_and_runtime_support_fields,simulation,thiscall,inferred,objdump + local disassembly + company-load correlation,3,"Per-company load-side follow-on beneath the live company collection bundle refresh. The helper clears runtime support dwords `[this+0x0d3a]` and `[this+0x0d3e]`, then clamps founding-year lane `[this+0x157]` into the active scenario-year band rooted at `[0x006cec78+0x05/+0x0d]`. Current grounded caller is `company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x00429af0`, so this is the safest current read for the post-load company year clamp and runtime support reset rather than a shell-side finance helper.","objdump + local disassembly + company-load correlation + field-reset correlation" 0x00426be0,53,company_can_purchase_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt.","objdump + caller inspection + RT3.lng strings + territory-flag correlation" 0x00426d60,393,company_deactivate_and_clear_chairman_share_links,simulation,thiscall,inferred,objdump + caller inspection + collection-state correlation,4,"Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper.","objdump + caller inspection + collection-state correlation + CompanyDetail control correlation" 0x00426ef0,43,company_get_linked_chairman_profile_record,simulation,thiscall,inferred,objdump + caller inspection,4,"Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text.","objdump + caller inspection + chairman-link correlation" @@ -313,21 +353,29 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00425880,64,company_compute_negative_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation" 0x004258c0,396,company_compute_positive_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation" 0x00429c70,976,company_read_derived_financial_report_metric_slot,simulation,thiscall,inferred,objdump + caller inspection + shell-label correlation,3,"Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper.","objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation" +0x00429950,42,company_collection_construct,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the live company collection later rooted at `0x0062be10`. The helper seeds the indexed-collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0x7684, initial_slots=5, growth=5, id_base=1)`, installs vtable `0x005c9bf8`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x0062be10`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" +0x00429980,11,company_collection_release_entries_and_collection_storage,simulation,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `company_collection_construct` `0x00429950`. The helper reinstalls vtable `0x005c9bf8` and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip inside `0x00434300`, which releases global `0x0062be10` with the other typed runtime collections.","objdump + world-shutdown correlation + local disassembly + companion correlation" 0x00429990,86,company_collection_get_nth_active_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows.","objdump + caller inspection + active-company roster correlation" 0x004299f0,84,company_collection_count_active_companies_before_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`.","objdump + caller inspection + active-company roster correlation" 0x00429a50,62,company_collection_count_active_companies,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math.","objdump + caller inspection + active-company roster correlation" +0x00429af0,118,company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load owner for the live company collection `0x0062be10`. The helper reads tagged sections `0x61a9/0x61aa/0x61ab` through repeated `0x00531360` calls, refreshes the indexed-collection header through `0x00518680`, and then walks every live company entry dispatching each record through `0x004268e0` with the active bundle handle before closing the final tag. Current grounded caller is the world-entry bring-up family, where this helper refreshes the live company records from the tagged bundle after collection construction.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation" +0x00429b90,92,company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle,simulation,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save sibling for the live company collection `0x0062be10`. The helper opens tagged sections `0x61a9/0x61aa/0x61ab` through repeated `0x00531340` calls, serializes the indexed-collection header through `0x00517d90`, and then walks every live company entry dispatching each record through the current no-op payload callback `0x00424000` before closing the final tag. Current grounded caller is the package-save path that persists the live runtime collections beside the other world roots.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation" 0x00430270,225,world_try_place_random_structure_batch_from_compact_record,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Shared world-side retry loop that tries to place multiple structures from one compact spawn record. The caller supplies one small record whose fields now read most safely as a structure or profile token at `+0x00`, requested placement count at `+0x11`, center coordinates at `+0x12/+0x14`, and placement radius or extent at `+0x16`. The helper translates the token through the static table at `0x0061039c` into the live structure-profile collection `0x0062b268`, increments the region-manager reentrancy counter at `[0x0062bae0+0x88]`, and then runs up to `200` randomized attempts while placements remain. Each attempt samples a candidate coordinate inside the requested radius, rejects points outside the live world bounds at `[0x0062c120+0x2155/+0x2159]`, resolves the owning region through `0x0044a800` and `0x0062bae0`, adapts the candidate through `0x00412880`, and finally re-enters `world_region_validate_and_commit_candidate_placement` `0x00422a70`. Successful placements decrement the remaining batch count and reset the local retry counter. Current grounded caller is the world-side dispatch branch at `0x00431b43`, where only compact record classes in the `0x1f7..0x265` table range enter this batch placer. This is therefore the strongest current read for the world-side randomized structure-batch placement loop rather than a region-worker-private helper.","objdump + local disassembly + caller correlation + placement-batch correlation" 0x00430b50,624,scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Builds one runtime-effect record in the live scenario event collection from a compact source record plus the caller's currently resolved targets. The helper first allocates a new runtime-effect entry through `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`, then seeds several per-record control bytes and target selectors in the new object, including mode byte `[record+0x7ef]`, optional gating bytes `[record+0x7f4/+0x7f9/+0x7fa]`, a primary selector at `[record+0x7f0]`, and optional comparison ids at `[record+0x82c/+0x830]`. Current grounded callers are the compact runtime-effect dispatcher `0x00431b20`, where fallback branches synthesize follow-on runtime effects from one compact linked record, and the shell-side branch at `0x004d60fd`, where the same builder is reached with a caller-owned output slot. This is therefore the current safest read for the runtime-effect follow-on record builder rather than a generic collection insert wrapper.","objdump + local disassembly + caller correlation + runtime-effect-builder correlation" +0x00430d70,990,scenario_event_serialize_runtime_record_into_packed_state,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Per-record save-side companion to `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` beneath the `.smp` event-collection serializer `0x00433060`. The helper first re-enters `0x0042d820` six times with clear-side flag `0` over the same fixed text bands rooted at `[record+0x0e0]`, `[+0x401]`, `[+0x4ca]`, `[+0x593]`, `[+0x65c]`, and `[+0x725]`, then counts the standalone linked runtime-condition row chain at `[record+0x00]` and the four grouped runtime-effect row chains rooted at `[record+0x04/+0x08/+0x0c/+0x10]`. It writes per-family version marker `0x526f`, serializes each `0x1e` condition row with its scalar and byte fields plus the optional resolved candidate-name side string for bounded candidate-id ranges, emits grouped-row marker `0x4eb8` plus the four per-slot counts, and then serializes each `0x28` grouped row with the same version-gated field extension seen on restore, including the optional linked locomotive-name side string for bounded locomotive-id ranges before the later grouped remap and write-side branches continue. Current grounded caller is `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, so this is the safest current read for one live event's packed-state serializer rather than a broader collection walk.","objdump + local disassembly + caller correlation + event-record-save correlation + condition-row-and-effect-row correlation" 0x00431b20,399,world_apply_compact_runtime_effect_record_to_resolved_targets,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Dispatches one linked compact runtime-effect record against the caller-resolved target context. The record token at `[*record+0x00]` is translated through the static table at `0x0061039c`; when the translated class lies in the `0x1f7..0x265` range the helper immediately re-enters `world_try_place_random_structure_batch_from_compact_record` `0x00430270`. Otherwise it jumps through the local class table at `0x004320b4/0x004320fc` into a mixed effect family that now includes: shell-state modifier branches over `0x006cec78`, signed scalar adjustments on resolved company/profile/territory targets through the `0x004d6611/0x004d6617` numeric readers, territory-access writes through `company_set_territory_access_rights_byte` `0x00424030`, selected-profile updates through `0x00434890/0x004348c0`, and several collection-side erase or follow-on branches. Current grounded caller is the outer loop at `0x00432317`, which walks linked compact records via `[record+0x24]` and supplies optional resolved company, chairman-profile, and adjacent owner context before each dispatch. This is therefore the current safest read for the wider compact runtime-effect dispatcher above the separate world-side structure-batch placement branch rather than as a placement-only helper.","objdump + local disassembly + caller correlation + effect-dispatch correlation" 0x004323a0,842,scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Per-record service pass over one live runtime-effect record in the scenario event collection. The helper first enforces several activation gates over the record's local control bytes and shell-side preview state, including one one-shot latch at `[this+0x81f]`, mode byte `[this+0x7ef]`, optional preview-policy byte `[this+0x7f4]`, and shell-side state at `0x006cec78/0x006cec74`. Once active it formats the optional status line through shell news helper `0x004554e0`, derives a target-availability bitmask through `0x0042d700`, resolves optional company/chairman/territory target pools, and then walks the linked compact effect chain rooted at `[this+0x00]`. Each linked record is dispatched through `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, while fallback branches synthesize follow-on runtime-effect records through `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50`. When any effect fires it may refresh company share-price caches through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, and records with nonzero `[this+0x7f5]` set the one-shot latch `[this+0x81f]`. Current grounded caller is the collection-wide service loop `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40`. This is therefore the current safest read for the runtime-effect record service and linked-effect dispatcher rather than a low-level target iterator.","objdump + local disassembly + caller correlation + runtime-effect-service correlation" -0x00433130,169,scenario_event_collection_refresh_runtime_records_from_packed_state,scenario,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper stages one small packed header read from the caller-supplied state or stream object, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk.","objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation" +0x00433060,198,scenario_event_collection_serialize_runtime_records_into_packed_state,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide save-side companion to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130` for the live event collection at `0x0062be18`. The helper opens chunk `0x4e99`, writes fixed version dword `0x3e9`, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and first re-enters `scenario_event_prepare_runtime_record_text_bands_for_packed_state_save` `0x0042da90` on each record. It then uses `0x00517d90` to emit the collection-side packed metadata, opens chunk `0x4e9a`, walks the same live records again through the same indexed-collection helpers, and re-enters `scenario_event_serialize_runtime_record_into_packed_state` `0x00430d70` on each one before closing with chunk `0x4e9b`. Current grounded caller is the `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, so this is the safest current read for the event-side packed-state save owner rather than an anonymous collection walk.","objdump + local disassembly + caller correlation + event-collection-save correlation" +0x00433130,169,scenario_event_collection_refresh_runtime_records_from_packed_state,scenario,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper opens chunk `0x4e99`, reads one fixed header dword from the caller-supplied state or stream object, re-enters the collection-side metadata refresh at `0x00518680`, then opens chunk `0x4e9a`, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record before closing chunk `0x4e9b`. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk.","objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation + chunk-family correlation" 0x004336d0,95,world_runtime_reset_startup_dispatch_state_bands,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small runtime-object zero-init helper immediately above `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`. The helper clears a bounded startup-owned state band on the caller object, including `[+0x4cae]`, `[+0x4cb2]`, `[+0x46a80..+0x46aa0]`, `[+0x66b2]`, `[+0x66b6]`, `[+0x46c34]`, and `[+0x66ae]`, then returns the same pointer. Current grounded callers are the mode-`4` `LoadScreen.win` lane inside `shell_transition_mode` at `0x004830b6` and the multiplayer preview launch lane at `0x0046b8c9`, both of which then publish the returned object into `0x006cec78` and immediately call `0x00438890`. This is therefore the safest current read for the pre-dispatch runtime reset helper rather than another world-release path.","objdump + caller xrefs + local disassembly + pre-dispatch-state correlation" 0x00433730,1,world_runtime_release_followon_noop_placeholder,map,cdecl,inferred,objdump + local disassembly + caller correlation,1,"Single-instruction `ret` placeholder immediately beside `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`. Current grounded caller is the old-active-mode teardown branch inside `shell_transition_mode` `0x00482ec0`, where it contributes no observable release work between `world_runtime_release_global_services` `0x00434300` and the common free path `0x0053b080`. This is therefore the safest current read for a no-op followon placeholder rather than a meaningful runtime teardown owner.","objdump + local disassembly + caller correlation" 0x00432ea0,103,scenario_event_collection_allocate_runtime_effect_record_from_compact_payload,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Allocates and initializes one live runtime-effect record in the scenario event collection at `0x0062be18` from a compact payload source. The helper allocates one temporary `0x88f` payload object, inserts a new collection entry through the generic collection allocator path, resolves the inserted live entry, and then initializes that entry from the caller-supplied compact payload through `0x0042d670` before freeing the temporary object. Current grounded callers are `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50` and the shell-side branch at `0x004db9f1`, where the returned live entry id is stored back into the caller object. This is therefore the current safest read for the scenario event collection's runtime-effect allocator rather than a generic collection clone helper.","objdump + local disassembly + caller correlation + runtime-effect-allocation correlation" 0x00432f40,267,scenario_event_collection_service_runtime_effect_records_for_trigger_kind,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide service loop over the live scenario event collection at `0x0062be18` for one caller-selected trigger kind byte. The helper first rejects fast-forward and editor-map gates through `0x006cec78+0x46c38`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x68]` unless the trigger kind is `9`, then walks every live runtime-effect record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Each resolved record is serviced through `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` `0x004323a0` with the selected trigger kind and optional text sink. When any record fires, the helper refreshes every active company's cached share price through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`; when the collection dirty latch at `[this+0x88]` is raised it clears that latch and immediately reruns the whole pass with trigger kind `0x0a`. The caller split is now tighter too: recurring simulation maintenance drives kinds `1`, `0`, `3`, and `2` through `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3`, while the neighboring route-style follow-on at `0x0040a91f` drives kinds `5` and `4` through `0x0040a930` and `0x0040a9ac`; world or startup-side company creation branches at `0x00407682`, `0x0047d293`, `0x0047d42b`, and `0x0047d6de` drive kind `7`; the kind-`6` branch is now tighter too, covering the placed-structure post-create tail at `0x0040f69e`, the build-version-gated company-startup or roster-refresh tail at `0x00428406`, and the route-entry post-change sweep at `0x004a3eae`; the kind-`8` world-entry one-shot gate now sits inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where it fires after the post-load company or route setup passes and then clears shell-profile latch `[0x006cec7c+0x97]`; and the `LoadScreen.win` briefing page at `0x004e520b` drives kind `9`. This is therefore the current safest read for the scenario event collection's collection-wide runtime-effect service loop rather than a generic text-query helper.","objdump + local disassembly + caller correlation + collection-service correlation + trigger-kind callsite decode" -0x00433bd0,546,world_refresh_selected_year_bucket_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads the packed world year at `[this+0x0d]`, bins it against the threshold table at `0x005f3978/0x005f3980`, derives one interpolated bucket fraction when the current year falls inside a nontrivial range, and writes the resulting float band into `[this+0x65]`, `[this+0x69]`, `[this+0x6d]`, and `[this+0x4ca2]` after one build-version-sensitive clamp through `0x00482e00`. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on.","objdump + local disassembly + caller inspection + year-bucket-table correlation + world-entry correlation" +0x00433bd0,546,world_refresh_selected_year_bucket_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads packed year word `[this+0x0d]`, walks the 21-entry threshold ladder rooted at `0x005f3980`, and chooses either the first bucket baseline at `0x005f3984`, the terminal bucket scalar at `0x005f3a24`, or one interpolated scalar between the paired `(year,value)` table entries at `0x005f3978/0x005f3980`. It then derives the dependent selected-year float band from that chosen scalar: direct bucket lanes `[this+0x65]`, `[this+0x69]`, and `[this+0x6d]` come from three fixed multipliers, while the later normalized companion lane is rebuilt after a build-version-sensitive clamp through `0x00482e00(0x006cec74)` before the wider selected-year sidebands continue. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on.","objdump + local disassembly + caller inspection + threshold-ladder correlation + year-bucket-table correlation + world-entry correlation" +0x00433f02,28,scenario_state_roll_pending_float_0x4caa_into_accumulator_0x4ca6,map,thiscall,inferred,objdump + local disassembly + field xrefs,3,"Tiny scenario-state accumulator rollup over the late world-state float pair `[this+0x4ca6]` and `[this+0x4caa]`. The helper adds the pending lane `[this+0x4caa]` into accumulator `[this+0x4ca6]`, clears `[this+0x4caa]` back to zero, and returns. Current field evidence grounds the relationship too: the periodic support-side branch at `0x0041144f` accumulates live deltas into `[0x006cec78+0x4caa]`, while the shell-side query family at `0x0042f89b/0x0042f8bb` reads both the pending lane alone and the accumulated sum. Current grounded caller is the late world-side scalar rollup strip around `0x00433ec0`.","objdump + local disassembly + field xrefs + accumulator-rollup correlation" 0x00434050,11,shell_has_auxiliary_preview_owner,shell,cdecl,inferred,objdump + caller inspection + side-owner correlation,4,"Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live.","objdump + caller inspection + side-owner correlation + caller xrefs" 0x00434080,80,scenario_state_query_cached_available_locomotive_rating_clamped_for_shell,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small read-side helper over cached scenario-state float `[this+0x4cbe]`. The helper returns that cached available-locomotive rating in `st(0)` when it stays under the local threshold, and otherwise falls back to one fixed shell-side float constant before returning. Current grounded caller is the shell-side formatter band around `0x004b11c5`, where this cached value is optionally rounded to an integer and then compared against display thresholds `40/50/70/85/100`. This is therefore the safest current read for the query-side companion of the later locomotive-rating refresh rather than a broader world-state getter.","objdump + caller inspection + local disassembly + shell-threshold correlation + display-bucket correlation" +0x00434130,196,scenario_state_refresh_year_gap_scalar_from_current_year_minus_1850_into_0x4ca2,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small year-derived float refresh over active scenario state `0x006cec78`. The helper subtracts literal base year `1850` from current year word `[this+0x0d]`, converts that year gap into one normalized float through fixed constants rooted at `0x005c9680`, `0x005c8770`, `0x005c9ef8`, and `0x005c8d80`, stores the result into `[this+0x4ca2]`, and clamps that field into the closed `0.0..1.0` range. Current grounded callers are the periodic year-step branch at `0x0040a310`, the scenario-state reset or rebuild owner at `0x00436d10`, and the two world-entry load lanes at `0x00443edd` and `0x00444070`, so this is the safest current read for a shared year-gap-derived scenario float refresh rather than a presentation-only helper.","objdump + caller xrefs + local disassembly + year-gap correlation + clamp correlation" 0x00434300,881,world_runtime_release_global_services,map,cdecl,inferred,objdump + local disassembly + caller correlation,4,"Primary old-world teardown owner for the live runtime object at `0x006cec78`. The helper first increments one local reentrancy band at `[this+0x4c93]`, then destroys and frees the two indexed world collections at `[this+0x66b2]` and `[this+0x66b6]` through `0x00518bd0` plus `0x0053b080`, clears global roots `0x0062b244`, `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, and `0x0062c120` through their typed release siblings `0x0040b720`, `0x004b23b0`, `0x00429980`, `0x00477770`, and `0x00449500`, and then tears down the map-content service roots `0x0062ba8c`, `0x006ada84`, `0x0062ba88`, `0x0062b2fc`, `0x0062b268`, `0x006cea4c`, and `0x006acd34` through `0x0041e8d0`, `0x004619b0`, `0x0041d7a0`, `0x00419680`, `0x00412a90`, `0x00473da0`, and `0x00455350` before freeing each backing object and nulling the global slot. After that typed global strip it releases the eight shell-helper handles at `[this+0x46a80..+0x46aa0]` plus the variable-length owner band rooted at `[this+0x46aa4]` through repeated `0x0053c000`, drains the linked chains at `[this+0x66a6]` and `[this+0x66aa]` through `0x0053afd0`, clears `[this+0x66ae]`, optionally re-enters `0x00516ba0` when shell gate `0x006d3b4c` is live, and finally decrements `[this+0x4c93]` before returning. Current grounded callers are the heavier world-entry branch `0x00443a50`, the sibling `.smp` world-state branch `0x00446d40`, and the old-active-mode teardown branch in `shell_transition_mode` `0x00482ec0`.","objdump + local disassembly + caller correlation + typed-global-release-order correlation" 0x00434d40,100,placed_structure_collection_seed_candidate_subtype2_runtime_latch,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Shared post-setup sweep over the live placed-structure collection at `0x0062b26c`. The helper walks every live placed structure through the indexed-collection accessors, resolves each linked candidate or structure descriptor through vtable slot `+0x80`, and when the resolved record's subtype byte `[candidate+0x32]` equals `2` it writes `1` to runtime dword `[candidate+0x7b0]`. Local field evidence is now tight enough to keep the name structural: the same dword is zeroed during candidate runtime materialization around `0x00412112`, read as a one-shot guard in the world-side placement branch around `0x00423c43`, and also written there after the guarded follow-on fires. Current grounded callers are the post-fast-forward setup tail at `0x00437bf9` and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared subtype-`2` candidate-runtime latch seeder rather than a one-off world-entry patch.","objdump + local disassembly + caller correlation + candidate-runtime-latch correlation" 0x004354a0,355,world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared shell-facing scalar publisher beneath selected-year changes, shell-state selector updates, and the late world-entry reactivation band. The helper always resolves the current shell presentation object through controller `0x006d4024 -> [controller+0x18]` and writes one clamped `0..255` integer into `[object+0x15]` through `0x00523d60`. Its source split is now bounded enough to name conservatively: when tutorial flag `0x006d3b4c` is live it forces `0`; otherwise it first honors the temporary shell-state selector pair `[0x006cec74+0x1df/+0x1e3]`, then the persisted selector pair `[0x006cec74+0x23b/+0x23f]` when sandbox bit `[0x006cec7c+0x82]` is set, and only when no selector override is active does it derive one interpolated scalar from the current year `[this+0x15]` against the ensured threshold band `[this+0x51/+0x55/+0x59/+0x5d/+0x61]` plus the base value at `[this+0x3a]`, re-entering `scenario_state_ensure_derived_year_threshold_band` `0x00435603` before the year-band path needs it. Current grounded callers are the simulation year-advance path at `0x0040ab39`, the shell-state setter at `0x00482878`, the startup-side branch at `0x005173d3`, and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared shell-controller progress-scalar publisher rather than a world-entry-only helper.","objdump + local disassembly + caller correlation + shell-controller correlation + year-threshold-band correlation" @@ -338,7 +386,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00434f20,272,scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437743` and `0x00436ad7` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation" 0x00435030,124,scenario_state_query_named_locomotive_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation" 0x004350b0,249,scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation" -0x00436af0,384,scenario_state_refresh_cached_available_locomotive_rating,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, filters them through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. It then normalizes and clamps that winning value into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper.","objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation" +0x004351c0,1099,scenario_state_rebuild_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Broader rebuild owner for the compact scenario-side year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. The helper first samples one shell presentation scalar through `0x006d4024 -> [controller+0x18] -> [object+0x15]`, chooses one of three range profiles from that scalar (`<0x28`, `<0x46`, or later), and seeds base lane `[this+0x61]` to `0xff`, `0xc8`, or `0xe6` together with one paired year-span scalar derived from the fixed `0x5a0` multiplier. It then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` on the current year `[this+0x15]`, queries three companion shell integers through `0x00527cc0`, folds those shell-side values into one normalized offset, and writes the rebuilt threshold quartet into `[this+0x51]`, `[this+0x55]`, `[this+0x59]`, and `[this+0x5d]` through the shared x87 rounding helper `0x005a10d0`. The same owner also contains the shell-facing follow-on hidden by the tiny ensure wrapper `0x00435603`: when the caller stack flag is nonzero, or when the current shell progress scalar falls outside the rebuilt band, it computes one interpolated or clamped `0..255` presentation value from current year `[this+0x15]`, base byte `[this+0x3a]`, floor `[this+0x61]`, and the rebuilt threshold quartet, then republishes that value into the current shell presentation object through `0x00523d60`. Current grounded callers are the ensure wrapper `0x00435603`, the shell command `0x004412e0`, the shell-state setter path around `0x00482878`, the compact runtime-effect side branch at `0x00431e03`, and the world-entry late rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the actual year-threshold rebuild owner beneath selected-year restore and shell progress refresh rather than another anonymous math body.","objdump + local disassembly + caller correlation + year-threshold-band correlation + shell-progress-followon correlation" +0x00436af0,384,scenario_state_refresh_cached_available_locomotive_rating_from_year_baseline_and_live_availability_gates,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]` with explicit tiers `110.0` through year `2000`, `200.0` after `2000`, and `300.0` after `2010`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, resolves the linked era through `[loco+0x72]`, filters each locomotive through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. The winning rating is forced to at least `1.0`, normalized, and clamped into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper.","objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation + year-baseline correlation" +0x004367c0,92,world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + RT3.lng strings,3,"Small world-side outcome-status helper. The caller-supplied mode dword is stored into `[this+0x4a73]`, world flag `[this+0x4d]` is cleared, and the current selected-year snapshot byte `[this+0x15]` is copied into `[this+0x4c88]`. The helper then copies one fixed localized string into status buffer `[this+0x4b47]`: id `2923` `You lose.` when the incoming mode equals `1`, otherwise id `2924` `You win, cheater...`. Current grounded callers are the cheat-modal owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and the scenario follow-on command branch around `0x004648e1`, so this is the safest current read for the cheat-owned outcome-mode setter rather than a generic prompt publisher.","llvm-objdump + local disassembly + caller correlation + RT3.lng strings + outcome-buffer correlation" +0x00436d10,522,scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges,map,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broader scenario-state reset or initialization owner over active world state `0x006cec78`. The helper first zeroes one contiguous late-state slab from `[this+0x4cc2]` for `0x9b` dwords plus one trailing byte, then separately clears the much larger late runtime slab rooted at `[this+0x66be]`. It seeds fixed default years `[this+0x66ca/+0x66ce/+0x66d2] = 0x726/0x7d0/0x74e`, seeds the sixteen 9-byte chairman-slot rows at `[this+0x69dc]` with default tuning `0x186a0`, and clears several now-grounded latch families explicitly: `[this+0x19/+0x21/+0x25/+0x29/+0x31/+0x3d/+0x41/+0x45/+0x49/+0x4d]`, outcome and cheat bands `[this+0x4a73/+0x4a77/+0x4a7b]`, the scenario-rule table `[this+0x4a7f..+0x4b3f]` plus trailing scalar `[this+0x4b43]`, the outcome text root `[this+0x4b47]`, the byte-policy and cached-scalar cluster `[this+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[this+0xbce..+0xbf6]` before reseeding the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `map_editor_economic_cost_slider_dispatch` `0x004ca980`: `+0xbde/+0xbe2 = 1.0f`, `+0xbe6/+0xbea/+0xbee/+0xbf2 = 0x3c75c28f`, and `+0xbf6 = 0x3ba3d70a`. It then zero-fills the twelve scenario recipe books at `[this+0x0fe7]` before copying one fixed default book template from `0x005c9f78` into each `0x4e1`-byte slot. It also destroys and recreates the two named-availability collections at `[this+0x66b2]` and `[this+0x66b6]` with fixed record sizes `0x22` and `0x41`, rebuilds selected-year and calendar state from the live profile plus shell gates into `[this+0x05/+0x09/+0x0d/+0x1d]` through `0x0051d3f0`, `0x0051d390`, `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, and `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, then re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0` before clearing several shell-controller-side cached state dwords under `0x006d4024+0x11425a..+0x114276`. Current grounded callers are the startup-profile dispatcher `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` and the world-entry coordinator `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared scenario-state reset-and-rebuild owner beneath startup and load paths rather than a smaller recipe-only helper.","objdump + caller xrefs + local disassembly + default-state correlation + economic-tuning-band correlation + named-availability-collection correlation + recipe-template correlation + selected-year-refresh correlation + runtime-bridge correlation + late-state-reset-cluster correlation" 0x0043cb00,295,world_view_step_heading_quadrant,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.,objdump + caller xrefs + callsite inspection 0x0043cc30,437,world_view_step_zoom_bucket,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4.,objdump + caller xrefs + callsite inspection 0x0043d050,111,world_view_set_focus_position_xyz,shell,thiscall,inferred,objdump + caller xrefs,4,Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d.,objdump + caller xrefs @@ -418,6 +469,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00514420,512,shell_train_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `TrainDetail.win` singleton later published at `0x006d3b20`. The constructor seeds the local vtable at `0x005d1990`, caches three shell runtime handles in `0x006d3b14..0x006d3b1c`, binds the `TrainDetail.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19c0`, and then wires the family controls and callbacks through `0x00540120`. Current grounded bindings are broad enough to treat this as the full `TrainDetail.win` family: it installs row-click callbacks on `0x65a3` and `0x65a4`, metric renderers on `0x65ab` and `0x65ac`, the selected-train callback on `0x659c`, the dynamic-name label callback on `0x659d`, seeds the side-toggle state through `shell_trainbuy_window_refresh_selection_side_toggle` at `0x00512f80`, and then refreshes the full window through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current grounded callers are the shell detail-panel transition manager at `0x004ddda1` and the direct opener at `0x00514620`.","objdump + caller inspection + strings correlation + callback binding + singleton correlation" 0x00514620,110,shell_open_or_focus_train_detail_window,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Shared opener or focus path for the shell-side `TrainDetail.win` singleton. When the caller supplies one valid train id present in the train collection at `0x006cfcbc`, the helper can seed the selected train subject through `0x004a7390`; when a live `TrainDetail.win` singleton already exists at `0x006d3b20` and the current shell runtime subject matches the incoming one, it simply refreshes that window and pings the shell runtime. Current grounded direct caller is the surrounding shell command path at `0x0046cbda`, and the existing constructor edge at `0x004ddda1` confirms that this opener sits above the same `TrainDetail.win` family rather than the neighboring `Trainbuy.win` singleton.","objdump + caller inspection + strings correlation + singleton correlation" 0x00514690,1920,shell_train_detail_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection + RT3.lng strings,4,"Primary message dispatcher for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The handler processes shell messages `0`, `0xca`, `0xcb`, and the recurring service message `0x3e9`; routes the top-level side-toggle, list-selection, and metric-row controls through a dispatch table over resources `0x659c..0x6947`; repeatedly reuses the currently selected train via the helper family at `0x005130f0..0x00513220`; and fans out into several now-bounded train verbs. Current explicit branches include one selected-train engine-replacement or trainbuy handoff lane that checks scenario gate `[0x006cec78+0x4a97]`, raises localized ids `593` `That action is not allowed in this scenario.` and `594` `You can not replace the engine while the train is broken-down.` on failure, and otherwise re-enters `shell_open_or_focus_trainbuy_window` at `0x00512c50` or the neighboring local follow-on path at `0x00436820`; one selected-train retirement lane that checks `[0x006cec78+0x4a9b]`, rejects blocked states through ids `595` and `597`, confirms through id `596`, and then either tears the train down locally through the train collection plus `shell_detail_panel_transition_manager` mode `2` or packages multiplayer opcode `0x37`; plus one tighter route-edit lane over the shared `0x33`-stride route-entry family, where removal re-enters `train_route_list_remove_entry_and_compact` at `0x004b3000` and staged insertion re-enters `train_route_list_insert_staged_entry_at_index` at `0x004b3160`, then validates the resulting route through `train_route_list_validate_reachability_and_station_pair` at `0x004b2c10` and commits the follow-on train state through `train_set_route_operating_mode_and_scalar` at `0x004ab980`, with multiplayer opcode mirrors `0x3d`, `0x3f`, and `0x41`. It also consumes the family refresh path through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current evidence is broad enough to treat this as the full `TrainDetail.win` message owner even though several deeper per-action verbs remain semantically open.","objdump + caller inspection + control-flow inspection + dispatch-table inspection + selected-train helper correlation + RT3.lng strings" +0x00515780,48,shell_train_list_window_clear_lower_action_range_unless_event_targets_active_top_list_control,shell,thiscall,inferred,objdump + local disassembly + callback correlation,3,"Tiny callback beneath the shell-side `TrainList.win` family. The helper consults the current top-side latch `0x006d3b30`, treats control `0x32c9` as active when that latch is clear or `0x32ca` as active when it is set, and only when the incoming control is outside that active top list does it clear or restyle the lower action range `0x332c..0x36b0` through `0x0053fe00(0)`. This is the current narrow callback that keeps the lower train-action band from being cleared while the active top list is still the event target.","objdump + local disassembly + callback correlation + top-side-latch correlation" +0x005157c0,21,shell_train_list_window_destruct_and_clear_singleton,shell,thiscall,inferred,objdump + strings correlation + singleton correlation,3,"Destructor wrapper for the shell-side `TrainList.win` family rooted at `0x006d3b34`. The helper restores the local vtable to `0x005d19d0`, clears the live singleton pointer `0x006d3b34`, and then tail-calls the shared shell base destructor `0x0053f7d0`. This is the current grounded teardown edge for the same `TrainList.win` family later constructed at `0x00515f50`.","objdump + strings correlation + singleton correlation + local disassembly" +0x005157e0,6,shell_train_list_window_query_current_top_side_latch,shell,cdecl,inferred,objdump + local disassembly + global-state correlation,2,"Tiny getter for the shared `TrainList.win` top-side latch at `0x006d3b30`. The helper simply returns that dword unchanged. Current grounded callers include the shared lower-row refresh owner `0x004bf320`, where the latch selects which top list side is currently active.","objdump + local disassembly + global-state correlation + caller correlation" +0x005157f0,41,shell_train_list_window_render_top_list_train_row_summary,shell,cdecl,inferred,objdump + local disassembly + callee correlation,3,"Top-list row renderer callback beneath the shell-side `TrainList.win` family. The helper resolves the incoming train id through the live train collection `0x006cfcbc` and then forwards the resolved train record plus the caller-supplied four float or scalar arguments into `0x004bd4a0` with `dl = 0`. Current evidence is strongest for the structural read: this is the shared top-list train-row summary renderer used by `TrainList.win`, not a direct action owner.","objdump + local disassembly + callee correlation + train-collection correlation" +0x00515820,136,shell_train_list_window_focus_selected_train_row_and_optionally_center_or_refresh,shell,fastcall,inferred,objdump + local disassembly + caller correlation,3,"Selection-focus callback beneath the shell-side `TrainList.win` family. The helper validates the incoming train id through `0x00517d40`, republishes that id into the shell detail controller `0x006d0818` through `0x004dd8a0`, resolves the train record, and then fans out by live input bits `[0x006d4018+0xa8c]`: when either low pan bit is set it validates the linked route object through `0x004a77b0` and recenters the world through `0x00437a90(1, 1, route_obj+0x34a)`; when bit `0x04` is set it re-enters the train-side action gate `0x004acb90` and, if the live `TrainList.win` singleton exists, reruns `shell_train_list_window_refresh_controls` `0x005158f0(-1)`. This is therefore the focus-and-follow callback for selected top-list train rows rather than a generic collection probe.","objdump + local disassembly + caller correlation + shell-detail correlation + selected-train-follow correlation" +0x005158b0,53,shell_train_list_window_refresh_lower_action_rows_for_inactive_top_list_side,shell,thiscall,inferred,objdump + local disassembly + callee correlation,3,"Small lower-row refresh callback beneath the shell-side `TrainList.win` family. The helper uses the same top-side latch `0x006d3b30` and active-control split `0x32c9/0x32ca` as `0x00515780`; when the event does not target the active top list it computes the relative row ordinal against the source control's base word `[control+0x1e2]` and forwards that delta into the broader lower action-row refresh owner `0x004bf320`. Current evidence is strongest for the structural read: this is the inactive-side lower-action refresh callback bound under `TrainList.win`, not a standalone action dispatcher.","objdump + local disassembly + callee correlation + top-side-latch correlation + control-base-word correlation" +0x005158f0,1120,shell_train_list_window_refresh_controls,shell,thiscall,inferred,objdump + strings correlation + control-flow inspection + caller correlation,4,"Refreshes the visible control state for the shell-side `TrainList.win` family rooted at `0x006d3b34`. The helper clears and rebuilds the two top list controls `0x32c9/0x32ca`, walks the full train collection `0x006cfcbc`, filters rows to the current company through `0x004337a0`, formats each surviving train name through `0x005193f0` and `0x00518de0`, and publishes mirrored entries into both list controls through `0x00540120`. It then installs the row renderers and callbacks on `0x32c9/0x32ca`, refreshes the shared selected-row latch `[this+0x78]`, updates the empty-state labels `0x32cf/0x32d0`, republishes the optional secondary selection from `0x00622b2c`, and when the world-side selected support-entry id at `[world+0x4cb6]` still resolves to one live train owned by the current company it reselects that same train in both list controls. Current grounded callers are the family constructor `0x00515f50`, the family message dispatcher `0x00515c60`, the sibling focus helper `0x00515820`, and the broader shell follow-on sweep `0x00436170`. This is therefore the real `TrainList.win` refresh owner rather than a generic company-list helper.","objdump + strings correlation + control-flow inspection + caller correlation + singleton correlation + selected-train-mirror correlation" +0x00515c60,752,shell_train_list_window_handle_message,shell,thiscall,inferred,objdump + strings correlation + control-flow inspection + caller correlation,4,"Primary message dispatcher for the shell-side `TrainList.win` family rooted at `0x006d3b34`. The handler processes shell messages `0`, `0xca`, `0xcb`, `0xce`, and the recurring refresh message `0x3e9`. Message `0` services the timed secondary-selection refresh through `0x0053f830` and updates `0x00622b2c`. Message `0xca` routes either the lower train-action row block `0x332c..0x36b0` through `0x004bf9d0` or direct top-list row clicks on controls `0x32c9/0x32ca`: those top-list clicks resolve the chosen train from `0x006cfcbc`, validate its linked route object through `0x004a77b0`, mirror the train-side support-entry id `[train+0x25]` into `[world+0x4cb6]`, republish the world focus through `0x00433900`, and transition the active detail panel through `0x004ddbd0(2, train_id)`. Message `0xcb` toggles the current top-side latch `0x006d3b30`, rewrites the paired list-action controls `0x32cb/0x32cc`, repopulates the lower action range `0x332c..0x36b0`, and clears the opposite top selection. Message `0xce` mirrors externally supplied top-list row payloads directly into `[world+0x4cb6]`. Message `0x3e9` simply re-enters `shell_train_list_window_refresh_controls` `0x005158f0`. This is the current grounded message owner for the full `TrainList.win` family.","objdump + strings correlation + control-flow inspection + caller correlation + detail-panel-transition correlation + selected-train-mirror correlation" +0x00515f50,181,shell_train_list_window_construct,shell,thiscall,inferred,objdump + strings correlation + control-wiring inspection + singleton correlation,4,"Constructs the shell-side `TrainList.win` singleton later published at `0x006d3b34`. The constructor binds the `TrainList.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19dc`, seeds the local vtable at `0x005d19d0`, stores the live singleton pointer `0x006d3b34`, initializes the shared top-row selection latch at `[this+0x78] = -1`, wires the two top list controls `0x32c9/0x32ca`, the top-side toggle controls `0x32cb/0x32cc`, and the row-selection callbacks through `0x00540120`, and then tail-calls `shell_train_list_window_refresh_controls` `0x005158f0(-1)`. Current evidence is strong enough to treat this as the full `TrainList.win` constructor rather than another unnamed train-side shell family.","objdump + strings correlation + control-wiring inspection + singleton correlation + local disassembly" 0x004a01a0,789,route_entry_collection_try_build_path_between_optional_endpoint_entries,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy route-entry collection method over the global route store at `0x006cfca8`. The helper accepts up to two optional endpoint-entry pointers or ids, two endpoint coordinate pairs, a route-policy or mode byte, and optional output slots for the chosen endpoint-entry ids. It first resolves any supplied route-entry ids through `0x00518140` and projects them back to compact coordinate pairs through `0x0048a170`, rejects early when either endpoint lands on an invalid world tile through `0x00449980`, and computes one span scalar through `0x004952f0`. When the leading endpoint entry is absent it can synthesize one fresh route entry from the supplied coordinates and policy arguments through `0x00493cf0`; after that it resolves the chosen entry, copies four `3*dword` route-shape or bounding blocks from that entry into the collection-owned builder-state area at `[this+0x139]..[this+0x167]` through `0x005394b0`, stores the chosen endpoint coordinates at `[this+0x11d]` and `[this+0x121]`, latches one active-builder flag at `[this+0x118]`, and stages one linked entry field from `[entry+0x202]` into `[this+0x125]`. On one newly synthesized-entry path and policy bytes `1/2` it also touches the auxiliary route-entry family at `0x006cfcb4` through `0x004a42b0`, `0x00494f00`, and `0x004a4340`. Current caller evidence now narrows one more policy case: both the later world-side caller at `0x00480cd0` and the linked-site refresh helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` enter this helper with both optional endpoint-entry ids unset and literal policy byte `2`, so the strongest current read for that byte is a full linked-site route-anchor rebuild between optional endpoint entries rather than the narrower direct endpoint-anchor creation or replacement lane carried by literal byte `1` in `0x00493cf0`. The helper then resets the collection's transient path-search state through `0x00495480`, re-enters the deeper route-search core at `0x0049d380`, optionally writes the chosen endpoint-entry ids back through the caller-supplied output pointers on success, and finally tears down the transient search state through `0x00495540` and `0x0049ad90`. Current grounded callers are the early route-search lane inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, two neighboring retry branches at `0x004030d0` and `0x00403330`, a paired startup-connection branch at `0x00403ac0`, that later world-side caller at `0x00480cd0`, and the linked-site refresh helper at `0x00480bb0`. This now looks like the shared route-entry search or synthesis owner above the deeper path-search core rather than a generic route-store mutator.","objdump + caller xrefs + callsite inspection + route-entry search correlation + builder-state correlation + partial-mode-byte correlation + linked-site refresh correlation + linked-site policy-byte split correlation" 0x004a3db0,272,route_entry_collection_service_recent_entry_state_promotions_and_followon_refreshes,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Collection-wide post-change sweep over the global route-entry store at `0x006cfca8`. The helper first snapshots collection field `[this+0x90]` into `[this+0x94]`, then, when shell-state gate `[0x006cec74+0x94]` is set, walks every live route entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. The current changed-entry lane is now bounded: for entries newer than collection threshold `[this+0x102]` via `[entry+0x240]` and still carrying state byte `[entry+0x216] == 1`, it promotes that state through `0x0048b830(entry, 2)` and then releases any queued side list at `[entry+0x244]` through `0x00489f40`. After that sweep it drains the collection-owned linked list at `[this+0x98]`, resets `[this+0x88] = -1`, and, when shell runtime `0x006d401c` is live while collection latch `[this+0xed]` is clear, posts shell status id `0xbb` through `0x00538e00`. When any entry was promoted it also re-enters `0x004358d0` on the active mode object at `0x006cec78`, triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6`, and then tails into `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` on `0x006ada90`. Current grounded callers include the city-connection route-builder tail at `0x00404564`, the linked-site route-anchor refresh tail at `0x00480d1c`, and TrackLay-side follow-ons at `0x0050d7ed` and `0x0050db24`, so this is now the safest current read for the route-entry collection's recent-entry state-promotion and follow-on refresh sweep rather than a generic collection walk.","objdump + caller inspection + local disassembly + route-entry collection correlation + state-promotion correlation + runtime-effect trigger-kind correlation + route-link followon correlation" 0x00489f80,11,route_entry_assign_aux_tracker_group_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,3,"Tiny route-entry helper that writes the caller-supplied auxiliary tracker id into route-entry field `+0x212`. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, and neighboring tracker-update branches at `0x004996e0`, `0x004a4380`, `0x004a4ce0`, and `0x004a4ff0`. This now looks like the direct route-entry aux-tracker group-id assignment helper rather than a generic field store.","objdump + caller xrefs + field-layout inspection + tracker-family correlation" @@ -426,6 +486,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00494e90,15,aux_route_entry_tracker_seed_owner_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Seeds one auxiliary route-entry tracker with its owner or primary route-entry id. The helper writes the caller-supplied id into tracker field `+0x00` and clears the small accumulator fields at `+0x42` and `+0x46`. Current grounded callers are the tracker allocator paths at `0x004a42b0`, which use it immediately after allocating one `0x006cfcb4` record keyed by a route-entry id.","objdump + caller xrefs + field-layout inspection + tracker-family correlation" 0x00494eb0,15,aux_route_entry_tracker_adjust_refcount,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Adds the caller-supplied delta into the small refcount field at tracker offset `+0x10` and returns the updated total. Current grounded callers are the collection-side tracker updater `0x004a4340`, where a zero result triggers the tracker's destruction path.","objdump + caller xrefs + field-layout inspection + tracker-family correlation" 0x00494ed0,26,aux_route_entry_tracker_contains_endpoint_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Small membership probe over one auxiliary route-entry tracker. The helper returns `1` when the caller-supplied route-entry id matches either tracker endpoint slot `+0x04` or `+0x08`, and `0` otherwise. Current grounded callers include several tracker-regroup and repair branches around `0x00490d62`, `0x0049a9ed`, `0x0049f162`, and `0x004a4ce0`, where it acts as the cheap endpoint-membership test beneath adjacent-chain transfer and duplicate-split logic.","objdump + caller xrefs + field-layout inspection + tracker-family correlation" +0x00494ef0,1,aux_route_entry_tracker_serialize_noop_per_entry_payload_stub,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Current per-entry save callback used by the auxiliary route-entry tracker collection tagged save owner `0x004a4240`. The body is a single `ret 4`, so this lane presently persists only the collection-side metadata and live ids emitted by the collection wrapper, not any additional per-entry payload. This is the safest current read for the tracker save stub rather than overclaiming hidden serialization state.","objdump + local disassembly + caller correlation + tracker-save correlation" 0x00494f00,176,aux_route_entry_tracker_merge_or_bind_endpoint_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Binds one route-entry id into the two-endpoint auxiliary tracker record. The helper resolves the supplied route-entry through `0x006cfca8`, derives one route-key-like value through `0x0048aa70`, reads the route-entry signature fields at `+0x22e` and byte `+0x44`, and then either seeds both endpoint slots `+0x04/+0x08` on the first bind or merges the new entry into one side when the signature, route-key, and boolean class latch match the tracker's existing state. On failure it returns `0`; on success it returns `1`. Current grounded callers are the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring `0x006cfcb4` tracker update branches around `0x0049f1ce`, `0x0049f38d`, `0x0049f90b`, `0x004a4685`, `0x004a4830`, `0x004a4982`, `0x004a5175`, and `0x004a5189`. This now looks like the tracker-side endpoint bind or merge helper rather than a generic route-entry accessor.","objdump + caller xrefs + callsite inspection + tracker-family correlation" 0x00494fb0,97,aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Refreshes the small boolean class latch at tracker offset `+0x1c` and notifies the owning route-entry group when that latch changes. When the route-store latch `[0x006cfca8+0xf1]` is clear, the helper resolves the current endpoint-entry ids from `+0x04` and `+0x08`, recomputes whether the bound endpoint pair carries the nonzero route-entry byte `+0x44` on both sides, writes the resulting boolean back into `+0x1c`, compares it against the previous latch value, and on change calls `0x004a6360` on the auxiliary tracker collection `0x006cfcb4` with the owner entry id at `+0x00`. Current grounded callers are the neighboring route-state branch at `0x004915e0` and the compatible endpoint-slot rewrite helper `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0`. This now looks like the tracker-side boolean class-latch refresh plus owner-notify path rather than a generic predicate helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-notify correlation" 0x00495020,188,aux_route_entry_tracker_refresh_cached_match_fields_and_maybe_split_duplicate_pair,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + field-layout inspection,3,"Refreshes one auxiliary tracker's cached match metadata and clears its trailing relationship payload band. Under two scenario-threshold branches keyed by `[0x006cec78+0x46c34]`, the helper seeds or refreshes tracker cache fields from the currently bound endpoint pair: it derives one route-key-like value through `0x0048aa30`, reuses one endpoint signature word from route-entry field `+0x22e`, and falls back to constant `1` when no endpoint slot is available on the active branch. After that it zeroes the trailing payload band at `+0x24..+0x46`. When both endpoint slots `+0x04` and `+0x08` still point to the same route-entry id and the tracker refcount `+0x10` is greater than `1`, it tail-calls the deeper split or reseed path at `0x004a51a0` with the owner route-entry id at `+0x00`. Current grounded caller is the broader tracker-side branch at `0x004a41b0`. The current objdump shape keeps the exact `+0x18/+0x1e` destination split slightly irregular on the second threshold path, so this row stays conservative about the final field assignment while still grounding the helper as cached-match refresh plus duplicate-pair split prep.","objdump + caller xrefs + callsite inspection + field-layout inspection + tracker-family correlation" @@ -457,8 +518,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004a7810,183,train_refresh_linked_route_object_steam_emitter_enable_flags,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + effect-family correlation,3,"Iterates the linked route-object row band rooted at `[route+0x316]` / count `[route+0x31a]` after resolving the train's linked route object through `[train+0x41]`. For each `0xc0`-stride row it probes the optional emitter definition at `[row+0x60]`, uses `effect_name_matches_literal_steam` `0x004749a0` to separate the literal `steam` family, and then either clears row byte `[row+0x1d8]`, resets scalar `[row+0xcc]` to `1.0f`, and re-enters `0x00554920`, or sets `[row+0x1d8] = 1` on the non-steam or missing-emitter branch. This is the safest current read for the linked-route-object steam-emitter enable-state refresh rather than a broader train visual owner.","objdump + local disassembly + caller inspection + effect-family correlation + linked-route-object correlation + row-band correlation" 0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation" 0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation" +0x004ac460,210,train_query_deterioration_scalar_with_disable_bypass,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + train-deterioration correlation,3,"Small train-side scalar query in the same deterioration family as the later crash or breakdown owner. When special-condition slot `33` `[0x006cec78+0x4b03]` is set, the helper returns the fixed fallback float at `0x005c8598` immediately. Otherwise it resolves the train's linked route-object family through `[train+0x41] -> 0x0062ba84 -> 0x41adb0 -> [entry+0x126] -> 0x006ada84`, derives one year-relative delta from current year `[0x006cec78+0x0d] - [train+0xd4]`, folds that delta through two fixed multipliers, and then quantizes the train-local float `[train+0xb8]` through `0x005a10d0` before continuing into the remaining scalar tail. Current loader-side prose already depends on this slot-`33` fast path as the smaller sibling beside the broader failure owner `0x004af8a0`, so this is the safest current read for the train deterioration scalar query with special-condition bypass rather than a generic route-object metric.","llvm-objdump + local disassembly + caller correlation + train-deterioration correlation + special-condition correlation" 0x004ad7a0,595,train_trigger_crash_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Broader train-side crash owner reached both from the cheat-code selector branch in `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and from the direct shell command strip around `0x00441810`, where localized id `365` warns `There is no train available to crash!` when no candidate train survives. The helper first enforces the usual crash-side global gates: it rejects when shell byte `[0x006cec78+0x4c8e]` is already set, when world or shell latches under `0x006cec74` block the action, or when the train already carries a nonzero operating mode at `[train+0xe8]`. On the active path it resolves the current linked route object through `[train+0x41]`, marks route field `[route+0x33e]`, enables the shared three-selector and selector-`5` train-visual effect families through `train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors` `0x0045cc90(1)` and its selector-`5` sibling `0x0045d1e0(1)`, clears several transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and then walks the linked route-object chain to drive byte `[train+0xf4]` plus the paired visual refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It finishes by writing crash mode `0x11` into `[train+0xe8]`, seeding scalar `[train+0xec] = 0x46924000`, rebuilding the local event payload through `0x004a9360`, and, when the crashing train belongs to the currently selected company, publishing both a shell-side notice through `0x004554e0` and the follow-on company update through `0x00423fd0`. Current neighboring caller `0x004af9e8` also treats this body as the crash-side branch opposite `0x004ada00`, so the safest current read is the shared train crash-state, effect, and owner-notification owner rather than a generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + train-visual correlation + crash-command correlation + route-state correlation" 0x004ada00,543,train_trigger_breakdown_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Breakdown-state sibling of `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0`. The helper is reached from the direct shell command strip around `0x004418a0`, where localized id `366` warns `There is no train available to break down!`, and from the neighboring train-state branch at `0x004af9f7`. It enforces the same crash-side global gates and the same `[train+0xe8] == 0` requirement, but on the active path it marks route field `[route+0x342]`, enables the selector-`5` and selector-`2` train-visual effect families through `0x0045cf40(1)` and `0x0045d1e0(2)`, clears the same transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and drives the same linked route-object byte `[train+0xf4]` plus refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It then writes breakdown mode `0x12` into `[train+0xe8]`, seeds the same scalar `[train+0xec] = 0x46924000`, rebuilds the local event payload through `0x004a9360`, and, when the affected train belongs to the currently selected company, publishes the shell-side notice through `0x004554e0` and the paired company follow-on through `0x00423fe0`. Current neighboring caller `0x004af9f7` uses this body as the direct opposite branch of `0x004ad7a0`, so the safest current read is the shared train breakdown-state, effect, and owner-notification owner rather than another generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + breakdown-command correlation + train-visual correlation + route-state correlation" +0x004af8a0,354,train_service_try_trigger_crash_or_breakdown_from_year_and_load_thresholds,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + train-deterioration correlation,3,"Broader train-side deterioration owner above `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0` and `train_trigger_breakdown_state_effects_and_optional_owner_notifications` `0x004ada00`. The helper first consults special-condition slot `33` `[0x006cec78+0x4b03]`; when that slot is set it returns immediately without building any threshold. Otherwise it derives one year-scaled base threshold from the current scenario year `[0x006cec78+0x0d]`, one live collection count from `0x006cfcbc`, and several fixed multipliers, quantizes that threshold through `0x005a10d0`, applies a second year-relative adjustment from `[train+0xd4]`, and then compares the result against one random bounded scalar from `0x00518be0`. Slot `32` `[0x006cec78+0x4aff]` is the narrower gate in the same owner: when it is set, or when `0x00434050` reports the auxiliary-preview side path, the helper forces the milder breakdown branch. Otherwise the random-threshold comparison selects crash via `0x004ad7a0` on the low path and breakdown via `0x004ada00` on the high path. Current save/load prose already depends on this slot-`32/33` split when describing restored special-condition semantics, so this is the safest current read for the train deterioration owner rather than an unnamed failure branch family.","llvm-objdump + local disassembly + caller correlation + train-deterioration correlation + special-condition correlation" 0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation" 0x004b2b80,29,train_route_list_count_live_site_reference_entries,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,4,"Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter.","objdump + caller xrefs + route-entry inspection + callsite inspection" 0x004b2c10,656,train_route_list_validate_reachability_and_station_pair,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan.","objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split" @@ -472,7 +535,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00518140,89,indexed_collection_resolve_live_entry_by_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared indexed-collection record resolver over the same common collection layout. The helper rejects nonpositive, out-of-range, or tombstoned ids through the `[this+0x14]` bound and `[this+0x34]` bitset, then returns one live record pointer from the payload rooted at `[this+0x30]`. When collection flag dword `[this+0x04]` is nonzero it treats that payload as a flat `stride=[this+0x08]` record array and returns `base + stride*id`; otherwise it treats the payload as an array of record pointers stored in `stride=[this+0x08]` slots and returns the pointer loaded from `base + stride*id`. Current grounded callers include the company, profile, train, and structure-candidate families, where it is the common bridge from one positive collection id to one concrete live record pointer.","objdump + caller inspection + collection-layout inspection + direct-vs-indirect payload correlation" 0x00518380,364,indexed_collection_get_nth_live_entry_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared nth-live-entry selector over the same indexed-collection layout. With traversal mode `0` it walks slot ids in forward order, skipping tombstoned ids through the bitset at `[this+0x34]`, and returns the positive entry id whose zero-based live ordinal matches the caller-supplied index; recent results are memoized in the small cache bands rooted at `[this+0x68]` and `[this+0x78]`. With nonzero traversal mode it reuses the auxiliary link banks rooted at `[this+0x38]`, `[this+0x48]`, and `[this+0x58]` to step through one alternate live-order chain before returning the resulting id. Current grounded callers across company, profile, structure-candidate, and placed-structure families mostly use traversal mode `0`, where this is the shared bridge from one zero-based live ordinal to one positive collection entry id.","objdump + caller inspection + collection-layout inspection + cache-band inspection + alternate-chain correlation" 0x0051c920,223,localization_lookup_display_label_by_stem_or_fallback,shell,thiscall,inferred,objdump + caller inspection + language-table correlation + static-table inspection,4,"Shared shell-side label helper that turns one ASCII stem string into one player-facing display label. The helper case-folds the first letter, scans the static `(stem, string-id)` table rooted at `0x006243c8`, compares candidate stems case-insensitively, and returns the localized text for the first matching string id through `0x005193f0` when that localized entry is nonempty. The current table correlation already grounds entries such as `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng ids `3202..3220`. When no table entry matches, the helper falls back to localized id `3866` `Could not find a translation table entry for '%1'`. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it sits directly above candidate field `[record+0x04]`, and several neighboring list and detail renderers that need one display label from the same stem family.","objdump + caller inspection + language-table correlation + static-table inspection + RT3.lng correlation" +0x0051d390,37,calendar_pack_unpacked_components_to_absolute_counter,support,fastcall,inferred,objdump + local arithmetic correlation + restore-path correlation,3,"Tiny calendar helper that converts one unpacked component set into the same mixed-radix absolute counter family later stored at `[world+0x15]`. It combines the fastcall component pair in `ECX/EDX` plus three stack-supplied scalar subfields as one `12 x 28 x 3 x 60` progression and returns the resulting absolute counter. Current grounded load or restore-side caller correlation comes from the selected-year rehydrate path in `world_load_saved_runtime_state_bundle` `0x00446d40`, where the helper is used after the mode-sensitive year adjustment to rebuild the final absolute counter from the staged calendar components before `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` republishes the derived tuple fields.","objdump + local arithmetic correlation + restore-path correlation + mixed-radix decode" 0x0051d3c0,44,calendar_point_pack_tuple_to_absolute_counter,support,fastcall,inferred,objdump + caller inspection + local arithmetic correlation,3,"Tiny packed-calendar helper that converts one local tuple rooted at the caller pointer in `ECX` into the same absolute calendar counter family later stored at `[world+0x15]`. It reads one year word plus four packed calendar subfields from `[tuple+0x00/+0x02/+0x04/+0x05/+0x06]`, combines them as one mixed-radix `12 x 28 x 3 x 60` progression, and returns the resulting scalar for direct subtraction against `[0x006cec78+0x15]`. That is now the strongest current read for the world-side calendar model: a packed year-plus-subfield point converted into one absolute counter rather than a plain year or month stamp. Current grounded finance caller is the stock-issue cooldown gate inside `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, where it converts the current issue tuple at `[company+0x16b/+0x16f]` before comparing that scalar against the active world counter.","objdump + caller inspection + local arithmetic correlation + finance-cooldown correlation + world-calendar-counter correlation + mixed-radix decode" +0x0051d3f0,103,calendar_pack_year_and_component_bytes_to_packed_tuple_dwords,support,cdecl,inferred,objdump + local arithmetic correlation + restore-path correlation,3,"Packs one explicit year-plus-component set into the broader world-calendar tuple format. The helper writes the caller-supplied year word and input bytes into the tuple root on the stack, derives the companion mixed-radix byte fields used by `calendar_point_pack_tuple_to_absolute_counter` `0x0051d3c0`, and returns the resulting packed tuple dwords in `EAX:EDX`. Current grounded load or restore-side caller correlation comes from `world_load_saved_runtime_state_bundle` `0x00446d40` and the shared scenario reset owner `0x00436d10`, where the raw selected-year lane `[profile+0x77]` is first expanded through this helper with Jan-1-style constants before later adjustment and republish through `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`.","objdump + local arithmetic correlation + restore-path correlation + packed-tuple correlation" 0x0051d460,131,calendar_point_unpack_absolute_counter_to_tuple,support,fastcall,inferred,objdump + caller inspection + local arithmetic correlation,3,"Inverse packed-calendar helper for the absolute counter family rooted at `[world+0x15]`. It accepts one absolute calendar counter in `ECX`, decomposes it back into the same mixed-radix year-plus-subfield tuple, and returns the reconstructed pair of dwords in `EAX:EDX` for storage into fields such as `[world+0x0d]` and `[world+0x11]`. Current local arithmetic now bounds the inverse against the same `12 x 28 x 3 x 60` model as `0x0051d3c0`, which keeps this tuple in the world-side calendar-point family rather than as an unrelated packed timestamp. Current grounded callers are `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, which refreshes `[world+0x0d/+0x11]` from the selected absolute counter at `[world+0x15]`, plus the target-resolution wrappers `0x0051d550` and `0x0051d5f0` used by `simulation_advance_to_target_calendar_point` `0x0040ab50`.","objdump + caller inspection + local arithmetic correlation + world-calendar-tuple correlation + target-resolution correlation + mixed-radix decode" 0x004f2e80,14,shell_has_live_overview_window,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny presence probe for the shell-side `Overview.win` singleton rooted at `0x006d12bc`. The helper returns `1` when that live overview object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside other shell-window probes, and the overview family itself around `0x004f3a10`, which uses the same singleton to suppress duplicate opens.","objdump + caller inspection + nearby-family correlation + singleton correlation" 0x004f2e90,11,shell_mark_overview_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_overview_window`. The helper stores `1` into `0x006d12cc`, which current nearby call patterns treat as the `Overview.win` refresh or service request latch once the live overview singleton at `0x006d12bc` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + caller inspection + nearby-family correlation + singleton correlation" @@ -480,7 +545,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004f38f0,562,shell_overview_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Primary message dispatcher for the shell-side `Overview.win` family rooted at `0x006d12bc`. The handler processes the usual shell message ids `0`, `0xca`, and `0xcb`; uses the current subject object at `[this+0x78]`; opens follow-on detail lanes through `0x004f2ea0`; and raises simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when the requested drill-down path is currently invalid. It also consumes the family dirty latch at `0x006d12cc` on the recurring service path. Current grounded caller is the shell runtime after construction through `shell_open_or_focus_overview_window`.","objdump + caller inspection + control-flow inspection + dirty-latch correlation" 0x004f3a10,272,shell_open_or_focus_overview_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `Overview.win` singleton. When a valid overview subject exists under the live world-side owner at `0x006cea4c` and no current overview window is open, the helper allocates an `0x80`-byte shell object, constructs it through `shell_overview_window_construct` at `0x004f38a0`, publishes it through the shell runtime at `0x006d401c`, and stages the selected subject pointer into the live singleton at `0x006d12bc` before routing it into the family message path at `0x004f2ea0`. When an overview window already exists it leaves the current singleton in place. Current grounded callers include the world-side action branches at `0x004396ae` and `0x004414c6`, both of which pass one subject object resolved from `0x006cea4c` before opening the overview path.","objdump + caller inspection + strings correlation + singleton correlation + publish-path inspection" 0x004b99c0,88,structure_candidate_collection_get_nth_active_candidate_id,map,cdecl,inferred,objdump + caller inspection + collection iteration,4,"Returns the zero-based nth active candidate id from the structure-candidate collection at `0x0062ba8c`. The helper iterates the collection through `0x517cf0` and `0x518380`, skips candidates whose active byte in the returned record is clear, decrements the caller-supplied ordinal only across the surviving entries, and finally returns the matching candidate id or `0` when the requested active slot does not exist. Current grounded callers are the shell-side building-detail branches at `0x004ba01f`, `0x004bbcfd`, and `0x004bbd56`, where ordinals `page-3` are translated back into live candidate ids before the selected-building service and capability rows are refreshed.","objdump + caller inspection + collection iteration + active-candidate correlation" -0x004b9a20,833,shell_building_detail_refresh_flagged_service_capability_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` refresh helper for the flagged service or capability row bands driven from the currently selected building subject at `0x006cfe04`. The helper repeatedly restyles controls in the `0x7d07..0x7d1c` range through `0x540120`, using route-entry flag byte `+0x28` from the selected building subject as the decision source. Current local control correlation now bounds that mask family more tightly than a generic bit consumer: `0x7d07/0x7d08` split the zero-versus-nonzero `0x30` mask, `0x7d11/0x7d12` split the bit-`0x20`-only case, `0x7d13/0x7d14` split the exclusive-or `0x20^0x10` case, `0x7d17/0x7d1a` track bit `0x20`, `0x7d18/0x7d1b` track bit-`0x10`-only, and `0x7d19/0x7d1c` track the combined `0x30` case. The later repeated row family rooted at `0x7f58..0x801f` also consults bit `0x40` together with the currently selected candidate or service id in subject field `+0x24`, but current evidence now narrows that lane too: it is a selected-ordinal highlight band rather than a generic restyle loop. The special express-side triplet at `0x7f58..0x7f5a` is the fixed table-driven branch; after that the helper falls through into the ordinary active-candidate/service rows. When the selected id is below `0x384`, the helper translates it through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0` and highlights ordinal `3 + active-candidate-rank` for the current subject id; otherwise it treats `0x384..` as the parallel express-side family directly. Current grounded callers include the broader building-detail refresh path at `0x004bae97`, the constructor-adjacent refreshes at `0x004bbcf3` and `0x004bbd0d`, and neighboring handler branches at `0x004bb8e3`, `0x004bbe5c`, and `0x004bc039`. Current evidence is therefore strong enough to treat this as the shared shell-side consumer of route-entry subflags `0x10`, `0x20`, and `0x40` even though the ordinary candidate-row captions still remain open.","objdump + caller inspection + control-range inspection + route-entry flag correlation + active-candidate correlation + control-family triplet correlation + row-mask partition correlation + selected-ordinal highlight correlation" +0x004b9a20,833,shell_building_detail_refresh_flagged_service_capability_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` refresh helper for the flagged service or capability row bands driven from the currently selected building subject at `0x006cfe04`. The helper repeatedly restyles controls in the `0x7d07..0x7d1c` range through `0x540120`, using route-entry flag byte `+0x28` from the selected building subject as the decision source. Current local control correlation now bounds that mask family more tightly than a generic bit consumer: `0x7d07/0x7d08` split the zero-versus-nonzero `0x30` mask, `0x7d11/0x7d12` split the bit-`0x20`-only case, `0x7d13/0x7d14` split the exclusive-or `0x20^0x10` case, `0x7d17/0x7d1a` track bit `0x20`, `0x7d18/0x7d1b` track bit-`0x10`-only, and `0x7d19/0x7d1c` track the combined `0x30` case. The important boundary is now explicit too: these rows are style-only indicator controls in current disassembly, not text-publishing lanes with a missing caption lookup. The later repeated row family rooted at `0x7f58..0x801f` also consults bit `0x40` together with the currently selected candidate or service id in subject field `+0x24`, but current evidence now narrows that lane too: it is a selected-ordinal highlight band rather than a generic restyle loop. The special express-side triplet at `0x7f58..0x7f5a` is the fixed table-driven branch; after that the helper falls through into the ordinary active-candidate/service rows. When the selected id is below `0x384`, the helper translates it through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0` and highlights ordinal `3 + active-candidate-rank` for the current subject id; otherwise it treats `0x384..` as the parallel express-side family directly. Current grounded callers include the broader building-detail refresh path at `0x004bae97`, the constructor-adjacent refreshes at `0x004bbcf3` and `0x004bbd0d`, and neighboring handler branches at `0x004bb8e3`, `0x004bbe5c`, and `0x004bc039`. Current evidence is therefore strong enough to treat this as the shared shell-side consumer of route-entry subflags `0x10`, `0x20`, and `0x40`, with the player-facing text side already grounded separately on the `0x7f58..0x7f5a` express triplet and the `Dining Car`/`Caboose` rows.","objdump + caller inspection + control-range inspection + route-entry flag correlation + active-candidate correlation + control-family triplet correlation + row-mask partition correlation + selected-ordinal highlight correlation + style-only-boundary correlation" 0x004ba3d0,2380,shell_building_detail_refresh_subject_cargo_and_service_rows,shell,thiscall,inferred,objdump + caller inspection + strings correlation,3,"Large `BuildingDetail.win` refresh helper for the selected subject row families centered on controls `0x7d06`, `0x7d96..`, `0x7d0e`, and the adjacent `0x7d6a/0x7d6b` and `0x7d9d` visual lanes. The helper walks the selected building subject at `0x006cfe04`, iterates the per-subject id list rooted at `[subject+0x01]`, validates ordinary ids through the structure-candidate collection at `0x0062ba8c` with `indexed_collection_entry_id_is_live` `0x00517d40`, resolves them into concrete live candidate records through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then uses candidate field `[record+0x04]` as the shared stem for both the ordinary row asset path `%s.imb` and the neighboring display-label lookup through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. Only when that ordinary candidate branch fails does it fall back to the fixed express-side special ids `0x384..0x386`. Current table correlation now bounds that fixed branch more sharply: `0x00621df8` seeds the short-label controls `0x7dc8..0x7dca` with localized ids `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while `0x00621e10` seeds the adjacent asset-name controls `0x7e90..0x7e92` with `AnyCargo`, `AnyFreight`, and `PassMail` before `%1.imb` formatting. The helper also uses `Cargo.imb`, `Caboose.imb`, and the adjacent asset string `Dining.imb` while rebuilding the visible row payloads; current RT3.lng alignment now ties the longer descriptive popup/help side to `497/498` for freight/express and the two special service rows to localized labels `911` `Dining Car` and `912` `Caboose`. One resource-side boundary is tighter now too: the extracted `BuildingDetail.win` blob currently exposes only a sparse embedded text table with the help line `0xbb8`, the asset-name string `0xbb9`, and one standalone caption entry `0xbba` `Cargo`, which is the strongest current resource-side anchor for the row header around `0x7d06` and simultaneously reinforces that the deeper ordinary rows are being labeled from live candidate-record stems rather than from a larger hidden caption table. Current subflag correlation is tighter too: the extra visual lanes `0x7d6a`, `0x7d6b`, and `0x7d9d` are driven from the same selected-subject flag byte at `+0x28`, with `0x7d9d` on the bit-`0x20` branch using `Caboose.imb` and the sibling bit-`0x10` special lane using `Dining.imb`. The helper then re-enters both `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20` and the flagged-row helper `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current grounded callers include the main building-detail refresh at `0x004baedd`, constructor-adjacent and handler-side refreshes at `0x004bb8dc`, `0x004bbc89`, `0x004bbd6a`, and `0x004bc02b`. Current evidence is therefore strong enough to treat this as the selected-building cargo or service row owner even though several ordinary candidate-row captions remain unrecovered.","objdump + caller inspection + strings correlation + control-range inspection + candidate-id correlation + collection-helper correlation + stem-label correlation + subflag-row correlation + asset-string block correlation + RT3.lng correlation + table-entry correlation + win-resource extraction" 0x004ba270,311,shell_building_detail_handle_subject_value_row_band_action,shell,cdecl,inferred,objdump + callsite inspection + local disassembly,3,"Small `BuildingDetail.win` row-band action callback over the control-id family `0x7d07..0x7d14`. The helper switches on the clicked control id minus `0x7d07`, updates the selected building subject rooted at `0x006cfe04`, and treats subject bytes `+0x21`, `+0x22`, and `+0x23` as one current selection plus one bounded low/high pair. On change it increments the family dirty latch at `0x006cfe0c`, writes the refreshed current or bound value back through the shared shell control helper on code `0x66`, and when the side list helper at `0x006cfe08` is active it re-enters the neighboring follow-up refresh path at `0x004b9ec0`. Current direct installation site is the `0x7d0e` widget branch inside `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004bacc9`, which keeps this bounded as the live action owner for the paired value rows rather than another passive formatter.","objdump + callsite inspection + local disassembly + selected-subject field correlation" 0x004bad20,461,shell_building_detail_refresh_subject_pair_value_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` helper for the mutually exclusive subject-value row pairs around controls `0x7d05..0x7d14`. The helper first styles the leading pair `0x7d05/0x7d06`, then chooses between the value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and `0x7d13/0x7d14` from the selected building subject at `0x006cfe04`, using the same flag byte at `+0x28` that drives the neighboring cargo or service rows. On the nonzero selector branch it instead refreshes the current-selection status around `0x7d0d/0x7d0e` from the subject count byte and the subject field at `+0x21`, then tails back into `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`. Current payload values for the mutually exclusive pairs come from subject fields `+0x22` and `+0x23`, and current grounded caller correlation keeps this bounded as one shared pair-value row owner rather than a separate top-level widget family.","objdump + caller inspection + control-range inspection + subject-field correlation + flag-branch correlation" @@ -502,12 +567,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004bc260,43,shell_world_surface_brush_query_cached_world_coords_and_selected_scalar,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cached-parameter getter beneath the same shell world-surface brush family. The helper copies cached world coordinates `[this+0x80]` and `[this+0x84]` into the two caller out-pointers and returns the current selected scalar from table `0x00621e24[ordinal]`, where the ordinal is stored at `[this+0x78]`, through the third out-pointer. Current local field correlation keeps this bounded as the brush-family cached-parameter query rather than a generic subject getter.","objdump + local disassembly + field correlation + ordinal-table correlation" 0x004bc290,192,shell_world_surface_brush_refresh_ordinal_and_mode_button_rows,shell,thiscall,inferred,objdump + caller inspection + control-family correlation,3,"Shared control refresh helper for the shell world-surface brush family. The first loop restyles the ordinal strip `0x0fa1..0x0fa7` through `0x00540120`, highlighting the current selected ordinal at `[this+0x78]`. The second loop restyles the mode strip `0x0faa..0x0faf` by mapping the current mode dword `[0x006d0818+0x8c]` from `0x0e..0x13` into local indices `0..5` and highlighting the matching button through the same shell control helper. Current grounded callers are the ordinal-strip branch at `0x004bc3fc` and the mode-change path beneath `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the ordinal and mode button-row refresh owner rather than a generic widget restyler.","objdump + caller inspection + control-family correlation + ordinal-mode-strip correlation" 0x004bc350,1496,shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf,shell,thiscall,inferred,objdump + local disassembly + control-family correlation,3,"Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is strong enough to treat this as a shell world-surface brush and mode dispatcher even though the exact window-family resource name is still open.","objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation" -0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first runs the preliminary candidate-availability prepass at `0x00437743` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection pass `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation" -0x00437743,93,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The helper iterates the live candidate pool at `0x0062b268` in reverse order, derives one small boolean mode from candidate bytes `[candidate+0xba]` and `[candidate+0x32]`, and then re-enters `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on the active scenario state `0x006cec78` using the candidate name at `+0x04`. The whole pass is skipped once global threshold `0x00620e94` reaches `0x26ad`. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation" -0x00438890,644,shell_active_mode_run_profile_startup_and_load_dispatch,map,thiscall,inferred,objdump + caller xrefs + debugger comparison,4,"Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, posts several shell progress or status updates through `0x5193f0/0x540120`, enumerates one shell-managed list off `0x006d4020+0x429b0`, and then switches over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438a66..0x00438c00` that first refreshes one support-family type-`7` record from setup path buffer `0x006d1370` through `global_banked_type7_record_refresh_from_openable_path_basename_and_stem` `0x0053d130`, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor selection hold through `0x0053f310`, builds three progress-text payloads, re-enters the hold through `0x0053f2f0`, and only then allocates `0x0062c120` when absent, runs `0x0044faf0`, and forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call.","objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation + selector2-support-record correlation + cursor-hold choreography correlation" +0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]` and, on the caller-selected setup path, first mirrors the leading editor economic-tuning scalar from `[world+0x0be2]` back into runtime multiplier lane `[world+0x0bde]` and then runs the preliminary candidate-availability prepass at `0x00437743` before the visible progress phases begin. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early candidate-local service pass `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set, id `320` `Setting Up Buildings...` then drives `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0`, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation + pre-recipe-scalar mirror correlation + economic-tuning-band correlation" +0x00437743,93,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The helper is skipped once global threshold `0x00620e94` reaches `0x26ad`; otherwise it walks the live candidate pool at `0x0062b268` in reverse order, derives one boolean override bit, and upserts each surviving candidate stem into the scenario-side named availability table through `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on `0x006cec78`. That override bit is now tighter than the older structural read: any nonzero availability word at `[candidate+0xba/+0xbb]` forces the upsert with bit `0`, while zero-word candidates derive the bit from the subtype parity check on `[candidate+0x32]` via the local `2 xor subtype` path; those zero-word subtype cases are skipped only when the saved stage counter copy from `0x00620e94` is nonzero. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass that mirrors live candidate subtype or availability state into `[world+0x66b2]` before the visible progress phases begin, rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation + override-bit-derivation correlation" +0x00438890,644,shell_active_mode_run_profile_startup_and_load_dispatch,map,thiscall,inferred,objdump + caller xrefs + debugger comparison,4,"Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, immediately re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, posts several shell progress or status updates through `0x5193f0/0x540120`, mirrors one shell-managed string table off `0x006d4020+0x429b0` into local dword slots `[this+0x46a80..+0x46aa4]`, and allocates the common startup-side runtime pools before the selector jump at all: the cargo collection `0x0062ba8c`, structure-candidate pool `0x0062b268`, auxiliary candidate collection `0x0062b2fc`, support owner `0x0062ba88`, locomotive pool `0x006ada84`, optional world root `0x0062c120`, city-label and manager families `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, `0x006cea4c`, and `0x006acd34`, plus the setup helper at `0x0062b244`. That common pre-branch stage is tighter now too: after allocating the locomotive pool it reverse-walks the live locomotives through `0x00461c80` and pre-seeds named locomotive-availability rows in scenario state through `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` before the later progress lane continues. Only after that common allocation pass does it switch over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438a66..0x00438c00` that first refreshes one support-family type-`7` record from setup path buffer `0x006d1370` through `global_banked_type7_record_refresh_from_openable_path_basename_and_stem` `0x0053d130`, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor selection hold through `0x0053f310`, builds three progress-text payloads, re-enters the hold through `0x0053f2f0`, and only then allocates `0x0062c120` when absent, runs `0x0044faf0`, and forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(0, 0)` immediately after dismissing the current detail panel and servicing `0x004834e0(0, 0)`. `0x0046b8bc` remains the distinct multiplayer-preview relaunch owner, also entering as `(0, 0)` before a later staged `0x00445ac0` call.","objdump + caller xrefs + manual-load breakpoint comparison + owner-tail disassembly + caller-shape comparison + selector-jump-table decode + tutorial-string correlation + selector-writer correlation + selector2-support-record correlation + cursor-hold choreography correlation + startup-allocation-pass correlation + locomotive-availability-preseed correlation" 0x00435603,10,scenario_state_ensure_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny guard wrapper over one derived scenario-state year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. When the small mode or threshold byte at `[this+0x3a]` is already `>= 2` the helper returns immediately; otherwise it falls back into the heavier rebuild body at `0x004351c0`, which refreshes those companion thresholds from the current year and shell-controller-side values before continuing. Current grounded callers are the post-fast-forward selected-year tail at `0x00437170`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, the compact runtime-effect side branch at `0x00431e03`, and the shell-command lane at `0x004661c0/0x004661e9`, so this is the safest current read for the small year-threshold ensure wrapper rather than a generic boolean probe.","objdump + local disassembly + caller correlation + year-threshold-band correlation" -0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book runtime band at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared maximum annual production float that precedes the first line, counts active lines across five repeated `0x30`-byte line records, writes that active-line count into the paired runtime count lane at `[book_runtime-0x3b0]`, and then imports those five lines into one parallel runtime array of `0xbc`-byte descriptors rooted at `[book_runtime-0x3ac]`. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves nonempty cargo strings through `cargo_collection_find_entry_by_exact_name` `0x0041e9f0` over the live cargo collection at `0x0062ba8c`, and builds paired runtime halves for the mode families `2/3` and `1/3`. Current mode gating is now tight enough to treat the polarity as grounded rather than provisional: the source token at `line+0x08` is the supplied-cargo field because it is the branch activated for `Supply Only` and `Production Demand->Supply`, while the source token at `line+0x1c` is the demanded-cargo field because it is the branch activated for `Demand Only` and `Production Demand->Supply`. The importer-side string behavior is tighter now too: empty supplied or demanded token strings are replaced in-place with the first live cargo name from `0x0062ba8c` before the same exact-name matcher runs, while mode `3` loops until the two token strings no longer compare equal through `0x005a57cf`. The constructor and handler now tighten the amount semantics too: `line+0x04` is the per-line annual-demand field only in mode `1`, but it becomes the annual-supply field in modes `2/3`. The importer matches that split by copying `line+0x04` directly into the supply-side runtime half for modes `2/3`, while the production-mode demand half is normalized to `1.0` rather than reusing the entered amount. After all twelve books are imported, the helper explicitly re-enters `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` when the live candidate collection `0x0062b268` exists, so this row is the real scenario-to-runtime bridge between the editor-owned recipe books and the candidate-side `0xbc` descriptor arrays plus their later cargo summary tables. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation + exact-matcher correlation + runtime-bridge correlation" -0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `0x006cec74+0x178` and active-mode flag `[0x006cec78+0x4af7]`, then repeatedly advances the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering" +0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book runtime band at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared production-cap float that precedes the first line up to a fixed minimum `4.0`, counts active nonzero-mode lines across the fixed five repeated `0x30`-byte line records, writes that count into the paired runtime lane at `[book_runtime-0x3b0]`, and then imports those same five lines into one parallel runtime array of `0xbc`-byte descriptors rooted at `[book_runtime-0x3ac]`. Every runtime slot is first zeroed, seeded with fixed year-window defaults `0x0708..0x270f`, and then filled only when the source line mode is nonzero. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves both token lanes through `cargo_collection_find_entry_by_exact_name` `0x0041e9f0` over the live cargo collection at `0x0062ba8c`, and builds the direct primary-cargo half for modes `1/3` plus the one-row subordinate half for modes `2/3`. Current mode polarity is grounded rather than provisional: the source token at `line+0x08` is the primary or supplied-cargo field because it feeds the direct branch used by `Supply Only` and the primary half of `Production Demand->Supply`, while the source token at `line+0x1c` is the subordinate or demanded-cargo field because it feeds the one-row branch used by `Demand Only` and the subordinate half of `Production Demand->Supply`. The importer-side string behavior is tighter now too: empty token strings in either lane are replaced in-place with the first live cargo name from `0x0062ba8c` before the same exact-name matcher runs, while mode `3` repeatedly compares the two token lanes through `0x005a57cf` and keeps reseeding the primary lane from that first live cargo name until the primary and subordinate strings diverge. The amount semantics are tighter in the same way: `line+0x04` is normalized to at least `1.0` for every nonzero-mode line, copied into `[desc+0x04]` only for modes `1/3`, copied into `[desc+0x48]` for mode `2`, and replaced with literal `1.0` in `[desc+0x48]` for mode `3`. After all twelve books are imported, the helper explicitly re-enters `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` when the live candidate collection `0x0062b268` exists, so this row is the real scenario-to-runtime bridge between the editor-owned recipe books and the candidate-side `0xbc` descriptor arrays plus their later cargo summary tables. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation + exact-matcher correlation + runtime-bridge correlation + mode3-divergence correlation" +0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `[0x006cec74+0x178]`, and then overrides that count to literal `0x150` whenever special-condition slot `30` `[0x006cec78+0x4af7]` is nonzero before repeatedly advancing the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering + special-condition override correlation" 0x00434680,435,world_set_game_speed_mode,simulation,thiscall,inferred,objdump + strings,3,"Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.`","objdump + RT3.lng strings + multiplayer handoff" 0x00434850,19,world_adjust_game_speed_mode_delta,simulation,thiscall,inferred,objdump,3,"Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled.","objdump + callee inspection" 0x004338c0,12,shell_mode_gate_is_active,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Tiny boolean wrapper over the shell-side gate at `0x006d07b4`. The helper simply forwards `0x004d4150`, normalizes the result to `0/1`, and returns. Current grounded callers use it as a coarse mode gate before trusting several scenario-side and runtime-object fields, including the flag-byte readers at `0x0041f910`, `0x00461500`, and `0x00474430`, plus broader world or shell-side branches such as `0x004197e0`, `0x00440e4d`, and `0x0044ccdc`. The exact player-facing owner of `0x006d07b4` is still open, so the safest current name stays structural around one active shell-mode gate.","objdump + local disassembly + caller correlation + gate reuse correlation" @@ -522,7 +587,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00434870,23,scenario_state_get_selected_chairman_company_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane.","objdump + global-state inspection + caller correlation" 0x00434890,35,scenario_state_set_selected_chairman_profile,map,thiscall,inferred,objdump + global-state inspection,4,"Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id.","objdump + global-state inspection + caller correlation" 0x004348c0,23,scenario_state_get_selected_chairman_profile_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`.","objdump + global-state inspection + caller correlation" -0x004337c0,128,scenario_state_append_runtime_effect_or_queue_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Allocates one zeroed `0x20`-byte node through `0x005a125d`, copies one caller-supplied string or payload seed into `[node+0x04..]` through `0x0051d820`, stores six further caller dwords at `[node+0x08..+0x1c]`, and appends the finished node to the singly linked list rooted at `[this+0x66a6]`. Current grounded callers include `world_region_collection_pick_periodic_candidate_region_and_queue_scaled_event_record` `0x00422100`, which appends literal-kind-`7` records keyed by one chosen class-0 region id and scaled amount, plus the shell-facing side path inside `world_region_try_place_candidate_structure` `0x00422ee0`, several startup-company branches around `0x0047d282/0x0047d409/0x0047d609`, and the broader runtime-effect service family. The exact gameplay label of this linked `0x20`-byte record family is still open, so the safest current name stays structural around appending one runtime-effect or queue record node beneath scenario state.","objdump + local disassembly + caller correlation + queue-node-list correlation" +0x004337c0,128,scenario_state_append_runtime_effect_or_queue_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Allocates one zeroed `0x20`-byte node through `0x005a125d`, copies one caller-supplied string or payload seed into `[node+0x04..]` through `0x0051d820`, stores six further caller dwords into the fixed field band `[node+0x08]`, `[node+0x0c]`, `[node+0x10]`, `[node+0x14]`, `[node+0x18]`, and `[node+0x1c]`, and appends the finished node to the singly linked list rooted at `[this+0x66a6]`. Current grounded callers include `world_region_collection_pick_periodic_candidate_region_and_queue_scaled_event_record` `0x00422100`, which appends payload seed `0x005c87a8`, literal kind `7`, zero promotion-latch dword `[node+0x0c]`, one chosen class-0 region id at `[node+0x10]`, one scaled amount at `[node+0x14]`, and sentinel tails `-1/-1` in `[node+0x18/+0x1c]`, plus the shell-facing side path inside `world_region_try_place_candidate_structure` `0x00422ee0`, several startup-company branches around `0x0047d282/0x0047d409/0x0047d609`, and the broader runtime-effect service family. The exact gameplay label of this linked `0x20`-byte record family is still broader than one subsystem, so the safest current name stays structural around appending one runtime-effect or queue record node beneath scenario state.","objdump + local disassembly + caller correlation + queue-node-list correlation + node-layout correlation + periodic-region-bonus correlation" 0x00436590,372,scenario_state_compute_issue_opinion_multiplier,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the broader support-adjusted share-price helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier.","objdump + caller inspection + issue-table correlation + merger-text correlation" 0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation" 0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation" @@ -546,10 +611,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004490f0,18,world_query_sidecar_plane_cell_count,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny size helper for the sidecar byte-plane family hanging off the live world object. It returns `([this+0x15d9]+1)*([this+0x15d5]+1)`, which is the per-plane cell count used by the four-plane sidecar raster copies. Current grounded callers include the shell-side plane-copy branches around `0x004f5ad6..0x004f5cc7`, so this is the safest current read for the shared sidecar-plane cell-count query rather than a generic world-size helper.","objdump + caller inspection + field correlation + sidecar-plane correlation" 0x00448f60,114,world_load_four_sidecar_byte_planes_from_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Loads four sidecar byte-plane buffers tied to the live world raster from one runtime bundle owner. The helper opens chunk family `0x9471..0x9472` through `0x00531360`, computes one plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four destination plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and fills those four buffers through repeated `0x00531150` reads before closing the chunk family. Current grounded callers are the `.smp` restore path inside world_load_saved_runtime_state_bundle `0x00446d40` and the neighboring world-side bundle-load branch at `0x0044d350`, so this is the safest current read for the shared four-plane runtime-bundle load helper rather than a generic deserializer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation" 0x00448fe0,108,world_serialize_four_sidecar_byte_planes_into_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Save-side sibling of world_load_four_sidecar_byte_planes_from_runtime_bundle. The helper opens chunk family `0x9471..0x9472` for output through `0x00531340`, computes the same one-plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four source plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and writes those four buffers through repeated `0x00531030` calls before closing the chunk family. Current grounded callers are the `.smp` serializer inside world_runtime_serialize_smp_bundle `0x00446240` and the neighboring world-side bundle-save branch at `0x00449714`, so this is the safest current read for the shared four-plane runtime-bundle serializer rather than a generic writer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation" +0x00449520,636,world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-tag correlation,4,"Save-side sibling of `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`. The helper first opens chunk `0x2ee2`, delegates one fixed `0xc8`-byte world-grid header save through `world_serialize_fixed_grid_header_mask_planes_secondary_raster_and_overlay_chunks_into_bundle` `0x00553760`, posts progress notice `0x005caa50`, and then writes the core grid and stride scalars from `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It follows with chunk family `0x2ef4/0x2ef5/0x2ef6` for the three main packed sidecar bands rooted at `[this+0x213d]`, `[this+0x2131]`, and `[this+0x2135]`, chunk family `0x2ee4/0x2ee5` for the extra bitplane and cell-word side rooted at `[this+0x2141]` and `[this+0x212d]`, re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0`, and then walks every live world-grid cell from `[this+0x2129]` through `0x0042b4a0` before closing the `0x2ee5` phase. Current grounded caller is the early package-save owner `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, so this is the safest current read for the early world-grid and secondary-raster bundle-save body rather than a generic header writer.","objdump + caller inspection + local disassembly + bundle-tag correlation + world-grid-array correlation + save-side sibling correlation" 0x0044afa0,439,world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Composed local world-scalar query over the live world root. The helper first derives one distance-like term from the caller cell to global preview anchor fields `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`; distances above `0x32` contribute one clamped bias term. It then samples the companion float raster rooted at `[world+0x1605]` at the caller cell and across two 8-direction rings from the static offset tables `0x00624b28/0x00624b48`, keeps the highest rounded neighbor sample, and folds the local rise above the center sample into the running score. When preview scalar `[0x0062be68+0x20]` exceeds threshold `0x005ca190` it adds one further scaled bias, and when the neighboring shell-mode gate `0x0041fff0` passes it adds `0x32` more before returning the final score plus base offset `0x8c`. Current grounded callers are the shared rounded-coordinate wrapper `0x0041f6b0` and the sibling virtual wrapper `0x004614d0`.","objdump + caller xrefs + local disassembly + float-grid correlation + radial-distance-helper correlation" -0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_databases` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation" +0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]`. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation" 0x0044c670,2544,world_service_secondary_grid_marked_cell_overlay_cache,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Recurring world-side service pass over the secondary raster rooted at `[this+0x2135]` after `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` has cached min/max/count bounds into `[this+0x21c6..+0x21d6]`. The helper first requires shell-state gate `[0x006cec78+0x4af3]`, then consumes the cached bounds to normalize the marked-cell band and rewrite per-cell bits in the same secondary raster. Its later overlay side is tighter now too: after resolving scaled surface dimensions through `shell_world_presentation_query_scaled_surface_dimensions` `0x00534c50`, it walks one local 3-by-32 sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only secondary-raster classes `4..0x0d`, folds several interpolated samples through repeated `0x0051db80` evaluation into one strongest local score, writes packed overlay pixels into the staged surface buffer, and only then publishes that staged overlay through `shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer` `0x00534af0`. The lower helper cluster beneath that owner is now explicit too: `0x00533e70` refreshes the coarse overlay chunks in a rectangle, `0x00534160` ensures one coarse chunk and seeds local marks, and `0x00534e90` is the neighboring marked-bit predicate over the same 3-byte raster family. Current grounded callers are the recurring simulation-maintenance route-style branch at `0x0040a9f4` inside `simulation_service_periodic_boundary_work` `0x0040a590` and one startup-side world branch at `0x00448168`, so this is the safest current read for the shared secondary-grid marked-cell overlay-cache service rather than a one-shot startup helper or a fully player-facing panel renderer.","objdump + local disassembly + caller inspection + secondary-raster correlation + recurring-maintenance correlation + staged-overlay publish correlation" -0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The later `319` tail is tighter now too: before the final world and shell reactivation it runs one post-bundle status-and-runtime-refresh phase that posts shell progress ids `0x196` and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the scenario-side port-or-warehouse cargo recipe runtime tables through `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, runs the named-candidate availability preseed through `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743`, and then enters one later staged-profile or availability rehydrate band before the broader reactivation sweep. That rehydrate band posts progress ids `0x32dc/0x3714/0x3715`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, and then rehydrates the named locomotive-availability collection at `[world+0x66b6]` before the later world-wide service passes continue. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation.","objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation" +0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it explicitly re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The collection-side tagged load strip inside that bringup is now explicit too: before the later runtime rehydrate tail it loads the main route-entry collection `0x006cfca8` through `0x00493be0`, the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, refreshes placed-structure local runtime records through `0x004133b0`, rebuilds one flagged secondary-raster cleanup band through `0x00448af0/0x00533fe0`, reloads the world-manager side family at `0x006ceb9c` through `0x00477780`, reloads the geographic-label database at `0x006ada80` through `geographic_label_database_refresh_records_from_tagged_bundle` `0x00461580`, reloads the city-database entry collection at `0x006cea50` through `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540`, reloads the live region collection at `0x0062bae0` through `world_region_collection_refresh_records_from_tagged_bundle` `0x00421510`, refreshes the neighboring manager at `0x006cfc9c` through `0x00487c20`, reloads the support family at `0x0062b244` through `0x0040b5d0`, and reloads event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The later load-side rehydrate band is tighter now too. Before the final world and shell reactivation it posts shell progress ids `0x32dc/0x3714/0x3715`, restores the late world-status block `[world+0x66be]` from `0x2ee0/0x2ee1`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, reruns `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, the shared stage-threshold compare `0x00444dc5`, the candidate visibility sweep `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for_all_live_records` `0x00412bd0`, `scenario_state_refresh_year_derived_float_0x4ca2` `0x00434130`, and `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`. Only after that does it restore the two named-availability collections rather than only the locomotive side: the candidate table at `[world+0x66b2]` is restored first from fixed `0x22`-byte name-plus-dword rows, keeping only names that survive the built-in stem rejects and still resolve into the live candidate pool through `0x00412b70`, and only after that does the same band restore the named locomotive-availability collection at `[world+0x66b6]` with its older empty-collection fallback into `0x004350b0`, followed by the live locomotive override refresh `0x00461e00`. That later reactivation tail is narrower now too: it includes `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, then `world_rebuild_all_grid_cell_candidate_cargo_service_bitsets` `0x0044c450`, then `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, then the recurring secondary-raster overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, before the later route-style rebuild, shell-window, and briefing branches. Only after that later tail does it re-enter the one-shot world-entry runtime-effect service through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `8`, after which shell-profile latch `[0x006cec7c+0x97]` is cleared. This is therefore the current safest read for the full shell-to-gameplay world-entry transition and runtime bringup owner rather than only the front half of file staging and world allocation.","objdump + analysis-context + caller xrefs + strings + post-load-pipeline correlation + late-tail phase-order correlation + staged-profile-rehydrate correlation + tagged-collection-load-order correlation + named-availability-restore-order correlation + selected-year-reactivation correlation" 0x00440530,46,shell_open_or_focus_detail_panel_mode_0x0b_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x0b`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x0b_or_warn` `0x00434db0`; on success it forwards `(-1, 0x0b)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de49a`, which uses the same gate and mode. This is therefore the safest current read for the direct mode-`0x0b` opener rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + mode-transition correlation" 0x00440560,22,shell_open_or_focus_detail_panel_mode_0x01_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 1)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`1` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation" 0x00440580,22,shell_open_or_focus_detail_panel_mode_0x04_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 4)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`4` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation" @@ -571,8 +637,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00440840,22,shell_open_or_focus_load_screen_page_7_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `7` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `7` as the player-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation" 0x00440860,22,shell_open_or_focus_load_screen_page_9_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `9` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `9` as the game-status slice.","objdump + local disassembly + load-screen correlation + page-table correlation" 0x00440880,35,shell_toggle_pause_or_restore_game_speed_and_emit_feedback_nudge,shell,cdecl,inferred,objdump + caller inspection + game-speed correlation,2,"Tiny shell command stub over the active scenario root `0x006cec78`. When the scenario object exists, the helper first re-enters `world_toggle_pause_or_restore_game_speed` `0x00437a60` with caller flag `1`, then immediately re-enters the indexed shell feedback helper `0x0045ea20` with selector `0x2c` and scalar `0.5f`. Current local evidence is only strong enough for the pause-toggle plus feedback-nudge structure, not for a tighter player-facing label for the second helper.","objdump + caller inspection + game-speed correlation + feedback-helper correlation" -0x004408b0,21,shell_invoke_world_bundle_coordinator_with_zero_flag_triplet_if_scenario_active,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation,2,"Tiny shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. When the active scenario root `0x006cec78` exists, the helper forwards three zero stack arguments into that coordinator and otherwise returns immediately. Current local evidence is only strong enough for the structural zero-flag-triplet wrapper, not for the exact user-facing command name.","objdump + caller inspection + bundle-coordinator correlation" -0x004408d0,21,shell_invoke_world_bundle_coordinator_with_flag_triplet_0_1_0_if_scenario_active,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation,2,"Tiny shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. When the active scenario root `0x006cec78` exists, the helper forwards stack flags `(0, 1, 0)` into that coordinator and otherwise returns immediately. Current local evidence is only strong enough for that structural flag-triplet wrapper, not for the exact user-facing command name.","objdump + caller inspection + bundle-coordinator correlation" +0x004408b0,21,shell_command_save_game_via_world_bundle_coordinator,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation,2,"Tiny registered shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. The helper is wired by the default binding seeder at `0x0045f9e0` under action id `0x76` and localized label id `0x0d4e`, whose RT3.lng caption is `Save game`. When the active scenario root `0x006cec78` exists, it forwards three zero stack arguments into that coordinator and otherwise returns immediately. Current evidence therefore closes both the registration-side and player-facing identity of the ordinary save-game wrapper.","objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation" +0x004408d0,21,shell_command_quick_save_via_world_bundle_coordinator,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation,2,"Tiny registered shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. The helper is wired by the default binding seeder at `0x0045f9e0` under action id `0x76` and localized label id `0x0d50`, whose RT3.lng caption is `Quick save`. When the active scenario root `0x006cec78` exists, it forwards stack flags `(0, 1, 0)` into that coordinator and otherwise returns immediately. Current evidence therefore closes both the registration-side and player-facing identity of the quick-save wrapper.","objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation" 0x004408f0,207,shell_assign_camera_view_slot_and_publish_confirmation,shell,cdecl,inferred,objdump + command-registration correlation + world-view correlation,4,"Direct shell command branch for the camera-view assignment family. The helper requires the live world-view owner at `0x0062be68`, stores one camera-view snapshot into the selected slot through `world_view_store_camera_view_slot_snapshot` `0x0043b2c0`, formats one slot label through `0x0051b700`, localizes ids `369` and `370` through `0x005193f0`, resolves one optional current focus label through `0x0045f3d0`, and finally publishes a two-line shell modal through the shared shell modal owner `0x004554e0`. Current direct wrappers `0x00440b00..0x00440b90` map the slot selector in `ECX` to camera views `1..9` and `0`, and the shell command-registration block at `0x0046092f..0x00460cab` ties those wrappers to the localized `Assign Camera View 1..9` and `Assign Camera View 0` command strip. This is therefore the safest current read for the shared camera-view assignment owner rather than a generic world-view modal helper.","objdump + command-registration correlation + world-view correlation + shell-modal correlation + slot-wrapper correlation" 0x004409c0,303,shell_select_camera_view_slot_or_publish_unassigned_warning,shell,cdecl,inferred,objdump + command-registration correlation + world-view correlation,4,"Direct shell command branch for the camera-view selection family. The helper first requires the live world-view owner at `0x0062be68`, then re-enters `world_view_restore_camera_view_slot_snapshot_if_populated` `0x0043ca20`. When the selected slot is populated the restore helper updates the live world-view immediately and this wrapper returns without opening a modal. When the slot is still unassigned, the wrapper formats one slot label through `0x0051b700`, localizes ids `371`, `372`, and `373` through `0x005193f0`, resolves up to two optional focus-label strings through repeated `0x0045f3d0` calls, and then publishes the resulting three-line warning through `0x004554e0`. Current direct wrappers `0x00440ba0..0x00440c30` map the slot selector in `ECX` to camera views `1..9` and `0`, and the shell command-registration block at `0x00460903..0x00460c7a` ties those wrappers to the localized `Select Camera View 1..9` and `Select Camera View 0` command strip. This is therefore the safest current read for the shared camera-view selection owner rather than a generic world-view restore path.","objdump + command-registration correlation + world-view correlation + shell-modal correlation + slot-wrapper correlation" 0x00440b00,12,shell_assign_camera_view_1,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `1` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460939` ties this wrapper to localized command id `3475`, the `Assign Camera View 1` slot.","objdump + command-registration correlation + wrapper inspection" @@ -621,12 +687,12 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00441980,52,shell_command_toggle_overview_window_page_2_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x74` and localized label id `0x0d4c`. The helper mirrors the adjacent page-toggle siblings, but it tests for `Overview.win` mode `9` page `2`; same-page hits close through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, while every other case requests mode `9`, page `2`. This is the safest current read for the third `Overview.win` page-toggle command rather than another generic shell leaf.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation" 0x004419c0,52,shell_command_toggle_overview_window_page_3_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the same `Overview.win` page-toggle strip. The helper tests the live detail manager for mode `9`, page `3`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `3`. Current evidence is strong enough to keep this as the fourth overview-page toggle, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation" 0x00441a00,52,shell_command_toggle_overview_window_page_4_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x72` and localized label id `0x0d4a`. The helper tests the live detail manager for mode `9`, page `4`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `4`. This is the current safest read for the fifth overview-page toggle command rather than a more semantic page-name claim.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation" -0x00441ac0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_0_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d4f`. The helper requires active scenario state `0x006cec78`, rejects when shell counter `[0x006d401c+0xc64]` is already positive, and then forwards three zero stack arguments into `shell_map_file_entry_coordinator` `0x00445ac0`. Current evidence is strong enough for the wrapper shape and gate conditions, but not yet for the exact player-facing verb mapped onto that zero-triplet coordinator call.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation" -0x00441af0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_1_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d51`. The helper mirrors `0x00441ac0`, but forwards stack flags `(0, 1, 0)` into `shell_map_file_entry_coordinator` `0x00445ac0` after the same active-scenario and shell-idle gate. Current evidence is strong enough for the wrapper shape and flag triplet, but not yet for the exact user-facing command name for this coordinator variant.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation" +0x00441ac0,39,shell_command_load_game_via_map_file_entry_coordinator,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + RT3.lng correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d4f`, whose RT3.lng caption is `Load game`. The helper requires active scenario state `0x006cec78`, rejects when shell counter `[0x006d401c+0xc64]` is already positive, and then forwards three zero stack arguments into `shell_map_file_entry_coordinator` `0x00445ac0`. Current evidence therefore closes the player-facing identity of the ordinary load-game wrapper as well as its wrapper shape and gate conditions.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation + RT3.lng correlation" +0x00441af0,39,shell_command_quick_load_via_map_file_entry_coordinator,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + RT3.lng correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d51`, whose RT3.lng caption is `Quick load`. The helper mirrors `0x00441ac0`, but forwards stack flags `(0, 1, 0)` into `shell_map_file_entry_coordinator` `0x00445ac0` after the same active-scenario and shell-idle gate. Current evidence therefore closes the player-facing identity of the quick-load wrapper as well as its gate and flag-triplet shape.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation + RT3.lng correlation" 0x00441b20,39,shell_command_clamp_world_dword_0x168d_not_below_0x1689_if_world_live,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + world-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d72`. The helper requires live world root `0x0062c120`, compares dwords `[world+0x1689]` and `[world+0x168d]`, and rewrites `[world+0x168d]` so it is never below `[world+0x1689]`. Current evidence is only strong enough for that direct clamp and owner boundary, not for a tighter semantic name for this world-side scalar pair.","objdump + command-registration correlation + local disassembly + world-root correlation + clamp correlation" 0x00441b50,358,shell_command_toggle_editor_map_mode_with_one_shot_warning_modals,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Broader registered shell command sibling above the editor-map-mode setter `0x00482e50`. The helper requires active scenario state `0x006cec78` and the live shell-state root `0x006cec74`, then branches on current editor-map mode lane `[shell+0x68]`. When editor-map mode is already active it uses one-shot latch `0x0062be88` to optionally publish localized modal `0x017e` through `0x005193f0 -> 0x004c98a0`; when editor-map mode is inactive it instead opens warning `0x0b6e` if the active-profile-count gate `0x004349a0` exceeds `1`, or uses one-shot latch `0x0062be8c` to optionally publish modal `0x0b24`. After those gates it computes target mode `([shell+0x68] == 0)` and forwards that boolean into `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. Current evidence is strong enough to treat this as the real editor-map-mode toggle command with one-shot warning modals rather than another anonymous scenario-side follow-on.","objdump + command-registration correlation + local disassembly + caller inspection + editor-map-mode correlation + warning-modal correlation" -0x00441cb0,111,shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6b` and localized label id `0x0db5`. The helper requires active scenario state `0x006cec78`, rejects when the active-profile-count gate `0x004349a0` exceeds `1`, clears shell dwords `[0x006cec74+0x233]` and `[+0x124]`, adds `0.5` to startup-side scalar `[0x006cec78+0xbfa]`, then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` before refreshing the live view owner at `0x0062be68` through `0x00439a80`. Current evidence is strongest for a paired half-step raise on the startup selected-year presentation scalar rather than a tighter player-facing command name.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation" -0x00441d20,111,shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. This is the current safest read for the paired half-step lower command rather than a stronger user-facing label claim.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation" +0x00441cb0,111,shell_command_increment_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation + RT3.lng correlation,3,"Registered shell command beneath action id `0x6b` and localized label id `0x0db5`, whose RT3.lng caption is `Increment Time Of Day`. The helper requires active scenario state `0x006cec78`, rejects when the active-profile-count gate `0x004349a0` exceeds `1`, clears shell dwords `[0x006cec74+0x233]` and `[+0x124]`, adds `0.5` to startup-side scalar `[0x006cec78+0xbfa]`, then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` before refreshing the live view owner at `0x0062be68` through `0x00439a80`. Current evidence therefore closes the player-facing label and narrows the command to the time-of-day presentation family, even though the exact relationship between `[world+0xbfa]` and the mixed-radix calendar state beneath `0x00409e80` still needs one deeper pass.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation + RT3.lng correlation" +0x00441d20,111,shell_command_decrement_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation + RT3.lng correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`, whose RT3.lng caption is `Decrement Time Of Day`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. Current evidence therefore closes the player-facing label and narrows the command to the time-of-day presentation family, even though the exact relationship between `[world+0xbfa]` and the mixed-radix calendar state beneath `0x00409e80` still needs one deeper pass.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation + RT3.lng correlation" 0x00441d90,135,shell_build_percent_status_payload_clamped_0_to_100,shell,cdecl,inferred,objdump + local disassembly + caller inspection + status-publisher correlation,3,"Shared percentage-status payload builder used by the save or load progress strip. The helper divides one caller float by one caller integer, multiplies by fixed scalar `100.0f`, rounds through `0x005a10d0`, clamps the result to at most `100`, and then packages that percentage into the small status payload built through `0x0051b700`, `0x005193f0`, and `0x00518de0`, returning the final shell text handle rooted at `0x0062c0d8`. Current grounded callers include the repeated progress-notice loop inside `shell_map_file_world_bundle_coordinator` `0x00445de0` and the adjacent throttled progress callback `0x00441e20`, so this is best read as the shared percent-status payload builder rather than a one-off modal helper.","objdump + local disassembly + caller inspection + status-publisher correlation + save-load-progress correlation" 0x00441e20,155,shell_progress_callback_publish_incremental_percent_status_until_target,shell,cdecl,inferred,objdump + caller inspection + local disassembly + progress-callback correlation,3,"Shared incremental progress callback above `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90`. The helper first checks global progress latches `0x0062bec8`, `0x0062becc`, and `0x0062c118`; when the caller target count has not advanced it returns immediately, and when the target equals `0x64` it instead advances `0x0062becc` by `0x14` and clears `0x0062c118`. Otherwise it increments `0x0062c118`, derives one intermediate percentage from the caller target divided by `3`, scaled by `100.0`, offset by current base `0x0062becc`, and then re-enters `shell_build_percent_status_payload_clamped_0_to_100` before publishing the resulting status through `0x00538c70` and servicing the shell frame through `0x00482160`. Current grounded owner correlation is the callback installation at `0x00442960`, which writes this function into global `0x00d93988` before entering a longer staged work loop, plus the same save or load progress family around `0x00445de0`. This is the safest current read for the throttled percent-status callback rather than another direct shell command leaf.","objdump + caller inspection + local disassembly + progress-callback correlation + staged-work correlation + shell-status correlation" 0x00441ec0,107,shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. On the save-side branch it writes one caller dword through `global_indexed_slot_table_write_bytes` `0x00531030` and then emits tagged headers `0x2ee0`, `0x03c2`, and `0x2ee1` through `0x00531340`; on the load-side branch it mirrors the same triplet through `0x005a276f` after opening the incoming staged object. Current grounded callers are the two companion-image file siblings `0x00441f70` and `0x004420f0`, where it serializes the selector byte at `[record+0x09]`, the payload size lane `[record+0x04]`, and the copied dword at `[record+0x00]` beside the external `_A.tga/_A.jpg` file path. This is the safest current read for the shared companion-image tag strip rather than a generic slot-table header helper.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation" @@ -672,10 +738,19 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation" 0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation" 0x0044ce60,272,world_scan_secondary_grid_marked_cell_bounds,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Secondary world-raster bounds scan beneath the later world-entry reactivation tail. The helper clears cached fields `[this+0x21c6/+0x21ca/+0x21ce/+0x21d2/+0x21d6]`, requires the shell-state gate `[0x006cec78+0x4af3]` to be nonzero, and then scans the byte raster rooted at `[this+0x2135]` through dimensions `[this+0x2155/+0x2159]`. Every cell whose byte has any bits in mask `0x3e` contributes to the cached min-X, min-Y, max-X, max-Y, and marked-cell-count slots at those same `0x21c6..0x21d6` fields. Current grounded callers are the later world-entry tail at `0x444c36`, one neighboring startup-side world branch at `0x448168`, and the small count accessor at `0x42f8d8`, so this is the safest current read for the shared marked-cell bounding-box scan over the secondary world raster rather than a fully player-facing overlay owner.","objdump + local disassembly + caller inspection + secondary-raster correlation" +0x00449500,18,world_runtime_release_root_payloads_and_collection_storage,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion for the live world root `0x0062c120`. The helper reinstalls vtable `0x005ca9fc`, re-enters `0x00449270`, and then tails into the shared world-presentation release path `0x00537e30`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation" +0x0042ae50,507,world_grid_cell_record_refresh_from_bundle_bitmask_and_optional_6byte_list,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Per-cell bundle-load helper used by the heavy world-grid restore path. The helper zeroes three local field bands on the destination record, reads one `0x14`-byte bitmask from the caller bundle, and then conditionally refreshes a repeating trio of payload lanes into the two `0x6a`-byte side bands and the larger band rooted at `[this+0x103]` through repeated `0x00531150` calls. It then refreshes the fixed footer fields `[this+0xd4]`, `[this+0xd6]`, `[this+0xd8]`, `[this+0xe6]`, two signed short coords `[this+0xe7/+0xe9]`, one count dword `[this+0xeb]`, allocates `[this+0xef]` as `count * 6` bytes, and reads that trailing `6`-byte record list from the same bundle. Current grounded caller is the world-grid load body `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`, which enters this helper on every live grid-cell record after the root arrays are allocated, so this is the safest current read for the per-cell bundle refresh helper rather than a generic small record constructor.","llvm-objdump + local disassembly + caller correlation + world-grid-load correlation + bundle-read correlation" +0x0042b050,227,world_grid_cell_refresh_bits_0x01_0x02_from_anchored_4x4_secondary_raster_class_counts,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + secondary-raster correlation,3,"Per-cell derived-flag refresh helper over one live world-grid record. The helper reads the anchored secondary-raster coordinate pair `[this+0xe7/+0xe9]`, expands that anchor into one `4x4` secondary-raster window, and then scans every cell in that window through the shared class predicates `0x00534e50`, `0x00534f00`, and `0x00534ec0`. One accumulated count treats class families `1/4` and `3/5` as admitted occupancy, while a second count separately tracks class family `2/4/5`. After the scan it rewrites the current world-grid byte `[this+0xe6]`: bit `0x01` is set only when the admitted occupancy count is at least `8`, and bit `0x02` is set only when that same count is at least `2`; otherwise those bits are cleared. Current grounded caller is the first pass inside `world_refresh_all_grid_cell_secondary_raster_derived_bits` `0x00449f80`, which runs this helper over every live grid-cell record before the neighboring bit-`0x08` refresh pass, so this is the safest current read for the anchored `4x4` secondary-raster class-count companion rather than a standalone terrain brush.","llvm-objdump + local disassembly + caller correlation + secondary-raster correlation + world-grid-derived-bit correlation" +0x0042bc70,432,world_grid_cell_refresh_bit_0x08_from_neighbor_cell_bit_0x01_clear_offsets,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + world-grid correlation,3,"Second per-cell derived-flag refresh helper over one live world-grid record. The helper snapshots the current world-grid byte `[this+0xe6]`, reads the anchored coordinate pair `[this+0xe7/+0xe9]`, and then walks the eight signed offset pairs from the fixed tables `0x00624b28..0x00624b54`. For every in-bounds offset target it resolves the peer world-grid record through the live grid rooted at `[0x0062c120+0x2129]`; if any admitted neighbor has bit `0x01` clear in its own byte `[peer+0xe6]`, the helper sets bit `0x08` in the current record, otherwise it clears that bit. Current grounded caller is the second pass inside `world_refresh_all_grid_cell_secondary_raster_derived_bits` `0x00449f80`, which applies this neighbor test after `world_grid_cell_refresh_bits_0x01_0x02_from_anchored_4x4_secondary_raster_class_counts` `0x0042b050` has refreshed bits `0x01/0x02`, so this is the safest current read for the neighbor-offset bit-`0x08` companion rather than a generic border scan.","llvm-objdump + local disassembly + caller correlation + world-grid correlation + neighbor-offset-table correlation" +0x00449f20,93,world_count_secondary_raster_cells_outside_class_set_1_3_4_5_and_store_0x21a9,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + secondary-raster correlation,3,"Small world-wide count pass over the live secondary raster. The helper clears dword `[this+0x21a9]`, walks every secondary-raster cell through live dimensions `[this+0x2155/+0x2159]`, and re-enters `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` on each `(x,y)` pair. Every cell that does not belong to that admitted class set increments `[this+0x21a9]`. Current grounded callers are the world-grid bundle-load body `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0` and the broader derived-surface rebuild owner `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, so this is the safest current read for the shared secondary-raster outsider-count refresh rather than a generic scan loop.","llvm-objdump + local disassembly + caller correlation + secondary-raster correlation + world-load-tail correlation" +0x00449f80,162,world_refresh_all_grid_cell_secondary_raster_derived_bits,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + world-grid correlation,3,"World-wide two-pass refresh over the live grid-cell record family rooted at `[this+0x2129]`. The first full-grid sweep re-enters `world_grid_cell_refresh_bits_0x01_0x02_from_anchored_4x4_secondary_raster_class_counts` `0x0042b050` on every live `0x1d7`-byte cell record, which refreshes bits `0x01` and `0x02` in `[cell+0xe6]` from the anchored secondary-raster window rooted at `[cell+0xe7/+0xe9]`. The second full-grid sweep then re-enters `world_grid_cell_refresh_bit_0x08_from_neighbor_cell_bit_0x01_clear_offsets` `0x0042bc70` on the same live cells, refreshing bit `0x08` from the neighbor-offset tables `0x00624b28..0x00624b54`. Current grounded callers are the broad derived-surface rebuild owner `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` and the transport/pricing preview ensure path `world_ensure_transport_pricing_preview_surface_and_publish_if_missing` `0x0044faf0`, so this is the safest current read for the full world-grid secondary-raster-derived-bit refresh rather than one narrow post-load loop.","llvm-objdump + local disassembly + caller correlation + world-grid correlation + secondary-raster-derived-bit correlation" +0x0044cf70,56,world_runtime_construct_root_and_seed_global_0x62c120,map,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"Top-level constructor for the live world root later published at `0x0062c120`. The helper enters the shared world-presentation base init `0x00534f60`, installs vtable `0x005ca9fc`, clears dword `[this+0x2125]`, stores `this` into global `0x0062c120`, and then forwards the three caller-supplied constructor arguments into the heavier initialization body `0x00449200`. Current grounded caller is the world-load allocation strip inside `0x00438c70`.","objdump + world-load correlation + local disassembly + global-publication correlation" 0x0044cfb0,1120,world_load_runtime_grid_and_secondary_raster_tables_from_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + bundle-tag correlation,3,"Heavy world-root bundle-load body beneath `world_construct_root_and_load_bundle_payload_thunk` `0x0044e910`. After the immediate base setup and neighboring local initializers `0x00449270` and `0x00448260`, the helper reads one rooted payload through repeated `0x00531150/0x00531360` calls, storing the core grid and stride scalars into `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It allocates the route-entry collection `0x006cfca8` through `0x00491af0`, allocates or zero-fills the main world arrays `[this+0x2139/+0x213d/+0x2141/+0x2131/+0x2135/+0x212d/+0x2129]` from chunk families `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, and on one loaded-raster path clears low bit `0x01` across every byte in `[this+0x2135]` after the bundle read succeeds. The tail then seeds every live world-grid cell record through `0x0042ae50`, re-enters `world_compute_transport_and_pricing_grid` `0x0044fb70`, refreshes neighboring presentation state through `0x00449f20`, and issues one shell-mode pulse through `0x00484d70` before returning. Current grounded caller is the world-root constructor thunk `0x0044e910` at `0x0044e931`, reached from the world-allocation branch inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the heavy world-grid and secondary-raster bundle-load body rather than the broader bringup owner.","objdump + caller xrefs + local disassembly + bundle-tag correlation + world-grid-array correlation" 0x0044e270,63,world_resolve_secondary_raster_class_record_at_float_xy,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-XY lookup over the live world secondary-raster class table. The helper rounds the two caller-supplied float coordinates through `0x005a10d0`, indexes the active byte raster at `[world+0x2131]` with row stride `[world+0x2155]`, shifts the selected byte right by three, and resolves the resulting class token through collection `0x006cfc9c`. Current grounded callers include `city_compute_connection_bonus_candidate_weight` `0x004010f0` and the linked-instance wrapper `0x0047f1f0`, so this is the safest current read for the world-side secondary-raster class-record lookup rather than a city-only predicate.","objdump + caller xrefs + local disassembly + secondary-raster-class correlation" +0x0044e910,42,world_construct_root_and_load_bundle_payload_thunk,map,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"Small world-root load thunk above the heavier bundle-body `0x0044cfb0`. The helper enters the shared world-presentation base init `0x00534f60`, installs vtable `0x005ca9fc`, re-enters `0x00448260` for the neighboring local setup, and then forwards the two caller-supplied bundle arguments into `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, which allocates the `0x0062c120` world root and then immediately enters this thunk.","objdump + world-load correlation + local disassembly + thunk-to-bundle-body correlation" 0x00491af0,295,route_entry_collection_construct_indexed_owner_and_zero_slot_array,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Concrete constructor for the route-entry collection rooted at `0x006cfca8`. The helper installs vtable `0x005cfe18`, re-enters the shared indexed-collection constructor path `0x00518570` with capacity-like scalars `0x3e8` and `0x1f4`, zeros the local side bands `[this+0x88..+0x10a]`, seeds `[this+0x88]` to `-1` and `[this+0x206]` to `-1.0f`, clears the small trailing triplet at `[this+0x10b]`, and allocates then zero-fills the separate slot-array pointer `[this+0x8c]` from caller count argument `arg0 * 4`. Current grounded caller is the world bundle-load body `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`, so this is the safest current read for the route-entry collection constructor rather than a generic list init.","objdump + caller inspection + local disassembly + indexed-collection correlation + route-entry-collection correlation" 0x00491c20,56,route_entry_collection_refresh_all_live_entries_derived_visual_bands,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small collection-wide post-pass over the route-entry collection `0x006cfca8`. The helper enumerates all live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640` on each resolved route entry. Current grounded caller is the later `319`-lane post-load pipeline inside `world_run_post_load_generation_pipeline` `0x004384d0`, where the same pass runs after placed-structure local-runtime refresh and flagged world-grid cleanup, so this is the safest current read for the collection-wide route-entry visual-band refresh pass rather than an anonymous indexed sweep.","objdump + caller inspection + local disassembly + indexed-collection correlation + post-load-pipeline correlation" +0x00491c60,134,route_entry_collection_serialize_records_into_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged save owner for the main route-entry collection rooted at `0x006cfca8`. The helper emits tag family `0x38a5/0x38a6/0x38a7` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, writes dword `[this+0x90]` directly into the active bundle through `0x00531030`, and then walks every live route-entry record through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `0x0048a6c0` with the caller bundle. Current grounded caller is the early package-save prelude `0x00444dd0`, where this helper runs before the auxiliary route-entry tracker collection serializer. This is the safest current read for the main route-entry tagged save owner rather than another anonymous collection walk.","objdump + local disassembly + caller correlation + tag-family correlation + route-entry correlation" 0x0044d4e0,512,world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local five-pass relaxer over the companion float grid rooted at `[this+0x1605]`. The helper clamps the caller rectangle inward against the live world bounds, derives one radial falloff from the supplied center and radius through `0x0051dc00` when the caller radius is nonzero, averages the four cardinal neighbors around each admitted cell, subtracts the current cell, scales that delta by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and only then accumulates the result back into the current float cell. The admit gate is explicit: cells whose paired raster byte in `[this+0x2135]` still has bit `0x01` set are skipped. After the five local passes it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded caller is the neighboring world-side branch at `0x004bc5d3`, so this is the safest current read for the local cross-neighbor relaxer under the same height-support family rather than a broader global smoothing owner.","objdump + caller xrefs + local disassembly + float-grid correlation + local-relaxation correlation" 0x0044d6e0,912,world_relax_companion_float_grid_cross_average_in_rect_with_acceptance_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Second local five-pass relaxer over the same companion float grid rooted at `[this+0x1605]`. Like the sibling at `0x0044d4e0`, it clamps the caller rectangle, averages the four cardinal neighbors, subtracts the current cell, and scales the resulting delta by a fixed coefficient before optionally accumulating it back into the current float slot. The admit path is tighter here: the cell is skipped whenever the paired raster byte in `[this+0x2135]` still has bit `0x01` set, and otherwise it also consults the neighboring acceptance gate `0x004499c0` before applying the delta. The final caller flag then decides whether the helper tails into `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same rectangle or returns immediately. Current grounded caller is the world-side branch at `0x004190b4`, where it is dispatched once per admitted local cell before the outer owner re-enters `0x0044d410`, so this is the safest current read for the acceptance-gated local cross-neighbor relaxer rather than another generic scalar write.","objdump + caller xrefs + local disassembly + float-grid correlation + acceptance-gate correlation" 0x0044d880,496,world_raise_companion_float_grid_toward_center_sample_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local neighborhood raise helper over the companion float grid rooted at `[this+0x1605]`. The function first validates the caller center cell against live dimensions, optionally seeds one baseline value from the current center sample when the caller gain is positive, expands a square neighborhood around that center by the caller radius, and then for each admitted cell derives one radial falloff through `0x0051dc00`. The body computes a delta from the current cell toward that baseline center sample, scales it by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and accumulates the result back into the current float slot. After the neighborhood pass it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded callers are the nearby world-side branches at `0x004bc676` and `0x004bc716`, so this is the safest current read for the center-sample-biased companion-float raise helper rather than another generic brush or setter.","objdump + caller xrefs + local disassembly + float-grid correlation + center-sample correlation" @@ -690,17 +765,21 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0044e940,1792,world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Broad rectangle-scoped rebuild owner over the live secondary-raster derived presentation family. The helper first clamps the caller rectangle through `0x00449df0` and reruns `world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component` `0x0044e500`. It then lazily ensures one presentation target through `0x0051f090` plus `0x00534910/0x00534920/0x00534930`, refreshes neighboring world-presentation state through `0x00449f20`, resolves scaled target dimensions through `0x00534c50`, and allocates a temporary `width*height` mask. The main scan then walks the live secondary raster `[this+0x165d]` and class predicates `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four sidecar byte planes `[this+0x1631..+0x163d]`, while the broader per-cell pass computes local windows, emits packed values into the ensured target through `0x00534730`, and also updates nibble lanes at byte offsets `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the temporary mask, expands the caller rectangle by dirty bounds `[this+0x21ad..+0x21b9]` through `0x00536710`, and finally seeds companion byte `[this+0x162d]` with `0xc4` on cells selected from mask plane `[this+0x1655]`. Current grounded callers include the post-load generation path at `0x00444a42`, the shell-mode toggle branch at `0x004480ec`, the sibling owner at `0x0044fac6`, and later world-side branches at `0x004fb1f9`, `0x004fc21e`, and `0x004ffee4`, so this is the safest current read for the broad secondary-raster derived-surface and companion-plane rebuild owner rather than a one-off shell preview draw.","objdump + caller xrefs + local disassembly + secondary-raster correlation + derived-surface publish correlation" 0x00414bd0,112,world_query_float_coords_within_live_grid_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-coordinate bounds predicate over the live world grid. The helper returns true only when both caller-supplied float coordinates are `>= 0` and `<= [world+0x15d9]-1` / `<= [world+0x15d5]-1` respectively; otherwise it returns false. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the radial secondary-raster stamp helper `0x0044e7d0`, several later world-side branches around `0x00480af8`, `0x00498278`, and `0x004982cb`, and the StationPlace world-surface branch at `0x005085a4`, so this is the safest current read for the shared float grid-bounds gate rather than a tool-specific placement check.","objdump + caller xrefs + local disassembly + grid-bounds correlation" 0x00449df0,144,world_clamp_rect_coords_to_live_grid_and_validate_nonempty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small rectangle clamp-and-validate helper over integer world-grid coordinates. The function takes four caller-owned coordinate pointers, clamps the two lower bounds to zero, clamps the two upper bounds to `[world+0x2155]-1` and `[world+0x2159]-1`, and then returns true only when the resulting rectangle is still nonempty and fully within those live dimensions. Current grounded callers include the local marked-bit refresh helper `0x0044dcf0`, the rect-wide secondary-raster edge refresh owner `0x0044e500`, the broader owner `0x0044e982`, later secondary-raster siblings around `0x0044ec93` and `0x0044eee9`, the route-entry window gate `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, and one later world-side caller at `0x00494261`, so this is the safest current read for the shared rect clamp-and-validity predicate rather than a serializer-only rectangle helper.","objdump + caller xrefs + local disassembly + rect-clamp correlation" -0x00444dd0,3301,map_bundle_open_reference_databases,map,cdecl,inferred,ghidra-headless,3,Opens and registers a broad reference-database bundle for the active map path. The routine formats %1\\%2 paths allocates bundle state through 0x00530c80 and wires many global datasets including gpdLabelDB gpdCityDB and related city geographic and map reference tables before later shell and map loaders continue.,ghidra + rizin + llvm-objdump + strings -0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. It accepts either an incoming filename seed or a generated Quicksave base name and then chooses between the heavier world-entry branch at 0x00443a50 and the sibling saved-runtime restore branch at 0x00446d40. Bit 0x1 in its flag argument now grounds the Quicksave path from the shared string table at 0x005ca9cc. The non-Quicksave interactive path is tighter now too: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using load mode 4=.gmp when EditorPanel.win is live and the paired non-editor open modes 8=.gms 9=.gmc and 10=.gmx. The shell-state master flag `[0x006cec74+0x68]` now reinforces that same mapping on the direct Quicksave branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence now makes the non-editor trio much less anonymous: `.gmx` aligns with sandbox mode because the sibling shell branch at 0x004dc923 gates on 0x006cec7c+0x82 and surfaces string 3898 `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because 0x004dc9cd gates on 0x006cec7c+0xc5 and surfaces string 3018 about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family. When a live runtime world is already active the helper appends .smp instead of the non-runtime extensions before the restore branch continues.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection -0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. It accepts either an incoming filename seed a generated Quicksave base name from flag bit 0x1 or the localized `Autosave` seed from flag bit 0x2 string id 387. Its non-Quicksave interactive path is now tighter: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using save mode 3=.gmp for the editor-map package path 0=.gms for standalone scenarios 1=.gmc for campaign-scenario saves and 2=.gmx for sandbox saves plus one auxiliary 11=.gmt branch reached only through the separate 0x00434050 check on the side owner at 0x006cd8d8. The shell-state master flag `[0x006cec74+0x68]` now reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. That `.gmt` path no longer looks like another scenario family: when the auxiliary owner is present the coordinator packages the chosen path into the owner-local request block near 0x006cd8d8+0x8f48 and submits it through 0x00469d30; only when that owner is absent does it fall back to map_bundle_open_reference_databases at 0x00444dd0. The campaign mapping is now backed by the numbered `%s%02d.gmc` helper at 0x00517c70 which formats one campaign-progress slot from 0x006cec7c+0xc4 before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string 3898 on 0x006cec7c+0x82. When a live runtime world is active the mainline branch still appends .smp and invokes world_runtime_serialize_smp_bundle at 0x00446240. This makes the helper the save-side sibling of shell_map_file_entry_coordinator rather than another restore dispatcher, with `.gmt` now bounded as an auxiliary preview-surface side path instead of a fourth gameplay save family.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct save branch inspection +0x00444dd0,3301,map_bundle_open_reference_package_and_serialize_early_world_datasets,map,cdecl,inferred,objdump + caller xrefs + local disassembly + chunk-family correlation,4,"Broader package-save prelude beneath the non-`.smp` branch of `shell_map_file_world_bundle_coordinator` `0x00445de0` and the neighboring multiplayer-side fallback path at `0x0046cfcb`. The helper seeds the shared stage/progress globals `0x00620e94 = 0x26ad`, `0x0062bec8 = 0x15`, `0x0062becc = 0`, and `0x0062bed0 = ticks`, optionally runs the editor-map side prepass `0x00436a70` when `[0x006cec74+0x68]` is live, opens one bundle through `0x00530c80(4, 0x30d40, 1)`, and on failure raises the localized modal rooted at `0x0fda` before unwinding the surrounding shell notices. On success it serializes the first broad save/package band in a fixed order with interleaved progress updates through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`: chunk `0x32c8` with the fixed `0x4f2c` world block `[world+0x04]`, chunk `0x32c9` with the fixed `0x0bb9` block `[world+0x4f30]`, chunk family `0x332d/0x332e` with the late world-status band `[world+0x66be]` and then the direct counted named-availability collection saves from `[world+0x66b2]` and `[world+0x66b6]`, chunk `0x32dc`, chunks `0x3714/0x3715` with the `0x108` staged profile block `0x006cec7c`, then the early reference and manager families through `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`, the shell notifier vtable `+0x08` on `0x0062be68`, `structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks` `0x0041e930`, `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`, `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, direct indexed-collection header serialization on the route-link family `0x006ada90` through `0x00517d90`, `placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle` `0x00481310`, `linked_route_object_collection_serialize_records_into_tagged_bundle` `0x0041d4c0`, `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, `route_entry_collection_serialize_records_into_tagged_bundle` `0x00491c60`, `aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle` `0x004a4240`, `profile_collection_serialize_records_into_tagged_bundle` `0x004777e0`, `geographic_label_database_serialize_records_into_tagged_bundle` `0x00461650`, `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610`, `world_region_collection_serialize_records_into_tagged_bundle` `0x004215e0`, `territory_collection_serialize_records_into_tagged_bundle` `0x00487cc0`, `support_collection_serialize_tagged_records_into_bundle` `0x0040b6a0`, and `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`. Its fixed tail is tighter now too: after the tagged collections it writes one direct dword from `[world+0x19]`, one zeroed `0x1f4`-byte slab under chunk `0x32cf`, closes the bundle through `0x00530a00`, derives the output path through `0x00442740`, conditionally emits the companion image file branch `0x00441f70` when `[world+0x66c8]` is set, conditionally emits the companion-payload rewrite branch `0x00442900` when `[world+0x66c9]` is set, and otherwise falls back to the localized no-preview notice path through `0x00441ec0`; those same preview/payload flags also add `+1` and `+0x15` respectively into the shared progress bound `0x0062bec8` before the save steps begin. This is therefore the real early reference-package open-and-save owner rather than a generic database opener.","objdump + caller xrefs + local disassembly + chunk-family correlation + save-order correlation + package-tail correlation + progress-bound correlation" +0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. At entry it clears the optional success dword, and every successful path later decrements nested open counter `0x0062be6c`, notifies the shared shell owner at `0x0062be68`, sets shell latch `[0x006cec74+0x501] = 1`, and clears live input word `[0x006d4018+0xa8c]`. The direct-seed side is tighter now too: when the caller supplies a path seed the helper increments `0x0062be6c`, and if a live runtime world is already active or flag bit `0x8` is set it copies that stem, appends the fixed `.smp` token from `0x005ca9a4`, and re-enters `world_load_saved_runtime_state_bundle` `0x00446d40`; otherwise it routes straight into the heavier world-entry branch `0x00443a50` with the flag-derived trailing boolean from `(flags>>2)^1`. The quickload side is explicit too: flag bit `0x1` seeds the shared quicksave base stem from `0x005ca9cc`, appends `.gmp` when editor-map flag `[0x006cec74+0x68]` is live and otherwise appends `.gms/.gmc/.gmx` through the same sandbox/campaign/default split used by the interactive chooser, resolves the final path through `0x004839e0`, validates it through `0x00530c20`, and uses the two localized validation branches rooted at ids `0x181/0x182` plus `0x004c98a0` before continuing. The non-Quicksave interactive path is tighter now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using load mode `4=.gmp` when `EditorPanel.win` is live and paired non-editor open modes `8=.gms`, `9=.gmc`, and `10=.gmx`. The shell-state master flag `[0x006cec74+0x68]` reinforces that same mapping on the direct quickload branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence still keeps the non-editor trio concrete: `.gmx` aligns with sandbox mode because the sibling shell branch at `0x004dc923` gates on `0x006cec7c+0x82` and surfaces string `3898` `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because `0x004dc9cd` gates on `0x006cec7c+0xc5` and surfaces string `3018` about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection + restore-vs-world-entry split" +0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. At entry it clears the optional success dword and seeds shared save-progress selector `0x0062bec4` from one of the two shell-controller dwords `[0x006d4024+0x11472a]` or `[+0x11472e]` depending on the side-owner gate `0x004839b0`. Its filename-selection side is tighter now too: an explicit caller-supplied stem bypasses the chooser, flag bit `0x1` seeds the Quicksave base stem from `0x005ca9cc`, and flag bit `0x2` seeds the localized `Autosave` stem through string id `387` while also clearing `0x0062bec4`. The non-Quicksave interactive path is explicit now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using save mode `3=.gmp` for the editor-map package path, `0=.gms` for standalone scenarios, `1=.gmc` for campaign-scenario saves, and `2=.gmx` for sandbox saves, plus the auxiliary `11=.gmt` branch reached only when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner at `0x006cd8d8`. The shell-state master flag `[0x006cec74+0x68]` reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. The active-world split is tighter in the same way: when a live runtime world is present the helper copies the chosen stem, appends the fixed `.smp` token from `0x005ca9a4`, re-enters `world_runtime_serialize_smp_bundle` `0x00446240`, and marks success immediately. Only when no active runtime world is present does it continue into the package side: when the auxiliary preview owner is live it packages the chosen stem into the owner-local request block near `0x006cd8d8+0x8f48` and submits it through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7d` and payload size `0x48`; otherwise it falls back to `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The campaign mapping is still backed by the numbered `%s%02d.gmc` helper at `0x00517c70`, which formats one campaign-progress slot from `0x006cec7c+0xc4` before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string `3898` on `0x006cec7c+0x82`. Its package-side order is now explicit too: the non-`.smp` branch delegates the early direct-save band to `0x00444dd0`, which itself serializes the route-entry family, auxiliary tracker family, profile, region, territory, support, and event managers with shared progress/sample notices interleaved through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`. One editor-only trailing validation branch is tighter now too: after a successful non-runtime package save, when `[0x006cec74+0x68]` and `[world+0x66de]` are both live, the helper scans the fixed 16-entry stem table `0x00621cf0..0x00621d2c` against format stem `0x005ca9d8` and only opens the localized warning rooted at `0x0fd9` through `0x004c98a0` when no match survives. This makes the helper the save-side sibling of `shell_map_file_entry_coordinator` rather than another restore dispatcher, with `.gmt` bounded as an auxiliary preview-side export path instead of a fourth gameplay save family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct-save branch inspection + active-world split + editor-only validation sweep" +0x00455320,42,runtime_object_collection_construct_vtable_5cae10,map,thiscall,inferred,objdump + world-load correlation + local disassembly,2,"World-load constructor for the `0x005cae10` indexed collection later rooted at `0x006acd34`. The helper enters the common collection base `0x00517ce0`, installs vtable `0x005cae10`, seeds the indexed collection through `0x00518570` with grounded parameters `(record_size=0x21a, initial_slots=0x0a, growth=5, id_base=1)`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting object is stored into global `0x006acd34`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" +0x00455350,22,runtime_object_collection_release_entries_and_collection_storage_vtable_5cae10,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `runtime_object_collection_construct_vtable_5cae10` `0x00455320`. The helper reinstalls vtable `0x005cae10`, re-enters `0x00518600` to release live entries, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation" 0x00455f60,96,world_region_resolve_center_world_grid_cell,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small region-to-grid resolver that converts one region's cached center coordinate pair into a pointer into the live world-grid cell table rooted at `[0x0062c120+0x2129]`. It reads the cached floats at `[this+0x1ea]` and `[this+0x1e2]`, scales and rounds them through `0x005a10d0`, multiplies the Y-like term by world width `[0x0062c120+0x2145]`, adds the X-like term, and returns the corresponding grid-cell pointer. Current grounded callers include the world-entry region-center flag reseed pass `0x0044c4b0` and several older site- or route-style world-grid query helpers, so this is now the safest current read for the shared region-center world-grid-cell resolver.","objdump + local disassembly + caller inspection + world-grid correlation" -0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it first pushes the nested mouse-cursor selection hold through `0x0053f2f0`, snapshots one startup-side status band through `0x004423a0`, allocates a bundle through `0x00530c80`, seeds many typed records through repeated `0x00531030` and `0x00531340` calls, walks world collections under `0x0062c120` and `0x006ada80`, and emits runtime-state payloads through helpers such as `0x00534e50`, `0x00534ec0`, `0x00534f00`, and `0x00534f40`; at the tail it mirrors the paired status follow-on through `0x004423d0`, pops the same mouse-cursor hold through `0x0053f310`, and posts the fixed shell status line through `0x00538c70`. The status-band choreography is tighter now too: `0x004423a0/0x004423d0` bracket the same four shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` through the `0x0062be90` stack while also servicing active TrackLay.win and StationPlace.win tool windows. The raster side is tighter now too, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters world_serialize_four_sidecar_byte_planes_into_runtime_bundle `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before finalizing through `0x00530a00`. One late fixed-band save is tighter now too: at version `>= 0x400` the serializer writes `49` dwords from `[world+0x4a7f..+0x4b3f]` and one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is `0x00445de0` on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation + cursor-hold choreography correlation + status-stack correlation" -0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes, including the secondary-raster class mutators world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane `0x00448c20` and world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane `0x00448cb0`, the byte2-flag and companion-byte writers `0x00448d90`, `0x00448e60`, and `0x00448e90`, and the broader restore-side world-cell helper `0x0044de30`; the raster side is tighter now too, because the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, and then, for versioned bundles at `>= 0x3ec`, re-enters world_load_four_sidecar_byte_planes_from_runtime_bundle `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into the world-owned pointer band `[world+0x1631 + index*4]`. One later fixed-band restore is tighter now too: at version `>= 0x3fc` the loader reads `49` dwords directly into `[world+0x4a7f..+0x4b3f]` and one trailing dword into `[world+0x4b43]`, which grounds a direct `.smp` restore of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred in the checked `gmp/gms/gmx` families. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation" +0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it first pushes the nested mouse-cursor selection hold through `0x0053f2f0`, snapshots one startup-side status band through `0x004423a0`, allocates a bundle through `0x00530c80`, seeds many typed records through repeated `0x00531030` and `0x00531340` calls, walks world collections under `0x0062c120` and `0x006ada80`, and emits runtime-state payloads through helpers such as `0x00534e50`, `0x00534ec0`, `0x00534f00`, and `0x00534f40`; at the tail it mirrors the paired status follow-on through `0x004423d0`, pops the same mouse-cursor hold through `0x0053f310`, posts the fixed shell status line through `0x00538c70`, and only then closes the bundle through `0x00530a00`. The status-band choreography is tighter now too: `0x004423a0/0x004423d0` bracket the same four shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` through the `0x0062be90` stack while also servicing active TrackLay.win and StationPlace.win tool windows. The serializer-side fixed header is explicit now too: it writes bundle version `0x400` first, then, for version `>= 0x3f1`, the late world-status block `[world+0x66be]` under chunk ids `0x2ee0/0x2ee1`, followed by the main world-grid dimensions and stride scalars from `[world+0x2155/+0x2159]`. The raster side is tighter in the same way, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before the later fixed-band tail continues. One save-side bridge into the editor economic-tuning band is explicit now too: before the region and named-availability runs, the serializer writes the same six-dword block the map-editor economic cost panel exposes at `[world+0x0be2..+0x0bf6]` as one direct dword from `[world+0x0be2]` plus five successive dwords from `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`. The mid-save state bands are tighter now too: after the core raster tables it serializes the twelve raw `0x4e1` recipe books from `[world+0x0fe7]` book-by-book, writing each shared cap dword at `+0x3ed`, one `0x3d`-byte book header, and the five repeated line records as `mode/amount/supplied-token-window/demanded-token-window` subfields in fixed `0x30`-byte steps. The named-availability, event, and trailing fixed bands are tighter in the same way: the serializer writes a counted run of fixed `0x22`-byte candidate-name-plus-dword records from `[world+0x66b2]`, then a counted run of fixed `0x41`-byte locomotive-name-plus-dword records from `[world+0x66b6]`, writes a counted region row run from `[0x0062bae0]` as `0x29`-byte headers plus companion profile-subcollection counts and `0x22`-byte rows, brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` before delegating the per-event packed-state save to `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, writes the two direct dwords at `[world+0x4c78/+0x4c7c]`, and at version `>= 0x400` writes `49` dwords from `[world+0x4a7f..+0x4b3f]` plus one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is `0x00445de0` on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-context + local disassembly + caller xrefs + strings + sidecar-plane correlation + mask-plane bundle-tag correlation + fixed-runtime-band correlation + cursor-hold choreography correlation + status-stack correlation + mid-save-band correlation + pre-recipe-scalar-band correlation + named-availability-save correlation + region-row-save correlation + event-collection-save correlation + trailing-fixed-band correlation + economic-tuning-band correlation" +0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by `shell_map_file_entry_coordinator` `0x00445ac0`. The helper dismisses the current shell detail controller, optionally tears down the active tool owner through `0x004ddbd0(-1, 0)`, releases the prior world runtime through `world_runtime_release_global_services` `0x00434300`, drives shell mode and status transitions, rebuilds the startup-side runtime roots through `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, allocates a new bundle through `0x00530c80`, and constructs a fresh world root at `0x0062c120` through `0x0044cf70` using `(width+1, height+1)` from the serialized grid scalars. The first restore bands are tighter now too: after bundle version `0x400` it restores the late world-status block `[world+0x66be]` from chunk ids `0x2ee0/0x2ee1` for versions `>= 0x3f1`, immediately re-normalizes that block through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and otherwise explicitly clears the older compatibility tail at `[world+0x6987]`; then it reads one dword per world-grid cell and forwards those values into `world_write_companion_float_grid_cell_and_optionally_refresh_rect` `0x0044dca0` across the full `(width+1)*(height+1)` raster. The raster and overlay side is explicit in the same way: the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, then, for versioned bundles at `>= 0x3ec`, re-enters `world_load_four_sidecar_byte_planes_from_runtime_bundle` `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into `[world+0x1631 + index*4]`. It also restores the per-cell secondary-raster sideband through the byte-level helpers `0x00448c20`, `0x00448cb0`, `0x00448d90`, `0x00448e60`, `0x00448e90`, and `0x0044de30`, with the later version split now explicit: at `>= 0x400` it restores five separate per-cell compatibility bits into the live secondary-raster word and byte lanes, while older bundles clear those same bits back to the older fixed fallback pattern. One mid-restore preview branch is tighter now too: for versions `>= 0x3ee` it restores one width/height-tagged dword surface, optionally resamples it through `shell_world_presentation_stage_overlay_rect_from_normalized_bounds` `0x00534930`, republishes it through `0x00534730/0x00534af0`, frees the temporary buffer, and then re-enters `0x004882e0` on the neighboring manager family. The recipe and manager bands are tighter in the same way: at version `>= 0x3f5` it restores the same twelve raw `0x4e1` recipe books back into `[world+0x0fe7]` book-by-book, line-by-line, and field-by-field as `cap dword + 0x3d-byte book header + five repeated 0x30-byte line records`. At version `>= 0x3f2` it then restores the same six-dword editor economic-tuning band by reading the first dword into `[world+0x0be2]`, mirroring that value immediately into `[world+0x0bde]`, and reading the five successive dwords into `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, before the later manager bands at `[world+0x4f30]`, the tagged geographic-label collection `0x006ada80`, the trailing scenario-rule band `[world+0x4a7f..+0x4b43]`, and the packed sidecar bitfield at `[world+0x2141]` run under the later version gates `0x3f4/0x3fa/0x3fc`. The region side is explicit now too: after seeding default regions through `world_region_collection_seed_default_regions` `0x00421b60`, the loader reads one counted run of fixed `0x29`-byte region rows, resolves or allocates each target through `0x00421660/0x00518140`, republishes pending amount `[region+0x272]`, paired pointers `[region+0x25a/+0x25e]`, reruns `0x004204c0`, reloads the per-region profile subcollection at `[region+0x37f]`, and then restores one second counted run of fixed `0x1e+4` rows whose names must survive the fixed reject stems and resolve back into the live candidate pool before the row is accepted into that region-owned subcollection. The named-availability and event-side collection bands are tight on the restore path too: the loader first clears `[world+0x66b2]`, reads one counted run of fixed `0x22`-byte candidate-name-plus-dword records, rejects the built-in alias stems at `0x005c8f94/0x005c8e4c`, resolves every surviving name back into the live candidate pool through `indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04` `0x00412b70`, and only then inserts the accepted record through collection vtable slot `+0x04`; it then does the same direct clear-and-repopulate pass for `[world+0x66b6]` from one counted run of fixed `0x41`-byte locomotive-name-plus-dword records, with the older empty-collection fallback into `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` still preserved after the direct restore. It then brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` and delegates the per-event packed-state restore to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The post-close reactivation tail is explicit now too: after `0x00530a00` closes the bundle, the helper re-enters `0x00538e00`, refreshes candidate and locomotive availability through `0x00412c10/0x00461e00`, rebuilds the full secondary-raster derived surface through `0x0044e940`, then reruns `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`, the scenario-side recipe bridge `0x00435630`, shell tool refresh `0x0040b830`, `world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions` `0x00421ce0`, `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0`, and a final `4x4` local bitplane mark loop through `0x004497a0` over the grounded quarter-resolution bitmap planes at `[world+0x2139/+0x213d/+0x2141]`. This is therefore the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.","objdump + analysis-context + local disassembly + caller xrefs + strings + world-root-allocation correlation + companion-float-grid restore correlation + sidecar-plane correlation + secondary-raster compatibility-bit restore correlation + region-row restore correlation + geographic-label restore correlation + named-availability-restore correlation + restore-side-name-validation correlation + event-collection-restore correlation + post-close-reactivation-tail correlation + trailing-fixed-band correlation + economic-tuning-band correlation + setup-payload-normalization correlation" 0x0044f840,176,world_build_transport_pricing_preview_surface_from_secondary_raster,map,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,3,"Small transport/pricing-side preview builder beneath `world_compute_transport_and_pricing_grid` `0x0044fb70`. The helper allocates one default presentation target through `0x00534930`, queries its dimensions through `0x00534c50`, seeds five fallback palette entries through repeated `0x0051de10` calls, and then walks the target pixels. Each pixel is mapped back into the live secondary raster `[this+0x165d]` through `0x00533970/0x00533980`; low-3-bit classes other than `1/4` get one fixed fallback color, while class-`1/4` pixels scan a local `+/-4` neighborhood for zero-tag cells, score those through the radial falloff helper `0x0051db80`, and then choose either one of the seeded palette entries or the alternate fallback color `0x5f040566`. After filling the whole surface it re-enters `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` on the full `0..0x270f` rectangle rooted at that target. Current grounded caller is the null-build path at `0x0044fb31` inside `world_compute_transport_and_pricing_grid`, so this is the safest current read for the transport/pricing preview-surface builder rather than another generic overlay helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + preview-surface correlation" 0x0044faf0,128,world_ensure_transport_pricing_preview_surface_and_publish_if_missing,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Thin world-side ensure/publish wrapper above `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`. The helper first forwards the caller rectangle and output pointer into `0x00538060`, then samples shell state through `0x0040b830` and the paired shell notifier `0x004834e0`. When the returned preview handle is null it rebuilds the preview surface by re-entering `0x0044f840`; in either case it then refreshes neighboring world presentation through `0x00449f80`, re-enters the region-border overlay refresh `0x004881b0`, posts the same shell notifier again, and finally issues one mode pulse through `0x00484d70` before returning the ensured handle. Current grounded caller is the world-side path at `0x0043901a`, so this is the safest current read for the transport/pricing preview ensure-and-publish wrapper rather than another generic surface allocator.","objdump + caller inspection + local disassembly + world-presentation correlation" 0x0044fb70,1117,world_compute_transport_and_pricing_grid,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop.",objdump + caller context + RT3.lng strings 0x00487540,221,world_region_border_overlay_reset_companion_record,map,thiscall,inferred,objdump + caller xrefs + field-reset inspection,4,"Shared companion-record initializer under the region-border overlay family rooted at `0x006cfc9c`. The helper zeroes the live region id and accumulated contribution fields, seeds the enable and remap dwords at `[this+0x31]` and `[this+0x35]` to `1`, seeds the budget-like dword `[this+0x39]` to `0x186a0`, clears the paired float or score bands at `[this+0x45/+0x49/+0x4d/+0x51]` and `[this+0x1fd/+0x201/+0x205/+0x209]`, zeros the later summary slots at `[this+0xd51..+0xd69]`, resets `[this+0xd4d]` to `1`, and clears the two large tail arrays rooted at `[this+0x3b5]` and `[this+0xd6d]`. Current grounded callers are the plain wrapper `0x00487620` and the id-setting wrapper `0x00487650`, both used under world_region_border_overlay_rebuild.","objdump + caller xrefs + field-reset inspection" 0x00487650,16,world_region_border_overlay_reset_companion_record_and_assign_region_id,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Thin wrapper around world_region_border_overlay_reset_companion_record. After resetting the full companion record, the helper stores the caller-supplied live region id into `[this+0x00]` and returns. Current grounded callers are the region-border overlay setup loops at `0x00487d77` and `0x0048836e`.","objdump + caller xrefs + wrapper inspection" +0x00487c20,143,territory_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Collection-wide tagged load owner for the live territory collection rooted at `0x006cfc9c`. The helper reads chunk family `0x61a9/0x61aa/0x61ab` through repeated `0x00531360` calls, refreshes the collection-side metadata through `0x00518680`, walks every live territory entry through the indexed-collection helpers `0x00517cf0/0x00518380/0x00518140`, and dispatches each resolved record through vtable slot `+0x40` with the caller-supplied bundle handle before closing tag `0x61ab`. The current per-entry load slot `0x00487670` is a no-op returning zero, so this tagged lane presently rehydrates collection-side metadata and live ids without additional per-entry payload. Current grounded caller is the world-entry bringup strip `0x00443a50`, where this collection is refreshed beside the neighboring region and support families.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-noop-load correlation" +0x00487cc0,118,territory_collection_serialize_records_into_tagged_bundle,map,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Collection-wide tagged save owner for the live territory collection rooted at `0x006cfc9c`. The helper opens chunk family `0x61a9/0x61aa/0x61ab` through repeated `0x00531340` calls, serializes the collection-side metadata through `0x00517d90`, walks every live territory entry through the indexed-collection helpers `0x00517cf0/0x00518380/0x00518140`, and dispatches each resolved record through vtable slot `+0x44` with the caller-supplied bundle handle before closing tag `0x61ab`. The current per-entry save slot `0x00487680` is a no-op serializer, so this tagged lane presently persists collection-side metadata and live ids without additional per-entry payload. Current grounded caller is the package-save strip beneath `shell_map_file_world_bundle_coordinator` `0x00445de0`, where this family is emitted beside the neighboring region and support managers.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-noop-save correlation" 0x004881b0,272,world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid,map,thiscall,inferred,objdump + caller xrefs + raster-count inspection,4,"Shared region-raster counting pass over the companion region set `0x006cfc9c`. The helper zeroes one `0x3e8`-entry local count table, sweeps the active world raster at `[0x0062c120+0x2131]` across `[world+0x2155/+0x2159]`, keeps only cells whose secondary-raster low-3-bit tag predicate `world_secondary_raster_query_cell_low3bit_tag_nonzero` `0x00448f00` returns `0`, and bins each surviving cell by the compact region id `cell_byte >> 3`. It then walks the companion region records, stores the corresponding raw cell count into `[entry+0x3d]`, and clears `[entry+0x41]` before later owners fold or reuse those totals. Current grounded callers are the region-border overlay rebuild at `0x004882e0`, the world-build paths around `0x004431ea`, `0x004476ad`, `0x0044f657`, and `0x0044fb43`, plus one shell-side caller at `0x004fcc05`.","objdump + caller xrefs + raster-count inspection + caller correlation + secondary-raster predicate correlation" 0x00487de0,752,world_region_border_overlay_emit_segment_geometry_from_region_grid,map,cdecl,inferred,objdump + caller xrefs + grid-neighbor inspection,4,"Heavy inner geometry pass under world_region_border_overlay_rebuild. The helper first clears or prepares the current overlay surface through `0x00533cf0` on the active world presentation rooted at `0x0062c120`, then walks the companion region-set family at `0x006cfc9c`, counting entries whose enable byte `[entry+0x31]` is nonzero or whose accumulated contribution pair `[entry+0x3d]+[entry+0x41]` stays positive. It seeds a local remap table from either the live region id `[entry+0x00]` or the fallback remap id `[entry+0x35]`, scans the world raster at `[world+0x2131]` across `[world+0x2155/+0x2159]` in two axis directions, compares neighboring mapped ids, and emits border-segment geometry through `0x00536ea0` whenever adjacent cells belong to different mapped regions. Current grounded caller is `0x004882c6` under world_region_border_overlay_rebuild.","objdump + caller xrefs + grid-neighbor inspection + geometry-emitter inspection" 0x004882e0,199,world_region_border_overlay_rebuild,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Rebuilds the border-overlay companion for the numbered region set owned by `0x0062bae0`. After pumping shell progress through `0x004834e0` the helper seeds or refreshes the companion record family at `0x006cfc9c`, using world_region_border_overlay_reset_companion_record_and_assign_region_id `0x00487650` to reset each resolved record before folding active contribution counts back into `[entry+0x3d]+[entry+0x41]`. It then refreshes the raw per-region cell-count band through world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid `0x004881b0`, and only after that hands the actual world-grid border-segment emission to `world_region_border_overlay_emit_segment_geometry_from_region_grid` `0x00487de0`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x00447560`, which makes this look like a region-border overlay rebuild rather than another generic player or company manager pass.","objdump + caller xrefs + RT3.lng strings + grid-neighbor inspection" @@ -830,7 +909,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004ca790,384,map_editor_scenario_metadata_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the shell-side map-editor scenario metadata controls under the shared control band `0x5b69..0x5b74`. The helper first re-enters `map_editor_scenario_metadata_panel_refresh_briefing_mode` at `0x004ca670`, then republishes the scenario description from `[0x006cec78+0x672e]` to control `0x5b69`, the start-year trio from `[+0x66ca]`, `[+0x66d2]`, and `[+0x66ce]` into `0x5b6a`, `0x5b6c`, and `0x5b6b`, the direct campaign-designated byte `[+0x66de]` into control `0x5b6e`, and the inverse of the paired metadata byte `[+0x66f3]` into control `0x5b74`. The resource-side anchor is now explicit too: `editorDetail.win` contains one control record rooted at `0x5b6e` that carries localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.` before the next control record begins at `0x5b74`, which grounds `[+0x66de]` as the actual campaign-scenario flag rather than a generic metadata boolean. The neighboring message dispatcher at `0x004cb4a0` clamps the three year fields to `1829..2100` and maintains `minimum <= default <= maximum`, which aligns the rest of this panel with the localized editor strings `Description:` `Minimum Start Year:` `Default Start Year:` `Maximum Start Year:` and the paired briefing labels in `RT3.lng` ids `1483..1492` and `3586`.","objdump + RT3.lng strings + UI control inspection + state-field correlation + editorDetail.win resource record" 0x004ca910,474,map_editor_building_density_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI control inspection,4,"Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls.","objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation" 0x004ca980,315,map_editor_economic_cost_slider_dispatch,map,thiscall,inferred,objdump + RT3.lng strings + .data descriptor table inspection,3,"Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d`, converts the incoming integer slider delta or position into normalized floats, writes six tuned values into the adjacent scenario-state block at `[0x006cec78+0x0be2]`, `[+0x0be6]`, `[+0x0bea]`, `[+0x0bee]`, `[+0x0bf2]`, and `[+0x0bf6]`, mirrors the first value into `[state+0x0bde]`, and then re-enters the live panel owner through `0x004cadf0` when `0x006cff84` is present. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned.","objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection" +0x004caaf0,751,map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows,map,cdecl,inferred,objdump + local disassembly + constructor correlation + state-field correlation,4,"Refreshes the shell-side preview and numeric readout strip beneath the map-editor economic tuning page. The helper is attached to control `0x5be1` by `map_editor_economic_cost_slider_panel_construct` `0x004cadf0`, reads the live six-float tuning band from `[0x006cec78+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and then does two distinct presentation passes. First it builds one curve preview into the `0x418` drawing path on `0x6cff8c`, using `[state+0x0be2]` as the leading scalar and the five trailing floats as one stepped multiplier table across successive ten-step buckets. Second it republishes the same six values back into the neighboring text controls `0x5bce`, `0x5bd0`, `0x5bd2`, `0x5bd4`, `0x5bd6`, and `0x5bd8`: the leading lane is formatted through one integer `%d`-style path, while the five trailing float lanes are formatted through one shared decimal formatter before all six strings are pushed through the generic type-`0x6f` dynamic-text control path. This is therefore the preview/formatter sibling of the economic slider dispatcher, not another mutator.","objdump + local disassembly + constructor correlation + state-field correlation + control-band correlation" 0x004cadf0,751,map_editor_economic_cost_slider_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + .data descriptor table inspection,4,"Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`.","objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection" +0x004cb1a0,22,map_editor_scenario_special_conditions_panel_clear_visible_row_band,map,thiscall,inferred,objdump + constructor correlation + local disassembly,3,"Tiny list-range clear helper beneath the map-editor special-conditions page. The helper resolves the page-owned list host at `[this+0x86]` and clears the visible row band `0xabe0..0xafc7` through `0x0053fe00`. Current grounded caller is the constructor `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0`, which binds this as the range callback on list control `0xa7fa`, so this is the visible-row reset sibling of the later per-row formatter rather than a generic list helper.","objdump + constructor correlation + local disassembly + control-range correlation" +0x004cb1c0,236,map_editor_scenario_special_conditions_panel_format_row_by_index,map,cdecl,inferred,objdump + constructor correlation + static-table inspection + local disassembly,4,"Per-row formatter callback for the map-editor special-conditions list control `0xa7fa`. The helper accepts one rule ordinal, builds one transient row payload through the shared shell dynamic-list path, reads the corresponding live rule dword from `[0x006cec78+0x4a7f + index*4]`, and republishes that value into the per-row toggle control band rooted at `0xabe0 + index`. The localized label/help side is explicit too: the helper walks the same nine-byte static rule table at `0x005f3ab0` used by `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0`, resolves each paired label/help id through `0x005193f0`, and emits the row text through the generic shell control path before the live enabled state is published. This makes it the actual row-format owner over the persisted 49-dword scenario-rule band rather than leaving that list on constructor-only evidence.","objdump + constructor correlation + static-table inspection + local disassembly + rule-band correlation" 0x004cb2b0,485,map_editor_scenario_special_conditions_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 49-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. The same constructor also reads one trailing dword at `[0x006cec78+0x4b43]`, so the live editor-owned scenario-rule band is now best bounded as `49` dwords plus one scalar rather than the smaller fixed matrix inferred in the checked `gmp/gms/gmx` files. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`.","objdump + RT3.lng strings + static-table inspection + UI callback inspection + fixed-runtime-band correlation" 0x004cb4a0,468,map_editor_scenario_metadata_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2`, writing the scenario description from the edit-control payload into `[0x006cec78+0x672e]`, the single-player and multiplayer briefing texts into `[+0x4f30]` and `[+0x5ae9]`, flipping the briefing selector at `0x621f50` between the single-player and multiplayer views, toggling the direct campaign-scenario byte `[+0x66de]` plus the paired metadata byte `[+0x66f3]`, and committing the three start-year fields `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]` after clamping each incoming value to `1829..2100`. The resource correlation is now explicit too: `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.`, so the direct toggle path at `0x4cb519` is now grounded as the editor-side campaign-designation bit rather than a generic metadata checkbox. Before returning it also normalizes the year trio so `minimum <= default <= maximum` and then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`.","objdump + RT3.lng strings + UI dispatch inspection + state-field correlation + editorDetail.win resource record" 0x004cb6f0,496,map_editor_available_chairman_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block.","objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation" @@ -900,7 +982,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0045e8c0,124,train_visual_service_row_object_strip_and_optionally_refresh_selected_entry,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small service helper over the fixed 32-entry row-object strip rooted at `[this+0x277]`. The function first walks all 32 slots and, for every live row object pointer, dispatches vtable slot `+0x10`. When the caller passes a valid row index instead of `-1`, it then resolves that selected row again, dispatches vtable slot `+0x0c`, and when the paired per-row flag byte in the neighboring strip is nonzero it also pushes `0,0,1.0f,1.0f` through `0x0052eab0` on that selected row object. Current grounded callers are the two train-side update branches at `0x0041c680` and `0x0041c69a`, which derive the selected index from byte `[cargo+0x20]`, so this is best read as the row-object service plus optional selected-entry refresh helper rather than a generic list walk.","objdump + local disassembly + caller inspection + train-visual correlation + row-object-strip correlation" 0x004614d0,40,runtime_object_vtable_wrapper_query_local_companion_float_relief_score_at_rounded_coords,map,thiscall,inferred,objdump + local disassembly + wrapper correlation,2,"Tiny virtual-style wrapper over `world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias` `0x0044afa0`. It rounds the current object's normalized secondary and primary coordinates through `0x00455810`, `0x00455800`, and `0x005a10d0`, then forwards the resulting cell pair plus world root `0x0062c120` into `0x0044afa0`. Current evidence grounds it only as the table-local wrapper over the heavier world-scalar query, not the owning subtype name.","objdump + local disassembly + wrapper correlation + world-scalar-query correlation" 0x00461500,39,runtime_object_query_flag_byte_0x42_with_class0_true_fallback_when_mode_gate_inactive,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query on the same virtual-family boundary as `0x004614d0`. The helper first checks shell mode gate `0x004338c0` on scenario root `0x006cec78`; when that gate is active it returns byte `[this+0x42]` directly. When the gate is inactive it returns literal `1` only for class-0 records with `[this+0x23e] == 0`, and otherwise falls back to the same byte `[this+0x42]`. Current evidence is strong enough only for that structural fallback rule, not for a tighter semantic name for the flag or owning subtype.","objdump + local disassembly + mode-gate correlation + field inspection" -0x00461650,120,map_load_geographic_label_database,map,cdecl,inferred,ghidra-headless,3,Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.,ghidra + rizin + llvm-objdump + strings +0x00461580,202,geographic_label_database_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + collection-correlation + load-order correlation,4,"Collection-wide tagged load owner for the geographic-label database rooted at `0x006ada80`. The helper opens chunk `0x5209`, refreshes collection-side metadata through `indexed_collection_refresh_header_and_live_id_band` `0x00518680`, opens chunk `0x520a`, then walks every live record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each resolved record through vtable slot `+0x40` with the caller-supplied bundle or stream context. It closes with chunk `0x520b` and returns the accumulated tagged-load byte count. Current grounded caller is the world-entry bringup branch at `0x00444812`, where it runs directly on `0x006ada80` beside neighboring tagged collection families, so this is the safest current read for the geographic-label tagged load owner.","objdump + caller inspection + local disassembly + collection-correlation + load-order correlation + geographic-label correlation" +0x00461650,120,geographic_label_database_serialize_records_into_tagged_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + collection-correlation + save-order correlation,4,"Collection-wide tagged save owner for the geographic-label database rooted at `0x006ada80`. The helper writes the collection bracket `0x5209/0x520a/0x520b` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, then walks every live record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each entry's save-side virtual slot `+0x44` with the caller bundle. Current grounded caller is the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, so this is the current safest read for the geographic-label tagged save owner.","objdump + caller inspection + local disassembly + collection-correlation + save-order correlation + geographic-label correlation" +0x00461f10,1552,locomotive_collection_stream_load_records_link_era_labels_and_refresh_runtime_availability,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tagged-import correlation,4,"Broader tagged import owner for the live locomotive collection rooted at `0x006ada84`, reached directly from constructor `0x00462520`. The helper runs two outer passes over the repeated tagged source opened through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stem `0x005ce0ec`, validates the imported field set against the built-in tag strings `0x005ce0e4..0x005ce07c`, and when the record layout passes materializes one parsed stack image before dispatching collection vtable slot `+0x04` to allocate or insert one live `0xad`-byte locomotive record. The parsed live record keeps its fixed scalar and string bands in-place, resolves one linked era record through the live era collection `0x0062ba88`, folds that era record's float lane `[era+0xfd]` into two imported scalar lanes, copies the matched era name at `[era+0x82]` into the temporary locomotive label band, and formats the two player-facing text rows through string ids `0x1b3` and `0x1b4` before copying those labels into `[loco+0x08]` and its paired display band. The live record also stores its own id into `[loco+0x4f]`, and when the current scenario or shell mode allows it the helper tails into `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00` after the import sweep completes. Current grounded caller is `locomotive_collection_construct_and_stream_load_records` `0x00462520`. Current package-save inspection still finds no mirrored early world-bundle serializer for `0x006ada84`; the neighboring package path persists only the named locomotive-availability mirror at `[world+0x66b6]`, so the safest current read remains a load-side content family rather than a bundle-saved runtime collection.","objdump + local disassembly + caller correlation + tagged-import correlation + era-link correlation + label-build correlation + runtime-refresh correlation + package-save-order correlation" +0x00462520,49,locomotive_collection_construct_and_stream_load_records,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the live locomotive collection rooted at `0x006ada84`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005ce068`, seeds the collection through `0x00518570` with literal tuple `(1, 0xad, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `locomotive_collection_stream_load_records_link_era_labels_and_refresh_runtime_availability` `0x00461f10`. Current grounded caller is the world-entry load branch at `0x00438d29`, which stores the finished object into global `0x006ada84`. Current package-save inspection still finds no early world-bundle serializer for this live locomotive root, so the strongest current boundary is a world-load content family whose player-facing availability state is mirrored separately through the named collection at `[world+0x66b6]` rather than a package-saved runtime collection.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation + package-save-order correlation" 0x00461c00,126,locomotive_collection_resolve_entry_by_primary_or_alias_stem,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared string resolver over the live locomotive collection at `0x006ada84`. The helper walks every live locomotive row, first compares the caller text against the primary stem at `[entry+0x34]`, then against the alias or secondary stem at `[entry+0x53]`, and returns the first matching live row pointer through the collection accessors `0x00518380/0x00518140`. Failure returns null. Current grounded caller is the cheat-code owner `0x00437d70`, where selector `4` resolves stems like the hidden locomotive cheat aliases before applying them to every train owned by the selected company through `0x004aefb0`. This is therefore the safest current read for the primary-or-alias locomotive stem resolver rather than a more specific dialog helper.","objdump + local disassembly + caller inspection + locomotive-stem correlation + cheat-branch correlation" 0x00461c80,30,locomotive_entry_query_linked_era_name_ptr,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small accessor over one live locomotive entry. The helper resolves linked era id `[loco+0x72]` through the era collection at `0x0062ba88` and, on success, returns the raw era-name pointer at `[era+0x45]`; missing era ids return null. Current grounded callers are the locomotives-availability and recipe-side editor families around `0x004cd641`, `0x004cdaf2`, `0x004cf16c`, `0x004cf1f2`, `0x004cf2ed`, `0x004cf3f0`, the world-entry rehydrate lane at `0x004478de`, and the smaller shell-side branch at `0x00438d5f`, so this is the safest current read for the linked-era name-pointer accessor rather than a display-only helper.","objdump + local disassembly + caller inspection + era-collection correlation + locomotive-editor correlation" 0x00461ca0,35,locomotive_entry_format_linked_era_name_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Formatting companion to `locomotive_entry_query_linked_era_name_ptr` `0x00461c80`. The helper resolves linked era id `[loco+0x72]` through the same era collection at `0x0062ba88` and, on success, forwards the era-name pointer `[era+0x45]` into `0x0051c920`; missing era ids return null. Current grounded callers are the train-upgrade news formatter `0x00409300` and the neighboring company-side upgrade branch at `0x00409903`, where it supplies the old and new locomotive-era display names embedded in localized news id `2897`.","objdump + local disassembly + caller inspection + era-name formatting correlation + train-upgrade-news correlation" @@ -918,8 +1003,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00474480,18,city_database_entry_collection_release_and_free,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,1,"Small destructor-side wrapper for the current city-database entry collection. The helper installs collection vtable `0x005ce4a8`, re-enters `0x00518600`, and then tails into `0x00518bd0`. Current grounded caller is the global teardown path at `0x004492c3`, which frees the collection rooted at `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + teardown correlation" 0x004744a0,101,city_database_entry_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + local disassembly + caller xrefs + collection-layout correlation,2,"Shared allocator and constructor beneath the city-database entry collection. The helper initializes one stack-local temporary entry through `0x00474110`, allocates a `0x250`-byte live record through `0x00518900`, resolves that record through `0x00518140`, then constructs it through `0x00474130` with the caller-supplied entry id plus three caller arguments, and finally tears down the temporary entry through `0x004743d0`. Current grounded caller is the collection load or clone lane at `0x004744ed`.","objdump + local disassembly + caller xrefs + collection-layout correlation + temp-entry correlation" 0x00474510,32,city_database_entry_collection_remove_entry_by_id_and_release,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the current city-database entry family. The function resolves the caller-supplied entry id through `0x00518140`, releases the resolved entry through `0x00474400`, and then removes the id from the collection through `0x00518a30`.","objdump + local disassembly + collection-layout correlation + removal-path correlation" -0x00474540,197,city_database_entry_collection_load_records_from_bundle_context,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-load correlation,2,"Underlying collection-owned load loop beneath `map_load_city_database` `0x00474610`. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller-supplied bundle, binds the selected path context through `0x00518680`, iterates every live record in the current collection, seeds a stack-local temporary entry through `0x00474110`, dispatches each record's vtable slot `+0x40` with the current bundle context, accumulates the returned byte count, tears the temporary entry down through `0x004743d0`, and finally closes tag `0x61ab`. Current grounded caller is the map-load branch at `0x00444834`, so this is now the safest current read for the collection-owned city-database record load loop.","objdump + caller xrefs + local disassembly + collection-load correlation + bundle-tag correlation" -0x00474610,120,city_database_entry_collection_reload_records_from_bound_bundle_context,map,cdecl,inferred,objdump + local disassembly + collection-load correlation,2,"Bundle-side reload owner for the live city-database entry collection. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller bundle through `0x00531340`, binds the selected path or payload context into the collection through `0x00517d90`, walks every live record through `0x00517cf0/0x00518380/0x00518140`, and dispatches each record through vtable slot `+0x44` with the same bundle context before finally closing tag `0x61ab`. This is the strongest current read for the direct bundle-reload companion to the collection-owned load loop `0x00474540`, rather than a generic map-load stub.","objdump + local disassembly + collection-load correlation + bundle-tag correlation" +0x00474540,197,city_database_entry_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-load correlation,2,"Collection-owned tagged load owner for the live city-database entry collection. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller-supplied bundle, binds the selected path context through `0x00518680`, iterates every live record in the current collection, seeds a stack-local temporary entry through `0x00474110`, dispatches each record's vtable slot `+0x40` with the current bundle context, accumulates the returned byte count, tears the temporary entry down through `0x004743d0`, and finally closes tag `0x61ab`. Current grounded caller is the map-load branch at `0x00444834`, so this is now the safest current read for the collection-owned city-database tagged refresh loop.","objdump + caller xrefs + local disassembly + collection-load correlation + bundle-tag correlation" +0x00474610,120,city_database_entry_collection_serialize_records_into_tagged_bundle,map,cdecl,inferred,objdump + local disassembly + collection-load correlation,2,"Collection-wide tagged save owner for the live city-database entry collection. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller bundle through `0x00531340`, binds the selected path or payload context into the collection through `0x00517d90`, walks every live record through `0x00517cf0/0x00518380/0x00518140`, and dispatches each record through vtable slot `+0x44` with the same bundle context before finally closing tag `0x61ab`. This is the strongest current read for the direct tagged save companion to the collection-owned load loop `0x00474540`, rather than a generic map-load stub.","objdump + local disassembly + collection-load correlation + bundle-tag correlation" 0x00474690,107,effect_emitter_table_publish_mode1_ratio_labels,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Walks the global emitter-definition table rooted at `0x006cea60` and, for each live entry whose mode dword `[entry+0x30]` equals `1`, derives one rounded ratio from float fields `[entry+0x00] / [entry+0x08]`, combines that with keyed field `[entry+0x34] | 0x10000` through `0x0053d810`, and forwards the resulting token into owner `0x006d4030` through `0x00556c50`. Current evidence grounds the iteration and derived ratio shape, but not the exact user-facing caption of the published label lane.","objdump + local disassembly + literal inspection + emitter-table correlation" 0x00474700,133,effect_table_load_particles_dat_into_global_root_and_register_particles_texture,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Reloads the global particle-data table from banked file `particles.dat`. The helper frees any previous root at `0x006cea5c`, checks for the named banked record through `0x0053c930`, resolves its keyed handle and payload length through `0x0053b5c0/0x0053c9c0`, allocates a new payload slab, reads that payload through `0x0053b7c0`, stores the resulting root at `0x006cea5c`, and finally registers literal `ParticlesTexture` through `0x00556370` on owner `0x006d4030`. This is the clearest current owner for the `particles.dat` load path rather than a generic banked-record fetch helper.","objdump + local disassembly + literal inspection + banked-record correlation + particle-table correlation" 0x00474790,133,effect_table_load_emitters_dat_into_global_root,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Reloads the global emitter-definition table from banked file `emitters.dat`. The helper frees any previous root at `0x006cea60`, checks for the named banked record through `0x0053c930`, resolves its keyed handle and payload length through `0x0053b5c0/0x0053c9c0`, allocates a new payload slab, reads that payload through `0x0053b7c0`, and stores the resulting root at `0x006cea60`. This is the clearest current owner for the `emitters.dat` load path rather than a generic banked-record fetch wrapper.","objdump + local disassembly + literal inspection + banked-record correlation + emitter-table correlation" @@ -1003,7 +1088,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0047ba60,17,shell_overlay_reset_global_pointer_marker_slots,shell,cdecl,inferred,objdump + caller correlation + global-state correlation,2,"Clears the ten-entry global pointer-marker slot table rooted at `0x006ceba4`. The helper simply zeroes ten dwords and returns. Current grounded caller is the world-side setup or rebuild branch at `0x00449252`, so this is the clean global reset sibling for the later pointer-marker slot constructors rather than a generic scratch clear.","objdump + caller correlation + global-state correlation + pointer-marker slot-table correlation" 0x0047ba80,268,shell_overlay_rebuild_global_pointer_marker_slot,shell,thiscall,inferred,objdump + caller correlation + local disassembly + literal correlation,2,"Rebuilds one indexed global pointer-marker slot in the ten-entry table rooted at `0x006ceba4`. The caller supplies the slot index in `ECX`, one variant selector in `EDX`, two world-space anchor coordinates on the stack, and one scalar lane that is rounded through `0x005a10d0`. If the indexed slot already owns a live marker object, the helper releases it through `0x0045b160`, `0x0045b040`, and `0x0053b080`. It then allocates one `0x26e`-byte placed-structure-specialization-like object through `0x0053b070 -> 0x0045b680`, seeds it through `0x0045b9b0` from one of the three literal roots `pointer`, `pointer2`, or `pointer3`, publishes the caller world anchor through `0x004556f0`, applies scalar `0.8f` through `0x00455720`, and clears bit `0x20` in the derived state byte `[slot+0x20]`. Current grounded callers are the clustered world-side branches at `0x0051677b`, `0x00516797`, `0x005167df`, and `0x005167fe`, which makes this the indexed global pointer-marker slot builder rather than a general placed-structure constructor.","objdump + caller correlation + local disassembly + literal correlation + slot-table correlation + specialization-constructor correlation" 0x0047bb90,60,shell_overlay_release_global_pointer_marker_slots,shell,cdecl,inferred,objdump + caller correlation + global-state correlation,2,"Releases the ten-entry global pointer-marker slot table rooted at `0x006ceba4`. The helper walks each slot, and for any live marker object re-enters `0x0045b160`, `0x0045b040`, and `0x0053b080` before clearing the slot pointer. Current grounded callers are the world-side teardown branches at `0x00449292` and `0x005166d8`, so this is the matching global release loop for `shell_overlay_rebuild_global_pointer_marker_slot` `0x0047ba80`.","objdump + caller correlation + global-state correlation + slot-release correlation" -0x0047bbf0,95,runtime_profile_reset_default_setup_and_campaign_seed_fields,shell,thiscall,inferred,objdump + caller correlation + field correlation,2,"Resets the staged `0x108`-byte runtime-profile record to its default setup or campaign seed state. The helper clears the whole record, seeds compact option byte `[this+0x7d] = 1`, selected-year lane `[this+0x77] = 0x726`, live-row threshold `[this+0x79] = 1`, scroll lane `[this+0x7b] = 0`, clears bytes `[this+0x82]`, `[this+0xc4]`, `[this+0xc5]`, and `[this+0x01]`, writes one bounded random-like dword from `0x00518d70(0,0x7fff)` into `[this+0x83]`, and forces bytes `[this+0x87] = 1` plus `[this+0x97] = 1`. Current grounded callers are the setup constructor side at `0x005040aa` and the late world-entry branch at `0x004440f1`, so this is the clean default-profile reset helper rather than a setup-only local clear.","objdump + caller correlation + field correlation + staged-profile correlation" +0x0047bbf0,95,runtime_profile_reset_default_setup_and_campaign_seed_fields,shell,thiscall,inferred,objdump + caller correlation + field correlation,2,"Resets the staged `0x108`-byte runtime-profile record to its default setup or campaign seed state. The helper clears the whole record, seeds compact option byte `[this+0x7d] = 1`, selected-year lane `[this+0x77] = 0x726`, live-row threshold `[this+0x79] = 1`, scroll lane `[this+0x7b] = 0`, clears bytes `[this+0x82]`, `[this+0xc4]`, `[this+0xc5]`, and `[this+0x01]`, writes one bounded random-like dword from `0x00518d70(0,0x7fff)` into `[this+0x83]`, seeds the first setup row-marker byte `[this+0x87] = 1`, and forces the file-backed launch or rehydrate latch `[this+0x97] = 1`. Current grounded callers are the setup constructor side at `0x005040aa` and the late world-entry branch at `0x004440f1`, so this is the clean default-profile reset helper rather than a setup-only local clear.","objdump + caller correlation + field correlation + staged-profile correlation" 0x0047bc50,37,runtime_profile_query_first_campaign_selector_byte_below_2,shell,cdecl,inferred,objdump + caller correlation + field correlation,2,"Scans the staged campaign selector band `[0x006cec7c+0xc6..+0xd5]` and returns the first index whose byte value is below `2`, or `16` if none match. Current grounded caller is the campaign-window side branch at `0x004b908e`, which keeps this on the staged campaign selector or unlock side of the profile rather than the earlier setup payload fields.","objdump + caller correlation + field correlation + campaign-selector-band correlation" 0x0047bea0,368,start_new_company_dialog_rebuild_primary_funding_band_and_publish_card,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Rebuilds the primary funding-band globals for the `Start New Company` dialog and republishes the matching summary controls. The helper resolves the selected chairman profile through `0x004348c0`, queries one profile-side scale factor through `profile_entry_query_start_new_company_funding_scale_factor` `0x00476950`, multiplies that factor by current funding lane `0x006cec14`, chooses a step-size bucket, derives a bounded snapped band into globals `0x006cebcc`, `0x006cebd0`, and count `0x005f2c50`, and then formats the resulting range summary into controls `0x73` and `0x66` on window root `0x006cec18` through localized id `0x7150`. Current grounded callers are the dialog open path at `0x0047d051/0x0047d062/0x0047d070`, the snap-and-republish helper `0x0047c220`, and the child-control callback gate `0x0047c360`, so this is the clean primary funding-band builder beneath the dialog rather than a generic slider formatter.","objdump + local disassembly + caller correlation + field correlation + funding-band correlation" 0x0047c070,273,start_new_company_dialog_rebuild_secondary_funding_band_and_publish_card,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Rebuilds the secondary funding-band globals for the `Start New Company` dialog and republishes the matching summary controls. The helper resolves the selected chairman profile through `0x004348c0(1)`, queries the threshold-adjusted total-plus-cash lane through `profile_entry_query_threshold_adjusted_holding_total_plus_cash_metric` `0x00476c20`, chooses a bounded step-size bucket, writes the resulting snapped band into globals `0x006cebd4`, `0x006cec0c`, and count `0x005f2c4c`, and then formats the summary into controls `0x73` and optionally `0x66` through localized id `0x714f` on window root `0x006cec18`. Current grounded caller is the start-company open path at `0x0047d047`, so this is the secondary funding-band sibling beside `0x0047bea0`.","objdump + local disassembly + caller correlation + field correlation + funding-band correlation" @@ -1027,6 +1112,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0047fd50,60,placed_structure_is_station_or_transit_site_class,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean class allowlist over one linked placed-structure record. The helper resolves the linked peer id at `[this+0x04]` through the live placed-structure collection `0x0062b26c`, re-enters that peer's candidate vtable `+0x80`, reads candidate class byte `[candidate+0x8c]`, and returns true only for class values `0`, `1`, or `2`; values `3`, `4`, and anything above `4` fail. Current grounded callers include the linked-transit company cache family at `0x00408280`, `0x00408f70`, and `0x004093d0`, the `cargo id 0` bypass branch inside the placed-structure sweep at `0x00452e60`, the nearby-site bucket builder `0x0047fdb0`, the linked-transit reachability gate `0x004801a0`, and the linked-site display-name or route-anchor refresh at `0x00480bb0`, so this is the safest current read for the narrower station-or-transit class gate rather than a route-reachability helper.","objdump + caller xrefs + callsite inspection + candidate-class correlation" 0x0047f320,1511,placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Broader linked-site runtime rebuild owner over the sampled local-service cell list rooted at `[this+0x34]/[this+0x38]`. The helper resolves the effective comparison mode from the linked candidate class byte `[candidate+0x8c]` unless the caller overrides it, derives one radius threshold from current world coordinates `[this+0x4a8/+0x4ac]`, frees the prior sampled-cell buffer at `[this+0x34]`, always clears the route-link scratch pair `[this+0x462/+0x466]`, and then scans one bounded world-grid rectangle through `[0x0062c120+0x2129]` with per-cell distance measured by `math_measure_float_xy_pair_distance` `0x0051db80`. For accepted cells it emits one temporary twelve-byte `(grid x, grid y, sampled score)` row through `0x0042b190`, `0x0042c530`, and `0x0042c580`; when caller arg0 is zero it then compacts one representative subset of those temporary rows into a newly allocated persistent list at `[this+0x34]` and stores the surviving row count in `[this+0x38]`, while nonzero arg0 callers use the same helper as a clear-and-scan companion without the final materialization step. Current grounded callers are the linked-site refresh and teardown strip at `0x00480542`, `0x004805c2`, `0x00480727`, and `0x004807e2`, so this is the safest current read for the local sampled-cell list rebuild plus route-link scratch reset rather than a plain route-entry-list clear helper.","objdump + caller xrefs + callsite inspection + local-service sampled-cell correlation + linked-site-runtime correlation" 0x0047e690,784,placed_structure_query_candidate_directional_route_overlay_summary,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds the heavier directional route-summary channel used by the station-detail candidate-service overlay when the active candidate carries a nonzero route-style byte at `[candidate+0x46]`. The helper converts one caller-supplied distance or bucket limit into a capped step count up to `0x28`, resolves the requested candidate's grouped routing class from `0x0062ba8c+0x9a`, then walks the current placed structure's linked route list at `[this+0x466]` and follows each route-linked placed structure through the live instance collections at `0x0062b26c` and the route-link collection `0x006ada90`. For matching class entries it re-enters `0x004676a0` to measure one directional route value against the peer placed-structure argument, keeps the strongest bounded values in a sorted local lane, and finally accumulates those kept route values into the caller-owned out-pointers. Current grounded overlay callers at `0x0043f89a` and `0x0043f8ee` invoke it in both directions between the preview station and each scanned placed structure before `world_render_station_candidate_service_map_overlay` turns those two returned channels into the `Coming To` and `Going From` legend rows.","objdump + caller xrefs + callsite inspection + overlay-caller correlation + legend-correlation + route-link-collection correlation" +0x00477740,42,profile_collection_construct,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the live profile or chairman collection later rooted at `0x006ceb9c`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0xcab, initial_slots=4, growth=2, id_base=1)`, installs vtable `0x005ce828`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x006ceb9c`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" +0x00477770,11,profile_collection_release_collection_storage,simulation,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `profile_collection_construct` `0x00477740`. The helper reinstalls vtable `0x005ce828` and tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation" +0x00477780,92,profile_collection_refresh_tagged_header_counts_from_bundle,map,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load sibling for the live profile collection `0x006ceb9c`. The helper reads the three tagged header dwords `0x5209/0x520a/0x520b` through repeated `0x00531360` calls around the collection refresh `0x00518680`, accumulating the returned byte counts. Current grounded caller is the world-entry bring-up strip, which re-enters this helper to refresh the profile collection's tagged header state during runtime load.","objdump + world-load correlation + local disassembly + tag correlation + collection-refresh correlation" +0x004777e0,92,profile_collection_serialize_tagged_header_counts_into_bundle,map,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save sibling for the live profile collection `0x006ceb9c`. The helper opens the same three tagged header dwords `0x5209/0x520a/0x520b` through repeated `0x00531340` calls around the collection serializer `0x00517d90`, accumulating the returned byte counts before closing the final tag. Current grounded caller is the package-save strip, which mirrors the profile collection's tagged header state back into the runtime bundle during world save.","objdump + package-save correlation + local disassembly + tag correlation + collection-save correlation" +0x00477820,59,profile_collection_count_active_chairman_records,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the currently active chairman-profile records in the live profile collection `0x006ceb9c`. The helper walks every live record through `0x00517cf0/0x00518380/0x00518140`, tests dword `[profile+0x04]`, and increments the result only when that field is nonzero. Current grounded callers include the re-entrant chairman refresh owner `0x00433850` and neighboring chairman-company branches, so this is the safest current read for the active-chairman count helper rather than a generic slot-count query.","objdump + local disassembly + caller correlation + active-chairman correlation" +0x00477860,92,profile_collection_get_nth_active_chairman_record,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Resolves the caller-selected nth active chairman-profile record in the live profile collection `0x006ceb9c`. The helper walks every live record through `0x00517cf0/0x00518380/0x00518140`, tests dword `[profile+0x04]`, decrements the caller-supplied ordinal only on active rows, and returns the first record reached when that active-only ordinal hits zero. Current grounded callers include `scenario_state_refresh_active_chairman_profiles_with_reentrancy_guard` `0x00433850`, where it feeds the per-record refresh loop over the active chairman family. This is the safest current read for the nth-active-chairman resolver rather than a plain nth-live-entry wrapper.","objdump + local disassembly + caller correlation + active-chairman correlation" +0x004778c0,107,profile_collection_get_nth_active_chairman_id,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Sibling helper in the same active-chairman strip over the live profile collection `0x006ceb9c`. The function walks every live record through `0x00517cf0/0x00518380`, treats only rows whose resolved record has nonzero dword `[profile+0x04]` as active, decrements the caller-supplied ordinal on those active rows, and returns the live entry id when that active-row ordinal hits zero, or `0` when the walk exhausts first. Current local evidence keeps this bounded as the id-returning companion beside `profile_collection_count_active_chairman_records` `0x00477820` and `profile_collection_get_nth_active_chairman_record` `0x00477860`.","objdump + local disassembly + caller correlation + active-chairman correlation" 0x0047e9a0,315,placed_structure_query_candidate_route_or_local_service_comparison_score,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,2,"Bridges the heavier directional-route overlay summary path and the simpler local-service comparison lane. When the requested candidate carries a grouped routing class at `0x0062ba8c+0x9a`, the helper forwards the full query to `placed_structure_query_candidate_directional_route_overlay_summary` `0x0047e690` with the final flag forced to `0`. Otherwise it resolves the current placed structure's linked instance through `0x00455f60`, samples the current site's local float table at `[cell+0x103]` for the requested candidate lane, optionally re-enters `0x0042c080` on each local sample record at `[this+0x34/+0x38]`, and writes the bounded result back into the same comparison-cache bands rooted at `[this+0x1e6]`, `[this+0x2ba]`, and `[this+0x38e]`. Current grounded caller is the candidate-side score branch at `0x0041bbe2`, so this is the safest current read for the route-or-local comparison wrapper above `0x0047e690` rather than another route-list helper.","objdump + caller xrefs + local disassembly + callsite inspection + cache-band correlation" 0x0047d440,845,world_conditionally_seed_named_starting_railroad_companies,map,cdecl,inferred,objdump + caller xrefs + global-state inspection,4,"Conditional company-side setup helper adjacent to the `Setting up Players and Companies...` lane. Current grounded callers are the neighboring bring-up flow after world_seed_default_chairman_profile_slots at `0x004377a0` and a second setup-side branch around `0x00438300`, both under the same sandbox or non-editor shell-state conditions: it runs only when the Multiplayer preview dataset owner at `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is clear. The helper first realigns the selected company from the chosen chairman profile when the current summary pair points at a missing company, then iterates exactly three fixed localized railroad-name ids through `0x00428420`: `0x23f` `Missouri Pacific`, `0x240` `New York Central`, and `0x241` `Grand Trunk Railroad` from `RT3.lng` ids `575..577`. That makes the branch look like a seeded trio of named starting railroad companies rather than a generic company refresh. The first seeded company is tied to the selected chairman-profile summary from `0x006cec78`, tuned from that selected chairman's per-profile fields `[profile+0x154]` and `[profile+0x158]`, and then written back as the selected company id through `0x00433790`. The second company is narrower now too: it only binds when `profile_collection_count_active_chairman_records` at `0x00477820` reports at least two live chairman records, and it then links through `profile_collection_get_nth_active_chairman_record` at `0x00477860` with ordinal `1`, so the second railroad is specifically the second active chairman-owned company rather than an arbitrary extra bind. The third railroad currently gets no matching chairman-link branch in the grounded code and therefore remains an unchaired named company in the live roster. All three records are constructed or refreshed from the live company collection at `0x0062be10` through `0x00428420`, while chairman-to-company ownership links are applied through `0x00427c70` and neighboring writes to `[profile+0x1dd]`. The tail is tighter now too: once at least three startup companies have been considered, the branch at `0x0047d6de` re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`.","objdump + caller xrefs + global-state inspection + state-accessor correlation + RT3.lng strings + company-constructor inspection + profile-helper inspection + runtime-effect trigger-kind correlation" 0x0047efe0,28,placed_structure_query_linked_company_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Returns the owning company id for one placed structure when a linked placed-instance record is present. The helper resolves `[this+0x04]` through the live placed-instance collection at `0x0062b26c` and then returns the company-like field at `[instance+0x276]`; when no linked instance is present it falls back to `0`. Current grounded callers include the station candidate-service overlay at `0x0043fff7`, where the returned company id is compared against the active company selector before the overlay chooses whether a scanned site should carry the `Already Connected by Another Company` note.","objdump + caller xrefs + callsite inspection + overlay-owner correlation" @@ -1059,6 +1151,31 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004874f0,70,shell_close_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Closes and frees the dedicated TigerTank shell viewer rooted at 0x006cfc8c. It detaches the viewer if currently selected in the shell owner at 0x0062be68 destroys its internal resources through 0x00530680 frees the object and clears the global viewer slot.,ghidra + rizin + llvm-objdump + strings 0x00489830,496,scenario_text_export_report_language_file,scenario,cdecl,inferred,ghidra-headless,3,Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled.,ghidra + rizin + llvm-objdump + strings 0x00489a20,1085,scenario_text_export_batch_process_maps,scenario,cdecl,inferred,ghidra-headless,4,Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog.,ghidra + rizin + llvm-objdump + strings +0x004a7030,113,train_serialize_tagged_route_list_payload_into_bundle,simulation,thiscall,inferred,objdump + local disassembly + train-save correlation,3,"Per-train save-side tagged payload owner beneath the live train collection package-save strip. The helper writes opening tag `0x5dc1`, writes one `(count*0x33)` byte route-list payload from buffer `[this+0x00]` using count `[this+0x04]`, and then writes closing tag `0x5dc2`. Current grounded caller is `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, so this is the safest current read for the live train route-list serializer rather than a broader collection walk.","objdump + local disassembly + train-save correlation + route-list-buffer correlation" +0x004a8310,80,train_forward_rgb_triplet_to_linked_owner_chain,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared train-side RGB publish helper. The helper resolves the linked owner chain from train field `[this+0x41]` through collection `0x0062ba84`, then repeatedly dispatches the caller-supplied RGB triplet through each resolved owner's vtable slot `+0x58` following the linked sibling chain at `[owner+0x352]` until the chain terminates at `-1`. Current grounded callers are the collection-wide train color passes `0x004b28e0` and `0x004b29e0`, so this is the safest current read for the train-linked RGB forwarder rather than a train metric query.","objdump + local disassembly + caller correlation + linked-owner-chain correlation" +0x004a7350,1,train_runtime_service_noop_placeholder,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Single-instruction `ret` placeholder in the train runtime strip. Current grounded caller is the shell-gated collection sweep `0x004b2a90`, which iterates all live train entries and dispatches here only when shell-state latch `[0x006cec74+0x1cf]` is nonzero. This is therefore the safest current read for a no-op train-runtime service placeholder rather than a hidden train mutation owner.","objdump + local disassembly + caller correlation + collection-sweep correlation" +0x004a84b0,195,train_refresh_tagged_route_list_payload_from_bundle,simulation,thiscall,inferred,objdump + local disassembly + train-load correlation,3,"Per-train load-side tagged payload owner beneath the live train collection bundle refresh. The helper reads opening tag `0x5dc1`, allocates or fills the `0x33`-stride route-list payload buffer at `[this+0x00]` using count `[this+0x04]`, clears runtime dwords `[this+0x1c6]` and `[this+0x0c8]`, conditionally re-enters `0x004a8220(1,1)` when byte `[this+0x0f4]` is set, and then reads closing tag `0x5dc2`. Current grounded caller is `train_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x004b2700`, so this is the safest current read for the live train route-list payload refresh rather than a route-builder owner.","objdump + local disassembly + train-load correlation + route-list-buffer correlation + runtime-clear correlation" +0x004b2340,42,train_collection_construct,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the live train collection later rooted at `0x006cfcbc`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0x1d5, initial_slots=0x32, growth=0x14, id_base=1)`, installs vtable `0x005d00c8`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x006cfcbc`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction" +0x004b2370,55,train_collection_release_live_entries,simulation,thiscall,inferred,objdump + local disassembly + companion correlation,2,"Release-side live-entry sweep beneath the train collection family. The helper repeatedly resolves the first live entry id through `0x00517cf0/0x00518380`, dispatches each entry through collection vtable slot `+0x08`, and then tails into `0x00518600` when no live entries remain. Current grounded direct caller is the top-level release wrapper `0x004b23b0`.","objdump + local disassembly + companion correlation + live-entry-release sweep" +0x004b23b0,18,train_collection_release_entries_and_collection_storage,simulation,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `train_collection_construct` `0x004b2340`. The helper reinstalls vtable `0x005d00c8`, re-enters `train_collection_release_live_entries` `0x004b2370`, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation" +0x004b23d0,83,train_collection_allocate_and_construct_entry_from_stack_seed_and_owner_id,simulation,thiscall,inferred,objdump + local disassembly + constructor-chain inspection,3,"Shared train-collection allocator wrapper immediately above the broader train family. The helper first seeds one stack-local temporary through `0x004a7400`, allocates a fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then forwards the new id plus one caller-supplied owner or company id into `0x004a7410` to initialize the live train record before clearing the stack temporary through `0x004a6e50`. Current evidence is strong enough to ground the allocation and constructor chain, but not yet the higher user-facing meaning of the caller-supplied seed payload.","objdump + local disassembly + constructor-chain inspection + collection-allocation correlation" +0x004b2700,143,train_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load sibling for the live train collection `0x006cfcbc`. The helper reads tagged sections `0x5209/0x520a/0x520b` through repeated `0x00531360` calls, refreshes the indexed-collection header through `0x00518680`, and then walks every live train entry, dispatching each one through `0x004a84b0` with the active bundle handle before closing the final tag. Current grounded caller is the world-entry bring-up family, where this helper refreshes the live train records from the tagged bundle after collection construction.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation" +0x004b27a0,118,train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle,simulation,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save owner for the live train collection `0x006cfcbc`. The helper opens tagged sections `0x5209/0x520a/0x520b` through repeated `0x00531340` calls, serializes the indexed-collection header through `0x00517d90`, and then walks every live train entry, dispatching each record through `0x004a7030` with the active bundle handle before closing the final tag. Current grounded caller is the package-save path that persists the live runtime collections beside the other world roots.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation" +0x004b2820,62,train_collection_remove_nonnegative_route_list_rows_matching_peer_site_id,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide cleanup pass over the live train collection. The helper walks every live train entry and re-enters `0x004af610` with one caller-supplied peer-site id. That per-train worker removes route-list rows whose sign byte `[row+0x28]` is nonnegative and whose peer-site `u16` at `[row+0x29]` matches the requested id, then refreshes the train's runtime state when its route list becomes empty. Current grounded caller is the linked-site refresh strip at `0x004805d4`, so this is the safest current read for the collection-wide train route-list cleanup by peer-site id rather than a generic route reset.","objdump + local disassembly + caller correlation + per-train-worker correlation" +0x004b2860,62,train_collection_remove_negative_route_list_rows_matching_dword_key,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide companion cleanup pass over the live train collection. The helper walks every live train entry and re-enters `0x004af760` with one caller-supplied dword key. That per-train worker removes route-list rows whose sign byte `[row+0x28]` is negative and whose trailing dword `[row+0x2b]` matches the requested key, then refreshes the train's runtime state when its route list becomes empty. Current grounded caller is the route-entry mutation strip at `0x00490f5b`, so this is the safest current read for the collection-wide train route-list cleanup by alternate negative-entry key rather than a site-id pass.","objdump + local disassembly + caller correlation + per-train-worker correlation" +0x004b28a0,56,train_collection_clear_runtime_dword_0x1a3_for_all_live_entries,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Collection-wide clear pass over train runtime dword `[train+0x1a3]`. The helper walks every live train entry and re-enters the tiny per-train store `0x004a7020`, which zeroes that dword. Current grounded callers include the route-mode branch at `0x0048b859` and neighboring route-style refresh strips, so this is the safest current read for the all-trains clear of the unresolved runtime field at `0x1a3` rather than a broader route rebuild.","objdump + local disassembly + caller correlation + per-train-clear correlation" +0x004b28e0,243,train_collection_publish_metric_derived_rgb_triplets_to_linked_owner_chain,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide train-side color or presentation refresh owner. The helper walks every live train entry, queries one per-train scalar through `0x004a9630`, converts that scalar into two bounded float lanes around the constants at `0x005c8770` and `0x005c8628`, rounds the resulting values through `0x005a10d0`, fixes the third channel at `0x33`, and forwards the final RGB triplet through `0x004a8310` into the linked owner chain rooted from `[train+0x41]`. Current grounded caller is the broader runtime branch at `0x004f4a75`, so this is the safest current read for the collection-wide train metric-derived RGB publish pass rather than a route-list cleanup helper.","objdump + local disassembly + caller correlation + per-train-scalar correlation + rgb-publish correlation" +0x004b29e0,108,train_collection_publish_boolean_match_color_triplets_by_train_field_0x51,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide train-side color publish companion over train field `[train+0x51]`. The helper walks every live train entry, compares that field against one caller-supplied dword, converts the resulting boolean `0/1` through `0x0051dfc0` into a packed preview color, splits the packed result into RGB bytes, and forwards the final triplet through `0x004a8310` into the linked owner chain. Current grounded caller is the broader runtime branch at `0x004f4a99`, so this is the safest current read for the all-trains boolean-match color publish pass rather than a route-list cleanup or world-load owner.","objdump + local disassembly + caller correlation + field-match correlation + rgb-publish correlation" +0x004b2a50,62,train_collection_publish_zero_rgb_triplets_to_linked_owner_chain,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Collection-wide train-side clear companion over the same linked owner chain. The helper walks every live train entry and forwards the fixed RGB triplet `(0,0,0)` through `0x004a8310`. Current grounded caller context is the adjacent train runtime strip, so this is the safest current read for the all-trains RGB clear pass rather than a route-list helper.","objdump + local disassembly + caller correlation + rgb-publish correlation" +0x004b2a90,72,train_collection_run_shell_gated_noop_refresh_placeholder,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Shell-gated collection-wide train refresh placeholder. The helper only runs when shell-state latch `[0x006cec74+0x1cf]` is nonzero, then walks every live train entry and dispatches the per-train placeholder `0x004a7350`, which currently returns immediately. Current grounded caller is the zero-depth optional collection-refresh dispatcher `0x00433b80`, so this is the safest current read for the train-side shell-gated no-op refresh pass rather than a hidden runtime mutation owner.","objdump + local disassembly + caller correlation + shell-gate correlation + zero-depth-dispatch correlation" +0x004b2ae0,76,train_collection_service_flagged_runtime_entries_via_0x4a8220,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide flagged-train runtime service pass. The helper walks every live train entry and, only when byte `[train+0x0f4]` is nonzero, re-enters `0x004a8220(1,1)` on that train. Current grounded caller is the zero-depth optional collection-refresh dispatcher `0x00433b80`, so this is the safest current read for the all-trains flagged runtime service pass rather than another load/save helper.","objdump + local disassembly + caller correlation + flagged-train correlation + zero-depth-dispatch correlation" +0x004b2b30,38,train_route_list_reset_descriptor_and_trailing_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + field-layout correlation,2,"Resets one local train route-list descriptor or adjunct block in place. The helper clears the two leading dwords, sets dword `+0x08` to `-1`, clears byte `+0x0c` and dword `+0x0d`, then clears the trailing five dwords rooted at `+0x11`. This is the safest current read for the in-place route-list descriptor reset helper rather than a train-record constructor.","objdump + local disassembly + field-layout correlation" +0x004b2b60,12,train_route_list_get_row_ptr_by_index,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Returns one `0x33`-stride route-list row pointer by index from the train route-list buffer rooted at `[this+0x00]`. Current grounded callers include the cleanup helpers `0x004af610/0x004af760` and several shell-side adjunct families, so this is the narrow indexed route-row accessor rather than a train collection helper.","objdump + local disassembly + caller correlation + route-list-buffer correlation" +0x004b2b70,2,train_route_adjunct_identity_passthrough,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Single-instruction identity helper that returns the caller train pointer unchanged. Current grounded callers are the selector-`0x42` multiplayer train-adjunct branch and the shell overlay owner that already resolved a live train collection entry before re-entering this helper, so this is best read as a structural train-adjunct passthrough placeholder.","objdump + local disassembly + caller correlation" +0x004b2b80,29,train_route_list_count_rows_with_nonnegative_sign_byte,simulation,thiscall,inferred,objdump + local disassembly + route-list-row correlation,2,"Counts how many `0x33`-stride route-list rows carry a nonnegative sign byte at offset `+0x28`. The helper walks the live route-list buffer and increments the result only when that byte is not negative. This is the safest current read for the positive-sign row counter beside the route-row accessors.","objdump + local disassembly + route-list-row correlation" +0x004b2ba0,40,train_route_list_reset_descriptor_and_trailing_scalar_band_alt,simulation,thiscall,inferred,objdump + local disassembly + field-layout correlation,1,"Register-allocation variant of `train_route_list_reset_descriptor_and_trailing_scalar_band` `0x004b2b30`. The helper performs the same in-place reset over the leading descriptor band and trailing five-dword scalar band. This is the safest current read for the duplicate reset sibling rather than a separate train-record owner.","objdump + local disassembly + field-layout correlation + duplicate-reset correlation" +0x004b2bd0,18,train_route_list_get_current_row_ptr_or_null,simulation,thiscall,inferred,objdump + local disassembly + route-list-row correlation,2,"Returns the current `0x33`-stride route-list row pointer selected by descriptor dword `+0x08`, or null when that selector is negative. This is the safest current read for the current-row accessor beside the route-list helper strip.","objdump + local disassembly + route-list-row correlation" +0x004b2bf0,24,train_route_list_get_current_or_last_row_ptr_or_null,simulation,thiscall,inferred,objdump + local disassembly + route-list-row correlation,2,"Returns one `0x33`-stride route-list row pointer from the same helper descriptor: a negative selector yields null, selector `0` maps to the last live row, and any other positive selector maps to the immediately preceding row. This is the safest current read for the current-or-last route-row accessor beside `0x004b2bd0`.","objdump + local disassembly + route-list-row correlation" 0x004bfb30,956,shell_format_company_financial_summary_card,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Reusable shell company financial-summary formatter shared by `CompanyDetail.win` and the company-list row lane. The helper resolves the linked chairman and current selected profile through `0x006cec78` and `0x006ceb9c`, highlights the card when the company belongs to the selected chairman, formats the visible company header text, and then renders a compact three-row finance block under localized ids `633` `Cash:`, `607` `Revenue:`, and `925` `Profits:`. The grounded metric mapping is now tighter too: `Cash:` comes from `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with slot `0x0d` and stat-family selector `0x2329`, `Revenue:` comes from the same reader with slot `0x2c`, and `Profits:` comes from slot `0x2b`; the revenue and profit rows also switch color when the readback is negative. Grounded callers are `shell_company_detail_render_company_summary_card` at `0x004c1ab0` and `shell_company_list_format_company_or_start_row` at `0x004c6b40`.","objdump + RT3.lng strings + caller inspection + shared shell formatter correlation + compact-metric-row correlation" 0x004c5540,347,shell_company_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `CompanyDetail.win` panel later published at `0x006cfe4c`. The constructor installs vtable `0x005d0858`, binds `CompanyDetail.imb` and `CompanyDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the primary action controls `0x9470`, `0x9471`, `0x947d`, `0x947e`, `0x948c`, `0x948d`, and `0x948e` through callbacks `0x004c1730`, `0x004c1ab0`, `0x004c1ec0`, `0x004c22e0`, `0x004c1d70`, and `0x004c1d30`, stores the singleton resources at `0x006cfe50..0x006cfe58`, and then immediately repopulates the visible state through `shell_company_detail_window_refresh_controls` at `0x004c2ca0`. One negative boundary is useful too: current constructor-time binding still does not install dedicated per-row callbacks for the broader section-0 governance bands `0x94d4..0x9537` and `0x9538..0x959b`, which keeps those rows looking more like resource-defined display bands gated and restyled by the refresh pass than like individually code-rendered widgets. A grounded shell detail-manager caller reaches this constructor at `0x004dde24`, which corrects the earlier assumption that the post-roster company branch still had no recovered detail-window owner.","objdump + strings + detail-manager correlation + caller inspection + constructor-binding absence correlation" 0x004c0160,2214,shell_format_company_stock_data_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Shared shell stock-data formatter used by `LoadScreen.win` page `6`. The helper resolves the selected company through the live collection at `0x0062be10`, builds the section headers `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`, ranks the top positive active-chairman holdings for that company through the profile collection at `0x006ceb9c`, and renders up to four shareholder rows with the current share counts from `[profile + company_id*4 + 0x15d]`. It then formats the full six-row per-share block: help texts `931..936` and labels `937..942`, with `Share Price` from stat-family `0x2329/0x1c`, `Book Value Per Share` from `0x2329/0x1d`, `Revenue Per Share` from `0x2329/0x1e`, `Earnings Per Share` from `0x2329/0x1f`, `Dividend Per Share` from `0x2329/0x20`, and `5 Year Weighted Return` from `0x2329/0x21` via `company_compute_five_year_weighted_shareholder_return` `0x004246b0`. Current grounded caller is `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`.","objdump + RT3.lng strings + caller inspection + shareholder-ranking correlation + stock-data-label correlation + per-share-metric correlation + weighted-return correlation" @@ -1138,6 +1255,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004dbfca,32,shell_event_conditions_window_select_grouped_effect_target_scope_mode_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + RT3.lng correlation,3,"Grouped target-scope mode selector case beneath `EventConditions.win` on the `0xcf` grouped-band path. The helper first commits the currently visible selected-event text panels through `shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change` `0x004d8ea0`, then refreshes the grouped-effect target-scope strip through `shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip` `0x004dab60`, and finally stores the clicked control id into global `0x00622074` so the same target-scope selector can be re-enabled during later selected-event bring-up at `0x004db120`. The `0x4dc09c` dispatch table now keeps the control family honest: this case is only reached by controls `0x5001` and `0x5002`, not by visible rows `0x5014..0x501c`. Current RT3.lng adjacency gives those two controls their strongest current player-facing fit too: `0x5001` is the condition-side `Test against...` mode and `0x5002` is the grouped-effect-side `Apply effects...` mode. This is therefore the safest current read for grouped target-scope mode selection and refresh rather than for the whole visible target-scope display family.","objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + persisted-selection correlation + RT3.lng correlation" 0x004dbf93,55,shell_event_conditions_window_select_grouped_effect_summary_band_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Grouped-band selector verb beneath `EventConditions.win`. The helper first commits the current grouped-effect summary editor state through `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, stores the newly chosen grouped selector ordinal `control_id - 0x4fed` into `[this+0x9c]`, refreshes the visible grouped rows through `0x004d88f0`, re-enters the surrounding condition-window repaint through `0x004da0f0`, and then finishes with the smaller grouped summary tail at `0x004da9a0`. Current grounded dispatcher caller is the `0x4fed..0x4ff0` case family under `0x004dbb80`, so this is the safest current read for grouped-effect summary band selection and refresh rather than a generic selector write.","objdump + local disassembly + dispatcher correlation + grouped-band-selector correlation" 0x004c8670,11,shell_mark_custom_modal_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with the shared callback-driven custom modal family rooted at `0x006cfeb4`. The helper stores `1` into `0x006cfeac`, which current nearby call patterns treat as the custom-modal refresh or service request latch after the lower constructor at `0x004c86c0` and opener `shell_open_custom_modal_dialog_with_callbacks` have published a live modal object. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation" +0x004c7520,190,shell_open_region_focus_modal_and_center_world_on_confirmed_region,shell,cdecl,inferred,objdump + local disassembly + caller correlation + modal-callback correlation,4,"Opens the region-focused custom modal used by queued runtime-effect kind `7` under `simulation_dispatch_runtime_effect_queue_record_by_kind_into_shell_or_world_handlers` `0x00437c00`. The helper first requires scenario latch `[0x006cec74+0x277]`, stores the incoming region id in global `0x006cfe80`, allocates one helper object through `0x0053c6f0(2)` and stores that handle in `0x006cfe88`, then opens the callback-driven custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized root `0x005c87a8`, callbacks `0x004c72f0` and `0x004c73c0`, mode `0x0a`, and scalar `0.5f`. On teardown it releases the helper through `0x0053c000`, and when the modal returns `0x3f2` it resolves the selected region id back through collection `0x0062bae0` and recenters the live world through `0x00433900`. Callback `0x004c72f0` formats one region-specific callout from the selected region name at `[region+0x356]`, the rounded region scalar `[region+0x276]`, and the helper root in `0x006cfe88`; callback `0x004c73c0` builds one interactive control payload strip from the supplied float pair. So the current strongest read is a region-focus or region-confirm modal owner, not a generic one-arg message path.","objdump + local disassembly + caller correlation + modal-callback correlation + region-collection correlation + world-center correlation" 0x004c8680,14,shell_has_live_custom_modal_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared callback-driven custom modal family. The helper reads the live modal singleton at `0x006cfeb4`, returns `1` when that pointer is positive or nonnull, and returns `0` otherwise. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside the `LoadScreen`, file-options, and other shell-window probes rather than any detached gameplay-only UI owner.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation" 0x004e1d60,1169,shell_load_screen_refresh_page_strip_and_page_kind_controls,shell,thiscall,inferred,objdump + descriptor-table decode + caller inspection,4,"Shared refresh helper beneath the shell-side `LoadScreen.win` family. The helper reads the active 13-byte page descriptor record at `0x006220a0 + page*0x0d` using current page id `[this+0x78]`, where the record now grounds as `{ page_kind_dword, title_string_id, back_link_page_dword, selected_company_header_flag_byte }`. It copies the descriptor kind into `[this+0x80]`, refreshes the page-strip and companion controls `0x3e80`, `0x3e81`, `0x3eee..0x3ef7`, `0x3ef8`, `0x3efb`, `0x3efc`, `0x3f0a`, `0x3f0b`, and `0x3f0e` through the generic shell control path at `0x00540120`, and applies page-specific row-band styling from current page-local row state `[this+0x7c]`, row count `[this+0x84]`, and stacked selection history `[this+0x0a0..0x118]`. The descriptor decode now also bounds control `0x3ef8` as the table-driven backlink affordance: page `0` keeps backlink `0`, page `1` backlinks to page `2`, page `8` backlinks to page `7`, page `0x0b` backlinks to page `0x0a`, and page `0x0d` backlinks to page `0x0c`. Current descriptor decode therefore keeps page `0` as kind `0`, title id `1200` `XXX`, backlink `0`, and header flag `0`; page `1` as company-overview kind `1` with backlink page `2`; page `8` as player-detail kind `3` with backlink page `7`; page `0x0b` as dormant train-detail title with backlink page `0x0a`; and page `0x0d` as dormant station-detail title with backlink page `0x0c`. Current grounded caller is `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, which uses this helper after storing a new page or subject selection.","objdump + descriptor-table decode + caller inspection + control-style correlation + backlink-control correlation" 0x004e2c10,3472,shell_load_screen_select_page_subject_and_refresh,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,4,"Shared page or subject selector beneath the shell-side `LoadScreen.win` family rooted at `0x006d10b0`. The helper accepts a page id, a page-local subselector, and an optional subject id; defaults of `-1` reuse the current fields at `[this+0x78]`, `[this+0x7c]`, and caller-selected company or profile state. It stores the chosen page in `[this+0x78]`, the subselector in `[this+0x7c]`, resets several page-local fields including `[this+0x84]` and the report-row latch at `[this+0x75c]`, updates the current company id `[this+0x88]` or profile id `[this+0x8c]` depending on page ownership, and then repaints the active page controls through `0x00563250` and `0x0053fe00`. Several page-specific branches also recompute bounded row-count state for the report lists on pages `0x0a`, `0x0c`, `0x0f`, and `0x0e`, including row styling over control band `0x3f48..`. The surrounding descriptor table now makes one narrower part of this family explicit too: when control `0x3ef8` is used as a backlink affordance, the selected page target comes from the current descriptor backlink dword rather than from a separate hardcoded detail-page branch. Current grounded callers include the broad `LoadScreen.win` dispatcher at `0x004e3a80`, the page-specific stock-holdings branch at `0x004e45d0`, and the selected-company or selected-profile step helpers at `0x004e3a00` plus `0x004e45d0`, so this now reads as the family-wide page or subject refresh owner rather than a CompanyDetail helper.","objdump + caller inspection + state-flow correlation + page-refresh correlation + backlink-target correlation" @@ -1163,6 +1281,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004e9b20,1330,shell_load_screen_render_company_report_history_panel,shell,cdecl,inferred,objdump + caller inspection + page-jump-table correlation + RT3.lng correlation,4,"Shared multi-year company report-table renderer inside `LoadScreen.win`. The helper validates the selected company through the live company collection at `0x0062be10`, derives a bounded display-year window from current display year `[this+0x9c]` and company founding year `[company+0x157]`, clears and repopulates the shared row buffer at `[this+0x11c]`, and then renders one of three page-local report modes selected by its caller-supplied mode argument. The descriptor table rooted at `0x00622192..0x006221a4` now grounds those modes as page `4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`: mode `0` walks the revenue and expense family `1301..1315`, mode `1` walks the asset and liability family `2816`, `1317..1322`, and mode `2` walks the haulage and operating-stat family `1323..1335`. Ordinary rows read yearly values through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0`. The two special row families are tighter now too: they feed the `%1/%2` rate inserts for localized strings `2815` and `2816` through `company_compute_negative_cash_balance_interest_rate` at `0x00425880` and `company_compute_positive_cash_balance_interest_rate` at `0x004258c0`. Current grounded callers are the page `4`, `5`, and `6` arms of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so ownership and page semantics are now both bounded.","objdump + caller inspection + page-jump-table correlation + selected-company validation correlation + report-table mode correlation + RT3.lng row-family correlation + descriptor-table decode + special-rate-row correlation" 0x004ea060,1403,shell_load_screen_render_active_page_panel,shell,thiscall,inferred,objdump + caller inspection + page-jump-table correlation + page-title-table decode,4,"Family-wide render dispatcher beneath the shell-side `LoadScreen.win` singleton `0x006d10b0`. The helper first formats the active page heading from the 13-byte page descriptor table rooted at `0x006220a0` using current page id `[this+0x78]`, specifically the title-string dword at record offset `+0x04`. It then lays out the common panel containers through the shell control family rooted at `[this+0x0b31]`, and conditionally exposes the selected-company header affordance on control `0x3f13` when the descriptor header-flag byte at record offset `+0x0c` is set and the current company `[this+0x88]` still resolves through the live company collection at `0x0062be10`. It then switches on the same page id `[this+0x78]` and dispatches into the active page body. Current grounded routes include page `0` through the localized fallback `1203` `Unable to display page`, page `1` through the broader company-overview wrapper around `0x004e5a70/0x004e5a80`, page `2` through `shell_load_screen_render_company_list_panel` at `0x004e68e0`, page `3` through `shell_load_screen_render_company_report_history_panel` at `0x004e9b20` in `Income Statement` mode, page `4` through the same renderer in `Balance Sheet` mode, page `5` through the same renderer in `Haulage Report` mode, page `6` through `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`, page `7` through `shell_load_screen_render_player_list_panel` at `0x004e6ef0`, page `8` through `shell_load_screen_render_player_detail_stock_holdings_panel` at `0x004e5300`, page `9` through `shell_load_screen_render_game_status_briefing_panel` at `0x004e51ea`, page `0x0a` through `shell_load_screen_render_company_train_list_panel` at `0x004e7670`, page `0x0b` through the same localized `1203` fallback, page `0x0c` through `shell_load_screen_render_company_station_list_panel` at `0x004e8bb0`, page `0x0d` through the same localized `1203` fallback, page `0x0e` through `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460`, and page `0x0f` through `shell_load_screen_render_company_industry_list_panel` at `0x004e8270`. That now makes the rendered title order concrete too: `XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`, `HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`, `TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`, and `INDUSTRY LIST`. Current grounded click flow is narrower than that title table: list-page row activation now re-enters page `8` for player detail, but train, station, and industry rows jump out through the shell detail-panel manager instead of switching to page `0x0b` or `0x0d`; no current recovered opener targets `0x0b` or `0x0d`; and no current post-constructor selector path has been recovered for page `0`, whose descriptor remains kind `0`, title `1200` `XXX`, backlink `0`, and header flag `0`. The outer ownership is now clear: this is the shared active-page body renderer above the individual `LoadScreen.win` pages rather than just one more page-local helper.","objdump + caller inspection + page-jump-table correlation + page-table correlation + selected-company header correlation + page-mode decode + page-title-table decode + row-click-route correlation" 0x004ea620,219,shell_load_screen_window_construct,shell,thiscall,inferred,objdump + resource strings + constructor inspection,4,"Constructs the shell-side `LoadScreen.win` family later stored at singleton `0x006d10b0`. The constructor installs vtable `0x005d1194`, binds the random background image `LoadScreen%d.imb` through the format string at `0x005d1180`, binds `LoadScreen.win` through `0x0053fa50`, initializes current page `[this+0x78]` to `0`, stores the singleton at `0x006d10b0`, and seeds the first three visible page-strip controls starting at `0x84d3` through the generic control path at `0x00540120`. It also randomizes one background index into shell state byte `[0x006cec74+0x2c7]` while avoiding the immediately previous choice. Current neighboring helpers at `0x004ea720` and `0x004ea730` provide the live-singleton query and destructor for the same family, which makes this the broad owner-side constructor above the page dispatcher at `0x004e3a80` and the sibling renderers at `0x004e5300`, `0x004e5a80`, and `0x004e5cf0`.","objdump + resource strings + constructor inspection + singleton-state correlation + page-strip correlation" +0x004ea710,7,shell_load_screen_window_set_active_page,shell,thiscall,inferred,objdump + caller inspection + local disassembly,4,"Tiny scalar setter inside the `LoadScreen.win` family. It copies the caller-supplied page id directly into `[this+0x78]` and returns. The mode-`4` startup branch in `shell_transition_mode` `0x00482e50` now makes its ownership concrete: after constructing `LoadScreen.win` it pushes `5.0f`, `110.0f`, or `236.0f` according to the startup selector and shell editor-mode latch, calls this setter, then immediately allocates the `0x46c40` startup-runtime object, resets it through `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`, stores it into `0x006cec78`, and enters `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`. So this is the page-selection setter directly on the startup transition seam rather than an isolated UI scalar helper.","objdump + caller inspection + local disassembly + startup-transition correlation" 0x004ea720,14,shell_load_screen_window_is_open,shell,cdecl,inferred,objdump + singleton inspection,4,"Tiny singleton-presence probe for `LoadScreen.win`. It returns `1` when global `0x006d10b0` is non-null and `0` otherwise, which matches the constructor and destructor pair at `0x004ea620` and `0x004ea730`.","objdump + singleton inspection + sibling correlation" 0x004ea730,53,shell_load_screen_window_destroy,shell,thiscall,inferred,objdump + singleton inspection,4,"Destructor for the `LoadScreen.win` singleton rooted at `0x006d10b0`. It restores the vtable header `0x005d1194`, clears the singleton global, releases the shared shell object rooted at `0x006cfd34` when present, and then tails into the common shell object destructor path. This is the destructor sibling of `shell_load_screen_window_construct` `0x004ea620` and is one of the explicit old-mode teardown branches reached from `shell_transition_mode`.","objdump + singleton inspection + destructor correlation" 0x004eb0b0,101,shell_open_grayscale_map_tga_picker_and_stage_selection,shell,cdecl,inferred,objdump + literal inspection + caller correlation,3,"Opens the small shell picker used by `Setup.win` to choose one grayscale source map from `TGA Files (*.tga)` rooted at `.\Data\GrayscaleMaps`. The helper forwards the caller-supplied output pointers in `ECX` and `EDX`, constructs the modal shell object family at `0x004ea940`, and on return copies the staged globals at `0x006d10b4` and `0x006d10b8` back into those outputs. It reports success only when the modal result equals control id `0x3f2`. Current grounded caller is the `Setup.win` branch at `0x0050394c`, which then writes startup selector `4` before shell request `0x0cc` continues. This makes the branch a grayscale-map/new-world picker rather than another saved-profile validator.","objdump + literal inspection + caller correlation + modal-result correlation" @@ -1185,7 +1304,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00505760,1159,shell_station_detail_refresh_candidate_service_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the visible candidate-service row lane inside `StationDetail.win`. The helper counts currently active candidate-service entries through `placed_structure_count_candidates_with_local_service_metrics` at `0x0047e330`, resolves each visible row candidate through the neighboring ordinal helper at `0x0047e620`, and then colors and formats the row from the candidate-local-service metrics, the candidate display name, and the same localized strings `681`, `682`, and `2813` used by `shell_station_detail_update_candidate_service_entry`. It registers the per-row click path through callback `shell_station_detail_update_candidate_service_entry` at `0x00504ba0`, keeps the selected and hovered candidate ids in the globals `0x006d16f8` and `0x006d16f4`, and toggles the current preview highlight as rows are rebuilt. Current grounded caller is the broader station-detail refresh pass at `0x00506610`.","objdump + RT3.lng strings + caller inspection + candidate-service row correlation" 0x00504ec0,644,shell_station_detail_refresh_class_3_or_4_train_service_matrix,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng string-id correlation,3,"Alternate `StationDetail.win` refresh branch for selected station classes `3` and `4`. After validating the current station and republishing the station name through helper root `0x006d16e4`, the helper rebuilds a five-row by two-column train-service matrix: the column headers come from localized ids `684` `Trains Serviced` and `685` `Trains Maintained`, the per-row category labels resolve through the world-side lookup table at `0x006cec78+0x46a84` plus `0x0053de00/0x00552560`, and the underlying counts come from the station-side integer lanes at `0x0047d800`. When the detail view is not already marked live it also rebuilds the shared popup-capable haul widget lane and reuses `shell_station_detail_present_to_from_haul_stats_popup` `0x00504770` as the click-through callback. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, which routes class-`3/4` stations into this helper instead of the ordinary nearby-structure, haul-summary, and candidate-service strip.","objdump + local disassembly + caller inspection + RT3.lng string-id correlation + class-3-4-branch correlation" 0x00506610,688,shell_station_detail_window_refresh_controls,shell,cdecl,inferred,objdump + local disassembly + caller inspection + child-helper correlation,4,"Broad refresh owner for the shell-side `StationDetail.win` family. The helper first validates the currently selected station id from detail-manager state `[0x006d0818+0x90]`, resolves the live station from collection `0x006cec20`, and publishes the upper summary lane through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16ec`. When scenario-side latch `[0x006cec74+0x1db]` is set it re-enters `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` for the paired action controls `0xb3b7` and `0xb3b8`; otherwise it checks the resolved candidate class byte `[candidate+0x8c]`, routes classes `3` and `4` into `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and for the ordinary branch it publishes the station name, rebuilds the nearby-structure jump lane through `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470`, rebuilds the `To` and `From` hauled-traffic widgets through `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150`, rebuilds the candidate-service rows through `shell_station_detail_refresh_candidate_service_rows` `0x00505760`, and finally marks the detail view live through `0x006d16f0 = 1`. Current grounded callers are the constructor-side control wiring under `shell_station_detail_window_construct` `0x005068c0` and the paired action-control callbacks on `0xb3b7/0xb3b8`, so this is the safest current read for the main StationDetail refresh owner rather than a narrower popup callback.","objdump + local disassembly + caller inspection + child-helper correlation + StationDetail control correlation" -0x00505e50,766,shell_station_detail_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + control-range correlation,4,"Primary message dispatcher for the shell-side `StationDetail.win` panel rooted at singleton `0x006d16d8`. The helper validates the current selected station from the detail-manager state under `0x006d0818+0x90`, mirrors that station into live world latch `[0x006cec78+0x4cba]` on the message-`0` setup branch, clears or preserves the active candidate-service preview state under `0x006d16f8/0x006d16fc/0x006d1700`, and can leave the panel through `shell_detail_panel_transition_manager` `0x004ddbd0` when the selected station is no longer valid. The message-`0xca` branch owns two concrete row families: candidate-service controls `0xb4dc..0xb5a3`, which either hand off into the `Overview.win` lane through `0x004ddbd0(..., 9, ...)` plus `0x004f4970` when Ctrl is held or else re-arm or clear the world preview through `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` and `0x00504a90`; and nearby-structure controls `0xb40a..0xb413`, which resolve site ids through `0x0047dc90/0x0047dcb0`, transition the detail manager with mode `0x0a`, and optionally recenter the world view through `0x00433900` plus the target object's vtable `+0x5c` callback when no modal overlay is active. The message-`0x3ea` branch refreshes the dirty dynamic rows through `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_refresh_class_partitioned_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`, then restyles control `0xb3f8` from selected-station byte `[station+0x5c9]` and re-arms the active preview if one is selected. The message-`0xcb` action band owns the paired navigation or selector toggles on `0xb3b3/0xb3b4`, the tutorial-gated back or escape branch beneath localized id `0xe8c`, and the lower `0xb3b5..0xb3bf` class-gated action dispatch that first checks selected-company ownership through `0x00504390/0x005043f0`, then resolves linked site and candidate class state through `0x0047de00`, `0x0040cec0`, and `0x0047fd50` before re-entering the world-side action helper strip under `0x00419590`. This is the current grounded owner above the already-mapped refresh helper `shell_station_detail_window_refresh_controls` `0x00506610`, not just one narrow control callback.","objdump + local disassembly + caller inspection + control-range correlation + StationDetail message-branch correlation" +0x00505e50,766,shell_station_detail_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + control-range correlation,4,"Primary message dispatcher for the shell-side `StationDetail.win` panel rooted at singleton `0x006d16d8`. The helper validates the current selected station from the detail-manager state under `0x006d0818+0x90`, mirrors that station into live world latch `[0x006cec78+0x4cba]` on the message-`0` setup branch, clears or preserves the active candidate-service preview state under `0x006d16f8/0x006d16fc/0x006d1700`, and can leave the panel through `shell_detail_panel_transition_manager` `0x004ddbd0` when the selected station is no longer valid. The message-`0xca` branch owns two concrete row families: candidate-service controls `0xb4dc..0xb5a3`, which either hand off into the `Overview.win` lane through `0x004ddbd0(..., 9, ...)` plus `0x004f4970` when Ctrl is held or else re-arm or clear the world preview through `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` and `0x00504a90`; and nearby-structure controls `0xb40a..0xb413`, which resolve site ids through `0x0047dc90/0x0047dcb0`, transition the detail manager with mode `0x0a`, and optionally recenter the world view through `0x00433900` plus the target object's vtable `+0x5c` callback when no modal overlay is active. The message-`0x3ea` branch refreshes the dirty dynamic rows through `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_refresh_class_partitioned_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`, then restyles control `0xb3f8` from selected-station byte `[station+0x5c9]` and re-arms the active preview if one is selected. The message-`0xcb` action band owns the paired navigation or selector toggles on `0xb3b3/0xb3b4`, the tutorial-gated back or escape branch beneath localized id `0xe8c`, and the lower `0xb3b5..0xb3bf` class-gated action dispatch that first checks selected-company ownership through `0x00504390/0x005043f0`, then resolves linked site and candidate class state through `0x0047de00`, `0x0040cec0`, and `0x0047fd50`. That lower dispatch is tighter now too: control `0xb3bd` selects action family `1` while the sibling controls select family `2`, the linked-site flag byte `[entry+0xc3]` is reduced to one action index `0..5`, and the resulting `(action_index, family)` pair is resolved into one auxiliary candidate id through `aux_candidate_collection_find_entry_id_by_station_detail_action_index_and_family` `0x00419590` before the deeper world-side validation and the two confirmation-modal branches rooted at localized ids `0x0bfe` and `0x0bff`. This is the current grounded owner above the already-mapped refresh helper `shell_station_detail_window_refresh_controls` `0x00506610`, not just one narrow control callback.","objdump + local disassembly + caller inspection + control-range correlation + StationDetail message-branch correlation + lower-action-selector correlation" 0x0050c500,426,shell_present_chairmanship_takeover_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch.","objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation" 0x0050c940,880,shell_resolve_chairmanship_takeover_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.","objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation" 0x0050ccc0,709,shell_company_detail_attempt_chairmanship_takeover_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + takeover-election correlation" @@ -1194,7 +1313,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004c6c30,765,shell_company_list_window_refresh_rows,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Rebuilds the shell company-list window rows. The helper clears the two mirrored list controls under ids `0x2ee1` and `0x2ee2`, iterates the live company collection at `0x0062be10`, and formats each company row with one of three localized status strings: id `267` `You are the chairman of the %1!` for the currently selected chairman company from `0x00434870`, id `268` `The %1 has no chairman at the moment.` when `[company+0x3b]` is zero, or id `269` `%1 is the chairman of the %2.` plus suffix id `270` `Double-click for details.` when another chairman profile is attached. When the row also has a primary station, the helper appends localized help id `2992` `Shift-Click to center on this company's primary station.` After the live-company rows are rebuilt, it conditionally appends the synthetic row id `0x7fff` through `shell_company_list_format_company_or_start_row` so `<>` appears as a separate affordance rather than as part of the seeded trio itself. It also refreshes the currently selected list index at `[this+0x78]`.","objdump + RT3.lng strings + caller inspection + company-list iteration" 0x004c6f30,704,shell_company_list_window_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Message dispatcher for the shell company-list window. Selection changes on controls `0x2ee1` and `0x2ee2` toggle the mirrored list selection state and the local start-company affordance latch at `0x006cfe7c`. Activating one live company row routes through `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0` or opens its detail path through the shell detail-panel manager `0x004ddbd0`. Activating the synthetic row id `0x7fff` instead checks whether the current chairman can start a new company, optionally shows localized confirmation id `272` `You're currently chairman of the %1... Proceed?`, and then opens the dedicated `Start New Company...` dialog through `start_new_company_dialog_open` at `0x0047d080`. When that dialog closes while the company-list window remains active, the handler rebuilds the rows through `shell_company_list_window_refresh_rows` at `0x004c6c30`.","objdump + RT3.lng strings + caller inspection + dialog correlation" 0x004c7200,212,shell_company_list_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings,4,"Constructs the shell company-list window rooted at globals `0x006cfe70..0x006cfe7c`. The helper allocates two mirrored list widgets under ids `0x2ee1` and `0x2ee2`, attaches the row formatter `shell_company_list_format_company_or_start_row` at `0x004c6b40`, the live-row activation handler `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0`, publishes the current selected-index storage at `[this+0x78]`, and then calls `shell_company_list_window_refresh_rows` at `0x004c6c30`. It also toggles the start-company affordance controls `0x2ee3` and `0x2ee4` from the global latch `0x006cfe7c`, which matches the handler-side selection logic for the synthetic `<>` row.","objdump + caller inspection + control wiring" -0x005068c0,443,shell_station_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationDetail.win` panel owned by detail-manager mode `8`. The constructor installs the singleton at `0x006d16d8`, binds `StationDetail.imb` and `StationDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the paired action controls `0xb3b7` and `0xb3b8` through callback `0x00506610`, toggles the adjacent navigation controls `0xb3b3` and `0xb3b4`, conditionally restyles the special action control `0xb3f8` from the editor latch `[0x006cec74+0x68]`, special-condition slot `[0x006cec78+0x4af7]`, and selected-station byte `[station+0x5c9]`, and then refreshes the lower class-gated action strip `0xb3bb..0xb3bf` through `0x005044b0`. This corrects the older company-browser reading: current grounded resource names and control wiring put mode `8` on a station-detail lane rather than on a company-detail browser.","objdump + strings + detail-manager correlation + caller inspection + special-action-control correlation + lower-action-strip correlation" +0x005068c0,443,shell_station_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationDetail.win` panel owned by detail-manager mode `8`. The constructor installs the singleton at `0x006d16d8`, binds `StationDetail.imb` and `StationDetail.win` through `0x0053d110` and `0x0053fa50`, seeds helper roots `0x006d16dc..0x006d16ec`, wires the paired action controls `0xb3b7` and `0xb3b8` through callback `0x00506610`, and toggles the adjacent navigation controls `0xb3b3` and `0xb3b4`. The special action control `0xb3f8` is tighter now too: when editor-map latch `[0x006cec74+0x68]` is clear it is forced to style `0x87`; when that latch is set and scenario slot `[0x006cec78+0x4af7]` is nonzero it switches to style `0x74` if selected-station byte `[station+0x5c9]` is nonzero and style `0x65` otherwise. The constructor then refreshes the lower class-gated action strip `0xb3bb..0xb3bf` through `0x005044b0`. This corrects the older company-browser reading: current grounded resource names and control wiring put mode `8` on a station-detail lane rather than on a company-detail browser.","objdump + strings + detail-manager correlation + caller inspection + special-action-control correlation + lower-action-strip correlation + helper-root correlation" 0x00506a80,64,shell_station_list_window_destruct_release_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Primary `StationList.win` destructor. The helper restores vtable `0x005d177c`, releases the two helper handles rooted at `0x006d1704` and `0x006d170c` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d1708`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current evidence comes from the StationList constructor or vtable pair, so this is the safest current read for the concrete list-window destroy path rather than another shared shell stub.","objdump + vtable scan + local disassembly + StationList destructor correlation" 0x00506ac0,656,shell_station_list_row_callback_publish_station_callout_card,shell,cdecl,inferred,objdump + local disassembly + caller inspection + callout correlation,3,"Row-side callout publisher beneath the visible `StationList.win` controls `0x61a9` and `0x61aa`. Given one selected station id and one caller-supplied screen anchor tuple, the helper resolves the live station from collection `0x006cec20`, derives one category or type label through the linked record path `0x0062b26c -> 0x0040cec0`, builds one localized header through `0x0053de00` and `0x00552560`, copies the station display name from `[station+0x46b]`, queries the weighted freight lane through `0x005519f0`, queries the cached express or freight class totals through `placed_structure_query_cached_express_service_class_score` `0x0047e390` for ids `0x0386` and `0x0385`, and then publishes the resulting stacked text card through repeated `shell_publish_text_callout_presentation` `0x005519f0` calls using the helper payload roots at `0x006d1704` and `0x006d170c`. Current grounded caller is `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30`, which wires this callback onto both station row controls with event `0x7a`.","objdump + local disassembly + caller inspection + callout correlation + StationList row-callback correlation" 0x00506be0,360,shell_station_detail_format_freight_and_express_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible freight and express summary lines on the shell-side `StationDetail.win` panel. The helper resolves the selected placed-structure record, builds the weighted freight total through the neighboring cargo-summary helper at `0x005519f0`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then writes the localized lines `Freight: %1` and `Express: %1` through string ids `239` and `240`. This is the first grounded shell-detail consumer of the local service bundle rebuilt beneath `0x0042d580`.","objdump + strings + caller inspection + service-query correlation" @@ -1450,7 +1569,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0046ce10,117,multiplayer_apply_string_and_three_scalars_into_current_session_entry_and_optionally_set_ready_flag,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that copies one payload string plus three following dwords into the current live session entry fields `[+0x258c/+0x268c/+0x2690/+0x2694]`, optionally sets bit `0x01` in entry flags `[+0x5c]`, and republishes the session list through `0x005216d0`. This is the current grounded current-session update companion to the selector-`0x54` submitter at `0x0046cd30`.","objdump + local disassembly + caller inspection + session-entry correlation + current-session correlation" 0x0046ce90,119,multiplayer_advance_pending_action_state_machine_from_payload_byte,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that advances pending-action globals `0x006d127c`, `0x006d1280`, and `0x006d128c` based on the first payload byte at `[msg+0x08]`. The grounded branches switch `0x006d1280` among values `8`, `0xd`, and `9`, which makes this a real pending-state owner beneath the callback table rather than another passive notifier.","objdump + local disassembly + caller inspection + pending-state correlation + state-machine correlation" 0x0046cf10,49,multiplayer_session_entry_set_flag_0x04,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]` and sets bit `0x04` in entry flags `[entry+0x5c]`. This is the current grounded owner for the flag-`0x04` session-entry latch beneath the callback table.","objdump + local disassembly + caller inspection + session-entry-flag correlation" -0x0046cf40,44,multiplayer_copy_payload_bytes_into_world_runtime_block_0x66be,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that bulk-copies payload bytes from `[msg+0x08]` with count `[msg+0x0c]` into live world root `0x006cec78+0x66be`. Current evidence grounds the destination block but not its exact semantic owner, so the label stays structural.","objdump + local disassembly + caller inspection + world-runtime-block correlation" +0x0046cf40,44,multiplayer_copy_payload_bytes_into_world_late_setup_preview_payload_block_0x66be,shell,cdecl,inferred,objdump + local disassembly + caller inspection + save-load correlation,3,"Selector-handler callback that bulk-copies payload bytes from `[msg+0x08]` with count `[msg+0x0c]` into live world root `0x006cec78+0x66be`. The destination block is tighter now than a generic runtime blob: the same `[world+0x66be]` band is serialized and restored under chunk ids `0x2ee0/0x2ee1` by `world_runtime_serialize_smp_bundle` `0x00446240` and `world_load_saved_runtime_state_bundle` `0x00446d40`, normalized after restore through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and exported as the live setup-preview payload record by `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100` `0x00442ba0`. So the strongest current read is a selector-handler that mirrors one remote late setup-preview or status payload block into the live world rather than a generic memcpy into anonymous runtime state.","objdump + local disassembly + caller inspection + save-load correlation + setup-preview-payload correlation" 0x0046cf70,56,multiplayer_clear_flag_0x01_on_all_live_session_entries,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that walks the live session list from `0x00521680`, clears bit `0x01` in each entry flags word `[entry+0x5c]`, and then republishes the full list through `0x005216a0`. This is the current grounded global clear path for the entry flag toggled by `0x0046c870` and `0x0046ce10`.","objdump + local disassembly + caller inspection + session-entry-flag correlation" 0x0046cfa0,3,multiplayer_selector_handler_return_true_stub_4,shell,cdecl,inferred,objdump + local disassembly,1,"Fourth literal selector-handler stub that returns `1` immediately with no side effects.","objdump + local disassembly + selector-handler correlation" 0x0046cfb0,37,multiplayer_toggle_selector0x67_batch_build_guard_and_call_0x444dd0,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small selector-handler callback that sets global guard `0x006ce9b8 = 1`, calls `0x00444dd0` with payload fields `[msg+0x08]+8` and `[msg+0x08]+4`, and then clears that same guard. Current evidence only grounds the guard and dispatch shape, so the label stays structural.","objdump + local disassembly + caller inspection + guard-toggle correlation" @@ -1625,7 +1744,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00502720,144,paint_terrain_tool_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0.,ghidra + rizin + llvm-objdump + strings 0x005027b0,351,shell_setup_window_refresh_file_backed_selection_list_panel,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the file-backed list pane used by the `Setup.win` submodes that depend on the staged dataset at `0x006d14b8`. The helper chooses one top header-control family from the current setup submode at `[window+0x7b]`, now bounded exactly as `4 -> 0xd4b`, `9 -> 0xde8`, `6/12/14 -> 0xdf2`, and `10 -> 0xe85`, rebuilds the repeated row controls rooted at `0x88` from each record's text at `+0x12d`, mirrors the selected record into the summary slot `0x66` when its secondary path matches `[0x006cec7c+0x44]`, paints the fixed status-color strip rooted at control `0xaf` from the constant table `0x00622a98`, and then re-enters `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. RT3.lng now also tightens one earlier misread here: those `0xd4b/0xde8/0xdf2/0xe85` values are local setup header-control or resource ids, not localized text ids. The setup-art bundle tightens that split one step further too: the only distinct file-backed setup art families under `rt3_2WIN.PK4` are the shared `Setup_Load(.imb/_Buttons.imb)` family and the separate `Setup_Sandbox(.imb/_Buttons.imb)` family, which matches the earlier selector evidence that mode `10` is the sandbox-backed `new` list while the neighboring mode `12` is its `load` sibling. The upstream dataset helpers now tighten the remaining family split too: this pane consumes rows staged by `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`, and the surrounding mode selector makes modes `4/6/10/12/14` default to the ordinary setup file root while mode `9` is the only file-backed sibling that also flips the shell-side root toward the map-family branch. Combined with the dataset normalization split in `0x004333f0`, that now shows only submodes `4` and `10` using the alternate localized-stem list-label path, while `6`, `9`, `12`, and `14` keep the direct filename-normalization lane. Current grounded callers are the mode-`4`, `9`, `6`, `10`, `12`, and `14` follow-up branches inside `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`.","objdump + local disassembly + caller xrefs + header-control correlation + dataset-list correlation + setup-file-root correlation + localized-file-list split + RT3.lng negative-result correlation + setup-art-family correlation" 0x00502910,744,shell_setup_window_refresh_mode_dependent_lists,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the shared non-file-backed `Setup.win` payload panel family, using the current setup submode at `[window+0x7b]` only as a presence gate rather than a deep selector. The helper formats the current item-count summary into `0x0cf3`, publishes one fixed placeholder or stem into `0x0cf4`, republishes the staged-path tail into `0x0cf5`, formats the scalar field from `[0x006cec7c+0x77]` into `0x0d4f`, mirrors option-byte `[0x006cec7c+0x7d]` into the five compact controls `0x0ce9..0x0ced`, looks up the constructor-installed draw callback host at `0x0ce8`, and then rebuilds the repeated row controls under `0x88` from the current setup payload at `0x006d14bc`. That payload-side row family is tighter now too: row count comes from `[payload+0x3ae]`, the draw callback id is read from `[control+0x1d6]`, row availability is gated by bytes `[payload+0x31b]` and `[payload+0x31c]`, and the live row-selection marker bytes are mirrored into `[0x006cec7c+0x87]` as `1` for the first row, `0x64+index` for later live rows, and `0` for hidden ones. After the row rebuild it republishes the active summary row in control `0x66` when the caller-supplied index still falls inside the current visible band `[submode_base + current_scroll .. + current_scroll + live_rows)`. Current grounded callers are the direct submode follow-up at `0x00503243`, the decrement or increment and option-byte branches at `0x005037e9`, `0x00503828`, `0x0050385f`, `0x005038a8`, `0x005038df`, `0x00503904`, and the constructor-side follow-up at `0x005040ba`. This now bounds it as the shared payload-driven companion to `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, distinct from the later file-backed pane rooted at `0x005027b0` and no longer safely reducible to a mode-`3`-only helper.","objdump + local disassembly + caller xrefs + control-id correlation + payload-row-availability correlation + shared-non-file-backed-panel correlation" -0x00502c00,472,shell_setup_window_select_launch_mode_and_apply_shell_state,shell,cdecl,inferred,objdump + local disassembly,4,"Central launch-mode selector for `Setup.win`. The helper clears or sets `[0x006cec74+0x6c]` according to the requested mode id, re-enters `0x00482e50` on the shell state, toggles `[0x006cec7c+0x97]` and `[0x006cec7c+0x10]`, stores the selected setup submode at `[window+0x7b]`, and republishes the controlling status widgets through `0x00540120`. The internal submode split is tighter now too: mode `1` publishes the cached local exe-version string from `runtime_query_cached_local_exe_version_string` `0x00482d80` into control `0x0c23` and is now the strongest current fit for the main landing panel; mode `2` explicitly clears the staged-profile presence byte at `[0x006cec7c+0x10]` and now most safely reads as the `Single Player` root from RT3.lng `1991/1992`; modes `4`, `9`, `6`, `10`, `12`, and `14` drive the file-backed selection pane through `shell_setup_window_refresh_file_backed_selection_list_panel` `0x005027b0`; modes `4` and `9` plus `6`, `10`, `12`, and `14` also route the `0x0d4d/0x0d4e` preview fields through `0x0053fe90`; modes `7`, `8`, and `9` are the only values that pass `1` into `0x00482e50`; and modes `6`, `9`, `12`, and `14` are the values that clear `[0x006cec7c+0x97]` while sibling file-backed modes set it. The file-backed submode-to-dataset mapping is now exact too: submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`. The top-level button-state family is tighter now too: the selector later restyles one persistent control band so that `0xbc5` tracks submode `15`, `0xbc6` tracks `16`, `0xbba` tracks `2`, `0xbbb` tracks `3`, `0xbc3` tracks `13`, `0xbbc` groups `3/4/5`, `0xbbd` tracks `4`, `0xbbe` tracks `5`, `0xbbf` groups `6/12/14`, `0xbc0` tracks `7`, `0xbc1` tracks `8`, `0xbc2` tracks `9`, `0xe75` tracks `10`, and `0xf6e` tracks `17`. The setup file-root helpers now tighten the family boundary further: `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0` defaults the ordinary setup file lanes to `saved games\\*.smp`, while the shell-state branch chosen here only flips into the `maps\\*.gm*` family when the requested mode leaves `[shell+0x6c] == 1`; the separate `[shell+0x6c] == 2` branch remains the tutorial-root `data\\tutorial` family above `0x00438890`. That means the ordinary saved-game-backed family is broader than the narrower file-list-pane family: modes `3`, `4`, `5`, `6`, `10`, `12`, and `14` all stay on the ordinary `.smp` setup side, but only `4`, `6`, `9`, `10`, `12`, and `14` re-enter the dedicated file-list pane at `0x005027b0`, while mode `3` stays on the option-heavy companion at `0x00502910`. Current asset and RT3.lng evidence now tighten several of those names too: mode `3` is the strongest current fit for the shared single-player `New Game` or `Options` companion behind `Setup_Options(.imb)`; mode `5` is the strongest current fit for the `Sandbox` companion behind `Setup_Sandbox(.imb)` and the later launch byte `[0x006cec7c+0x82] = 1`; mode `10` is now the strongest current fit for the sandbox-backed template or profile list because it is the only file-backed submode with its own `0x0e85` header family and a neighboring validated launch control `0x0e81` that both routes into selector `5` and sets runtime-profile byte `[0x006cec7c+0x82] = 1`; mode `4` is therefore the strongest non-sandbox peer in the same alternate localized-stem template-list pair, which makes it the strongest current fit for the standalone `New Scenario`-style chooser still owned by `Setup.win`; and modes `6`, `12`, and `14` now tighten one step further as the three selector-`3` direct-filename load siblings, with mode `14` the strongest current landing panel for that family because `0x0c24` jumps to it directly while `0x0c82` and `0x0c84` only reach sibling modes `6` and `12` from inside the same load cluster. The same control pairing now makes one stronger semantic split defensible too: `0x0c83 -> 10` and `0x0c84 -> 12` look like the sandbox-side new or load pair inside that four-button family, so mode `12` is now the strongest current fit for the setup-local `Load Sandbox` lane. The remaining non-sandbox pair is closed now too: `shell_setup_filter_candidate_file_by_dataset_and_payload_flags` `0x00433260` shows dataset `9` taking the extra nonzero payload-flag lane while dataset `8` stays on the plain non-sandbox path, and the editor-side metadata path now grounds `[0x006cec78+0x66de]` as the direct `Campaign Scenario` checkbox bit because `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161`. That means the extra dataset-`9` lane is the campaign-designated load family, while dataset `8` is the ordinary scenario load family, so `14 = Load Campaign` and `6 = Load Scenario` now read as grounded rather than residual. Modes `7/8/9` are now the grounded `Editor` or `Choose Map` family from RT3.lng `1995`, `2022`, `2024`, `2026`, and `2028`, with mode `7` the editor root, mode `8` the `New Map` chooser, and mode `9` the file-backed `Load Map` list sibling. Submode `13` is tighter in a second way too: it now clearly joins neither the dedicated file-list pane nor the mode-`3` option pane, and current top-level RT3.lng elimination makes it the strongest residual fit for the `Multi Player` root. Submode `16` remains the other residual top-level `Setup.win` root and is now the strongest current fit for the `High Scores` lane, since `Credits` already lives in separate shell mode `6`. It is the shared callee for many larger dispatcher branches in the `0x005033d0..0x00503b7b` family, including the direct mode requests at `0x00503567`, `0x0050361b`, `0x00503652`, `0x005036c3`, `0x005036f6`, `0x00503707`, `0x0050371f`, `0x0050374b`, `0x00503769`, `0x005037a9`, `0x00503921`, `0x0050393f`, `0x00503982`, `0x00503991`, `0x00503a57`, and `0x00503b44`. Current mode-selection correlation now also grounds its ownership above the startup-profile selector in `0x00438890`: the surrounding dispatcher writes `[0x006cec7c+0x01]` values `2`, `3`, `4`, `5`, `1`, and `7` before later entering `0x00482150` with launch request `0xcc`.","objdump + local disassembly + caller xrefs + setup-dispatch correlation + shell-state correlation + submode-follow-up correlation + selector-table decode + setup-file-root correlation + map-editor-branch correlation + ordinary-smp-family split + top-level-button-state correlation + setup-submode-dataset mapping + grouped-launch-control correlation + RT3.lng top-level correlation + setup-asset correlation + setup-local-new-vs-load split + direct-launch-branch correlation + file-family correlation + load-cluster landing correlation + control-pairing inference + dataset-payload-flag correlation + campaign-scenario-warning correlation + editorDetail.win resource record" +0x00502c00,472,shell_setup_window_select_launch_mode_and_apply_shell_state,shell,cdecl,inferred,objdump + local disassembly,4,"Central launch-mode selector for `Setup.win`. The helper clears or sets `[0x006cec74+0x6c]` according to the requested mode id, re-enters `0x00482e50` on the shell state, toggles the file-backed launch or rehydrate latch `[0x006cec7c+0x97]`, updates the staged-profile presence byte `[0x006cec7c+0x10]`, stores the selected setup submode at `[window+0x7b]`, and republishes the controlling status widgets through `0x00540120`. The file-backed lane is tighter now too: when one dataset-backed row is successfully selected, the helper materializes that dataset through `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`, copies the row's primary `0x32`-byte stem band into `[0x006cec7c+0x11]`, copies the secondary `0x32`-byte display-name band into `[0x006cec7c+0x44]`, sets `[0x006cec7c+0x10] = 1`, and re-enters `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`; when no valid row survives it drops the staged file-list owner at `0x006d14b8` instead. The internal submode split is tighter now too: mode `1` publishes the cached local exe-version string from `runtime_query_cached_local_exe_version_string` `0x00482d80` into control `0x0c23` and is now the strongest current fit for the main landing panel; mode `2` explicitly clears the staged-profile presence byte at `[0x006cec7c+0x10]` and now most safely reads as the `Single Player` root from RT3.lng `1991/1992`; modes `4`, `9`, `6`, `10`, `12`, and `14` drive the file-backed selection pane through `shell_setup_window_refresh_file_backed_selection_list_panel` `0x005027b0`; modes `4` and `9` plus `6`, `10`, `12`, and `14` also route the `0x0d4d/0x0d4e` preview fields through `0x0053fe90`; modes `7`, `8`, and `9` are the only values that pass `1` into `0x00482e50`; and modes `6`, `9`, `12`, and `14` are the values that clear `[0x006cec7c+0x97]` while sibling file-backed modes set it. The file-backed submode-to-dataset mapping is now exact too: submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`. The top-level button-state family is tighter now too: the selector later restyles one persistent control band so that `0xbc5` tracks submode `15`, `0xbc6` tracks `16`, `0xbba` tracks `2`, `0xbbb` tracks `3`, `0xbc3` tracks `13`, `0xbbc` groups `3/4/5`, `0xbbd` tracks `4`, `0xbbe` tracks `5`, `0xbbf` groups `6/12/14`, `0xbc0` tracks `7`, `0xbc1` tracks `8`, `0xbc2` tracks `9`, `0xe75` tracks `10`, and `0xf6e` tracks `17`. The setup file-root helpers now tighten the family boundary further: `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0` defaults the ordinary setup file lanes to `saved games\\*.smp`, while the shell-state branch chosen here only flips into the `maps\\*.gm*` family when the requested mode leaves `[shell+0x6c] == 1`; the separate `[shell+0x6c] == 2` branch remains the tutorial-root `data\\tutorial` family above `0x00438890`. That means the ordinary saved-game-backed family is broader than the narrower file-list-pane family: modes `3`, `4`, `5`, `6`, `10`, `12`, and `14` all stay on the ordinary `.smp` setup side, but only `4`, `6`, `9`, `10`, `12`, and `14` re-enter the dedicated file-list pane at `0x005027b0`, while mode `3` stays on the option-heavy companion at `0x00502910`. Current asset and RT3.lng evidence now tighten several of those names too: mode `3` is the strongest current fit for the shared single-player `New Game` or `Options` companion behind `Setup_Options(.imb)`; mode `5` is the strongest current fit for the `Sandbox` companion behind `Setup_Sandbox(.imb)` and the later launch byte `[0x006cec7c+0x82] = 1`; mode `10` is now the strongest current fit for the sandbox-backed template or profile list because it is the only file-backed submode with its own `0x0e85` header family and a neighboring validated launch control `0x0e81` that both routes into selector `5` and sets runtime-profile byte `[0x006cec7c+0x82] = 1`; mode `4` is therefore the strongest non-sandbox peer in the same alternate localized-stem template-list pair, which makes it the strongest current fit for the standalone `New Scenario`-style chooser still owned by `Setup.win`; and modes `6`, `12`, and `14` now tighten one step further as the three selector-`3` direct-filename load siblings, with mode `14` the strongest current landing panel for that family because `0x0c24` jumps to it directly while `0x0c82` and `0x0c84` only reach sibling modes `6` and `12` from inside the same load cluster. The same control pairing now makes one stronger semantic split defensible too: `0x0c83 -> 10` and `0x0c84 -> 12` look like the sandbox-side new or load pair inside that four-button family, so mode `12` is now the strongest current fit for the setup-local `Load Sandbox` lane. The remaining non-sandbox pair is closed now too: `shell_setup_filter_candidate_file_by_dataset_and_payload_flags` `0x00433260` shows dataset `9` taking the extra nonzero payload-flag lane while dataset `8` stays on the plain non-sandbox path, and the editor-side metadata path now grounds `[0x006cec78+0x66de]` as the direct `Campaign Scenario` checkbox bit because `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161`. That means the extra dataset-`9` lane is the campaign-designated load family, while dataset `8` is the ordinary scenario load family, so `14 = Load Campaign` and `6 = Load Scenario` now read as grounded rather than residual. Modes `7/8/9` are now the grounded `Editor` or `Choose Map` family from RT3.lng `1995`, `2022`, `2024`, `2026`, and `2028`, with mode `7` the editor root, mode `8` the `New Map` chooser, and mode `9` the file-backed `Load Map` list sibling. Submode `13` is tighter in a second way too: it now clearly joins neither the dedicated file-list pane nor the mode-`3` option pane, and current top-level RT3.lng elimination makes it the strongest residual fit for the `Multi Player` root. Submode `16` remains the other residual top-level `Setup.win` root and is now the strongest current fit for the `High Scores` lane, since `Credits` already lives in separate shell mode `6`. It is the shared callee for many larger dispatcher branches in the `0x005033d0..0x00503b7b` family, including the direct mode requests at `0x00503567`, `0x0050361b`, `0x00503652`, `0x005036c3`, `0x005036f6`, `0x00503707`, `0x0050371f`, `0x0050374b`, `0x00503769`, `0x005037a9`, `0x00503921`, `0x0050393f`, `0x00503982`, `0x00503991`, `0x00503a57`, and `0x00503b44`. Current mode-selection correlation now also grounds its ownership above the startup-profile selector in `0x00438890`: the surrounding dispatcher writes `[0x006cec7c+0x01]` values `2`, `3`, `4`, `5`, `1`, and `7` before later entering `0x00482150` with launch request `0xcc`.","objdump + local disassembly + caller xrefs + setup-dispatch correlation + shell-state correlation + submode-follow-up correlation + selector-table decode + setup-file-root correlation + map-editor-branch correlation + ordinary-smp-family split + top-level-button-state correlation + setup-submode-dataset mapping + grouped-launch-control correlation + RT3.lng top-level correlation + setup-asset correlation + setup-local-new-vs-load split + direct-launch-branch correlation + file-family correlation + load-cluster landing correlation + control-pairing inference + dataset-payload-flag correlation + campaign-scenario-warning correlation + editorDetail.win resource record" 0x005033d0,1963,shell_setup_window_handle_message,shell,thiscall,inferred,objdump + local disassembly,3,"Primary message or command dispatcher for the `Setup.win` family rooted at `0x00504010`. The handler switches over many control ids in the `0x0c80..0x0f71` band, routes direct mode changes through `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, refreshes the visible list families through `shell_setup_window_refresh_mode_dependent_lists` `0x00502910` and `shell_setup_window_refresh_selection_lists_and_summary_fields` `0x00502550`, republishes the selected labels and preview surface through `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`, and writes startup-profile selector values into `[0x006cec7c+0x01]` before later shell request `0x00482150(0xcc, ...)` transitions continue. The control-id split is tighter now too: `0x0d4b/0x0de8/0x0e85` reuse the current row index from `[msg+0x08]` to republish one selected setup record through `0x00502220`; `0x0e88/0x0e89/0x0e8a` toggle the persisted shell-state booleans at `[0x006cec74+0x247/+0x243/+0x24b]` and immediately save config through `0x00484910(1)`; `0x0c1f` is the settings-window escape through `shell_has_settings_window` `0x004fe120` and `shell_open_settings_window` `0x00501e50`; `0x0c1e`, `0x0c20`, and `0x0c22` are direct shell-request branches entering `0x00482150` with request ids `0x0cc` or `0x0cd`; `0x0bc2`, `0x0bc5`, `0x0bc6`, and `0x0bc7` are the separate shell-open or help-content quartet above `shell_query_registry_open_command_for_http_or_rtf_target` `0x00501f20`; `0x0bc1` and `0x0bc8` both select submode `15`, which now safely reads as the `Extras` family because RT3.lng `3118..3129` and the surrounding shell-open quartet align with `Readme`, `Weblinks`, and the return-to-extras sibling; `0x0bc3` selects submode `16`, which now most safely reads as the remaining `High Scores` top-level root because `Credits` already lives in separate shell mode `6` `Credits.win`; `0x0bc4` selects submode `1`, the current strongest main landing-panel fit; `0x0c80` selects submode `13`, now the strongest residual fit for the `Multi Player` root; `0x0c1c` selects submode `17`, which now safely reads as the tutorial chooser because mode `17` is the only family that later exposes startup selectors `1` and `7` through controls `0x0f6f` and `0x0f70`; `0x0c1d` selects submode `2`, the current strongest `Single Player` root from RT3.lng `1991/1992`; and `0x0c24` selects submode `14`; `0x0c81`, `0x0c82`, `0x0c83`, and `0x0c84` select submodes `14`, `6`, `10`, and `12`; `0x0c85` conditionally selects submode `4` or `3` from the entry flag at `[msg+0x2c]+0x6a`; `0x0ce4` writes selector `4` and then selects submode `8`, now the strongest `New Map` chooser fit from RT3.lng `2022/2026/2028`; `0x0ce5` writes selector `3` and then selects submode `9`, now the strongest `Load Map` list sibling; `0x0de0` and `0x0dea` both select submode `7`, now the strongest `Editor` root fit from RT3.lng `1995/1996`; `0x0df4` and `0x0e80` are the high-side slider refresh pair; `0x0e83` selects submode `1`; and `0x0f71` selects submode `1` after writing selector `7`. `0x0ce6/0x0ce7` and `0x0d49/0x0d4a` are bounded decrement or increment controls over `[0x006cec7c+0x7b]` and `[0x006cec7c+0x77]`; `0x0ce9..0x0ced` plus `0x0f3d..0x0f3f` store compact option bytes into `[0x006cec7c+0x7d]`; and `0x0e82/0x0e83` are the wider clamp-to-`0x834/0x70d` slider pair that feeds `0x00502550`. The later launch-side branches are tighter in a corrective way too: the validated staged-profile launch lane no longer includes `0x0ce5` or `0x0dcb`. `0x0cf6` and `0x0e81` are the selector-`5` siblings in that validated lane; current local disassembly also shows the neighboring selector-`3` validated lane is at least shared by the later `0x0de9` and `0x0df3` controls before shell request `0x0cc` continues; and `0x0e81` is now tighter still because it is the only one of those validated controls that also sets runtime-profile byte `[0x006cec7c+0x82] = 1`, the strongest current sandbox-side anchor beneath the later `.gmx` file family. `0x0dca` is now tighter as the grayscale-map picker branch above `shell_open_grayscale_map_tga_picker_and_stage_selection` `0x004eb0b0`, then writes selector `4`; `0x0dcb` conditionally selects submode `5` or `3` from the same entry flag family used by the earlier `0x0c85` branch, which reinforces mode `5` as the sandbox-style companion rather than another launch control; `0x0ddf` is the separate windowed-mode-gated grayscale-heightmap generation branch that reopens the `TGA Files (*.tga)` / `.\Data\GrayscaleMaps` picker through `shell_open_file_dialog_copy_selected_path_and_restore_cwd` `0x0042a970`, validates the chosen image through `shell_query_tga_header_is_supported_truecolor_image` `0x005411c0`, and only then writes selector `2`; `0x0f6f` writes selector `1`; and `0x0f70` writes selector `7` before shell request `0x0cc` continues.","objdump + local disassembly + selector-writer correlation + caller-family reconstruction + control-cluster correlation + jump-table decode + literal-correlation + submode-mapping decode + grayscale-map-picker correlation + extras/tutorial correlation + grayscale-generation correlation + RT3.lng top-level correlation + setup-asset correlation + sandbox-launch-flag correlation + load-map correction" 0x0047bc80,457,shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots,shell,thiscall,inferred,objdump + local disassembly,3,"Normalizes the live `Setup.win` payload row metadata before the shared non-file-backed panel consumes it. Outside editor-map mode `[0x006cec74+0x68] == 0`, the helper clears the static category-used table rooted at `0x005f2d28`, marks every already-nonzero payload category byte from `[payload+0x31a + row*9]`, counts the existing marker bytes across the four 10-byte local bands rooted at `[payload+0x2ca]`, and fills any remaining empty marker slots at `[payload+0x2c9 + n]` until the payload row count at `+0x3ae` is covered. On the multiplayer-preview side it also forces runtime profile dword `[0x006cec7c+0x83] = 7`. It then walks the row records again and, for any zero category byte at `[payload+0x31a + row*9]`, chooses the next unused category id using runtime profile dword `[0x006cec7c+0x83]`, the local marker-slot bytes at `[payload+0x2c9 + n]`, and a bounded retry loop before writing the chosen category back and marking the static-used table. Current grounded callers are the setup payload-copy helper at `0x0047be50` and the post-load chairman-profile builder at `0x00437220`, which makes this the shared category-byte and marker-slot normalizer beneath the setup payload panel rather than one world-only helper.","objdump + local disassembly + setup-payload correlation + category-table correlation + marker-slot correlation + caller split" 0x0047be50,69,shell_setup_profile_copy_payload_scroll_count_and_campaign_byte_and_seed_row_categories,shell,thiscall,inferred,objdump + local disassembly,3,"Copies the small shared-panel runtime fields out of one live `Setup.win` payload record into the staged runtime profile at `0x006cec7c`, then normalizes the payload row metadata. When the caller-supplied payload pointer is non-null and its first byte is nonzero, the helper copies payload word `+0x14` into profile `+0x77`, payload word `+0x3b2` into profile `+0x79`, payload word `+0x3ba` into profile `+0x7b`, and payload byte `+0x20` into profile `+0xc5`, except that the three word copies are skipped while the multiplayer-preview owner at `0x006cd8d8` is live. It then tail-calls `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80` on the same payload. Current grounded caller is `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`, which uses this helper immediately after the heavier payload-materialization lane at `0x00422400`.","objdump + local disassembly + setup-payload correlation + runtime-profile-field correlation + caller correlation" @@ -1662,13 +1781,16 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00421200,547,world_region_construct_entry_with_id_class_and_default_marker09_profile_seed,map,thiscall,inferred,objdump + local disassembly + caller xrefs + region-family correlation,3,"Concrete world-region record constructor beneath the region-collection allocator. The helper writes the new region id into `[region+0x23a]`, stores the caller-supplied class dword into `[region+0x23e]`, clears the broader cached metric, queue, and linked-structure bands through `[region+0x242..+0x385]`, allocates one `0x88`-byte profile collection into `[region+0x37f]`, copies shell gate `[0x006cec74+0x174]` into `[region+0x385]`, seeds the display-name buffer `[region+0x356]` from localized id `0x00cd`, then pushes literal stem `Marker09` into `0x00455b70` before rebuilding the default profile collection through `world_region_rebuild_profile_collection_and_seed_class_split_default_weights` `0x00420ed0`. The helper also initializes cached density or growth floats such as `[region+0x25a/+0x25e] = 100.0f`, `[region+0x256] = 10`, and `[region+0x31b] = 1.0f`. Current grounded caller is `world_region_collection_allocate_and_construct_entry` `0x00421660`.","objdump + local disassembly + caller xrefs + region-family correlation + default-profile correlation" 0x00421430,49,world_region_collection_construct,map,thiscall,inferred,objdump + caller xrefs + collection correlation,2,"Small constructor for the live world-region manager stored at `0x0062bae0`. The helper first re-enters base collection setup `0x00517ce0`, then installs vtable `0x005c9ae0`, clears reentrancy dword `[this+0x88]`, and tails into `0x00518570` for the remaining collection initialization. Current grounded caller is the broader world-side bootstrap strip at `0x004487db`, which allocates `0x90` bytes and stores the result into global region-collection root `0x0062bae0`.","objdump + caller xrefs + collection correlation + bootstrap correlation" 0x00421470,22,world_region_collection_destruct,map,thiscall,inferred,objdump + vtable scan + local disassembly + collection correlation,2,"Destructor-side companion to `world_region_collection_construct` `0x00421430`. The helper reinstalls vtable `0x005c9ae0`, re-enters `0x00518600`, and then tails into `0x00518bd0`. Current evidence grounds it as the small collection destructor for the live world-region manager rather than a broader bootstrap owner.","objdump + vtable scan + local disassembly + collection correlation" +0x00421510,197,world_region_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-family correlation,3,"Collection-wide tagged load owner for the live world-region manager at `0x0062bae0`. The helper opens chunk `0x5209`, refreshes collection-side metadata through `0x00518680`, opens chunk `0x520a`, then walks every live region record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each resolved record through vtable slot `+0x40` with the caller-supplied bundle or stream context. It closes with chunk `0x520b` and returns the accumulated tagged-load byte count. Current grounded caller is the broader world-state load branch at `0x00444887`, where it runs directly on `0x0062bae0` between neighboring tagged collection families, so this is the safest current read for the region-collection tagged load or refresh owner rather than the separate geographic-label database loader at `0x00461650` over `0x006ada80`.","objdump + caller xrefs + local disassembly + region-family correlation + chunk-family correlation" +0x004215e0,118,world_region_collection_serialize_records_into_tagged_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-family correlation,3,"Collection-wide tagged save owner for the live world-region manager at `0x0062bae0`. The helper emits chunk `0x5209`, forwards the current collection metadata through `indexed_collection_serialize_header_or_live_id_band` `0x00517d90`, emits chunk `0x520a`, then walks every live region record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each resolved record through vtable slot `+0x44` with the caller-supplied bundle or stream context. It closes with chunk `0x520b`. Current grounded caller is the broader tagged world-save branch at `0x0044577d`, where it runs directly on `0x0062bae0` beside neighboring tagged collection serializers, so this is the safest current read for the region-collection tagged save owner rather than the separate geographic-label database loader `0x00461650`.","objdump + caller xrefs + local disassembly + region-family correlation + chunk-family correlation" 0x00421660,144,world_region_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-family correlation,3,"Shared allocator wrapper for one live world-region record. The helper first seeds one stack-local scratch block through `0x0041f590`, allocates a new collection entry id through `0x00518900` with row size `0x389`, resolves that id through `0x00518140`, and then forwards the new region id plus the caller-supplied class and constructor arguments into `world_region_construct_entry_with_id_class_and_default_marker09_profile_seed` `0x00421200`. When the optional caller-supplied display-name pointer is nonnull it also copies up to `0x28` bytes into `[region+0x356]`, and before returning it sets world latch `[0x0062c120+0x2201] = 1`. Current grounded caller is `world_region_collection_seed_default_regions` `0x00421b60`, where it materializes the numbered default region set.","objdump + caller xrefs + local disassembly + region-family correlation + collection-allocation correlation" 0x00420410,167,world_region_refresh_profile_availability_summary_bytes_0x2f6_0x2fa_0x2fe,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small derived-summary refresh over the current region subcollection `[region+0x37f]`. The helper clears the three dword summary lanes `[region+0x2f6/+0x2fa/+0x2fe]`, walks every live profile entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, resolves the backing structure candidate by name through `0x00412b70`, and then inspects candidate bytes `[candidate+0xba]` and `[candidate+0xbb]`. When either byte is nonzero it sets `[region+0x2f6] = 1`; a nonzero `[candidate+0xba]` sets `[region+0x2fa] = 1`, while the complementary branch sets `[region+0x2fe] = 1`. Current grounded caller is the editor-side mutation helper `0x004206b0`, which runs this refresh after every profile add, remove, or weight update.","objdump + local disassembly + caller correlation + region-subcollection correlation + summary-byte correlation" +0x004204c0,155,world_region_refresh_profile_availability_display_strings_for_cached_selector_0x2f2,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Display-side companion to `world_region_refresh_profile_availability_summary_bytes_0x2f6_0x2fa_0x2fe` `0x00420410` over the current region subcollection `[region+0x37f]`. When the caller-supplied selector differs from cached dword `[region+0x2f2]`, the helper walks every live profile entry through `0x00517cf0/0x00518380/0x00518140`, resolves the backing structure candidate by name through `0x00412b70`, and for availability-qualified candidates formats one per-profile display string through `0x005a19c4` using format roots `0x005c93e8` or `0x005c93d8` chosen from candidate bytes `[candidate+0xba]` and `[candidate+0xbb]`. It then caches the selector back into `[region+0x2f2]`. Current grounded caller is the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40`, which reruns this helper after restoring each fixed `0x29`-byte region row and its paired profile subcollection.","objdump + local disassembly + caller correlation + region-subcollection correlation + display-string correlation + selector-cache correlation" 0x00421d20,246,world_region_collection_count_regions_with_profile_label_matching_candidate_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the live regions in the current region collection whose profile subcollection `[region+0x37f]` contains one label equal to the candidate-name string for the caller-supplied candidate id. The helper resolves that candidate name from the global candidate pool `0x0062b268`, lowercases its first byte through `0x0051d660` as a cheap prefilter, skips region records whose class dword `[region+0x23e]` is nonzero and whose companion availability count `[region+0x242]` is nonpositive, then walks each surviving region's profile entries through `0x0041f6a0` and `0x0041fac0` until a casefolded label match through `0x005a57cf` is found. It increments the region count once per matching region and returns that total. Grounded callers include the editor-side summary builders at `0x004cdd56` and `0x004d150e`.","objdump + local disassembly + caller correlation + region-profile correlation + editor-summary correlation" 0x00421e30,275,world_region_collection_resolve_nth_region_with_profile_label_matching_candidate_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Resolves the Nth live region in the current region collection whose profile subcollection `[region+0x37f]` contains one label equal to the candidate-name string for the caller-supplied candidate id. The helper uses the same first-byte lowercase prefilter and full casefolded compare as `0x00421d20`, skips nonzero-class regions whose `[region+0x242]` count is nonpositive, and increments one match counter once per region rather than once per profile row. When that counter reaches the caller-supplied 1-based ordinal, it returns the matching region record pointer; otherwise it returns null. Current grounded caller is the editor-side enumerator at `0x004cdeab`, which immediately formats the returned region name for display.","objdump + local disassembly + caller correlation + region-profile correlation + editor-summary correlation" 0x00422010,155,world_region_collection_resolve_nearest_class0_region_id_covering_normalized_rect,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Scans the live region collection for class-0 region records whose normalized primary and secondary coordinates fall inside the caller-supplied inclusive float bounds, refreshes a small region-local helper through `0x00455a70(0)` on each in-bounds candidate, and keeps the nearest matching region id `[region+0x23a]` by squared XY distance through `math_measure_float_xy_pair_distance` `0x0051db80`. The helper returns `0` when no class-0 region lies inside the supplied rectangle. Current grounded callers include the world-side selection branch at `0x00452658`, where integer world arguments are converted to floats before the query, and the small string wrapper `0x004220b0`.","objdump + local disassembly + caller correlation + region-distance correlation" 0x004220b0,73,world_region_collection_query_name_of_nearest_class0_region_covering_normalized_rect_or_default,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small wrapper above `world_region_collection_resolve_nearest_class0_region_id_covering_normalized_rect` `0x00422010`. When the inner query returns a live region id, the helper resolves that region and returns name pointer `[region+0x356]`; otherwise it copies the fallback localized string `0x00d0` into global scratch buffer `0x0062ba90` and returns that buffer instead. Grounded callers include the early world-status formatter `0x00401815`, the later world-side branch `0x00411c41`, and the terrain-side formatter at `0x004f2b97`.","objdump + local disassembly + caller correlation + region-name correlation" -0x00422100,543,world_region_collection_pick_periodic_candidate_region_and_queue_scaled_event_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Periodic region-side selector reached from `simulation_service_periodic_boundary_work` `0x0040a590`. The helper first requires several live world-state gates to be clear, derives one year-sensitive random threshold from selected-year fields `[world+0x05/+0x0d/+0x0f]` plus live world width `[world+0x2155]`, and returns immediately unless one bounded random test passes. On the active path it scans the live region collection twice. The first pass counts eligible class-0 regions whose transient dwords `[region+0x276]` and `[region+0x302]` are clear and which fail the city-connection peer probe `0x00420030(1,1,0,0)`. The second pass picks one random eligible region, derives one small severity bucket from cached scalar `[region+0x25e]`, stores the resulting scaled amount into `[region+0x276]`, and appends one 0x20-byte queued record through `0x004337c0` with literal kind `7`, the chosen region id `[region+0x23a]`, the scaled amount, sentinel dwords `-1/-1`, and fixed payload `0x005c87a8`. The exact gameplay label for that queued record is still open, so the current name stays structural around the periodic class-0 region pick plus queued scaled event record.","objdump + local disassembly + caller correlation + periodic-maintenance correlation + queued-record correlation" +0x00422100,543,world_region_collection_pick_periodic_candidate_region_and_queue_region_focus_modal_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Periodic region-side selector reached from `simulation_service_periodic_boundary_work` `0x0040a590`. The helper first requires several live world-state gates to be clear, derives one year-sensitive random threshold from selected-year fields `[world+0x05/+0x0d/+0x0f]` plus live world width `[world+0x2155]`, and returns immediately unless one bounded random test passes. On the active path it scans the live region collection twice. The first pass counts eligible class-0 regions whose transient dwords `[region+0x276]` and `[region+0x302]` are clear and which fail the city-connection peer probe `0x00420030(1,1,0,0)`. The second pass picks one random eligible region, derives one small severity bucket from cached scalar `[region+0x25e]`, stores the resulting scaled amount into `[region+0x276]`, and appends one `0x20`-byte queued record through `0x004337c0` with fixed payload `0x005c87a8`, literal kind `7`, zero promotion-latch dword `[node+0x0c]`, the chosen region id `[node+0x10]`, that scaled amount at `[node+0x14]`, and sentinel tails `-1/-1` in `[node+0x18/+0x1c]`. Kind `7` is now tighter than a generic queued-effect lane: `simulation_dispatch_runtime_effect_queue_record_by_kind_into_shell_or_world_handlers` `0x00437c00` routes it into `shell_open_region_focus_modal_and_center_world_on_confirmed_region` `0x004c7520`, which opens a callback-driven custom modal and recenters the live world on the chosen region after confirmation. So the current strongest read is a periodic class-0 region picker that queues one region-focus modal record rather than an anonymous scaled event node.","objdump + local disassembly + caller correlation + periodic-maintenance correlation + queued-record correlation + kind-7-modal correlation" 0x00421f50,181,world_region_collection_refresh_position_triplet_for_class0_regions_inside_normalized_rect,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Scans the current live region collection for class-0 records whose normalized primary and secondary coordinates fall inside the caller-supplied inclusive float rectangle, then refreshes each qualifying region's current-position triplet through `runtime_object_publish_current_position_triplet_with_height_bias` `0x00455a70(0)`. The helper performs no further aggregation and simply walks the surviving records through the live region collection interfaces `0x00517cf0/0x00518380/0x00518140`. Current grounded caller is the rectangle-side height-support owner `0x0044d410`, where this acts as one dependent region refresh across the updated work window rather than a broader collection rebuild.","objdump + local disassembly + caller correlation + region-rectangle correlation" 0x00421700,32,world_region_collection_remove_entry_by_id_release_record_and_erase_id,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the live world-region manager. The function resolves the caller-supplied region id through `0x00518140`, releases the resulting record through `world_region_release_profile_collection_clear_linked_structure_site_chain_and_tail_base_cleanup` `0x00420670`, and then removes that id from the current collection through `0x00518a30`. Current evidence grounds this as the collection-owned remove-and-release wrapper for the world-region family rather than a wider rebuild pass.","objdump + local disassembly + collection-layout correlation + region-family correlation" 0x00421730,560,world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids,map,thiscall,inferred,objdump + local disassembly + caller inspection + region-correlation,3,"Region-side world-grid finalizer beneath the default region seeding path. The helper first clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the full live world raster using dimensions `[world+0x214d/+0x2151]`. It then seeds each live region entry with default bounds and helper fields `[region+0x242/+0x24e/+0x252] = 0` and `[region+0x246/+0x24a] = 0x270f`, and for every class-0 region computes one square neighborhood around the region center from `[region+0x256]`, `0x00455800`, and `0x00455810`. Within that bounded cell rectangle it evaluates one distance-like score through `0x0051dbb0` and writes the current region id `[region+0x23a]` into the per-cell word when the slot is empty or when the current region beats the previously assigned region on the same score. Current grounded callers are `world_region_collection_seed_default_regions` `0x00421b60` and the broader world-build path around `0x004476ec`, so this is the safest current read for clearing and repopulating the world-cell region-id raster rather than a generic collection sweep.","objdump + local disassembly + caller inspection + region-correlation + raster-assignment correlation" @@ -1689,7 +1811,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00480bb0,1535,placed_structure_refresh_linked_site_display_name_and_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Single-site post-create or post-edit refresh helper reached from `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10` when the current placed structure keeps one linked site id at `[this+0x2a8]`. The helper operates on that linked placed-structure record, optionally rebuilds one route-entry anchor at `[this+0x08]` through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` with both optional endpoint-entry ids unset and literal policy byte `2`, then binds the chosen route entry back to the site through `0x0048abc0` and re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0` so the auxiliary tracker family at `0x006cfcb4` can regroup around the refreshed anchor. Current caller correlation makes that byte the strongest current match for the broader linked-site route-anchor rebuild lane, as opposed to the narrower direct endpoint-anchor creation or replacement lane that neighboring repair branches drive through literal byte `1` into `0x00493cf0`. It also rebuilds the display-name buffer at `[this+0x46b]`: when the current site coordinates resolve a city or region entry through `0x0044a830` it copies that entry name from `[entry+0x356]`, optionally appends one civic suffix from RT3.lng ids `585..588` `Township`, `New`, `Modern`, and `Renaissance`, and on special linked-instance class branches appends `589` `Service Tower` or `590` `Maintenance Facility` with per-city counters instead. When no city entry resolves it falls back to `591` `Anytown`. The ordinary non-special branch also rotates through RT3.lng ids `578..584` `Junction`, `Crossing`, `Depot`, `Corners`, `Exchange`, `Point`, and `Center` via the static table at `0x005f2cf8`. After trimming trailing spaces it conditionally re-enters `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` when the narrower station-or-transit gate `0x0047fd50` passes, clears or seeds adjacent city-side cached state through `0x004358d0` and `0x00420650`, and returns. Current direct caller is `0x0040f626`, so this now looks like the linked-site display-name and route-anchor refresh beneath placed-structure finalization rather than another city-connection owner.","objdump + caller xrefs + callsite inspection + RT3.lng strings + route-anchor correlation + linked-site refresh correlation + linked-site policy-byte split correlation + tracker-regrouping correlation" 0x00481390,55,placed_structure_collection_allocate_and_construct_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Small allocator wrapper over the live placed-structure collection at `0x006cec20`. The helper allocates one fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then hands the new id plus the caller-supplied anchor site id and coordinate pair into `placed_structure_construct_linked_site_record_from_anchor_and_coords` `0x00480210`. Current direct caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, where the returned id is published into `[site+0x2a8]` when the backing candidate subtype byte `[candidate+0x32]` is `1`. This is the allocator wrapper for the linked-site records used by the later policy-`1` and policy-`2` route-anchor refresh families rather than another anonymous collection helper.","objdump + caller xrefs + constructor inspection + linked-site correlation" 0x004813d0,91,placed_structure_collection_remove_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one linked-site record from the live placed-structure collection. The helper resolves the supplied site id through `0x006cec20`, derives one station-or-transit or linked-instance-class latch through `0x0047de00 -> 0x0040c990`, runs `placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, and then removes the collection entry through `0x00518a30`. When scenario field `[0x006cec78+0x4c93]` is clear and the removed record passed the narrower latch, it also re-enters the company-wide follow-on at `0x00429c10`. Current direct caller is the subtype-`1` destruction path around `0x0040f626`.","objdump + caller xrefs + callsite inspection + linked-site removal correlation" +0x00481210,245,placed_structure_collection_refresh_dynamic_side_buffers_from_tagged_bundle,map,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the variable-size side buffers on placed-structure records in `0x006cec20`. The helper first reads one four-byte subtag selector from the caller bundle through `0x00531150`, refreshes collection-side metadata through `0x00518680` with size `0x465` only when that selector is `0x4a39`, opens tag `0x4a3a`, and then walks every live placed-structure record through the indexed-collection accessors. The loop body branches on the incoming subtag selector: when it is `0x4a39` it copies the live six-byte route-entry list root at `[site+0x462]` back into the earlier scratch band at `[site+0x2ba]` and clears the later side-buffer bands `[site+0x2ba..+0x389]`, `[site+0x38e..+0x5c9]`, and `[site+0x5ca..]` before re-entering `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0`; the helper closes the tag family through `0x4a3b` on exit. Current grounded caller is the world-entry bringup branch at `0x004444d8`, immediately before the linked-route-object tagged load lane. This is the safest current read for the placed-structure dynamic-side-buffer tagged load owner rather than a post-load stream-only refresh pass.","objdump + local disassembly + caller correlation + tag-family correlation + side-buffer-layout correlation" 0x00481430,72,placed_structure_collection_load_dynamic_side_buffers_from_stream,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-level load pass for the variable-size side buffers on placed-structure records. When the shell or world-side stream slot at `[0x006cec74+0x1c7]` is present, the helper walks the live placed-structure collection at `0x006cec20`, resolves each record by id, and re-enters `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0` on it. Current direct caller is the wider post-load world-side refresh path at `0x00433b93`.","objdump + caller xrefs + callsite inspection + stream-load correlation" +0x00481310,118,placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle,map,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged save owner for the variable-size side buffers on placed-structure records in `0x006cec20`. The helper emits tag family `0x4a9d/0x4a3a/0x4a3b` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, then walks every live placed-structure record through the indexed-collection accessors before dispatching each record into `placed_structure_serialize_dynamic_side_buffers_into_tagged_bundle` `0x0047da40`. Current grounded caller is the early package-save prelude at `0x004453ca`, immediately before the linked-route-object tagged save lane. This is the safest current read for the placed-structure dynamic-side-buffer tagged save owner rather than a lower per-record serializer.","objdump + local disassembly + caller correlation + tag-family correlation + side-buffer-layout correlation" 0x00481480,64,placed_structure_collection_append_site_into_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to consider one caller-supplied peer site for proximity-bucket insertion. The helper resolves each live record and re-enters `placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0` with the supplied peer placed-structure pointer. Current direct callers are the subtype-`4` update paths at `0x0040ec73` and `0x0040fa11`, so this now reads as the add-peer sweep for the nearby-site bucket family rather than another generic collection iterator.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation" 0x004814c0,64,placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to remove one caller-supplied site id from its proximity buckets. The helper resolves each live record and re-enters `placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10` with the supplied site id. Current direct callers are the subtype-`4` pre-update or pre-destroy paths at `0x0040e0a2` and `0x0040ebc7`.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation" 0x00429c10,88,company_collection_refresh_active_company_linked_transit_site_peer_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide company sweep above the linked-transit peer cache family. The helper first counts the active companies in the live company collection at `0x0062be10` by testing `[company+0x3f]`, then walks that active ordinal range through `company_collection_get_nth_active_company_id` `0x00429a90` and re-enters `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each resolved company record. Current grounded callers are the linked-site removal follow-on at `0x00481421` and the wider world-side company refresh branch at `0x00444c9c`.","objdump + caller xrefs + callsite inspection + active-company sweep correlation" @@ -2739,6 +2863,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00552fa0,65,shell_map_bundle_codec_context_write_bytes_to_allocated_output,shell,fastcall,inferred,objdump + caller inspection + local disassembly,2,"Callback-side write helper paired with `0x00552f30` under the same map-bundle codec wrappers. The helper resolves the active destination slab from global context `0x00d93984`, copies the caller byte span from `ECX` into `[ctx+0x0c] + [ctx+0x10]`, clamps against destination capacity `[ctx+0x14]`, advances the written-byte counter `[ctx+0x10]`, and returns. Current grounded callers are the same `0x0056be10/0x0056bfe0` and `0x0056c3e0/0x0056c630` codec families, which use this as their shared sink callback rather than a broad stream writer.","objdump + caller inspection + local disassembly + callback correlation + bundle-codec correlation" 0x00553000,277,shell_map_bundle_encode_payload_with_selector_0x91_or_0x92_into_allocated_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Bundle-side encode wrapper for the two callback-stream codec families used by the companion-payload and tagged-surface rewrite paths. The helper allocates one destination slab sized to source bytes `[src+0x10] + 0x10`, seeds the shared callback context at `0x00d93984`, then dispatches selector `[this+0x00] == 0x91` to `0x0056bfe0` or selector `0x92` to `0x0056c3e0` using the context callbacks `0x00552f30/0x00552fa0`. On success it publishes the allocated destination pointer and used byte count; on failure it frees the slab and returns one negative status. Current grounded callers are the companion-payload rewrite owners `0x004427c0/0x00442900`, the preview transport submitter `0x00469d30`, and the tagged surface-row exporter `0x005428c0`.","objdump + caller inspection + local disassembly + bundle-codec correlation + companion-payload correlation + tagged-surface correlation" 0x00553120,277,shell_map_bundle_decode_payload_with_header_0x91_or_0x92_into_allocated_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Bundle-side decode wrapper paired with `0x00553000`. The helper validates leading magic `0xbabe`, allocates the destination slab from stored decoded-size dword `[record+0x08]`, seeds shared callback context `0x00d93984`, and dispatches codec word `[record+0x0e] == 0x91` to `0x0056be10` or `0x92` to `0x0056c630` using the same context callbacks `0x00552f30/0x00552fa0`. On success it publishes the allocated output pointer and decoded byte count; on failure it frees the slab and returns one negative status. Current grounded caller is `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` `0x00541c30`, which uses this wrapper to recover the tagged bands before repacking them into the live row.","objdump + caller inspection + local disassembly + bundle-codec correlation + tagged-payload correlation + callback correlation" +0x00553760,665,world_serialize_fixed_grid_header_mask_planes_secondary_raster_and_overlay_chunks_into_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-tag correlation,4,"Broader fixed-band save owner beneath `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`. The helper first derives one companion resource stem from the caller path, chooses one of two literal suffixes from shell flag `[0x006d4024+0x11471a]`, and forwards that derived stem plus the caller selector into `0x00534c80`. It then emits chunk family `0x2af9/0x2afa/0x2afc` for the primary world-size and float-grid band rooted at `[this+0x15d9/+0x15d5/+0x1605]`, chunk family `0x2ced/0x2cee/0x2d51/0x2d4a/0x2cf2/0x2cf3/0x2afd` for the one-byte mask and secondary-raster companion planes rooted at `[this+0x1655/+0x1659/+0x165d/+0x1661/+0x1665/+0x162d]`, and then walks the coarse overlay-chunk table `[this+0x1685]` in `16x16` blocks, writing one presence byte per chunk and serializing each present chunk through `secondary_overlay_chunk_serialize_header_and_present_local_pages_to_stream` `0x0056b510`. It closes that coarse-chunk phase with tags `0x2afe` and `0x2b02`. Current grounded caller is the early package-save branch inside `0x00449520`, so this is the safest current read for the fixed grid-header, mask-plane, secondary-raster, and coarse-overlay-chunk serializer rather than a generic path helper.","objdump + caller inspection + local disassembly + bundle-tag correlation + coarse-overlay correlation + mask-plane correlation" 0x0051db80,32,math_measure_float_xy_pair_distance,support,cdecl,inferred,objdump + caller xrefs + callsite inspection,4,"Tiny shared float distance helper. It subtracts one caller-supplied X or Y point pair from the other, squares both deltas, sums them, and returns the Euclidean distance `sqrt(dx*dx + dy*dy)`. Current grounded callers include the city-connection chooser at `0x00402cb0`, the route-entry search family at `0x0049bd40` and `0x0049d380`, several company and world-side scoring branches, and shell presentation helpers such as `shell_queue_projected_world_anchor_quad` `0x00552900`. This now grounds `0x0051db80` as a generic float XY distance primitive rather than another opaque quality helper.","objdump + caller xrefs + callsite inspection + arithmetic inspection" 0x0051dbb0,32,math_measure_float_xy_pair_distance_squared,support,cdecl,inferred,objdump + caller xrefs + arithmetic inspection,4,"Tiny squared-distance sibling of `math_measure_float_xy_pair_distance` `0x0051db80`. It subtracts one caller-supplied float X or Y pair from the other, squares both deltas, sums them, and returns that raw squared Euclidean distance without the final `sqrt`. Current grounded callers include the region-cell nearest-assignment pass `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730` and the weighted auxiliary route-entry tracker metric family around `0x004a5280`, where the unsquared ordering is enough and the exact root would be wasted work. This now grounds `0x0051dbb0` as the generic float XY squared-distance primitive rather than another opaque scoring helper.","objdump + caller xrefs + arithmetic inspection + squared-distance correlation" 0x0051dbe0,32,math_measure_int_xy_pair_distance_squared,support,fastcall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Small integer squared-distance helper. It takes one integer XY pair in `ECX/EDX`, subtracts the caller-supplied comparison pair from the stack, squares both integer deltas, sums them, and returns that raw squared distance without `sqrt`. Current grounded callers include `company_query_min_linked_site_distance_to_xy` `0x00405920`, where it ranks linked sites before the winning integer distance is later converted back to `float`, so the safest current read is a compact integer XY squared-distance primitive rather than another gameplay-specific metric.","objdump + caller xrefs + arithmetic inspection + company-distance correlation" @@ -3172,7 +3297,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00592a70,109,multiplayer_transport_probe_or_enqueue_route_record,shell,cdecl,inferred,ghidra-headless,2,"Small route-probe or deferred route-record wrapper over `multiplayer_transport_enqueue_opcode_record`. It first calls `multiplayer_transport_is_route_mode_active_nonterminal` and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode-`1` record built from the caller callback and payload fields. Current grounded callers now show the staged work-record triplet more concretely as `(callback fn @ +0x10, callback companion @ +0x18, drain context id @ +0x0c)` with extra route-mode control bytes layered on top, and the final dword again aligned to the shared `0x5934c0`-seeded drain context used by the deferred path.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation" 0x00592ae0,111,multiplayer_transport_enqueue_descriptor_block_record,shell,cdecl,inferred,objdump + local disassembly,3,"Copies one caller-supplied seven-dword descriptor-block payload into a local `0x1c` buffer and enqueues it through `multiplayer_transport_enqueue_opcode_record` `0x5928a0` as opcode `2`. The deeper opcode-`2` initializer family rooted at `0x591410/0x591470/0x591480` now bounds that payload more tightly: it stores dwords `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` verbatim and duplicates the optional string pointer at `+0x08` into owned heap storage. Current grounded callers are now broader than the earlier callback-registration-only note: the helper is also the enqueue tail beneath `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`, where live mode supplies a populated descriptor payload but replay modes `3/5` intentionally pass an all-zero seven-dword payload while reusing separate sidecar metadata slots from the cached work record.","objdump + local disassembly + opcode-record table correlation + descriptor-block initializer correlation + capacity-descriptor correlation" 0x00592b50,226,multiplayer_transport_enqueue_field_snapshot_record,shell,cdecl,inferred,ghidra-headless,3,"Builds and enqueues one field-snapshot transport record through `multiplayer_transport_enqueue_opcode_record` using opcode `3` and a `0x14`-byte payload. Depending on the caller mode it can first remove prior matching entries through `0x5929f0`, then normalizes the `hostname` field against `(No Name)`, samples the `gamemode` field and compares it against `openstaging`, computes one 0-to-100 progress percentage from cached progress slot `[this+0x1774]` plus counters `[this+0x1734]` and `[this+0x1740]` and the current active descriptor count under `[this+0xba4]`, and packages the subscribed callback pointers from `[this+0x176c]` and `[this+0x1770]`. Current grounded caller `0x596500` seeds `[this+0x1774]` to `1` immediately before the first mode-`3` snapshot under `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`.","ghidra + rizin + llvm-objdump + strings + local disassembly + caller inspection" -0x00593330,57,multiplayer_transport_construct_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,3,"Constructs the transient transport work-record collection at `[this+0x1780]`. It clears counters `[this+0x1784]` and `[this+0x1788]`, allocates one vector-like owner through `0x59e0b0` using cleanup shim `0x5932f0`, stores the resulting collection root at `[this+0x1780]`, and returns success when that root is nonnull.","objdump + local disassembly + work-queue correlation" +0x00593330,57,multiplayer_transport_construct_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,3,"Constructs the transient transport work-record collection at `[this+0x1780]`. It clears the queued and completed counters `[this+0x1784]` and `[this+0x1788]`, allocates one vector-like owner through `0x59e0b0` using cleanup shim `0x5932f0`, stores the resulting collection root at `[this+0x1780]`, and returns success when that root is nonnull.","objdump + local disassembly + work-queue correlation" 0x00593370,16,multiplayer_transport_clear_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Thin clearer for the transient transport work-record collection rooted at `[this+0x1780]`. When that collection exists it tailcalls the generic clear helper `0x59e4b0`; otherwise it returns immediately.","objdump + local disassembly + work-queue correlation" 0x00593380,30,multiplayer_transport_destroy_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the transient transport work-record collection rooted at `[this+0x1780]`. When the collection exists it destroys that vector owner through `0x59e330`, then clears `[this+0x1780]` to null.","objdump + local disassembly + work-queue correlation" 0x005933a0,83,multiplayer_transport_remove_queued_work_record_by_pointer,shell,thiscall,inferred,objdump + local disassembly,3,"Scans the transient transport work-record collection at `[this+0x1780]` for one exact record-pointer match and removes that vector slot through `generic_vector_remove_index` `0x59e3d0`. Successful removal also increments the released-or-completed work counter at `[this+0x1788]`. Current grounded callers include the callback-table binding result helper `0x593570`, route-binding release `0x595620`, and the names or bound-route or selector-text completion lanes when they drop stale or finished work records.","objdump + local disassembly + caller inspection + work-queue correlation" @@ -3197,12 +3322,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00593200,78,multiplayer_transport_enqueue_callback_slot28_record,shell,cdecl,inferred,objdump + local disassembly,2,"Gated callback-slot wrapper that enqueues one `0x10`-byte opcode `28` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are `multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28` `0x59fbd0` and its helper `0x596b90`.","objdump + local disassembly + caller inspection" 0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump 0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,"Gated callback-slot wrapper that enqueues one `0x08`-byte opcode `16` record through `multiplayer_transport_enqueue_opcode_record` when byte `[this+0x17ac]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded caller `0x59f440` forwards the staged route-callback payload handle from `[this+0xb50]` together with fixed text at `0x00db9dd8` through this lane just before `multiplayer_transport_set_route_mode` forces mode `5`, so slot `16` is no longer just an abstract callback-slot wrapper.","ghidra + rizin + llvm-objdump + caller inspection" +0x00593280,30,multiplayer_transport_enqueue_fixed_selector_0x1f_opcode16_record,shell,cdecl,inferred,objdump + local disassembly + enqueue-caller correlation,2,"Tiny queue-submit shim over `multiplayer_transport_enqueue_opcode_record` `0x5928a0`. It forwards caller payload in `EAX`, owner context `[this+0x17f8]`, fixed selector `0x1f`, queue class `1`, and opcode `0x10`, then returns the common enqueue result. Current local shape bounds this as the fixed-selector opcode-`0x10` submit lane rather than a generic route helper.","objdump + local disassembly + enqueue-caller correlation" +0x005932a0,64,multiplayer_transport_enqueue_bound_route_mode_snapshot_opcode4_if_live,shell,cdecl,inferred,objdump + local disassembly + route-mode correlation,3,"Route-mode change notification shim for the bound-route branch rooted at `[this+0x1ec8]`. When one bound route still exists and carries both callback payload pointer `[route+0x10]` and companion owner dword `[route+0x18]`, the helper snapshots the current route mode from `[this+0x18b8]` into one local dword and forwards it through `multiplayer_transport_enqueue_opcode_record` `0x5928a0` with opcode `4`, queue class `1`, fixed selector `0x21`, owner context `[this+0x17f8]`, callback payload pointer `[route+0x10]`, callback companion dword `[route+0x18]`, and route-local discriminator dword `[route+0x0c]`. If the bound route or its callback payload pointer is absent it returns without enqueuing anything. Current grounded caller is `multiplayer_transport_set_route_mode` `0x595650`, which uses this only when the stored route mode actually changes.","objdump + local disassembly + route-mode correlation + enqueue-caller correlation" +0x005932f0,56,multiplayer_transport_release_work_record_callback_payloads_and_optional_socket_handle,shell,cdecl,inferred,objdump + local disassembly + work-record lifecycle correlation,2,"Destructor-style release callback for the transport work-record family. It releases three owned callback payload pointers from fields `+0x20`, `+0x24`, and `+0x08` through `0x58f3c0`, then when presence flag `[record+0x34]` is nonzero it closes the optional socket handle in `[record+0x2c]` through `closesocket` and `0x58f490`, and finally tail-calls `0x58f3c0` on the work record object itself. Current grounded caller is the work-record collection constructor `0x593330`, which installs this as the collection release callback for records stored in `[transport+0x1780]`.","objdump + local disassembly + work-record lifecycle correlation" 0x0059f2e0,64,multiplayer_transport_is_selector_control_line,shell,cdecl,inferred,objdump,2,"Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes.","objdump + caller xrefs + strings" 0x0059f320,131,multiplayer_transport_split_selector_payload_token_and_tail,shell,cdecl,inferred,objdump,2,"Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`.","objdump + caller xrefs + strings" 0x0059f5e0,111,multiplayer_transport_sync_selector_view_nfo_r_flag,shell,cdecl,inferred,objdump,3,"Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot.","objdump + caller xrefs + strings" 0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump -0x005934e0,130,multiplayer_transport_allocate_and_enqueue_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Allocates one zeroed `0x3c` transient transport work record and appends it into the work collection at `[this+0x1780]`. The helper stores the owner transport pointer at `+0x00`, caller-supplied type and metadata dwords at `+0x04`, `+0x08`, `+0x0c`, `+0x10`, and `+0x18`, clears bookkeeping field `+0x20` and stale latch `+0x38`, inserts the finished pointer through `generic_vector_push_back` `0x59e4d0`, and increments `[this+0x1784]` on success. Current grounded callers include callback-table descriptor attach, bound-route request submission, selector-text route request submission, and the type-`9` text fastpath. The wider caller set now proves one stronger boundary on the metadata triplet itself: these three dwords are shared transport wrapper metadata reused across type `0/1/2/9` work records, not one capacity-only or route-only cache tuple. Current direct consumers now bound that triplet more concretely as `drain context id @ +0x0c`, deferred callback function pointer @ `+0x10`, and callback companion or context @ `+0x18`; the callback-table lane still gives the cleanest concrete subcase because it intentionally duplicates the same caller metadata dword into both `+0x0c` and `+0x18` while preserving the callback pointer in `+0x10`.","objdump + local disassembly + caller inspection + work-queue correlation + metadata-triplet correlation + cross-type work-record correlation + callback-dispatch correlation" -0x00593570,160,multiplayer_transport_publish_callback_table_binding_result_and_release_work_record,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Consumes one transient callback-table attach work record. It resolves the owner transport from work field `+0x00`, conditionally downgrades a nominal success when the current live transport probe through `0x58d7e0/0x58d810` fails, clears in-flight latch `[transport+0x44]`, and stores the final boolean result into `[transport+0x48]`. On the success branch it also stamps tick field `[transport+0x50]`, refreshes the local transport name buffer at `[transport+0x04]` from `multiplayer_transport_query_current_local_name_or_fallback_sample` `0x58e630`, and then republishes the staged metadata triplet through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40` using work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` together with the final boolean result in `EDX`. The failure tail sends that same opcode-`1` callback trigger with zero result and additionally arms deferred reset latch `[transport+0x1edc]`. The helper always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`.","objdump + local disassembly + caller inspection + callback-binding correlation + work-queue correlation + callback-triplet correlation + opcode-table correlation" +0x005934e0,130,multiplayer_transport_allocate_and_enqueue_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Allocates one zeroed `0x3c` transient transport work record and appends it into the work collection at `[this+0x1780]` when that collection exists. The helper stores the owner transport pointer at `+0x00`, caller-supplied type and metadata dwords at `+0x04`, `+0x08`, `+0x0c`, `+0x10`, and `+0x18`, clears bookkeeping field `+0x20` and stale latch `+0x38`, inserts the finished pointer through `generic_vector_push_back` `0x59e4d0`, and increments the queued-work counter `[this+0x1784]` on success. Current grounded callers include callback-table descriptor attach, bound-route request submission, selector-text route request submission, and the type-`9` text fastpath. The wider caller set now proves one stronger boundary on the metadata triplet itself: these three dwords are shared transport wrapper metadata reused across type `0/1/2/9` work records, not one capacity-only or route-only cache tuple. Current direct consumers now bound that triplet more concretely as `drain context id @ +0x0c`, deferred callback function pointer @ `+0x10`, and callback companion or context @ `+0x18`; the callback-table lane still gives the cleanest concrete subcase because it intentionally duplicates the same caller metadata dword into both `+0x0c` and `+0x18` while preserving the callback pointer in `+0x10`.","objdump + local disassembly + caller inspection + work-queue correlation + metadata-triplet correlation + cross-type work-record correlation + callback-dispatch correlation" +0x00593570,160,multiplayer_transport_publish_callback_table_binding_result_and_release_work_record,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Consumes one transient callback-table attach work record. It resolves the owner transport from work field `+0x00`, conditionally downgrades a nominal success when the current live transport probe through `0x58d7e0/0x58d810` fails, clears in-flight latch `[transport+0x44]`, and stores the final boolean result into `[transport+0x48]`. When validation fails it also clears `[transport+0x48]`, arms deferred reset latch `[transport+0x1edc]`, and still falls through into the same replay path. On the success branch it stamps the current route scalar from `0x58f450` into `[transport+0x50]`, refreshes the local transport name buffer at `[transport+0x04]` from `multiplayer_transport_query_current_local_name_or_fallback_sample` `0x58e630`, and then republishes the staged metadata triplet through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40` using work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` together with the final boolean result in `EDX`. The helper always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`, which increments completed-work counter `[transport+0x1788]` on successful removal.","objdump + local disassembly + caller inspection + callback-binding correlation + work-queue correlation + callback-triplet correlation + opcode-table correlation" 0x00593610,25,multiplayer_transport_worker_callback_enqueue_opcode5_binding_record_from_work_triplet,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small worker-side callback shim used by the callback-table attach owner `0x593650`. It loads the staged work-record metadata dwords at `+0x0c` and `+0x18` from the caller work record, pushes those together with the incoming callback result token, resolves the owner transport from work field `+0x00`, and then forwards the assembled triplet into `multiplayer_transport_enqueue_callback_binding_record` `0x592c40`. This is the clean enqueue-side worker callback in the attach pair chosen from transport field `[this+0x4c]`.","objdump + local disassembly + caller inspection + callback-binding correlation + work-record-triplet correlation" 0x00593630,23,multiplayer_transport_worker_callback_store_route_scalar_and_forward_into_0x597780,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Second worker-side callback shim used by the callback-table attach owner `0x593650`. It resolves the owner transport from work field `+0x00`, stores incoming scalar `EDX` into transport field `[transport+0x54]`, pushes companion dword `[transport+0x5c]`, and then forwards the caller text/buffer pointer together with that companion into `0x597780`. Current evidence grounds this as the route-scalar store plus format-or-forward sibling of `0x593610`, while the exact higher semantic role of `0x597780` remains open.","objdump + local disassembly + caller inspection + callback-binding correlation + route-scalar correlation" 0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings @@ -3250,8 +3378,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00595440,98,multiplayer_transport_init_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.,ghidra + rizin + llvm-objdump + strings 0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump 0x005955a0,125,multiplayer_transport_reset_all_selector_slots_and_clear_probe_marker_bands,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Bulk selector-reset owner for the outer session-event transport. The helper walks all three selector slots, and for each slot either tears the current selector object down through `multiplayer_transport_reset_selector_slot` `0x5954b0` or directly clears the slot-active or generation dwords, slot-local sample buffer, and fixed selector-text buffer rooted at `[this+0x80]`, `[this+0x384]`, `[this+0x390]`, and `[this+0x39c]`. Slot `2` also forces the route-side cleanup tail through `0x5965d0(0)`, `multiplayer_transport_release_status_route` `0x597350` when the status-route latch is already clear, `multiplayer_transport_clear_staged_route_callback_payload` `0x5962c0`, the route-status pump `0x5951f0`, and the selector callback-name service owner `0x596900`, while slot `1` additionally clears `[this+0x9a8]`. After the full sweep the helper clears the shared probe-marker byte at `[this+0x9ac]`. Current grounded caller is the common runtime-reset strip `0x58d810`.","llvm-objdump + local disassembly + caller correlation + selector-slot correlation + route-side cleanup correlation" -0x00595620,35,multiplayer_transport_release_route_binding,shell,cdecl,inferred,ghidra-headless,3,Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].,ghidra + rizin + llvm-objdump -0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Main route-mode state machine for the session-event transport. When one bound route still exists at `[this+0x1ec8]`, the helper first takes a pre-dispatch gate: requested mode `2` with no selector-`2` owner at `[this+0x398]` submits one bound-route status request through `0x5959e0`, and on failure immediately rewrites the target mode to `0` or `1` according to deferred route-state latch `[this+0x1ed4]`. After that gate it stores the requested mode in `[this+0x18b8]` and notifies `0x5932a0` on change, then runs one of six concrete branches. Mode `0` refreshes selector-route side effects through `0x5973b0`, resets selector slot `2`, tries to reopen the `gsi_am_rating` callback-table family through `0x596530`, and then falls back to mode `0` or `2` according to deferred route-status flag `[this+0x1ed8]`. Mode `1` conditionally reopens the same am-rating family and, when no live route exists at `[this+0x1ecc]`, tries to connect the status route through `0x597480`, falling back to mode `0` or `1` according to `[this+0x1ed4]`. Mode `2` ensures selector-route state is current, resets the am-rating route family through `0x596060`, and when status latch `[this+0xb40]` remains live with no live route present tries `0x597480`, promoting success into mode `1`. Mode `3` resets the am-rating family, refreshes selector-route state, resets selector slot `2`, and releases the current route binding through `0x595620`. Mode `4` is the narrow recovery branch that only retries `0x597480` when status latch `[this+0xb40]` is live and no live route exists. Mode `5` resets the am-rating family, refreshes selector-route state, and releases the current route binding without the selector-slot reset. The stable transitions therefore converge through route-table reset or reopen, status-route connect, selector-slot-`2` reset, and route-binding release rather than through in-place mutation of the live route object's callback slots.","objdump + local disassembly + caller inspection + route-mode correlation + status-route correlation + am-rating-owner correlation" +0x00595620,35,multiplayer_transport_release_current_route_binding_detach_descriptor_callback_and_clear_slot,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small route-binding teardown helper beneath route-mode branches `3` and `5`. The helper first detaches the current binding callback or descriptor lane from the route-label object rooted at `[this+0x1ed0]` through `0x58f3c0`, then releases the staged bound-route callback payload stored at `[this+0x1ec8]` through `0x5933a0`, and finally clears `[this+0x1ec8]` back to zero. Current grounded caller is `multiplayer_transport_set_route_mode` `0x595650`, where it runs only after the am-rating family and live route have already been torn down.","objdump + local disassembly + caller inspection + route-mode correlation + bound-route teardown correlation" +0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Main route-mode state machine for the session-event transport. When one bound route still exists at `[this+0x1ec8]`, the helper first takes a pre-dispatch gate: requested mode `2` with no selector-`2` owner at `[this+0x398]` submits one bound-route status request through `0x5959e0`, and on failure immediately rewrites the target mode to `0` or `1` according to deferred am-rating latch `[this+0x1ed4]`. After that gate it stores the requested mode in `[this+0x18b8]`, notifies `0x5932a0` on change, and then runs one of six concrete branches. Mode `0` releases the current live route through `0x5973b0`, resets selector slot `2`, and when the am-rating route is not already live at `[this+0x1ec4]` tries to reopen it through `0x596530`; a failed reopen then falls back to mode `0` or `2` according to deferred route-status flag `[this+0x1ed8]`. Mode `1` reopens that am-rating route only when both `[this+0x1ec4]` and `[this+0x1ed4]` are clear and then, when no live route exists at `[this+0x1ecc]`, tries to connect the live route through `0x597480`; a failed live-route connect falls back to mode `0` or `1` according to `[this+0x1ed4]`. Mode `2` first releases any stale live route when status latch `[this+0xb40]` is clear, resets the am-rating route family through `0x596060`, and when `[this+0xb40]` remains live with no live route present tries `0x597480`, promoting success into mode `1`. Mode `3` resets the am-rating family, releases the live route, resets selector slot `2`, and releases the current route binding through `0x595620`. Mode `4` is the narrow recovery branch that only retries `0x597480` when status latch `[this+0xb40]` is live and no live route exists. Mode `5` resets the am-rating family, releases the live route, and releases the current route binding without the selector-slot reset. The stable transitions therefore converge through am-rating reopen, live-route release or reconnect, selector-slot-`2` reset, and route-binding release rather than through in-place mutation of the live route object's callback slots.","objdump + local disassembly + caller inspection + route-mode correlation + status-route correlation + am-rating-owner correlation + live-route correlation" 0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation" 0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. Current evidence does not yet prove this tuple is the same field family as the selector-view probe marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation" 0x00595820,58,multiplayer_transport_reset_live_route_mode_to_zero_while_preserving_selector2_owner,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small route-mode-sensitive cleanup helper beneath the broader runtime-reset strip `0x58d810`. When `multiplayer_transport_is_route_mode_active_nonterminal` `0x58dc30` succeeds, the helper temporarily clears the live route object's dword `[route+0x10]`, saves selector-slot-`2` owner `[this+0x398]`, re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `0`, and then restores `[this+0x398]` before returning. Current grounded callers are the common reset strip `0x58d810` and the surrounding disconnect path `0x58d830`, so the safest current read is a forced route-mode-zero cleanup that preserves the selector-`2` owner across the reset.","llvm-objdump + local disassembly + caller correlation + route-mode correlation" @@ -3268,11 +3396,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_route_binding_gsp_payload allocates a type `1` transient request record through 0x5934e0 and stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` on the completion side publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation" 0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,"Follow-up callback used by `multiplayer_transport_handle_selector_text_route_request`. When the callback succeeds it initializes or repopulates selector slot `[req+0x1c]` through `multiplayer_transport_init_selector_slot` and `multiplayer_transport_upsert_selector_name_entry`. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-local selector slot id at `+0x1c`, then unlinking the request through `0x5933a0`.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation" 0x00593bb0,144,multiplayer_transport_handle_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump -0x00593c40,177,multiplayer_transport_submit_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one selector-text route request. It validates the caller text defaults the sample text to 0x005c87a8 allocates a type `2` transient request record through 0x5934e0 stores the selector id at +0x1c stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` refreshes selector naming through 0x59fc80 and multiplayer_transport_set_selector_name and then submits the request through 0x58e720 using multiplayer_transport_handle_selector_text_route_request.","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation" +0x00593c40,177,multiplayer_transport_submit_selector_text_route_request,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Builds and submits one selector-text route request. The helper rejects null or empty caller text, falls back to fixed sample text `0x005c87a8` when the caller sample pointer is null, and rejects texts whose byte length reaches `0x101`. It then allocates a type-`2` transient request record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`, stores the selector id from `EDX` into work field `+0x1c`, stages the same shared transport wrapper metadata triplet later consumed from work fields `+0x0c/+0x10/+0x18`, refreshes selector-side naming through `0x59fc80` and `multiplayer_transport_set_selector_name` `0x595140`, and finally submits the request through `multiplayer_transport_submit_bound_route_or_selector_text_request_and_optionally_immediate_drain` `0x58e720` using completion callback `multiplayer_transport_handle_selector_text_route_request` `0x593bb0`. Current grounded callers include the formatted status publisher `0x58dfb0` and the staged route-callback descriptor path `0x5958e0`.","objdump + local disassembly + caller inspection + strings + work-record-triplet correlation + selector-id staging correlation" 0x00595a40,245,multiplayer_transport_dispatch_field_snapshot_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Current grounded cases are tighter now: mode `0` enqueues one descriptor-backed snapshot and, when descriptor ready bit `0x1` is still clear, also inserts that descriptor into the local field-cache family `[this+0x1724]` with pending tag `0x4`; mode `1` enqueues the same snapshot without cache insertion; mode `2` removes descriptors carrying pending state bits `0x04/0x08` from that local field-cache family before enqueueing; mode `3` clears progress scalar `[this+0x1774]` and resets the callback payload to zero; mode `4` enqueues one empty selector snapshot through mode `0`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the field-cache subslot `[this+0x1724+0x24]` through `multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter` `0x005a0940`, not into `[this+0x1778]`. Queue service later promotes pending tag `0x4` into ready bit `0x1`.","ghidra + rizin + llvm-objdump + strings + queue-state correlation + caller inspection + local disassembly + companion-dword-slot correlation" 0x00595b60,25,multiplayer_transport_enqueue_field_snapshot_mode1_if_enabled,shell,cdecl,inferred,ghidra-headless,2,Tiny field-snapshot wrapper that enqueues one mode-1 field snapshot only when the caller enable flag is zero. The helper is a thin front end over multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump 0x00595b80,50,multiplayer_transport_clear_field_subscription_table_runtime_and_active_opcode3_records,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the live field-subscription route callback table rooted at `[this+0xba4]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, clears the companion local field-cache family `[this+0x1724]` through `0x5a0950`, and then removes matching opcode-`3` field-snapshot records from the active opcode collection `[this+0x17fc]` through `0x5929a0`. The helper only runs when callback-table plumbing latch `[this+0xba0]` is set. Current grounded callers are the broader route-callback teardown and reopen owners `0x5961b0` and `0x5962e0`.","objdump + local disassembly + caller inspection + route-callback-table correlation + active-opcode correlation" -0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,objdump,3,"Builds and enqueues one opcode-`2` descriptor-block record tied to the local capacity or occupancy sidecar at `[this+0x1778]`. Current evidence now bounds that sidecar more tightly: it behaves as one cached pointer into the transient transport work-record family rooted at `[this+0x1780]`, because every meaningful branch in this helper first reads that pointer and then consumes the familiar work-record metadata triplet at `+0x0c/+0x10/+0x18`. Mode `0` is the live append-notify branch, lining up directly with the generic descriptor owner callback at `0x590370`: it samples the current descriptor's primary IPv4, `hostname`, `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` properties through `0x58d1f0`, `0x58d170`, and `0x58d6d0`, then packs a populated seven-dword descriptor payload through `multiplayer_transport_enqueue_descriptor_block_record` `0x592ae0` while also carrying the same outer callback-wrapper triplet as `(drain context id [cache+0x0c], callback fn [cache+0x10], callback companion [cache+0x18])`. Modes `3` and `5` are the live receive-state callbacks sourced by `multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine` `0x5911e0` and its inner decode state machine `0x5908c0`: they deliberately enqueue an all-zero seven-dword descriptor payload, forward only that same stored callback-wrapper triplet in the outer slots, and then unlink the cached work record through `0x5933a0`, using `EDX=1` for mode `3` and `EDX=0` for mode `5`. Modes `1`, `2`, and `6` are now explicitly bounded too: compact-descriptor upsert notifies mode `1` through `0x590d00`, generic removal notifies mode `2` through `0x590430`, and the receive-header gate notifies mode `6` through `0x5908c0`, but this capacity owner falls through without staging any descriptor block for those modes. The negative result is stronger now too: direct local field-xref scans hit neighboring lifecycle fields `[this+0x176c]`, `[this+0x1770]`, `[this+0x1774]`, `[this+0x177c]`, `[this+0x1780]`, and `[this+0x1784]`, while the owned transient-work lifecycle at `0x593330/0x593370/0x593380/0x5934e0/0x5933a0` and the neighboring active-opcode reset path at `0x5929a0` still never touch `[this+0x1778]`; constructor, recurring service, reset, teardown, and route-callback-table setup scans around `0x58dc50/0x596090/0x596210/0x596060/0x5961b0/0x5962e0/0x596530` likewise seed or clear the surrounding route tables and replay-band neighbors without ever seeding `[this+0x1778]`. The constructor proof is now explicit too: `0x58dc50` bulk-zeroes the full `0x1ee4`-byte transport body and still never writes a nonzero value into `[this+0x1778]`. Broader local text scans also fail to show any `lea`-based replay-band writer or a block-copy owner spanning the whole `0x176c..0x1784` band. A full-binary literal offset sweep now tightens that further: the only direct `0x1778` hit in `RT3.exe` is this read at `0x595bce`. The callback-binding family now sharpens that boundary too: `0x5934e0` stages the shared work-record metadata triplet, `0x593650` binds it into the callback-table worker path, and `0x593570` later consumes and republishes it, while `[this+0x1778]` still appears only as the borrowed sidecar read in this helper. So the sidecar producer remains upstream of the mapped binary and is now best treated as an external callback or worker handoff rather than one missing ordinary direct, derived-address, literal-offset, constructor-side, or higher callback-owner lifecycle store. Current evidence therefore bounds this as a real capacity or occupancy descriptor publisher over one cached borrowed work record, not a vague route-progress helper or a custom replay-scalar blob.","objdump + local disassembly + strings + capacity-cache correlation + work-record correlation + descriptor-block correlation + mode split correlation + opcode2-payload correlation + generic-owner-mode correlation + negative-xref correlation + callback-triplet correlation + neighboring-field-lifecycle correlation + live-receive-owner correlation + negative-derived-address-scan + constructor-teardown-band scan + full-binary literal-offset scan + request-collection-lifecycle correlation + constructor-zero-init correlation + explicit-owner-mode-noop correlation + higher-owner-lifecycle correlation + callback-binding-boundary correlation" +0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,objdump + local disassembly,3,"Owner callback for the capacity-descriptor route callback table rooted at `[transport+0x1164]`, building and enqueueing one opcode-`2` descriptor-block record tied to the borrowed sidecar pointer at `[transport+0x1778]`. The route-callback-table constructor `0x5905e0` installs this helper with owner cookie `transport`; later append-notify `0x590370` and decode-service `0x5908c0/0x5911e0` invoke it with `ecx = table object`, the route descriptor or special decode frame on the stack, and the transport cookie on the stack. Inside that callback it always reads the sidecar pointer first; modes `3` and `5` use it immediately, while mode `0` branches through a live descriptor-property build path and then still consumes the same sidecar metadata triplet `[sidecar+0x0c/+0x10/+0x18]` just before publishing the record. Mode `0` is therefore the populated live-capacity branch rather than a sidecar-free fallback: it resolves the current descriptor's primary IPv4 through `0x58d1f0`, formats one local stem through `0x58d170(0x005e1fd8, 0x005e2230)`, queries the four keyed integer properties `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` through `0x58d6d0(0x005e2280/0x005e2274/0x005e2268/0x005ce1a0)`, and then forwards those five live payload lanes plus the borrowed callback-wrapper triplet into `multiplayer_transport_enqueue_descriptor_block_record` `0x592ae0` with `EDX=1`. Modes `3` and `5` are the live receive-state callbacks sourced by `multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine` `0x5911e0` and its inner decode state machine `0x5908c0`: they enqueue the same outer callback-wrapper triplet but deliberately zero all seven descriptor-payload lanes, using `EDX=1` for mode `3` and `EDX=0` for mode `5`, before unlinking the borrowed sidecar through `0x5933a0`. Modes `1`, `2`, and `6` are now explicitly bounded as no-op fallthroughs in this owner callback: compact-descriptor upsert notifies mode `1` through `0x590d00`, generic removal notifies mode `2` through `0x590430`, and the receive-header gate notifies mode `6` through `0x5908c0`, but this leaf stages no descriptor block for those modes. The negative result is stronger now too: direct local field-xref scans hit neighboring lifecycle fields `[transport+0x176c]`, `[transport+0x1770]`, `[transport+0x1774]`, `[transport+0x177c]`, `[transport+0x1780]`, and `[transport+0x1784]`, while the owned transient-work lifecycle at `0x593330/0x593370/0x593380/0x5934e0/0x5933a0`, the constructor or teardown owners `0x58dc50/0x596090/0x5961b0`, the reset or service strip `0x596060/0x596210/0x596530`, and the neighboring active-opcode reset path `0x5929a0` still never seed `[transport+0x1778]`. Broader local text scans also fail to show any `lea`-based replay-band writer or block-copy owner spanning the full `0x176c..0x1784` band, and a full-binary literal-offset sweep still finds only this read at `0x595bce`. The callback-binding family now sharpens that boundary too: `0x5934e0` stages the shared work-record metadata triplet, `0x593650` binds it into the callback-table worker path, and `0x593570` later consumes and republishes it, while `[transport+0x1778]` still appears only as the borrowed sidecar read in this callback owner. So the producer remains upstream of the mapped binary and is best treated as an external callback or worker handoff rather than one missing ordinary direct, derived-address, literal-offset, constructor-side, or higher callback-owner lifecycle store. Current evidence therefore bounds this as a real capacity or occupancy descriptor publisher over one cached borrowed work record, not a vague route-progress helper or a custom replay-scalar blob.","objdump + local disassembly + strings + capacity-cache correlation + route-callback-table ownership correlation + work-record correlation + descriptor-block correlation + mode split correlation + opcode2-payload correlation + generic-owner-mode correlation + negative-xref correlation + callback-triplet correlation + neighboring-field-lifecycle correlation + live-receive-owner correlation + negative-derived-address-scan + constructor-teardown-band scan + full-binary literal-offset scan + request-collection-lifecycle correlation + constructor-zero-init correlation + explicit-owner-mode-noop correlation + higher-owner-lifecycle correlation + callback-binding-boundary correlation + sidecar-required-live-branch correlation" 0x00595ce0,22,multiplayer_transport_clear_capacity_descriptor_route_callback_table_live_runtime_only,shell,cdecl,inferred,objdump + local disassembly,3,"Clears only the live runtime for the auxiliary capacity-descriptor route callback table at `[this+0x1164]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740` when callback-table plumbing latch `[this+0xba0]` is present. Unlike the broader field-subscription reset `0x595b80`, this helper does not touch `[this+0xba4]`, `[this+0x1724]`, the queued descriptor families, or the active opcode collection. Current grounded callers use it before disconnect and broader route-state cleanup.","objdump + local disassembly + caller inspection + route-callback-table correlation + negative-owner-scope correlation" 0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller descriptor's primary IPv4 dword through `0x58d1f0` against bound-route field `[binding+0x54]`. When payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires the descriptor's secondary IPv4 dword from `0x58d240` to match `[binding+0x58]` and the descriptor's host-order port word from `0x58d250` to match `[binding->route+0x30]`; otherwise it falls back to the single-port getter `0x58d200` against that same route word. The helper returns `1` only when the full required tuple matches and `0` otherwise. Current grounded caller is `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, where this tuple check short-circuits the broader capacity path. This row is intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + local disassembly + caller inspection + descriptor-getter correlation + route-binding-layout correlation + tuple-match correlation" 0x00595d60,84,multiplayer_transport_check_capacity_and_optionally_invoke_bound_route_callback,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Capacity-side gate beneath the `gsi_am_rating` route transition family. When a bound route already exists at `[this+0x1ecc]`, the helper first reuses `multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple` `0x595d00`; a successful tuple match returns immediately through `multiplayer_transport_invoke_bound_route_callback_if_present` `0x592710`. Otherwise it samples the caller descriptor's `maxplayers` and `numplayers` fields through `0x58d6d0` using the fixed keys at `0x005ce194` and `0x005ce1a0`, and only when the current player count is still below the max-player cap does it again fall into `0x592710`. Failure on both branches returns `0`. Current grounded caller is `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`, where this helper forms the immediate route-transition gate before the staged route-callback payload path.","objdump + local disassembly + caller inspection + descriptor-capacity correlation + route-binding-callback correlation" @@ -3280,13 +3408,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00595e10,321,multiplayer_transport_dispatch_am_rating_route_event_mode,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Dispatches route-event modes for the `gsi_am_rating` callback branch rooted at the primary-endpoint table `[this+0x18bc]` and queued descriptor family `[this+0x1e7c]`. Mode `0` first checks descriptor flag-byte `0x15` bit `0x1`: clear-bit descriptors are upserted directly into the primary-endpoint table through `multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port` `0x00591330`, while set-bit descriptors are reinserted into the queued family through `multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag` `0x005a09a0` with pending tag `1/0`. Mode `1` first requires descriptor state-byte ready bit `0x2`; clear-ready descriptors go straight back into that same queue family, while ready descriptors next test flag-byte `0x15` bit `0x1`, suppressing the direct transition path for endpoint-only records and otherwise falling into `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`. Mode `2` removes descriptors still carrying queued pending-state bits `0x04/0x08` through `0x005a0cd0`. Mode `3` checks endpoint-table emptiness through `0x590470` and forces route mode `2` only when no primary endpoint remains. Mode `4` stamps `[this+0x1ed4] = 1` and then switches route mode based on callback-table sentinel `[this+0x18b8]` plus deferred descriptor pointer `[this+0x1ed8]`, producing mode `1` when no deferred descriptor is staged and mode `3` when one is present. Mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the field-cache subslot `[this+0x1724+0x24]` through `multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter` `0x005a0940`, not into `[this+0x1778]`. The strongest current read remains that flag byte `0x15` bit `0x1` marks primary-endpoint-seed or endpoint-only descriptors: they can be staged and enriched through the queue family, but they do not take the richer direct transition path used by clear-bit descriptors.","objdump + local disassembly + caller inspection + endpoint-table correlation + queued-descriptor correlation + transition-suppression correlation + companion-dword-slot correlation" 0x00595f70,237,multiplayer_transport_dispatch_am_rating_route_callback,shell,cdecl,inferred,objdump + local disassembly + strings + endpoint-table correlation,3,"Callback handler for the `gsi_am_rating` route branch rooted at the primary-endpoint table `[this+0x18bc]`. Mode `0` forwards directly into `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`. Mode `2` is now grounded as the real owner above the staged route-callback path, not just a vague table walk: it requires current route mode `1`, no live selector object at `[this+0x398]`, and no busy slot object at `[this+0x38c]`; then it walks the primary-endpoint table through `0x590470/0x590480`, prunes stale entries against `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, and refreshes every surviving entry's `gsi_am_rating` property through `0x58d130` using fixed key `0x005e228c`. After that sweep it branches on table emptiness. When the table is empty it forces route mode `2` through `multiplayer_transport_set_route_mode` `0x595650`. Otherwise it stages the same fixed `gsi_am_rating` key into the endpoint table through `0x590310`, selects the current head entry through `0x590480` with index `0`, forwards that head descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and on submit failure falls back to route mode `0`. Success leaves the staged callback path to drive the later route-mode ladder through `0x595860`. This now closes the owner split above `0x5958e0` without inventing a separate fake function boundary at internal label `0x596000`.","objdump + local disassembly + strings + endpoint-table correlation + route-mode correlation + staged-callback correlation" 0x00596060,48,multiplayer_transport_reset_am_rating_route_runtime_and_queued_descriptor_family,shell,cdecl,inferred,objdump + local disassembly,3,"Resets the `gsi_am_rating` route branch when callback-table plumbing latch `[this+0xba0]` is present: it zeroes am-rating state latch `[this+0x1ec4]`, clears the live runtime for the primary-endpoint callback table `[this+0x18bc]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, and clears the companion queued descriptor family `[this+0x1e7c]` through `0x5a0950`. The helper does not touch the field-subscription table `[this+0xba4]` or the capacity-descriptor table `[this+0x1164]`. Current grounded callers are the route-mode owner `0x595650` and the reopen helper `0x596530`.","objdump + local disassembly + caller inspection + am-rating-owner correlation + negative-owner-scope correlation" -0x00596090,272,multiplayer_transport_construct_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,3,"Constructor-side owner for the transport callback-table branch. It constructs the field-subscription table `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, owner cookie `this`, route-label bands `[this+0xb58]` and `[this+0xb78]`, descriptor/schema owner `[this+0xb98]`, and base runtime state `[this+0x60]`; seeds the companion field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60` and the fixed stem at `0x00629d50`; constructs the capacity-descriptor route callback table `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; then builds one fixed `0x20`-byte local route-label buffer on the stack from the current local transport name at `[this+0x60]` plus suffix format `0x005dccfc`, constructs the `gsi_am_rating` primary-endpoint table `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` and that stack-built label, and finally seeds the queued descriptor family `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70`. On success it clears staged route-callback payload slot `[this+0xb50]` and sets callback-table plumbing latch `[this+0xba0] = 1`. This stronger lifecycle decode now also makes the negative result around `[this+0x1778]` explicit: constructor-side setup seeds the surrounding route tables, labels, and caches without ever seeding that sidecar slot.","objdump + local disassembly + constructor-argument correlation + route-label correlation + latch-state correlation + higher-owner-lifecycle correlation" +0x00596090,272,multiplayer_transport_construct_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,3,"Constructor-side owner for the transport callback-table branch. It constructs the field-subscription table `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, owner cookie `this`, route-label bands `[this+0xb58]` and `[this+0xb78]`, descriptor/schema owner `[this+0xb98]`, and base runtime state `[this+0x60]`; seeds the companion field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60` and fixed descriptor stem `0x00629d50`; constructs the capacity-descriptor route callback table `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; then builds one fixed `0x20`-byte `gsi_am_rating` route label on the stack from local transport name `[this+0x60]` plus suffix template `0x005dccfc`, constructs the primary-endpoint table `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` and that stack-built label, and finally seeds the queued descriptor family `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70` plus fixed stem `0x00629d54`. On success it clears staged route-callback payload slot `[this+0xb50]`, sets callback-table plumbing latch `[this+0xba0] = 1`, and leaves the surrounding route-label and descriptor-cache band ready for the later open or reopen owners `0x5962e0` and `0x596530`. This stronger lifecycle decode now also makes the negative result around `[this+0x1778]` explicit: constructor-side setup seeds the surrounding route tables, labels, caches, and staged payload slot without ever seeding that sidecar slot.","objdump + local disassembly + constructor-argument correlation + route-label correlation + latch-state correlation + higher-owner-lifecycle correlation + fixed-stem correlation" 0x005961b0,92,multiplayer_transport_teardown_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,4,"Full teardown for the transport-owned route callback-table branch. It first clears the live field-subscription runtime, field-cache family, and active opcode-`3` records through `0x595b80`; then clears the live capacity-descriptor callback runtime through `0x595ce0`; and finally, when callback-table plumbing latch `[this+0xba0]` is set, destroys the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through `0x5907a0`, releases the companion caches `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0970`, and resets am-rating state latch `[this+0x1ec4]` to `0`. Current grounded caller is `multiplayer_transport_disconnect` `0x58d830`.","objdump + local disassembly + caller inspection + route-callback-table correlation + active-opcode correlation" 0x00596210,71,multiplayer_transport_service_route_callback_tables_and_descriptor_queues,shell,cdecl,inferred,objdump + local disassembly,3,"Recurring service sweep for the transport-owned route callback tables and descriptor queues. When callback-table plumbing latch `[this+0xba0]` is enabled it services the field-subscription table `[this+0xba4]`, the capacity-descriptor table `[this+0x1164]`, and the `gsi_am_rating` primary-endpoint table `[this+0x18bc]` through `0x591290`, then services the companion descriptor queues `[this+0x1724]` and `[this+0x1e7c]` through `multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition` `0x5a0c80`. Current evidence now bounds those queue families more tightly too: the service pass promotes pending state tags `0x4/0x8` into ready bits `0x1/0x2` before the higher transport-owned route branches consume them. Current grounded caller is `multiplayer_transport_service_frame` `0x58d8d0`, which makes this the callback-table side of the recurring multiplayer transport cadence. The same recurring sweep also strengthens the negative replay-band result: it services all local owner tables surrounding `[this+0x1778]` without ever writing that sidecar slot.","objdump + local disassembly + queue-state correlation + higher-owner-lifecycle correlation + caller inspection" 0x005962c0,32,multiplayer_transport_clear_staged_route_callback_payload,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the cloned staged route-callback payload handle at `[this+0xb50]`. When that slot is non-null the helper forwards the embedded owned object slot through `0x58d0d0`, then zeroes `[this+0xb50]`. Current grounded callers are the stale-request branch in `multiplayer_transport_handle_selector_text_route_request` `0x593bb0` and the selector-slot-`2` reset path around `0x595561`.","objdump + local disassembly + caller inspection + payload-slot correlation" -0x005962e0,583,multiplayer_transport_open_field_subscription_route_callback_table,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Builds and opens the field-subscription route callback table rooted at `[this+0xba4]`. It first clears prior field-subscription runtime through `0x595b80` and releases any live route descriptors at `[this+0xba4]` through `0x5904d0`. It then builds one route label from the optional suffix text: with a caller suffix it formats `0x005e22b4` plus that suffix into a local `0x100`-byte buffer and appends the fixed tail word at `0x005d0b78`; without a suffix it copies the default stem block at `0x005e22c0..0x005e22cc`. After that it clears local progress-counter slot `[this+0x1760]`, materializes the fixed callback-key stem block at `0x005e22a0..0x005e22b2` into a local buffer, seeds the field-cache family `[this+0x1724]` through `0x5a0cc0` with fixed key ids `1` and `0x0b`, and then appends one selector-name key id per caller field byte through the string table at `0x00629958` as long as the assembled key buffer still fits in `0x100` bytes. Finally it opens the live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `4` with that assembled label and callback-key buffer. On success it seeds cached progress percentage `[this+0x1774] = 1` and immediately enqueues one mode-`3` field snapshot through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`; on failure it falls back through the same `0x595b80` clear path. This remains the strongest current upstream owner above the `[transport+0xba4]` route-callback table.","objdump + local disassembly + caller inspection + field-cache correlation + route-callback-table correlation + route-label correlation" -0x00596530,101,multiplayer_transport_try_open_am_rating_route_callback_table_from_stored_route_label,shell,cdecl,inferred,objdump,3,"Tries to reopen the `gsi_am_rating` route callback table rooted at `[this+0x18bc]` from the stored route label at `[this+0x1ed0]`. It first resets the am-rating route state through `multiplayer_transport_reset_am_rating_route_state` `0x596060`, releases any prior active descriptors through `0x5904d0`, and then opens one mode-`4` live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` with a null companion route string. Success clears `[this+0x1ed4]`, sets `[this+0x1ec4]` to `1`, and leaves the primary-endpoint table ready for later raw-endpoint seeding through `0x590dc0`; failure reverts through the same reset path and sets `[this+0x1ed4]`. Current grounded caller is the larger route-mode setter around `0x595650`. This higher reopen path also tightens the negative result for `[this+0x1778]`: even the am-rating reset and reopen lifecycle clears and reseeds the surrounding live tables and queued descriptor family without ever staging that sidecar slot.","objdump + local disassembly + caller inspection + am-rating-owner correlation + route-callback-table correlation + higher-owner-lifecycle correlation" -0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,ghidra-headless,3,Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump +0x005962e0,583,multiplayer_transport_open_field_subscription_route_callback_table,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Builds and opens the field-subscription route callback table rooted at `[this+0xba4]`. It first clears prior field-subscription runtime through `0x595b80` and releases any live route descriptors at `[this+0xba4]` through `0x5904d0`. It then builds one route label from the optional suffix text: with a caller suffix it formats `0x005e22b4` plus that suffix into a local `0x100`-byte buffer and appends the fixed two-byte tail at `0x005d0b78`; without a suffix it copies the default stem block at `0x005e22c0..0x005e22cc` directly. After that it clears local progress-counter slot `[this+0x1760]`, materializes the fixed callback-key stem block at `0x005e22a0..0x005e22b2` into a local buffer, seeds the field-cache family `[this+0x1724]` through `0x5a0cc0` with fixed key ids `1` and `0x0b`, and then appends one selector-name key id per caller field byte through the string table at `0x00629958` as long as the assembled key buffer still fits in `0x100` bytes. Finally it opens the live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `4` with that assembled label and callback-key buffer. On success it seeds cached progress percentage `[this+0x1774] = 1` and immediately enqueues the first field snapshot through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`; on failure it falls back through the same `0x595b80` clear path. This remains the strongest current upstream owner above the `[transport+0xba4]` route-callback table.","objdump + local disassembly + caller inspection + field-cache correlation + route-callback-table correlation + route-label correlation" +0x00596530,101,multiplayer_transport_try_open_am_rating_route_callback_table_from_stored_route_label,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Tries to reopen the `gsi_am_rating` route callback table rooted at `[this+0x18bc]` from the stored route label at `[this+0x1ed0]`. When precondition `[this+0xba0]` is clear the helper does not attempt any reopen work at all: it simply stamps deferred am-rating latch `[this+0x1ed4] = 1` and returns failure. Otherwise it resets that am-rating route family through `multiplayer_transport_reset_am_rating_route_state` `0x596060`, clears the callback-table descriptor band at `[this+0x18bc]` through `0x5904d0`, and then opens one mode-`4` live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` with stored route label `[this+0x1ed0]` and a null companion route string. A successful open clears `[this+0x1ed4]` and sets `[this+0x1ec4] = 1`; a failed open re-enters the same reset path and then stamps `[this+0x1ed4] = 1`. Current grounded caller is the larger route-mode setter around `0x595650`. This higher reopen path also tightens the negative result for `[this+0x1778]`: even the am-rating reset and reopen lifecycle clears and reseeds the surrounding live tables and queued descriptor family without ever staging that sidecar slot.","objdump + local disassembly + caller inspection + am-rating-owner correlation + route-callback-table correlation + higher-owner-lifecycle correlation" +0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Single-shot wrapper for the auxiliary status-route object at `[this+0xaf0]`. When the in-flight latch at `[this+0xb40]` is already set it returns false immediately. Otherwise it sets that latch to `1`, forwards the caller route id into `multiplayer_transport_try_connect_status_route` `0x5973d0`, and booleanizes the returned result without doing any local rollback itself. Current grounded callers are `multiplayer_transport_handle_names_query_response` and the larger route-mode family around `0x595650`; the matching latch cleanup lives in `multiplayer_transport_clear_status_route_latches_and_optionally_release_route_then_rerun_status_pump` `0x5965d0`.","objdump + local disassembly + caller inspection + status-route-latch correlation" 0x005965d0,61,multiplayer_transport_clear_status_route_latches_and_optionally_release_route_then_rerun_status_pump,shell,cdecl,inferred,objdump + local disassembly,3,"Status-route cleanup sibling used by the selector-status owner strip. When caller flag `EDX` is nonzero it first releases the auxiliary status-route object through `multiplayer_transport_release_status_route` `0x597350`; when transport latch `[this+0xb40]` is live it then clears `[this+0xb40]`, `[this+0xb44]`, and `[this+0xb54]` together and tail-calls `multiplayer_transport_service_status_pump_and_emit_hashed_selector_mode_strings` `0x5951f0`. Current grounded callers are `multiplayer_transport_disconnect` `0x58d830` and the selector-slot-`2` reset tail inside `multiplayer_transport_reset_selector_slot` `0x5954b0`.","objdump + local disassembly + caller inspection + latch correlation" 0x00596840,105,multiplayer_transport_prune_shared_selector_callback_name_when_no_live_slot_store_still_owns_it,shell,cdecl,inferred,objdump + local disassembly,3,"Callback used while servicing the shared selector callback-name store at `[this+0x18a8]`. For one stored name pair it resolves the current selector-view entry through `0x594a40`; when no live selector-view entry remains, or when none of the three slot ownership pointers at `[entry+0x40/+0x44/+0x48]` still resolves the same name in the slot-specific callback stores rooted at `[this+0x1890/+0x1894/+0x1898]` through `hashed_entry_table_lookup` `0x58f9c0`, it removes that shared name record from `[this+0x18a8]` through `hashed_entry_table_remove` `0x58f970`. Current grounded caller is `multiplayer_transport_service_selector_callback_name_tables` `0x596900`.","objdump + local disassembly + selector-view correlation + caller inspection" 0x005968b0,79,multiplayer_transport_prune_shared_selector_callback_name_from_one_slot_service_pass,shell,cdecl,inferred,objdump + local disassembly,3,"Slot-specific callback used during selector callback-name service. It resolves the current selector-view entry for one shared selector name, checks whether the current slot index still owns that entry at `[entry+0x40+slot*4]`, and then confirms the same name still exists in the slot-owned callback store rooted at `[this+0x189c+slot*4]` through `hashed_entry_table_lookup` `0x58f9c0`. When either condition fails, it removes the shared name record from `[this+0x18a8]` through `hashed_entry_table_remove` `0x58f970`. Current grounded caller is `multiplayer_transport_service_selector_callback_name_tables` `0x596900`.","objdump + local disassembly + selector-slot correlation + caller inspection" @@ -3338,13 +3466,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x005971b0,192,multiplayer_transport_status_route_seed_control_id_list_and_notify_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback-vector lane that seeds one control-id list into the caller byte builder through `0x58bcb0`. In its first grounded mode it appends the currently available local status-control ids, including the always-on `8` lane plus conditional ids `1`, `0x0b`, `0x13`, `0x14`, and `0x0a` according to the current status-route state at `[this+0x1ecc]`, `[this+0xb4c]`, `[this+0xb3c]`, and `[this+0xb48]`; in its second grounded mode it emits the smaller pair `0x15` and `0x18`. After seeding that local list it optionally forwards the same mode plus builder into the owner callback at `[this+0x17e8]` with context `[this+0x17f8]`. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + control-id-list correlation" 0x00597270,80,multiplayer_transport_status_route_query_third_selector_generation_or_forward_owner_scalar,shell,cdecl,inferred,objdump + caller correlation,2,"Small scalar-query lane in the status-route callback vector. When the caller event id is `1` and the transport-side status gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, the helper returns the third selector-slot generation counter at `[this+0xac0]`. Otherwise it forwards the same selector or scalar query into the owner callback at `[this+0x17ec]` with context `[this+0x17f8]`, returning zero when that callback is absent. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + selector-generation correlation" 0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump" +0x00597300,3,multiplayer_transport_noop_status_route_owner_callback,shell,cdecl,inferred,objdump + local disassembly,2,"Three-byte `ret 4` stub in the status-route helper strip. Current local layout shows it sitting immediately before the owner-callback dispatchers at `0x597303` and `0x597330`, so the safest current read is a no-op status-route owner callback placeholder rather than a hidden route-state mutator.","objdump + local disassembly + callback-strip correlation" +0x00597303,28,multiplayer_transport_forward_validated_route_cookie_event_to_owner_callback_0x17f0,shell,cdecl,inferred,objdump + local disassembly,3,"Owner-callback forwarding lane immediately beside `multiplayer_transport_handle_validated_route_cookie_event` `0x5972c0`. It checks owner callback slot `[this+0x17f0]`, and when present forwards the caller event id in `ebx`, payload wrapper in `edi`, and owner context `[this+0x17f8]`. Current grounded caller is the fallback branch inside `0x5972c0`, so this is the clearest explicit dispatcher for the validated cookie-event owner callback slot rather than another generic route callback shim.","objdump + local disassembly + caller correlation + callback-slot correlation" 0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump" 0x00597350,30,multiplayer_transport_release_status_route,shell,cdecl,inferred,ghidra-headless,3,Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state.,ghidra + rizin + llvm-objdump 0x00597370,16,multiplayer_transport_service_status_route_if_live,shell,cdecl,inferred,objdump + local disassembly,3,"Tiny status-route service helper for the session-event transport. When the auxiliary status route at `[this+0xaf0]` is live it forwards that route object into the shared low-level route tick helper `0x58cf90`; otherwise it returns immediately. Current grounded callers are `multiplayer_transport_publish_selector2_fixed_token_status_and_refresh_route_mode` `0x58e100` and the route-object sweep `0x597380`.","objdump + local disassembly + caller inspection" -0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump,3,"Recurring route-object sweep for the session-event transport. It services the auxiliary status-route object at `[this+0xaf0]` through the shared low-level route tick helper `0x58d040` when present and then services the current live route at `[this+0x1ecc]` through that same helper. The current grounded caller is multiplayer_transport_service_frame, which makes this the route-object side of the recurring multiplayer transport cadence.",objdump +0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump + local disassembly,3,"Recurring route-object sweep for the session-event transport. It first services the auxiliary status route at `[this+0xaf0]` through the broader route-object service helper `0x58d040` when present, then applies that same helper to the current live route at `[this+0x1ecc]`. The current grounded caller is the recurring multiplayer transport frame service, so this is now the explicit two-route owner sweep rather than a vague route-side tick wrapper.","objdump + local disassembly + caller inspection + route-object-service correlation" 0x005973b0,30,multiplayer_transport_release_live_route,shell,cdecl,inferred,ghidra-headless,4,Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.,ghidra + rizin + llvm-objdump -0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the auxiliary status-route object at `[this+0xaf0]`. It first releases any existing status route through `multiplayer_transport_release_status_route` `0x597350`, then seeds the full six-entry callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0` together with owner scalar `[this+0xb34]`, owner context `[this+0x60]`, and route-side callback table storage `[this+0xaf4]`. When the caller route id is `-1` it opens the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40`; otherwise it uses the caller route id through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0`. On success it copies stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears status-route mode mask `[this+0xb38]`, and returns `1`; failure returns `0` without those patches. Current grounded callers are the one-shot wrapper `0x5965a0`, the selector-status refresh owner `0x595650`, and the names-query response path `0x5965a0/0x58e100` that later services this route through `0x597370`.","objdump + local disassembly + strings + caller correlation + callback-vector correlation + status-route correlation" -0x00597480,261,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the current live route object at `[this+0x1ecc]`. It first releases any existing live route through `multiplayer_transport_release_live_route` `0x5973b0`, then builds one `0x20`-byte local identifier from owner text `[this+0x60]` plus suffix template `0x005dccfc` through `0x5a18a0` and `0x5a1eb0`. The helper then seeds the full live-route callback vector rooted at `0x596fd0`, `0x5970e0`, `0x597180`, `0x5971b0`, `0x597270`, and `0x5972c0`, forwards owner scalar `[this+0xb34]`, and chooses between the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40` when binding dword `[binding+0x2c]` is `-1`, or the binding-specific id in word `[binding+0x30]` through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` otherwise. On the binding-specific path it also clears any pending rebuild cookie at `[binding+0x34]` and marks the newly constructed route live by storing `1` into `[route+0xbc]`. In the grounded connect path it still does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`; on exit it only mirrors success into deferred route-status flag `[this+0x1ed8]` and returns whether the live-route rebuild succeeded.","objdump + local disassembly + strings + caller correlation + live-route-callback-vector correlation" +0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the auxiliary status-route object at `[this+0xaf0]`. It first releases any existing status route through `multiplayer_transport_release_status_route` `0x597350`, then seeds the full six-entry callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0` together with owner scalar `[this+0xb34]`, owner context string `[this+0x60]`, and route-side callback storage `[this+0xaf4]`. When the caller route id is `-1` it opens the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40`; otherwise it uses the caller route id through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` after zero-extending the supplied route word. On success it copies stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears status-route mode mask `[this+0xb38]`, and returns `1`; failure returns `0` without those patches. Current grounded callers are the one-shot wrapper `0x5965a0`, the selector-status refresh owner `0x595650`, and the names-query response path `0x58e100` that later services this route through `0x597370`.","objdump + local disassembly + strings + caller correlation + callback-vector correlation + status-route correlation + route-id-width correlation" +0x00597480,261,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the current live route object at `[this+0x1ecc]`. It first releases any existing live route through `multiplayer_transport_release_live_route` `0x5973b0`, then builds one `0x20`-byte local identifier from owner text `[this+0x60]` plus suffix template `0x005dccfc` through `0x5a18a0` and `0x5a1eb0`. The helper then seeds the full live-route callback vector rooted at `0x596fd0`, `0x5970e0`, `0x597180`, `0x5971b0`, `0x597270`, and `0x5972c0`, forwards owner scalar `[this+0xb34]`, and chooses between the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40` when binding dword `[binding+0x2c]` is `-1`, or the binding-specific id in word `[binding+0x30]` through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` otherwise. On the binding-specific path it also clears any pending rebuild cookie at `[binding+0x34]` and marks the newly constructed route live by storing `1` into `[route+0xbc]`. On success it mirrors stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, clears live-route mode mask `[this+0xb38]`, mirrors success into deferred route-status flag `[this+0x1ed8]`, and returns `1`; failure returns `0`. In the grounded connect path it still does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`.","objdump + local disassembly + strings + caller correlation + live-route-callback-vector correlation" 0x00598230,67,multiplayer_transport_enqueue_names_query_record,shell,cdecl,inferred,ghidra-headless,3,Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump 0x0058f0a0,99,multiplayer_transport_append_user_and_optional_nick_commands,shell,cdecl,inferred,rizin,3,Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.,rizin + llvm-objdump + strings 0x0058f920,72,hashed_entry_table_upsert,support,cdecl,inferred,rizin,4,Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.,rizin + llvm-objdump @@ -3400,7 +3530,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0059dea0,96,multiplayer_transport_stage_registered_name_callback_payload_for_name,shell,cdecl,inferred,rizin,3,Looks up one primary registered-name entry then fans helper multiplayer_transport_stage_registered_name_callback_payload across the registered-name store through generic_callback_list_for_each using the caller secondary key plus the two payload buffers. Current grounded role is a primary-name keyed payload staging wrapper for nested callback-entry records.,rizin + llvm-objdump 0x0059df00,96,multiplayer_transport_try_resolve_registered_name_callback_payload,shell,cdecl,inferred,rizin,4,Fast resolver for one nested callback-entry payload. When the descriptor either has no selector string or matches the shared two-byte default token at 0x005e1e1c it looks up the nested callback-entry record by key from `[entry+0x134]` and if the entry is active at `[subentry+0xd8]` marks the descriptor successful and returns pointers to the staged payload blocks at `[subentry+0x80]` and `[subentry+0x98]`.,rizin + llvm-objdump 0x005934c0,30,multiplayer_transport_next_work_sequence,shell,thiscall,inferred,ghidra-headless,3,"Returns the next monotonically increasing transport work-sequence value by incrementing dword `[this+0x177c]` and clamping negative wraparound back to zero. Current grounded callers now bound this more tightly than a generic work-sequence source: the returned dword is also the shared immediate-drain context id later copied into queued work field `+0x0c`, mirrored into active opcode-record field `+0x14`, and waited on through `0x58d720` by the text-submission and callback-table registration roots.","ghidra + rizin + llvm-objdump" -0x00593650,229,multiplayer_transport_attach_callback_table_descriptor,shell,cdecl,inferred,objdump + local disassembly,3,"Builds one transport-side callback-table descriptor from caller metadata and then links it through `multiplayer_transport_worker_create` `0x58f2f0`. The helper first allocates one transient work record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`; this lane is now tighter: it uses work-record type `0`, leaves field `+0x08` zero, duplicates the first caller metadata dword into both fields `+0x0c` and `+0x10`, and carries the second caller metadata dword in field `+0x18` for the later replay path through `multiplayer_transport_publish_callback_table_binding_result_and_release_work_record` `0x593570`. It then installs callback vectors from `0x59f5c0` and `0x59f650`, copies the caller transport pointer into the local descriptor frame, and chooses the follow-on worker callback pair `multiplayer_transport_worker_callback_enqueue_opcode5_binding_record_from_work_triplet` `0x593610` and `multiplayer_transport_worker_callback_store_route_scalar_and_forward_into_0x597780` `0x593630` from transport field `[this+0x4c]`. Failure unlinks the staged work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. The current grounded caller is `multiplayer_transport_register_callback_table`.","objdump + local disassembly + work-queue correlation + callback-binding-triplet correction + worker-callback correlation" +0x00593650,229,multiplayer_transport_attach_callback_table_descriptor,shell,cdecl,inferred,objdump + local disassembly,3,"Builds one transport-side callback-table descriptor from caller metadata and then links it through `multiplayer_transport_worker_create` `0x58f2f0`. The helper first allocates one transient work record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`; this lane is now tighter: it uses work-record type `0`, leaves field `+0x08` zero, duplicates the first caller metadata dword into both fields `+0x0c` and `+0x10`, and carries the second caller metadata dword in field `+0x18` for the later replay path through `multiplayer_transport_publish_callback_table_binding_result_and_release_work_record` `0x593570`. It then installs callback vectors from `0x59f5c0` and `0x59f650`, copies the caller transport pointer into the local descriptor frame, always installs `multiplayer_transport_worker_callback_store_route_scalar_and_forward_into_0x597780` `0x593630` as the second worker callback, and only installs `multiplayer_transport_worker_callback_enqueue_opcode5_binding_record_from_work_triplet` `0x593610` as the first worker callback when transport field `[this+0x4c]` is nonzero. Failure unlinks the staged work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. The current grounded caller is `multiplayer_transport_register_callback_table`.","objdump + local disassembly + work-queue correlation + callback-binding-triplet correction + worker-callback correlation" 0x00593d00,85,multiplayer_transport_fastpath_submit_text_shim_copy_local_name_and_maybe_reemit_followon_callback,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Callback shim installed by `multiplayer_transport_try_submit_text_record_fastpath` `0x593d60` above the fast local-name and immediate-callback owner `0x58e510`. When the incoming result flag in `EDX` is nonzero, it copies the returned text at the second stack argument into the owner transport's local-name buffer rooted at `[transport+0x04]`. It then checks the staged callback function pointer in work field `+0x10`; when that pointer is nonnull it forwards the copied text, staged callback function, callback companion, and drain context id through `multiplayer_transport_enqueue_callback_record` `0x593170`. The shim always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. Current grounded caller is the type-`9` text fastpath owner `0x593d60`, so this is the clean callback-and-copy shim above that fastpath rather than a generic string copy helper.","objdump + local disassembly + caller correlation + text-fastpath correlation + callback-wrapper correlation" 0x00593d60,66,multiplayer_transport_try_submit_text_record_fastpath,shell,cdecl,inferred,ghidra-headless,3,"Attempts the fast submission path for one prepared transport text record. It allocates a type-`9` transient record through `0x005934e0`, again staging the shared transport wrapper triplet as `(drain context id +0x0c, callback fn +0x10, callback companion +0x18)`, and when that succeeds forwards the caller callback and payload through `0x0058e510` with callback shim `0x00593d00`. That shim copies the returned text into `[transport+0x04]` and, when work field `+0x10` is nonnull, re-emits one follow-on callback record through `0x00593170` using the staged callback pointer and companion plus the same drain context id. The current grounded caller is `multiplayer_transport_submit_text_record`.","ghidra + rizin + llvm-objdump + work-record-triplet correlation + local disassembly" 0x00593db0,144,multiplayer_transport_hash_pair_of_ordered_status_strings_mod_divisor,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Hash callback installed by `multiplayer_transport_ensure_aux_selector_view_sidecar_worker_and_seed_runtime` `0x593fe0` into the auxiliary selector-view sidecar allocator `0x58faf0`. The helper first orders the two fixed `0x40`-byte status strings rooted at `(entry, entry+0x40)` by lexical compare, then walks the chosen ordered pair bytewise, maps each signed character through `0x5a5900`, accumulates the resulting integer sum, and after each string reduces that rolling sum modulo the caller-supplied divisor from the first stack argument. The final remainder is returned in `EAX`. Current evidence therefore bounds this as the pair-hash callback for the sidecar keyed store rather than a generic string checksum.","objdump + local disassembly + caller correlation + selector-view-sidecar correlation" @@ -3507,6 +3637,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00436070,24,shell_refresh_active_window_followons_without_subject_gate,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"No-argument shell follow-on refresh strip keyed off the current active detail-manager mode at `[0x006d0818+0x8c]`. It refreshes the company-detail branch when mode `7` is active through `0x4c6c30`, the stock-buy branch when mode `0x0b` is active through `0x50c130`, and the `Overview.win` side when mode `9` is active through `0x452f20` with the fixed `0x270f` bounds. Unlike its argument-sensitive sibling `shell_refresh_active_window_followons_for_subject_and_optional_company_match` `0x4360d0`, this helper has no mode-`8` subject-id gate.","llvm-objdump + callee correlation + detail-manager-mode correlation" 0x004360d0,39,shell_refresh_active_window_followons_for_subject_and_optional_company_match,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"Small shell follow-on refresh helper keyed off the current active detail-manager mode at `[0x006d0818+0x8c]`. It first refreshes the live company-detail branch when mode `7` is active through `0x4c6c30`, then refreshes the stock-buy branch when mode `0x0b` is active through `0x50c130`. For active mode `8` it also requires that the current subject id at `[state+0x90]` matches the caller dword before it triggers the world-side timed overlay refresh through `0x482150`. Finally, when mode `9` is active it refreshes the `Overview.win` side through `0x452f20` with the fixed `0x270f` bounds. This is the argument-sensitive sibling of the smaller no-arg follow-on strip at `0x436070`.","llvm-objdump + callee correlation + detail-manager-mode correlation" 0x00436170,24,shell_refresh_active_window_followons_and_adjacent_station_or_company_lists,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"Broader shell follow-on wrapper above `shell_refresh_active_window_followons_for_subject_and_optional_company_match` `0x4360d0`. It first forwards the caller subject id into `0x4360d0`, then adds two adjacent list-window refresh branches keyed by the current active detail-manager mode: when mode `4` is active and singleton `0x006d1708` is live it refreshes the station list panel through `0x506f30`, and when mode `1` is active and singleton `0x006d3b34` is live it refreshes the company-list side through `0x5158f0(-1)`. This is the current grounded owner for the active-window follow-on sweep that spans company detail, station list, stock buy, overview, and the mode-`8` subject-gated overlay branch.","llvm-objdump + callee correlation + detail-manager-mode correlation + shell-singleton correlation" +0x00436170,24,shell_refresh_active_window_followons_and_adjacent_station_or_train_lists,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"Broader shell follow-on wrapper above `shell_refresh_active_window_followons_for_subject_and_optional_company_match` `0x4360d0`. It first forwards the caller subject id into `0x4360d0`, then adds two adjacent list-window refresh branches keyed by the current active detail-manager mode: when mode `4` is active and singleton `0x006d1708` is live it refreshes the station list panel through `0x506f30`, and when mode `1` is active and singleton `0x006d3b34` is live it refreshes the train-list side through `shell_train_list_window_refresh_controls` `0x005158f0(-1)`. This is the current grounded owner for the active-window follow-on sweep that spans company detail, station list, train list, stock buy, overview, and the mode-`8` subject-gated overlay branch.","llvm-objdump + callee correlation + detail-manager-mode correlation + shell-singleton correlation + TrainList.win string correlation" 0x004361d0,120,world_refresh_collection_side_effects_after_broad_state_change,map,thiscall,inferred,llvm-objdump + caller correlation,3,"Shared broad refresh sweep over several live world collections after larger state changes. It walks the region collection at `0x006cfca8`, first re-entering `0x48b660` and then `0x48a9e0` on every region record; walks the placed-structure collection at `0x0062b26c` and refreshes each entry through `placed_structure_refresh_linked_peer_overlay_runtime` `0x40d2d0`; and then walks three more live collections rooted at `0x006ada80`, `0x0062bae0`, and `0x006cea50`, invoking each record's vtable slot `+0x54` with argument `0`. Current grounded callers include the broader world-side owner at `0x44b160` and the TrackLay teardown branch at `0x50dba7`, so this is the safest current read for a shared collection-side post-change refresh sweep rather than a subsystem-local helper.","llvm-objdump + caller correlation + collection-sweep correlation + vtable-refresh correlation" 0x00436350,576,simulation_service_world_outcome_mode_prompt_and_transition_effects,simulation,thiscall,inferred,llvm-objdump + caller correlation + outcome-latch correlation,3,"Frame-serviced owner for the live world outcome-mode latch at `[world+0x4a73]`. The helper immediately stamps `[world+0x4a77] = 1`, maps the current mode band `1..4` to selector values `0..3` for the shared helper `0x517a80`, and then runs a larger presentation/transition split keyed by scenario bytes `[0x006cec7c+0xc4/+0xc5/+0x7d]` plus the current mode. One early branch closes the active detail panel through `0x4ddbd0(-1, 0)`, clears one world-view scalar at `[0x006cec74+0x14]+0x110`, arms shell latch `0x006d4000`, and triggers the fixed world-side transition path through `0x482150(..., 0xcc, 0, 3, 0, 0)`. The broader common branch refreshes two presentation scalars through `0x531560`, re-enters `0x4e1af0` with the outcome-mode-derived selector, and then opens one callback-driven shell modal rooted at localized id `0x169` through `0x5193f0 -> 0x4c98a0`. On modal dismissal or fallback it can close the current detail panel through `0x4ddbd0`, tear down the live multiplayer session object at `0x006cd8d8`, trigger the alternate world-side transition through `0x482150` with selector `7` or `2` depending on `[0x006cec7c+0xc5]`, and refresh the same two presentation scalars again. Current grounded caller is the simulation frame cadence `simulation_frame_accumulate_and_step_world` `0x439140`, which reaches this owner only after the shell-window dirty-mark ladder when the outcome latch is live and the completion latch `[world+0x4a77]` is still clear. This is therefore the safest current owner for outcome-mode prompt and transition servicing above the already-grounded outcome text buffer `[world+0x4b47]`, not just another shell modal wrapper.","llvm-objdump + caller correlation + outcome-latch correlation + shell-modal correlation + transition-side correlation" 0x005996c0,304,multiplayer_transport_handle_pending_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Structural mode-3 wrapper over the pending-template path for registered-name updates. It normalizes the caller selector string against the shared default token at 0x005e1e1c builds a four-way pending-template query and dispatches the matched node through multiplayer_transport_dispatch_pending_template_node. Depending on the matched node kind it can mark the registered-name entry dirty through multiplayer_transport_mark_registered_name_dirty or forward the node-owned payload fields into the dispatch descriptor.,llvm-objdump @@ -3747,7 +3878,14 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x005b07d7,50,math_apply_abstract_floating_control_value_and_mask,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Primary older CRT floating-control owner beneath `math_apply_floating_point_control_word_value_and_mask_with_bit0x80000_cleared` `0x005b0809`. The helper snapshots the current x87 control word with `fstcw`, maps it into the abstract flag space through `0x005b06b7`, merges the caller value and mask there, converts the merged result back through `0x005b0749`, loads the new control word with `fldcw`, and returns the previous abstract control setting. Current grounded callers are `0x005b0809` and the legacy bootstrap wrapper `0x005a63b8`.","llvm-objdump + local disassembly + caller correlation + x87-control correlation" 0x005b08ba,245,math_build_matherr_report_record_and_dispatch_default_runtime_message,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Broader older-CRT math-report owner beneath the x87 wrappers `0x005a77f7` and `0x005a790a`. The helper reads the staged math-error record, selects one operand-format width from record kind `[record+0x00]`, formats the operand payload through `0x005a8af0` and `0x005a884b`, updates the floating-point report mode through `0x005a9070`, and then either consults the default matherr-style hook stub `0x005b09b8` or falls through directly to the default runtime-message path `0x005a8d12`. This is the safest current read for the common matherr-report formatter and dispatcher rather than overclaiming one single formatting helper.","llvm-objdump + local disassembly + caller correlation + math-error-report correlation" 0x005b09b8,3,math_default_matherr_hook_stub_return_zero,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Trivial default hook stub in the older CRT math-report seam. The function just returns `0`, and current grounded caller `0x005b08ba` uses that zero result before falling through to the default runtime-message path.","llvm-objdump + local disassembly + caller correlation + math-error-report correlation" -0x00438710,300,simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + queue-family correlation,3,"Recurring service owner for the linked `0x20`-byte runtime-effect or queue-record family rooted at `[this+0x66a6]`, above the older append helper `scenario_state_append_runtime_effect_or_queue_record` `0x004337c0`. When a live custom modal already exists through `shell_has_live_custom_modal_dialog` `0x004c8680` and the queued-record list already contains one kind-`1` node, the helper takes the short path through `shell_mark_custom_modal_dialog_dirty` `0x004c8670`. Otherwise it enters a recursion guard at `0x0062be3c`, samples the broader shell-block gate through `0x004348e0`, walks the queued-record list at `[this+0x66a6]`, and for each node either accepts it immediately when the shell gate is open or the node kind plus live shell state allows direct promotion, or falls back to node-specific handlers through `0x00437c00`. Accepted nodes are either unlinked and preserved as the new active queue pointer at `[this+0x66aa]`, or replace the previously active node there after releasing the earlier owned payloads through `0x0053afd0`; rejected nodes are released through the same payload helper before the walk continues. Current grounded callers are the frame-owned outcome follow-on branch at `0x0043963d` and the earlier world-side notification path at `0x00432cb0`, where this owner runs only after a stricter local gate. This is therefore the safest current read for the queue-record service and custom-modal dirty-mark owner above `[this+0x66a6]` and `[this+0x66aa]`, while the exact gameplay label of the queued node family remains intentionally open.","llvm-objdump + local disassembly + caller correlation + queue-family correlation + custom-modal correlation + active-node-slot correlation" +0x00437c00,237,simulation_dispatch_runtime_effect_queue_record_by_kind_into_shell_or_world_handlers,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + queue-family correlation,4,"Kind-dispatch owner for one queued runtime-effect or queue-record node. The helper switches on dword `[node+0x08]`, and the jump table is now resolved exactly. Kinds `1` and `2` are no-op success arms that return `1` immediately. Kinds `0` and `4` both open the fixed callback-driven custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, using localized id `[node+0x04]` plus the standard all-zero payload and `-1.0f` scalar pair. Kind `3` forwards `[node+0x10]` plus `[node+0x14]` into `0x004dc540` and returns `0`. Kind `5` dispatches `[node+0x10]` into `0x004f29c0` with `dl=1`. Kind `6` first validates route-entry id `[node+0x10]` against collection `0x006cfcbc` and then forwards that id plus `[node+0x04]` into `0x00436820`, with failed validation falling back to the fixed modal arm. Kind `7` forwards `[node+0x10]` into `0x004c7520`. Kind `8` forwards `[node+0x10]` plus `[node+0x14]` into `0x004f2d80`. Unsupported kinds also fall back to the fixed modal arm. Current grounded callers are `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710` and `simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153` `0x00438840`, so this is now the real queued-record kind table rather than one loose arm list.","llvm-objdump + local disassembly + caller correlation + queue-family correlation + resolved-jump-table correlation + route-entry-lookup correlation + custom-modal correlation" +0x00438710,300,simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + queue-family correlation,4,"Recurring service owner for the linked `0x20`-byte runtime-effect or queue-record family rooted at `[this+0x66a6]`, above the older append helper `scenario_state_append_runtime_effect_or_queue_record` `0x004337c0`. When a live custom modal already exists through `shell_has_live_custom_modal_dialog` `0x004c8680`, the helper first walks the queued-record list looking for any node whose promotion-latch dword `[node+0x0c]` equals `1`; when such a node exists and shell latch `0x0062be80` is already live it takes the short path through `shell_mark_custom_modal_dialog_dirty` `0x004c8670`. Otherwise it enters a recursion guard at `0x0062be3c`, samples the broader shell-block gate through `0x004348e0`, walks the queued-record list at `[this+0x66a6]`, and for each node either accepts it immediately when the shell gate is open or the node kind plus live shell state allows direct promotion, or falls back to node-specific handlers through `0x00437c00`. Accepted nodes are either unlinked and preserved as the new active queue pointer at `[this+0x66aa]`, or replace the previously active node there after releasing the earlier owned payloads through `0x0053afd0`; rejected nodes are released through the same payload helper before the walk continues. Current grounded callers are the frame-owned outcome follow-on branch at `0x0043963d` and the earlier world-side notification path at `0x00432cb0`, where this owner runs only after a stricter local gate. This is therefore the safest current read for the queue-record service and custom-modal dirty-mark owner above `[this+0x66a6]` and `[this+0x66aa]`, with the key short-path gate now tied to `[node+0x0c]` rather than the queue kind field itself.","llvm-objdump + local disassembly + caller correlation + queue-family correlation + custom-modal correlation + active-node-slot correlation + promotion-latch correlation" 0x0043963d,236,simulation_frame_service_outcome_followon_windows_overview_and_pause_toggle_after_transition,simulation,thiscall,inferred,llvm-objdump + local disassembly + callee correlation,3,"Post-outcome follow-on branch inside `simulation_frame_accumulate_and_step_world` `0x00439140`, reached only when the current outcome-sequence marker `[world+0x4a7b]` still matches the latched step-local marker. The branch first services the queued runtime-effect or queue-record family rooted at `[world+0x66a6]` through `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710`, then conditionally opens `Overview.win` through `shell_open_or_focus_overview_window` `0x004f3a10` when no overview window is already live, the shell is not blocked by mode-`0x0c` plus input bit `0x400`, and the preview fixed-record collection at `0x006cea4c` still has one admissible entry through `0x00473e20/0x00473e70`. After that it runs a second follow-on gate for `LoadScreen.win`: when no live overview or ledger is open, shell latch `0x006d4000` is clear, and world flag `[this+0x4d]` is still nonzero, it clears that flag, rechecks the same overview-entry gate, and then opens or focuses `LoadScreen.win` page `0` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`. The same branch also conditionally toggles world pause or resume through `world_toggle_pause_or_restore_game_speed` `0x00437a60` when no multiplayer session object is live at `0x006cd8d8`, before falling back into `world_view_service_shell_input_pan_and_hover` `0x0043db00` at the end of the frame. This is therefore the safest current owner for the post-transition outcome follow-on window and pause strip, not just another loose tail inside the frame cadence.","llvm-objdump + local disassembly + callee correlation + outcome-latch correlation + overview-correlation + loadscreen-correlation + pause-toggle-correlation" 0x00438840,76,simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153,simulation,thiscall,inferred,llvm-objdump + caller correlation + queue-family correlation,3,"Small owner beside the queued runtime-effect record family. When the active queue slot `[this+0x66aa]` is nonnull it forwards that node into the same node-specific handler table at `0x00437c00` used by `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710`. When no active node is staged it instead opens one fixed callback-driven custom modal rooted at localized id `0x153` through `0x5193f0 -> 0x4c98a0`, with the same all-zero option payload and default `-1.0f` scalar pair every time. Current grounded caller is the small shell-side branch at `0x004414d0`, which only reaches this owner when the live world object exists and the active shell presentation stack is otherwise idle. This is therefore the safest current read for the queued-record dispatch-or-fallback prompt owner above `[this+0x66aa]`, not a generic modal opener.","llvm-objdump + caller correlation + queue-family correlation + custom-modal correlation" 0x004414d0,33,shell_try_dispatch_active_runtime_effect_queue_record_prompt_when_shell_stack_idle,shell,cdecl,inferred,llvm-objdump + caller correlation + queue-family correlation,3,"Small shell-side gate above `simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153` `0x00438840`. It first requires a live world object at `0x006cec78`, then requires the current shell presentation stack depth `[0x006d401c+0xc64]` to be nonpositive, and only then forwards the live world object into `0x00438840`. Current evidence keeps this structural: it is the idle-shell dispatcher for the queued-record prompt family, not yet a named player-facing command.","llvm-objdump + caller correlation + queue-family correlation + shell-stack-idle correlation" +0x00413f80,681,aux_candidate_collection_restore_temp_record_bank_and_queue_keys_from_packed_state,map,thiscall,inferred,objdump + local disassembly + caller correlation + packed-state correlation,4,"Restore-side packed-state loader for the auxiliary or source record family rooted at `0x0062b2fc`. The helper first reads one `0x0c`-byte header from the caller stream, stores the queued-record count into `0x0062ba64`, allocates the queued-key array at `0x0062ba6c/0x0062ba70`, frees any prior temporary record bank at `0x0062b2f8`, allocates a fresh bank sized as `count * 0x74e`, and then walks every temporary record image in that bank. For each image it reads the queued key, the fixed scalar header at `[record+0x00/+0x04/+0x08/+0x0c/+0x4b8/+0x4bc]`, the counted inline dword run rooted at `[record+0x10]`, the fixed `0x10`-byte payload at `[record+0x498]`, the optional counted byte payload rooted at `[record+0x4c0]`, the counted dword run rooted at `[record+0x4c8]`, the paired one-byte streams rooted at `[record+0x65c]` and `[record+0x6c1]`, and the trailing dword at `[record+0x72a]`. On exit it seeds queue index `0x0062ba74 = 0` and stores the restored record count into `0x0062ba68`. Current grounded caller is the world-entry restore branch at `0x004443ed`, immediately before the optional live reimport through `0x0041a950`, so this is the safest current read for the packed-state restore of the temporary aux-candidate record bank plus queued keys rather than a generic bundle reader.","objdump + local disassembly + caller correlation + packed-state correlation + temp-record-bank correlation" +0x0041a950,55,aux_candidate_collection_release_live_entries_then_reimport_records_and_refresh_runtime_followons,map,thiscall,inferred,objdump + local disassembly + caller correlation + restore-path correlation,3,"Restore-side sibling over the auxiliary or source record pool rooted at `0x0062b2fc`. When the collection currently holds live entries, the helper walks every live id through `0x00518380` and dispatches entry vtable slot `+0x08` to release per-entry state, then tail-jumps directly back into `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. Current grounded caller is the world-entry restore branch at `0x0044440f`, which uses it only when the shell-side restore flags demand a live reimport after `aux_candidate_collection_restore_temp_record_bank_and_queue_keys_from_packed_state` `0x00413f80`, so this is the safest current read for the in-place aux-candidate reset-and-reimport sibling rather than a generic collection destructor.","objdump + local disassembly + caller correlation + restore-path correlation + entry-release correlation" +0x004931e0,186,route_entry_collection_run_optional_refresh_hooks_and_validate_world_cell_side_lists,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Optional refresh owner over the live route-entry collection `0x006cfca8`. When shell gate `[0x006cec74+0x1cb]` is nonzero, the helper first walks every live route-entry record and dispatches the current per-entry hook `0x0048a780`, which is presently a no-op. It then scans the world-grid dimensions stored at `[0x0062c120+0x2155/+0x2159]`, resolves each cell-side route-entry side-list through `0x00492130`, and validates every linked route-entry id in those per-cell lists against the live collection through `0x00517d40`. Current grounded callers are the zero-depth optional refresh dispatcher `scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero` `0x00433b80` and the city-connection route-builder family at `0x00402ccf` and `0x0040461d`, so this is the safest current read for the route-entry collection's optional refresh-and-validation owner rather than a narrower mutator we have not yet recovered.","llvm-objdump + local disassembly + caller correlation + route-entry-collection correlation + world-cell-side-list correlation" +0x00493be0,265,route_entry_collection_refresh_records_from_tagged_bundle_and_reseed_tracker_sidecars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the main route-entry collection rooted at `0x006cfca8`. The helper opens tag family `0x38a5/0x38a6/0x38a7` through `0x00531360`, refreshes collection-side metadata through `0x00518680`, restores dword `[this+0x90]` and mirrors it into `[this+0x94]`, then walks every live route-entry record through `0x00517cf0/0x00518380/0x00518140`. For each entry it seeds one small stack-local helper through `0x00489e60`, stores that helper's root dword back into the record, dispatches the record through `0x0048dcf0` with the active bundle handle, conditionally re-enters `0x00491e60` when the entry's class byte `[entry+0x216]` is nonzero or collection field `[this+0xe9]` is live, and finally resets the record through `0x0048a5c0(-1, -1)` before releasing the stack helper. Current grounded caller is the world-entry restore branch at `0x0044461a`, where this helper refreshes the live route-entry store before the auxiliary route-entry tracker collection. This is the safest current read for the route-entry tagged load owner plus tracker-sidecar reseed rather than an anonymous collection walk.","objdump + local disassembly + caller correlation + tag-family correlation + route-entry correlation + sidecar-reseed correlation" +0x004a41b0,127,route_entry_tracker_collection_refresh_records_from_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the auxiliary route-entry tracker collection rooted at `0x006cfcb4`. The helper opens tag family `0x396d/0x396e` through `0x00531360`, refreshes collection-side metadata through `0x00518680`, forces collection latch `[this+0x8c] = 1`, and then walks every live tracker entry through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `0x00495020` with the active bundle handle. Current grounded caller is the world-entry restore branch at `0x0044466c`, immediately after the main route-entry collection reload at `0x00493be0`, so this is the safest current read for the tagged restore of the route-entry tracker family rather than another generic collection loader.","objdump + local disassembly + caller correlation + tag-family correlation + tracker-collection correlation" +0x004a4240,102,aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged save owner for the auxiliary route-entry tracker collection rooted at `0x006cfcb4`. The helper emits tag family `0x396d/0x396e` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, and then walks every live tracker entry through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `aux_route_entry_tracker_serialize_noop_per_entry_payload_stub` `0x00494ef0`. Current grounded caller is the early package-save prelude `0x00444dd0`, where this helper runs immediately after the main route-entry tagged save owner `0x00491c60`. This is the safest current read for the auxiliary tracker tagged save owner rather than another generic collection serializer.","objdump + local disassembly + caller correlation + tag-family correlation + tracker-collection correlation" diff --git a/docs/control-loop-atlas/editor-breadth.md b/docs/control-loop-atlas/editor-breadth.md index 73da8fe..633dbac 100644 --- a/docs/control-loop-atlas/editor-breadth.md +++ b/docs/control-loop-atlas/editor-breadth.md @@ -18,7 +18,24 @@ The broader map-editor page owner is now bounded through the paired overall growth selector whose effects later appear in the city-growth side of the simulation. `map_editor_city_region_panel_construct` and `map_editor_city_region_panel_handle_message` own the city-or-region editing lane with rename and - copy-industry-data flows. That copy side is tighter now too: the handler first enters + copy-industry-data flows. The adjacent economic tuning page is explicit now too: + `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` registers + `map_editor_economic_cost_slider_dispatch` `0x004ca980` on six visible slider controls + `0x5bcd..0x5bd7`, re-publishes the current values from + `[world+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and pairs that band with the localized + captions `Prime Rate`, `Merger Premium`, and the construction/maintenance cost family + `Build Stations Cost` through `Steam Engine Cost`. The dispatch side writes those six floats + directly back into the same state band and mirrors the first lane into `[world+0x0bde]`, which + now ties the editor page directly to the `.smp` save/load plateau and the post-load/runtime + consumers grounded elsewhere in the atlas. The read-side presentation seam is explicit now too: + `map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows` `0x004caaf0` is the + control-`0x5be1` sibling for that same page. It reads the live six-float band, builds one + preview curve from leading lane `[world+0x0be2]` plus the stepped multiplier table + `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and republishes the six formatted numeric + rows through the neighboring dynamic-text controls `0x5bce/0x5bd0/0x5bd2/0x5bd4/0x5bd6/0x5bd8`. + That closes the economic tuning page as one real save/load-facing editor family rather than only + a constructor plus one write-only slider dispatcher. The city-or-region copy side is tighter now too: the + handler first enters `0x00420e00`, which rebuilds the selected region's profile collection `[region+0x37f]`, clones the source region's live label-weight entries when a source region is present, and otherwise reseeds a fixed default weight set through repeated `0x004206b0` calls. The no-source companion @@ -49,6 +66,13 @@ The broader map-editor page owner is now bounded through region id `[region+0x23a]` by squared XY distance through `0x0051db80`, and returns `0` when no qualifying region is found; `0x004220b0` is the small wrapper above it that returns the matched region name `[region+0x356]` or the fallback localized scratch string at `0x0062ba90`. + The adjacent scenario-rule page is tighter on the same save/load axis too: + `map_editor_scenario_special_conditions_panel_clear_visible_row_band` `0x004cb1a0` and + `map_editor_scenario_special_conditions_panel_format_row_by_index` `0x004cb1c0` are now the + concrete range and row callbacks behind list control `0xa7fa`, so the persisted 49-dword + scenario-rule band `[world+0x4a7f..+0x4b3f]` is no longer only constructor-shaped in the atlas. + The constructor `0x004cb2b0` binds those callbacks, counts enabled rows directly from that same + dword band, and keeps the trailing scalar `[world+0x4b43]` in the same page family. `map_editor_territory_panel_construct` and `map_editor_territory_panel_handle_message` own the territory rename and border-remap lane; `map_editor_locomotive_availability_panel_construct` plus @@ -69,26 +93,40 @@ The broader map-editor page owner is now bounded through result is now a full chain rather than only the importer: `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` first imports those same five lines into one repeated array of identical `0xbc`-byte runtime descriptors with no row-index - special casing, and the candidate-side rebuild pass at + special casing, while mode `3` keeps reseeding the primary token lane until it differs from the + one-row subordinate lane and then writes literal `1.0` into the subordinate amount slot + `[desc+0x48]`. The candidate-side rebuild pass at `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` then projects those descriptors into the live structure collection at `0x0062b268` in two availability-bank passes. The current local disassembly now shows that this bridge reuses live candidate slots by prior ordinal field `[candidate+0x794]` when possible, otherwise allocates one fresh candidate, clones from the current bank's template source candidate, and only then copies in the imported recipe-line count, shared production-cap float, and packed `0xbc` descriptor strip - from scenario state. Each rebuilt candidate then feeds + from scenario state. The label side is narrower than the earlier note too: current local + disassembly of `0x00412d70` does not consult the recipe-book name at `[state+0x0fe8]` at all. + Instead it formats display stem `[candidate+0x04]` directly from one of two fixed built-in roots + chosen by availability bit `[candidate+0xba] & 1`, together with the current ordinal. Each + rebuilt candidate then feeds `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0`, which rebuilds the per-cargo runtime summary tables. That helper now reads more concretely too: it clears both - emitted cargo-id tables at `[candidate+0x79c]` and `[candidate+0x7a0]`, rebuilds one local - `0x35`-cargo mark band from the descriptor strip, accumulates the scaled per-cargo runtime rates - into `[candidate+0xa1..+0xb8]`, and then allocates the two final compact membership tables from - the `mark>=1` and `mark>=2` sets with counts stored at `[candidate+0x7a4]` and `[candidate+0x7a8]`. - The same scan also makes the production-mode split explicit on the runtime side: descriptor mode - `0` uses the shared production cap at `[candidate+0x2a]` divided by the descriptor amount, while - nonzero mode bypasses that scaling path. The immediate sibling + emitted cargo-id tables at `[candidate+0x79c]` and `[candidate+0x7a0]`, clears the per-cargo + float band at `[candidate+0xa1..+0xb8]`, and fills one local `0x35`-cargo status scratch from + the descriptor strip. Each subordinate row contributes status `1` when the cargo is only + referenced and status `2` when the row is currently year-active, with the helper keeping the + maximum status per remapped cargo id through `0x0062ba8c+0x9a`. It then allocates the two final + compact membership tables from the `status>=1` and `status>=2` sets with counts stored at + `[candidate+0x7a4]` and `[candidate+0x7a8]`. The same scan also makes the production-mode split + explicit on the runtime side: descriptor mode `0` uses the shared production cap at + `[candidate+0x2a]` divided by the descriptor amount, while nonzero mode bypasses that scaling + path and publishes the row amount directly. At that point the candidate import strip is + structurally closed in current local evidence: the local import and rebuild seam is no longer + where the loader reconstructs runtime descriptor or membership tables, but only what the + unresolved supply-marker token family means before those already-grounded candidates are projected + back into live cargo ids. The immediate sibling `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, which for subtype byte `[candidate+0x32] == 2` scans the imported descriptor strip and derives two compact - post-import flags from mode `0` presence and subordinate-row presence. The stream-load side is + post-import flags from mode `0` presence and whether every mode-`0` descriptor keeps at least + one subordinate row. The stream-load side is tighter in the same way: the constructor-side load owner `structure_candidate_collection_construct_and_stream_load_runtime_records` `0x004131f0` seeds global pool `0x0062b268` and immediately re-enters the broader collection importer @@ -99,14 +137,39 @@ The broader map-editor page owner is now bounded through `0x00412ab0`, the collection aggregate subtotal pass over `[pool+0x8c..+0x9c]`, rebuilds the fixed name catalog at `0x0061dbc2/0x0061dc09` for non-subtype-`1` zero-availability candidates with live ids `<= 0x6e` via localized string `0x0b53`, and only then re-enters the same - named-availability refresh at `0x00412c10` before returning. The neighboring placed-structure + named-availability refresh at `0x00412c10` before returning. The broader scenario-state reset + side is explicit now too: `0x00436d10` is the shared reset-and-rebuild owner beneath startup and + world-entry paths. It zeroes the late scenario-state bands, seeds the fixed year defaults and + chairman-slot rows, rebuilds the two named availability collections at `[state+0x66b2]` and + `[state+0x66b6]`, re-seeds the twelve recipe books at `[state+0x0fe7]` from the fixed template + at `0x005c9f78`, refreshes selected-year state through `0x00409e80`, `0x00433bd0`, + `0x00435603`, and the year-gap scalar helper `0x00434130`, and only then re-enters + `0x00435630`, `0x0041e970`, `0x00412bd0`, and `0x00436af0`. The startup side is tighter now too: + `0x00438890` does not jump straight into one selector-specific file-load branch. It first + re-enters `0x00436d10`, mirrors one shell-managed label list from `0x006d4020+0x429b0` into local + state, allocates the common runtime pools (`0x0062ba8c`, `0x0062b268`, `0x0062b2fc`, + `0x0062ba88`, `0x006ada84`, `0x0062c120`, `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, + `0x006cea4c`, `0x006acd34`, `0x0062b244`), and pre-seeds named locomotive-availability rows + through `0x004350b0` before the profile selector at `[profile+0x01]` chooses tutorial, + setup-generation, or file-load lanes. The neighboring placed-structure side is bounded too: global pool `0x0062b26c` comes from `placed_structure_collection_construct_empty_runtime_pool` `0x00413230`, while the paired tagged collection owners `0x00413280` and `0x00413440` now own the broader placed-structure stream load/save path around tags `0x36b1/0x36b2/0x36b3` and the per-entry virtual load/save slots `+0x40/+0x44`. The adjacent collection pass `0x00412ab0` is tighter in the same way: it now reads as a pure stem-policy sweep that refreshes candidate dword `[+0xbc]` - from defaults `0x1869f/3/4` plus the fixed override table at `0x005edca8..0x005edd20`. The + from defaults `0x1869f/3/4` plus the fixed override table at `0x005edca8..0x005edd20`, with the + non-default `3/4` branches driven directly by post-import flag `[candidate+0x78c]` and subtype + byte `[candidate+0x32]`. The stream-load side is tighter too: `0x004120b0` now clearly reads the + fixed header fields first, allocates the descriptor strip as `count*0xbc + 1`, zeroes every + loaded `0xbc` descriptor slot before import, resolves primary mode-`0` cargo names from + `+0x08 -> +0x1c` and subordinate row cargo names from `+0x30 -> +0x44`, clamps descriptor start + year `[desc+0x20]` upward to the resolved cargo availability floor `[cargo+0x21]`, and only then + reruns `0x00411ee0` plus `0x00411ce0`. Its version gates are explicit too: bundles before + `0x3ed` omit `[candidate+0x3b..+0xbb]`, bundles before `0x3f2` keep the narrow `0x02`-byte form + of `[candidate+0xc0]`, nonzero `[candidate+0x4b]` forces `[candidate+0x47] = 1.0` and rescales + `[candidate+0x43]` to at least `0x1388`, and the later stem-index resolution first checks two + built-in alias stems before the full fixed row table at `0x005ed338..0x005edca4`. The current local file-side result is now tighter too: the grounded recipe-book root at `0x0fe7` is preserved byte-for-byte across the checked map/save scenario pairs, so the loader can safely treat the twelve `0x4e1`-byte books as preserved @@ -122,16 +185,20 @@ The broader map-editor page owner is now bounded through to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The lower gameplay side is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds - four per-cargo summary banks and returns one direct-supply channel, one cap-normalized supply - channel, one demand or input channel, and one scaled production-output subrow channel for a - requested cargo id. The internal indexing is tighter now too: the direct-supply lane indexes from - `[desc+0x1c]`, the demand or input lane uses that same resolved cargo id in the no-subrow branch, - and the scaled production-output lane indexes each subordinate row directly from - `[desc+0x44+row*0x1c]`, with no post-resolution failure guard between the importer writes and the - summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if + four per-cargo summary banks and returns one direct primary-cargo scalar channel, one cap-share + primary-cargo scalar channel, one nonzero-mode subrow channel, and one zero-mode cap-scaled + subrow channel for a requested cargo id. The internal indexing is tighter now too: the two + primary-cargo banks index from `[desc+0x1c]`, while both subordinate-row banks index each row + directly from `[desc+0x44+row*0x1c]`. The mode split is tighter in the same way: nonzero-mode + descriptors bypass the primary-cargo banks entirely and only feed the nonzero-mode subrow bank, + while mode-`0` descriptors either add their direct scalar to `[this+0x03a]` or, when subrows are + present, add one cap-share scalar to `[this+0x0a4]` and one cap-scaled row contribution to + `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and + the summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if the imported low-16 marker rows fail the exact matcher at `0x0041e9f0`, the resulting `0` ids will still hit the first summary-bank bucket inside `0x00412650`, but the semantic meaning of - cargo id `0` itself remains ungrounded. The sibling helper + cargo id `0` itself remains ungrounded. So the remaining gap here is semantic only, not another + missing import or rebuild owner. The sibling helper `structure_candidate_supports_or_references_cargo_id` `0x004129d0` then uses those same banks plus the cached cargo-membership arrays to answer whether a live candidate materially references a cargo at all. One compare step tighter, the raw line @@ -195,12 +262,13 @@ The broader map-editor page owner is now bounded through cargo-name resolution unless another upstream transform exists. The wrapper layer above that query no longer looks like a hiding place for special treatment either. Local `objdump` now shows `0x00412960` simply summing the two supply-side floats returned - by `0x00412650`, while `0x004129a0` returns the single scaled production-output lane directly; + by `0x00412650`, while `0x004129a0` returns the single zero-mode cap-scaled subrow lane directly; neither wrapper checks for cargo id `0` after the query returns. The broader world-side accumulator at `0x0041e7be` is tighter in the same way: it calls `0x00412650`, requires all four returned channels to be positive before continuing, queries one linked-instance count through - `0x00413940`, scales each of the four channel values by that count, and then writes the finished - quartet into candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]` while stamping + `0x00413940`, scales the direct-primary, cap-share-primary, nonzero-mode-subrow, and + zero-mode-cap-scaled-subrow lanes by that count, and then writes the finished quartet into + candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]` while stamping `[candidate+0x8a]` from current world field `[0x006cec78+0x15]`. So the current strongest read remains structural rather than semantic: unresolved marker rows can still propagate through the first bank bucket, but the first place that meaning matters is a normal positivity-gated @@ -426,17 +494,19 @@ The broader map-editor page owner is now bounded through when `0x004349a0` reports more than one active profile. After those gates it forwards target mode `([shell+0x68] == 0)` into `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. - The adjacent startup-year strip is grounded now too: - `shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar` `0x00441cb0` - and `shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar` - `0x00441d20` are the paired registered commands beneath localized ids `0x0db5/0x0db6`. Both + The adjacent time-of-day strip is grounded now too: + `shell_command_increment_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar` + `0x00441cb0` and + `shell_command_decrement_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar` + `0x00441d20` are the paired registered commands beneath localized ids `0x0db5/0x0db6`, whose + RT3.lng captions are `Increment Time Of Day` and `Decrement Time Of Day`. Both require active scenario state plus the same single-profile gate from `0x004349a0`, clear shell dwords `[0x006cec74+0x233]` and `[+0x124]`, then adjust startup scalar `[0x006cec78+0xbfa]` by `+0.5` or `-0.5` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute - counter `[0x006cec78+0x15]` and refreshing the live world view through `0x00439a80`. The exact - player-facing command labels are still open, but the static owner boundary is now clear: these - are not generic shell scalars, they are the paired half-step selected-year presentation commands. + counter `[0x006cec78+0x15]` and refreshing the live world view through `0x00439a80`. So the + registration-side identity is now closed: these are the paired half-step time-of-day + presentation commands, not generic shell scalars and not the earlier selected-year read. The adjacent progress-status side is tighter now too: `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90` is the shared save or load progress payload builder, and @@ -889,7 +959,8 @@ The broader map-editor page owner is now bounded through `0x00437d70`. That owner increments the shared shell counter at `[0x006d401c+0xc60]`, opens the localized cheat prompt `2922` `Do I detect a cheater in the house?\n\nEnter code (or to cancel):`, and then scans the fixed 26-entry table at `0x005ee2c8`. The active selector strip is - now grounded: winner/loss strings `3618/3619/3620/3622` route through `0x004367c0`, selector `1` + now grounded: winner/loss strings `3618/3619/3620/3622` route through + `world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text` `0x004367c0`, selector `1` jumps to the out-of-line reset branch at `0x004d676c` that clears the selected-company stat bands rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`, selectors `2` and `3` post deltas into the selected company and selected chairman profile through `0x0042a080` and @@ -958,10 +1029,11 @@ The broader map-editor page owner is now bounded through refreshes the live company-detail branch in mode `7`, the stock-buy branch in mode `0x0b`, the mode-`8` timed overlay only when the current subject id matches the caller dword, and the `Overview.win` side in mode `9`. Its wrapper - `shell_refresh_active_window_followons_and_adjacent_station_or_company_lists` `0x00436170` + `shell_refresh_active_window_followons_and_adjacent_station_or_train_lists` `0x00436170` forwards through that helper and then adds the station-list refresh through `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30` when mode `4` is - active plus the company-list refresh through `0x005158f0(-1)` when mode `1` is active. The + active plus the `TrainList.win` refresh through + `shell_train_list_window_refresh_controls` `0x005158f0(-1)` when mode `1` is active. The shared world-side follow-on beneath those shell branches is explicit now too: `world_refresh_collection_side_effects_after_broad_state_change` `0x004361d0` sweeps the live region, placed-structure, and three adjacent world collections, re-entering their per-record diff --git a/docs/control-loop-atlas/map-and-scenario-content-load.md b/docs/control-loop-atlas/map-and-scenario-content-load.md index ee1b2c0..bba23ce 100644 --- a/docs/control-loop-atlas/map-and-scenario-content-load.md +++ b/docs/control-loop-atlas/map-and-scenario-content-load.md @@ -4,16 +4,16 @@ `shell_active_mode_run_profile_startup_and_load_dispatch` at `0x00438890`, the shell-mode switcher `shell_transition_mode` at `0x00482ec0`, the first grounded world-entry branch `world_entry_transition_and_runtime_bringup` at `0x00443a50`, - `shell_map_file_world_bundle_coordinator` at `0x00445de0`, reference-database setup via - `map_bundle_open_reference_databases` at `0x00444dd0`, and narrower loaders such as - `map_load_geographic_label_database` and `map_load_city_database`. + `shell_map_file_world_bundle_coordinator` at `0x00445de0`, early reference-package save via + `map_bundle_open_reference_package_and_serialize_early_world_datasets` at `0x00444dd0`, and narrower tagged collection owners such as + `geographic_label_database_refresh_records_from_tagged_bundle` and `city_database_entry_collection_refresh_records_from_tagged_bundle`. - Trigger/Cadence: shell tutorial launch, editor or detail-panel file actions through `fileopt.win`, map-scenario open paths, and scenario-text export batch commands. - Key Dispatchers: `shell_map_file_entry_coordinator`, `shell_active_mode_run_profile_startup_and_load_dispatch`, `shell_transition_mode`, `world_entry_transition_and_runtime_bringup`, `world_runtime_release_global_services`, `shell_map_file_world_bundle_coordinator`, - `map_bundle_open_reference_databases`, `map_load_geographic_label_database`, - `map_load_city_database`, `scenario_text_export_build_language_file`, + `map_bundle_open_reference_package_and_serialize_early_world_datasets`, `geographic_label_database_refresh_records_from_tagged_bundle`, + `city_database_entry_collection_refresh_records_from_tagged_bundle`, `scenario_text_export_build_language_file`, `scenario_text_export_report_language_file`, `scenario_text_export_batch_process_maps`. - State Anchors: shell-side file staging buffers at `0x0062bee0` and `0x0062bec4`, shell and mode globals at `0x006cec74` and `0x006cec78`, world object root `0x0062c120`, map bundle state @@ -37,7 +37,31 @@ mode `11` is tighter now too: it still maps to `.gmt`, but instead of looking like another gameplay save family it conditionally diverts into the same `.gmt` preview-surface pipeline owned by the Multiplayer preview dataset object at `0x006cd8d8`, and only falls back to the normal - reference-bundle path when that dataset object is absent. The shell-side mode owner above those + reference-bundle path when that dataset object is absent. That fallback owner is tighter now too: + `0x00444dd0` is not a generic database opener, but the early package-save prelude that seeds the + shared stage/progress globals, opens one `0x30d40` bundle through `0x00530c80`, handles the + localized failure modal `0x0fda`, and then serializes the first direct package band in a fixed + order: chunks `0x32c8/0x32c9`, direct saves of `[world+0x66be]`, `[world+0x66b2]`, and + `[world+0x66b6]`, chunk `0x32dc`, the staged `0x108` profile block under `0x3714/0x3715`, then + `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520` for the + early world-grid and sidecar-table band, then + `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` for the direct + `0x0062b2fc` source-or-auxiliary record family, and only after that the neighboring reference + and manager families before `shell_map_file_world_bundle_coordinator` continues with the later + tagged collections. That `0x0062b2fc` seam is tighter now too: `0x00416a70` first builds one + temporary scored queue from each record's linked chain at `[entry+0x04]`, writes one leading + `0xbabe` header, and then serializes the fixed fields, counted dword runs, optional byte payload, + paired one-byte bands, and trailing dword for each queued record; the load-side companion is + `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` + `0x004196c0`, which now clearly tails into + `aux_candidate_collection_rebank_or_clone_records_by_availability_pass_and_refresh_owner_links` + `0x00419230` before the later world-load side continues, with destructor + `aux_candidate_collection_release_templates_queues_and_indexed_storage` `0x00419680`. The fixed + tail is explicit now too: `0x00444dd0` writes one direct dword from + `[world+0x19]`, one zeroed `0x1f4`-byte slab under `0x32cf`, closes the package, derives the + preview path through `0x00442740`, and then conditionally emits the companion-image and + companion-payload sidecars through `0x00441f70` and `0x00442900` when `[world+0x66c8]` and + `[world+0x66c9]` are set. The shell-side mode owner above those file coordinators is clearer now too. `shell_transition_mode` no longer reads like a generic mode switch: its ABI is now grounded as a `thiscall` with two stack arguments because the body reads the requested mode from `[esp+0x0c]` and returns with `ret 8`. The grounded world-entry @@ -52,6 +76,49 @@ `0x0062b2fc`, `0x0062b268`, `0x006cea4c`, and `0x006acd34` in that order before it drains the shell-helper handle band `[world+0x46a80..+0x46aa0]`, the variable owner band `[world+0x46aa4]`, and the linked chains at `[world+0x66a6]` and `[world+0x66aa]`. + The corresponding world-load allocation branch is tighter now too: inside `0x00438c70`, + `0x0062b2fc` is allocated as a `0xb8`-byte object and then constructed through + `aux_candidate_collection_construct_seed_globals_and_helper_bands_then_import_records` + `0x0041aa50`, which seeds the collection base, resets the neighboring constructor globals, builds + the helper bands at `[this+0x88/+0x8c/+0x90]` through `0x0041a990`, and only then tails into the + tagged import owner `0x004196c0`. The next two roots in the same load strip are now explicit + too: `0x0062ba8c` is allocated and constructed through + `structure_candidate_collection_construct_and_stream_load_records_then_refresh_counts` + `0x0041f4e0`, which enters the tagged import owner `0x0041ede0` and then refreshes the aggregate + filter/year-visible counts through `0x0041e970`; and `0x006ada84` is allocated and constructed + through `locomotive_collection_construct_and_stream_load_records` `0x00462520`, which enters the + linked-era locomotive import owner `0x00461f10` and then refreshes the live availability override + band through `0x00461e00`. The same fan-out now also has explicit constructor ownership for the + adjacent typed roots: the live company collection `0x0062be10` is constructed through + `company_collection_construct` `0x00429950`, the live profile/chairman collection `0x006ceb9c` + is constructed through `profile_collection_construct` `0x00477740`, the live train collection + `0x006cfcbc` is constructed through `train_collection_construct` `0x004b2340`, the sibling + indexed collection `0x006acd34` is constructed through + `runtime_object_collection_construct_vtable_5cae10` `0x00455320`, the support family + `0x0062b244` is constructed through + `support_collection_construct_seed_counters_and_clear_large_sideband` `0x0040aeb0`, and the live + world root `0x0062c120` is published through + `world_runtime_construct_root_and_seed_global_0x62c120` `0x0044cf70` before the heavier bundle + load body continues through `0x00449200` and `0x0044cfb0`. The profile-side tagged header + siblings are explicit too: runtime load re-enters + `profile_collection_refresh_tagged_header_counts_from_bundle` `0x00477780`, while package save + later mirrors the same `0x5209/0x520a/0x520b` trio back out through + `profile_collection_serialize_tagged_header_counts_into_bundle` `0x004777e0`. The same tagged + symmetry is now bounded for the live company collection too: world-load refresh re-enters + `company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x00429af0`, + while the package-save path mirrors the same `0x61a9/0x61aa/0x61ab` bracket through + `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` + `0x00429b90`, whose per-company callback is currently the no-op stub `0x00424000` while the + load-side per-company follow-on is `company_refresh_post_load_year_clamp_and_runtime_support_fields` + `0x004268e0`. The same tagged symmetry is now bounded for the live train collection too: + world-load refresh re-enters + `train_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x004b2700`, + while the package-save path mirrors the same `0x5209/0x520a/0x520b` header bracket and per-train + record walk through + `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` + `0x004b27a0`; the per-train payload seam itself is now explicit too, with route-list load through + `train_refresh_tagged_route_list_payload_from_bundle` `0x004a84b0` and route-list save through + `train_serialize_tagged_route_list_payload_into_bundle` `0x004a7030`. The later world-entry reactivation branch correspondingly uses `(1, esi)` rather than `(1, 0)`. The current live hook probes now push the remaining auto-load gap much later too: on the hook-driven path `shell_transition_mode(4, 0)` returns cleanly, and the full old-mode teardown @@ -89,30 +156,25 @@ ready-count log so the mode-`4` startup lane either stages immediately or shows exactly how far the gate gets. That adjustment worked on the next run: the hook now stages and completes the `shell_transition_mode` path again, with `LoadScreen.win` construction and publish returning - cleanly. But the post-publish startup subchain is still unresolved: there is still no trusted - `0x46c40` allocator hit, no direct `0x004336d0` entry, and no direct `0x00438890` entry. So - the next clean runtime boundary is the tiny `LoadScreen.win` scalar setter at `0x004ea710`, - which sits immediately before the `0x0053b070` allocation in the static mode-`4` branch. The - immediate next runtime check is even more concrete than the helper hook, though: inspect the - state that `0x004ea710` should leave behind. The hook now logs the post-transition - `LoadScreen.win` singleton, its field `[+0x78]`, `0x006cec78`, the shell state's `[+0x0c]` - active-mode object field, and the startup selector. If `0x004ea710` really ran on the mode-`4` - branch, `[LoadScreen.win+0x78]` should no longer be zero after `shell_transition_mode` returns. - The latest run answered that directly: after transition return, `field_active_mode_object` is - still the `LoadScreen.win` singleton, `0x006cec78` is still null, `[LoadScreen.win+0x78]` is - still zero, and the startup selector is still `3`. So the current best read is that RT3 is - still parked in the plain `LoadScreen.win` state at transition return rather than having entered - the separate runtime-object path yet. That shifts the best next runtime boundary from “deeper - inside `shell_transition_mode`” to “what later active-mode service tick, if any, promotes the - load-screen object into the startup-dispatch path.” The next run now logs the first few - shell-state service ticks after auto-load is attempted with that same state tuple - (`0x006cec78`, `[shell_state+0x0c]`, `0x006d10b0`, `[LoadScreen.win+0x78]`, selector), so the - next question is very narrow: does one later service tick finally promote the plain - `LoadScreen.win` state into the startup-runtime object path, or does it stay frozen as-is? The - internal selector split in `0x438890` is tighter now too: `[0x006cec7c+0x01]` is a separate - seven-way startup selector, not the shell mode id. Values `1` and `7` load `Tutorial_2.gmp` and - `Tutorial_1.gmp`, values `3/5/6` collapse into the same profile-seeded file-load lane through - `0x445ac0([0x006cec7c]+0x11, 4, &out_success)`, value `2` is a world-root initialization lane + cleanly. The post-publish startup subchain is no longer unresolved on the static side, though. + Direct disassembly of the mode-`4` branch at `0x0048302a..0x004830ca` now closes it completely: + after constructing `LoadScreen.win`, the branch sets shell state `[transition+0x08] = 4`, + chooses one page scalar `110.0f`, `236.0f`, or `5.0f`, writes that page id through + `shell_load_screen_window_set_active_page` `0x004ea710`, allocates one `0x46c40`-byte runtime + object through `0x0053b070`, resets it through + `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`, stores the result into + `0x006cec78`, and then directly enters + `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` as `(1, 0)` before + publishing the active-mode object back through `0x005389c0`. So the static startup chain after + `LoadScreen.win` publish is now explicit rather than inferred from the earlier hook traces. The + remaining runtime-side question is narrower: why the earlier hook snapshots still showed + `[LoadScreen.win+0x78] == 0` and `0x006cec78 == 0` immediately after transition return even + though the static mode-`4` branch does not leave those fields that way once it reaches the + startup-dispatch path. The internal selector split in `0x438890` is tighter now too: + `[0x006cec7c+0x01]` is a separate seven-way startup selector, not the shell mode id. Values `1` + and `7` load `Tutorial_2.gmp` and `Tutorial_1.gmp`, values `3/5/6` collapse into the same + profile-seeded file-load lane through `0x445ac0([0x006cec7c]+0x11, 4, &out_success)`, value `2` + is a world-root initialization lane that allocates `0x0062c120` and then forces selector `3`, and value `4` is the setup-side world reset or regeneration lane that rebuilds `0x0062c120` from `0x006d14cc/0x006d14d0` before later world setup continues. The write side is tighter now too: `Campaign.win` writes selector `6`, @@ -346,11 +408,14 @@ sixteen-byte per-scenario campaign selector or unlock band consumed directly by `Campaign.win`. The neighboring profile helpers are tighter now too: `0x0047bbf0` is the broad default reset for the staged `0x108`-byte runtime-profile record, clearing the whole record and then reseeding the - visible setup and campaign anchors `[profile+0x77]`, `[profile+0x79]`, `[profile+0x7d]`, - `[profile+0x83]`, `[profile+0x87]`, and `[profile+0x97]`; and `0x0047bc50` is the compact scan - helper over `[profile+0xc6..+0xd5]` that returns the first selector byte below `2`, which keeps - that band tied to staged campaign progress or unlock state rather than to the earlier setup-panel - payload fields. + visible setup and campaign anchors `[profile+0x77]`, `[profile+0x79]`, `[profile+0x7d]`, the + random-like dword `[profile+0x83]`, the first setup row-marker byte `[profile+0x87]`, and the + file-backed launch or rehydrate latch `[profile+0x97]`; `0x00502c00` is now tighter on the same + slab because its file-backed lane copies the selected row's primary and secondary `0x32`-byte + string bands into `[profile+0x11]` and `[profile+0x44]` while arming presence byte + `[profile+0x10]`; and `0x0047bc50` is the compact scan helper over `[profile+0xc6..+0xd5]` that + returns the first selector byte below `2`, which keeps that band tied to staged campaign progress + or unlock state rather than to the earlier setup-panel payload fields. The message-dispatch side is tighter now too. The local classifier at `0x004b91d8` routes the control range `0x0c352..0x0c39b` through five concrete case classes: `0x0c352..0x0c361` enter the shared selector or launch branch, `0x0c362..0x0c367` force local page `1`, @@ -441,10 +506,12 @@ `.gmp`, `.gmx`, `.gmc`, `.gms`, `.gmt`, `.smp`, `Quicksave`, the `0x004dd010` mode table at `0x005f3d58`, the auxiliary-owner presence check at `0x00434050`, and the `.gmt` handoff through `0x00469d30`, together with localized string evidence from ids `3018` and `3898`. -- Direct shell stubs above that coordinator are tighter now too: `0x004408b0` is the pure - zero-flag wrapper into `shell_map_file_world_bundle_coordinator`, while `0x004408d0` is the - sibling wrapper with flag triplet `(0, 1, 0)`. The exact user-facing command names for those two - wrappers are still open, but the dispatcher shape is no longer. +- Direct shell stubs above that coordinator are tighter now too: `0x004408b0` is the ordinary + `Save game` wrapper and forwards the pure zero-flag triplet into + `shell_map_file_world_bundle_coordinator`; `0x004408d0` is the sibling `Quick save` wrapper, + forwarding flag triplet `(0, 1, 0)`. RT3.lng closes the neighboring `shell_map_file_entry_coordinator` + pair in the same way: `0x00441ac0` is `Load game` and `0x00441af0` is `Quick load`, with the + same `(0, 0, 0)` versus `(0, 1, 0)` split above `0x00445ac0`. - Open Questions: bit `0x1` on both broad coordinators now grounds the Quicksave name seed and the former third `fileopt.win` flag has been ruled out as a file-flow question because it just opens `SettingsWindow.win`. The old broad extension question is mostly resolved: `.gmp` is the diff --git a/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md b/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md index 7949c9f..8e620b8 100644 --- a/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md +++ b/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md @@ -112,7 +112,11 @@ side is separated now too: `0x0046cce0`, `0x0046cd10`, `0x0046ce90`, and `0x0046d230` are the current small latch/state owners under `0x006cd91c`, `0x006d1280`, `0x006d1284`, and `0x006ce9c8`, while `0x0046cd30` and `0x0046ce10` are the paired current-session string/scalar - submit-and-apply handlers over `[entry+0x258c/+0x268c/+0x2690/+0x2694]`. The same callback table + submit-and-apply handlers over `[entry+0x258c/+0x268c/+0x2690/+0x2694]`. One neighboring + cross-subsystem callback is tighter now too: `0x0046cf40` mirrors one remote late + setup-preview/status payload block into `[world+0x66be]`, the same world band later serialized + and restored under bundle chunk ids `0x2ee0/0x2ee1` and re-normalized after restore through + `0x0047bc80`. The same callback table also owns one small fixed transfer-progress family rooted at `0x006ce2e8`: `0x0046cfe0` allocates the first free `0x5c` slot and optionally formats one label string, `0x0046d090` appends progress payload into the matched slot while publishing one percent string through @@ -358,7 +362,9 @@ through `0x596090`, and on success refreshes the current status text at `[transport+0xaf4]` before rerunning `0x5965d0(1)`. The same local pass also makes the negative boundary tighter: setup still touches the surrounding callback-table and replay-band fields without ever seeding a - nonzero value into `[transport+0x1778]`, so that sidecar remains an upstream producer gap. + nonzero value into `[transport+0x1778]`, so the local static seam is closed here: no ordinary + constructor, reset, service, or callback-table owner in `RT3.exe` currently writes that sidecar, + and the producer looks upstream of this local cluster. Beside it, `0x58e200` is the broader callback-table attach or refresh owner: it seeds one immediate-drain context id, conditionally copies the local name into `[transport+0x04]`, clears `[transport]`, `[transport+0x48]`, and `[transport+0x1edc]`, stores follow-on callback @@ -398,6 +404,12 @@ refresh path is tighter too: `0x59d5b0` builds one zeroed `0x1e0`-byte stub from the caller string and appends it into the flat registered-name vector `[transport+0x54c]` through the shared `generic_vector_push_back` helper `0x59e4d0`, while the smaller sibling `0x58e7a0` sits + beside it as the selector-slot text and registered-name removal path. The selector-text submit + owner itself is explicit now too: `0x593c40` is not just a generic “route request” wrapper. It + rejects null, empty, or `>= 0x101`-byte text, falls back to fixed sample `0x005c87a8` when the + caller sample pointer is null, allocates a type-`2` transient work record through `0x5934e0`, + stores the selector id in work field `+0x1c`, refreshes selector-side naming through + `0x59fc80/0x595140`, and only then hands the request into `0x58e720` with callback `0x593bb0`. under `0x5954b0` and formats one selector-slot line before removing the corresponding registered-name entry through `0x59d760`. The selector callback-name side under the same reset tail is explicit now too: `0x596900` first walks the shared selector callback-name store at @@ -491,8 +503,16 @@ `multiplayer_transport_invoke_bound_route_callback_if_present` `0x592710`, which simply calls the bound route's optional callback slot `[binding+0x14]` with companion argument `[binding+0x18]`. When the tuple does not match, the same gate instead compares descriptor fields `maxplayers` and - `numplayers`; only a descriptor with spare capacity reaches that same callback handoff. Current - evidence now also closes the clone side of that staged path: `0x596270` copies the first nine + `numplayers`; only a descriptor with spare capacity reaches that same callback handoff. The owner + directly above that gate is explicit now too: `0x595dc0` first rejects when staged-route busy + latch `[transport+0x1e8c]` or selector-slot object `[transport+0x38c]` is live, then reuses the + same tuple-or-capacity result from `0x595d60`; only a positive result lets it refresh selector + state through `0x5973b0`, reset selector slot `2` through `0x5954b0`, stage the descriptor + through `0x5958e0`, and finally drop route mode back to `0` through `0x595650` when that staging + path fails. That makes the seam read as one bounded ladder instead of three isolated helpers: + descriptor tuple match or spare-capacity gate, optional bound-route callback handoff, then the + busy-latch-screened route-transition owner above it. Current evidence now also closes the clone + side of that staged path: `0x596270` copies the first nine dwords of the source staged callback payload, clears the intrusive next-link, and then replays the source keyed-property list through shim `0x596260`, which simply reinserts each owned `(key,value)` pair into the clone's property store through `0x58d0f0`, before the clone is @@ -513,8 +533,12 @@ `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0` now bound the shared string pool used by that decoded schema, and the higher bring-up owner `0x596090` now clearly splits between `[transport+0xba4]` with owner callback `0x595a40`, the local field-cache family - `[transport+0x1724]` seeded through `0x5a08f0/0x595b60`, and `[transport+0x1164]` with owner - callback `0x595bc0`, while + `[transport+0x1724]` seeded through `0x5a08f0/0x595b60` with fixed stem `0x00629d50`, and + `[transport+0x1164]` with owner callback `0x595bc0`. The same constructor also builds the + `gsi_am_rating` primary-endpoint table `[transport+0x18bc]` from local transport name + `[transport+0x60]` plus suffix `0x005dccfc` under callback `0x595e10`, and seeds the queued + descriptor family `[transport+0x1e7c]` through `0x5a08f0/0x595f70` with fixed stem + `0x00629d54`, while `multiplayer_transport_route_callback_table_service_receive_decode_state_machine` `0x5908c0` is the current live receive/decode state machine serviced by `0x591290` in table states `2/3`. The callback-owner mode split above that runtime is now explicit too: append-notify `0x590370` @@ -548,7 +572,13 @@ route in mode `4` through `0x590ed0`. Success seeds cached progress percentage `[transport+0x1774] = 1` and immediately enqueues one mode-`3` field snapshot through `0x592b50`; failure falls back through the same clear path. `0x596530` is the `gsi_am_rating` reopen - path above `[transport+0x18bc]`. On that latter branch, `0x590dc0` is now bounded as the + path above `[transport+0x18bc]`, and that owner is tighter now too: when precondition + `[transport+0xba0]` is clear it does not even attempt the reopen and instead stamps + `[transport+0x1ed4] = 1`; otherwise it resets the am-rating route family, clears the callback + table rooted at `[transport+0x18bc]`, tries `0x590ed0(mode 4)` from stored route label + `[transport+0x1ed0]`, and only on success sets `[transport+0x1ec4] = 1` while clearing + `[transport+0x1ed4]`. On that latter + branch, `0x590dc0` is now bounded as the state-`0` raw-endpoint seed pass over the live route handle, repeatedly pulling endpoint tuples through `0x58bc7e` record type `0x1f3` before stamping descriptor flag byte `0x15` with `0x11`. That makes the remaining source-flag meaning narrower too: current evidence now supports reading @@ -560,15 +590,22 @@ `[transport+0x1ed4] = 1` and then picks route mode `1` or `3` based on whether deferred descriptor pointer `[transport+0x1ed8]` is null, and mode `5` mirrors staged companion dword `[transport+0x490]` into both `[transport+0x54]` and `[transport+0x1724+0x24]`. - The adjacent capacity-descriptor side is tighter too: `0x595bc0` now clearly publishes a - descriptor block from live descriptor properties `hostname`, `numwaiting`, `maxwaiting`, - `numservers`, and `numplayers` plus three carried sidecar scalars. Its live mode `0` path reads - those descriptor properties through `0x58d1f0`, `0x58d170`, and `0x58d6d0`, then forwards them - through opcode-`2` builder `0x592ae0`; its replay-linked modes `3/5` instead enqueue an all-zero - descriptor payload while preserving only the borrowed callback-wrapper triplet from the cached - sidecar record and then unlink that cached record through `0x5933a0`; and its callback modes - `1/2/6` are now explicit no-op fallthroughs. That sidecar at - `[transport+0x1778]` is tighter now too: current evidence says it behaves as one cached pointer + The adjacent capacity-descriptor side is tighter too: `0x595bc0` is now clearly the owner + callback for the capacity-descriptor route callback table rooted at `[transport+0x1164]`, not a + direct transport method on `ecx = transport`. The route-callback-table constructor `0x5905e0` + installs it with owner cookie `transport`, and the live route machinery later invokes it from + append-notify `0x590370` and decode-service `0x5908c0/0x5911e0` with `ecx = table object`, the + route descriptor or special decode frame on the stack, and the transport cookie on the stack. + Inside that callback it still always reads `[transport+0x1778]` first. Modes `3/5` consume that + sidecar immediately, while live mode `0` first resolves primary IPv4 plus `hostname`, + `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` through `0x58d1f0`, `0x58d170`, and + `0x58d6d0`, and only then forwards those live payload lanes together with the same sidecar + triplet `[+0x0c/+0x10/+0x18]` into opcode-`2` builder `0x592ae0`. So mode `0` is not a + sidecar-free fallback; it still requires the borrowed sidecar before it can publish the + populated descriptor block. The replay-linked modes `3/5` instead enqueue an all-zero + descriptor payload while preserving only that same borrowed callback-wrapper triplet and then + unlinking the cached record through `0x5933a0`; and its callback modes `1/2/6` are now explicit + no-op fallthroughs. That sidecar at `[transport+0x1778]` is tighter now too: current evidence says it behaves as one cached pointer into the transient work-record family at `[transport+0x1780]`, because every meaningful branch in `0x595bc0` reads the same `+0x0c/+0x10/+0x18` metadata triplet and replay modes later consume the pointer through `0x5933a0`. The negative result is stronger too: local text-side xrefs still @@ -598,13 +635,17 @@ `0`, `3`, and `5`; the upstream route-callback-table owner still delivers modes `1`, `2`, and `6`, but those are explicit no-ops in this capacity leaf. So the owner wiring itself is no longer the open edge; only the upstream sidecar producer remains unresolved. The neighboring - work queue is tighter too: `0x593330/0x593370/0x593380` now bound `[transport+0x1780]` as the - construct/clear/destroy owner family, while `0x5933a0`, `0x5934e0`, and `0x593570` ground the - remove, allocate, and completion side over that same collection. The completion owner is tighter - now too: `0x593570` clears in-flight latch `[transport+0x44]`, stores the final attach result in - `[transport+0x48]`, stamps `[transport+0x50]` on success, refreshes local name buffer + work queue is tighter too: `0x593330/0x593370/0x593380` now bind `[transport+0x1780]` as the + construct/clear/destroy owner family and explicitly treat `[transport+0x1784]` and + `[transport+0x1788]` as the queued-work and completed-work counters beside that collection, + while `0x5933a0`, `0x5934e0`, and `0x593570` ground the remove, allocate, and completion side + over that same queue. The completion owner is tighter now too: `0x593570` clears in-flight + latch `[transport+0x44]`, stores the final attach result in `[transport+0x48]`, stamps current + route scalar `[transport+0x50]` from `0x58f450` on success, refreshes local name buffer `[transport+0x04]` from `0x58e630`, republishes the staged metadata triplet through opcode-`1` - trigger wrapper `0x592a40`, and only then unlinks the consumed work record. The small sibling + trigger wrapper `0x592a40`, and only then unlinks the consumed work record. When validation of a + nominal success fails through `0x58d7e0/0x58d810`, the same owner still replays that callback + trigger but also arms deferred reset latch `[transport+0x1edc]`. The small sibling `0x593400` is tighter too: it is a pure work-record uniqueness predicate over field `+0x0c`. Its caller is tighter now too: `0x58d720` is an immediate-drain quiescence gate over one transport context id, using `0x593400` for the queued work family at `[transport+0x1780]` and `0x592970` for the @@ -654,11 +695,21 @@ buffer from the current local transport name at `[transport+0x60]` plus format `0x005dccfc`, constructs `[transport+0x18bc]` with callback `0x595e10` and that stack-built label, seeds queued descriptor family `[transport+0x1e7c]` through `0x595f70`, clears staged payload slot - `[transport+0xb50]`, and then sets callback-plumbing latch `[transport+0xba0] = 1`. `0x596210` - is the recurring service sweep over those same three - tables plus the field-cache and queued-descriptor families; `0x596060` is the explicit - `gsi_am_rating` runtime-and-queue reset; and `0x596530` is the reopen-from-stored-label sibling - above that same am-rating table. The matching local cleanup is tighter too: `0x595b80` is now + `[transport+0xb50]`, and then sets callback-plumbing latch `[transport+0xba0] = 1`. That + constructor now reads cleanly as pure callback-table and cache bringup: it leaves the later + live-route entry to the dedicated open or reopen owners `0x5962e0` and `0x596530` instead of + trying to start either live route itself. One level lower, `0x5962e0` now reads as the + field-subscription open owner rather than a vague route + helper: it clears the old `[transport+0xba4]` runtime, rebuilds the route label from the + optional caller suffix plus the fixed tail word at `0x005d0b78`, materializes one callback-key + buffer from the fixed stem `0x005e22a0..0x005e22b2`, seeds fixed field ids `1` and `0x0b`, + appends per-field selector-name ids through `0x00629958`, opens the live route in mode `4`, and + then seeds `[transport+0x1774] = 1` before the first immediate field snapshot. `0x596210` is the + recurring service sweep over those same three tables plus the field-cache and queued-descriptor + families; `0x596060` is the explicit `gsi_am_rating` runtime-and-queue reset; `0x596530` is the + reopen-from-stored-label sibling above that same am-rating table; and `0x5965a0` is the single-shot + status-route connect latch that sets `[transport+0xb40]` before forwarding into `0x5973d0`, + leaving the rollback and clear path to `0x5965d0`. The matching local cleanup is tighter too: `0x595b80` is now explicitly the field-subscription-side live-runtime reset plus field-cache clear plus active opcode-`3` purge, `0x595ce0` resets only the capacity-descriptor route callback runtime at `[transport+0x1164]`, `0x5961b0` is the full destroy-side owner over the three tables plus both @@ -675,10 +726,16 @@ body and still never writes a nonzero value into `[transport+0x1778]` before later explicit neighbor initialization. The callback-binding owner stack now tightens that boundary too: `0x5934e0` stages the shared work-record metadata triplet, `0x593650` binds it into the - callback-table worker path, and `0x593570` later consumes and republishes it, while + callback-table worker path with one fixed second worker callback and one optional first worker + callback gated by `[transport+0x4c]`, and `0x593570` later consumes and republishes it, while `[transport+0x1778]` still appears only as the borrowed sidecar read in `0x595bc0`. So this - edge is now locally closed, and the remaining producer looks like an upstream callback or worker - handoff rather than one missing ordinary field store in the local cluster. The adjacent staged-route + local ownership seam is closed: within the mapped transport cluster there is no remaining + ordinary producer to find, and the remaining source now looks like an upstream callback or worker + handoff rather than one missing field store in the local binary. The neighboring callback-vector + strip is explicit now too: `0x597300` is a no-op owner-callback stub, `0x597303` is the + validated-cookie event forwarder over callback slot `[transport+0x17f0]`, and `0x597330` is the + validated extended-payload forwarder over `[transport+0x17f4]`; both reuse the same owner + context at `[transport+0x17f8]`. The adjacent staged-route callback side is tighter too: `0x595860` is now bounded as the submit-result handler beneath `0x5958e0`, and the old `[transport+0xac0]` ambiguity there is now gone. That branch is using the already-grounded third selector-generation counter at `[0xac0]` @@ -769,12 +826,7 @@ only show it being preserved by later generic helpers like `generic_record_0x1c_deep_copy_with_owned_string_at_0x08` `0x591410` and the adjacent callback-marshaling wrappers `0x591480` and `0x591510`, not read through any dedicated semantic - accessor yet. The route-event dispatcher side is tighter too: `0x595dc0` is no longer just one - vague transition shim. It first rejects when staged-route busy latch `[transport+0x1e8c]` or - selector-slot object `[transport+0x38c]` is live, then reuses `0x595d60`; only a positive - capacity result lets it refresh selector state through `0x5973b0`, reset selector slot `2` - through `0x5954b0`, and stage the descriptor through `0x5958e0` before route mode `0` is - entered through `0x595650`. The mode-`5` tails in both + accessor yet. The mode-`5` tails in both callback families do not copy a descriptor-local field but instead mirror the transport-staged companion dword at `[this+0x490]` into `[this+0x54]` and queue-side slot `[this+0x1724+0x24]`. The `gsi_am_rating` maintenance lane is tighter now too: after pruning failed descriptors it sorts @@ -947,24 +999,44 @@ force mode `2` when `[this+0xac0] <= 1` and otherwise promote through mode `3` or `4` according to `[this+0xb48]`, while zero results set `[this+0x1ed8] = 1` and then fall back through route mode `0` or `1` according to deferred am-rating latch `[this+0x1ed4]`. On success the route-mode setter stores the current - mode at `[this+0x18b8]` and then runs one of the concrete branches: mode `0` refreshes - selector-route side effects through `0x5973b0`, resets selector slot `2`, tries to reopen the - `gsi_am_rating` callback-table family, and then falls back according to deferred route-status - flag `[this+0x1ed8]`; mode `1` conditionally reopens that family and then, when no live route is - present, tries to connect the live route through `0x597480`; mode `2` resets the am-rating - family and promotes a successful live-route connect into mode `1`; once that family is already - populated, the later callback-owner at `0x595f70` takes over by pruning stale entries, refreshing - `gsi_am_rating`, selecting the current head endpoint, and staging the route-callback payload - through `0x5958e0`; mode `3` resets the - am-rating family, refreshes selector-route state, resets selector slot `2`, and releases the - current route binding; mode `4` is the narrow status-route recovery retry; and mode `5` resets - the am-rating family, refreshes selector-route state, and releases the current route binding - without the selector-slot reset. The live-route connect path is tighter now too: `0x597480` - builds one `0x20`-byte local identifier from `[this+0x60]` plus suffix template `0x005dccfc`, - seeds the callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0`, and chooses - either the default route id `0x1964` through `0x58cc40` or the binding-specific id in - `[binding+0x30]` through `0x58c9b0`; on the binding-specific path it also clears pending rebuild - cookie `[binding+0x34]` and marks the constructed route live via `[route+0xbc] = 1`. The stable + mode at `[this+0x18b8]`, mirrors mode changes into the bound-route callback lane through + `multiplayer_transport_enqueue_bound_route_mode_snapshot_opcode4_if_live` `0x5932a0`, and then + runs one of the concrete branches: mode `0` releases the current + live route, resets selector slot `2`, and only when the am-rating route is not already live at + `[this+0x1ec4]` tries to reopen the `gsi_am_rating` callback-table family through `0x596530`; + a failed reopen then falls back according to deferred route-status flag `[this+0x1ed8]`. Mode + `1` conditionally reopens that am-rating family only when both `[this+0x1ec4]` and + `[this+0x1ed4]` are clear and then, when no live route is present, tries to connect the live + route through `multiplayer_transport_try_connect_live_route` `0x597480`; once that family is already populated, the later callback-owner at + `0x595f70` takes over by pruning stale entries, refreshing `gsi_am_rating`, selecting the + current head endpoint, and staging the route-callback payload through `0x5958e0`. Mode `2` + first releases any stale live route through `multiplayer_transport_release_live_route` + `0x5973b0` when status latch `[this+0xb40]` is clear, then resets the am-rating family and + promotes a successful live-route connect into mode `1`. Mode `3` resets the am-rating family, + releases the live route through `0x5973b0`, resets selector slot `2`, and then tears down the + current bound-route payload through + `multiplayer_transport_release_current_route_binding_detach_descriptor_callback_and_clear_slot` + `0x595620`; mode `4` is the narrow status-route recovery retry; and mode `5` resets the + am-rating family, releases the live route through `0x5973b0`, and runs that same + `0x595620` teardown path without the selector-slot reset. That helper is narrower than the older + generic wording implied: it detaches the current binding from route-label object `[this+0x1ed0]` + through `0x58f3c0`, releases the staged bound-route callback payload at `[this+0x1ec8]` through + `0x5933a0`, and only then clears `[this+0x1ec8]`. The status-route connect path is tighter now too: + `0x5973d0` seeds `[this+0xaf4]`, uses the same six callback lanes, mirrors stored route label + `[this+0x9a8]` into `[this+0xb3c]`, patches the created route's extended-payload callback slot, + and clears `[this+0xb38]` on success; when the caller route id is not `-1` it also zero-extends + the supplied route word before forwarding it into `0x58c9b0`. The local status-route helper + strip is explicit too: `0x597350` releases `[this+0xaf0]` through `0x58cfd0`, `0x597370` + services only that route through `0x58cf90`, and `0x597380` is the broader two-route sweep that + services `[this+0xaf0]` and `[this+0x1ecc]` through the common route-object service helper + `0x58d040`. The live-route connect path is tighter in the same way: + `0x597480` builds one `0x20`-byte local identifier from `[this+0x60]` plus suffix template + `0x005dccfc`, seeds the callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0`, + and chooses either the default route id `0x1964` through `0x58cc40` or the binding-specific id + in `[binding+0x30]` through `0x58c9b0`; on the binding-specific path it also clears pending + rebuild cookie `[binding+0x34]` and marks the constructed route live via `[route+0xbc] = 1`, + while the success tail mirrors stored route label `[this+0x9a8]` into `[this+0xb3c]` and clears + live-route mode mask `[this+0xb38]`. The stable transitions therefore still switch by releasing route objects or route bindings and rebuilding route state, not by mutating callback slots in place. The parser behavior is now tighter as well: semicolon lines only dispatch when `[route+0xd4]` is non-null, and the subtype-`6` raw fallback only dispatches when `[route+0xa4]` diff --git a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md index 9948158..47155e0 100644 --- a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md +++ b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md @@ -32,7 +32,9 @@ The same brush strip is tighter now too: fixed increment for class `3`, and no current contribution from class `1`. One neighboring collection-side dispatcher is tighter now too: `0x00433b80` only runs when global mutation depth `0x0062be40` is back at zero and then conditionally fans into the optional refresh hooks - `0x00481430`, `0x00413860`, `0x004b2a90`, and `0x004931e0`. The periodic boundary + `0x00481430`, `0x00413860`, `0x004b2a90`, and + `route_entry_collection_run_optional_refresh_hooks_and_validate_world_cell_side_lists` + `0x004931e0`. The periodic boundary side is narrower now too. `0x00422100`, reached only from `simulation_service_periodic_boundary_work` `0x0040a590`, first requires several live world state gates to stay clear, derives one year-sensitive random threshold from selected-year fields @@ -40,14 +42,27 @@ The same brush strip is tighter now too: dwords `[region+0x276]` and `[region+0x302]` are both clear and which fail the city-connection peer probe `0x00420030(1,1,0,0)`. When the gate passes it picks one random eligible region, derives one small severity bucket from `[region+0x25e]`, stores the scaled amount back into - `[region+0x276]`, and appends one queued `0x20`-byte record through `0x004337c0` with literal - kind `7`, the chosen region id, that amount, the fixed payload `0x005c87a8`, and sentinel dwords - `-1/-1`. That append helper is now grounded directly too: `0x004337c0` allocates one zeroed - linked `0x20`-byte node, copies one string or payload seed into `[node+0x04..]`, stores the six - trailing caller dwords at `[node+0x08..+0x1c]`, and appends the finished node to the singly - linked list rooted at `[state+0x66a6]`. The gameplay label for that queued-record family is still - open, but the structural link from periodic region selection into the scenario-state queue is now - direct instead of speculative. One neighboring owner is tighter now too: `0x004358d0` walks the + `[region+0x276]`, and appends one queued `0x20`-byte record through `0x004337c0` with payload + seed `0x005c87a8`, literal kind `7`, zero promotion-latch dword `[node+0x0c]`, the chosen region + id at `[node+0x10]`, that amount at `[node+0x14]`, and sentinel tails `-1/-1` in + `[node+0x18/+0x1c]`. That append helper is now grounded directly too: `0x004337c0` allocates one + zeroed linked `0x20`-byte node, copies one string or payload seed into `[node+0x04..]`, stores + the six fixed dwords into `[node+0x08]` through `[node+0x1c]`, and appends the finished node to + the singly linked list rooted at `[state+0x66a6]`. The queued family is no longer one unnamed + gameplay lane either. Local dispatch through `0x00437c00` now resolves kinds `0/4` as fixed + custom-modal rows, kinds `1/2` as no-op success rows, kind `3` as the direct world-side two-arg + branch through `0x004dc540`, kind `5` as the one-arg world-side branch through `0x004f29c0`, + kind `6` as the route-entry-validated branch into `0x00436820`, kind `7` as the region-focused + custom-modal owner `0x004c7520`, and kind `8` as the two-arg branch through `0x004f2d80`. + `0x004c7520` is no longer opaque: it requires scenario latch `[0x006cec74+0x277]`, stores the + queued region id in `0x006cfe80`, allocates one helper object into `0x006cfe88`, opens the + callback-driven modal through `0x004c98a0` with callbacks `0x004c72f0` and `0x004c73c0`, and on + affirmative result `0x3f2` resolves the selected region through `0x0062bae0` before recentering + the live world through `0x00433900`. That also closes the periodic producer side: `0x00422100` + is no longer just “some scaled region event,” it is the class-0 region picker that queues this + specific region-focus modal record, with the scaled amount preserved alongside the queued region + id for the later service family. So the periodic region-selection lane now ties directly into one + specific queued kind instead of only a generic queue family. One neighboring owner is tighter now too: `0x004358d0` walks the same live region collection and services those pending amounts after linked-site refreshes. When a region's pending amount at `[region+0x276]` is live and the city-connection peer probes `0x00420030` and `0x00420280` can resolve one matching peer site plus linked company through @@ -59,10 +74,13 @@ The same brush strip is tighter now too: same amount and region scalar before setting `[region+0x316]`. So the pending-region bonus lane is no longer just a queued setup artifact: it has a concrete later service owner and an explicit shell-facing fallback above the same queue family now too. `0x00438710` is the recurring queue - service owner above `[world+0x66a6]` and `[world+0x66aa]`, while `0x00438840` is the tiny + service owner above `[world+0x66a6]` and `[world+0x66aa]`; the short dirty-mark path is tighter + now as well, because it checks the per-node promotion-latch dword `[node+0x0c] == 1` rather than + reusing the queue kind field. `0x00438840` is the tiny dispatch-or-fallback sibling: it forwards the currently active queue node at `[world+0x66aa]` - into the same node-handler table `0x00437c00`, or opens the fixed custom modal rooted at - localized id `0x153` when no active node is staged. + into `simulation_dispatch_runtime_effect_queue_record_by_kind_into_shell_or_world_handlers` + `0x00437c00`, or opens the fixed custom modal rooted at localized id `0x153` when no active + node is staged. company-credit side effect. One neighboring narrow counter is bounded too: `0x00422850` counts class-0 regions that pass a second `0x00420030` peer-probe variant with fixed flags `(1,1,1)` plus one caller-supplied trailing dword, and current callers are the query/script @@ -97,11 +115,15 @@ The same brush strip is tighter now too: the surrounding placed-structure collection side is no longer just the per-record loader family. `0x004131f0` now cleanly constructs and stream-loads the live placed-structure collection, `0x00413230` constructs the empty runtime pool, `0x00413280` stream-loads tagged placed-structure - entries with progress publishing, `0x00413260` is the matching release-and-free owner, and + entries with progress publishing, one temporary per-entry shim through `0x0040c950/0x0040c970`, + and one evenly distributed `0x00ccb9e8` progress step from the saved base scalar, `0x00413260` + is the matching release-and-free owner, and `0x00413550` now clearly resolves one site id, re-enters `0x0040e080` to release local runtime and linked-site follow-on state, and only then unlinks the entry from the live collection. The adjacent helper strip is tighter too: `0x00413620` is the collection-wide linked-peer overlay - refresh sweep above `0x0040d2d0`; `0x00413660` and `0x004136e0` are the neighboring owner-color + refresh sweep above `0x0040d2d0`; `0x00413580` is the periodic quarter-subset route-style sweep + that derives one four-way start bucket from scenario byte `[world+0x11]` and then touches every + fourth live record; `0x00413660` and `0x004136e0` are the neighboring owner-color and scalar publish sweeps; `0x00413750` is the shared mode-`3/6` linked-site preview membership refresh owner; `0x00413860` is the collection-side center-cell roster sweep above `0x0040cd10`; `0x004138b0` is the route-link cleanup sweep keyed by one center-cell `u16` roster token; @@ -127,33 +149,125 @@ The same brush strip is tighter now too: live event collection at `0x0062be18` through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the scenario-side port-or-warehouse cargo recipe runtime tables through `0x00435630`, and then runs - the named-candidate availability preseed through `0x00437743`. The recipe rebuild lane itself is - tighter now too: `0x00435630` resolves both supplied and demanded token strings through the exact - live cargo-name matcher `cargo_collection_find_entry_by_exact_name` `0x0041e9f0`, fills empty - token strings from the first live cargo entry before that match, and in mode `3` loops until the - supplied and demanded strings no longer compare equal. The importer-side bridge is tighter now - too: each of the twelve recipe books writes its active-line count into the paired runtime count - lane beside the imported `0xbc` descriptor strip, and after the full twelve-book sweep the helper - explicitly re-enters + the named-candidate availability preseed through `0x00437743`. That preseed lane is tighter now + too: it walks the live candidate pool at `0x0062b268` in reverse, forces one override bit `0` + whenever the candidate availability word `[candidate+0xba/+0xbb]` is already nonzero, derives the + remaining zero-word subtype cases from the local `2 xor [candidate+0x32]` parity check, and only + skips those subtype-derived rows when the copied stage counter from `0x00620e94` is nonzero + before re-entering `0x00434f20` on the candidate stem at `[candidate+0x04]`. The event-side + `.smp` bridge is + tighter now too: the save-side companion `0x00433060` opens chunk `0x4e99`, writes version dword + `0x3e9`, first walks the live event collection through + `scenario_event_prepare_runtime_record_text_bands_for_packed_state_save` `0x0042da90`, emits the + collection-side packed metadata through `0x00517d90`, then opens chunk `0x4e9a` and serializes + each event through `scenario_event_serialize_runtime_record_into_packed_state` `0x00430d70` + before closing with `0x4e9b`; the restore-side sibling `0x00433130` then re-enters + `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each live record + during bring-up. The per-record split is narrower too: `0x0042da90` services the six fixed + The surrounding tagged collection-load strip is explicit now too. Before that same late + reactivation tail continues, `world_entry_transition_and_runtime_bringup` reloads the main route + collection `0x006cfca8` through + `route_entry_collection_refresh_records_from_tagged_bundle_and_reseed_tracker_sidecars` + `0x00493be0`, the auxiliary route-entry tracker collection `0x006cfcb4` through + `route_entry_tracker_collection_refresh_records_from_tagged_bundle` `0x004a41b0`, + placed-structure local runtime records through `0x004133b0`, + the world-manager family at `0x006ceb9c` through `0x00477780`, the geographic-label database at + `0x006ada80` through `geographic_label_database_refresh_records_from_tagged_bundle` `0x00461580`, + the placed-structure dynamic-side-buffer tagged lane on `0x006cec20` through + `placed_structure_collection_refresh_dynamic_side_buffers_from_tagged_bundle` `0x00481210`, the + linked-route-object collection at `0x0062ba84` through + `linked_route_object_collection_refresh_records_from_tagged_bundle` `0x0041d3f0`, the + city-database entry collection at `0x006cea50` through + `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540`, the live region collection at `0x0062bae0` through + `world_region_collection_refresh_records_from_tagged_bundle` `0x00421510`, the live territory + collection at `0x006cfc9c` through `territory_collection_refresh_records_from_tagged_bundle` + `0x00487c20`, and the support family at `0x0062b244` through + `support_collection_refresh_records_from_tagged_bundle` `0x0040b5d0`. + The matched save side is explicit too. Inside + `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, the same + route collections are written back through + `route_entry_collection_serialize_records_into_tagged_bundle` `0x00491c60` and + `aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle` `0x004a4240`. The + tracker per-entry save callback + `aux_route_entry_tracker_serialize_noop_per_entry_payload_stub` `0x00494ef0` is currently a bare + `ret 4`, so that tracker lane persists collection-side metadata and live ids without additional + per-entry payload. + The adjacent route-link family at `0x006ada90` is tighter now too: current world-entry bring-up + only refreshes its direct indexed-collection header or id band through `0x00518680`, and the + later live endpoint or grid state is regenerated afterward by + `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` and the + broader rebuild sibling `0x00468300` rather than by a separate tagged per-record payload lane. + text-band families at `[record+0x0e0/+0x401/+0x4ca/+0x593/+0x65c/+0x725]`, while `0x00430d70` + writes the standalone runtime condition-row chain plus the four grouped runtime-effect row chains + into the packed stream. The recipe rebuild lane itself is + tighter now too: `0x00435630` resolves both token lanes through the exact live cargo-name matcher + `cargo_collection_find_entry_by_exact_name` `0x0041e9f0`, fills empty token strings from the + first live cargo entry before that match, and in mode `3` keeps reseeding the primary lane from + that same first live cargo name until the primary and subordinate strings no longer compare equal + through `0x005a57cf`. The importer-side bridge is tighter now too: each of the twelve recipe + books first clamps the shared production-cap float that precedes the five `0x30`-byte line + records up to a fixed minimum `4.0`, then writes each book's active nonzero-mode line count into + the paired runtime count lane beside the imported `0xbc` descriptor strip. The five runtime + slots are zeroed and seeded with fixed year-window defaults before any nonzero-mode line is + imported, and each nonzero line amount is normalized to at least `1.0` before the mode `1/3` + direct primary half and mode `2/3` one-row subordinate half are populated. Mode `2` copies the + normalized line amount into `[desc+0x48]`, while mode `3` overwrites that same subordinate amount + with literal `1.0` after the token-divergence loop succeeds. + After the full twelve-book sweep the helper explicitly re-enters `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` when the live candidate collection exists. That keeps the strongest current static split narrow and concrete: mode-zero demand rows can still preserve readable cargo-name text in the saved recipe books, but only the nonzero imported rows reach the live `0xbc` descriptor array, and the unresolved supply-marker forms still have no special decode path before the exact matcher runs. - The immediate helper strip under that bridge is tighter now too: `0x00411d50` is the narrow + The first grounded consumer beneath that import bridge is tighter now too: + `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` lazily stamps the current + scenario year into `[candidate+0x788]`, rebuilds four banks across both mode banks `0/1`, and + returns one direct primary-cargo scalar channel, one cap-share primary-cargo scalar + channel, one nonzero-mode subrow channel, and one zero-mode cap-scaled subrow channel for a + requested cargo id. The two primary-cargo banks index from `[desc+0x1c]`, while both subordinate + row banks index from `[desc+0x44+row*0x1c]`; nonzero-mode descriptors only feed the nonzero-mode + subrow bank, while mode-`0` descriptors either add their direct scalar to `[this+0x03a]` or, when + subrows are present, add one cap-share scalar to `[this+0x0a4]` and one cap-scaled row + contribution to `[this+0x178]`. That keeps the cargo-id-`0` boundary narrow and concrete too: + if marker rows still fail `0x0041e9f0`, they will hit the first bank bucket inside `0x00412650`, + but the broader steady-state caller layer already avoids treating cargo id `0` as a normal cargo + request: the candidate-service bitset owner loops from cargo id `1`, and the placed-structure + sweep routes explicit cargo-id-`0` requests into the linked-site classification side instead of + the ordinary cargo-reference helper. That means the remaining load/save gap in this local bridge + is the marker-token meaning itself, not another missing consumer-side structure. The runtime descriptor + construction is tighter in the same way: each imported `0xbc` slot is + zeroed first, seeded with fixed year-window defaults `0x0708..0x270f`, then filled only for + nonzero source-line modes; mode `2/3` writes the supplied token lane through `+0x08 -> +0x1c` + plus the direct annual amount at `[desc+0x04]`, while mode `1/3` writes one subordinate-row + demand half through `+0x30 -> +0x44` with `[desc+0x2c] = 1`, and production mode `3` forces that + demand-row amount to `1.0` at `[desc+0x48]` instead of reusing the entered annual amount. + The immediate helper strip under that bridge is tighter now too. `0x00411ee0` is no longer just + a vague summary refresh: it clears the two compact cargo-id tables at `[candidate+0x79c]` and + `[candidate+0x7a0]`, clears the per-cargo float band `[candidate+0xa1..+0xb8]`, fills one local + `0x35`-cargo status scratch where `1` means referenced and `2` means currently year-active, keeps + that maximum status per remapped cargo id through `0x0062ba8c+0x9a`, and then compacts the + `status>=1` and `status>=2` sets back into the two emitted cargo-id tables with counts + `[candidate+0x7a4]` and `[candidate+0x7a8]`. The same scan publishes the stronger production-side + split too: mode-`0` descriptor rows are cap-scaled by `[candidate+0x2a] / [desc+0x04]`, while + nonzero-mode rows bypass that normalization and keep their direct row amount. Below that, `0x00411d50` is the narrow descriptor-pattern predicate that returns true only when every imported descriptor keeps mode `0` and at least one descriptor has no subordinate rows, while `0x00411da0`, `0x00411e10`, and `0x00411e50` are conservative fixed-table accessors over candidate slot `[candidate+0x798]`, exposing one copied name plus either a scalar pair or scalar triplet from the same fixed row in `0x005ed338..0x005edca4` rather than a separate loader family. + The sibling post-import flag pass `0x00411ce0` is tighter in the same way: for subtype byte + `[candidate+0x32] == 2`, `[candidate+0x790]` records whether any mode-`0` descriptor exists, + while `[candidate+0x78c]` stays armed only when every mode-`0` descriptor carries at least one + subordinate row, or when no mode-`0` descriptors exist at all. One later subphase is tighter now too: before the broad world-reactivation sweep it posts progress ids `0x32dc/0x3714/0x3715`, reloads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged - runtime-profile bytes back into `0x006cec7c` while latch `[profile+0x97]` is set, mirrors the - grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world - bytes `[world+0x66de]` and `[world+0x66f2]`, and restores the selected year/profile lane through - a tighter two-stage calendar path than before. Current local disassembly now shows the raw saved - lane at `[profile+0x77]` first feeding helper `0x0051d3f0` with constant components + runtime-profile bytes back into `0x006cec7c` while the file-backed profile rehydrate latch + `[profile+0x97]` is set, mirrors the grounded campaign/setup byte `[profile+0xc5]` and sandbox + launch byte `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, and + restores the selected-year lane through a tighter two-stage calendar path than before. Current + local disassembly now shows the raw saved lane at `[profile+0x77]` first feeding + `calendar_pack_year_and_component_bytes_to_packed_tuple_dwords` `0x0051d3f0` with constant components `(month=1, day=1, subphase=0, tick=0)`, which writes the resulting Jan-1-style tuple dwords into `[world+0x05/+0x09]`. Only after that seed does the same lane enter one mode-sensitive adjustment branch: non-editor startup mode can decrement the lane by `1` or `3` depending on @@ -169,14 +283,37 @@ The same brush strip is tighter now too: rebuilds the collection aggregate subtotal band at `[pool+0x8c..+0x9c]`, repopulates the fixed name catalog at `0x0061dbc2/0x0061dc09` for non-subtype-`1` zero-availability candidates whose live ids stay within `0x6e`, and then reruns the named-availability pass at `0x00412c10` before - returning. The neighboring placed-structure side + returning. The surrounding bringup strip is explicit now too: the world-entry load branch passes + through one bare placeholder `structure_candidate_post_collection_construct_noop_placeholder` + `0x00411d90` between constructing `0x0062b268` and allocating the auxiliary candidate pool at + `0x0062b2fc`, so that callsite is no longer an unmapped hole in the candidate-side loader path. + The same load strip is tighter now too: `0x00412ab0` is the pure stem-policy sweep + that refreshes candidate dword `[+0xbc]` from defaults `0x1869f/3/4` plus the fixed override + table at `0x005edca8..0x005edd20`, with the non-default `3/4` branches driven directly by + post-import flag `[candidate+0x78c]` and subtype byte `[candidate+0x32]`. The per-record loader + `0x004120b0` now clearly reads the fixed header fields first, allocates the descriptor strip as + `count*0xbc + 1`, zeroes every imported `0xbc` descriptor slot before import, resolves primary + mode-`0` cargo names from `+0x08 -> +0x1c` and subordinate row cargo names from `+0x30 -> +0x44`, + clamps descriptor start year `[desc+0x20]` upward to the resolved cargo availability floor + `[cargo+0x21]`, and only then reruns `0x00411ee0` plus `0x00411ce0`. Its version gates are + explicit too: bundles before `0x3ed` omit `[candidate+0x3b..+0xbb]`, bundles before `0x3f2` + keep the narrow `0x02`-byte form of `[candidate+0xc0]`, nonzero `[candidate+0x4b]` forces + `[candidate+0x47] = 1.0` and rescales `[candidate+0x43]` to at least `0x1388`, and the later + stem-index resolution first checks two built-in alias stems before the full fixed row table at + `0x005ed338..0x005edca4`. The neighboring placed-structure side is bounded too: global pool `0x0062b26c` comes from `placed_structure_collection_construct_empty_runtime_pool` `0x00413230`, while the paired tagged collection owners `0x00413280` and `0x00413440` now own the broader placed-structure stream load/save path around tags `0x36b1/0x36b2/0x36b3` and the per-entry virtual load/save slots - `+0x40/+0x44`. + `+0x40/+0x44`. The adjacent auxiliary or source-record side is tighter now too: global + `0x0062b2fc` comes from + `aux_candidate_collection_construct_seed_globals_and_helper_bands_then_import_records` + `0x0041aa50`, which seeds constructor globals `0x0062b2f0/0x0062b2f4/0x0062b2f8`, initializes + the collection configuration, allocates the three owned helper bands at `[this+0x88/+0x8c/+0x90]` + through `0x0041a990`, and then tails into the already-grounded tagged import owner + `0x004196c0` plus the later rebank-or-clone refresh `0x00419230`. adjusted lane then feeds - helper `0x0051d390` before `world_set_selected_year_and_refresh_calendar_presentation_state` + `calendar_pack_unpacked_components_to_absolute_counter` `0x0051d390` before `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` stores the final absolute counter into `[world+0x15]` and refreshes `[world+0x0d/+0x11]`. That means the restore no longer reads as a direct `[profile+0x77] -> [world+0x15]` copy; the raw lane seeds the tuple immediately, but the final @@ -191,22 +328,51 @@ The same brush strip is tighter now too: band directly too: `world_runtime_serialize_smp_bundle` `0x00446240` writes `49` dwords from `[world+0x4a7f..+0x4b3f]` plus one trailing scalar at `[world+0x4b43]`, and `world_load_saved_runtime_state_bundle` `0x00446d40` restores the same fixed `0xc8`-byte band - symmetrically. Slot `30` in that table is localized pair `3722/3723` + symmetrically. The surrounding `.smp` lane is tighter too: at version `>= 0x3f1` the save path + also writes the late world-status block at `[world+0x66be]` through chunk ids `0x2ee0/0x2ee1`, + and the restore path reads that same pair back while older bundles clear the compatibility tail + at `[world+0x6987]`; both sides also copy the raw twelve `0x4e1` recipe books at + `[world+0x0fe7]` directly into or out of the bundle before the wider world-cell loops. One + serializer-side negative boundary is explicit now too: after the save path emits the six-dword + economic tuning band at `[world+0x0be2..+0x0bf6]`, it spends its next large loops on per-cell + world-grid, overlay-mask, sidecar-plane, and secondary-raster bit serialization and only then + jumps directly to the recipe-book root at `[world+0x0fe7]`. So the later pre-recipe plateau is a + real save-neighbor family, but current local evidence no longer supports treating it as one + contiguous `.smp` serializer-owned slab beyond that leading six-dword tuning band. Slot `30` + in that table is localized pair `3722/3723` `Disable Cargo Economy`, so `+0x4af7` now reads as the live copy of that saved scenario rule, not a startup-runtime-only mystery latch. The neighboring fixed reads line up with the same rule cluster too: `+0x4aef` is slot `28` `Completely Disable Money-Related Things`, `+0x4af3` is slot `29` `Use Bio-Accelerator Cars`, `+0x4afb` is slot `31` `Use Wartime Cargos`, `+0x4aff` is slot `32` `Disable Train Crashes`, `+0x4b03` is slot `33` `Disable Train Crashes AND Breakdowns`, and - `+0x4b07` is slot `34` `AI Ignore Territories At Startup`. So the remaining loader gap is - narrower than before: the restore still depends on live shell policy `[shell+0x178]`, but the - `+0x4af7` input itself is save-derived scenario rule data rather than something that requires - runtime tracing to discover. Its read-side family is no longer isolated to the selected-year + `+0x4b07` is slot `34` `AI Ignore Territories At Startup`. The remaining restore-side dependency + is now concrete rather than mysterious: the year adjustment still depends on live shell policy + `[shell+0x178]`, but that policy already has grounded UI writers and the `+0x4af7` input itself + is save-derived scenario rule data rather than something that requires runtime tracing to + discover. Its read-side family is no longer isolated to the selected-year restore either: it also shapes the chunk size in `simulation_run_chunked_fast_forward_burst` `0x00437b20` and appears in candidate/local-service selection and station-detail-side scoring branches around `0x0047f910`, `0x00410d87`, and `0x005069c6`, which now makes this whole slot cluster look like broader runtime consumers of - scenario special conditions rather than one startup-only mode enum. One file-side anchor is now - tighter too: the checked classic and 1.05 `gmp/gms/gmx` corpus does expose the same aligned + scenario special conditions rather than one startup-only mode enum. That startup-side consumer + split is tighter now too: inside the localized `Computing Transportation and Pricing...` bring-up + lane, `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437743` only runs + before global stage counter `0x00620e94` reaches `0x26ad`, reverse-walks the live candidate pool, + and seeds the scenario-side named availability table through `0x00434f20` with one override bit + derived directly from current live candidate state. Any nonzero availability pair + `[candidate+0xba/+0xbb]` forces that upsert with override bit `0`; otherwise the zero-availability + path derives its bit from subtype parity on `[candidate+0x32]` through the local `2 xor subtype` + branch and only skips those subtype-driven cases when the copied stage counter is already nonzero. + The same startup strip then flows into `world_seed_default_chairman_profile_slots` `0x004377a0`, + which compacts the 16 staged chairman slot records at `[world+0x69d8]`, writes the first-pass + selector bytes into `[profile+0x87+i]`, and only after that materializes the named-profile rows + through `0x00476140`. So the save-derived special-condition band no longer sits beside anonymous + startup glue: the bring-up path now has one concrete candidate-availability mirror at + `0x00437743`, one concrete chairman-slot selector seeding pass at `0x004377a0`, and then the + economy burst `0x00437b20`, whose own loop count is now tighter than before because a nonzero + `[world+0x4af7]` forces the chunk count to literal `0x150` instead of leaving the shell-side + `[0x006cec74+0x178]` count in control. One file-side anchor is now tighter too: the checked + classic and 1.05 `gmp/gms/gmx` corpus does expose the same aligned `0x0d64..0x0e2c` `50`-dword band as the grounded `.smp` runtime save or restore copy into `[world+0x4a7f..+0x4b43]`, but most checked file families only populate a sparse subset of that band. The first `36` dwords still behave like the older inferred fixed rule matrix with hidden @@ -239,16 +405,19 @@ The same brush strip is tighter now too: and classic saves leave that whole post-sentinel band zeroed, while checked 1.05 saves carry sparse nonzero dwords there, many of which decode cleanly as normal little-endian `f32` values. That makes the adjacent band look like a 1.05 save-only - runtime band rather than scenario-static payload, even though its semantics are still open. + runtime band rather than scenario-static payload. So the local static seam there is closed: it + is runtime-save state, and only the exact owner family of those scalar lanes remains unnamed. One numeric alignment inside that band is now exact too: the tail start `0x0e2c` is the same relative distance from the aligned runtime-rule base `0x0d64` as live object offset `+0x4b47` is from grounded world-rule base `[world+0x4a7f]`, so the bounded tail window `0x0e2c..0x0f30` is offset-aligned with live bytes `[world+0x4b47..+0x4c4b]`. The first - grounded live field at that boundary is no longer anonymous. `0x004367c0` sets one outcome mode - in `[world+0x4a73]`, zeros `[world+0x4d]`, snapshots the selected-year lane to `[world+0x4c88]`, - and then copies localized id `2923` `You lose.` or `2924` `You win, cheater...` into - `[world+0x4b47]`; `0x00472dd0` formats localized id `3918` `%1 has won the game!` with one live - profile name and writes that string into the same destination; and one compact runtime-effect + grounded live field at that boundary is no longer anonymous. + `world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text` `0x004367c0` sets one outcome + mode in `[world+0x4a73]`, zeros `[world+0x4d]`, snapshots the selected-year lane to + `[world+0x4c88]`, and then copies localized id `2923` `You lose.` or `2924` + `You win, cheater...` into `[world+0x4b47]`; `0x00472dd0` formats localized id `3918` + `%1 has won the game!` with one live profile name and writes that string into the same + destination; and one compact runtime-effect branch inside `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20` resets the same destination to the fixed placeholder token at `0x005c87a8`. That gives a grounded live owner above the latch too: `simulation_service_world_outcome_mode_prompt_and_transition_effects` @@ -265,16 +434,24 @@ The same brush strip is tighter now too: clean live-field boundary at `[world+0x4c73]`, and checked 1.05 saves still carry sparse nonzero bytes in that continuation window rather than a trailing text-looking suffix. Checked 1.05 save bytes in the aligned region therefore still do not resemble preserved text; they stay mostly zero - at the beginning and many nonzero lanes decode as ordinary `f32` values. So the safest current - note is: the tail is offset-aligned with the live object beyond `+0x4b43`, but it is not yet a - validated byte-for-byte mirror of the live `[world+0x4b47]` status-text buffer, and the current - nonzero save-side content continues right up to the first clean field edge at `0x0f58`. The next + at the beginning and many nonzero lanes decode as ordinary `f32` values. So the safer current + read is no longer “maybe a preserved text buffer.” This `0x0e2c..0x0f58` tail is an + offset-aligned save-side runtime band that overlaps the live outcome-text region in memory but is + not serialized as the raw `[world+0x4b47]` text payload. The current nonzero save-side content + continues right up to the first clean field edge at `0x0f58`, after which the next exact grounded + fields switch to byte and dword lanes with independent semantics. The next exact grounded fields after that edge are byte lanes, not restored dwords: `0x0f59` maps to `[world+0x4c74]` `Auto-Show Grade During Track Lay`, `0x0f5d` maps to `[world+0x4c78]` `Starting Building Density Level`, `0x0f61` maps to `[world+0x4c7c]` `Building Density Growth`, `0x0f65` maps to grounded dword `[world+0x4c80]` `leftover simulation time accumulator`, and - `0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The first later grounded - dword after that is `[world+0x4c8c]` at `0x0f71`. The frame-side follow-on above the outcome + `0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The next later grounded + field after that is no longer best read as a dword either: `0x0f71` is the first byte of the + cheat-toggled scenario-lock trio rooted at `[world+0x4c8c..+0x4c8e]`, not the start of one + independently grounded 4-byte scalar. Current runtime-side evidence only gives one narrower + consumer inside that trio: `[world+0x4c8e]` is the crash-side global gate already checked by + `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0`, while + `0x00437d70` still bounds all three bytes together as cheat-toggled scenario state. The + frame-side follow-on above the outcome prompt is grounded now too: after `0x00436350` stamps `[world+0x4a77]`, internal branch `0x0043963d` keeps running only while `[world+0x4a7b]` still matches the current step-local marker, then services the queued runtime-effect record family rooted at `[world+0x66a6]` @@ -318,10 +495,99 @@ The same brush strip is tighter now too: this later band now has the same conservative read as the post-text one: the save bytes are still offset-correlated to grounded live fields, but the exact live byte or dword layout is not yet validated as a direct on-disk mirror. - One more structural cut is now grounded beyond that neighborhood. The aligned scalar plateau - `0x0fa7..0x0fe7` ends exactly at the later recipe-book root `[world+0x0fe7]` already grounded in - the port-or-warehouse cargo editor and runtime rebuild path. We still do not have live semantic - names for the plateau itself, but its aligned dword run now splits cleanly by save family. The + One more structural cut is now grounded beyond that neighborhood. Under the same offset + alignment used above, file offset `0x0fa7` maps to the start of the later scenario-state band + `[world+0x4cc2]`, and `scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges` + `0x00436d10` now explicitly zeroes that late-state band before it separately zero-fills the + twelve recipe books at `[world+0x0fe7]`. That reset owner is tighter now too: it does not just + clear one anonymous slab. It first zeroes exactly `0x9b` dwords plus one trailing byte from + `[world+0x4cc2]`, then separately clears the much larger late runtime slab rooted at + `[world+0x66be]`, and also explicitly resets several already-grounded outcome, rule, and policy + lanes: the scenario-rule table `[world+0x4a7f..+0x4b3f]` plus trailing scalar `[world+0x4b43]`, + the outcome-status text root `[world+0x4b47]`, outcome or cheat words `[world+0x4a73/+0x4a77/+0x4a7b]`, + the byte-policy and cached-scalar cluster `[world+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, + and the trailing float strip `[world+0xbce..+0xbf6]` before reseeding its fixed defaults. That + default reseed is concrete now too: `0x00436d10` restores `[world+0x0be2]` and its live mirror + `[world+0x0bde]` to `1.0f`, seeds the next four tuning lanes + `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2]` to `0x3c75c28f`, and seeds `[world+0x0bf6]` to + `0x3ba3d70a` before the later selected-year and candidate refresh path runs. The recipe-side + reset is explicit in the same way: after zeroing exactly `0xea3` dwords rooted at + `[world+0x0fe7]`, the same owner repopulates all twelve `0x4e1`-byte books from the fixed + template table at `0x005c9f78`, using generated ordinal strings `1..12` as the per-book name + lane before later runtime recipe projection re-enters `0x00435630`. That + same reset owner is now the strongest current live bridge over the whole later pre-recipe + plateau: + after clearing `[world+0x4cc2..+0x4d02]` it rebuilds the named candidate and locomotive + availability collections, reruns the selected-year adjustment path through + `0x0051d3f0 -> 0x0051d390 -> 0x00409e80`, refreshes the derived year-threshold side through + `0x00435603`, reruns candidate filter or visible-count maintenance through `0x0041e970`, and + refreshes the cached available-locomotive rating through `0x00436af0`, which now reads as a + year-tiered baseline `110/200/300` plus the strongest surviving live locomotive rating filtered + by era-policy and named-availability gates. So the aligned scalar + plateau `0x0fa7..0x0fe7` now has a stronger boundary than “some bytes before the recipe books”: + it is the later save-side neighbor immediately in front of a reset-and-rebuild band whose + downstream consumers are already grounded. The local layout seam is therefore closed even though + we still do not have live semantic names for most of the plateau dwords themselves. The + serializer-side evidence now sharpens that same boundary too: current local disassembly of + `0x00446240` writes the leading six-dword tuning band, then falls into the world-grid and + secondary-raster loops, and only after those loops jumps straight to `[world+0x0fe7]` for the + recipe books. So the plateau is still a real save/load family, but not one direct serializer + block in the same way as the recipe books or the scenario-rule band. The earlier + late-state cluster is tighter now too: `[world+0x4c9a]` and `[world+0x4c9e]` are no longer just + save-side counters in the reset slab. The support family at `0x0062b244` actively maintains them + as two nonnegative live-entry counters through + `support_collection_try_spawn_goose_entry_in_primary_counter_lane` `0x0040b0b0`, + `support_collection_select_or_spawn_goose_entry_id` `0x0040b2d0`, and + `support_collection_release_entry_and_decrement_world_type_counters` `0x0040af00`. The paired + float lanes `[world+0x4ca6/+0x4caa]` are tighter in the same way: `0x0041144f` accumulates live + deltas into pending lane `+0x4caa`, `scenario_state_roll_pending_float_0x4caa_into_accumulator_0x4ca6` + `0x00433f02` rolls that pending value into accumulator `+0x4ca6`, and the shell-side query lane + at `0x0042f89b/0x0042f8bb` reads both the pending-only and accumulated sums. `[world+0x4cb6]` + is also no longer an anonymous save byte or dword: the shell-side `TrainList.win` family rooted + at `0x006d3b34` actively mirrors the current selected train-side support-entry id there. The + constructor `shell_train_list_window_construct` `0x00515f50` seeds the singleton and wires the + top list controls `0x32c9/0x32ca`; the refresh owner + `shell_train_list_window_refresh_controls` `0x005158f0` reselects `[world+0x4cb6]` when that id + still resolves to one live train owned by the current company; and the message owner + `shell_train_list_window_handle_message` `0x00515c60` mirrors top-list picks and direct payloads + back into `[world+0x4cb6]` before republishing focus through `0x00433900` and the detail-panel + transition manager. The earlier helper writes at `0x00514b0e`, `0x00515d14`, and `0x00515f40` + now sit cleanly inside that same train-list selection seam. The smaller callback strip under the + same family is grounded too: `0x005157e0` exposes the current top-side latch `0x006d3b30`, + `0x00515780` preserves the lower action range `0x332c..0x36b0` only while the event still + targets the active top list, `0x005157f0` is the shared top-list train-row summary renderer over + `0x004bd4a0`, `0x00515820` is the focus-and-follow callback that republishes a selected train id + into the shell detail controller and can recenter the world through the linked route object, and + `0x005158b0` is the inactive-side lower-row refresh callback into `0x004bf320`. + The neighboring bytes `[world+0x4c90/+0x4c91/+0x4c92]` are narrower now too, but only in the + negative sense: the current binary still shows no grounded non-reset readers or writers for + those three one-byte lanes. In local static evidence they only appear in the shared + scenario-state reset-and-rebuild owner `0x00436d10`, which clears them alongside the broader + late-state cluster before the later selected-year, availability, and recipe-runtime rebuilds. + So the strongest current read is that they remain reset-only late-state bytes, not yet another + live shell or simulation seam. + The earlier + persisted six-dword tuning band should now + be kept separate from that later slab rather than folded into the same “pre-recipe plateau” + label. The editor and runtime bridge is tighter now too: the shell-side + economic tuning owner `0x004ca980/0x004cadf0` writes the visible slider values directly into + `[world+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]` and mirrors the first lane into + `[world+0x0bde]`; the `.smp` save/load pair persists that same six-dword band; the post-load + generation pipeline `0x004384d0` reseeds `[world+0x0bde]` from `[world+0x0be2]` before its early + setup passes; and `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` + consumes `[world+0x0bde]` as one global multiplier on both its live-region and fallback + projected-structure branches. The editor-side read path is explicit on the same seam: + `map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows` `0x004caaf0` reads the + same six-float band, builds the live preview curve on control `0x5be1`, and republishes the six + numeric value rows through controls `0x5bce/0x5bd0/0x5bd2/0x5bd4/0x5bd6/0x5bd8`, so the panel is + now grounded as a full read/write save-state owner rather than only a slider mutator. The + recurring maintenance side is grounded too: + `simulation_service_periodic_boundary_work` `0x0040a590` derives one bounded bucket from the + selected-year gap, reads the corresponding float from the five-slot table + `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and folds that result back into the running + scalar `[world+0x0bde]` before its company/profile refresh sweep. Its aligned dword run now + splits cleanly by + save family. The base 1.05 saves (`Autosave.gms`, `nom.gms`) carry one stable signature with `0x0faf = 0x8000003f`, `0x0fb3 = 0x75c28f3f`, repeated `0x75c28f3c` lanes through `0x0fbf`, a sign-flipped lane `0x0fc3 = 0xa3d70a3c`, one tiny marker at `0x0fc7 = 0x0000003b`, and @@ -369,70 +635,97 @@ The same brush strip is tighter now too: bounded rather than semantically named. The same branch is no longer world-entry-only either: current local disassembly now shows the identical lane-adjust and - `0x51d3f0 -> 0x51d390 -> 0x409e80` sequence in the post-fast-forward selected-year tail at - `0x004370e0`, which lines up with the existing post-fast-forward callers already mapped under - `0x00433bd0`, `0x00435603`, `0x0041e970`, and `0x00436af0`. That restore now + `0x51d3f0 -> 0x51d390 -> 0x409e80` sequence in the post-fast-forward selected-year tail inside + `scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges` + `0x00436d10`, which lines up with the existing post-fast-forward callers already mapped under + `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, + `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, + `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, and + `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`. That restore now also has some neighboring slot semantics bounded well enough to carry in the loader notes. Slot `31` `[0x006cec78+0x4afb]` is no longer best read as an unnamed runtime cargo-economy latch: local disassembly now ties it directly to the saved special-condition table entry `Use Wartime Cargos`, and the strongest current runtime owner is `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Inside that - candidate-collection sweep the branch at `0x0041ed37` only activates when slot `31` is set and + candidate-collection sweep the wartime-cargo branch only activates when slot `31` is set and then treats the string family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and `Diesel` as one special cargo set before writing the live candidate filter byte `[entry+0x56]`. That makes the old read-side note around `0x00412560` tighter too: the neighboring descriptor gate is now best understood as using the live copy of the `Use Wartime Cargos` scenario rule, - not an anonymous cargo-economy mode byte. Slot `34` `[0x006cec78+0x4b07]` is similarly bounded - on the runtime side: the wrapper at `0x004013f0`, which sits immediately above the broader - company-start or city-connection chooser `0x00404ce0`, snapshots region dword `[entry+0x2d]` - across all `0x18` live region records in `0x006cfc9c`, zeros that field while the chooser runs, - and then restores the original values on exit. That is a strong current fit for the editor rule - `AI Ignore Territories At Startup`, even though the exact meaning of region field `+0x2d` - remains open. Slot `29` `[0x006cec78+0x4af3]` is less semantically tidy but still worth carrying - as a bounded consumer family: the branch at `0x0041d286` activates one later placed-structure or - building-side scoring path only when that slot is nonzero and the linked candidate or era record - at `[entry+0x41]` equals `5`, while two already-grounded world helpers + the live cargo-availability latch at `[cargo+0x16e]`, and the paired selected-bank dword gates + `[desc+0x24/+0x28]`, not an anonymous cargo-economy mode byte. Slot `34` `[0x006cec78+0x4b07]` + is similarly bounded + on the runtime side: + `world_run_company_start_or_city_connection_chooser_with_region_field_0x2d_temporarily_cleared_if_rule_0x4b07` + `0x004013f0`, which sits immediately above the broader company-start or city-connection chooser + `0x00404ce0`, snapshots region dword `[entry+0x2d]` across all `0x18` live region records in + `0x006cfc9c`, zeros that field while the chooser runs, and then restores the original values on + exit. The chooser-side effect is now the useful grounded part: the same owner normally uses + `[region+0x2d]` as one per-region exclusion gate while building startup or city-connection + candidates, so slot `34` effectively suppresses that exclusion latch during the startup pass + without needing a stronger semantic name for the field itself. Slot `29` `[0x006cec78+0x4af3]` + is less semantically tidy but still worth carrying + as a bounded consumer family: the placed-structure-side radial class-`2` stamp path only + activates when that slot is nonzero and the linked candidate or era record at `[entry+0x41]` + equals `5`, while two already-grounded world helpers + `world_stamp_radial_secondary_raster_class_2_marks_from_world_coords` `0x0044e7d0`, `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` and `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670` also gate on the same slot. So the identity of slot `29` as saved rule data is grounded, but the downstream runtime semantics are still mixed enough that the loader should preserve the raw value without trying to rename its whole consumer family yet. The neighboring train-safety slots are now bounded enough to keep as a cautious runtime split too. Slot `33` `[0x006cec78+0x4b03]` - `Disable Train Crashes AND Breakdowns` is the coarse gate in the currently recovered train-side - deterioration family around `0x004af8a0`: the very first branch at `0x004af8ab` jumps straight + `Disable Train Crashes AND Breakdowns` is the coarse gate inside + `train_service_try_trigger_crash_or_breakdown_from_year_and_load_thresholds` `0x004af8a0`: the + very first slot-`33` gate jumps straight to the function tail when the slot is set, bypassing the year-scaled threshold build, the later random or threshold comparison, and the two follow-on state transitions at `0x004ad7a0` and `0x004ada00`. Slot `32` `[0x006cec78+0x4aff]` `Disable Train Crashes` is narrower in the same - family: after the threshold path has already run, the branch at `0x004af9c1` uses slot `32` to + family: after the threshold path has already run, the later slot-`32` gate uses slot `32` to suppress only the lower failure-transition path and force the milder follow-on at `0x004ada00`. - That same slot-`33` read also appears in the smaller train-side scalar query at `0x004ac460`, - where setting it returns one fixed float immediately before the ordinary route-object-dependent - calculation runs. So the current best loader-facing read is: slot `33` is the broad train - deterioration bypass, slot `32` is the narrower crash-only branch inside that same family, but - the exact player-facing names of the two unnamed train helpers still need one more naming pass. + That same slot-`33` read also appears in + `train_query_deterioration_scalar_with_disable_bypass` `0x004ac460`, where setting it returns + one fixed float immediately before the ordinary route-object-dependent calculation runs. So the + current best loader-facing read is: slot `33` is the broad train deterioration bypass, while slot + `32` matches its loader-facing label directly as the narrower `Disable Train Crashes` gate inside + the same family, suppressing only the crash transition while leaving the breakdown branch live. That restore now also has one concrete file-side correlation in the classic `.gms` family: local save inspection now consistently finds `0x32dc` at `0x76e8`, `0x3714` at `0x76ec`, and `0x3715` at `0x77f8` in `Autosave.gms`, `kk.gms`, and `hh.gms`, leaving one exact `0x108`-byte span from `0x76f0` to `0x77f8` between `0x3714` and `0x3715`. That span already carries staged-profile-looking payload text such as `British Isles.gmp`, so the current static-file evidence now supports the atlas-side - `0x108` packed-profile note for the classic save family even though the exact field layout inside - that block is still unresolved. The same classic corpus is tighter now too: inside that - `0x108` span the map-path C string begins at relative offset `0x13`, the display-name C string - begins at `0x46`, the block is otherwise almost entirely zeroed, and the three local samples are + `0x108` packed-profile note for the classic save family as another serialized setup-profile slab, + not an unrelated anonymous save trailer. The same classic corpus is tighter now too: the leading payload + boundary is slightly skewed relative to the simple `0x76f0` chunk cut, which is why the classic + map-path C string first becomes visible at relative offset `0x13` and the display-name string at + `0x46` instead of the cleaner `0x10/0x43` split seen in the 1.05 branch. Outside that skewed + front edge the block is otherwise almost entirely zeroed, and the three local samples are byte-identical except for the leading dword at `+0x00` (`3` in `Autosave.gms` and `hh.gms`, - `5` in `kk.gms`). The currently atlas-tracked bytes `[profile+0x77]`, `[profile+0x82]`, + `5` in `kk.gms`). One middle strip in that classic block is now exact too: all three checked + saves carry the same fixed bytes `+0x79..+0x8a = 25 07 01 00 01 00 01 00 00 00 00 00 da 33 00 00 01 65`. + The currently atlas-tracked bytes `[profile+0x77]`, `[profile+0x82]`, `[profile+0x97]`, and `[profile+0xc5]` are all `0` in that classic sample set, so the current - file-side evidence grounds the block boundaries and the embedded strings but does not yet show - live examples of those branch-driving latches being set. One 1.05-era file-side analogue is now + file-side evidence now supports a stronger boundary than the older “field layout unresolved” note: + the classic slab preserves the same staged-profile string core and the same middle-band setup + structure, but in the checked classic saves the branch-driving launch/campaign latches stay zero + and most surrounding bytes remain empty. So the local static seam is closed here too: this is the + same serialized setup/runtime profile family, and the remaining work is only the exact meaning of + the fixed middle bytes and the skewed front-edge framing in the classic serializer. One 1.05-era + file-side analogue is now visible too, but only as an inference from repeated save structure rather than a disassembly-side field map: local `.gms` files in `rt3_105/Saved Games` carry one compact string-bearing block at `0x73c0` with the same broad shape as the classic profile slab, including a leading dword at - `+0x00`, one map-path string at `+0x10`, one display-name string at `+0x43`, and a small - nonzero tail around `+0x76..+0x88`. In that 1.05 corpus the analogue bytes at relative `+0x77` - and `+0x82` are now nonzero in every checked sample (`Autosave.gms`/`nom.gms` show `0x07` and - `0x4d`; `p.gms`/`q.gms` show `0x07` and `0x90`; `g.gms` shows `0x07` and `0xa3`), while - relative `+0x97` and `+0xc5` remain `0`. The compared 1.05 save set is tighter now too: + `+0x00`, one map-path string at `+0x10`, one display-name string at `+0x43`, and a middle strip + around `+0x76..+0x88` that is now more specific than the earlier generic “small nonzero tail” + note. Across all five checked 1.05 saves, the compact slab keeps `+0x77 = 0x07`, `+0x78 = 0x01`, + `+0x7c = 0x01`, `+0x86 = 0x01`, and `+0x87 = 0x65`, while the scenario-sensitive pair + `+0x82/+0x83` varies coherently as `0x4d/0x36` for `Alternate USA`, `0x90/0x1b` for + `Southern Pacific`, and `0xa3/0x29` for `Spanish Mainline`. One narrower scenario-save split is + visible inside that same strip too: the checked scenario saves `p.gms` and `q.gms` also carry + `+0x7a = 0x05` and the extra four-byte band `+0x88..+0x8b = 66 67 68 69`, while the other + checked 1.05 saves leave those lanes zeroed. Relative `+0x97` and `+0xc5` still remain `0`. + The compared 1.05 save set is tighter now too: `Autosave.gms` and `nom.gms` cluster together on `Alternate USA.gmp` with `+0x82 = 0x4d`, `g.gms` carries `Spanish Mainline.gmp` with `+0x82 = 0xa3`, and `p.gms`/`q.gms` cluster on `Southern Pacific.gmp` with `+0x82 = 0x90`; across all five files the same inferred analogue @@ -440,9 +733,36 @@ The same brush strip is tighter now too: `+0x80` tracks those `0x4d/0xa3/0x90` byte lanes (`0x364d0000`, `0x29a30000`, `0x1b900000`). The leading dword at `+0x00` also splits the same corpus, with `Autosave.gms` alone at `3` and the other four checked 1.05 saves at `5`. That is enough to say the wider save corpus does - contain nonzero candidates for two of the atlas-tracked profile lanes, and that one of them - varies coherently with the loaded scenario family, but not yet enough to claim that the 1.05 - block reuses the exact same semantic field assignments as the classic one. The loader-side + contain nonzero candidates for two of the already-grounded profile lanes: `+0x77` is still the + selected-year lane from the setup/runtime profile family, and `+0x82` is at least the same + sandbox-launch anchor used by later `Setup.win` launch branches. The current corpus also shows + that one of those grounded lanes, `+0x82`, varies coherently with the loaded scenario family. + The same setup/runtime profile family now bounds more of the compact slab than before too: + `runtime_profile_reset_default_setup_and_campaign_seed_fields` `0x0047bbf0` seeds + `[profile+0x79] = 1`, `[profile+0x7b] = 0`, clears `[profile+0x82]`, writes one bounded + random-like dword into `[profile+0x83]`, seeds the first setup row-marker byte + `[profile+0x87] = 1`, and forces the file-backed launch or rehydrate latch `[profile+0x97] = 1`; + `shell_setup_profile_copy_payload_scroll_count_and_campaign_byte_and_seed_row_categories` + `0x0047be50` then copies payload lanes into `[profile+0x77/+0x79/+0x7b/+0xc5]`; and the broader + setup-mode owner `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00` + treats `[profile+0x97]` as the file-backed launch or rehydrate latch, `[profile+0x82]` as the + sandbox-side launch byte, and its dataset-backed row-selection lane now grounds the staged + presence byte `[profile+0x10]` plus the paired `0x32`-byte file/path bands at + `[profile+0x11]` and `[profile+0x44]`. The neighboring setup-side consumer note is tighter now + too: `map-and-scenario-content-load.md` already grounds `[profile+0x79]` as the live-row + threshold lane used by the payload-row draw callback and `[profile+0x7b]` as the current scroll + or row-index lane adjusted by controls `0x0ce6/0x0ce7`. The current file-side 1.05 corpus now + supports a stronger boundary than the old “still open wider layout” note: this compact slab is + not a byte-for-byte dump of the staged `0x108`-byte runtime profile, but a closely related + serialized profile payload with a grounded setup core. The direct core lanes match the staged + profile family (`+0x77`, `+0x79`, `+0x7b`, `+0x82`, `+0x87`, `+0x97`, `+0xc5`, and the paired + `+0x10/+0x43` string bands), while the stable presence byte at `+0x0f`, the leading dword at + `+0x00`, the scenario-sensitive middle word around `+0x80`, and the scenario-save-only + `+0x88..+0x8b = 66 67 68 69` band show that the save slab also carries file-format-specific + framing and scenario-family metadata around that shared setup core. So the local static seam is + closed here: those grounded lanes belong to one serialized setup-profile slab, while the + surrounding extra bytes are serializer-owned framing rather than stray unrelated runtime fields. + The remaining work is only to name that framing more precisely. The loader-side family split is tighter now too: `p.gms` and `q.gms` no longer live under a generic fallback; their save headers now classify as one explicit `rt3-105-scenario-save` branch with preamble words `0x00040001/0x00018000/0x00000746` and the early secondary window @@ -484,15 +804,36 @@ The same brush strip is tighter now too: the remaining subtype-`2` records does it consult `0x00434ea0` by stem before tailing into the dependent cargo-economy filter rebuild `0x0041eac0`. The adjacent collection helpers also read cleanly now: `0x00412bd0` is the collection-wide `0x00411ee0` cargo-summary rebuild sweep over - imported `0xbc` descriptor arrays, while `0x00412ba0` is the remove-and-release sibling that - clears one candidate's dependent runtime descriptor and cargo-membership tables through - `0x00411cb0` before erasing that id from the pool. One lower runtime detail is explicit now too: + imported `0xbc` descriptor arrays, explicitly rebuilding the two compact cargo-membership tables + `[candidate+0x79c/+0x7a0]`, their counts `[candidate+0x7a4/+0x7a8]`, and the scaled runtime rate + band `[candidate+0xa1..+0xb8]`, while `0x00412ba0` is the remove-and-release sibling that clears + one candidate's dependent runtime descriptor and cargo-membership tables through `0x00411cb0` + before erasing that id from the pool. One lower runtime detail is explicit now too: `0x00411ee0` does not just “refresh summary tables.” It rebuilds the two emitted cargo-id tables at `[candidate+0x79c]` and `[candidate+0x7a0]` from one temporary `0x35`-cargo mark band, stores their counts at `[candidate+0x7a4]` and `[candidate+0x7a8]`, and accumulates the scaled runtime rates into `[candidate+0xa1..+0xb8]`; mode-`0` descriptor rows use the shared production cap at `[candidate+0x2a]` divided by the descriptor amount, while nonzero mode rows bypass that cap - scaling. The loader-side coverage is tighter now too: + scaling. The shared reset side is explicit now too: `0x00436d10` is the scenario-state + reset-and-rebuild owner beneath startup and world-entry. It zeroes the late scenario-state bands, + seeds the fixed year defaults and chairman-slot rows, reseeds the same six-dword economic-tuning + band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through + `0x004ca980/0x004caaf0/0x004cadf0`, rebuilds the two named-availability collections at + `[state+0x66b2]` and `[state+0x66b6]`, re-seeds the twelve recipe books from the fixed template + at `0x005c9f78`, refreshes selected-year state through `0x00409e80`, + `0x00433bd0`, `0x00435603`, and the year-gap scalar helper `0x00434130`, and only then + re-enters `0x00435630`, `0x0041e970`, `0x00412bd0`, and `0x00436af0`. The loader-side coverage + around world entry is tighter now too. `0x00443a50` does not just “restore the late profile + block” after the tagged collections load: it re-enters `0x00436d10`, restores `[world+0x66be]` + from `0x2ee0/0x2ee1`, immediately re-normalizes that late setup/status payload through + `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, reloads the + `0x108`-byte profile block, mirrors the campaign/setup byte + `[profile+0xc5]` and sandbox launch byte `[profile+0x82]` into `[world+0x66de/+0x66f2]`, + restores `[profile+0x77]` into the selected-year lanes, reruns + `0x00409e80`, `0x00433bd0`, `0x00435603`, `0x00444dc5`, `0x0041e970`, `0x00412bd0`, + `0x00434130`, and `0x00436af0`, and only then rehydrates `[world+0x66b2]`, `[world+0x66b6]`, + and the later locomotive override refresh `0x00461e00`. The loader-side coverage is tighter now + too: the same table parser now attaches both to the common-save bridge payload and directly to the fixed source range in `.gmp` files and the non-common `rt3-105-scenario-save` / `rt3-105-alt-save` branches. That @@ -526,8 +867,208 @@ The same brush strip is tighter now too: `Spanish Mainline.gmp -> g.gms`, the parsed candidate-availability table contents now match exactly entry-for-entry, with the only reported differences being the outer container family (`map` vs `save`) and source-kind path (`map-fixed-catalog-range` vs the save-side branch). - has the explicit companion `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, which - rebuilds the dependent selected-year bucket floats after the packed year changes; and then + The save-side `.smp` writer is explicit now too: inside `world_runtime_serialize_smp_bundle` + `0x00446240`, the serializer first writes the current count of `[world+0x66b2]`, then one fixed + `0x22`-byte candidate-name-plus-dword record for each live entry, then the current count of + `[world+0x66b6]`, then one fixed `0x41`-byte locomotive-name-plus-dword record for each live + entry. At version `>= 0x3f2` it also writes one direct six-dword save plateau before the later + manager bands: one dword from `[world+0x0be2]` and then the five successive dwords at + `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`. Later in the same serializer it brackets the + live event collection with chunk ids + `0x4e21/0x4e22` and delegates the actual per-event packed-state save to + `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`. So the + save/load bridge is now symmetric on structure as well as on semantics: the named availability + collections are not derived-only runtime tables; they are serialized directly into `.smp` and + then rehydrated back into `[world+0x66b2]` and `[world+0x66b6]` before the later candidate and + locomotive refresh passes run. + The non-`.smp` package side is explicit now too. The fallback owner + `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0` is not a + generic database opener; it is the early package-save prelude that seeds stage/progress globals + `0x00620e94/0x0062bec8/0x0062becc/0x0062bed0`, opens one `0x30d40` bundle, and then serializes + the first direct save band in fixed order: chunks `0x32c8/0x32c9`, the late world-status block + `[world+0x66be]`, the direct counted named-availability collections `[world+0x66b2]` and + `[world+0x66b6]`, chunk `0x32dc`, the staged `0x108` profile block under `0x3714/0x3715`, then + `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520` for the + early world-grid/core-raster band under chunk families `0x2ee2..0x2f44`, then + `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` for the direct + `0x0062b2fc` source-or-auxiliary record family, then + `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, the + direct indexed-collection header save on the route-link family `0x006ada90` through + `0x00517d90`, `placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle` + `0x00481310` on `0x006cec20`, and + `linked_route_object_collection_serialize_records_into_tagged_bundle` `0x0041d4c0` on + `0x0062ba84`, and only then the neighboring reference and manager families before the later + tagged-collection tail under + `shell_map_file_world_bundle_coordinator` `0x00445de0`. Current evidence still bounds that + `0x006ada90` lane as header-only persistence, with live endpoint or route-style state regenerated + later during bring-up instead of emitted through a separate per-record tagged payload owner. The + package tail is explicit now too: + after the manager families it writes one direct dword from `[world+0x19]`, a zeroed `0x1f4`-byte + slab under chunk `0x32cf`, closes the bundle, derives the preview path through `0x00442740`, and + then conditionally emits the companion-image and companion-payload sidecars through `0x00441f70` + and `0x00442900` when `[world+0x66c8]` and `[world+0x66c9]` are set. + The two outer shell coordinators above those package and runtime branches are explicit now too. + `shell_map_file_entry_coordinator` `0x00445ac0` is no longer just the generic open path: it + clears the caller-supplied success dword, increments nested open counter `0x0062be6c`, and then + either routes a direct seeded stem into `.smp` restore through + `world_load_saved_runtime_state_bundle` `0x00446d40` when a live runtime world is already active + or flag bit `0x8` is set, or routes the same direct seeded stem into the heavier world-entry + branch `0x00443a50` with one trailing flag derived from `(flags>>2)^1`. Its quickload and + interactive sides are explicit in the same way: bit `0x1` seeds the Quicksave base stem from + `0x005ca9cc`, appends `.gmp` under editor-map flag `[0x006cec74+0x68]` and otherwise the same + `.gms/.gmc/.gmx` family used by the interactive chooser, while the non-Quicksave chooser re-enters + `shell_file_request_dialog_collect_target_path` `0x004dd010` with load modes + `4=.gmp`, `8=.gms`, `9=.gmc`, and `10=.gmx`. The save-side sibling + `shell_map_file_world_bundle_coordinator` `0x00445de0` now has the same shape: it seeds save-side + selector `0x0062bec4`, accepts either an explicit caller stem, a Quicksave stem from `0x005ca9cc`, + or the localized `Autosave` stem from string id `387`, chooses save modes + `3=.gmp`, `0=.gms`, `1=.gmc`, `2=.gmx`, or side-owner-only `11=.gmt`, then either appends the + fixed `.smp` token and re-enters `world_runtime_serialize_smp_bundle` `0x00446240` when a live + runtime world exists or falls back to the package side through `0x00444dd0`, with the `.gmt` + side-owner branch packaged instead into `0x006cd8d8+0x8f48` and submitted through + `multiplayer_preview_dataset_submit_transport_request` `0x00469d30`. + The paired load-side seam is explicit now too. `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` + `0x004196c0` rebuilds the same `0x0062b2fc` family from the tagged import source around + `0x005c93fc`, re-entering + `aux_candidate_record_stream_decode_fixed_fields_and_optional_mask_planes` `0x00414490` for + each decoded source record before the broader + rebank-or-clone refresh + `aux_candidate_collection_rebank_or_clone_records_by_availability_pass_and_refresh_owner_links` + `0x00419230`. That lower decode body is explicit now too: it imports the six fixed `0x1e`-byte + stem bands, the small scalar tail through `[record+0xcd]`, applies the two exact-stem rewrites + for that tail word, allocates and fills up to four optional heap planes at + `[record+0xcf/+0xd3/+0xd7/+0xdb]`, stamps the corresponding presence latches at + `[record+0x177/+0x17b/+0x17f/+0x183]`, frees any plane whose decode stayed empty, and seeds + `[record+0x1a3] = 1.0f`. Save-side ownership is explicit on the other end too: + `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` builds its + temporary scored-node queue through callback + `aux_candidate_record_chain_callback_collect_unique_link_keys_into_save_queue` `0x00416830`, + which walks each record's linked chain, chooses one dedupe key from the terminal node, and + pushes only unique keys into the queue at `0x0062ba58` while counting them in `0x0062ba64`. The + release side is split cleanly as well: + `aux_candidate_collection_release_templates_queues_and_indexed_storage` `0x00419680` tears that + family back down through + `aux_candidate_collection_release_live_entries_scratch_roots_and_helper_bands` `0x00416950`, + which walks every live entry, re-enters + `aux_candidate_collection_release_entry_optional_mask_planes_and_erase` `0x004168e0`, clears the + scratch root `0x0062b300`, drains the temporary scored-node family `0x0062ba58..0x0062ba74`, + and only then releases the three helper bands at `[this+0x88/+0x8c/+0x90]`. That follow-on pass + is tighter now too: `0x00419230` requires both live scenario state and the live + structure-candidate pool, then + runs two availability-bank passes keyed by candidate bytes `[+0xba]` and `[+0xbb]`. For each of + the twelve ordinals it picks one current-bank template entry, tries to reuse one prior target by + ordinal field `[entry+0x187]`, clones the full fixed record plus up to four optional heap + payload planes `[+0xcf/+0xd3/+0xd7/+0xdb]` when the target differs from the template, then + republishes the built-in pass label into `[entry+0x22]` and `[entry+0x04]` and rebinds owner id + `[entry+0x173]` by exact stem match back into the live candidate pool. So the `0x0062b2fc` + import seam is no longer just stream-load plus teardown: it now has one explicit post-load + rebank/projection pass between those endpoints, and the restore-side sibling is explicit too. + `aux_candidate_collection_restore_temp_record_bank_and_queue_keys_from_packed_state` `0x00413f80` + restores the queued-key table `0x0062ba6c/0x0062ba70`, the temporary record bank at `0x0062b2f8`, + and the matching count latches `0x0062ba64/0x0062ba68/0x0062ba74` from packed state. When the + restore flags demand a live reimport immediately afterward, world-entry restore then re-enters + `aux_candidate_collection_release_live_entries_then_reimport_records_and_refresh_runtime_followons` + `0x0041a950`, which releases every live entry through vtable slot `+0x08` and tails straight + back into `0x004196c0`. + The neighboring tagged region-manager seam is explicit too. Outside the direct `.smp` branch, the + live region collection at `0x0062bae0` now has a matched tagged save/load pair: + `world_region_collection_refresh_records_from_tagged_bundle` `0x00421510` and + `world_region_collection_serialize_records_into_tagged_bundle` `0x004215e0`. Those owners bracket + the collection with chunk family `0x5209/0x520a/0x520b`, forward collection-side metadata through + the indexed-collection helpers, and then dispatch each live region record through the region + vtable slots `+0x40` and `+0x44`. That keeps the region-record persistence seam distinct from the + separate geographic-label database load path on `0x006ada80`. + The two adjacent tagged database families are explicit now too. The geographic-label database at + `0x006ada80` has the matched tagged pair + `geographic_label_database_refresh_records_from_tagged_bundle` `0x00461580` and + `geographic_label_database_serialize_records_into_tagged_bundle` `0x00461650`, both bracketing + chunk family `0x5209/0x520a/0x520b` and dispatching per-record virtual slots `+0x40/+0x44` + after the indexed-collection header helpers. The neighboring city-database entry collection at + `0x006cea50` has the same symmetry on its own tag family + `0x61a9/0x61aa/0x61ab` through + `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540` and + `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610`. + The adjacent territory and support families are explicit now too. The live territory collection at + `0x006cfc9c` has the matched tagged pair + `territory_collection_refresh_records_from_tagged_bundle` `0x00487c20` and + `territory_collection_serialize_records_into_tagged_bundle` `0x00487cc0`, both bracketing tag + family `0x61a9/0x61aa/0x61ab`; current per-entry slots `0x00487670/0x00487680` are no-op load + and save callbacks, so that bundle lane currently persists only collection-side metadata and live + ids, not per-entry payload. The neighboring support family at `0x0062b244` now has the same + bounded symmetry too: + `support_collection_refresh_records_from_tagged_bundle` `0x0040b5d0` versus + `support_collection_serialize_tagged_records_into_bundle` `0x0040b6a0`, both over chunk family + `0x2af9/0x2afa/0x2afb` with collection-side metadata forwarded through the indexed-collection + helpers and per-entry virtual slots `+0x40/+0x44`. + The restore-side symmetry is explicit too: inside `world_load_saved_runtime_state_bundle` + `0x00446d40`, the loader first clears `[world+0x66b2]`, reads one counted run of fixed + `0x22`-byte candidate-name-plus-dword records, and inserts only the rows whose copied names + survive both fixed built-in stem rejects `0x005c8f94/0x005c8e4c` and then resolve back into the + live candidate pool `0x0062b268` through `0x00412b70`; the rejected rows are discarded instead of + blindly restoring stale candidate names. The same loader then clears and repopulates + `[world+0x66b6]` from one counted run of fixed `0x41`-byte locomotive-name-plus-dword records. + After those direct named-availability restores it preserves the older empty-collection fallback + for locomotives by re-entering + `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` + `0x004350b0` only when `[world+0x66b6]` stayed empty. The startup and restore-side preseed + callers are tighter now too: the common startup lane at `0x00438d6b` and the `.smp` restore + fallback at `0x004478ea` both resolve one linked era name through `0x00461c80` and then upsert + it with literal availability bit `1`, matching the later live-pool sweep inside `0x00461eab`. + The same `.smp` loader then brackets the + live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` and delegates the per-event + packed-state restore to `scenario_event_collection_refresh_runtime_records_from_packed_state` + `0x00433130`, which itself opens `0x4e99`, refreshes collection-side metadata, opens `0x4e9a`, + materializes each live event through `0x0042db20`, and closes `0x4e9b`. + The earlier restore spine is explicit now too. `0x00446d40` dismisses the current shell detail + controller, tears down the prior runtime world through `world_runtime_release_global_services` + `0x00434300`, rebuilds the startup-side runtime roots through + `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, allocates the new world + root at `0x0062c120` through `0x0044cf70` using `(width+1, height+1)` from the bundle, and then + restores one dword per world-grid cell through + `world_write_companion_float_grid_cell_and_optionally_refresh_rect` `0x0044dca0` before the later + raster compatibility loops begin. The secondary-raster side is tighter in the same way: for + versioned bundles at `>= 0x3ec` it restores the four sidecar byte planes through + `world_load_four_sidecar_byte_planes_from_runtime_bundle` `0x00448f60`, then restores the versioned + per-cell compatibility bits through the byte-level helpers + `0x00448c20/0x00448cb0/0x00448d90/0x00448e60/0x00448e90/0x0044de30`, with the older pre-`0x400` + branch explicitly clearing those newer bits back to the legacy fallback pattern. + One adjacent mid-restore preview branch is explicit now too: for version `>= 0x3ee` the loader + restores one width/height-tagged dword surface, optionally resamples it through + `shell_world_presentation_stage_overlay_rect_from_normalized_bounds` `0x00534930`, republishes it + through `0x00534730/0x00534af0`, frees the temporary buffer, and then re-enters `0x004882e0` on + the neighboring manager family. + The region-side restore band is explicit now too. After seeding default regions through + `world_region_collection_seed_default_regions` `0x00421b60`, `0x00446d40` restores one counted run + of fixed `0x29`-byte region rows, resolves or allocates each region through + `0x00421660/0x00518140`, republishes pending amount `[region+0x272]` plus paired pointers + `[region+0x25a/+0x25e]`, reruns + `world_region_refresh_profile_availability_display_strings_for_cached_selector_0x2f2` + `0x004204c0`, and then reloads the per-region profile + subcollection at `[region+0x37f]`. It then restores one second counted run of fixed `0x1e+4` + rows whose copied names must survive the fixed reject stems and still resolve back into the live + candidate pool before the row is accepted into that region-owned subcollection. That keeps the + `.smp` restore seam broader and cleaner than before: it is not only named availability and event + state, but also full region-owned profile and policy rows, one versioned preview surface branch, + and the older direct companion-float grid restore above them. The pre-recipe save-only scalar + plateau is explicit on the restore side now too: at version `>= 0x3f2`, `0x00446d40` first reads + one dword into `[world+0x0be2]`, immediately mirrors that same value into `[world+0x0bde]`, and + then reads the five successive dwords at `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`. So the + current boundary is tighter than the earlier `save-only plateau` wording: one six-dword save + band is directly persisted first, and only after that does the separate later + `0x0fa7..0x0fe7` family-shaped slab lead into the fixed recipe-book root at `0x0fe7`. The + loader-side bridge explicitly fans the first persisted tuning lane back into the neighboring + manager scalar at `[world+0x0bde]` before the later tagged database and rule-band restores run. + The adjacent candidate-side recipe rebuild is structurally closed now too: the remaining + save/load gap is no longer how the loader reconstructs the runtime descriptor and + cargo-membership bands, but what the imported supply-marker token family means before those + bands are projected back into live cargo ids. That same selected-year bridge also has the + explicit companion `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, which now + reads as the real selected-year bucket rebuild owner rather than a generic follow-on math body: + it bins packed year word `[world+0x0d]` against the 21-step threshold ladder at `0x005f3980`, + chooses either the first bucket baseline, the terminal bucket scalar at `0x005f3a24`, or one + interpolated scalar from the paired `(year,value)` table at `0x005f3978/0x005f3980`, and then + rebuilds the dependent selected-year float band rooted at `[world+0x65/+0x69/+0x6d]` before the + later threshold and presentation helpers continue; and then rehydrates the named locomotive availability collection at `[world+0x66b6]` through `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`. That locomotive-side restore is tighter now too: its tail explicitly re-enters @@ -536,6 +1077,123 @@ The same brush strip is tighter now too: surviving available locomotive-side rating scalar `[loco+0x20]`, and the tiny query sibling `0x00434080` is now bounded as the shell-side clamped read helper over that same cached field, with the grounded shell-side reader later bucketing that value against `40/50/70/85/100`. The + load-side bridge into `[world+0x66b6]` is tighter too: the constructor-side world-entry bring-up + sweep over the live locomotive pool `0x006ada84` is the pure preseed path, walking every live + locomotive, resolving its linked era name through `0x00461c80`, and upserting that name into + `[world+0x66b6]` through `0x004350b0`. The direct `.smp` restore-side branch inside + `world_load_saved_runtime_state_bundle` `0x00446d40` first clears the collection, reads one + counted run of fixed `0x41`-byte locomotive-name-plus-dword records from the bundle, inserts + them directly through collection vtable slot `+0x04`, and only when that restored collection + stays empty does it fall back to the same full live-locomotive preseed sweep. The + neighboring named-candidate bridge is now aligned with that same save/load pattern too: the + scenario-side named candidate-availability table at `[world+0x66b2]` is another counted fixed + record run, the `.smp` restore path only keeps rows whose names still resolve into the live + candidate pool, and the later post-load preseed `0x00437743` plus + `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` + `0x00434f20` mirror that filtered table back into `[candidate+0x7ac]` across the live candidate + pool. The + separate era-side runtime collection is tighter now too: global `0x0062ba88` is constructed in + the same world-load strip through + `locomotive_era_collection_construct_and_stream_load_tagged_records` `0x0041e170`, which tails + into + `locomotive_era_collection_stream_load_tagged_records_import_engine_type_content_and_seed_runtime_sidecars` + `0x0041d7c0`. That import seam is tighter now too: collection vtable slot `+0x04` dispatches + into + `locomotive_era_collection_allocate_entry_import_tagged_record_and_seed_named_sidecar_handles` + `0x0041de60`, which loads one `Data/EngineTypes/%1.cgo` payload, seeds the nested collection at + `[entry+0x196]`, and resolves imported named rows against `[0x006d4020+0x429b8]`; collection + vtable slot `+0x08` later releases that same live record through + `locomotive_era_collection_remove_entry_by_id_release_nested_sidecars_and_erase` `0x0041ddc0`. + The immediate post-load sidecar layer is explicit now too: + `locomotive_era_collection_publish_intro_notice_and_service_current_year_type2_entries` + `0x0041e010` can publish the one-shot introductory `0xcb/0xcc` pair on the early-year branch, + then scans the imported era records for current-year matches whose type dword `[entry+0x41]` + equals `2`, re-enters the company-policy gate `0x0041d550`, and publishes the matching + locomotive-side notice through `0x004337c0`. The neighboring query helper + `locomotive_era_collection_find_first_live_entry_matching_type_and_current_year_window` + `0x0041e100` closes the small search seam above that same imported collection by returning the + first live entry whose type and `[entry+0x105..+0x109]` year window admit the current scenario + year. + Current package-save inspection still finds no mirrored early world-bundle serializer for + `0x0062ba88`, so the strongest current boundary is that this era family is content-imported + during world load rather than package-saved beside the neighboring tagged runtime collections. + `0x00461650` remains grounded instead as the save-side twin of the geographic-label database at + `0x006ada80`. The live era records themselves are still later queried through `[loco+0x72]` by + `0x00461c80/0x00461ca0`. + The two adjacent live runtime roots in that same world-load strip are tighter now too. Global + `0x0062ba8c` is constructed through + `structure_candidate_collection_construct_and_stream_load_records_then_refresh_counts` + `0x0041f4e0`, which tails into the broader tagged import owner + `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` + `0x0041ede0` and then reruns the aggregate counter refresh `0x0041e970`; the same family also has + the in-place reset sibling + `structure_candidate_collection_release_live_entries_reimport_tagged_records_and_refresh_counts` + `0x0041f530`, which releases each live entry through vtable slot `+0x08`, clears the three + built-in named-candidate slots `[candidates+0x88/+0x8a/+0x8c]`, and rebuilds the same imported + record set plus summary counts. Global `0x006ada84` is constructed one step later through + `locomotive_collection_construct_and_stream_load_records` `0x00462520`, which tails into + `locomotive_collection_stream_load_records_link_era_labels_and_refresh_runtime_availability` + `0x00461f10`; that load owner resolves linked era records from `0x0062ba88`, folds `[era+0xfd]` + into imported scalar lanes, builds the paired locomotive text rows through string ids `0x1b3` + and `0x1b4`, stores the live id into `[loco+0x4f]`, and then re-enters + `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`. + Current package-save inspection still finds no mirrored early world-bundle serializer for + `0x006ada84`; the neighboring package path persists only the named locomotive-availability mirror + at `[world+0x66b6]`, so the strongest current boundary is another load-side content family rather + than a bundle-saved live runtime collection. + The same world-load strip now has the adjacent typed roots grounded too: `0x0062be10` is built + by `company_collection_construct` `0x00429950`, `0x006ceb9c` by + `profile_collection_construct` `0x00477740`, `0x006cfcbc` by `train_collection_construct` + `0x004b2340`, `0x006acd34` by + `runtime_object_collection_construct_vtable_5cae10` `0x00455320`, and `0x0062b244` by + `support_collection_construct_seed_counters_and_clear_large_sideband` `0x0040aeb0`. That support + seam is broader than just tagged save/load now too: the constructor seeds the `0x20`-row + sideband at `[collection+0x90]`, the package path brackets the live collection under + `0x2af9/0x2afa/0x2afb`, and the same family now has its live goose-side owners grounded too: + `support_collection_try_spawn_goose_entry_in_primary_counter_lane` `0x0040b0b0`, + `support_collection_select_or_spawn_goose_entry_id` `0x0040b2d0`, and the release companion + `support_collection_release_entry_and_decrement_world_type_counters` `0x0040af00`. That closes + the local late-state bridge from the saved world slab into live support counters and selection + state instead of leaving `0x4c9a/+0x4c9e/+0x4cb6` as anonymous neighboring fields. The live + world root itself is now bounded one layer higher too: `0x0062c120` is published by + `world_runtime_construct_root_and_seed_global_0x62c120` `0x0044cf70`, and its typed release + sibling on the old-world teardown path is `world_runtime_release_root_payloads_and_collection_storage` + `0x00449500`. The profile-side load/save header symmetry is explicit in the same band: runtime + load refreshes `0x006ceb9c` through + `profile_collection_refresh_tagged_header_counts_from_bundle` `0x00477780`, while package save + mirrors those same `0x5209/0x520a/0x520b` header lanes through + `profile_collection_serialize_tagged_header_counts_into_bundle` `0x004777e0`. The same family's + active-chairman helper strip is explicit now too: + `profile_collection_count_active_chairman_records` `0x00477820`, + `profile_collection_get_nth_active_chairman_record` `0x00477860`, and the id-returning + companion `0x004778c0`. The live company + and train collections now have the same bounded symmetry: world-load refresh re-enters + `company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x00429af0`, + while package save mirrors the same `0x61a9/0x61aa/0x61ab` bracket through + `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` + `0x00429b90`; the load-side per-company follow-on is + `company_refresh_post_load_year_clamp_and_runtime_support_fields` `0x004268e0`, while the + current save-side per-company callback remains the no-op stub `0x00424000`. The live train + collection has the same bounded symmetry too: world-load refresh re-enters + `train_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x004b2700`, + while package save mirrors the same `0x5209/0x520a/0x520b` bracket plus the per-train record walk + through `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` + `0x004b27a0`. The per-train tagged payload seam is explicit now as well: load-side route-list + refresh goes through `train_refresh_tagged_route_list_payload_from_bundle` `0x004a84b0`, while + save-side route-list emission goes through `train_serialize_tagged_route_list_payload_into_bundle` + `0x004a7030`. The adjacent live train collection utility strip is tighter now too: the same + family owns collection-wide cleanup passes for positive-sign peer-site rows + `0x004b2820 -> 0x004af610`, negative-sign dword-key rows `0x004b2860 -> 0x004af760`, an + all-trains clear of runtime dword `[train+0x1a3]` through `0x004b28a0 -> 0x004a7020`, and the + broader RGB publish pass `0x004b28e0` that turns per-train scalar `0x004a9630` into linked-owner + triplets through `0x004a8310`. The same RGB forwarder also now has an adjacent boolean-match + companion: `0x004b29e0` compares train field `[train+0x51]` against one caller-supplied dword, + maps the resulting `0/1` through `0x0051dfc0`, and republishes the resulting color triplet + through the same linked-owner chain. The strip is bounded on both sides now too: `0x004b2a50` + is the all-zero RGB clear sweep through the same forwarder, while the later collection refresh + hooks reached from `0x00433b80` are `0x004b2a90` for the shell-gated no-op placeholder pass and + `0x004b2ae0` for the flagged-train `0x004a8220(1,1)` service sweep. + The same rehydrate band also refreshes the live structure-candidate filter and year-visible counts through `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, rebuilding the paired per-slot bands at `[candidates+0x246]` and `[candidates+0x16e]` and the @@ -550,7 +1208,13 @@ The same brush strip is tighter now too: scenario-side recipe rebuild, the same band also re-enters `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, which only falls into its heavier rebuild body while `[state+0x3a] < 2` and otherwise leaves the derived year-threshold - companion slots `[state+0x51/+0x55/+0x59/+0x5d/+0x61]` unchanged. The neighboring late status + companion slots `[state+0x51/+0x55/+0x59/+0x5d/+0x61]` unchanged. That heavier body is tighter + now too: `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` samples the current + shell presentation scalar `[controller->presenter+0x15]`, chooses one of three range profiles, + seeds floor lane `[state+0x61]` to `0xff`, `0xc8`, or `0xe6`, rebuilds the threshold quartet + `[state+0x51/+0x55/+0x59/+0x5d]` from the current year plus three shell-side companion integers, + and, when the caller asks for it or the current shell scalar falls outside the rebuilt band, + immediately republishes one new clamped `0..255` value back through `0x00523d60`. The neighboring late status checkpoints around progress ids `0x196` and `0x197` also share one explicit stage gate now: `world_query_global_stage_counter_reached_late_reactivation_threshold` `0x00444dc5` compares the global counter `0x00620e94` against threshold `0x9901`, and the two current callers use a @@ -636,7 +1300,8 @@ The same brush strip is tighter now too: sidecar byte planes `[world+0x1631..+0x163d]`, while the broader per-cell pass writes packed values into the ensured target through `0x00534730` and also updates nibble lanes at byte offsets `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it - notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the + notifies the shell owner at `0x0062be68`, re-enters + `world_refresh_all_grid_cell_secondary_raster_derived_bits` `0x00449f80` and `0x004881b0`, frees the temporary mask, expands the caller rectangle by dirty bounds `[world+0x21ad..+0x21b9]` through `0x00536710`, and finally seeds companion byte `[world+0x162d]` with `0xc4` on cells selected from mask plane `[world+0x1655]`. So the `0x0044e500 -> 0x0044e940` band is now a real @@ -655,11 +1320,25 @@ The same brush strip is tighter now too: immediately feeds the heavier payload body `0x0044cfb0`, which reads the rooted chunk families `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, allocates the core world-grid and secondary-raster arrays `[world+0x2129..+0x2141]` plus the route-entry collection - `0x006cfca8`, initializes every grid-cell record through `0x0042ae50`, and only then hands off + `0x006cfca8`, initializes every grid-cell record through + `world_grid_cell_record_refresh_from_bundle_bitmask_and_optional_6byte_list` `0x0042ae50`, and + only then hands off into `world_compute_transport_and_pricing_grid` `0x0044fb70`, the neighboring presentation - refresh `0x00449f20`, and the shell-mode pulse `0x00484d70`. So the `0x0044e910 -> 0x0044cfb0` + refresh `world_count_secondary_raster_cells_outside_class_set_1_3_4_5_and_store_0x21a9` + `0x00449f20`, and the shell-mode pulse `0x00484d70`. So the `0x0044e910 -> 0x0044cfb0` load side is now bounded as the heavy world-grid and secondary-raster bundle-load body rather than just another anonymous constructor tail. One + level lower on that same post-load seam, the full-grid derived-bit companion is tighter now too: + `world_refresh_all_grid_cell_secondary_raster_derived_bits` `0x00449f80` walks the live + `0x1d7`-byte grid-cell records twice, first re-entering + `world_grid_cell_refresh_bits_0x01_0x02_from_anchored_4x4_secondary_raster_class_counts` + `0x0042b050` to refresh bits `0x01/0x02` from each cell's anchored `4x4` secondary-raster + window rooted at `[cell+0xe7/+0xe9]`, then re-entering + `world_grid_cell_refresh_bit_0x08_from_neighbor_cell_bit_0x01_clear_offsets` `0x0042bc70` + to refresh bit `0x08` from the fixed neighbor-offset tables `0x00624b28..0x00624b54`. + That closes the immediate world-grid restore side of this load/save branch instead of leaving the + last post-load refresh passes as raw helper calls. + One level higher again, the broader world-presentation reinitializer `0x00537e60` now sits above that base allocator and the larger support-family ensure path `0x005375c0`: it stores the live grid dimensions, hard-resets the whole overlay runtime family through `0x00532590`, diff --git a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md index 85ca6cc..489e7fc 100644 --- a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md +++ b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md @@ -37,7 +37,7 @@ `Computing Transportation and Pricing...` stays visible while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection-owned staging pass `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, - `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair + `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50`, and the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_collection_refresh_neighbor_and_profile_bands` `0x00420f30`. One save-load-side status-stack strip is now tighter too: `0x004422d0/0x00442330` push and pop the same four shell @@ -2153,9 +2153,14 @@ Current evidence grounds the shell-controller-backed input and frame path as the bits `0x40`, `0x20`, and `0x10` in the same flag byte during route-entry rewrites. Those bits are also no longer copy-only: the neighboring shell helper `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20` now consumes them to - restyle the `BuildingDetail.win` row bands `0x7d07..0x7d1c` and `0x7f58..0x801f`. The exact - player-facing labels for those rows are still open, but the subflags now have one real shell-side - consumer instead of only preservation logic. The broader `BuildingDetail.win` refresh family is + restyle the `BuildingDetail.win` row bands `0x7d07..0x7d1c` and `0x7f58..0x801f`. The important + boundary is tighter now too: the `0x7d07..0x7d1c` band is a style-only indicator family in current + disassembly, not a hidden text-publishing row family with missing captions. The grounded + player-facing text sits elsewhere: the fixed express-side triplet `0x7f58..0x7f5a` is table-fed + from RT3.lng `494/497/498`, and the sibling special service rows still align to `Dining Car` and + `Caboose`. So the subflags now have one real shell-side consumer instead of only preservation + logic, and the old “missing label” seam on the indicator rows is gone. The broader + `BuildingDetail.win` refresh family is tighter too: `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0` now clearly owns the selected subject rows around `0x7d06`, `0x7d96..`, and `0x7d0e`, resolving ordinary ids through the live candidate collection and the special express-side ids through the @@ -2203,6 +2208,12 @@ Current evidence grounds the shell-controller-backed input and frame path as the installed by the attach helper, and `+0x0e` is the stable second-site field. One more split is tighter now too: `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` currently uses `+0x0a` and `+0x0e` as the active endpoint site pair while recomputing state + byte `+0x12`. The load/save boundary is tighter now too: package save currently persists only the + direct indexed-collection header band of `0x006ada90` through `0x00517d90`, world-entry bring-up + mirrors only that header refresh through `0x00518680`, and the live endpoint or grid state is + then regenerated later through `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` + `0x004682c0` and `placed_structure_route_link_collection_rebuild_route_style_grid_counters_and_endpoint_state` + `0x00468300` rather than through a separate tagged per-record payload lane. byte `+0x12`; `+0x0c` is still not directly read there. The family also has a clearer release and refresh side now: `placed_structure_route_link_release_and_detach` `0x004680b0` rolls back the class counters and then tails into `placed_structure_route_link_detach_current_owner_chain` @@ -2749,8 +2760,9 @@ Current evidence grounds the shell-controller-backed input and frame path as the best read as the shared `(x,y) -> world-cell*` resolver rather than another object-specific method. The next sibling table at `0x005c9750` is tighter now too, though still not fully decoded. The - structural anchor is `map_load_city_database` `0x00474610`: that loader stages bundle tags - `0x61a9..0x61ab`, iterates one collection, and dispatches each entry through vtable slot `+0x44`. + structural anchor is `city_database_entry_collection_refresh_records_from_tagged_bundle` + `0x00474540`: that load-side owner stages bundle tags `0x61a9..0x61ab`, iterates one + collection, and dispatches each entry through vtable slot `+0x40`. In `0x005c9750`, that same slot resolves into the sibling record family beside `0x0041ab70/0x0041ab80`, which is enough to treat the table as the city-database entry family rather than a generic unresolved runtime object. The small load-side slot `0x0041ab70` simply @@ -2760,10 +2772,11 @@ Current evidence grounds the shell-controller-backed input and frame path as the one named handle through owner `0x006d4020`, writes the resulting handle into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component. That method is currently called from later world-side branches at - `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantics of the handle and - the many constant-return virtuals in the same table are still open, but the family boundary is no - longer arbitrary: this is now the current city-database entry vtable cluster, not another - placed-structure specialization. One correction matters here too: the lower + `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantic of the handle still + is not grounded, but the leftover rows in the same table are now bounded as low-value + constant-return stubs rather than a meaningful unresolved behavior seam. The family boundary is + therefore no longer arbitrary: this is now the current city-database entry vtable cluster, not + another placed-structure specialization. One correction matters here too: the lower `0x00455660/0x00455800/0x00455810/0x00455930` helpers are no longer city-only. Local `.rdata` now shows the same shared slots under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, whose constructors at `0x0048a240/0x0048a2dc/0x00490a3c` @@ -3080,12 +3093,14 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` `0x00474110`, allocates one `0x250`-byte live record, resolves it, constructs it through `0x00474130`, and then tears the temporary entry down through `0x004743d0`; `0x00474510` resolves one entry id, releases it through `0x00474400`, and removes it from the collection. The - collection-owned load loop at `0x00474540` sits directly beneath `map_load_city_database` - `0x00474610`: it opens the same `0x61a9/0x61aa/0x61ab` bracket on the caller-supplied bundle, - binds the selected path context, iterates the current collection, dispatches each record through - vtable slot `+0x40`, accumulates the returned byte counts, and tears down the temporary entry - after each record. That still leaves broader semantic questions open, but the current static edges - around the city-entry family are now largely exhausted. The adjacent scaffolding is bounded too. + collection-owned load loop at `0x00474540` now has a direct save-side companion too: + `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610` opens the + same `0x61a9/0x61aa/0x61ab` bracket through `0x00531340`, forwards collection metadata through + `0x00517d90`, and dispatches each record through vtable slot `+0x44`. The refresh side binds the + selected path context, iterates the current collection, dispatches each record through vtable + slot `+0x40`, accumulates the returned byte counts, and tears down the temporary entry after each + record. That still leaves broader semantic questions open, but the current static edges around the + city-entry family are now largely exhausted. The adjacent scaffolding is bounded too. Base helper `0x00455b20` initializes the shared `0x23a`-sized record family by installing base vtable `0x005cb1c0`, clearing the scalar bands `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroing the seven-dword block `[+0x212..+0x22a]`, and re-entering `0x0052ecd0`; that is why it shows up @@ -3093,8 +3108,9 @@ The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` construction paths outside the city family. The city collection itself now has a bounded teardown side too: `0x00474480` is the small release-and-free wrapper for the collection rooted at `0x005ce4a8`, and teardown caller `0x004492c3` uses it before freeing the global collection - pointer at `0x006cea50`. On the load side, `0x00445713`'s broader setup branch re-enters - `map_load_city_database` `0x00474610` on that same global `0x006cea50` collection. Outside the + pointer at `0x006cea50`. On the save side, `0x00445713`'s broader package branch re-enters + `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610` on that same + global `0x006cea50` collection. Outside the city-specific branch, the two tiny dispatch wrappers `0x00455a40` and `0x00455a50` are also now bounded as raw vtable-slot helpers: the first jumps through entry slot `+0x44`, while the second pushes one caller argument into slot `+0x40` and then clears the global roots diff --git a/docs/control-loop-atlas/station-detail-overlay.md b/docs/control-loop-atlas/station-detail-overlay.md index e194dbb..00b6f0f 100644 --- a/docs/control-loop-atlas/station-detail-overlay.md +++ b/docs/control-loop-atlas/station-detail-overlay.md @@ -32,6 +32,18 @@ The neighboring connection-state note pair now appears currently owns only the `Coming To`, `Going From`, `Current Supply`, `Current Demand`, `--None--`, and `All` legend lanes. +The shell-side preview arm or clear path above that overlay is explicit now too. + `shell_station_detail_clear_active_candidate_service_preview` `0x00504a90` resets the shared + `(station id, candidate id)` pair, drops the local preview latch at `[window+0x7c]`, decrements + the sibling global refcount `0x0062be84`, and on matching live world-preview state tails into + `world_clear_aux_preview_mode_0x2171_and_overlay_companion_live_flag` `0x00452d30`. + `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` first clears any prior + preview, then for a nonzero candidate id pushes the current station and candidate through the + world-side setter strip `0x00452f60`, `0x00452d80`, `0x00452db0`, and `0x00452ca0` before + latching `[window+0x7c]`, incrementing `0x0062be84`, and storing the active pair back into + `0x005ee4fc/0x005ee500`. That closes the shell-to-world preview seam end-to-end: row callbacks + arm or clear one explicit candidate pair, and the world-side overlay consumes exactly that pair. + That formatter boundary is tighter now too. `0x004207d0` returns `0` immediately when preview-global `0x0062be84` is armed, forwards directly into the shared fallback formatter `0x00455860` when subtype dword `[this+0x23e]` is nonzero, and only otherwise runs its own connection-status path. On @@ -110,11 +122,15 @@ The reusable bridge between the status formatter and the filters and scores candidate city entries, re-enters the same shared heavy builder through `city_connection_try_build_route_between_region_entry_pair` `0x00404c60` for the dense pair sweep and the final retry, and then publishes `2889` `%1 has started a new company - the %2` - or `2890` `%1 has connected %2 to %3.` through the shell news path. The remaining open edge on - this branch is therefore narrower now: it is mostly whether `0x39` should be read as the - narrower city-connection public-opinion lane or as part of a broader management-attitude family, - not the ownership of the connection-bonus formatter, peer-route candidate path, or company news - gate. + or `2890` `%1 has connected %2 to %3.` through the shell news path. Wider governance and shell + xrefs now close that last `0x39` ambiguity too: `company_compute_prime_rate_from_issue39_scenario_baseline` + `0x00424580`, the `CompanyDetail` and bond-side notes, and the already-grounded + `Prime Rate` label family all point at the same metric, so this city-connection branch is + reusing the explicit issue-`0x39` prime-rate lane rather than a separate public-opinion or + management-attitude family. The local static seam on this branch is therefore closed: `0x39` + itself is no longer ambiguous here, and the remaining work is only how much of the wider + company-start or city-connection ladder above that helper should be described as + recent-profit/fuel-burden pressure versus the already-grounded prime-rate term. The ordinary `StationDetail.win` caller strip is tighter now too. In the non-scenario, non-class `3/4` branch, `shell_station_detail_window_refresh_controls` `0x00506610` rebuilds the nearby-site @@ -129,8 +145,67 @@ nearby-site helper has a similarly concrete split now: for each of the fixed fiv counts entries through `0x0047dc90`, emits the descriptive text block through `0x0051b700 -> 0x0053f9c0`, and then builds the paired jump-control payload through `0x0053b070 -> 0x0055a040 -> 0x0053f9c0`, with text rows under `0xb40a..0xb40e` and jump controls under `0xb410..0xb414`. So -the remaining uncertainty in the ordinary branch is no longer the ownership of those lanes; it is -the broader user-facing meaning of later callers above the row callbacks. + the local static seam in the ordinary branch is closed: the ownership of those lanes now belongs + to the concrete refresh helpers named here, and the remaining work is only the broader + user-facing meaning of later callers above the row callbacks. +The helper strip directly beneath that ordinary branch is explicit now too. +`shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` uses dirty latch +`0x006d16f0` plus the live window singleton `0x006d16d8` to clear the candidate-service and +nearby-site row bands `0xb414..0xb5a3`, `0xb40a..0xb413`, and `0xb400..0xb409`, then disables the +paired haul controls `0xb3f6` and `0xb3f7` before resetting the latch. The current-subject gates +above the lower action strip are tighter in the same way: +`shell_station_detail_has_valid_selected_station` `0x00504370` is the narrow selected-station +presence probe over detail-manager state `[0x006d0818+0x90]`, while +`shell_station_detail_selected_station_belongs_to_selected_company` `0x00504390` resolves that same +station and compares its linked company through `placed_structure_query_linked_company_id` +`0x0047efe0` against the active selected company from `0x004337a0`. The ownership-blocked modal +above that gate is explicit too: +`shell_station_detail_present_selected_station_not_controlled_notice` `0x005043f0` formats +localized id `3595` with the owning railroad name when that owner resolves and otherwise falls back +to the empty-string root before opening the standard shell message-box path at `0x004c98a0`. One +remaining local helper is no longer anonymous either: +`shell_station_detail_refresh_class_partitioned_action_controls_0xb3bb_to_0xb3bf` `0x005044b0` +restyles the lower action controls into affordance states `0x65` or `0x87` according to the linked +candidate class byte `[candidate+0x8c]`, keeping `0xb3bb/0xb3bd/0xb3be` active only for class `0` +and `0xb3bc/0xb3bf` active only for class `1`. That closes the helper seam beneath +`shell_station_detail_window_handle_message` `0x00505e50` and +`shell_station_detail_window_refresh_controls` `0x00506610`: the remaining work in this branch is +above those message and refresh owners, not inside the lower helper strip itself. One layer higher, +the lower action dispatch is no longer opaque either. In the message-`0xcb` path, +`shell_station_detail_window_handle_message` first reduces the clicked control to one small family +split: `0xb3bd` selects family `1`, while the sibling controls select family `2`. It then reduces +linked-site flag bits `[entry+0xc3]` to one action index `0..5` and resolves the resulting +`(action_index, family)` pair through +`aux_candidate_collection_find_entry_id_by_station_detail_action_index_and_family` `0x00419590`, +which formats one localized action stem from the fixed tables at `0x005f3c6c/0x005f3c80` and scans +the auxiliary candidate pool `0x0062b2fc` for the first matching stem at `[entry+0x04]`. Only +after that auxiliary id resolves does the branch enter the deeper world-side validation owner +`placed_structure_validate_station_detail_aux_candidate_action_and_optionally_apply_linked_site_mutation` +`0x0040dc40` plus the two confirmation-modal branches rooted at localized ids `0x0bfe` and +`0x0bff`. The constructor-side special-action strip is explicit now too: +`shell_station_detail_window_construct` `0x005068c0` wires action controls `0xb3b7/0xb3b8`, +navigation controls `0xb3b3/0xb3b4`, and helper roots `0x006d16dc..0x006d16ec`; then it restyles +special control `0xb3f8` with one exact three-way split. When editor-map latch `[0x006cec74+0x68]` +is clear, `0xb3f8` is forced to style `0x87`. When that latch is set and scenario slot +`[0x006cec78+0x4af7]` is nonzero, the same control takes style `0x74` if selected-station byte +`[station+0x5c9]` is nonzero and style `0x65` otherwise. So that control is no longer just “some +editor or scenario action”; the local branch now grounds it as one editor-gated, scenario-gated, +selected-station-special-case affordance under the main StationDetail constructor. That deeper +owner then continues into +`0x0bff`. That deeper owner is no longer just a black box either: it first requires the linked peer +at `[site+0x2a8]` to pass the station-or-transit class gate, resolves the auxiliary candidate, +computes one projected scalar cost from candidate field `[candidate+0x22]`, owner company +`[site+0x276]`, current world coords, and scenario-side scale owner `0x00436590(0x3b, ...)`, and +returns that scalar through the optional out-float. When the caller supplies the optional notice +sink and the current owner company exists, the helper compares that scalar against company metric +`(0x0d, 0x2329)` and on failure formats localized notice `0x0b52` before returning. The success +side is tighter too: it materializes one packed projected-cell list through `0x00417840`, runs the +shared placement validator `0x004197e0`, restores the temporary compact-grid replay bits through +`0x004142c0/0x004142d0`, and only then commits the linked-site mutation through +`0x0040d1f0`, `0x00480710`, `0x0045b160`, `0x0045b9b0`, `0x00418be0`, and `0x0040cd70`, posting +the signed scalar into the owner company through `0x0042a040` and accumulating the running total +in `[site+0x27a]`. So the lower action band is now grounded as a real validate-or-apply linked-site +mutation path with an explicit affordability notice branch, not just one anonymous modal gate. #### Route-list side The neighboring helper @@ -138,9 +213,10 @@ The neighboring helper append-if-missing builder for the six-byte route-entry list rooted at `[site+0x462]` and `[site+0x466]`. One tighter boundary closes the overlay-side uncertainty further: the directional overlay query at `0x0047e690` only consumes the leading `u16` peer-site key when it walks that - list and does not currently read the trailing `u32` companion payload at all. So the remaining - uncertainty is no longer route-list ownership or overlay dependence on that payload; it is only - the broader meaning of the payload for other caller families. + list and does not currently read the trailing `u32` companion payload at all. So the local + overlay-side seam is closed: route-list ownership and overlay dependence on that payload are no + longer open here, and the remaining work is only the broader meaning of the payload for other + caller families. #### Route-entry and Cache Side The adjacent helper strip is tighter now too. @@ -179,6 +255,6 @@ The nearby linked-instance raster wrappers are no `0x0047f0e0` and `placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query` `0x0047f1f0` now bound the two record-returning lanes used by the later world-side and - linked-peer filters. That means the remaining uncertainty in this neighborhood is no longer the - route-entry or terrain-class helper ownership; it is the broader user-facing meaning of the later - callers that consume those gates. + linked-peer filters. So the local static seam in this neighborhood is closed too: route-entry and + terrain-class helper ownership are no longer open here, and the remaining work is only the + broader user-facing meaning of the later callers that consume those gates.