From 81316e6e492de6bf1bebb1e1746f9fae0b68af67 Mon Sep 17 00:00:00 2001 From: Jan Petykiewicz Date: Sun, 12 Apr 2026 10:12:10 -0700 Subject: [PATCH] Split input/save/load atlas and update references --- artifacts/exports/rt3-1.06/function-map.csv | 472 +- docs/atlas/company-and-ledger.md | 2 +- docs/atlas/editor-and-site-service.md | 4 +- docs/atlas/route-entry-and-trackers.md | 2 +- docs/atlas/runtime-and-world-tools.md | 2 +- docs/control-loop-atlas.md | 7 + docs/control-loop-atlas/README.md | 8 + docs/control-loop-atlas/editor-breadth.md | 912 ++++ ...nt-editors-companydetail-and-loadscreen.md | 423 ++ .../input-save-load-and-simulation.md | 4124 +---------------- ...tion-paintterrain-and-save-load-restore.md | 652 +++ ...ntime-roots-camera-and-support-families.md | 2656 +++++++++++ .../station-detail-overlay.md | 148 + 13 files changed, 5300 insertions(+), 4112 deletions(-) create mode 100644 docs/control-loop-atlas/editor-breadth.md create mode 100644 docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md create mode 100644 docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md create mode 100644 docs/control-loop-atlas/runtime-roots-camera-and-support-families.md create mode 100644 docs/control-loop-atlas/station-detail-overlay.md diff --git a/artifacts/exports/rt3-1.06/function-map.csv b/artifacts/exports/rt3-1.06/function-map.csv index 89a4512..badfb93 100644 --- a/artifacts/exports/rt3-1.06/function-map.csv +++ b/artifacts/exports/rt3-1.06/function-map.csv @@ -315,6 +315,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0045f6d0,334,shell_input_register_action_binding_with_mode_specific_defaults,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf.","objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation" 0x0045f8a0,315,shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper.","objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation" 0x0045f9e0,598,shell_input_seed_default_binding_registry_entries_from_static_table,shell,cdecl,inferred,objdump + local disassembly + static-table inspection,4,"Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch.","objdump + local disassembly + static-table inspection + post-table registration-strip correlation" +0x00460fe0,52,shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" 0x00461000,52,shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" 0x00461040,40,shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation" 0x00461070,170,shell_input_binding_registry_destroy_all_roots_and_reset_globals,shell,cdecl,inferred,objdump + local disassembly + global-field correlation,4,"Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command.","objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation" @@ -324,6 +325,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00420030,578,city_connection_bonus_exists_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan.","objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding" 0x00420280,204,city_connection_bonus_select_first_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan.","objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation" 0x004207d0,1053,city_site_format_connection_bonus_status_label,map,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. When the preview-global `0x0062be84` is armed or the city-side subtype field `[this+0x23e]` is nonzero the function falls back into the neighboring virtual-style formatter at `0x00455860`; otherwise it builds one visible text block from the base city label at `[this+0x356]`, optionally appends the numeric value in `[this+0x276]`, and can append localized id `207` `(Connected)` when the active linked world object and city class checks succeed. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` at `0x00420030` with three meaningful filter combinations: a deeper peer-reachability pass, an active-company-only pass using `scenario_state_get_selected_chairman_company_record` at `0x004337a0`, and a broader any-company pass. After those boolean note checks it also re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` to recover one representative matching peer site, resolves that peer's linked company through `placed_structure_query_linked_company_id` at `0x0047efe0`, and uses the selected company record when formatting the follow-on company-oriented text lane. That current grounded split is enough to tie `3869` `Connected By Another Station`, `3870` `Already Connected`, `3871` `Connected By Another Company`, `3872` `Already Connected by Another Company`, and `3873` `Not Connected` to this formatter boundary rather than to the station-detail overlay body. The helper also writes one caller-owned color field and label-priority scalar before returning style code `3`, so it currently reads as a world-label or hover-summary formatter for city connection-bonus state rather than a generic text helper.","objdump + caller inspection + RT3.lng strings + city-bonus note correlation + filter-combination decoding + peer-selector correlation" +0x0043f610,13,world_clear_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared reset for the two preview globals at `0x005ee4fc` and `0x005ee500`. The helper writes `-1` into both lanes and returns. Current grounded callers are the shell-side preview clear and teardown paths in `StationDetail.win` at `0x00504a90` and `0x00505bf0`, where those globals hold the active `(station id, candidate id)` pair used by the world-side overlay scanner `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair reset helper.","objdump + caller inspection + local disassembly + preview-pair correlation" +0x0043f620,20,world_store_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared setter for the same preview globals at `0x005ee4fc` and `0x005ee500`. The helper stores its two caller dwords into those lanes unchanged and returns. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, where the pair is the active `(station id, candidate id)` selection later consumed by `world_render_station_candidate_service_map_overlay` `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair setter.","objdump + caller inspection + local disassembly + preview-pair correlation" 0x0043f640,3797,world_render_station_candidate_service_map_overlay,render,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner.","objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check" 0x00439140,1086,simulation_frame_accumulate_and_step_world,simulation,cdecl,inferred,objdump + analysis-context,4,"Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup.","objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation" 0x00433a40,82,shell_can_open_company_list_or_detail_panel_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,4,"Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker.","objdump + caller inspection + shell-detail correlation + modal-path correlation" @@ -332,6 +335,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00434db0,91,shell_can_open_detail_panel_mode_0x0b_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the safest current read for the mode-`0x0b` availability gate rather than a tighter family name we have not yet recovered.","objdump + caller inspection + shell-detail correlation + modal-path correlation" 0x00434e20,128,shell_can_open_detail_panel_mode_0x06_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the safest current read for the mode-`0x06` availability gate rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation" 0x00433b80,69,scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner.","objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation" +0x00433da0,367,shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay,shell,cdecl,inferred,objdump + caller inspection + overlay-control correlation,3,"Shared owner beneath the paired shell commands `0x00441260` and `0x004412a0` for the mode-`0x19` overlay family. The helper takes one caller-supplied presenter-state boolean and one variant selector, restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across the detail-panel control band `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and then forwards the same variant into world helper `0x0043a0a0`. Current grounded callers are the two registered shell commands that derive the presenter-state boolean from `[0x006d4024+0x114216] == 1` and pass variant `0` or `1`, which makes this the safest current read for the shared mode-`0x19` variant-open and overlay-refresh owner rather than another anonymous control restyler.","objdump + caller inspection + overlay-control correlation + mode-0x19 correlation + detail-panel transition correlation" +0x00439820,91,world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared world-view helper beneath the local controller strip. The function samples five nearby heights through `0x00534490` at the current eye X/Z pair `[this+0x1c/+0x24]` and four axis-offset probes, keeps the highest sampled clearance, rounds and expands that limit through `0x0052d0c0` plus fixed scalar margins, and then compares the result against current eye height `[this+0x20]`. When the smoothed or clamped target exceeds the current eye height it republishes the eye triplet through `0x0052d1e0`; when local smoothing latch `[this+0x60]` is live it also uses gain `[this+0x34e]` and cached scalar `[this+0x34a]` before that republish. Current grounded callers are the shell-input controller path `0x0043a1d4`, the camera-restore and step buckets at `0x0043c967`, `0x0043cdd4`, `0x0043d0a6`, and the neighboring motion branches `0x0043e4d5` and `0x0043f427`, so this is the safest current read for the local clearance-ring clamp and republish helper rather than a generic terrain-height query.","objdump + caller inspection + local disassembly + world-view correlation + local-clearance correlation + eye-triplet correlation" +0x0043a0a0,76,world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view owner reached directly from the mode-`0x19` shell strip. The helper stores the inverse of its caller-supplied variant selector into presenter dword `[0x006d4024+0x114216]`, seeds four controller scalars through `0x0052d140` on the live world-view root `0x0062be68`, calls that same object's vtable slot `+0x00`, and then sets dirty byte `[world_view+0x65] = 1`. The seeded scalar quadruple is either `(1.0, 1.0, 0.0, 0.0)` or `(0.7, 1.0, 0.0, 0.0)` depending on the selected mode-`0x19` variant. Current grounded caller is `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`, so this is the safest current read for the world-view-side variant latch plus controller-blend seed owner rather than a generic shell flag setter.","objdump + caller inspection + local disassembly + world-view correlation + mode-0x19 correlation + controller-band correlation" +0x0043a1a0,61,world_view_store_two_scaled_controller_inputs_and_mark_projection_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view helper over the same local controller strip. The helper scales its two caller floats by `100.0`, forwards them together with current controller dword `[this+0x0c]` into `0x0052d180`, forces controller scalar `[this+0x34e] = 1.0`, and then re-enters `0x00439820` to refresh the dependent view-projection state. Current grounded caller is `shell_world_view_apply_one_normalized_input_pair_from_shell_frame` `0x00516837`, which makes this the safest current read for the two-input controller setter plus projection-dirty publish rather than a higher-level camera mode owner.","objdump + caller inspection + local disassembly + world-view correlation + controller-input correlation + projection-refresh correlation" +0x0043a1e0,890,world_view_service_controller_transient_offsets_and_selection_handle,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader world-view-side service owner above the same controller strip. When activation dword `[this+0x38e]` is nonzero, the helper derives time-varying transient offsets into `[this+0x3a6/+0x3aa/+0x3ae]` from the current timer fields `[+0x392/+0x396]` and several fixed scalar thresholds, updates or clears one selection-like handle at `[this+0x3b2]` through `0x00531790` and `0x005317b0`, and can drop the activation dword plus all three offsets back to zero when the transient expires. On the live path it also republishes the accumulated offset-adjusted controller position through `0x0052d180` and restores controller gain `[this+0x34e] = 1.0`. Current grounded callers are the recurring simulation-frame path `0x0043916c`, the selection-side refresh strip at `0x0043bd1a`, and the neighboring motion branch at `0x0043e2a4`, so this is the safest current read for the controller transient-offset and selection-handle service owner rather than a static constructor or one-shot callback.","objdump + caller inspection + local disassembly + world-view correlation + transient-offset correlation + selection-handle correlation" +0x0043a560,64,world_view_release_controller_selection_handle_and_reset_embedded_controller_base,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Teardown-side sibling for the same world-view controller family. The helper temporarily restores one local vtable root at `[this]`, releases selection-like handle `[this+0x3b2]` through `0x005317b0(0)` when it is still live, clears the matching presenter-side owner slot through `0x0052d3e0`, and then tail-jumps into the embedded controller-base reset at `0x0052d570`. This is the safest current read for the controller-family release and base-reset helper rather than a generic shell singleton destructor.","objdump + local disassembly + caller inspection + world-view correlation + controller-reset correlation + selection-handle correlation" +0x0043a5a0,421,world_view_construct_reset_controller_state_and_seed_keyboard_bindings,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Broader world-view constructor or reset owner above the same controller strip. The helper first resets the embedded controller base through `0x0052d5a0`, clears a large local scalar and handle band rooted at `[this+0x8a..+0x38e]`, seeds a few fixed defaults such as `[this+0x38a] = -999.0f` and `[this+0x34e] = 1.0f`, and then tail-jumps into `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`. The resulting boundary is strong enough to treat this as the real world-view reset and keyboard-binding seed owner rather than a small camera-only helper.","objdump + local disassembly + caller inspection + world-view correlation + reset-owner correlation + keyboard-binding correlation" +0x0043ac30,235,world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Load-side world-view owner above the embedded controller snapshot loader. The helper first releases any pending helper handle from `[this+0x3b2]` through `0x005317b0`, clears presenter owner slot through `0x0052d3e0`, and resets the local controller strip through `0x0043a5a0`. It then loads one stored camera-view snapshot from the caller stream through `0x0052d750`, conditionally reads either `8` or `10` extra `0x30`-byte rows into `[this+0x10e]` according to startup-side scalar `[0x006cec78+0x46c34]`, consumes one trailing `0x14`-byte block, reseeds the four controller blend scalars through `0x0052d140(0, 0, 1.0, 0.7)`, calls vtable slot `+0x10`, and finally normalizes the heading lane `[this+0x10]`. Current evidence is strongest for a camera-snapshot load owner with one optional extra-row band rather than a generic stream-reader wrapper.","objdump + caller inspection + local disassembly + world-view correlation + stream-load correlation + controller-base correlation" +0x0043bde0,2037,world_view_refresh_dependent_projection_visibility_and_presentation_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader dependent-refresh owner beneath the same world-view family. After re-entering `0x00439be0`, the helper derives one large band of projection, visibility, and presentation-side scalars from the current focus and eye triplets `[this+0x04..+0x24]`, current controller defaults `[+0x38/+0x3c/+0x40/+0x44/+0x4c]`, world-side mode gates, and several fixed threshold tables. Along that path it calls `0x0052cec0`, `0x00484af0`, `0x00533100`, `0x0043a940`, and repeated world-cell validity checks through `0x00534e50`, and can set dirty byte `[this+0x65]` when the resulting bounds or visibility envelopes move outside tolerated ranges. Current grounded callers are the camera-restore path `0x0043caee`, the heading and zoom-step paths `0x0043cb1d/0x0043cddb`, the shell-input controller service `0x00516842`, and several neighboring motion branches, so this is the safest current read for the world-view dependent projection and presentation refresh owner rather than a smaller math helper.","objdump + caller inspection + local disassembly + world-view correlation + projection-refresh correlation + presentation-scalar correlation" 0x0050f740,6,shell_has_live_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation" 0x0050f750,11,shell_mark_trainbuy_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch.","objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection" 0x0050f760,45,shell_trainbuy_window_query_selected_locomotive_id,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`.","objdump + caller inspection + strings correlation + selected-row correlation" @@ -387,8 +399,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation" 0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation" 0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation" +0x004a77b0,24,train_resolve_linked_route_object_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny train-side resolver over linked route-object id `[train+0x41]`. The helper treats `-1` as empty, otherwise resolves that id through collection `0x0062ba84` via `0x00518140` and returns the live linked route object pointer. Current grounded callers are broad and consistent: the whistle command `0x00441870`, the multiplayer train-apply and callback families at `0x0046d780`, `0x0046e250`, and `0x00470bb0`, the train list renderers around `0x004e7670`, and many neighboring simulation-side train helpers. This is therefore the safest current read for the shared train-to-linked-route-object resolver rather than a metrics-owner-only helper.","objdump + local disassembly + caller inspection + linked-route-object correlation + train-family correlation" +0x004a77d0,51,train_query_linked_route_object_metric_pair_or_default_10f,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small train-side wrapper above the linked route-object metric helper `0x0041add0`. When linked route-object id `[train+0x41]` is live, the helper resolves that route object through collection `0x0062ba84` and tail-calls `0x0041add0` with the original two out-float pointers. When the train has no linked route object, it instead writes `10.0f` to both caller out-float slots and returns. Current evidence is strongest for a generic two-float linked-route metric pair rather than a narrower semantic name, but the default path and ownership boundary are now explicit.","objdump + local disassembly + caller inspection + linked-route-object correlation + two-float-out-parameter correlation" +0x004a7810,183,train_refresh_linked_route_object_steam_emitter_enable_flags,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + effect-family correlation,3,"Iterates the linked route-object row band rooted at `[route+0x316]` / count `[route+0x31a]` after resolving the train's linked route object through `[train+0x41]`. For each `0xc0`-stride row it probes the optional emitter definition at `[row+0x60]`, uses `effect_name_matches_literal_steam` `0x004749a0` to separate the literal `steam` family, and then either clears row byte `[row+0x1d8]`, resets scalar `[row+0xcc]` to `1.0f`, and re-enters `0x00554920`, or sets `[row+0x1d8] = 1` on the non-steam or missing-emitter branch. This is the safest current read for the linked-route-object steam-emitter enable-state refresh rather than a broader train visual owner.","objdump + local disassembly + caller inspection + effect-family correlation + linked-route-object correlation + row-band correlation" 0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation" 0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation" +0x004ad7a0,595,train_trigger_crash_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Broader train-side crash owner reached both from the cheat-code selector branch in `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and from the direct shell command strip around `0x00441810`, where localized id `365` warns `There is no train available to crash!` when no candidate train survives. The helper first enforces the usual crash-side global gates: it rejects when shell byte `[0x006cec78+0x4c8e]` is already set, when world or shell latches under `0x006cec74` block the action, or when the train already carries a nonzero operating mode at `[train+0xe8]`. On the active path it resolves the current linked route object through `[train+0x41]`, marks route field `[route+0x33e]`, enables the shared three-selector and selector-`5` train-visual effect families through `train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors` `0x0045cc90(1)` and its selector-`5` sibling `0x0045d1e0(1)`, clears several transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and then walks the linked route-object chain to drive byte `[train+0xf4]` plus the paired visual refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It finishes by writing crash mode `0x11` into `[train+0xe8]`, seeding scalar `[train+0xec] = 0x46924000`, rebuilding the local event payload through `0x004a9360`, and, when the crashing train belongs to the currently selected company, publishing both a shell-side notice through `0x004554e0` and the follow-on company update through `0x00423fd0`. Current neighboring caller `0x004af9e8` also treats this body as the crash-side branch opposite `0x004ada00`, so the safest current read is the shared train crash-state, effect, and owner-notification owner rather than a generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + train-visual correlation + crash-command correlation + route-state correlation" +0x004ada00,543,train_trigger_breakdown_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Breakdown-state sibling of `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0`. The helper is reached from the direct shell command strip around `0x004418a0`, where localized id `366` warns `There is no train available to break down!`, and from the neighboring train-state branch at `0x004af9f7`. It enforces the same crash-side global gates and the same `[train+0xe8] == 0` requirement, but on the active path it marks route field `[route+0x342]`, enables the selector-`5` and selector-`2` train-visual effect families through `0x0045cf40(1)` and `0x0045d1e0(2)`, clears the same transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and drives the same linked route-object byte `[train+0xf4]` plus refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It then writes breakdown mode `0x12` into `[train+0xe8]`, seeds the same scalar `[train+0xec] = 0x46924000`, rebuilds the local event payload through `0x004a9360`, and, when the affected train belongs to the currently selected company, publishes the shell-side notice through `0x004554e0` and the paired company follow-on through `0x00423fe0`. Current neighboring caller `0x004af9f7` uses this body as the direct opposite branch of `0x004ad7a0`, so the safest current read is the shared train breakdown-state, effect, and owner-notification owner rather than another generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + breakdown-command correlation + train-visual correlation + route-state correlation" 0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation" 0x004b2b80,29,train_route_list_count_live_site_reference_entries,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,4,"Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter.","objdump + caller xrefs + route-entry inspection + callsite inspection" 0x004b2c10,656,train_route_list_validate_reachability_and_station_pair,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan.","objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split" @@ -457,6 +474,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation" 0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation" 0x00437a60,41,world_toggle_pause_or_restore_game_speed,simulation,thiscall,inferred,objdump + strings,3,"Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`.","objdump + RT3.lng strings" +0x00437d70,736,shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats,shell,thiscall,inferred,objdump + local disassembly + static-table decode + RT3.lng strings,4,"Broader shell-side cheat owner reached from the registered command wrapper `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340`. After the usual single-profile gate through `0x004349a0`, the helper increments shell counter `[0x006d401c+0xc60]`, opens the callback-driven modal rooted at `RT3.lng` id `2922` `Do I detect a cheater in the house?\\n\\nEnter code (or to cancel):` through `0x005193f0 -> 0x004c98a0`, and then scans the fixed 26-entry cheat table at `0x005ee2c8`. Current grounded case coverage is real: selector `0` dispatches winner or loss outcome modes through `0x004367c0` using labels `3618/3619/3620/3622`; selector `1` jumps out to `0x004d676c`, where it clears the selected-company stat bands rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`; selector `2` posts one caller-supplied float delta into the selected company through `company_add_delta_into_stat_series_current_slot_and_optional_cash_totals` `0x0042a080`; selector `3` posts one signed integer delta into the selected chairman profile through `profile_entry_add_signed_integer_delta_into_qword_field_0x154` `0x00476050`; selector `4` resolves one locomotive record by primary or alias stem through `0x00461c00` and applies it to every train owned by the selected company through `0x004aefb0`; selector `5` walks the live territory collection and forces access-rights byte `1` through `company_set_territory_access_rights_byte` `0x00424030`; selector `6` toggles scenario byte `[state+0x4c8f]`; selector `7` runs the train-wide branch through `0x004ad7a0(1)`; and selectors `8/9/10` toggle scenario bytes `[state+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also contains later labeled rows `3634` `Orca` and alias-only names `Katie..Seymour`, but their selector values lie above the visible jump-table bound `0x0a`, so current evidence only supports treating them as unreached or separately handled tail entries rather than active cases in this owner.","objdump + local disassembly + static-table decode + RT3.lng strings + cheat-table correlation + selected-company/profile mutation correlation" 0x00448aa0,28,world_sample_companion_float_grid_value_by_cell,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny float-raster sampler over the companion world grid rooted at `[this+0x1605]`. The helper uses width field `[this+0x15d9]`, flattens the caller-supplied cell coordinates with an extra `+1` row stride, reads one `float` from that raster, and returns it in `st(0)`. Current grounded callers include `world_compute_transport_and_pricing_grid` `0x0044fb70`, the flagged-cell sample collector `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, the projected-rectangle helper `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, and several neighboring shell or presentation branches, so this is the safest current read for the shared companion float-grid sampler rather than a transport-only helper.","objdump + caller inspection + field correlation + float-raster correlation" 0x00448af0,206,world_query_compact_grid_flag_bitset_membership_by_mode,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Boolean compact-bitset query over three neighboring world-grid flag banks. The helper uses dimensions `[this+0x215d/+0x2161]` to flatten the caller-supplied cell coordinates into one bit index, rejects out-of-bounds cells, and then checks one or more compact bitset banks depending on the caller mode argument: mode `0` checks both `[this+0x2139]` and `[this+0x213d]`, mode `1` checks `[this+0x213d]` only, mode `2` checks `[this+0x2139]` only, and mode `3` checks `[this+0x2141]` only. It returns `1` when any selected bank contains the bit and `0` otherwise. Current grounded callers include the post-load `319` cleanup lane inside `world_run_post_load_generation_pipeline` `0x004384d0`, the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the projected-runtime scratch builder `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, several neighboring world-scan or presentation branches around `0x004512b5..0x00451393`, and later world-side routes or scenario handlers, so this is the safest current read for the shared compact grid-flag-bitset membership query rather than one specific road- or route-only gate.","objdump + caller inspection + field correlation + compact-bitset correlation + post-load-cleanup correlation" 0x00448c20,132,world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small secondary-raster mutator over one world cell. After rejecting cells whose current secondary class already lies in subset `1/4` through `world_secondary_raster_query_cell_class_in_set_1_4` `0x00534e50`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `4` when the old class was `2`, or to `1` otherwise. It then notifies the shell-side world presentation through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and several shell-side map-editing or painting branches around `0x004f9c17` and `0x004fbcc9`, so this is the safest current read for the shared class-`1/4` demotion helper rather than a more player-facing terrain brush.","objdump + caller inspection + field correlation + secondary-raster correlation" @@ -524,12 +542,76 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00440c10,12,shell_select_camera_view_8,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `8` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460bb7` ties this wrapper to localized command id `3488`, the `Select Camera View 8` slot.","objdump + command-registration correlation + wrapper inspection" 0x00440c20,12,shell_select_camera_view_9,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `9` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c19` ties this wrapper to localized command id `3490`, the `Select Camera View 9` slot.","objdump + command-registration correlation + wrapper inspection" 0x00440c30,9,shell_select_camera_view_0,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `0` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c7b` ties this wrapper to localized command id `3492`, the `Select Camera View 0` slot.","objdump + command-registration correlation + wrapper inspection" +0x00440e00,274,shell_command_step_active_window_subject_forward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Paired shell command owner for the forward-step action registered at `0x45ffae` with action id `0x22` and localized label id `0x0d65`. The helper first prefers live `StationDetail.win` singleton `0x006d16d8`, where it re-enters `shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class` `0x00505e30`. Failing that it prefers the live building-detail singleton `0x006cfd04` and re-enters `0x004b6fc0`, then the live company-detail singleton `0x006cfe4c` when no custom modal is active through `shell_has_live_custom_modal_dialog` `0x004c8680`, where it re-enters `shell_company_detail_select_next_active_company` `0x004c3540`, and finally the sibling live singleton `0x006d3b20`, where it re-enters `0x00514880`. When no supported live window family is active but scenario state `0x006cec78` exists, it builds one contextual notice through localized ids `0x017a/0x017b`, validates the modal path through `0x0045f3d0`, and publishes that notice through `0x004554e0`. This is therefore the broad forward-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation" +0x00440f20,274,shell_command_step_active_window_subject_backward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Backward-step sibling of `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00`, registered at `0x45ffdf` with action id `0x21` and localized label id `0x0d66`. The helper walks the same live window-family priority chain: `StationDetail.win` through `shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class` `0x00505e40`, then the building-detail singleton `0x006cfd04` through `0x004b6fd0`, then the company-detail singleton `0x006cfe4c` through `shell_company_detail_select_previous_active_company` `0x004c3550` when no custom modal is active, and finally the sibling singleton `0x006d3b20` through `0x00514890`. When none of those families is live but scenario state `0x006cec78` exists, it builds and conditionally publishes the paired contextual notice through localized ids `0x017c/0x017d`, `0x0045f3d0`, and `0x004554e0`. This is therefore the broad reverse-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation" +0x00441040,131,shell_open_or_focus_train_detail_for_current_or_first_owned_train,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff1b` with action id `0x54` and localized label id `0x0d62`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current train-subject id from `[detail+0x78]` and validates it against the live train collection `0x006cfcbc`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned trains through `company_count_owned_trains` `0x004264c0`, and falls back to the first owned-train id through `0x00426520`. Once a valid train id survives it forwards `(train_id, 2)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct train-detail opener or refresher for the current subject with first-owned-train fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + train-detail correlation + first-owned-train fallback correlation" +0x004410d0,138,shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff7d` with action id `0x53` and localized label id `0x0d64`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current station-subject id from `[detail+0x80]` and validates it against the live placed-structure collection `0x006cec20`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned linked stations through `company_count_linked_transit_sites` `0x00426590(0)`, and falls back to the first owned linked-station id through `0x00426620(1, 0)`. Once a valid station id survives it forwards `(station_id, 5)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct station-detail opener or refresher for the current subject with first-owned-station fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + station-detail correlation + first-owned-station fallback correlation" +0x00441160,50,shell_command_dispatch_live_world_followon_by_query_0x450150,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling beneath the same command table. The helper requires active scenario state `0x006cec78` plus the live world root `0x0062c120`, re-enters query helper `0x00450150`, and then dispatches one of two world-root follow-ons: `0x00453370` when that query returns zero, or `0x00453780` when it returns nonzero. The registration block at `0x460286` ties this body to localized label id `0x0d73` and command id `0x47`. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + world-root followon correlation" +0x004411a0,52,shell_command_dispatch_live_route_store_followon_by_query_0x4934a0_zero,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling over the live route-store root `0x006cfca8`. The helper requires active scenario state `0x006cec78` plus a live route-store owner, re-enters `0x004934a0(0)`, and then dispatches one of two route-store follow-ons: `0x00491880` when that query returns nonzero, or `0x004932a0` when it returns zero. The registration block at `0x4602b7` ties this body to localized label id `0x0f01` and the same command id `0x47` family. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + route-store followon correlation" +0x00441240,21,shell_command_toggle_shared_world_preview_global_0x62be84,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + global-state correlation,2,"Tiny registered shell command that flips global dword `0x0062be84` between `0` and `1`. The same global is already grounded on the station-detail candidate-service preview side and on the city-site connection-bonus label formatter, so this command currently reads as a shared world-preview-global toggle rather than a detail-window-local helper. The registration block at `0x4602e8` ties it to action id `0x4e` and localized label id `0x0d74`.","objdump + command-registration correlation + local disassembly + global-state correlation + shared-preview-global correlation" +0x00441260,49,shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Registered shell command beneath action id `0x09` and localized label id `0x0d70`. The helper first rejects while sibling singleton `0x006d3b4c` is live, then requires active scenario state `0x006cec78` and the main shell presenter root `0x006d4024`. It derives one boolean from presenter field `[root+0x114216] == 1`, passes that boolean together with variant selector `0` into `0x00433da0`, and that shared helper in turn restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across detail-panel controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the variant into world helper `0x0043a0a0`. Current evidence is strong enough for the mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation" +0x004412a0,49,shell_command_open_detail_panel_mode_0x19_variant_1_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Variant-`1` sibling of `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`, registered under the same action id `0x09` family with localized label id `0x0d71`. The helper enforces the same `0x006d3b4c` / scenario-state / presenter-root gates, derives the same presenter boolean from `[0x006d4024+0x114216] == 1`, and then re-enters `0x00433da0` with variant selector `1`, which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the selected variant into world helper `0x0043a0a0`. Current evidence is strong enough for the paired mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation" +0x004412e0,85,shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-state correlation,3,"Registered shell command beneath action id `0x45` and localized label id `0x0d75`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then accepts either when shell-state probe `0x00435480` succeeds or when shell flag `[0x006cec74+0x1df]` is already nonzero through `0x00482840`. On the active path it re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` with stack flag `1` and then writes shell dwords `[0x006cec74+0x1df/+0x1e3] = 0/0` through `0x00482850`, which also triggers the follow-on refresh helper `0x004354a0`. Current evidence is strong enough for the shell-state-band and year-threshold refresh owner shape, but not yet for a tighter user-facing command name.","objdump + command-registration correlation + local disassembly + shell-state correlation + year-threshold-band correlation" +0x004411e0,31,shell_command_toggle_presenter_flag_0x114276_if_present,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + presenter-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d79`. The helper probes the main shell presenter root at `0x006d4024` and, when that root is live, flips the dword at `[presenter+0x114276]` between `0` and `1`. Current evidence is only strong enough for the direct toggle and owner boundary, not for a tighter user-facing semantic name for that presenter-side latch.","objdump + command-registration correlation + local disassembly + presenter-root correlation + toggle-latch correlation" +0x00441200,52,shell_command_send_message_0xcb_to_control_0x9858_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-message correlation,2,"Small registered shell command beneath action id `0x5a` and localized label id `0x0d7b`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then forwards shell message `0xcb` with control id `0x9858` plus three zero trailing arguments into the shared shell runtime at `0x006d401c` through `0x00538e00`. Current evidence is strong enough for the message-injection owner shape, but not yet for a tighter user-facing command name for control `0x9858`.","objdump + command-registration correlation + local disassembly + shell-message correlation + active-scenario correlation" +0x00441340,15,shell_command_dispatch_cheat_code_modal_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + cheat-owner correlation,2,"Tiny registered shell command beneath action id `0x00be` and localized label id `0x0d7c`. The helper requires active scenario state `0x006cec78` and then tail-calls `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70`. This is therefore the direct command-table entry for the cheat-code modal owner rather than a generic scenario follow-on.","objdump + command-registration correlation + local disassembly + cheat-owner correlation" +0x00441360,68,shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + focus-handoff correlation,3,"Registered shell command beneath action id `0x47` and localized label id `0x0db3`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, requires live collection root `0x0062b244`, then queries selector `0x0040b2d0(0, 1)`. When that selector returns a nonzero subject id, the helper forwards `(1, 3, subject_id)` into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. Current evidence is strong enough for the focus-handoff owner shape, but not yet for a tighter user-facing verb or subject family name.","objdump + command-registration correlation + local disassembly + focus-handoff correlation + selector-correlation" +0x00441790,111,shell_resolve_focused_or_fallback_train_owned_by_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Shared current-train resolver beneath the shell-side train command strip. The helper first probes the live world-view owner at `0x0062be68`, and when a focused subject exists through `[view+0x60]` plus vtable slot `+0x6c`, it resolves the corresponding live train from collection `0x006cfcbc` by id `[subject+0x390]`. It then requires that train's owner company id `[train+0x51]` to match the current scenario-selected company through `scenario_state_get_selected_chairman_company_id` `0x004337a0`; otherwise it falls back to `0x005130f0` and repeats the same ownership test on that fallback train. Success returns the live train pointer; failure returns null. Current grounded callers are the adjacent shell command leaves `0x00441810`, `0x00441870`, and `0x004418a0`, so this is the safest current read for the focused-or-fallback owned-train resolver rather than a broader world-view query.","objdump + local disassembly + caller inspection + world-view correlation + selected-company correlation + train-command-strip correlation" +0x00441810,79,shell_command_crash_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x43` and localized label id `0x0d77` `Current train crashes`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`. When no train survives it opens the simple shell modal rooted at localized id `365` `There is no train available to crash!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the resolved train into `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0(1)`.","objdump + command-registration correlation + local disassembly + RT3.lng strings + crash-owner correlation" +0x00441870,34,shell_command_mark_current_or_fallback_owned_train_whistle_request,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,2,"Registered shell command beneath action id `0x57` and localized label id `0x0d76` `Current train whistles`. The helper resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`; when that succeeds it resolves the train-side visual owner through `0x004a77b0` and writes request dword `1` into `[owner+0x33a]`. Failure is silent and returns `0`. Current evidence is strong enough for the whistle-request owner shape even though the deeper user-facing meaning of `[owner+0x33a]` remains open.","objdump + command-registration correlation + local disassembly + RT3.lng strings + train-visual-owner correlation" +0x004418a0,79,shell_command_break_down_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x42` and localized label id `0x0d78` `Current train breaks down`. The helper enforces the same active-scenario and single-profile gate as the crash sibling `0x00441810`, resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`, and when no train survives opens the simple shell modal rooted at localized id `366` `There is no train available to break down!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the train into the sibling failure-state owner `0x004ada00(1)`. Current evidence is strongest for the breakdown-command wrapper above that sibling train-state body rather than a generic shell modal leaf.","objdump + command-registration correlation + local disassembly + RT3.lng strings + failure-state sibling correlation" +0x00441900,53,shell_command_toggle_overview_window_page_0_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the `Overview.win` page-toggle strip. The helper probes the shell detail-panel controller at `0x006d0818`; when current mode `[detail+0x8c]` already equals `9` and current overview page `[detail+0x90]` already equals `0`, it closes that page by forwarding `(-1, 0)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Otherwise it requests mode `9`, page `0` through the same owner. Current evidence is strong enough for the page-toggle shape, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation" +0x00441940,52,shell_command_toggle_overview_window_page_1_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x73` and localized label id `0x0d4b`. The helper mirrors `0x00441900`, but it tests for `Overview.win` mode `9` page `1` at `[0x006d0818+0x90]`; a same-page hit closes through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, otherwise it requests mode `9`, page `1`. This is the safest current read for the second `Overview.win` page-toggle command rather than another anonymous detail-manager wrapper.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation" +0x00441980,52,shell_command_toggle_overview_window_page_2_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x74` and localized label id `0x0d4c`. The helper mirrors the adjacent page-toggle siblings, but it tests for `Overview.win` mode `9` page `2`; same-page hits close through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, while every other case requests mode `9`, page `2`. This is the safest current read for the third `Overview.win` page-toggle command rather than another generic shell leaf.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation" +0x004419c0,52,shell_command_toggle_overview_window_page_3_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the same `Overview.win` page-toggle strip. The helper tests the live detail manager for mode `9`, page `3`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `3`. Current evidence is strong enough to keep this as the fourth overview-page toggle, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation" +0x00441a00,52,shell_command_toggle_overview_window_page_4_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x72` and localized label id `0x0d4a`. The helper tests the live detail manager for mode `9`, page `4`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `4`. This is the current safest read for the fifth overview-page toggle command rather than a more semantic page-name claim.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation" +0x00441ac0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_0_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d4f`. The helper requires active scenario state `0x006cec78`, rejects when shell counter `[0x006d401c+0xc64]` is already positive, and then forwards three zero stack arguments into `shell_map_file_entry_coordinator` `0x00445ac0`. Current evidence is strong enough for the wrapper shape and gate conditions, but not yet for the exact player-facing verb mapped onto that zero-triplet coordinator call.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation" +0x00441af0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_1_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d51`. The helper mirrors `0x00441ac0`, but forwards stack flags `(0, 1, 0)` into `shell_map_file_entry_coordinator` `0x00445ac0` after the same active-scenario and shell-idle gate. Current evidence is strong enough for the wrapper shape and flag triplet, but not yet for the exact user-facing command name for this coordinator variant.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation" +0x00441b20,39,shell_command_clamp_world_dword_0x168d_not_below_0x1689_if_world_live,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + world-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d72`. The helper requires live world root `0x0062c120`, compares dwords `[world+0x1689]` and `[world+0x168d]`, and rewrites `[world+0x168d]` so it is never below `[world+0x1689]`. Current evidence is only strong enough for that direct clamp and owner boundary, not for a tighter semantic name for this world-side scalar pair.","objdump + command-registration correlation + local disassembly + world-root correlation + clamp correlation" +0x00441b50,358,shell_command_toggle_editor_map_mode_with_one_shot_warning_modals,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Broader registered shell command sibling above the editor-map-mode setter `0x00482e50`. The helper requires active scenario state `0x006cec78` and the live shell-state root `0x006cec74`, then branches on current editor-map mode lane `[shell+0x68]`. When editor-map mode is already active it uses one-shot latch `0x0062be88` to optionally publish localized modal `0x017e` through `0x005193f0 -> 0x004c98a0`; when editor-map mode is inactive it instead opens warning `0x0b6e` if the active-profile-count gate `0x004349a0` exceeds `1`, or uses one-shot latch `0x0062be8c` to optionally publish modal `0x0b24`. After those gates it computes target mode `([shell+0x68] == 0)` and forwards that boolean into `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. Current evidence is strong enough to treat this as the real editor-map-mode toggle command with one-shot warning modals rather than another anonymous scenario-side follow-on.","objdump + command-registration correlation + local disassembly + caller inspection + editor-map-mode correlation + warning-modal correlation" +0x00441cb0,111,shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6b` and localized label id `0x0db5`. The helper requires active scenario state `0x006cec78`, rejects when the active-profile-count gate `0x004349a0` exceeds `1`, clears shell dwords `[0x006cec74+0x233]` and `[+0x124]`, adds `0.5` to startup-side scalar `[0x006cec78+0xbfa]`, then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` before refreshing the live view owner at `0x0062be68` through `0x00439a80`. Current evidence is strongest for a paired half-step raise on the startup selected-year presentation scalar rather than a tighter player-facing command name.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation" +0x00441d20,111,shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. This is the current safest read for the paired half-step lower command rather than a stronger user-facing label claim.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation" +0x00441d90,135,shell_build_percent_status_payload_clamped_0_to_100,shell,cdecl,inferred,objdump + local disassembly + caller inspection + status-publisher correlation,3,"Shared percentage-status payload builder used by the save or load progress strip. The helper divides one caller float by one caller integer, multiplies by fixed scalar `100.0f`, rounds through `0x005a10d0`, clamps the result to at most `100`, and then packages that percentage into the small status payload built through `0x0051b700`, `0x005193f0`, and `0x00518de0`, returning the final shell text handle rooted at `0x0062c0d8`. Current grounded callers include the repeated progress-notice loop inside `shell_map_file_world_bundle_coordinator` `0x00445de0` and the adjacent throttled progress callback `0x00441e20`, so this is best read as the shared percent-status payload builder rather than a one-off modal helper.","objdump + local disassembly + caller inspection + status-publisher correlation + save-load-progress correlation" +0x00441e20,155,shell_progress_callback_publish_incremental_percent_status_until_target,shell,cdecl,inferred,objdump + caller inspection + local disassembly + progress-callback correlation,3,"Shared incremental progress callback above `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90`. The helper first checks global progress latches `0x0062bec8`, `0x0062becc`, and `0x0062c118`; when the caller target count has not advanced it returns immediately, and when the target equals `0x64` it instead advances `0x0062becc` by `0x14` and clears `0x0062c118`. Otherwise it increments `0x0062c118`, derives one intermediate percentage from the caller target divided by `3`, scaled by `100.0`, offset by current base `0x0062becc`, and then re-enters `shell_build_percent_status_payload_clamped_0_to_100` before publishing the resulting status through `0x00538c70` and servicing the shell frame through `0x00482160`. Current grounded owner correlation is the callback installation at `0x00442960`, which writes this function into global `0x00d93988` before entering a longer staged work loop, plus the same save or load progress family around `0x00445de0`. This is the safest current read for the throttled percent-status callback rather than another direct shell command leaf.","objdump + caller inspection + local disassembly + progress-callback correlation + staged-work correlation + shell-status correlation" +0x00441ec0,107,shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. On the save-side branch it writes one caller dword through `global_indexed_slot_table_write_bytes` `0x00531030` and then emits tagged headers `0x2ee0`, `0x03c2`, and `0x2ee1` through `0x00531340`; on the load-side branch it mirrors the same triplet through `0x005a276f` after opening the incoming staged object. Current grounded callers are the two companion-image file siblings `0x00441f70` and `0x004420f0`, where it serializes the selector byte at `[record+0x09]`, the payload size lane `[record+0x04]`, and the copied dword at `[record+0x00]` beside the external `_A.tga/_A.jpg` file path. This is the safest current read for the shared companion-image tag strip rather than a generic slot-table header helper.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation" +0x00441f70,384,shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Broader companion-image load helper paired with `0x004420f0`. The helper derives an extensionless stem from the caller path through `support_copy_string_stem_before_first_dot` `0x0051dde0`, appends either `_A.tga` or `_A.jpg` according to selector byte `[record+0x09]`, opens the resulting path in mode `r+b`, streams the file through `0x005a1b05` into a temporary `0x200`-byte loop buffer, and then mirrors the loaded bytes through `0x005a276f` before writing the companion-image selector tags through `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`. Current grounded caller is the broader save or load coordinator strip around `0x00445983`, and the sibling overlay-surface owner `0x00535430` later consumes the same global fallback descriptor rooted at `0x0062bed4/0x0062bed8`. This is the safest current read for the companion-image file import path rather than a generic external file loader.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation" +0x004420f0,476,shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Write-side sibling of `0x00441f70` for the same companion-image family. The helper derives an extensionless stem from the caller destination path, appends either `_A.tga` or `_A.jpg` by selector byte `[record+0x09]`, tries to open that file in mode `r+b`, and when no existing file is present allocates or reuses the global staging buffer rooted at `0x0062bed4/0x0062bed8` before streaming bytes from the source handle in `0x200`-byte chunks. On the existing-file path it writes the same chunks through `0x005a276f`; on completion it clears the temporary typed cache through `0x0053c900`, copies the final companion path into the caller out-buffer, and returns. Current grounded caller is the save-side branch at `0x00443d1c`, which immediately follows this helper by writing the paired tagged headers `0x2ee0/0x2ee1`. The later world-presentation fallback path `0x00535430` also consumes the same global staging descriptor, so this is the safest current read for the companion-image export path rather than a generic file-copy helper.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation" +0x00450150,7,world_query_preview_mode_0x15_latch_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny getter for the shared world-side preview-mode latch byte `[this+0x21c5]`. The helper returns that byte unchanged as a boolean-like integer. Current grounded callers are the shell command strip at `0x00441173`, which chooses between the enter and exit siblings `0x00453370` and `0x00453780`, and the TrackLay destructor path at `0x0050db8d`, which only re-enters `0x00453510` when this latch is clear while world mode `[world+0x2175]` still equals `0x15`. This is therefore the safest current read for the direct mode-`0x15` preview-latch query rather than a broader world-mode predicate.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation" +0x00450160,816,world_recompute_mode3_preview_normalization_window_0x2195_0x2199,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Mode-`3` prepass beneath the shared world preview rebuild owner `0x00450520`. The helper walks the live secondary-grid cells rooted at `[this+0x2129]` across world dimensions `[+0x2145/+0x2149]`, skips blocked class lanes when cell byte `[cell+0xe6]` carries bit `0x01` without `0x04`, and scores each surviving cell either with fixed `200.0f` or with `0x0042c960(remainder(id, 0x35))` against the current primary preview id `[this+0x2179]`. It tracks min, max, average, and one farther qualifying score through `0x0042b350`, then writes the resulting float window into `[this+0x2195]` and `[this+0x2199]`, clamping the final scale lane to at least `1.0f`. Current grounded caller is the shared active preview or tool overlay rebuild owner `0x00450520`, which invokes this prepass only when current world preview mode `[this+0x2175]` equals `3`. This is the safest current read for the mode-`3` normalization-window recompute helper rather than a broader map-load statistic pass.","objdump + caller inspection + local disassembly + mode-3 correlation + normalization-window correlation" +0x00450490,144,world_query_mode3_preview_cell_best_matching_six_byte_list_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small per-cell query beneath the same mode-`3` world preview family. The helper indexes one secondary-grid cell from `(x, y)` through `[this+0x2129]`, reads the six-byte entry list described by count dword `[cell+0xeb]` and pointer `[cell+0xef]`, and searches for the strongest matching entry when the caller-supplied selector id matches the row's leading `u16` or when that selector id is `0`. When any match is found it returns the shared tagged color lane `[0x006cec78+0x66ba] | 0x2c000000`; otherwise it returns zero. Current grounded callers are the mode-`3` pixel cases inside `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds` `0x00450520`, where this helper acts as the local linked-site or service-list color query rather than as a top-level roster scan.","objdump + caller inspection + local disassembly + mode-3 correlation + per-cell list correlation + tagged-color correlation" +0x00450520,4074,world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared rebuild owner for the world-side preview or tool-mode family rooted at `[this+0x2175]`, `[+0x2179..+0x2191]`, and transient surface root `[this+0x478]`. The helper first rejects when no active mode is set, runs the mode-`3` normalization prepass `world_recompute_mode3_preview_normalization_window_0x2195_0x2199` `0x00450160` when required, derives the current world-cell rectangle and float scale from the active mode table at `0x005ee5e0/0x005ee5e4`, clamps the active sub-rectangle against the live world dimensions and shell presentation caps, reuses or rebuilds the transient overlay surface through `0x00532490`, `0x00534f80`, and `0x005323f0`, then fills that surface by switching over the active mode and computing one packed color per cell. The per-mode pixel cases mix checkerboard fallbacks with several grounded world queries, including mode-`3` helper `world_query_mode3_preview_cell_best_matching_six_byte_list_color` `0x00450490`, the secondary-grid and overlay classifiers `0x00534e10/0x00534e50/0x00534e90/0x00534ec0/0x00534f00/0x00534f40`, terrain and grid queries `0x00448af0`, `0x00448f00`, `0x00448f30`, and one scalar ramp through `0x0051dfc0`. After rasterizing the active rectangle it publishes the active mode byte through `0x00532510`, refreshes the overlay live flag through `0x00532460`, and pushes the normalized preview bounds back through `0x00532520` and `0x005324e0`. Current grounded callers include the shared wrappers `0x00452d80`, `0x00452db0`, `0x00452f20`, `0x00452f60`, and `0x00452fa0`, plus the mode-`0x15` entry or clear siblings `0x00453370` and `0x00453510`. This is therefore the safest current read for the shared active preview or tool overlay rebuild owner rather than any one window family's private raster pass.","objdump + caller inspection + local disassembly + active-mode correlation + overlay-surface correlation + normalized-bounds correlation + paint-tool correlation" +0x00452d30,68,world_clear_aux_preview_mode_0x2171_and_overlay_companion_live_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small shared clear path inside the world-side preview or tool-mode family. When auxiliary preview mode dword `[this+0x2171]` equals `1`, the helper also clears optional flag dword `[this+0x219d]` and decrements the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when flag `[this+0x21a1]` is still set. It then zeroes `[this+0x2171]` unconditionally and tail-jumps into `world_presentation_clear_overlay_companion_block_live_flag` `0x00532360`. Current grounded callers are the mode-`0x15` entry or clear owners `0x00453370` and `0x00453510`, plus the shell-side cleanup paths in `BuildingDetail.win` at `0x004bc1f1` and `StationDetail.win` at `0x00504a90/0x00505bf0`. This is therefore the safest current read for the auxiliary preview-mode clear helper rather than a generic overlay reset.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + overlay-companion correlation" +0x00452ca0,137,world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared setter beside the same world-side preview family. The helper stores the caller mode into auxiliary preview dword `[this+0x2171]`, conditionally arms optional companion flag `[this+0x219d]` when the caller mode is `1`, and increments the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when live flag `[this+0x21a1]` is already set at that moment. It then chooses one of three coarse tile-size lanes (`0x40`, `4`, or `1`) from the auxiliary preview mode and forwards those dimensions plus live world size `[0x0062c120+0x2155/+0x2159]` into `0x00532310` to reseed the local overlay-companion grid. Current grounded callers are `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which passes mode `1`, and `shell_change_height_window_construct` `0x004bcb50`, which passes mode `6`. This is therefore the safest current read for the auxiliary preview-mode setter and companion-grid reseed helper rather than a station-detail-only preview latch.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + companion-grid correlation" +0x00452d80,33,world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny setter in the same world-side preview family. The helper stores one caller dword into `[this+0x217d]` and, when current mode `[this+0x2175]` is already nonzero, re-enters `0x00450520(0)` to rebuild the active preview or tool state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which forwards the current station-detail row through this helper after staging the candidate id. This is the safest current read for the direct scalar setter plus active-mode refresh rather than a more semantic station-only helper.","objdump + caller inspection + local disassembly + preview-scalar correlation" +0x00452db0,88,world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared linked-site id setter beneath the same world-side preview family. The helper first unregisters the previous linked site through `0x00413620` when current mode `[this+0x2175]` equals `3` and old id `[this+0x2181]` is nonzero, stores the caller id into `[this+0x2181]`, then registers the new id through `0x00413750` when mode `3` is still active and the new id is nonzero. When any preview or tool mode is already active it finally re-enters `0x00450520(0)` to rebuild that mode. Current grounded callers are the linked-peer action branches at `0x0040e5b1`, `0x0040e65d`, and `0x0040e97d`, plus `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses it while arming the current station preview. This is therefore the safest current read for the preview-family linked-site setter and mode-3 rebind owner rather than a plain id store.","objdump + caller inspection + local disassembly + linked-site correlation + mode-3 rebind correlation" +0x00452e10,136,placed_structure_collection_dispatch_virtual_slot_0x0c_or_0x10_by_optional_subject_and_linked_peer_gate,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Collection-side dispatch helper over every live placed structure in `0x0062b26c`. For each record it chooses between vtable slot `+0x0c` and `+0x10`. When the caller mode arg is not `-1`, slot `+0x0c` is chosen if either the optional subject id resolves through vtable slot `+0x80` plus `0x004129d0` or the structure already satisfies `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`; otherwise the helper falls back to slot `+0x10`. Current grounded callers are the world preview-mode owners `0x00453370`, `0x00453510`, and the broader mode-switch body `0x00452fa0`, which use this helper while entering, leaving, or changing the same site-aware preview states. This is the safest current read for the collection-wide virtual dispatch gate rather than a narrower route-builder helper.","objdump + caller inspection + local disassembly + placed-structure-collection correlation + linked-peer gate correlation" +0x00452ea0,117,world_refresh_preview_flag_0x21a1_from_world_view_float_and_presenter_counters,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small flag-refresh helper in the same world-side preview family. The helper samples float `[0x0062be68+0x20]` from the live world-view owner against one fixed threshold, normalizes the result to boolean flag `[this+0x21a1]`, and only mutates the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when companion enable dword `[this+0x219d]` is already nonzero and the sampled boolean changed. Current grounded caller is the nearby world-view follow-on at `0x0043c5f6`, which invokes this helper before the later local owner refresh path at `0x0043b350`. This is the safest current read for the view-scalar-driven preview-flag updater rather than a broader camera or zoom-mode owner.","objdump + caller inspection + local disassembly + world-view correlation + preview-flag correlation + presenter-counter correlation" +0x00452f20,48,world_refresh_active_preview_mode_from_four_dword_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small active-mode refresh wrapper over the same preview or tool-mode family. The helper copies four caller dwords into a local parameter block and forwards that block into `0x00450520`, leaving the current mode selector unchanged. Current grounded callers are the world-facing preview publish tails at `0x00436164`, `0x004f7958`, `0x004fb4c4`, `0x004fc4a0`, `0x004fc61a`, and `0x004fd4dc`, where it is used as the parameter-block refresh step rather than a top-level mode switch. This is the safest current read for the four-dword active-mode refresh wrapper.","objdump + caller inspection + local disassembly + parameter-block correlation" +0x00452f60,51,world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared primary-id setter in the same world-side preview family. The helper stores one caller dword into `[this+0x2179]`; when current mode `[this+0x2175]` equals `3` it first re-enters `0x00452e10` with that same id to update the placed-structure collection dispatch, and when any mode is active it then re-enters `0x00450520(0)` to rebuild the current preview state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses this helper to stage the candidate id before syncing the station row and linked-site id. This is the safest current read for the primary-id setter plus mode-3 dispatch refresh rather than a station-only helper.","objdump + caller inspection + local disassembly + primary-id correlation + mode-3 collection correlation" +0x00452fa0,704,world_switch_preview_or_tool_mode_and_seed_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared mode-switch owner for the world-side preview or tool family rooted at `[this+0x2171..+0x2191]`. The helper first releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles the current mode's presenter counters and placed-structure bindings for the grounded families `3`, `6`, and `7`, and then seeds the caller-supplied parameter block into `[this+0x217d/+0x2181/+0x2185/+0x2189/+0x218d/+0x2191]` together with primary scalar `[this+0x2179]` and target mode `[this+0x2175]`. It finishes by re-entering `0x00450520` on that new state and then replaying the mode-specific side binds such as `0x00413750` for mode `6` and `0x00413620/0x00413750/0x00452e10` for mode `3`. Current grounded callers include `PaintRegion.win`, `PaintSound.win`, and `PaintTerritory.win` constructors and message handlers at `0x004f539f`, `0x004f549e`, `0x004f5784`, `0x004fcd10`, and `0x004fcf30`, plus the linked-peer action branches around `0x0040e60a`, `0x0040e9c2`, and `0x00464f8f`. This is therefore the safest current read for the shared world-side preview or tool mode switch owner rather than a single window-family helper.","objdump + caller inspection + local disassembly + mode-switch correlation + parameter-block correlation + paint-tool correlation + linked-peer action correlation" +0x00453370,405,world_enable_preview_mode_0x15_latch_and_enter_if_idle,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared world-side owner for entering the preview-capable mode `0x15`. The helper first rejects when latch byte `[this+0x21c5]` is already nonzero; otherwise it sets that latch and only continues when current mode `[this+0x2175]` is still `0`. On the active path it releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles prior shell-presenter counters for the neighboring mode families `3` and `7` plus optional flag pair `[this+0x219d/+0x21a1]`, adjusts the shared presenter count lane `[0x006d4024+0x11426e]` from the mode table at `0x005ee5e8/0x005ee6e4`, seeds mode `0x15` into `[this+0x2175]`, clears the local scalar band `[+0x2179..+0x2189]`, seeds both timeout-like dwords `[+0x218d/+0x2191] = 0x1869f`, and re-enters `0x00450520` before tailing through `0x00452d30` according to shell field `[0x006cec74+0x12c]`. Current grounded caller is the shell command strip at `0x00441182`, which dispatches here when active scenario plus world state exist and the same preview latch is still clear. This is the safest current read for the mode-`0x15` preview-latch entry owner rather than a generic world reset.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation" +0x00453510,621,world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared teardown-or-reseed owner for the same world-side preview-mode family rooted at mode byte `[this+0x2175]` and latch `[this+0x21c5]`. The helper first reconciles the auxiliary preview byte `[this+0x2171]` through the small clear tail at `0x00452d30`, then tears down the current mode state through `0x00532360`, `0x00532500`, and `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, clears the current mode dword `[this+0x2175]`, and decrements the same shell-presenter counter families used by the entry sibling for prior modes `3` and `7` plus optional flags `[this+0x219d/+0x21a1]`. When preview latch byte `[this+0x21c5]` is still set, it then replays the same mode-`0x15` reset strip against the live world root `0x0062c120`, re-seeding `[world+0x2175] = 0x15`, the scalar band `[+0x2179..+0x2191]`, and the later `0x00450520 -> 0x00452d30` tail. When that latch is clear it returns with the mode fully torn down. Current grounded callers include the shell-side linked-peer action branch at `0x0040e94c`, the route or preview wrappers at `0x00449467` and `0x00464f2d`, many shell tool-window destructors such as `0x004f3b50`, `0x004f50fa`, `0x004f5784`, and `0x0050db9c`, plus the explicit latch-clear sibling `0x004537a0`. This is therefore the safest current read for the shared preview-mode clear-or-reseed owner rather than a one-window destructor helper.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation + tool-window teardown correlation" +0x00453780,38,world_disable_preview_mode_0x15_latch_and_clear_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny paired exit helper for the same world-side preview-mode family. When latch byte `[this+0x21c5]` is nonzero the helper clears that latch and, if current mode `[this+0x2175]` still equals `0x15`, tail-jumps into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`; otherwise it returns immediately. Current grounded callers are the shell command strip at `0x0044118a` and the neighboring settings-side wrapper at `0x004ff90c/0x004ff94a`, which use it as the direct preview-mode unlatch path when the same mode-`0x15` latch is already active. This is the safest current read for the paired latch-clear helper rather than another generic world-mode toggle.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation" 0x004422d0,96,shell_status_stack_push_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status lanes into one `5`-byte slot selected by the current depth: shell dwords `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. Current grounded callers include the heavier wrappers `0x004423a0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation" 0x00442330,112,shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five status lanes from the selected `0x0062be90` slot back into shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, and returns. Current grounded callers include the higher wrapper `0x004423d0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation" 0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation" 0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded callers include the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, the neighboring save-load path `0x00446d40`, and the collection-side world branch `0x0046b9f0`, so this is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation" 0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads the smaller startup payload and preview-surface chunks rooted at ids `0x0001` and `0x03c2`, while the map-style side reads the larger setup payload chunks rooted at ids `0x0004`, `0x2ee0`, and `0x2ee1`, with the exact chunk mix gated by the parsed bundle-header word in the local scratch. Current grounded caller is `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`.","objdump + local disassembly + caller inspection + chunk-family correlation" 0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation" +0x00442660,209,shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks,shell,cdecl,inferred,objdump + caller inspection + local disassembly + status-notice correlation,2,"Shared progress-sample notice helper in the surrounding save or load strip. The helper measures the current byte counter through `0x00530b70`, derives one rounded kilobyte delta against previous counter `0x0062c11c`, formats that delta through `%5d`, measures elapsed ticks against `0x0062bed0` through `0x0051d890`, formats the elapsed field through `% 4d`, and then packages both fields plus the caller-supplied status stem into the shared shell text builder `0x005193f0 -> 0x00518de0 -> 0x0051d680`. It finally updates `0x0062c11c` to the current byte counter. Current grounded callers include the bundle-service strip at `0x00413469/0x004134b4` and the save-side progress path inside `shell_map_file_world_bundle_coordinator` around `0x00445098`, so this is the safest current read for the shared byte-delta and elapsed-time progress notice helper rather than a one-off formatter.","objdump + caller inspection + local disassembly + status-notice correlation + save-load-progress correlation" +0x00442740,128,shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Short companion helper in the same save or export strip. The function allocates a temporary `0x40000`-byte RGBA copy of the embedded preview pixel block rooted at `[record+0x03c2]`, constructs one temporary `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, and then forwards the caller path seed plus fixed selector `0x46` into `0x00542f50`, storing the returned dword into payload field `[record+0x18]`. It finally releases the temporary owner through `0x00542c90 + 0x0053b080`. Current grounded caller is the save-side bundle branch at `0x00445925`, immediately after tagged setup-preview payload export and before the shared progress notice path, so this is the safest current read for the temporary-surface query helper rather than a generic image copier.","objdump + caller inspection + local disassembly + surface-family correlation + save-side bundle correlation" +0x004427c0,624,shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Broader companion-payload rewrite owner in the same save or export strip. The helper copies the caller path into a local buffer, strips its extension through `support_strip_extension_in_place` `0x0051df90`, appends the fixed `%1.tmp` suffix, opens the source file, allocates one full-size heap buffer, and reads the file body through `0x005a1b05`. It then installs `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` into global `0x00d93988`, forwards the source tail plus destination tail rooted at `+0x03ce` into `0x00553000`, and writes the rewritten output back through `0x005a276f`, preserving the leading `0x03ce` bytes and the trailing untouched source bands around the transformed middle region. On completion it updates payload dword `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x00443cd3`, which enters this helper only when payload byte `[record+0x66c9]` is set before deriving the external `_A.tga/_A.jpg` companion path. This is the safest current read for the temporary-path companion-payload rewrite owner rather than a generic file copy helper.","objdump + caller inspection + local disassembly + companion-image correlation + tmp-path correlation + progress-callback correlation" +0x00442900,304,shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Sibling companion-payload rewrite owner in the same save or export strip. The helper takes the live payload record in `EAX` plus one caller path on the stack, reads the whole source file into a temporary heap buffer, installs progress callback `0x00441e20` in `0x00d93988`, and then rewrites the middle payload band through `0x00553000` using the stored file offsets in `[record+0x18/+0x1c]`. It writes the rebuilt output in four spans through `0x005a276f`: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. On completion it stores the caller path back into `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x004459dd`, reached after companion-image import `0x00441f70` when payload byte `[record+0x66c9]` is set, so this is the safest current read for the offset-driven companion-payload rewrite sibling rather than another generic file copier.","objdump + caller inspection + local disassembly + companion-image correlation + progress-callback correlation + save-side bundle correlation" +0x00442a40,31,locomotive_policy_issue_id_is_in_primary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Small range-membership predicate in the locomotive-policy strip. The helper returns true only for issue ids in the two disjoint bands `0x0f1..0x15f` and `0x1c9..0x1da`, and false everywhere else. Current grounded callers are the stream-load path `0x0042ddd0`, the stream-save inverse path `0x00430feb`, the scenario availability-owner path `0x0043160b`, the setup-side terrain or candidate branch `0x004d6125`, and the neighboring primary forward mapper `0x00442a85`, so this is the safest current read for the primary locomotive-engine-family issue-band membership test rather than a generic range helper.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation" +0x00442a5f,38,locomotive_policy_issue_id_is_in_secondary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Sibling range-membership predicate in the same locomotive-policy strip. The helper returns true only for issue ids in the disjoint bands `0x160..0x1c4` and `0x1db..0x1f6`, and false everywhere else. Current grounded callers are the same stream-load and stream-save pair `0x0042ddde` and `0x00431000`, plus the neighboring secondary forward mapper `0x00442aac`, so this is the safest current read for the secondary locomotive-engine-family issue-band membership test rather than another anonymous range check.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation" +0x00442a85,23,locomotive_policy_map_primary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + editor-policy correlation,3,"Primary forward mapper in the locomotive-policy strip. The helper treats the caller value as one compact engine-family or policy index, leaves `0` unchanged, maps `1..0x6f` into issue ids `0x0f1..0x15f`, maps `0x70..` into issue ids `0x1c9..0x1da` by inserting a fixed gap `0x69`, and then bounds the result against the upper limit `0x1db`. Current grounded callers are `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, the stream-load branch `0x0042de19`, and the neighboring primary row resolver `0x00442a9c`, so this is the safest current read for the forward map from the primary locomotive engine-family index space into raw issue ids rather than a plain arithmetic shim.","objdump + caller xrefs + local disassembly + editor-policy correlation + locomotive-policy correlation" +0x00442a9c,16,locomotive_policy_resolve_primary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Primary row resolver over the fixed issue table rooted at `0x00610398`. The helper first maps the caller through `locomotive_policy_map_primary_engine_family_index_to_issue_id` `0x00442a85`, then multiplies that issue id by stride `0x6e`, adds the table base `0x00610398`, stores the resulting row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the shell-side formatter strip at `0x00462449`, which uses the returned row to resolve the primary localized issue-name path. This is the safest current read for the primary issue-row resolver rather than a generic table indexer.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation" +0x00442aac,23,locomotive_policy_map_secondary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + caller correlation,3,"Secondary forward mapper in the same locomotive-policy strip. The helper leaves index `0` unchanged, maps `1..0x65` into issue ids `0x15f..0x1c4`, maps higher indices into issue ids `0x1db..0x1f6` by inserting fixed gap `0x16`, and bounds the result against the upper limit `0x1f7`. Current grounded callers are the stream-load branch `0x0042de19`, the locomotive scalar owner `0x00461a06`, and the neighboring secondary row resolver `0x00442ac3`, so this is the safest current read for the secondary locomotive-engine-family index-to-issue-id map rather than another plain arithmetic helper.","objdump + caller xrefs + local disassembly + caller correlation + locomotive-policy correlation" +0x00442ac3,16,locomotive_policy_resolve_secondary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Secondary row resolver over the same fixed issue table rooted at `0x00610398`. The helper maps the caller through `locomotive_policy_map_secondary_engine_family_index_to_issue_id` `0x00442aac`, multiplies the resulting issue id by stride `0x6e`, adds the base `0x00610398`, stores the row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the sibling shell-side formatter strip at `0x004624ae`, where it resolves the alternate localized issue-name row. This is the safest current read for the secondary issue-row resolver rather than a generic pointer arithmetic stub.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation" +0x00442ad3,14,locomotive_policy_map_primary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442a85` in the same locomotive-policy strip. The helper subtracts base issue id `0x0f0`, and when the resulting compact index rises above `0x6f` it removes the inserted gap `0x69` to recover the original primary engine-family or policy index. Current grounded caller is the stream-save path `0x00430ff2`, which uses this inverse map when serializing the primary issue band back into the compact save-side index space. This is the safest current read for the primary issue-id-to-index inverse rather than a free-standing subtractive helper.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation" +0x00442ae1,14,locomotive_policy_map_secondary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442aac` in the same locomotive-policy strip. The helper subtracts base issue id `0x15f`, and when the resulting compact index rises above `0x65` it removes the inserted gap `0x16` to recover the original secondary engine-family or policy index. Current grounded caller is the stream-save path `0x00431007`, which uses this inverse map when serializing the secondary issue band back into the compact save-side index space. This is the safest current read for the secondary issue-id-to-index inverse rather than another subtractive arithmetic stub.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation" +0x00442ba0,143,shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100,shell,thiscall,inferred,objdump + caller inspection + local disassembly + payload-export correlation,3,"Concrete live-payload export helper in the setup and map-bundle strip. The helper copies the full live payload record from `[this+0x66be]` into the caller buffer, forces the leading validity byte to `1`, patches the exported world dimensions from `[0x0062c120+0x2155/+0x2159]` into offsets `+0x01/+0x05`, mirrors three shell-side state bytes from `[0x006d4024+0x11471a]`, `[0x006d4024+0x11471e]`, and `0x0062bec4` into offsets `+0x09..+0x0b`, and then normalizes the embedded pixel block at `+0x03c2` through `0x0047a120` with fixed dimensions `0x100 x 0x100`. Current grounded callers are the save-side setup export path at `0x00444f42`, which immediately forwards the resulting record into the companion-image tag strip `0x00441ec0`, and the slot-table bundle serializer at `0x00446312`, which emits the same copied record under tags `0x2ee0/0x03c2/0x2ee1`. This is the safest current read for the live setup-preview payload exporter rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + payload-export correlation + companion-image correlation + bundle-tag correlation" +0x00442c30,3600,shell_apply_scenario_name_specific_post_load_world_and_object_fixups,shell,thiscall,inferred,objdump + caller inspection + local disassembly + scenario-string correlation,4,"Broad post-load fixup owner reached from `world_entry_transition_and_runtime_bringup` at `0x00444b50`. The helper compares the caller-supplied scenario title against many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload byte `[this+0x66de]`. Matching branches then perform targeted live-world and collection edits: they mutate object-state dwords and bytes inside collections rooted at `0x0062be18`, `0x0062bae0`, and `0x006ada80`; retune selected float and scalar fields; copy paired ten-dword record blocks when specific name or class pairs match; patch secondary-raster bits through the fixed table `0x005ee508..0x005ee5cc`; update one later collection at `0x0062b268`; and inject several scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated `0x0051e5d0`. This is the safest current read for the scenario-name-specific post-load fixup owner rather than a generic string-dispatch helper.","objdump + caller inspection + local disassembly + scenario-string correlation + live-world mutation correlation + post-load-fixup correlation" 0x0044c450,96,world_rebuild_all_grid_cell_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop.","objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation" 0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation" 0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation" @@ -763,6 +845,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004614d0,40,runtime_object_vtable_wrapper_query_local_companion_float_relief_score_at_rounded_coords,map,thiscall,inferred,objdump + local disassembly + wrapper correlation,2,"Tiny virtual-style wrapper over `world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias` `0x0044afa0`. It rounds the current object's normalized secondary and primary coordinates through `0x00455810`, `0x00455800`, and `0x005a10d0`, then forwards the resulting cell pair plus world root `0x0062c120` into `0x0044afa0`. Current evidence grounds it only as the table-local wrapper over the heavier world-scalar query, not the owning subtype name.","objdump + local disassembly + wrapper correlation + world-scalar-query correlation" 0x00461500,39,runtime_object_query_flag_byte_0x42_with_class0_true_fallback_when_mode_gate_inactive,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query on the same virtual-family boundary as `0x004614d0`. The helper first checks shell mode gate `0x004338c0` on scenario root `0x006cec78`; when that gate is active it returns byte `[this+0x42]` directly. When the gate is inactive it returns literal `1` only for class-0 records with `[this+0x23e] == 0`, and otherwise falls back to the same byte `[this+0x42]`. Current evidence is strong enough only for that structural fallback rule, not for a tighter semantic name for the flag or owning subtype.","objdump + local disassembly + mode-gate correlation + field inspection" 0x00461650,120,map_load_geographic_label_database,map,cdecl,inferred,ghidra-headless,3,Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.,ghidra + rizin + llvm-objdump + strings +0x00461c00,126,locomotive_collection_resolve_entry_by_primary_or_alias_stem,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared string resolver over the live locomotive collection at `0x006ada84`. The helper walks every live locomotive row, first compares the caller text against the primary stem at `[entry+0x34]`, then against the alias or secondary stem at `[entry+0x53]`, and returns the first matching live row pointer through the collection accessors `0x00518380/0x00518140`. Failure returns null. Current grounded caller is the cheat-code owner `0x00437d70`, where selector `4` resolves stems like the hidden locomotive cheat aliases before applying them to every train owned by the selected company through `0x004aefb0`. This is therefore the safest current read for the primary-or-alias locomotive stem resolver rather than a more specific dialog helper.","objdump + local disassembly + caller inspection + locomotive-stem correlation + cheat-branch correlation" +0x00461c80,30,locomotive_entry_query_linked_era_name_ptr,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small accessor over one live locomotive entry. The helper resolves linked era id `[loco+0x72]` through the era collection at `0x0062ba88` and, on success, returns the raw era-name pointer at `[era+0x45]`; missing era ids return null. Current grounded callers are the locomotives-availability and recipe-side editor families around `0x004cd641`, `0x004cdaf2`, `0x004cf16c`, `0x004cf1f2`, `0x004cf2ed`, `0x004cf3f0`, the world-entry rehydrate lane at `0x004478de`, and the smaller shell-side branch at `0x00438d5f`, so this is the safest current read for the linked-era name-pointer accessor rather than a display-only helper.","objdump + local disassembly + caller inspection + era-collection correlation + locomotive-editor correlation" +0x00461ca0,35,locomotive_entry_format_linked_era_name_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Formatting companion to `locomotive_entry_query_linked_era_name_ptr` `0x00461c80`. The helper resolves linked era id `[loco+0x72]` through the same era collection at `0x0062ba88` and, on success, forwards the era-name pointer `[era+0x45]` into `0x0051c920`; missing era ids return null. Current grounded callers are the train-upgrade news formatter `0x00409300` and the neighboring company-side upgrade branch at `0x00409903`, where it supplies the old and new locomotive-era display names embedded in localized news id `2897`.","objdump + local disassembly + caller inspection + era-name formatting correlation + train-upgrade-news correlation" 0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation" 0x00461e00,262,locomotive_collection_refresh_runtime_availability_overrides_and_usage_state,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime refresh over the live locomotive pool at `0x006ada84`. The helper guards itself with reentrancy latch `0x006ada88`, walks every live locomotive record, resolves the linked era record through `[loco+0x72]`, and combines the locomotive-side requirement bytes `[loco+0x30/+0x31/+0x32]` with the active scenario-state availability toggles at `[0x006cec78+0x4c97..+0x4c99]`. When the current locomotive or its linked era passes those gates it upserts one boolean availability override through `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0`; it then immediately queries the resulting named override through `scenario_state_query_named_locomotive_availability_record_value` `0x00435030` and stores that value into `[loco+0x7b]`. When the collection sweep finishes it tails into `0x00436af0` to rebuild the dependent locomotive-side scalar band. Current grounded callers are the world-entry rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and the startup or restore-side upsert family that also re-enters this helper through `0x004350b0`, so this is the safest current read for the collection-wide locomotive runtime-availability refresh rather than a single dialog-owned toggle helper.","objdump + caller xrefs + local disassembly + locomotive-availability correlation + scenario-state override correlation + reentrancy-latch correlation" 0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless,4,Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.,ghidra + rizin + llvm-objdump + strings @@ -911,6 +996,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x004853c0,740,shell_apply_graphics_preset_bundle,shell,cdecl,inferred,ghidra-headless,4,Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024.,ghidra + rizin + llvm-objdump 0x00485060,635,shell_set_graphics_option_with_fanout,shell,thiscall,inferred,ghidra-headless,4,Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes.,ghidra + rizin + llvm-objdump 0x00485760,2746,vehicle_visual_init_running_gear_and_smoke_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner.,ghidra + rizin + llvm-objdump + strings +0x004858e0,1677,vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children,bootstrap,thiscall,inferred,objdump + local disassembly + rdata literal inspection,2,"Broader vehicle-side child-builder under `vehicle_visual_init_running_gear_and_smoke_effects` `0x00485760`. The helper formats and allocates one attachment child for `%1_ExhaustSmoke.3dp`, one payload record for `%1_MuzzleFlash.3dp`, then builds and registers a larger running-gear strip including `%1_RoadWheelL%2.3dp`, `%1_RoadWheelR%2.3dp`, `%1_IdlerWheelL.3dp`, `%1_IdlerWheelR.3dp`, `%1_DriveWheelL.3dp`, `%1_DriveWheelR.3dp`, `%1_TrackL.3dp`, `%1_TrackR.3dp`, and `%1_MantletLight1.3dp`. Along that path it publishes child handles through `0x0052d8a0/0x0052d9a0`, derives local triplet bands through `0x0052e780`, and uses `0x0052db10/0x0052dc00` to materialize and threshold-bucket grouped packet rows on the two running-gear child roots at `[this+0x232]` and `[this+0x236]`. Current evidence is strongest for the exhaust, wheel, track, and mantlet attachment-child builder rather than the top-level vehicle visual constructor itself.","objdump + local disassembly + rdata literal inspection + vehicle-visual correlation + grouped-subrecord correlation" 0x004883f0,325,scenario_text_export_append_numbered_entry,scenario,cdecl,inferred,ghidra-headless,4,Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0.,ghidra + rizin + llvm-objdump + strings 0x004886e0,3796,scenario_text_export_build_language_file,scenario,cdecl,inferred,ghidra-headless,4,Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer.,ghidra + rizin + llvm-objdump + strings 0x00487450,153,shell_open_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,3,Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c.,ghidra + rizin + llvm-objdump + strings @@ -1035,7 +1121,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00504590,468,shell_station_detail_present_scenario_station_connection_triplet_popup,shell,cdecl,inferred,objdump + local disassembly + caller inspection + format-string correlation,3,"Formats and presents the scenario-latched `StationDetail.win` popup beneath action controls `0xb3b7` and `0xb3b8`. After validating the current station from detail-manager state `0x006d0818+0x90`, the helper walks the selected station's per-destination table rooted at `[station+0x30]`, skips invalid or self station ids, copies each other station name into the local text buffer, and then appends three per-destination scalar lanes from the current station's five-byte-stepped metric arrays. Active lanes format through the local `%1 : ` and ` %5.2f` helpers at `0x005d16f0` and `0x005d16e8`, while missing lanes fall back to `N/C` at `0x005d16e0`; the stacked result is then published through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16e8`. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610` when scenario latch `[0x006cec74+0x1db]` is set, so the safest current read is a scenario-side station connection triplet popup rather than an ordinary haul or candidate-service branch.","objdump + local disassembly + caller inspection + format-string correlation + scenario-latch correlation" 0x00504770,786,shell_station_detail_present_to_from_haul_stats_popup,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats and presents the `StationDetail.win` hauled-traffic popup for one of the two `To` or `From` summary widgets. The helper validates the current station from detail-manager state `0x006d0818+0x90`, resolves the selected station record through `0x006cec20`, and then chooses the localized direction strings `676` `...hauled TO this station.` or `679` `...hauled FROM this station.` plus the singular or plural `load` and `loads` labels `677/678` based on the triggering control id `0xb3f6` versus `0xb3f7`. It formats the current-year and lifetime load and value totals through the station haul-stat helpers at `0x0047d7e0` or `0x0047d7f0`, then presents the final popup text through the shell message-box path at `0x00538c70`. Current grounded owner is the neighboring `To` or `From` summary-widget builder at `0x00505150`.","objdump + RT3.lng strings + caller inspection + hauled-traffic popup correlation" 0x00504a90,70,shell_station_detail_clear_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Clears the active candidate-service preview owned by `StationDetail.win`. The helper first resets the shared `(placed-structure id, candidate id)` pair at `0x005ee4fc` and `0x005ee500` through `0x0043f610`, then tears down the local station-detail preview latch at `[this+0x7c]` and decrements the sibling global refcount `0x0062be84` when that preview was armed. When the live world owner at `0x0062c120` is in the matching preview-capable mode gate rooted at `[+0x2171]` and `[+0x2175]`, it tails into the neighboring world-side clear path at `0x00452d30`. Current grounded callers are the station-detail selection reset branches around `0x00504bca`, `0x00504bda`, and the later cleanup family at `0x00505bff` and `0x00505c0a`.","objdump + caller inspection + world-preview correlation" -0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `0x00452f60`, `0x00452d80`, `0x00452db0`, and `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation" +0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active` `0x00452f60`, `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`, `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` `0x00452db0`, and `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation" 0x00504ba0,796,shell_station_detail_update_candidate_service_entry,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Updates one candidate-service entry inside `StationDetail.win`. With zero in the first stack slot the helper either re-arms the globally remembered candidate through `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` or clears the current preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`. On the ordinary nonzero path it validates the current station from detail-manager state `0x006d0818+0x90`, rejects disallowed modifier combinations from `0x006d4018+0xa8c`, resolves the candidate from `0x0062ba8c`, and then either updates the hover anchor at `0x006d16fc/0x006d1700` or re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` to format the visible entry text. Current grounded text lanes use localized ids `681`, `682`, and `2813` for the loads-available, current-price, and average-profit explanation strings, plus ids `688` and `689` for the nearby-structure jump text. This is the clearest shell-side owner above the active candidate-service preview pair and the station-detail candidate service readout.","objdump + RT3.lng strings + caller inspection + service-preview correlation" 0x00504bea,722,shell_station_detail_format_candidate_local_service_summary,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the candidate-local-service summary lane inside `StationDetail.win`. The helper validates the current station id from the detail manager through collection `0x006cec20`, resolves the candidate record through `0x0062ba8c`, and when the ordinary station-detail path is active it re-enters `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` before querying `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`. It then formats the visible candidate text using localized ids `681` `%1: Loads available: %2`, `682` `Current Price: %1`, and the explanatory text `2813` `Prices shown are the average profit per load for delivering %1 from %2 to that station...`; neighboring branches also use localized ids `688` and `689` for the nearby-structure jump affordance. This now looks like the shell-side candidate-service readout above the same local service metric lane used by the station freight and express summaries.","objdump + RT3.lng strings + caller inspection + service-query correlation" 0x00505150,796,shell_station_detail_build_to_from_haul_summary_widget,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Builds one of the two `To` or `From` hauled-traffic summary widgets inside `StationDetail.win`. The helper chooses the localized heading `686` `To` or `687` `From` from its first argument, paints a bounded 10-step summary strip from the supplied float lane and the paired station haul-stat queries at `0x0047d7e0` or `0x0047d7f0`, and formats the one-line direction-specific labels and totals through the same `load` or `loads` family later used by the popup callback. On first build it also registers the matching control id `0xb3f6` or `0xb3f7` through callback `shell_station_detail_present_to_from_haul_stats_popup` at `0x00504770`, so the same widget owns both the visible `To` or `From` strip and the click-through stats popup. Current grounded caller is the larger station-detail refresh pass at `0x00506610`, which constructs the `To` and `From` widgets back to back.","objdump + RT3.lng strings + caller inspection + control registration correlation" @@ -1043,6 +1129,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00505760,1159,shell_station_detail_refresh_candidate_service_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the visible candidate-service row lane inside `StationDetail.win`. The helper counts currently active candidate-service entries through `placed_structure_count_candidates_with_local_service_metrics` at `0x0047e330`, resolves each visible row candidate through the neighboring ordinal helper at `0x0047e620`, and then colors and formats the row from the candidate-local-service metrics, the candidate display name, and the same localized strings `681`, `682`, and `2813` used by `shell_station_detail_update_candidate_service_entry`. It registers the per-row click path through callback `shell_station_detail_update_candidate_service_entry` at `0x00504ba0`, keeps the selected and hovered candidate ids in the globals `0x006d16f8` and `0x006d16f4`, and toggles the current preview highlight as rows are rebuilt. Current grounded caller is the broader station-detail refresh pass at `0x00506610`.","objdump + RT3.lng strings + caller inspection + candidate-service row correlation" 0x00504ec0,644,shell_station_detail_refresh_class_3_or_4_train_service_matrix,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng string-id correlation,3,"Alternate `StationDetail.win` refresh branch for selected station classes `3` and `4`. After validating the current station and republishing the station name through helper root `0x006d16e4`, the helper rebuilds a five-row by two-column train-service matrix: the column headers come from localized ids `684` `Trains Serviced` and `685` `Trains Maintained`, the per-row category labels resolve through the world-side lookup table at `0x006cec78+0x46a84` plus `0x0053de00/0x00552560`, and the underlying counts come from the station-side integer lanes at `0x0047d800`. When the detail view is not already marked live it also rebuilds the shared popup-capable haul widget lane and reuses `shell_station_detail_present_to_from_haul_stats_popup` `0x00504770` as the click-through callback. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, which routes class-`3/4` stations into this helper instead of the ordinary nearby-structure, haul-summary, and candidate-service strip.","objdump + local disassembly + caller inspection + RT3.lng string-id correlation + class-3-4-branch correlation" 0x00506610,688,shell_station_detail_window_refresh_controls,shell,cdecl,inferred,objdump + local disassembly + caller inspection + child-helper correlation,4,"Broad refresh owner for the shell-side `StationDetail.win` family. The helper first validates the currently selected station id from detail-manager state `[0x006d0818+0x90]`, resolves the live station from collection `0x006cec20`, and publishes the upper summary lane through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16ec`. When scenario-side latch `[0x006cec74+0x1db]` is set it re-enters `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` for the paired action controls `0xb3b7` and `0xb3b8`; otherwise it checks the resolved candidate class byte `[candidate+0x8c]`, routes classes `3` and `4` into `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and for the ordinary branch it publishes the station name, rebuilds the nearby-structure jump lane through `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470`, rebuilds the `To` and `From` hauled-traffic widgets through `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150`, rebuilds the candidate-service rows through `shell_station_detail_refresh_candidate_service_rows` `0x00505760`, and finally marks the detail view live through `0x006d16f0 = 1`. Current grounded callers are the constructor-side control wiring under `shell_station_detail_window_construct` `0x005068c0` and the paired action-control callbacks on `0xb3b7/0xb3b8`, so this is the safest current read for the main StationDetail refresh owner rather than a narrower popup callback.","objdump + local disassembly + caller inspection + child-helper correlation + StationDetail control correlation" +0x00505e50,766,shell_station_detail_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + control-range correlation,4,"Primary message dispatcher for the shell-side `StationDetail.win` panel rooted at singleton `0x006d16d8`. The helper validates the current selected station from the detail-manager state under `0x006d0818+0x90`, mirrors that station into live world latch `[0x006cec78+0x4cba]` on the message-`0` setup branch, clears or preserves the active candidate-service preview state under `0x006d16f8/0x006d16fc/0x006d1700`, and can leave the panel through `shell_detail_panel_transition_manager` `0x004ddbd0` when the selected station is no longer valid. The message-`0xca` branch owns two concrete row families: candidate-service controls `0xb4dc..0xb5a3`, which either hand off into the `Overview.win` lane through `0x004ddbd0(..., 9, ...)` plus `0x004f4970` when Ctrl is held or else re-arm or clear the world preview through `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` and `0x00504a90`; and nearby-structure controls `0xb40a..0xb413`, which resolve site ids through `0x0047dc90/0x0047dcb0`, transition the detail manager with mode `0x0a`, and optionally recenter the world view through `0x00433900` plus the target object's vtable `+0x5c` callback when no modal overlay is active. The message-`0x3ea` branch refreshes the dirty dynamic rows through `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`, then restyles control `0xb3f8` from selected-station byte `[station+0x5c9]` and re-arms the active preview if one is selected. The message-`0xcb` action band owns the paired navigation or selector toggles on `0xb3b3/0xb3b4`, the tutorial-gated back or escape branch beneath localized id `0xe8c`, and the lower `0xb3b5..0xb3bf` class-gated action dispatch that first checks selected-company ownership through `0x00504390/0x005043f0`, then resolves linked site and candidate class state through `0x0047de00`, `0x0040cec0`, and `0x0047fd50` before re-entering the world-side action helper strip under `0x00419590`. This is the current grounded owner above the already-mapped refresh helper `shell_station_detail_window_refresh_controls` `0x00506610`, not just one narrow control callback.","objdump + local disassembly + caller inspection + control-range correlation + StationDetail message-branch correlation" 0x0050c500,426,shell_present_chairmanship_takeover_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch.","objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation" 0x0050c940,880,shell_resolve_chairmanship_takeover_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.","objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation" 0x0050ccc0,709,shell_company_detail_attempt_chairmanship_takeover_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + takeover-election correlation" @@ -1065,6 +1152,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00507620,656,shell_station_pick_window_construct,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Constructs the shell-side `StationPick.win` helper window. The constructor binds the list control `0x80ea`, the scroll or selector controls `0x80e8` and `0x80e9`, publishes the helper at `0x006d1718`, and then populates the visible station rows from collection `0x006cec20`. The same family feeds the selected station id through `0x00622ae8`, normalizes list and scroll messages through `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event` `0x005075c0`, and returns the chosen id to the caller when the modal opener closes. Current grounded callers put this helper under the `StationList.win` selector branch rather than under the startup-company flow.","objdump + strings + caller inspection + helper correlation + StationPick normalization correlation" 0x005076c0,501,shell_station_pick_window_populate_station_rows,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Populates the visible row set for the shell-side `StationPick.win` helper. The helper iterates collection `0x006cec20`, filters entries through `0x0047fd50`, sorts them by the display-name field at `[entry+0x46b]`, and publishes the resulting station names through the helper list control `0x80ea`. It also mirrors the chosen station ids back into the helper-local scratch arrays, updates one status lane through control event `0xaf`, and refreshes the visible row count through control event `0x66`. Current grounded caller is `shell_station_pick_window_construct` at `0x00507620`.","objdump + strings + caller inspection + collection iteration" 0x005078c0,192,shell_station_pick_window_open_modal_and_return_selected_station_id,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Modal StationPick helper opener above `shell_station_pick_window_construct` `0x00507620`. If the live station collection `0x006cec20` is empty the helper returns `-1` immediately. Otherwise it allocates one `0x78`-byte helper object through `0x0053b070`, constructs the `StationPick.win` window, stores the live helper at `0x006d1718`, optionally nudges one presentation float at `[helper+0x05]` when caller flag `CL` is nonzero, brackets the modal show path through `0x00483450`, `0x00538f10`, `0x004834a0`, and `0x005389c0`, then destroys the helper, clears `0x006d1718`, and returns the selected station id from `0x00622ae8`. Current grounded caller is the side-selector branch inside `shell_station_list_window_handle_message` `0x005071e0`.","objdump + caller inspection + local disassembly + modal-helper correlation" +0x00505bf0,188,shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly + helper-root correlation,3,"Primary `StationDetail.win` destructor rooted at vtable `0x005d1748`. The helper first restores that same vtable, clears the active candidate-service preview pair through two calls into the world-side reset helper `0x0043f610`, drops the local preview latch `[this+0x7c]` together with sibling refcount `0x0062be84`, optionally re-enters the world-side preview clear path `0x00452d30` when the live world owner at `0x0062c120` is still in the matching preview-capable mode gate, releases the five shell helper handles at `0x006d16dc`, `0x006d16e0`, `0x006d16e4`, `0x006d16e8`, and `0x006d16ec` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d16d8`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current grounded caller is the shell detail-panel teardown side at `0x004dd9fa`.","objdump + vtable scan + local disassembly + helper-root correlation + preview-teardown correlation" +0x00505cb0,382,shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class,shell,fastcall,inferred,objdump + local disassembly + caller inspection + collection-walk correlation,3,"Direction-driven station-selection helper beneath the `StationDetail.win` family. The first register argument in `ECX` is a signed step direction, and the helper first validates the current selected station from detail-manager state `0x006d0818+0x90`, resolves that station's owner through `0x0047efe0`, and gets its current live-slot position in collection `0x006cec20`. It then walks the live station collection circularly by the requested direction until it finds another entry that passes the same station-or-transit-site class allowlist `0x0047fd50` and shares the same linked company id. When a match is found it releases the current global iteration root through `record_collection_release_global_iteration_root_0x6acd40_if_present` `0x004557b0`, republishes the selected station into the shell detail-panel family through `0x004dd8a0`, and, when no modal overlay is active under `[0x0062be68+0x60]`, recenters the world view through `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900` before tail-calling the target object's vtable `+0x5c` callback. This is the current grounded owner for StationDetail next-or-previous station stepping rather than a generic collection iterator.","objdump + local disassembly + caller inspection + collection-walk correlation + owner-filter correlation" +0x00505e30,10,shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `+1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the broader shell command branch at `0x00440e0f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation" +0x00505e40,8,shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `-1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the paired shell command branch at `0x00440f2f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation" 0x004d4500,88,shell_ensure_editor_panel_window,shell,cdecl,inferred,objdump + analysis-context,4,Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160.,objdump + analysis-context + strings 0x004dc670,368,shell_file_options_dialog_construct,shell,thiscall,inferred,objdump + strings,4,Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled.,objdump + strings 0x004dc7d0,14,shell_has_file_options_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared shell file-options dialog rooted at `0x006d0800`. The helper returns `1` when the live `fileopt.win` object is present and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this check now sits beside the `LoadScreen` and custom-modal probes.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation" @@ -1493,6 +1584,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00482d10,110,runtime_query_cached_local_exe_version_float,simulation,thiscall,inferred,objdump + local disassembly,3,"Returns one cached local executable version as a float-like `major + minor/100` value. On first use the helper queries the version-info resource of the literal stem `RT3.EXE` at `0x005cec18` through `0x0055d9c0`, splits the returned packed dword into low and high 16-bit words, converts them into one float as `hi + lo/100.0`, caches the result at `0x006cec5c`, and returns that cached value on later calls. The sibling formatter `0x00482d80` and the rounded hundredths query `0x00482e00` both consume the same source, which now makes this the clearest current owner for the local `1.03/1.04/1.05/1.06`-style version float rather than a gameplay progress value.","objdump + local disassembly + version-resource correlation" 0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation" 0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation" +0x00482e50,271,shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shell-state owner beneath `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` and the setup-mode selector `0x00502c00`. The helper writes the caller-supplied boolean into editor-map mode field `[this+0x68]`, then splits its refresh side effects by that target mode. When the target mode is `0` it re-enters `0x004d44a0` and `0x004dfda0` when the detail-panel controller `0x006d0818` is live, refreshes the active world root through `world_compute_transport_and_pricing_grid` `0x0044fb70` when `0x0062c120` exists, and then re-enters `shell_apply_graphics_option_runtime_effects` `0x00484d70` with mask `0x0d` and stack flag `1`. When the target mode is nonzero it instead re-enters `shell_ensure_editor_panel_window` `0x004d4500` before the same `0x00484d70(0x0d, 1)` tail. Current evidence is strong enough to treat this as the real editor-map-mode setter plus dependent detail-panel, world, and graphics refresh owner.","objdump + local disassembly + caller inspection + editor-map-mode correlation + side-effect correlation" +0x00483680,17,shell_command_cycle_display_resolution_forward,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,2,"Small registered shell command beneath action id `0x78` and localized label id `0x0d52`. The helper fixes forward step `+1` in `ECX` and tail-calls `shell_cycle_display_resolution_and_publish_status` `0x00483780`. Current evidence is strong enough for the command-wrapper role and step direction, but not yet for a tighter player-facing label beyond the display-resolution cycle.","objdump + command-registration correlation + local disassembly + caller inspection + wrapper correlation" +0x00483780,527,shell_cycle_display_resolution_and_publish_status,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Broader display-resolution cycle owner reached from the small forward and backward wrappers at `0x00483680`, `0x00483990`, and `0x004839a0`. The helper requires live shell presenter root `0x006d4024`, reads the current display mode through the active mode table and the paired width-bucket tables at `0x00620e64` and `0x00620e7c`, derives one bounded six-step cycle from the caller-supplied signed step in `ECX`, selects the next supported resolution pair, and applies that requested size through `0x005206b0`. It then formats and publishes a status string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, refreshes dependent presentation state through `0x004625b0`, persists the graphics config through `0x00484910(1)`, and re-enters the neighboring shell follow-on `0x004821d0`. Current evidence is strong enough to treat this as the shared display-resolution cycle-and-apply owner rather than a narrower presenter-only math helper.","objdump + local disassembly + caller inspection + display-mode-table correlation + status-publish correlation" +0x00483990,8,shell_cycle_display_resolution_forward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `+1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain forward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation" +0x004839a0,8,shell_cycle_display_resolution_backward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `-1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain backward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation" 0x004839b0,37,shell_setup_query_file_list_uses_map_extension_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns whether the current `Setup.win` file-list scan should enumerate the map-family extension pattern `*.gm*` instead of the saved-game pattern `*.smp`. The helper checks the live shell state rooted at `0x006cec74`: it requires the broad setup/file gate at `[shell+0x1bf]`, then returns true when either `[shell+0x68]` is nonzero or the current setup-side mode flag at `[this+0x6c]` equals `1`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, where the result chooses the search literal at `0x005c9d14` versus `0x005c9d1c`.","objdump + literal inspection + caller correlation + setup-file-root correlation" 0x004839e0,37,shell_setup_query_file_list_root_dir_name,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns the root directory name used by the current `Setup.win` file-list scan. When `[this+0x6c] == 2` it returns the literal `data\\tutorial` at `0x005ca338`; otherwise it returns `maps` at `0x005ced78` when `[this+0x68]` is nonzero or `[this+0x6c] == 1`, and falls back to `saved games` at `0x005ced80` for the ordinary setup-side load family. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which formats the returned root through the literal `%s\\` at `0x005c9d10`.","objdump + literal inspection + caller correlation + setup-file-root correlation" 0x00433260,400,shell_setup_filter_candidate_file_by_dataset_and_payload_flags,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Filters one candidate `Setup.win` filename against the current dataset id and the small payload-flag family recovered from the staged bundle. Editor-map mode short-circuits to success immediately through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`; otherwise the helper builds one rooted path from `shell_setup_query_file_list_root_dir_name` `0x004839e0`, opens the candidate bundle through `0x00530c80`, reads the small chunk family `0x2ee0/0x3c2` through `0x00531150/0x00531360`, and then applies dataset-specific acceptance rules to three recovered flag bytes. The current split is tighter now: dataset `10` requires the sandbox-side payload-flag family, dataset `9` requires a different nonzero payload-flag family, dataset `8` stays on the plain non-sandbox path, and dataset `12` adds one literal stem check through `0x005c9cf8` before the later payload-flag gate. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which uses this helper as the real extension-and-payload filter beneath the file-backed setup lists.","objdump + local disassembly + caller correlation + setup-dataset correlation + payload-flag gating correlation" @@ -1719,7 +1815,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00529fd0,793,shell_build_cell_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state.,ghidra + rizin + llvm-objdump 0x0052a2f0,736,shell_build_ranked_overlay_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span.,ghidra + rizin + llvm-objdump 0x0052a5d0,1784,shell_build_ranked_object_billboard_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span.,ghidra + rizin + llvm-objdump -0x0052dd00,864,shell_expand_segment_record_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one active presentation-batch record into three transformed 0x20-byte segment records inside the caller-provided buffer; each output record is two vec3 blocks at +0x00 and +0x0c plus scalar slots at +0x18 and +0x1c. The selected batch record supplies a source-array pointer at +0x04 a source-count at +0x0c and 0x4c-byte packed source entries that carry four point sources plus three scalar pairs for the emitted triplet.,ghidra + rizin +0x0052dd00,864,runtime_object_emit_materialized_group_packet_rows_as_segment_record_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared segment-record emitter beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. Starting from the currently selected group header `[this+0x14/+0x3a/+0x21]`, the helper resolves the active materialized row payload at `[row+0x35]`, the current packet source span from `[record+0x04/+0x08/+0x0c]`, and one shell-presenter-derived count through `0x0051f090`, then emits `count*3` transformed `0x20`-byte segment records into the caller-provided buffer while advancing the output-count accumulator. In the nonnegative `[this+0x69]` branch each output record carries two vec3 blocks at `+0x00` and `+0x0c` plus scalar slots at `+0x18` and `+0x1c`; in the negative branch it emits the same triplet family with the reduced scalar form. Current grounded caller is the layout-state presentation owner `0x005490b0`, so this is the safest current read for emitting materialized group packet rows as one segment-record window rather than a shell-only batch expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + segment-record-window correlation" 0x0053f000,238,mouse_cursor_select_shape_id_load_handle_and_refresh_shell_presentation,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Core `MouseCursor.cpp` selector over one requested cursor-shape id. The helper normalizes negative ids to zero, optionally short-circuits when the requested id already matches `[this+0x04]`, refreshes the local elapsed-tick latch `[this+0x24]` through `0x0051d890`, toggles cursor visibility through `0x0051e810` on the special `0 -> nonzero` and `nonzero -> 0` transitions, lazily loads the corresponding native cursor handle into table `0x00ccba60` through `0x0053ee90`, publishes that handle through the USER32 cursor-set import, resolves one shell presentation payload through `0x0053d110` when the requested id is nonzero, releases the previous payload through `0x0053c000`, and then stores the new payload at `[this+0x00]` plus the selected id at `[this+0x04]`. Current grounded callers include shell modal setup `0x004c98a0`, several detail-panel mode publishers, and the rest of the mouse-cursor owner family, so this is the safest current read for the live cursor-shape selector plus presentation refresh owner.","objdump + caller inspection + local disassembly + source-string correlation + cursor-handle-table correlation" 0x0053f0f0,115,mouse_cursor_enter_hidden_or_captured_mode_and_clear_selection,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Mode-transition branch in the `MouseCursor.cpp` owner family. When local state `[this+0x18]` is still clear, the helper first pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, then calls one zero-argument USER32 import, marks `[this+0x18] = 1`, clears `[this+0x14]`, seeds `[this+0x08] = 1`, mirrors shell latch `[0x006d4024+0x11473e] = 1`, and, when a non-`-1` cursor id is active, forces cursor visibility down through `0x0051e810(0)` before re-entering `0x0053f000(-1, 0, 0)`. Current grounded callers are the graphics-backend service branches `0x004ffb64`, the coarse mouse-cursor service `0x0053f400`, and the local constructor sync at `0x0053f330`, so the safest current read is a hidden-or-captured mode entry branch rather than a generic state toggle.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation" 0x0053f170,159,mouse_cursor_begin_pending_release_from_hidden_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Release-side mode-transition branch in the `MouseCursor.cpp` owner family. When `[this+0x14]` is still clear, the helper conditionally forwards the shell window handle through one one-argument USER32 import when graphics mode byte `[0x006d4024+0x114226]` is active, pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, re-enters `0x0053f000(0, 0, 0)` to clear the live cursor selection, clears `[this+0x18]`, sets `[this+0x14] = 1`, zeroes shell latches `[0x006d4024+0x11473a/+0x11473e]`, and, when local byte-flag dword `[this+0x08]` is nonzero, raises cursor visibility back through `0x0051e810(1)`. Current grounded callers are the graphics-backend service-and-repaint branch `0x004ffafb`, the coarse mouse-cursor service `0x0053f400`, and the local inside-view watcher `0x0053f450`, so this is the safest current read for the begin-release transition out of the hidden mode.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation" @@ -1732,7 +1828,44 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0053f400,80,mouse_cursor_service_coarse_global_mode_latches,shell,cdecl,inferred,objdump + caller inspection + local disassembly + family correlation,3,"Coarse service branch over the global `MouseCursor.cpp` mode latches `0x00ccbb18/0x00ccbb1c/0x00ccbb24/0x00ccba58/0x00ccba5c`. The helper decrements countdown `0x00ccbb24`, and when that reaches zero it dispatches either into `0x0053f0f0` or `0x0053f170` from the pending global owners, then mirrors the surviving globals back into shell latches `[0x006d4024+0x11473e/+0x11473a]`. Current grounded caller is the frame updater `0x0053f4e0`.","objdump + caller inspection + local disassembly + family correlation + shell-latch correlation" 0x0053f450,134,mouse_cursor_refresh_inside_active_view_and_toggle_visibility_hint,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Small view-sensitive refresh in the `MouseCursor.cpp` family. The helper samples the current `cursor inside active view` predicate through `shell_input_cursor_inside_active_view` `0x0054f540`, compares that boolean against local state `[this+0x08]`, and on changes updates the same state plus toggles cursor visibility through `0x0051e810(0/1)` when hidden mode `[this+0x18]` is active. On the fallback path it also consults the global shell-side cursor owner at `0x00ccbb20` and, when the global `ShowCursor` refcount is positive, refreshes the coarse elapsed-tick latch `[this+0x24]` or re-enters `0x0053f000(1, 1, 0)`. Current grounded callers are `mouse_cursor_update_frame_state` `0x0053f4e0` and the shell camera action helper `0x004e0780`, so this is the safest current read for the inside-view watcher plus visibility hint owner.","objdump + caller inspection + local disassembly + source-string correlation + inside-view correlation" 0x0053f4e0,739,mouse_cursor_update_frame_state,shell,thiscall,inferred,ghidra-headless,4,Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.,ghidra + rizin + llvm-objdump + strings -0x0052e060,537,shell_expand_vertex24_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Sibling emitter for the same active presentation-batch record family; expands each 0x4c-byte packed source entry into three 0x18-byte vertex24 records in the caller-provided buffer. Each emitted record stores a vec3 at +0x00 a style dword from [this+0x43] at +0x0c and scalar slots at +0x10 and +0x14 while the output-count accumulator advances by count*3.,ghidra + rizin +0x0052e060,537,runtime_object_emit_materialized_group_packet_rows_as_vertex24_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Vertex24-emission sibling to `0x0052dd00` beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. The helper resolves the same selected group header, active materialized row payload at `[row+0x35]`, and packet source span from `[record+0x04/+0x08/+0x0c]`, then emits `count*3` transformed `0x18`-byte vertex24 records into the caller-provided buffer while advancing the output-count accumulator. Each emitted record stores one vec3 at `+0x00`, style dword `[this+0x43]` at `+0x0c`, and scalar lanes at `+0x10/+0x14`, with the same nonnegative-versus-negative `[this+0x69]` split used by `0x0052dd00`. Current grounded caller is the shell-side presentation branch `0x00528821`, so this is the safest current read for emitting materialized group packet rows as one vertex24 window rather than a shell-only triplet expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + vertex24-window correlation" +0x0052cd20,21,embedded_view_controller_copy_eye_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny copy helper over the embedded world-view controller base. The function copies the current eye triplet `[this+0x1c/+0x20/+0x24]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the world-view wrapper `0x00527e5e`, which uses it together with the focus-triplet sibling `0x0052cd40`, so this is the safest current read for the packed eye-triplet copy helper rather than a broader serializer.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052cd40,21,embedded_view_controller_copy_focus_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Packed focus-triplet sibling to `0x0052cd20` over the same embedded controller base. The helper copies the current focus triplet `[this+0x04/+0x08/+0x0c]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the same world-view wrapper `0x00527e6a`, so this is the safest current read for the packed focus-triplet copy helper rather than another generic memcpy leaf.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052cd60,28,embedded_view_controller_copy_eye_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out eye-triplet copy helper over the embedded world-view controller base. The function writes current eye lanes `[this+0x1c/+0x20/+0x24]` into three separate caller out-pointers. Current grounded callers include the world-view wrappers `0x00524089`, `0x00528226`, `0x00528384`, `0x00529508`, `0x00529c02`, `0x0052a79a`, the local helper strip around `0x0052bb01`, and sibling controller-bridge calls inside `0x00548382/0x005484de`, so this is the safest current read for the split eye-triplet export helper rather than a subtype-specific query.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052cd80,28,embedded_view_controller_copy_focus_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out focus-triplet sibling to `0x0052cd60` over the same embedded controller base. The function writes current focus lanes `[this+0x04/+0x08/+0x0c]` into three separate caller out-pointers. Current grounded callers include world-side and setup-side branches `0x0042ac39`, `0x0042ad67`, `0x00487483`, `0x0052ad16`, `0x0052bad3`, and sibling controller-bridge calls inside `0x0054836c/0x005484c8`, so this is the safest current read for the split focus-triplet export helper rather than a generic outparam block.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052cda0,28,embedded_view_controller_copy_aux_triplet_0x2c_0x34_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small auxiliary-triplet export helper over the embedded controller base. The function writes lanes `[this+0x2c/+0x30/+0x34]` into three separate caller out-pointers. Current grounded caller is the neighboring layout-state bridge `0x00548398`, so this is the safest current read for exporting the auxiliary cached triplet at `+0x2c..+0x34` rather than a named world coordinate without broader owner evidence.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052cdc0,22,embedded_view_controller_store_aux_triplet_0x2c_0x34,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion to `0x0052cda0` over the same controller base. The helper stores three caller dwords into auxiliary triplet `[this+0x2c/+0x30/+0x34]`. Current grounded callers are the setup-side world-view branches `0x004592ef` and `0x00459b7b`, so this is the safest current read for the auxiliary-triplet store helper rather than a broader camera-mode owner.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052cde0,48,embedded_view_controller_set_dirty_latch_0x64_and_optionally_snapshot_focus_eye_heading_distance_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Dirty-latch helper over the embedded controller base. The function stores the caller boolean into byte `[this+0x64]`; when the boolean is zero it also snapshots the current heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the cached companion band `[this+0x44/+0x48/+0x38/+0x3c/+0x40/+0x4c]`. Current grounded caller is `0x0052c2ef`, so this is the safest current read for the primary dirty-latch and cached focus-eye-orientation snapshot helper rather than a generic flag setter.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052ce20,54,embedded_view_controller_set_dirty_latch_0x65_and_optionally_snapshot_focus_heading_distance_band_0x72_0x86,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Secondary dirty-latch helper over the same controller base. The function stores the caller boolean into byte `[this+0x65]`; when that boolean is zero it snapshots heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the secondary companion band `[this+0x72/+0x76/+0x7a/+0x7e/+0x82/+0x86]`. Current grounded caller is the later owner branch `0x0052cc5d`, so this is the safest current read for the secondary dirty-latch and cached snapshot helper rather than a generic mode toggle.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052ce60,5,embedded_view_controller_raise_dirty_latch_0x64,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny leaf over the embedded controller base that only sets dirty byte `[this+0x64] = 1`. Current evidence grounds it as a direct dirty-latch raiser and does not yet justify a broader semantic name.","objdump + local disassembly + controller-base correlation" +0x0052ce70,43,embedded_view_controller_refresh_shell_presenter_scalar_0x6a_and_consume_dirty_latch_0x64,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small shell-state synchronization helper over the same controller base. The function compares cached scalar `[this+0x6a]` against current shell presenter dword `[0x006d4024+0x114222]`, raises dirty byte `[this+0x64]` and stores the new shell scalar when they differ, then returns the prior dirty state and clears `[this+0x64]` back to zero. Current grounded caller is `0x0052c29c`, so this is the safest current read for the shell-scalar refresh plus dirty-latch consume helper rather than a generic poll routine.","objdump + caller inspection + local disassembly + controller-base correlation + shell-scalar correlation" +0x0052cea0,19,embedded_view_controller_copy_heading_pitch_pair_to_two_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny heading/pitch export helper over the embedded controller base. The function copies lanes `[this+0x10/+0x14]` into two caller out-pointers. Current grounded caller is the later support branch `0x00566700`, so this is the safest current read for the heading-pitch pair copy helper rather than a broader serializer fragment.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052cec0,49,embedded_view_controller_sample_owner_height_at_current_eye_xz,shell,thiscall,inferred,objdump + local disassembly,1,"Small owner-height query helper beneath the same controller base. The function scales current eye X/Z lanes `[this+0x1c/+0x24]` through the recurring world-unit constants, then forwards the resulting pair into owner handle `[this+0x6e]` through `0x00534490`. Current evidence grounds it as the direct sampled-height query at the controller's current eye X/Z position.","objdump + local disassembly + controller-base correlation + sampled-height correlation" +0x0052cf00,436,embedded_view_controller_query_owner_height_peak_over_clamped_xy_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Broader owner-height extent query over the embedded controller base. The helper clamps the caller-supplied X and Y extent floats against lower bound `2.0` and against owner-derived width and height limits from `0x00533970/0x00533980`, samples an initial owner height through `0x00534490`, and then walks a rectangular neighborhood in repeated world-unit steps to keep the highest sampled height, returning that peak float. Current grounded callers are the current-eye wrapper `0x0052d0dc`, the world-view clamp owner `0x0045211f`, and the later support branch `0x0053037f`, so this is the safest current read for querying the peak sampled owner height across one clamped XY extent pair rather than a generic math loop.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation" +0x0052d0c0,33,embedded_view_controller_query_owner_height_peak_over_current_eye_xz_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Current-eye wrapper over `0x0052cf00` in the embedded controller base. The helper scales current eye X/Z lanes `[this+0x1c/+0x24]` into owner-space extents and forwards them into the broader peak-height query `0x0052cf00`. Current grounded callers are the world-view clamp owners `0x00439942` and `0x0043ceec`, so this is the safest current read for the current-eye peak-height wrapper rather than a separate terrain query family.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation" +0x0052d0f0,64,embedded_view_controller_query_normalized_scalar_band_contains_xy_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small range predicate over normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]` in the embedded controller base. The helper returns `1` only when the caller-supplied XY pair lies inside that stored scalar rectangle and `0` otherwise. Current grounded callers are the world-side branch `0x0045211f` and the later support branch `0x0053037f`, so this is the safest current read for the normalized-band containment predicate rather than a generic compare helper.","objdump + caller inspection + local disassembly + controller-base correlation + normalized-rect correlation" +0x0052d140,29,embedded_view_controller_store_four_blend_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter over the embedded world-view controller base. The helper copies four caller-supplied dwords into scalar lanes `[this+0x50/+0x54/+0x58/+0x5c]` unchanged. Current grounded callers are the mode-`0x19` variant seed owners `0x0043a0a0`, `0x0043ace3`, the setup-side world-view branches `0x00459139`, `0x00459982`, and the later world-side owner `0x005208ad`, so this is the safest current read for the four-scalar controller-blend setter rather than a higher-level mode owner.","objdump + caller inspection + local disassembly + controller-band correlation" +0x0052d180,91,embedded_view_controller_store_focus_triplet_and_mark_dirty_if_changed,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core focus-triplet setter beneath the embedded world-view controller base. The helper compares the incoming focus XYZ against the current stored triplet `[this+0x04/+0x08/+0x0c]`; when any component moves beyond the small epsilon at `0x005dd1c0` it sets dirty byte `[this+0x64] = 1`. It then stores the new triplet into `[+0x04/+0x08/+0x0c]`. Current grounded callers are the shell-input controller path `0x0043a1c3`, the transient-offset service `0x0043a54b`, the local clamp helper `0x00439820`, setup-side world-view branches `0x004592b8/0x00459b61`, and the runtime-object support strip `0x0052d440/0x0052bf65`, so this is the safest current read for the focus-triplet setter plus dirty-latch update rather than a generic vec3 copy.","objdump + caller inspection + local disassembly + controller-base correlation + dirty-latch correlation" +0x0052d1e0,67,embedded_view_controller_store_eye_triplet_and_refresh_vertical_delta,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Eye-triplet setter beneath the same embedded controller base. The helper stores the caller eye XYZ into `[this+0x1c/+0x20/+0x24]`; when owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the new X/Z pair and writes the resulting vertical delta `eye_y - sampled_height` into `[this+0x66]`, otherwise it copies the eye Y lane directly into `[this+0x66]`. Current grounded callers are the local clearance-ring clamp `0x00439820`, the setup-side controller owners `0x00459139/0x004592b8/0x00459afe`, and the helper itself's paired rebuild path `0x0052d440`, so this is the safest current read for storing the eye triplet and refreshing the sampled vertical delta rather than a generic world-position setter.","objdump + caller inspection + local disassembly + controller-base correlation + vertical-delta correlation" +0x0052d230,115,embedded_view_controller_query_focus_to_eye_distance_heading_and_pitch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pure query helper over the same controller base. Starting from the current focus triplet `[this+0x04/+0x08/+0x0c]` and eye triplet `[this+0x1c/+0x20/+0x24]`, the function can write the straight-line distance, one heading-like angle, and one pitch-like angle into up to three caller out-pointers. Current grounded caller is the world-side wrapper `0x0052fa59`, which consumes these as a bundled camera-state query, so this is the safest current read for the focus-to-eye distance and angle extractor rather than a standalone math primitive.","objdump + caller inspection + local disassembly + controller-base correlation + polar-query correlation" +0x0052d2b0,178,embedded_view_controller_serialize_focus_eye_and_orientation_triplets,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared serializer for the embedded controller base. The helper writes the current focus triplet `[this+0x04/+0x08/+0x0c]`, distance or view-height lane `[this+0x18]`, heading and pitch lanes `[this+0x10/+0x14]`, and eye triplet `[this+0x1c/+0x20/+0x24]` into the caller stream through repeated `0x00531030` writes, followed by one fixed zeroed `0x14`-byte trailer. Current grounded caller is `world_view_store_camera_view_slot_snapshot` `0x00439ac0`, so this is the safest current read for the controller-base snapshot serializer rather than a generic stream writer.","objdump + caller inspection + local disassembly + camera-view correlation + controller-base correlation" +0x0052d3e0,21,embedded_view_controller_clear_presenter_owner_slot_if_self,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny presenter cleanup leaf beneath the embedded controller base. When the live shell presenter exists and its owner slot `[0x006d4024+0x28]` still points at `this`, the helper clears that slot to null. Current grounded callers are the controller release owners `0x0043a58d` and `0x0043ac5c`, so this is the safest current read for the conditional presenter-owner clear helper.","objdump + caller inspection + local disassembly + presenter-owner correlation" +0x0052d400,69,embedded_view_controller_rebuild_focus_triplet_from_eye_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Inverse rebuild helper for the same embedded controller base. Starting from the current eye triplet `[this+0x1c/+0x20/+0x24]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance or view-height lane `[this+0x18]`, the function reconstructs the implied focus triplet on the stack and then stores that triplet through `0x0052d180`. Current grounded caller is the world-view camera-restore branch `0x0043c960`, which adjusts heading before re-entering this helper, so this is the safest current read for rebuilding focus from eye-orientation-distance rather than another trig primitive.","objdump + caller inspection + local disassembly + controller-base correlation + focus-triplet correlation" +0x0052d450,117,embedded_view_controller_rebuild_eye_triplet_from_focus_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core rebuild helper for the embedded controller base. Using the stored focus triplet `[this+0x04/+0x08/+0x0c]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance lane `[this+0x18]`, the function recomputes the eye triplet into `[this+0x1c/+0x20/+0x24]` by applying the usual trig decomposition. When owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the rebuilt X/Z pair and refreshes vertical delta `[this+0x66]`; otherwise it copies the rebuilt eye Y lane there directly. Current grounded callers are the controller reset or clamp helpers `0x0052d5bf`, `0x0052d646`, and the world-view side branch `0x0043e4ce`, so this is the safest current read for rebuilding the eye triplet from focus, orientation, and distance rather than a generic trig helper.","objdump + caller inspection + local disassembly + controller-base correlation + eye-triplet correlation" +0x0052d4d0,143,embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small display-rect materializer beneath the embedded world-view controller base. The helper samples the active shell display width and height pair from `[0x006d4024+0x34 + [0x006d4024+0x11421e]*0x15]`, multiplies those two display metrics by the stored normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]`, rounds the four products through `0x005a10d0`, and writes the resulting integer rectangle corners through the caller out-pointers. Current grounded caller is the layout-state bridge `0x005482e0`, so this is the safest current read for materializing one active-display rect from the controller's normalized scalar band rather than a generic scaling helper.","objdump + caller inspection + local disassembly + controller-base correlation + display-rect correlation" +0x0052d570,27,embedded_view_controller_rebind_base_vtable_and_clear_presenter_owner_slot,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny base-reset leaf for the embedded controller object. The helper restores the base vtable root `0x005dd1c8` at `[this]` and clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`. Current grounded callers are the world-view release path `0x0043a595`, the setup-side teardown path `0x00458258`, the world-side cleanup branches `0x00520d43` and `0x0052bfd3`, so this is the safest current read for the base-vtable rebind and presenter-owner clear leaf.","objdump + caller inspection + local disassembly + controller-base correlation" +0x0052d5a0,144,embedded_view_controller_reset_scalar_bands_defaults_and_dirty_latches,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader initializer for the embedded controller base. The helper clears owner handle `[this+0x6e]`, sampled vertical delta `[+0x66]`, heading `[+0x10]`, several transient scalar lanes `[+0x44/+0x48/+0x60]`, focus and eye triplets `[+0x04..+0x0c]` and `[+0x38..+0x40]`, re-enters `0x0052d450`, seeds default scalar lanes such as `[+0x14]=0.2`, `[+0x18]=100.0`, `[+0x28]=100`, `[+0x30/+0x58/+0x5c]=1.0`, `[+0x4c]=100.0`, dirty byte `[+0x64]=1`, and sentinel `[+0x6a]=-1`, then copies the rebuilt heading or pitch defaults into `[+0x72/+0x76]` and `[+0x86]`. Current grounded callers are the world-view reset owner `0x0043a5a3`, the local constructor `0x0052d6d9`, and the later rebuild paths `0x0052d6d9/0x0052d869`, so this is the safest current read for the embedded controller-base reset and default seeding owner rather than a generic constructor stub.","objdump + caller inspection + local disassembly + controller-base correlation + reset-owner correlation" +0x0052d640,131,embedded_view_controller_clamp_distance_against_sampled_eye_height_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Distance-clamp helper for the embedded controller base. The function first rebuilds the current eye triplet through `0x0052d450`, compares owner-derived metric `vtable[+0x0c]` against eye height `[this+0x20]`, and when the current distance or view-height lane `[this+0x18]` is too large it computes one reduced value from the current height gap, pitch sine, and the sampled vertical offset, stores the clamped result back into `[this+0x18]`, and rebuilds the eye triplet again through `0x0052d450`. Current grounded callers are the world-view heading and zoom-step paths `0x0043cb16/0x0043cc16`, the controller seed path `0x0043ce3a`, the motion wrapper `0x0043d09f`, and the local constructor `0x0052d744`, so this is the safest current read for the distance clamp and eye-triplet rebuild helper rather than a generic projection recompute.","objdump + caller inspection + local disassembly + controller-base correlation + distance-clamp correlation" +0x0052d6f0,90,embedded_view_controller_seed_focus_distance_owner_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor-side seed helper for the embedded controller base. The function stores one caller-supplied owner handle into `[this+0x6e]`, seeds the focus triplet into `[this+0x04/+0x08/+0x0c]`, seeds distance or view-height lane `[this+0x18]` plus its copy `[this+0x4c]`, mirrors shell presenter scalar `[0x006d4024+0x114222]` into `[this+0x6a]`, derives one bucket-like value from `0x51f070(1)` into `[this+0x28]`, and then tail-calls `0x0052d640` to rebuild the eye triplet and apply any needed clamp. Current grounded callers are the world-view owner `0x0043ce0e` and the stream-load branches `0x0052d7da/0x0052d889`, so this is the safest current read for the seeded controller-base setup helper rather than a generic stream-load leaf.","objdump + caller inspection + local disassembly + controller-base correlation + seed-owner correlation" +0x0052d750,260,embedded_view_controller_load_focus_eye_and_orientation_snapshot_from_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load companion to the camera-view snapshot serializer `0x0052d2b0`. The helper first clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`, then reads the stored focus triplet `[+0x04/+0x08/+0x0c]` and distance lane `[+0x18]` through repeated `0x00531150` calls, resolves one owner handle from that focus or distance tuple through shell presenter helper `0x0051f090`, and re-enters `0x0052d6f0` to seed the controller base. After that it loads heading and pitch lanes `[+0x10/+0x14]`, eye triplet `[+0x1c/+0x20/+0x24]`, and consumes the trailing zeroed `0x14`-byte trailer. Current grounded caller is the world-view stream-load owner `0x0043ac30`, so this is the safest current read for loading one embedded controller snapshot from a stream rather than a generic byte-reader block.","objdump + caller inspection + local disassembly + stream-load correlation + camera-view correlation + controller-base correlation" +0x0052d860,50,embedded_view_controller_construct_reset_and_seed_from_focus_distance_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor wrapper for the same embedded controller base. The helper rebinds base vtable `0x005dd1c8`, re-enters `0x0052d5a0` to reset and seed defaults, and then forwards one caller-supplied owner handle, focus triplet, and distance lane into `0x0052d6f0`. Current grounded callers are the placed-structure and world-side builders `0x004581ff` and `0x0052087e`, so this is the safest current read for the reset-plus-seed constructor wrapper rather than another raw allocator tail.","objdump + caller inspection + local disassembly + controller-base correlation + constructor-wrapper correlation" +0x0052d8a0,170,runtime_object_register_relative_child_in_owned_list_field_0x75,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x75]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, optionally rewrites the incoming child object's anchor triplet `[child+0x1e2/+0x1e6/+0x1ea]` into coordinates relative either to current group-anchor `[this+0x14]` or to this object's own anchor when state bit `0x10` is still clear, sets bit `0x10` in the child state byte `[child+0x20]`, and then pushes the child through `0x00556e10`. Current grounded callers include the placed-structure specialization builders `0x0045b6f0`, `0x0045b760`, `0x0045c310`, the vehicle-side branches `0x00485933..0x00485ddb`, and the effect-side builders `0x0045b96b`, `0x0045c39c`, and `0x0045da83..0x0045e305`, so this is the safest current read for registering one relative child object in owned list `[this+0x75]` rather than a subtype-specific builder.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + relative-anchor correlation" +0x0052d950,71,runtime_object_register_record_in_owned_list_field_0x79_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the specialization payload publishers `0x00474f3e`, `0x00485f30`, and `0x00486029`, so this is the safest current read for registering one record in owned list `[this+0x79]` with a copied group anchor rather than a bare list append.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation" +0x0052d9a0,79,runtime_object_register_record_in_owned_list_field_0x7d_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling owned-list registration helper over list root `[this+0x7d]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the placed-structure specialization publishers `0x00456ad4`, `0x00456b80`, `0x00456c5a`, `0x00457047`, `0x0045b141`, `0x0045b14f`, `0x0045e305`, and the vehicle-side helpers `0x0048597a`, so this is the safest current read for registering one record in owned list `[this+0x7d]` with a copied group anchor rather than a subtype-specific payload constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation" +0x0052da70,32,runtime_object_refresh_dependent_handle_0x0c_if_flag_0x40_and_owner_live,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small dependent-handle refresh helper beneath the broader `0x23a` runtime-object family. When owner pointer `[this+0x04]` is live and state byte `[this+0x20]` still carries bit `0x40`, the helper clears that bit, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded callers are the nearby world-side support strips `0x00421415` and `0x00461300`, so this is the safest current read for the `0x40`-bit dependent-handle refresh leaf rather than a generic flag clear.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + dependent-handle correlation" +0x0052daa0,67,runtime_object_select_grouped_subrecord_by_clamped_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared grouped-subrecord selector over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live, the helper clamps the caller-requested index against the current group count from the selected `0x45`-byte group header `[group+0x14]`, stores the resulting cursor into `[this+0x21]`, updates active subrecord pointer `[this+0x18]` to the corresponding `0x45`-byte payload row under `[group+0x0c]`, and returns whether the requested index was already in range. Current grounded callers are the world-side wrappers `0x0042aba0`, `0x00455c73`, `0x00528721`, and `0x0052941f`, so this is the safest current read for the explicit grouped-subrecord select helper rather than a generic array index setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation" +0x0052db10,224,runtime_object_store_scalar_0x69_mark_transform_dirty_and_materialize_group_packet_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader grouped-subrecord materialization helper beneath the same `0x23a` runtime-object family. The function stores one caller-supplied scalar into `[this+0x69]`, sets dirty bit `0x02` in state byte `[this+0x20]`, raises byte `[this+0x8d]`, resolves the currently selected group header from `[this+0x14]` and group index `[this+0x3a]`, and then walks every `0x45`-byte row in that group. For each row it caches the active row pointer in globals `0x00cc3b58/0x00cc3b6c`, lazily allocates row-local payload storage when `[row+0x35]` is still null, copies the row's packed source span there, zero-fills the trailing companion area, and advances to the next row. Current grounded callers are the vehicle-side visual builders `0x00485a1d` and `0x00485a68` plus the shell-side presentation branch `0x005287af`, so this is the safest current read for storing scalar lane `[+0x69]` and materializing the current group's packet rows rather than a pure allocator helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + packet-row correlation" +0x0052dc00,240,runtime_object_bucket_materialized_group_packet_rows_by_four_float_thresholds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Companion grouped-row helper immediately above `0x0052db10` in the same `0x23a` runtime-object family. When byte latch `[this+0x8d]` is live and local bucket byte `[this+0x5b]` is still below `2`, the function increments that bucket, stores one caller float into threshold lane `[this+0x69 + bucket*4]`, resolves the currently selected `0x45`-byte group, and then walks every materialized row payload at `[row+0x35]`. For each copied entry it compares the entry's two stored floats against the four caller-supplied threshold bounds and, on success, writes the current bucket byte into the compact trailing byte band of the copied row payload. Current grounded callers are the vehicle-side visual builders `0x00485a8c`, `0x00485ab0`, `0x00485ad4`, and `0x00485af8`, so this is the safest current read for bucketing the materialized group packet rows by threshold windows rather than a generic float clamp.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + threshold-bucket correlation" 0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin 0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" 0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly" @@ -1849,12 +1982,82 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x0053a440,14,shell_set_geographic_label_item_alpha,bootstrap,thiscall,inferred,ghidra-headless,4,Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission.,ghidra + rizin + llvm-objdump 0x0053a960,723,shell_emit_geographic_label_text_span,bootstrap,thiscall,inferred,ghidra-headless,4,Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets.,ghidra + rizin + llvm-objdump 0x00543f10,853,layout_state_bind_presentation_asset_bundle,bootstrap,thiscall,inferred,ghidra-headless,4,Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543].,ghidra + rizin +0x00544290,195,layout_state_publish_local_descriptor_0x352f_from_integer_span_pair,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local descriptor-publish helper in the layout-state family. The helper derives one normalized span scalar from the caller's two integer inputs, combines that value with local scalar lanes `[this+0x25eb/+0x25ef/+0x25f3]`, builds one `0x100`-byte descriptor rooted at `[this+0x352f]` through `0x0056e41a`, stores one derived shell-scaled scalar into `[this+0x36f9]`, and publishes that descriptor through node slot `+0x94` on the bound presentation node `[this+0x25df]` for selector `3`. Current grounded callers are the neighboring rect and span owners `0x00548120`, `0x00548180`, and `0x005482e0`, so this is the safest current read for publishing local descriptor `[+0x352f]` from an integer span pair rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation" +0x00544360,208,layout_state_reset_local_descriptor_0x34ef_to_identity_and_publish,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Identity-reset companion to `0x00544290` in the same layout-state family. The helper zeroes the local `0x100`-byte descriptor block rooted at `[this+0x34ef]`, seeds the four diagonal scalar lanes `[+0x34ef/+0x3503/+0x3517/+0x352b]` to `1.0f`, and publishes that block through node slot `+0x94` on the bound presentation node `[this+0x25df]`. Current grounded callers include the neighboring rect and span owners `0x00548120` and a wider set of shell presentation rebuild paths such as `0x00524d05`, `0x00528805`, `0x00529dab`, and `0x0054d93a`, so this is the safest current read for resetting local descriptor `[+0x34ef]` to identity and publishing it rather than a standalone memset wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation" +0x00544cb0,64,layout_state_publish_property_pair_0x0d_0x0e_for_selector3,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small property-pair publisher in the same layout-state family. The helper forwards one caller-supplied byte value into bound-node property groups `0x0d` and `0x0e`, both for selector `3`, through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural property-pair publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00544cf0,48,layout_state_clear_property_pair_0x0d_0x0e_for_selector2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny clear sibling to `0x00544cb0` in the layout-state family. The helper writes `0` into bound-node property groups `0x0d` and `0x0e` for selector `2` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural clear helper description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00544d20,96,layout_state_set_property_pair_0x0d_0x0e_for_selector1_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small arming helper over the same layout-state property strip. The helper first clears bound-node property groups `0x0d` and `0x0e` for selector `1`, then republishes both groups with literal value `1` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural selector-`1` property-pair arm description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00544d80,32,layout_state_publish_property_0x3c_packed_dword,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny packed-property setter over the bound presentation node `[this+0x25df]`. The helper forwards one caller-supplied dword into property `0x3c` through node vtable slot `+0xc8`. Current evidence only supports this structural packed-dword publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00544da0,48,layout_state_publish_property_0x3c_with_cached_rgb_and_alpha_byte,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small color-pack sibling to `0x00544d80` in the layout-state family. The helper reads cached RGB lanes from `[this+0x25a3]`, masks them down to `0x00ffffff`, combines that value with one caller-supplied alpha byte in the high lane, and publishes the packed result into property `0x3c` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-RGB-plus-alpha publisher description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00544dd0,32,layout_state_publish_property_group_0x0b_for_selector_with_value,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny grouped-property publisher over the same bound node. The helper forwards its two caller-supplied dwords as selector and value into property group `0x0b` through node vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural grouped-property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00544df0,320,layout_state_apply_capability_and_mode_gated_property_strip_0x1d_0x13_0x14_0x12,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader property-strip owner in the layout-state family. The helper first checks shell capability byte `[0x006d4024+0x11422e]` and publishes property `0x1d` on the bound node `[this+0x25df]`, then conditionally seeds fixed property pair `0x13 = 5` and `0x14 = 6` when state byte `[this+0x83c+0x21]` is live. After that it derives one per-slot mode value from state dword `[this+0x83c+0x29]` and local slot count `[this+0x258f]`, publishes property `0x13` across every active slot, and finally publishes property `0x12` across the same slot span with the derived mode selector. Current grounded caller is the neighboring layout-state owner branch `0x0052bc18`, so this is the safest current read for the capability and mode-gated `0x1d/0x13/0x14/0x12` property-strip owner rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation" +0x00544f30,208,layout_state_apply_slot_range_property_strip_0x15_0x1a_0x11_0x10,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Broader slot-range property-strip owner adjacent to `0x00544df0` in the same layout-state family. The helper derives one active slot range from the caller's signed start byte and the current slot count `[this+0x258f]`, optionally clears property `0x15` down to zero and raises property `0x1a = 1` when the caller's boolean flag is set, then walks the active slot range publishing property groups `0x11` and `0x10` with one derived mode value. That derived mode depends on both the caller flag and state byte `[this+0x83c+0x1e]`. Current evidence only supports this structural slot-range property-strip description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00545000,32,layout_state_clear_property_0x89,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the layout-state family. The helper writes literal `0` into property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00545020,32,layout_state_publish_property_0x89_from_state_byte_0x22,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small sibling publisher to `0x00545000`. The helper reads byte `[this+0x83c+0x22]` and forwards that value into bound-node property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-byte property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00545040,64,layout_state_publish_property_0x89_from_state_byte_0x22_and_notify_slot_0,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Notify-style sibling over the same cached state byte `[this+0x83c+0x22]`. The helper first publishes that byte into property `0x89` through node slot `+0xc8`, then forwards the same value into node slot `+0xb8` with selector `0`. Current evidence only supports this structural publish-plus-notify description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00545080,32,layout_state_clear_property_0x0e,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the same layout-state strip. The helper writes `0` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x005450a0,32,layout_state_set_property_0x0e_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny sibling setter to `0x00545080`. The helper writes literal `1` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property-set description.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x005450c0,32,layout_state_copy_cached_local_block_0x24f0_to_out_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small cached-block exporter in the layout-state family. The helper copies the fixed `0x33`-byte local block rooted at `[this+0x24f0]` into one caller-supplied output buffer through a straight `rep movs` copy. Current evidence only supports this structural cached-block export description.","objdump + local disassembly + layout-state correlation + cached-block correlation" +0x005450e0,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_with_mid_clamp,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Three-outparam local scalar exporter in the layout-state family. The helper reads float lanes `[this+0x2517]`, `[this+0x251b]`, and `[this+0x251f]`, negates all three, scales the third lane through the same constant used by neighboring layout-state math, and writes them to three separate outparams. The middle exported scalar is then clamped up to `0.5f` when the negated source would fall below that floor. Current evidence only supports this structural negated-triplet export description.","objdump + local disassembly + layout-state correlation + local-scalar correlation" +0x00545130,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_to_vec3_with_mid_clamp,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Packed-output sibling to `0x005450e0` in the same layout-state family. The helper writes the same negated local scalar triplet derived from `[this+0x2517/+0x251b/+0x251f]` into one caller-supplied contiguous three-float buffer, again scaling the third lane and clamping the middle lane up to `0.5f`. Current grounded caller is the neighboring layout-state owner branch `0x0052bbb7`, so this is the safest current read for the packed vec3 export sibling rather than another generic copy helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-scalar correlation" +0x00545180,640,layout_state_build_default_preset_table_0x840_from_angular_sweep,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Default preset-table builder in the same layout-state family. The helper walks `0x90` fixed records of size `0x33` rooted at `[this+0x840]`, deriving one normalized vector pair, several companion float lanes, and three byte-scaled threshold lanes from an angular sweep that starts at `-0xa8c0` and advances by `0x258` per row. Current grounded caller is the default-cache bootstrap path `0x0054be29`, which only invokes this builder when global dirty byte `0x00ccd820` is still clear; otherwise that owner copies preset rows from global cache `0x00ccbb68`. So the safest current read is a generated default preset-table builder rather than a generic trig helper.","objdump + caller inspection + local disassembly + layout-state correlation + preset-table correlation + default-cache correlation" +0x00545400,32,layout_state_store_preset_row_float_0x23_in_table_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row setter in the layout-state family. The helper stores one caller-supplied float into offset `0x23` of the selected `0x33`-byte row under preset table `[this+0x840]`. Current evidence only supports this structural preset-row float-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation" +0x00545420,32,layout_state_store_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array setter adjacent to the preset-table strip. The helper stores two caller-supplied floats into indexed arrays `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]`. Current evidence only supports this structural paired-array store description.","objdump + local disassembly + layout-state correlation + paired-array correlation" +0x00545440,48,layout_state_query_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array query sibling to `0x00545420`. The helper conditionally writes indexed floats from `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]` into up to two caller-supplied outparams. Current evidence only supports this structural paired-array query description.","objdump + local disassembly + layout-state correlation + paired-array correlation" +0x00545470,48,layout_state_store_two_floats_into_preset_row_column_pair,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small indexed preset-row setter adjacent to `0x00545400`. The helper resolves one selected `0x33`-byte row under `[this+0x840]`, then stores two caller-supplied floats into the first and second column bands using the caller's subindex as a `4`-byte lane selector. Current evidence only supports this structural two-float row-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation" +0x005454a0,32,layout_state_query_float_from_preset_row_column_band_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row query helper over the same table `[this+0x840]`. The helper resolves one selected `0x33`-byte row and returns the float stored in the first column band at the requested `4`-byte subindex. Current evidence only supports this structural preset-row float-query description.","objdump + local disassembly + layout-state correlation + preset-table correlation" +0x005457c0,224,layout_state_publish_property_0x8b_with_stack_descriptor_and_optional_capability_scaled_scalar,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stack-descriptor publisher in the layout-state family. The helper zeroes one local descriptor block, optionally seeds one capability-gated scaled scalar from `[this+0x25fb] * [this+0x24f4]` when both the caller flag and shell capability byte `[0x006d4024+0x11422e]` are live, pushes packed color `0xffafafaf` into property `0x8b` on the bound node `[this+0x25df]`, and then forwards the prepared stack descriptor through node slot `+0xa8`. Current grounded callers include nearby layout-state refresh owners `0x00524cd3`, `0x00524e28`, `0x0052a641`, `0x0052ac7a`, `0x0052ae3d`, `0x0052b42f`, `0x0052bbc1`, `0x0054d944`, and later support branches `0x00564c38`, so the safest current read is a property-`0x8b` stack-descriptor publish helper rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + stack-descriptor correlation" +0x005458a0,48,layout_state_borrow_current_segment_record_window_handle_0x265b_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over current segment-record handle `[this+0x265b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2800`-byte window through handle vtable slot `+0x2c`, and returns the borrowed scratch pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation" +0x005458d0,32,layout_state_release_current_segment_record_window_handle_0x265b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x005458a0`. The helper decrements global counter `0x00ccd824` and forwards current segment-record handle `[this+0x265b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation" +0x005459f0,48,layout_state_release_segment_record_window_handle_0x2643_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the `0x2643` segment-record window readers. When gate byte `[this+0x254e]` is live, the helper clears that gate, decrements global counter `0x00ccd824`, and forwards handle `[this+0x2643]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation" +0x00545a20,32,layout_state_release_handle_0x264f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny release-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545a40,48,layout_state_borrow_handle_0x264f_window_0x7800_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x7800`-byte window through handle vtable slot `+0x2c`, writes the borrowed pointer to local scratch `[this+0x2657]`, and returns that pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545a70,48,layout_state_borrow_handle_0x2653_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x2653]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545aa0,32,layout_state_release_handle_0x2653_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545a70`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x2653]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545ac0,48,layout_state_borrow_handle_0x264b_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545af0,32,layout_state_release_handle_0x264b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545ac0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x264b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545b90,32,layout_state_release_vertex24_window_handle_0x2647_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the vertex24 window readers over handle `[this+0x2647]`. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + vertex24 correlation" +0x00545bb0,48,layout_state_borrow_handle_0x263f_window_0x2ee00_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x263f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2ee00`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545be0,32,layout_state_release_handle_0x263f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545bb0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x263f]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation" +0x00545ca0,176,layout_state_clear_first_optional_binding_publish_property_0x9e_and_commit_span_type1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small commit-side owner in the layout-state family. When gate byte `[this+0x254d]` is still clear and slot count `[this+0x258f]` is positive, the helper clears the first optional slot binding `[this+0x2593][0]` through node slot `+0xf4` when that binding is nonnull, then publishes property `0x9e = 1.0f` on the bound node `[this+0x25df]`, accumulates one derived span count into `[this+0x3711]`, and commits the caller-supplied range through node slot `+0x118` with primitive-type argument `1`. Current evidence only supports this structural clear-plus-commit description.","objdump + local disassembly + layout-state correlation + span-commit correlation" +0x00545d50,16,layout_state_query_accumulated_span_counter_0x3711,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny accessor in the same layout-state family. The helper returns accumulated span counter `[this+0x3711]` unchanged. Current evidence only supports this structural counter-query description.","objdump + local disassembly + layout-state correlation + counter correlation" +0x00545d60,80,layout_state_reset_counters_0x370d_0x3711_and_optionally_reseed_bound_node_mode2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Reset-side helper adjacent to the span-commit strip. The function zeroes local counters `[this+0x370d]` and `[this+0x3711]`, optionally dispatches the bound node `[this+0x25df]` through vtable slot `+0x90` with selector `2` and one `1.0f` scalar when the caller requests it, and then unconditionally forwards the node through slot `+0x88`. Current evidence only supports this structural reset-and-optional-reseed description.","objdump + local disassembly + layout-state correlation + counter correlation" +0x00545db0,64,layout_state_finalize_bound_node_and_optionally_clear_zero_mode_through_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small finalize-side helper over the bound node `[this+0x25df]`. The helper first dispatches node slot `+0x8c`, then, when the caller's boolean is still zero, clears one four-zero argument lane through node slot `+0x3c`. Current evidence only supports this structural finalize-and-optional-clear description.","objdump + local disassembly + layout-state correlation + bound-node correlation" +0x00545e00,48,layout_state_classify_bound_node_signature_0x88760868_0x88760869_or_other,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny classifier over the bound node `[this+0x25df]`. The helper queries node slot `+0x0c` and returns `1` for signature `0x88760868`, `2` for `0x88760869`, `0` for a null signature, and `3` for any other nonzero result. Current evidence only supports this structural node-signature classifier description.","objdump + local disassembly + layout-state correlation + node-signature correlation" 0x00554830,142,attachment_object_init_named_asset,bootstrap,thiscall,inferred,ghidra-headless,3,Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0.,ghidra + rizin + llvm-objdump 0x00531640,129,shell_audio_service_query_selected_backend_index_by_name,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Queries the currently selected audio backend index from the shell audio service. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper pulls the current backend-name stem through `0x569720` on service object `0x00ccb9fc`, iterates candidate names through `0x005314b0`, and returns the first matching backend index. Otherwise it falls back to `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use it to mirror the live backend selector into control `0x7551`.","objdump + settings-window caller correlation + backend-name-match correlation" 0x005316d0,47,shell_audio_service_query_backend_available_flag_by_index,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns one availability flag for the requested audio backend index. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper resolves the backend-name pointer through `0x005314b0(index)` and forwards it into `0x569730` on service object `0x00ccb9fc`; otherwise it returns `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use the returned flag to republish control `0x7550`.","objdump + settings-window caller correlation + backend-availability correlation" 0x00531e10,48,shell_audio_service_apply_indexed_feedback_event_if_ready,shell,thiscall,inferred,objdump + caller correlation + local disassembly,4,"Small shell-audio-service sink beneath the indexed feedback-nudge helper `0x0045ea20`. The helper only dispatches when service mode dword `[this+0x04]` equals `1`, override gate `0x00ccb9f4` is clear, and the service-side readiness scalar at `[0x00ccb9f8+0x20]` passes the local positive check; on the ready path it tail-jumps into `0x0056ad20` with the caller's table-driven event pair and scalar, otherwise it returns `0`. Current grounded direct caller is `shell_emit_indexed_audio_feedback_nudge_if_live` `0x0045ea20`, which keeps this safely on the shell-audio feedback side rather than the broader backend-selection family.","objdump + caller correlation + local disassembly + readiness-gate correlation" 0x0053ef60,4,graphics_backend_query_primary_status_dword_18,shell,thiscall,inferred,objdump + settings-window caller correlation,3,"Returns graphics-backend dword `[this+0x18]` unchanged. Current grounded callers are the `Graphics` page refresh and graphics-selector callback strip, which pair this value with `graphics_backend_query_both_status_slots_clear` `0x0053ef70` when deciding how controls `0x757c` and `0x759a` should be republished.","objdump + settings-window caller correlation" 0x0053ef70,23,graphics_backend_query_both_status_slots_clear,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns `1` only when both graphics-backend dword `[this+0x18]` and dword `[this+0x14]` are zero; otherwise returns `0`. Current grounded callers are the `Graphics` page refresh and the graphics-selector callback strip, which use this test as the fallback branch when republishing controls `0x757c` and `0x759a`.","objdump + settings-window caller correlation + status-slot correlation" +0x00540e30,283,surface_owner_base_init_and_register_on_global_list,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Base initializer for the `0xec`-byte RGBA surface-owner family. The helper copies one fixed owner label into `[this+0x13]`, seeds capability and mode bytes from the live shell presenter into `[this+0x96/+0x97]`, clears the cached byte-count and pointer bands `[this+0xc0..+0xe8]`, allocates two small companion helper objects through `0x0053b070 -> 0x00556d80`, clears the eight-entry row bands `[this+0x98..+0x9f]` and `[this+0xa0..+0xbc]`, resets selector dword `[this+0x07]`, and finally links the owner into the global intrusive list rooted at `0x00ccbb2c`, incrementing `0x00ccbb30`. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, so this is the safest current read for base-init plus global registration rather than a generic shell allocator.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation" +0x00540fc0,304,surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Two-part maintenance owner in the same surface-owner family. Its first half clears cached byte totals `[this+0xcc/+0xd0]` and then walks the eight row slots `[this+0xa0..+0xbc]`, accumulating active row byte sizes `[row+0x04]` into total bytes when backing pointer `[row+0x22]` is live and into selected bytes when companion byte `[this+0x98 + slot]` is set and selector dword `[this+0x07]` matches the shell mode token `[0x006d4024+0x114222]`. Its second half walks the same slots again and frees row buffers `[row+0x2a/+0x26/+0x2e]`, clears `[row+0x22]`, and resets owner selector `[this+0x07]`. Current grounded callers are the surface constructor `0x00543980` and the cached-surface commit helper `0x005438d0`, so this is the safest current read for the cached-byte refresh plus full row-buffer release owner rather than a narrow query helper.","objdump + caller inspection + local disassembly + surface-family correlation + byte-total correlation + row-release correlation" +0x00541160,88,surface_owner_query_dimension_cap_from_mode_and_quality_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small dimension-cap query in the same surface-owner family. When owner byte `[this+0x05]` is clear it returns the broad fallback cap `0x800`. Otherwise it derives a tighter power-of-two limit from the shell editor or capability gate `[0x006d4024+0x11422f]` and then clamps that base cap against quality-style selector dword `[this+0xd8]`, yielding at most `0x100`, `0x200`, or `0x400`. Current grounded caller is the type-`2` import branch at `0x00542e15`, so this is the safest current read for the shared surface-dimension cap helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + dimension-cap correlation" +0x005411c0,79,surface_owner_probe_named_file_for_type2_header_signature,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small file-header probe adjacent to the same import seam. The helper opens one caller-supplied path with mode `0x8000`, reads the leading `0x12` bytes, closes the file, and returns `1` only when the checked header byte stays clear and the small type byte at local offset `+0x06` equals `2`; otherwise it returns `0`. Current grounded caller is the shell-side path at `0x005039fb`, so this is the safest current read for probing a named file for the type-`2` header signature rather than a generic file-exists test.","objdump + caller inspection + local disassembly + surface-family correlation + file-header correlation" +0x00541210,709,surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Row-side repack owner beneath the same RGBA surface family. When shell capability byte `[0x006d4024+0x114255]` is live and editor-map gate `[0x006d4024+0x11422f]` is clear, the helper requires row backing buffer `[row+0x26]`, ensures one active output buffer at `[row+0x2a]`, seeds row state `[row+0x04/+0x10/+0x1c/+0x22]`, and then repacks the caller pixels into a 16-bit destination. The current split is structural but real: when owner byte `[this+0x96]` is nonzero it computes a palette-like packed color from accumulated channel maxima; otherwise it uses direct nibble-packed conversion from the source dwords. When owner byte `[this+0x97]` is clear it also frees the source backing pointer `[row+0x26]` on exit. Current grounded callers are `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish` `0x005438d0` and the broader row-type import body at `0x00541c30`, so this is the safest current read for the active 16-bit repack owner rather than a generic blit.","objdump + caller inspection + local disassembly + surface-family correlation + repack correlation + capability-gate correlation" +0x00541970,292,surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Shared query-or-materialize helper in the same `0xec`-byte surface-owner family. For non-type-`2` rows it optionally returns width and height from `[row+0x08/+0x0c]`, then returns active RGBA backing pointer `[row+0x26]` when already live. If that RGBA buffer is still null, the helper allocates `width * height * 4` bytes, expands the current 16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords, stores the result into `[row+0x26]`, and returns that pointer. Current grounded callers include the cached world-presentation strip `0x005323f0/0x00532460`, the staged overlay publisher `0x00534af0`, the secondary-overlay loaders `0x00535430/0x00538060`, and the save/setup preview seam below `0x00542550`, so this is the safest current read for querying or materializing the RGBA backing buffer from the active 16-bit row rather than a generic width or height helper.","objdump + caller inspection + local disassembly + surface-family correlation + RGBA-materialization correlation" +0x00541aa0,48,surface_owner_query_first_row_width_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny first-row width query in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns width dword `[row+0x08]`; otherwise it falls back to `1`. Current grounded callers include the world-presentation math strips at `0x0055238a/0x005523b6` and the later projection-side branch `0x0055f5d0`, so this is the safest current read for the first-row width-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + width-query correlation" +0x00541ad0,48,surface_owner_query_first_row_height_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Height-side sibling to `surface_owner_query_first_row_width_or_one` in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns height dword `[row+0x0c]`; otherwise it falls back to `1`. Current grounded callers include the same world-presentation and projection-side strips at `0x0055250e/0x0055253a` and `0x0055f5ed`, so this is the safest current read for the first-row height-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + height-query correlation" +0x00541bf0,32,surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small state-refresh helper in the same surface-owner family. The helper reads the live shell presenter through `0x0051f070`, copies presenter dword `[presenter+0x05]` into cached owner field `[this+0xd4]`, and returns bound handle `[this+0xc0]`. Current grounded caller is the layout-state binding strip at `0x00545566`, so this is the safest current read for refreshing cached shell scalar `0xd4` and returning handle `[+0xc0]` rather than a broader semantic owner.","objdump + caller inspection + local disassembly + surface-family correlation + cached-shell-scalar correlation" +0x00541c10,32,surface_owner_release_selector_handle_0x07_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny selector-handle release helper in the same surface-owner family. When owner field `[this+0x07]` is nonzero, the helper re-enters `0x00541780` on that handle and then clears `[this+0x07]` back to zero. Current grounded callers include the broader release body `0x00542c90`, the local maintenance strip at `0x0053293c`, and the cache-refresh owner around `0x00543521/0x00543593`, so this is the safest current read for releasing selector handle `+0x07` rather than a generic destructor fragment.","objdump + caller inspection + local disassembly + surface-family correlation + selector-handle correlation" +0x00541b10,132,surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Slot allocator in the `0xec`-byte RGBA surface-owner family. The helper scans the eight-entry row-pointer band `[this+0xa0 .. +0xbc]` for the first null slot, increments active-count byte `[this+0x04]`, marks companion byte `[this+0x98 + slot] = 1`, allocates one `0x32`-byte row, zeroes it, seeds row fields `[row+0x08]` and `[row+0x0c]` from the caller width and height, mirrors the third caller dword into `[row+0x14/+0x18]`, stores the row into `[this+0xa0 + slot*4]`, and returns the slot index or `-1` when no slot is free. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, which invokes it as `(..., width, height, 3)`, so this is the safest current read for allocating the first free surface-row slot rather than a generic small object allocator.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation" +0x00541ba0,66,surface_owner_release_row_slot_0xa0_by_index,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Release-side companion to `0x00541b10` in the same surface-owner family. When the caller-supplied slot index is in range and row pointer `[this+0xa0 + slot*4]` is live, the helper decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current evidence grounds it as the indexed row-slot releaser beneath the same temporary-surface and cached-surface owner family.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation" +0x00541c30,1024,surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`4` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the usual early fast path through `0x00541210`, the helper reads one tagged payload stream, validates the fixed tag sequence rooted at `0xbabe` and the following `0xbaba/0xbabb` alternatives, allocates temporary buffers for the recovered bands, and then reconstructs one RGBA destination buffer from those tagged payload pieces before storing it back into the active row. The current grounded split is structural but real: one branch routes the recovered tagged bands through `0x00553120`, another copies one direct recovered band, and the mismatch branch falls back to an all-`0xff` fill. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`4` family and then re-enters `0x00541210` to materialize the live 16-bit buffer. This is the safest current read for the tagged `0xbabe/0xbaba/0xbabb` payload importer rather than a generic stream helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-payload correlation" +0x00542030,905,surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`3` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the same early repack fast path through `0x00541210`, the helper resolves one headered payload through the local stream service, validates recovered width and height against the live shell caps, rejects unsupported header combinations, allocates a full RGBA destination plus one temporary `0x40000` staging buffer, and then decodes the payload into RGBA rows. The current grounded split is structural but real: it accepts direct `0x20`-byte-per-pixel and `0x18`-byte-per-pixel source bands, can reseed an auxiliary table lookup through `0x0053b7c0`, and treats one large-value branch as a staged scanline reader rather than a raw memcpy. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`3` family and re-enters `0x00541210` with row flag byte `[row+0x20]` selected from the dimension threshold branch. This is the safest current read for the headered RGB or paletted payload importer rather than another generic buffer copy.","objdump + caller inspection + local disassembly + surface-family correlation + headered-payload correlation" +0x005423d0,380,surface_row_materialize_dxt3_payload_into_active_16bit_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"DXT3 materializer beneath the same type-`2` row family. When the active output buffer `[row+0x2a]` is still null and compressed payload `[row+0x2e]` is live, the helper builds two temporary codec-side objects through `0x00570691`, forwards the row payload and format tag `0x33545844` (`DXT3`) into the adjacent decode path `0x0057025d`, runs the follow-on materialization step `0x005706f7`, and then allocates the live output buffer `[row+0x2a]`, copies the decoded bytes into it, seeds row state `[row+0x04/+0x10/+0x14/+0x1c/+0x22]`, and releases the temporary codec objects. Current grounded caller is the non-editor tail of `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, so this is the safest current read for materializing the compressed DXT3 row payload into the active output buffer rather than another generic codec wrapper.","objdump + caller inspection + local disassembly + surface-family correlation + DXT3-correlation + decode-materialization correlation" +0x00542550,786,surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Capability-gated row postprocess owner in the same surface family. When shell capability byte `[0x006d4024+0x11422d]` is live and owner byte `[this+0x95]` has not already latched, the helper walks the active row slots, skips type-`2` rows and rows whose processed byte `[row+0x21]` is already set, forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970`, marks the row processed, seeds row state `[row+0x1c] = 0x3c`, discards the previous live 16-bit buffer `[row+0x2a]`, allocates a replacement destination, and then rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA source. For rows whose pixel-size tag `[row+0x10]` equals `0x20`, it halves the stored byte count `[row+0x04]` after the rebuild. Current grounded caller is the world-presentation template seeder `0x005356e0`, which revisits the earlier overlay slot series and runs this helper after clearing byte `[slot+0x05]`, so this is the safest current read for the capability-gated postprocess over non-type-`2` rows rather than a generic buffer conversion.","objdump + caller inspection + local disassembly + surface-family correlation + processed-row correlation + neighbor-difference correlation" +0x00542870,69,surface_owner_release_all_row_slots_0xa0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Compact full-slot release helper in the same surface-owner family. The function walks all eight row slots `[this+0xa0..+0xbc]`, and for each live slot decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current grounded caller is the broader release owner `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90`, which uses this after unlinking the global owner entry, so this is the safest current read for releasing all row slots rather than a generic loop body.","objdump + caller inspection + local disassembly + surface-family correlation + full-slot-release correlation" +0x005428c0,607,surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader file-write owner in the same import/export surface seam. The helper allocates one alpha-sized plane and one `3 * width * height` RGB plane from the active row dimensions, splits current backing pixels `[row+0x26]` into those temporary buffers, seeds a stack image/codec object, and then writes several tagged records into the already-open stream passed by the caller. The current grounded split is structural: when the caller requests the transformed path it forwards the temporary planes through `0x00553000` before writing the tagged records `0xbaba`, `0xbabb`, and `0xbabe`; otherwise it writes the raw split buffers and the same trailing tag family directly. It frees the temporary planes before returning. Current grounded caller is `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`, which opens the destination path in `a+b` mode and forwards the resulting stream here, so this is the safest current read for encoding the active surface row and writing tagged records to the open stream rather than a generic image copy helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-record correlation + open-stream correlation" +0x00542b30,208,surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Direct file-write sibling to `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` in the same preview-surface seam. The helper opens one caller-supplied path in `wb` mode, builds a compact `0x12`-byte header on the stack with row type `2`, the first-row width and height, fixed pixel-size byte `0x20`, and one optional flag bit `0x20` when the second caller argument is nonzero, then optionally forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` and writes the first-row RGBA payload `[row+0x26]` plus the header to the open stream. Current grounded callers are the paired export-side branches at `0x00520cda`, `0x00520f61`, and `0x00534dd6`, each of which uses this as the direct-file alternative to `0x00542f50` before releasing the temporary surface owner through `0x00542c90 + 0x0053b080`, so this is the safest current read for writing the first row plus its `0x12`-byte header to a named file rather than a generic save helper.","objdump + caller inspection + local disassembly + surface-family correlation + direct-file-write correlation" +0x00542c10,114,shell_release_active_global_layout_cache_entries,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Global cache-release sweep in the shell layout-state family. The helper walks the linked list rooted at `0x00ccbb2c`, and for every active entry `[entry+0x07]` releases optional handles `[entry+0xc0]` and `[entry+0xc8]` through vtable slot `+0x08`, refreshes controller-side cached field `[0x006d4024+0x1136ad]` through `0x0051f990`, clears sibling bookkeeping dwords `[entry+0xcc/+0xd0/+0xd4]`, decrements active-count global `0x00ccbb34`, and resets `[entry+0x07]` back to `0`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd80` and `0x0055e060`, so this is the safest current read for releasing the active global layout-cache entries rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + global-cache correlation" +0x00542c90,177,surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Primary release body for the same global surface-owner family. The helper releases optional companion helpers `[this+0xdc]` and `[this+0xe4]` through `0x005571d0 + 0x0053b080`, clears sibling field `[this+0xe0]`, unlinks the owner from the intrusive global list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter through `0x005271a0` when owner byte `[this+0x93]` is set, re-enters `0x00541780` to drop any active selector-side handle, re-enters `surface_owner_release_all_row_slots_0xa0` `0x00542870`, and finally clears `[this+0x07]` plus `[this+0xc0]`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation slot-release strips `0x00532760/0x00532b30/0x00534f80`, and the shell overlay release path `0x0047b320`, so this is the safest current read for releasing helper objects, unlinking the global surface-owner entry, and dropping the row slots rather than a generic destructor stub.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation + row-slot-release correlation" +0x00542f50,95,surface_owner_open_named_resource_and_dispatch_row_type_import,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Named-resource import dispatcher in the same temporary-surface and cached-surface family used by the setup/save preview helpers. The function takes one caller path seed, opens or resolves the matching resource file through the neighboring file-open strip, forwards the result into `0x005428c0`, and then dispatches the imported row by embedded type dword `[row+0x18]`: current grounded branches are type `2 -> 0x00542d50`, type `3 -> 0x00542030`, and type `4 -> 0x00541c30`, with the fallback returning `2`. Current grounded caller is `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46` `0x00442740`, which uses the returned dword as payload field `[record+0x18]`, so this is the safest current read for the named-resource open-and-import dispatcher rather than a generic file helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation" +0x00542fb0,64,surface_owner_dispatch_row_import_by_embedded_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small row-type selector beneath the same import seam. The helper reads embedded row type dword `[row+0x18]` and dispatches type `2` to `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, type `3` to `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer` `0x00542030`, and type `4` to `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` `0x00541c30`, returning `2` on the unsupported fallback path. Current grounded caller is the temporary-slot wrapper `0x00543000`, so this is the safest current read for the embedded row-type import selector rather than another file-open helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation" +0x00543000,128,surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Temporary-slot import wrapper in the same surface-owner family. The helper clears selector field `[this+0x07]`, allocates one fresh slot through `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10`, dispatches the newly allocated row through `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0`, releases the slot again through `0x00541ba0` when the import result is `1` or `2`, and then refreshes cached byte totals and row state through `0x00540fc0` before returning the import status. Current grounded callers are the higher surface-owner service strip immediately above `0x00543080`, so this is the safest current read for allocating a temporary row slot, dispatching the type-specific import, and releasing it on failure rather than a broader constructor.","objdump + caller inspection + local disassembly + surface-family correlation + temp-slot-import correlation" +0x005438d0,173,surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Commit-side publish helper in the same `0xec`-byte RGBA surface-owner family used by `0x00543980`. When the caller supplies a nonnull backing buffer, the helper replaces existing row buffer `[row+0x26]`, freeing the old buffer when it differs. It then resets state byte `[row+0x20]` to `0`, restores state dword `[row+0x1c] = 0x15`, mirrors active backing pointer into `[row+0x22]`, recomputes byte size `[row+0x04] = width * height * 4` from `[row+0x08/+0x0c]`, re-enters `0x00541210`, publishes through `0x005435d0`, and finally clears owner dwords `[this+0xcc/+0xd0]`. Current grounded callers are the surface constructor `0x00543980`, the cached world-presentation surface strip at `0x00532460/0x00534af0`, and the shell overlay raster wrappers `0x0047b3d0/0x0047b470`, so this is the safest current read for committing the active RGBA backing buffer and republishing the live surface row rather than a generic free helper.","objdump + caller inspection + local disassembly + surface-family correlation + republish correlation" +0x00543980,131,surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Constructor or ensure helper for the `0xec`-byte RGBA surface-owner family. The function takes an optional caller pixel buffer, width, height, and one extra mode or flag argument. When the pixel buffer is null it allocates `width * height * 4` bytes itself, then re-enters `0x00540e30`, copies the fixed owner label at `0x005dd924` into `[this+0x13]`, and on first use seeds local bytes `[this+0x94] = 1` and `[this+0x96] = 0`, allocates one slot row through `0x00541b10(width, height, 3)`, and commits the active backing pixels through `0x005438d0`. It finishes by re-entering `0x00540fc0`, clears byte `[this+0x05]`, and returns `this`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation cached-surface owners `0x005323f0/0x00535100/0x00535430`, and the shell overlay ensure-surface owner `0x0047b470`, so this is the safest current read for initializing or ensuring one RGBA surface owner from caller pixels and dimensions rather than a world-only allocator.","objdump + caller inspection + local disassembly + surface-family correlation + first-use-slot-allocation correlation" +0x005454c0,82,layout_state_snapshot_current_slot_triplet_table_into_history_list_0x259f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, copies the whole live slot table into that buffer, and then appends the copied buffer into the history-style list rooted at `[this+0x259f]` through `0x00556e10`. Current grounded callers are the tightly clustered probe-side branches `0x0055de10..0x0055df9f`, so this is the safest current read for snapshotting the current slot-triplet table into history list `[+0x259f]` rather than a generic allocator wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation + history-list correlation" +0x00545520,179,layout_state_set_optional_item_binding_in_slot_table_0x2593,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared optional-binding setter over slot table `[this+0x2593]` in the broader layout-state presentation family. When the requested slot index is in range, the helper compares the incoming item pointer against the current slot binding. For nonnull items it first checks item dword `[item+0x07]` against the current shell-side mode token `[0x006d4024+0x114222]`; mismatches are normalized through `0x005435d0(item, [this+0x25df], 0)` before the final bind. Effective changes then publish node property slot `+0xf4` on `[this+0x25df]`, using the derived item-side dword returned from `0x00541bf0` for nonnull bindings or `0` for clears, incrementing local change counter `[this+0x370d]` and mirroring the final pointer back into `[this+0x2593 + slot*4]`. Current grounded callers include the nearby-presentation and layout-state refresh strips `0x005243eb`, `0x0052876a`, `0x00548a24`, and many sibling presentation owners, so this is the safest current read for the optional per-slot item-binding publisher rather than a generic list write.","objdump + caller inspection + local disassembly + layout-state correlation + slot-binding correlation" 0x005455e0,224,layout_state_set_slot_triplet_lo,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3.,ghidra + rizin + llvm-objdump 0x005456d0,240,layout_state_set_slot_triplet_hi,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6.,ghidra + rizin + llvm-objdump 0x005458f0,169,layout_state_read_segment_record_window,bootstrap,thiscall,inferred,ghidra-headless,4,Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars.,ghidra + rizin @@ -1862,23 +2065,286 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf 0x00545b10,57,layout_state_read_vertex24_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin 0x00545b50,59,layout_state_read_vertex24_window,bootstrap,thiscall,inferred,ghidra-headless,4,Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin 0x00545c50,67,layout_state_commit_vertex24_span,bootstrap,thiscall,inferred,ghidra-headless,4,Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4.,ghidra + rizin +0x00545e30,1657,layout_state_query_external_report_and_build_summary_text_0x43c,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader report-summary owner in the layout-state family beneath the release and capability-gated property strip. The helper first queries one external/provider object through `0x0058bc36`; when that lookup fails it formats localized id `0x73` directly into summary buffer `[this+0x43c]` and returns success. On the live path it fetches one capability-style report through vtable slot `+0x10`, clears summary buffer `[this+0x43c]`, and then appends a sequence of localized fragments `0x74..0x7d`, fixed format strings such as `%1(16-bit HW) ` and `%1(8-bit HW) `, and several numeric fields from the returned report before returning. Current grounded caller is the broader setup-side layout-state owner branch `0x0054a12b`, so this is the safest current read for querying the external report and building summary text buffer `0x43c` rather than a generic string formatter.","objdump + caller inspection + local disassembly + layout-state correlation + summary-buffer correlation + external-report correlation" +0x005464d0,105,layout_state_run_four_pass_bound_node_reset_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small four-pass bound-node reset strip in the layout-state family. The helper re-enters node slot `+0x88`, then publishes fixed selector/value pairs through node slot `+0x90` and finally clears slot `+0x3c`, repeating that sequence four times against bound presentation node `[this+0x25df]`. Current grounded caller is the same broader owner strip that invokes `0x00545e30` and then selects shell mode `4` or `5`, so this is the safest current read for the repeated bound-node reset strip rather than a generic loop body.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation" +0x00546540,19,layout_state_set_property_0x17_to_7,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny fixed property setter over the bound presentation node `[this+0x25df]`. The helper simply publishes value `7` into property `0x17`. Current grounded caller is `0x0052cb68`, so this is the safest current read for setting property `0x17` to `7` rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation" +0x00546560,19,layout_state_set_property_0x17_to_4,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546540` in the same layout-state family. The helper simply publishes value `4` into property `0x17` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00546580,19,layout_state_clear_property_0xa8,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny property-clear helper over bound presentation node `[this+0x25df]`. The function publishes `0` into property `0xa8`.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x005465a0,19,layout_state_set_property_0xa8_to_0x0f,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small fixed property setter beside `0x00546580` in the same layout-state family. The helper publishes value `0x0f` into property `0xa8` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation" 0x00546a30,333,layout_state_rebuild_variant_asset_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups.,ghidra + rizin 0x005467a0,50,layout_state_enable_presentation_gate,bootstrap,thiscall,inferred,ghidra-headless,4,Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df].,ghidra + rizin +0x005467e0,41,layout_state_disable_presentation_gate,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005467a0` in the same layout-state family. When local gate byte `[this+0x2549]` is live, the helper clears that byte and publishes `0` into property `0x1c` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + presentation-gate correlation" +0x00546810,67,layout_state_raise_property_0x16_to_3_when_template_flag_0x1c_permits,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Template-gated property raiser in the layout-state family. When local mode byte `[this+0x254a]` is not already `2` and template byte `[[this+0x83c]+0x1c]` is nonzero, the helper publishes value `3` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 2`.","objdump + local disassembly + layout-state correlation + template-gate correlation + property-strip correlation" +0x00546850,30,layout_state_set_property_0x16_to_2_and_store_mode1,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546810` in the same layout-state family. The helper publishes value `2` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 1`.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x00546890,41,layout_state_clear_property_0x16_and_reset_mode_byte_0x254a,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x00546810/0x00546850` in the same layout-state family. When local mode byte `[this+0x254a]` is nonzero, the helper publishes value `1` into property `0x16` on bound node `[this+0x25df]` and resets `[this+0x254a]` back to `0`.","objdump + local disassembly + layout-state correlation + property-strip correlation" +0x005463e0,149,layout_state_release_midband_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Midband handle-release strip in the layout-state family. The helper walks a five-handle band rooted at `[this+0x260f]`, `[this+0x2617]`, `[this+0x261f]`, `[this+0x2627]`, and `[this+0x262f]`, releasing each live entry through vtable slot `+0x08`, clearing the corresponding field back to `0`, and emitting localized notice `0x9b` when the release reports success. Current grounded callers are the repeated layout-state owner branches `0x00549f1c..0x0054a1c2`, including the broader bound-presentation release body `0x0054a190`, so this is the safest current read for the midband bound-handle cleanup strip rather than a generic field reset.","objdump + caller inspection + local disassembly + layout-state correlation + handle-band correlation" +0x005465c0,284,layout_state_release_variant_bank_and_late_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Late cleanup strip in the layout-state family beneath the broader bound-presentation release path. The helper first walks the 64-entry variant-bank table rooted at `[this+0x31ab]`, releasing every live entry through vtable slot `+0x08` with localized notice `0x9b` on successful release, then performs the same release-and-clear pattern on the later bound-handle band `[this+0x263f/+0x2643/+0x264f/+0x265b/+0x265f/+0x2663]`. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the variant bank and late bound handles rather than a generic array clear.","objdump + caller inspection + local disassembly + layout-state correlation + variant-bank correlation + handle-band correlation" +0x00546d40,712,layout_state_publish_transform_descriptor_from_local_scalars_and_seeded_handle_0x36fd,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader descriptor-publish helper in the layout-state family. The helper builds one large stack descriptor from local scalar bands `[this+0x2517/+0x251b/+0x251f/+0x25f7/+0x25ff]`, scale factors `[this+0x24f0/+0x24f8]`, the seeded handle `[this+0x36fd]`, and a local side buffer at `[this+0x35af]`, then forwards that descriptor into the bound presentation node `[this+0x25df]`. Current grounded caller is the three-slot batch owner `0x0054ab20`, so this is the safest current read for publishing one transform-style descriptor from local scalars and seeded handle `0x36fd` rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + descriptor-publish correlation" +0x005471f0,176,layout_state_bind_table_0x112_or_0x142_and_optionally_publish_property_0x154,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Generalized table-bind helper in the layout-state family beneath the local `0x2643/0x2647/0x264f` wrapper strip. When the caller-supplied table pointer differs from cached field `[this+0x2637]`, the helper binds that table onto the bound presentation node `[this+0x25df]`, choosing property `0x112` for `0x20`-byte records or property `0x142` for `0x18`-byte records through node slots `+0x130/+0x14c`, then caches the new table pointer. It also optionally forwards one caller dword through node slot `+0x154` and mirrors that value into `[this+0x263b]`. Current grounded callers are the small wrappers `0x0054bbd0` and `0x0054bbf0`, so this is the safest current read for the shared table-bind plus optional property-`0x154` publish helper rather than a single table-specific owner.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation + bound-node correlation" +0x005472a0,20,layout_state_clear_property_0x1b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-clear helper over the bound presentation node `[this+0x25df]`. The function simply publishes `0` into property group `0x1b` through node slot `+0xc8`. Current grounded callers include layout-state owner branches `0x0052888d`, `0x0052b93b`, `0x0052bebc`, `0x0052caf4`, `0x00564d58`, and `0x0056507e`, so this is the safest current read for clearing property `0x1b` rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation" +0x00547300,31,layout_state_publish_property_0x1b_from_template_flag_bit0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small property publisher beside `0x005472a0` in the same layout-state family. The helper reads template byte bit `0` from `[[this+0x83c]+0x21]` and forwards that one-bit value into property group `0x1b` on the bound presentation node `[this+0x25df]` through node slot `+0xc8`. Current grounded callers include layout-state owners `0x00524c3c`, `0x0052889d`, `0x005289a0`, `0x0052ae55`, `0x0052b89c`, `0x0052cb4e`, and later shell-side presentation branches, so this is the safest current read for publishing property `0x1b` from the template bit rather than a generic flag copy.","objdump + caller inspection + local disassembly + layout-state correlation + template-flag correlation + property-strip correlation" +0x00547320,96,layout_state_apply_capability_gated_property_0x0f_0x18_0x19_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated three-property strip in the layout-state family. When shell capability byte `[0x006d4024+0x114252]` is live, the helper publishes `1` into property `0x0f`, forwards the caller dword into property `0x18`, and then publishes fixed value `7` into property `0x19` on the bound node `[this+0x25df]`. Current grounded callers include layout-state owners `0x005243c1`, `0x00524cc9`, `0x0052873c`, `0x00529995`, `0x0052a1c9`, `0x0052a50c`, `0x0052ae5f`, `0x0052b8a6`, `0x0052c824`, and later shell-side branches, so this is the safest current read for the capability-gated `0x0f/0x18/0x19` property strip rather than an isolated scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation" +0x00547380,64,layout_state_clear_capability_gated_property_0x0f_0x18_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small clear-side sibling to `0x00547320` in the same layout-state family. When capability byte `[0x006d4024+0x114252]` is live, the helper clears property `0x0f` and property `0x18` on the bound node `[this+0x25df]` by publishing zero into both groups. Current grounded callers include layout-state owner branches `0x00528895` and `0x0052b940`, so this is the safest current read for clearing the capability-gated `0x0f/0x18` strip rather than a generic branch reset.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation" +0x00547610,48,layout_state_publish_bound_node_pair_0x2607_0x260b_once,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small one-shot publisher over the bound presentation node `[this+0x25df]` in the layout-state family. When local gate byte `[this+0x254c]` is still clear, the helper forwards dwords `[this+0x2607]` and `[this+0x260b]` into node vtable slot `+0x7c`, then marks the gate byte live. Current grounded callers are the setup-side owner `0x0052c032`, the small and broad release bodies `0x0055dd57/0x0055dd87/0x0055e07b`, and sibling rebuild paths such as `0x0052cc7d` and `0x0055e978`, so this is the safest current read for publishing the cached bound-node pair once rather than a generic setter.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation" +0x00547640,7,layout_state_clear_bound_node_pair_0x2607_0x260b_publish_gate,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny gate-clear sibling to `0x00547610` in the same layout-state family. The helper only resets byte `[this+0x254c]` back to `0`, allowing the next `0x00547610` call to republish dwords `[this+0x2607/+0x260b]` into the bound node. Current grounded callers are nearby presentation owners such as `0x0052bc20` and `0x0052bdd3`, so this is the safest current read for clearing the one-shot publish gate rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + publish-gate correlation" +0x00547650,578,layout_state_apply_capability_gated_presentation_property_strip_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated presentation property owner over the bound node `[this+0x25df]` in the layout-state family. When shell capability byte `[0x006d4024+0x11422d]` is live, the helper seeds one fixed property strip through repeated node slot `+0xfc` writes over property groups `0x0b`, `0x18`, `0x0d`, and `0x0e`, then binds auxiliary handles `[this+0x2623]` and `[this+0x2633]` through node slots `+0x130` and `+0x160`. When the first gate is clear but capability byte `[0x006d4024+0x114250]` is live, it instead builds one stack descriptor rooted at local handle `[this+0x36fd]`, publishes that block through node slot `+0x94` on property `0x11`, and then applies the reduced `0x0d/0x0e` property pair. Both branches finish by clearing the `0x0d/0x0e` property lane for selector `3`. Current grounded callers are the neighboring layout-state owner paths `0x0054abd1`, `0x0054b0e1`, and `0x0054b5de`, so this is the safest current read for the capability-gated presentation property strip and auxiliary-handle bind rather than a small scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + bound-node correlation" +0x005478a0,680,layout_state_apply_trig_derived_presentation_property_strip_and_bind_aux_handles_0x261b_0x262b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Alternate property-strip sibling to `0x00547650` in the same layout-state family. After one external timing or state query, the helper applies the same initial `0x0b/0x18` property band on the bound node `[this+0x25df]`, then publishes trig-derived scalar pairs into property groups `0x07..0x0a` for selectors `2` and `3`, sets both `0x0d/0x0e` groups for selector `2`, clears those groups for selector `3`, and finally binds auxiliary handles `[this+0x261b]` and `[this+0x262b]` through node slots `+0x130` and `+0x160`. Current grounded callers are the batch owners `0x0054abca` and `0x0054b0da`, so this is the safest current read for the trig-derived alternate property strip rather than a generic sine-cosine helper.","objdump + caller inspection + local disassembly + layout-state correlation + trig-strip correlation + bound-node correlation" +0x00547c30,224,layout_state_store_four_local_scalars_0x36df_0x36eb_and_publish_property_0x07_block,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared four-scalar publisher beneath the trig-derived layout-state strip. The helper stores four caller dwords into local scalar fields `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, validates them against the zero-threshold path, and then publishes either one identity-like `(0,0,1,1)` block or one block using the negated first pair plus the unmodified second pair into property group `0x07` on the bound presentation node `[this+0x25df]` through node slot `+0x13c` with notify flag `1`. Current grounded callers are the neighboring owner branches `0x0052c701` and `0x0052c77e`, so this is the safest current read for storing the local four-scalar band and publishing the derived property-`0x07` block rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + four-scalar correlation + property-strip correlation" 0x00547d10,288,layout_state_apply_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94.,ghidra + rizin + llvm-objdump 0x00547f20,177,layout_state_apply_gamma_ramp_scalar,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device.,ghidra + rizin + llvm-objdump +0x00548030,43,layout_state_publish_property_pair_0x13_0x14_as_1_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-pair setter in the layout-state family. The helper publishes value `1` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b8ae`, so this is the safest current read for the fixed `0x13/0x14 = 1/6` publish pair rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation" +0x00548060,43,layout_state_publish_property_pair_0x13_0x14_as_5_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x00548030` in the same layout-state family. The helper publishes value `5` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b91c`, so this is the safest current read for the fixed `0x13/0x14 = 5/6` publish pair rather than a generic wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation" +0x00548120,92,layout_state_reset_local_descriptor_identity_ensure_fallback_block_0x25e3_and_refresh_current_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small rect-strip owner in the layout-state family. The helper resets local descriptor `[this+0x34ef]` to identity through `0x00544360`, lazily allocates fallback block `[this+0x25e3]` and registers it on the bound node `[this+0x25df]` through slot `+0xa4`, then refreshes the sibling local descriptor `[this+0x352f]` from the current integer span pair `[this+0x25c7/+0x25cb]` by tail-calling `0x00544290`. Current grounded caller is `shell_commit_layout_updates` `0x00523d90`, so this is the safest current read for the identity-reset plus fallback-block ensure path rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation" +0x00548180,350,layout_state_store_normalized_local_rect_0x2523_0x252f_publish_dynamic_or_fallback_block_and_refresh_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader rect update owner immediately above `0x00548120` in the same layout-state family. The helper lazily allocates fallback block `[this+0x25e3]`, stores four normalized local rect scalars into `[this+0x2523/+0x2527/+0x252b/+0x252f]` from the caller's integer rectangle corners and current span pair `[this+0x25c7/+0x25cb]`, publishes either that derived dynamic block through node slot `+0xa0` or the fallback block when the rectangle is too small, and then refreshes sibling descriptor `[this+0x352f]` by re-entering `0x00544290` with the resulting width and height deltas. Current grounded caller is the neighboring bridge `0x005482e0`, so this is the safest current read for storing the normalized local rect, publishing the dynamic-or-fallback block, and refreshing the current span rather than a generic rectangle math helper.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation + fallback-block correlation" +0x005482e0,109,layout_state_apply_display_rect_or_delta_span_from_controller_normalized_scalars,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Bridge between the embedded view-controller scalar band and the layout-state rect-strip owners. The helper first materializes one active-display rectangle from controller scalar band `[controller+0x50..+0x5c]` through `embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c` `0x0052d4d0`; when that resolved rectangle is nondegenerate it forwards the four corners into `0x00548180`, and otherwise it computes simple width and height deltas and refreshes descriptor `[this+0x352f]` directly through `0x00544290`. Current grounded callers are shell presentation branches `0x0052c108` and `0x0052ccd8`, so this is the safest current read for applying a controller-derived display rect or fallback delta span into the layout-state family rather than a generic clamp helper.","objdump + caller inspection + local disassembly + layout-state correlation + controller-bridge correlation + rect-strip correlation" +0x00548820,116,layout_state_seed_all_slot_triplets_to_1_2_1_pattern,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small slot-table seed helper in the broader layout-state presentation family. The function walks every live slot in `[this+0x2597]` and writes the same six-scalar pattern into both triplet halves of each `0x18`-byte slot record: `(1, 2, 1)` at `+0x00/+0x04/+0x08` and again at `+0x0c/+0x10/+0x14`. Current grounded caller is the capability-side `TextureForTests` probe strip at `0x0055dfaa`, so this is the safest current read for seeding all slot triplets to the fixed `1,2,1` pattern rather than a general reset helper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation" +0x005488a0,157,layout_state_snapshot_current_slot_triplet_table_into_seeded_list_and_optionally_apply,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, pushes that copied table into the seeded-record list rooted at `[this+0x259b]` through `0x00557150`, and, when the caller requests it, immediately re-applies the copied low and high triplet halves to every live destination slot through `0x005455e0` and `0x005456d0` with notify flag `1`. Current grounded callers include several nearby-presentation builders `0x00524393`, `0x00524cca`, `0x005288ec`, `0x00528a20`, the broader probe path `0x00548a3b`, and later sibling presentation owners, so this is the safest current read for snapshotting the current slot-triplet table into the seeded list with an optional immediate re-apply rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + slot-triplet correlation" +0x005489f0,237,layout_state_run_texture_for_tests_binding_probe,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Capability-style probe owner in the broader layout-state presentation family. The helper allocates one temporary payload from literal `TextureForTests` through `0x0053c1c0(0, 0, 0x7f)`, binds that payload across every live optional item slot through `0x00545520`, snapshots or reapplies the current slot-triplet state through `0x005488a0`, queries the bound presentation node at `[this+0x25df]` through vtable slot `+0x100`, re-applies the first seeded slot-triplet pair through `0x00548940(1)`, clears the live optional slot bindings back to null through `0x00545520`, releases the temporary payload through `0x0053c000`, and returns the resulting boolean-like probe outcome. Current grounded callers are the later capability-setting branch `0x0055dfc1/0x0055dfe0/0x0055e004/0x0055e047`, which mirror that result into shell capability bytes `[0x006d4024+0x114250/+0x114251]`, so this is the safest current read for the `TextureForTests` binding probe rather than a generic presentation refresh owner.","objdump + caller inspection + local disassembly + rdata string decode + layout-state correlation + capability-probe correlation" +0x00548940,167,layout_state_apply_first_n_seeded_slot_triplet_pairs_from_list_0x259b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-triplet apply helper over the seeded record list rooted at `[this+0x259b]` in the broader layout-state presentation family. The function clamps the caller-requested record count against list count `[[this+0x259b]+0x0c]`, iterates that many seeded `0x18`-byte records through `0x00556e50`, and for each destination slot index writes the first and second triplet blocks into the cached slot table `[this+0x2597]` through `0x005455e0` and `0x005456d0` with notify flag `1`. After the pass it releases the temporary seeded-list cursor through `0x005a1145`. Current grounded callers include the nearby-presentation sweeps `0x00524521`, `0x00524e32`, `0x00529998`, the broader layout-state owner `0x00548a71`, and several sibling presentation rebuild paths, so this is the safest current read for applying the first N seeded slot-triplet pairs from list `[+0x259b]` rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation" +0x00548c50,342,layout_state_release_history_seeded_lists_and_clear_optional_slot_bindings,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pre-release cleanup owner in the layout-state presentation family. When live slot count `[this+0x258f]` is positive, the helper drains and frees every record in the history list `[this+0x259f]` and the seeded-record list `[this+0x259b]`, releases the two list owners themselves, clears both fields back to `0`, and then walks the optional slot-binding table `[this+0x2593]` to publish null bindings through bound-node slot `+0xf4` before zeroing each slot entry. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the history and seeded lists plus clearing optional slot bindings rather than a narrow list helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + optional-binding correlation" 0x00548da0,1328,layout_state_refresh_presentation_batches,bootstrap,thiscall,inferred,ghidra-headless,4,Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record.,ghidra + rizin + llvm-objdump 0x005492d0,3747,layout_state_probe_d3d8_capabilities,bootstrap,thiscall,inferred,ghidra-headless,4,Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04].,ghidra + rizin + llvm-objdump + strings +0x0054a0c0,176,layout_state_bind_external_source_rebuild_summary_reset_bound_node_and_select_mode_4_or_5,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader setup-side owner in the layout-state family above the newly grounded summary and reset strips. The helper binds one caller-supplied external source onto the bound presentation node `[this+0x25df]` through node slot `+0x12c`, falls back to the midband-handle cleanup strip `0x005463e0` when that bind reports failure, conditionally reapplies the cached gamma-ramp scalar from template field `[[this+0x83c]+0x2f]` through `0x00547f20`, seeds optional handle `[this+0x33ab]` through `0x00570fbd`, rebuilds summary buffer `[this+0x43c]` through `0x00545e30`, runs the repeated bound-node reset strip `0x005464d0`, clears local byte `[this+0x254d]`, and finally selects layout-state mode dword `[this+0x04]` as `4` or `5` from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`. Current grounded caller is the surrounding setup-side branch that prepares the subordinate layout state before later property application, so this is the safest current read for binding the external source, rebuilding the summary/reset strip, and selecting mode `4` or `5` rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation + summary-buffer correlation + resolution-tier correlation" +0x0054a190,228,layout_state_release_bound_presentation_handles_and_clear_controller_slot_0x08,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broad bound-presentation release body in the layout-state family. The helper first re-enters `0x00548c50`, then releases optional handles `[this+0x33ab]`, `[this+0x25e3]`, `[this+0x25e7]`, `[this+0x25df]`, and `[this+0x25db]`, emitting shell notices through localized ids `0x9b` or `0x9c` when the bound-node release paths report success. It also re-enters the two adjacent cleanup helpers `0x005463e0` and `0x005465c0`, clears local presentation pointers `[this+0x2643/+0x25df/+0x25db]`, and finally clears shell controller dword `[0x006d4024+0x08]` back to `0`. Current grounded callers are the direct layout-state branches `0x0054bd64` and `0x0054be7f`, so this is the safest current read for releasing the bound presentation handles and controller slot rather than a generic object destructor.","objdump + caller inspection + local disassembly + layout-state correlation + presentation-release correlation" 0x0054a280,626,layout_state_apply_presentation_properties,bootstrap,thiscall,inferred,ghidra-headless,4,Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3].,ghidra + rizin +0x0054a500,1568,layout_state_refresh_variant_bank_batches_from_handle_0x2663_or_local_descriptor_set,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch owner in the layout-state family above the newly grounded `0x00547c30` strip. The helper requires active batch count `[this+0x2667]`, clears the local visited-byte strip `[this+0x254f..]`, pulses property groups `0x89` and `0x0e`, derives two normalized shell-scalars from the current shell presentation size through `0x0051f090 -> 0x00533970/0x00533980`, and then branches on midband handle `[this+0x260f]`. On the null-handle path it snapshots the current slot-triplet state through `0x005488a0`, seeds one fixed triplet pair, binds handle `[this+0x2663]` as one `0x18`-byte table on property `0x142`, reads that table through vtable slot `+0x2c`, rescales the resulting rows by local scalar band `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, and commits the resulting batch ranges through variant-bank entries `[this+0x31ab + batch*4]` into node slot `+0x11c`. On the live-handle path it instead binds current segment-record handle `[this+0x265b]`, publishes the local descriptor rooted at `[this+0x35af]`, pushes two fixed property blocks `5` and `6`, and then commits the same visited batch ranges. Current grounded caller is the neighboring owner branch `0x0052c73d`, so this is the safest current read for refreshing the variant-bank batches from handle `0x2663` or the local descriptor set rather than a generic layout rebuild body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + variant-bank correlation" +0x0054ab20,1262,layout_state_refresh_presentation_batches_with_three_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch-refresh owner in the layout-state family with three optional slot-binding candidates. The helper clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` onto node property `0x112` when needed, chooses between the capability-gated property strips `0x00547650` and `0x005478a0`, applies one descriptor publish through `0x00546d40`, and then walks the active `0x2d`-stride batch records rooted at `[this+0x266f]`. During that walk it compares previous/current/next candidate values, updates optional slot bindings through `0x00545520` for slots `0`, `1`, and `2`, emits batch ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited batch bytes under `[this+0x254f]`, and follows the per-batch next-link selectors at `+0x267b/+0x2683/+0x2687`. Current grounded callers are the setup-side layout-state owner branches `0x0052c4d6`, `0x0052c50c`, and `0x0052c53d`, so this is the safest current read for the three-slot candidate batch-refresh owner rather than a generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation" +0x0054b030,1159,layout_state_refresh_presentation_batches_with_two_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Two-slot sibling to `0x0054ab20` in the same layout-state batch family. The owner clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` when needed, chooses between `0x00547650` and `0x005478a0`, and then walks the same `0x2d`-stride batch records rooted at `[this+0x266f]`. Its candidate-comparison and rebinding phase only manages slots `0` and `1` through `0x00545520`, then commits the selected ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited bytes, and follows the same per-batch next-link selectors. Current grounded callers are the setup-side owner branches `0x0052c578`, `0x0052c5e5`, `0x0052c63c`, and `0x0052cb2f`, so this is the safest current read for the two-slot candidate batch-refresh owner rather than another generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation" +0x0054b4e0,1465,layout_state_refresh_handle_0x265f_backed_batches_with_capability_variant_switch,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-switched batch-refresh owner in the same layout-state family. The helper clears the visited-byte strip `[this+0x254f..]`, ensures current segment-record handle `[this+0x265b]` is rebound, applies a capability-gated pre-strip over properties `0x0f`, `0x18`, and `0x1b`, calls `0x00547650`, and then branches on node slot `+0x128` plus capability byte `[0x006d4024+0x114250]` to choose one of two handle-backed descriptor publishes rooted at `[this+0x265f]`. After that it walks the same `0x2d`-stride batch records and commits them through variant-bank entry `[this+0x31ab + batch*4]`, but the candidate-rebinding phase is narrower and only refreshes slot `0` plus the optional slot-`1` clear path. Current grounded callers are the setup-side layout-state owner branches `0x0052c46c` and `0x0052c49a`, so this is the safest current read for the `0x265f`-backed capability-variant batch owner rather than a generic descriptor upload body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + capability-variant correlation" 0x0054bab0,89,layout_state_bind_segment_record_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump +0x0054bb10,90,layout_state_bind_alternate_segment_record_table_0x263f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x0054bab0` in the same layout-state family. The helper binds alternate `0x20`-byte segment-record table `[this+0x263f]` onto property `0x112` of the bound presentation node `[this+0x25df]` when that table differs from cached field `[this+0x2637]`, then clears local dirty dword `[this+0x263b]`. Current grounded caller is the nearby owner branch `0x00528885`, so this is the safest current read for the alternate segment-record table bind rather than a broader batch owner.","objdump + caller inspection + local disassembly + layout-state correlation + segment-record correlation" 0x0054bb70,90,layout_state_bind_vertex24_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump +0x0054bbd0,22,layout_state_bind_vertex24_table_0x264f_and_publish_property_0x154_from_0x2653,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny wrapper into `0x005471f0` in the layout-state family. The helper binds the `0x18`-byte table `[this+0x264f]` onto the bound presentation node and forwards companion dword `[this+0x2653]` through property `0x154`. Current grounded callers are the neighboring owner branches `0x0052b8be` and `0x0052b94b`, so this is the safest current read for the `0x264f/0x2653` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation" +0x0054bbf0,22,layout_state_bind_vertex24_table_0x2647_and_publish_property_0x154_from_0x264b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny sibling wrapper into `0x005471f0` in the same layout-state family. The helper binds the `0x18`-byte table `[this+0x2647]` onto the bound presentation node and forwards companion dword `[this+0x264b]` through property `0x154`. Current grounded callers are the nearby owner branches `0x0052ae2b` and `0x0054e30b`, so this is the safest current read for the `0x2647/0x264b` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation" 0x0054bc10,592,shell_init_layout_state_defaults,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28].,ghidra + rizin +0x0054be60,52,layout_state_export_preset_table_0x840_to_global_defaults_and_refresh,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small export-and-refresh helper in the shell layout-state family. The function copies the full `0x72c`-byte preset table from `[this+0x840]` into global default cache `0x00ccbb68`, raises global dirty byte `0x00ccd820`, refreshes the surrounding layout-state side through `0x0054a190`, and clears shell controller pointer field `[0x006d4024+0x0c]` through `shell_controller_store_pointer_field_0x0c` `0x0051eff0(0)`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd9a` and `0x0055e29d`, so this is the safest current read for exporting preset table `0x840` into the global defaults and refreshing the shell-side cache rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + default-cache correlation" 0x0054bea0,1399,layout_state_apply_interpolated_pose,bootstrap,thiscall,inferred,ghidra-headless,4,Applies an interpolated pose and palette sample on the subordinate layout-state object using the controller counters passed by callers; clamps the time window blends preset tables at offsets 0x840 through 0x86f updates color bytes at 0x2510 through 0x2512 invokes the bound presentation node at [this+0x25df] and finishes through 0x0054a280.,ghidra + rizin +0x0055ddc0,664,shell_seed_layout_state_probe_snapshot_handles_by_resolution_tier,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Setup-side probe owner for the shell layout-state family. The helper first chooses a small resolution tier, `4` or `5`, from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`, then programs a sequence of fixed slot-triplet patterns into subordinate layout state `[this+0x2d]` through `0x005455e0/0x005456d0`, snapshotting each resulting slot table through `0x005454c0` and storing the returned handles into local probe fields `[this+0x35/+0x39/+0x3d/+0x41/+0x45/+0x49/+0x4d/+0x51/+0x55/+0x59]`. After that it seeds all live slots to the fixed `(1,2,1)` pattern through `0x00548820`, clears shell capability byte `[0x006d4024+0x114251]`, probes several of the stored snapshot handles through `layout_state_run_texture_for_tests_binding_probe` `0x005489f0`, mutates one fallback probe record at `[this+0x4d]` when the first pass fails, and finally mirrors the resulting booleans into shell capability bytes `[0x006d4024+0x114250/+0x114251]`. Current grounded caller is the layout-state constructor `shell_create_layout_state` `0x0055e2b0`, so this is the safest current read for seeding the layout-state probe snapshots by resolution tier rather than a generic table initializer.","objdump + caller inspection + local disassembly + layout-state correlation + capability-probe correlation + resolution-tier correlation" +0x0055dd80,50,shell_release_layout_state_field_0x2d_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small layout-state teardown sibling over owner field `[this+0x2d]`. The helper first refreshes and drops the live layout-state side through `0x00547610` and `0x00542c10`, then, when `[this+0x2d]` is nonnull, releases that subordinate layout-state object through `0x0054be60` and `0x0053b080` before clearing the field back to null. Current grounded callers are the broader layout-state rebuild owner `0x00565110` and the local branch at `0x00520008`, so this is the safest current read for the direct layout-state field release helper rather than a generic object free.","objdump + caller inspection + local disassembly + layout-state correlation + teardown correlation" +0x0055e060,587,shell_release_layout_state_owner_resources_and_subordinate_handles,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader release body in the same shell layout-state owner family. When activation dword `[this+0x01]` is live, the helper first shuts down subordinate payload `[this+0x5d]`, refreshes and drops layout-state side `[this+0x2d]` through `0x00547610` and `0x00542c10`, and then walks a long owned-handle strip rooted at `[this+0x65]`, `[this+0x79..+0x8d]`, `[this+0x95..+0xa5]`, `[this+0x364d]`, and `[this+0x3651..+0x3665]`, releasing each live entry through the corresponding local family helper plus `0x0053b080` or `0x0053c000`. The tail also clears several cached layout-owned pointers and finally releases the subordinate layout-state object at `[this+0x2d]` through `0x0054be60`. Current grounded caller is the shell-side owner branch at `0x0051ffee`, which frees `[owner+0x18]` through this helper when the higher-level teardown flag is set, so this is the safest current read for the full layout-state owner release body rather than a small field reset.","objdump + caller inspection + local disassembly + layout-state correlation + owner-release correlation" 0x0054e3a0,528,shell_controller_window_message_dispatch,shell,stdcall,inferred,objdump,4,Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through 0x0051f0c0 or 0x0051f0d0 and then forwarding the transition into shell_input_apply_window_key_transition at 0x0054f290 on the shell input object rooted at 0x006d4018 routes `WM_COMMAND` through 0x0054eb10 routes mouse messages in the `0x0200..0x0208` family through 0x0054ee50 and falls back to `DefWindowProcA` for unhandled cases. This is the first grounded shell-side input ingest path rather than only a generic message drain.,objdump + import table + callsite inspection 0x0054e5d0,88,shell_drain_pending_window_messages,shell,cdecl,inferred,objdump + analysis-context,4,Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself.,objdump + analysis-context + import table 0x0054e710,110,shell_input_state_init,shell,thiscall,inferred,objdump + analysis-context,3,Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update.,objdump + analysis-context + import table 0x0054e880,305,shell_input_service_pointer_proximity_event_record_and_queue_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one queued 12-dword shell-input event record from the ring rooted at `[this+0x128]` as a pointer-proximity or timeout update. The helper classifies input record types `6`, `8`, and `10` into one of three local slot bands under `[this+0x104]`, `[this+0x110]`, and `[this+0x11c]`, measures the absolute pointer delta against the controller-selected view size from `[0x006d4024+0x34 + selector*0x15]`, compares that against the shared radius threshold, and either snapshots the current pointer coordinates plus deadline tick into the chosen slot or clones the record into a follow-on event with rewritten type `0x1e`, `0x20`, or `0x22` before requeueing it through `0x0054e9c0`. Current grounded callers are the queue wrappers `0x0054e9c0`, `0x0054f5b0`, and `0x0054eb10`, so this is the safest current read for the pointer-proximity event service owner rather than another generic ring-buffer helper.","objdump + caller inspection + local disassembly + event-ring correlation + pointer-proximity correlation" 0x0054e9c0,79,shell_input_enqueue_event_record_and_run_pointer_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small queue wrapper over the shell-input event ring at `[this+0x128]`. The helper appends one caller-supplied 12-dword record into the ring, rewrites ring index `[this+0xa88]` from `0x32` back to `0x31` when needed, increments that index, and immediately tails into `0x0054e880` on the same record. Current grounded callers are `shell_input_apply_window_key_transition` `0x0054f290`, `shell_input_enqueue_window_event_record_and_signal_dispatch` `0x0054f5b0`, and `shell_input_handle_window_command_and_toggle_messages` `0x0054eb10`.","objdump + caller inspection + local disassembly + event-ring correlation" 0x0054ea20,229,shell_input_pop_next_event_record_with_type2_coalescing,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Dequeues the next 12-dword shell-input event record from the same ring at `[this+0x128]` into one caller output buffer. When more than one event is pending and nested dispatch latch `[this+0xa90]` is clear, the helper compacts the ring forward, decrements the event count, and performs one special coalescing pass for adjacent type-`2` records when no key-state byte at `[this+0x100]` is active. Current grounded caller is `shell_input_snapshot_dispatch_state` `0x0054f4d0`, which uses this helper to pull one filtered dispatch record at a time.","objdump + caller inspection + local disassembly + event-ring correlation + coalescing correlation" +0x005708c0,11,refcounted_object_vtable_0x5deba0_query_current_matrix_pointer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny current-entry pointer helper for the `0x5deba0` object family. The function resolves and returns the current `0x40`-byte matrix entry at `[this+0x08 + [this+0x0c]*0x40]`.","objdump + local disassembly + object-family correlation + matrix-row correlation" +0x005708ce,36,aligned_alloc_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small aligned-allocation helper reused by the `0x5deba0` object family. The function allocates `requested_size + 0x10` bytes through `0x0053b070`, rounds the returned pointer up to the next 16-byte boundary, stores the applied back-offset in byte `[aligned_ptr-1]`, and returns that aligned pointer. Current grounded caller is `0x0057091d`, which uses this helper for `0x40`-byte matrix-row blocks.","objdump + local disassembly + allocation correlation + alignment correlation" +0x005708f2,22,aligned_free_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Free-side sibling to `0x005708ce`. When the incoming aligned pointer is nonnull, the helper reads the stored back-offset byte at `[ptr-1]`, reconstructs the original allocation base, and frees it through `0x0053b080`. Current grounded callers are destructor `0x00570908` and the `0x5deba0` growth path.","objdump + local disassembly + allocation correlation + alignment correlation" +0x00570908,21,refcounted_object_vtable_0x5deba0_destruct_and_release_row_block,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small destructor-side helper for the `0x5deba0` object family. The function reinstalls vtable `0x005deba0`, releases optional row-block pointer `[this+0x08]` through `0x005708f2`, and returns. Current grounded caller is the release wrapper `0x005709da`, so this is the safest current read for destructing the object and dropping its row block rather than a broader owner teardown.","objdump + local disassembly + object-family correlation + row-block correlation" +0x0057091d,108,refcounted_object_vtable_0x5deba0_reserve_0x40_byte_row_capacity,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Reserve owner for the same `0x5deba0` object family. The helper allocates one aligned row block sized as `requested_count << 6`, fills it from fixed `0x40`-byte template `0x0056cd2c`, stores the resulting pointer into `[this+0x08]`, stores requested row capacity into `[this+0x04]`, clears live row count `[this+0x0c]`, and then dispatches one object-specific follow-on through vtable slot `+0x14`. Current grounded caller is the create-and-reserve wrapper `0x00570fbd(0x10)`, so this is the safest current read for reserving `0x40`-byte row capacity rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + row-capacity correlation" +0x0057098b,77,refcounted_object_vtable_0x5deba0_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the `0x5deba0` object family. The helper accepts exactly two interface ids: `IUnknown` `{00000000-0000-0000-C000-000000000046}` from `0x005eaaec` and one custom IID rooted at `0x005c8520`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation" +0x005709da,26,refcounted_object_vtable_0x5deba0_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the `0x5deba0` object family. The helper re-enters destructor `0x00570908`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00570fa1`, which invokes this path when refcount `[this+0x10]` reaches zero.","objdump + local disassembly + object-family correlation + refcount correlation" +0x005709f6,180,refcounted_object_vtable_0x5deba0_grow_row_capacity_and_append_duplicate_last_row,bootstrap,thiscall,inferred,objdump + local disassembly,2,"First growth owner above `0x0057091d` in the same `0x5deba0` object family. The helper increments live row count `[this+0x0c]`, doubles row capacity `[this+0x04]` and reallocates the `0x40`-byte row block when the new count would exceed capacity, then duplicates the previous `0x40`-byte row into the new last slot. This is the safest current read for growing row capacity and appending a duplicate of the last row rather than a generic vector push.","objdump + local disassembly + object-family correlation + row-capacity correlation + row-block correlation" +0x00570aac,95,refcounted_object_vtable_0x5deba0_set_current_matrix_to_identity,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small current-entry seed helper for the `0x5deba0` object family. The function resolves the current `0x40`-byte entry at `[this+0x08 + [this+0x0c]*0x40]`, zeroes all sixteen float lanes, and then writes `1.0` into offsets `0x00`, `0x14`, `0x28`, and `0x3c`, producing an identity 4x4 matrix. This is the safest current read for seeding the current matrix to identity rather than a generic clear helper.","objdump + local disassembly + object-family correlation + matrix-row correlation" +0x00570b0d,29,refcounted_object_vtable_0x5deba0_store_current_matrix_from_caller_block,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Direct current-entry store helper for the `0x5deba0` object family. The function copies one caller-supplied `0x40`-byte block into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for storing the current matrix from a caller block rather than a generic memcpy wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation" +0x00570b2c,72,refcounted_object_vtable_0x5deba0_compose_current_matrix_with_caller_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Current-entry composition helper for the `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, current, caller)` and writes the resulting block back into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for composing the current matrix with one caller matrix on the right-hand side rather than a generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation" +0x00570b76,72,refcounted_object_vtable_0x5deba0_compose_caller_matrix_with_current_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling composition helper to `0x00570b2c` in the same `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, caller, current)` and writes the result back into the current entry. This is the safest current read for composing the caller matrix with the current matrix on the right-hand side rather than another generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation" +0x00570bc0,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056df7d` from the caller pointer plus one float scalar, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56df7d`-generated right-side composition path rather than a generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570c2f,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570bc0` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte helper matrix through `0x0056df7d`, then composes it on the left through `0x0056d3cd(temp, helper, current)` and stores the result back into the current entry. This is the safest current read for the left-side `0x56df7d` composition path rather than another generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570c9e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56e1a8`-generated right-side composition path rather than a generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570d1a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570c9e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, composes it on the left through `0x0056d3cd(temp, helper, current)`, and stores the result back into the current entry. This is the safest current read for the left-side `0x56e1a8` composition path rather than another generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570d96,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dc9a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dc9a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570e12,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570d96` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dc9a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dc9a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570e8e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dd2a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dd2a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570f0a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570e8e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dd2a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dd2a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation" +0x00570f86,27,refcounted_object_vtable_0x5deba0_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for one 0x14-byte refcounted object family. The helper installs vtable `0x005deba0`, clears dwords `[this+0x04/+0x08/+0x0c]`, and seeds refcount `[this+0x10] = 1`. Current grounded direct caller is the create-and-reserve wrapper `0x00570fbd`, so this is the safest current read for initializing the `0x5deba0` object family rather than a wider bootstrap owner.","objdump + local disassembly + object-family correlation" +0x00570fa1,26,refcounted_object_vtable_0x5deba0_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the `0x5deba0` object family. The function decrements refcount `[this+0x10]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x005709da(1)` to destroy and free the object. This is the safest current read for the direct refcount decrement path rather than a generic counter helper.","objdump + local disassembly + object-family correlation + refcount correlation" +0x00570fbd,86,create_refcounted_object_vtable_0x5deba0_and_reserve_block_0x10,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small create-and-reserve wrapper for the same `0x5deba0` object family. The helper validates the caller out-pointer, allocates one `0x14`-byte object through `0x0053b070`, initializes it through `0x00570f86`, asks the new object to reserve or materialize one `0x10`-byte block through `0x0057091d(0x10)`, releases the object through vtable slot `+0x08` on failure, and stores the live pointer through the caller outparam on success. Current grounded caller is the setup-side layout-state owner `0x0054a0c0`, which uses this helper to seed optional handle `[layout+0x33ab]`, so this is the safest current read for creating the refcounted `0x5deba0` object and reserving its first `0x10`-byte block rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + allocation correlation" +0x0057ad20,58,refcounted_object_vtable_0x5def30_destruct_release_resource_fields_and_attached_object,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def30`. The helper reinstalls vtable `0x005def30`, conditionally tears down resource field `[this+0x48]` through `0x00580bb9/0x00580bdc`, frees optional heap block `[this+0x08]` through import thunk `0x005c8058`, and releases attached object `[this+0x4c]` through its vtable slot `+0x08`. This is the safest current read for destructing the `0x5def30` object family and releasing its owned fields rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + resource-field correlation" +0x0057ad5a,11,refcounted_object_vtable_0x5def30_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for object family `0x005def30`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation" +0x0057ad67,91,refcounted_object_vtable_0x5def30_bind_resource_field_attach_object_and_copy_15_dword_payload,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for object family `0x005def30`. When both caller inputs are nonnull, the helper initializes resource field `[this+0x48]` through `0x0058123c`, allocates payload block `[this+0x08]` through import thunk `0x005c8054`, stores attached object `[this+0x4c]` with an addref, and copies one `0x0f`-dword payload block into `[this+0x0c]`. Otherwise it returns `0x8876086c`. This is the safest current read for binding the resource field, attaching the sibling object, and copying the fixed payload block rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + payload-copy correlation" +0x0057add4,21,refcounted_object_vtable_0x5def30_get_attached_object_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for object family `0x005def30`. The helper writes attached object `[this+0x4c]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + attached-object correlation" +0x0057adfb,18,refcounted_object_vtable_0x5def30_copy_15_dword_payload_out,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small payload-copy helper for object family `0x005def30`. The function copies the fixed `0x0f`-dword payload block from `[this+0x0c]` into the caller destination and returns `0x8876086c` only when the destination pointer is null.","objdump + local disassembly + object-family correlation + payload-copy correlation" +0x0057ae0f,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_5809c7,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x005809c7`.","objdump + local disassembly + object-family correlation + resource-field correlation" +0x0057ae1e,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a54,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae0f` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580a54`.","objdump + local disassembly + object-family correlation + resource-field correlation" +0x0057ae2d,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode0,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader pass-through owner for object family `0x005def30`. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `0` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation" +0x0057ae53,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode1,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Mode-`1` sibling to `0x0057ae2d` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `1` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation" +0x0057ae79,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a84,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x00580a84`.","objdump + local disassembly + object-family correlation + resource-field correlation" +0x0057ae88,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580aff,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae79` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580aff`.","objdump + local disassembly + object-family correlation + resource-field correlation" +0x0057ae97,66,refcounted_object_vtable_0x5def30_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x005def30`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8500`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation" +0x0057aedb,22,refcounted_object_vtable_0x5def30_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for object family `0x005def30`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571016(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation" +0x0057aef3,27,refcounted_object_vtable_0x5def30_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for object family `0x005def30`. The helper installs vtable `0x005def30`, seeds refcount `[this+0x04] = 1`, and clears optional fields `[this+0x08]`, `[this+0x48]`, and `[this+0x4c]`.","objdump + local disassembly + object-family correlation" +0x0057af0e,64,refcounted_object_vtable_0x5def5c_destruct_release_optional_target_and_two_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def5c`. The helper reinstalls vtable `0x005def5c`, and when target field `[this+0x08]` is live it conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0` before releasing the target itself through slot `+0x08`. This is the safest current read for destructing the `0x5def5c` object family and releasing its optional target-side handles rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + target-handle correlation" +0x0057af4e,11,refcounted_object_vtable_0x5def5c_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for sibling object family `0x005def5c`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation" +0x0057af5b,115,refcounted_object_vtable_0x5def5c_attach_target_and_derive_cached_flag_pair,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for sibling object family `0x005def5c`. The helper stores one caller target object into `[this+0x08]` with addref, queries two target-side flag blocks through vtable slots `+0x1c` and `+0x24`, and derives cached booleans `[this+0x1c]` and `[this+0x18]` from the observed flag bits before returning success. When the incoming target pointer is null it returns `0x8876086c`. This is the safest current read for attaching the target and deriving the cached flag pair rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + target-flag correlation" +0x0057afd0,36,refcounted_object_vtable_0x5def5c_get_target_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for sibling object family `0x5def5c`. The helper writes target field `[this+0x08]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + target-object correlation" +0x0057aff6,40,refcounted_object_vtable_0x5def5c_release_handle_0x10_once,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small one-shot release helper for sibling object family `0x5def5c`. When live flag `[this+0x0c]` is nonzero, the function asks target `[this+0x08]` to release handle `[this+0x10]` through vtable slot `+0xd8`, then clears `[this+0x0c]` back to `0`; otherwise it returns `0x80004005`. This is the safest current read for releasing handle `0x10` once rather than a generic boolean guard.","objdump + local disassembly + object-family correlation + target-handle correlation" +0x0057b021,61,refcounted_object_vtable_0x5def5c_clear_optional_handles_0x14_and_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small clear-side sibling to `0x0057aff6` in the `0x5def5c` family. When target field `[this+0x08]` is live, the helper conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0`, then clears both fields back to `0`.","objdump + local disassembly + object-family correlation + target-handle correlation" +0x0057b060,3,refcounted_object_vtable_0x5def5c_return_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Literal zero-return stub in the `0x5def5c` helper strip.","objdump + local disassembly + object-family correlation" +0x0057b065,66,refcounted_object_vtable_0x5def5c_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x5def5c`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c84f0`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation" +0x0057b0a9,22,refcounted_object_vtable_0x5def5c_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for sibling object family `0x5def5c`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571032(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation" +0x0057b0c1,1074,refcounted_object_vtable_0x5def5c_seed_target_handles_publish_property_strip_and_latch_ready,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader service owner for sibling object family `0x5def5c`. The helper rejects re-entry when ready latch `[this+0x0c]` is already set, then, when optional handle `[this+0x10]` is still null, queries the target at `[this+0x08]` through slots `+0xd0`, `+0x130`, `+0x94`, `+0xc8`, `+0xfc`, and `+0xd4` to seed the two handle lanes `[this+0x10/+0x14]`, publish one fixed property strip, and optionally build one target-derived matrix when cached flag `[this+0x1c]` is clear. The tail always replays target slot `+0xdc` for `[this+0x10]`, target slot `+0xd8` for `[this+0x14]`, conditionally emits one more target-derived matrix through slot `+0x94`, and finally marks ready latch `[this+0x0c] = 1`. This is the safest current read for seeding target handles, publishing the fixed property strip, and latching the object ready rather than a generic virtual wrapper.","objdump + local disassembly + object-family correlation + target-handle correlation + property-strip correlation" +0x0057b4fd,213,target_object_build_local_transform_block_from_optional_anchor_pairs_angle_and_scale_and_dispatch_slot_0x18,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader target-side geometry owner immediately above the `0x5def5c` service strip. The helper conditionally lifts up to three optional caller anchor pairs into local vec2-plus-scalar records, derives one temporary transform block through `0x0056e1bf` from those optional anchors plus caller angle and scale inputs, and then forwards that finished block into the target object through vtable slot `+0x18` with the caller's dispatch pair. This is the safest current read for building one local transform block from optional anchor pairs, angle, and scale before dispatching slot `+0x18`, rather than a generic float wrapper.","objdump + local disassembly + target-object correlation + transform-block correlation" +0x00580867,75,target_service_init_clear_entry_bands_and_aux_fields,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the target-service object family wrapped by `0x005def30`. The helper seeds refcount `[this] = 1`, clears the target, attached-object, embedded entry-band roots, ready byte, service handles, auxiliary handle roots, and list link at `[this+0xac]`, and leaves the object ready for the later constructor-side owner `0x00580be8`.","objdump + local disassembly + target-service-family correlation + constructor correlation" +0x005808b2,249,target_service_destruct_release_handles_entry_bands_and_unlink_global_cache,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for the same target-service family. The helper releases the two target-bound service handles `[this+0x64/+0x68]` through target slot `+0xe0`, walks and releases the two embedded eight-entry bands rooted at `[this+0x10]` and `[this+0x30]`, drops attached object `[this+0x0c]` and target `[this+0x04]`, tears down the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, `[this+0x9c]`, and `[this+0xa8]` through the imported `0x005c8030/0x005c803c/0x005c8058` helpers, and finally unlinks the object from the global cache chain rooted at `0x00db89e4`. This is the safest current read for the full target-service destructor rather than a generic cleanup body.","objdump + local disassembly + target-service-family correlation + destructor correlation + global-cache correlation" +0x005809ab,28,target_service_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the target-service family. The helper re-enters destructor `0x005808b2`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00580bdc`.","objdump + local disassembly + target-service-family correlation + refcount correlation" +0x005809c7,141,target_service_seed_handles_0x64_0x68_and_latch_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Activation-side owner for the next target-service family beneath the `0x5def30` wrappers. When ready byte `[this+0x60]` is still clear, the helper ensures service handles `[this+0x64]` and `[this+0x68]` through target `[this+0x04]` vtable slots `+0xd0` and `+0xd4`, invokes attached object `[this+0x0c]` through slot `+0x10`, republishes those two handles back into the target through slots `+0xdc` and `+0xd8`, and finally marks `[this+0x60] = 1`. This is the safest current read for seeding the two service handles and latching the service live rather than a generic query helper.","objdump + local disassembly + target-service-family correlation + handle-seed correlation" +0x00580a54,48,target_service_release_handle_0x64_and_clear_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005809c7` in the same target-service family. When ready byte `[this+0x60]` is nonzero, the helper asks target `[this+0x04]` to release handle `[this+0x64]` through vtable slot `+0xd8`, notifies attached object `[this+0x0c]` through slot `+0x1c`, and clears `[this+0x60]` back to `0`.","objdump + local disassembly + target-service-family correlation + handle-release correlation" +0x00580a84,123,target_service_release_handles_and_reset_embedded_entry_bands,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Broader release owner for the same target-service family. The helper tears down target-side handle state through target `[this+0x04]`, attached object `[this+0x0c]`, and the optional handles rooted at `[this+0x64]` and `[this+0x68]`, then iterates the two embedded eight-entry bands under `[this+0x10]` and `[this+0x30]` to clear their per-entry pointers and counters. This is the safest current read for releasing the bound handles and resetting the embedded entry bands rather than a generic cleanup fragment.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation" +0x00580aff,186,target_service_build_embedded_entry_bands_from_mode_variant_and_dispatch_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Setup-side owner immediately above the clear strip in the same target-service family. When entry root `[this+0x10]` is still null, the helper branches on local mode byte `[this+0x50]` to choose one of two fixed parameter triples, seeds control scalars `[this+0x54]`, `[this+0x58]`, and `[this+0x5c]` through `0x00570669` and `0x00570691`, iterates the embedded entry bands rooted at `[this+0x10]` and dispatches each live per-entry object through slot `+0x3c`. This is the safest current read for building the embedded entry bands from the mode variant and dispatching their setup slot rather than a generic initializer.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation" +0x00580bb9,35,target_service_release_aux_handle_band_if_live,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small auxiliary release helper for the same target-service family. When optional band flag `[this+0x6c]` is live, the helper walks the pointer band rooted at `[this+0xa8]`, releases it through import thunk `0x005c803c`, and clears the associated slots back to `0`.","objdump + local disassembly + target-service-family correlation + auxiliary-handle correlation" +0x00580bdc,12,target_service_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny refcount-drop helper for the same target-service family. The function decrements refcount `[this]` and when it reaches zero tail-calls release wrapper `0x005809ab(1)`.","objdump + local disassembly + target-service-family correlation + refcount correlation" +0x00580be8,321,target_service_init_seed_mode_scalars_build_entry_bands_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Constructor-side owner for the target-service family wrapped by the `0x5def30` object. The helper stores caller target `[this+0x04]`, derives mode byte `[this+0x50]` from target-side flags, seeds the fixed scalar triple `[this+0x54] = 0x15`, `[this+0x58] = 0x40`, `[this+0x5c] = 0x10`, invokes embedded-band builder `0x00580aff`, initializes the later service roots under `[this+0x70..]`, and allocates or binds the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, and `[this+0x9c]`. This is the safest current read for initializing the target-service object, seeding its mode scalars, building the entry bands, and binding the auxiliary handles rather than a generic constructor fragment.","objdump + local disassembly + target-service-family correlation + constructor correlation" +0x00580d29,1299,target_service_dispatch_payload_block_with_mode_variant_and_target_callbacks,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary target-service owner beneath the `0x0057ae2d/0x0057ae53` wrappers. The helper accepts the target-service object, the caller payload block, five caller arguments, and a fixed mode variant flag from the wrapper, then branches across local bounds, anchor, and callback conditions while using service handle `[this+0x6c]` plus external callbacks rooted at `0x005c81e4`, `0x005c8248`, and `0x005c824c`. Current static evidence is strong enough to ground this as the main payload-dispatch and layout-style service body for the target-service family, while the exact user-facing meaning of every branch remains open.","objdump + local disassembly + target-service-family correlation + payload-block correlation + callback correlation" +0x0058123c,117,target_service_cache_or_create_for_target_and_return_via_outparam,bootstrap,cdecl,inferred,objdump + local disassembly,2,"Factory-side helper above the target-service family. The function walks the global cache chain rooted at `0x00db89e4` looking for an existing target-service object whose target field `[entry+0x04]` matches the caller target. On a hit it increments the service refcount and returns the cached object through the caller outparam. Otherwise it allocates one `0xb0`-byte object through `0x0053b070`, initializes it through `0x00580867`, runs constructor owner `0x00580be8`, and on failure releases it through `0x005809ab(1)`. This is the safest current read for the cache-or-create factory for the target-service family rather than a generic resource wrapper constructor.","objdump + local disassembly + target-service-family correlation + global-cache correlation + factory correlation" +0x005812b1,16,dword_pointer_vector_reset_4dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one four-dword vector-style record. The function clears fields `[this+0x00]`, `[this+0x04]`, `[this+0x08]`, and `[this+0x0c]` back to zero.","objdump + local disassembly + container-helper correlation" +0x005812c1,14,dword_pointer_vector_release_storage_if_nonnull,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small release helper for the same four-dword vector record. When storage pointer `[this+0x00]` is nonnull, the helper frees it through `0x0053b080`.","objdump + local disassembly + container-helper correlation" +0x005812cf,110,dword_pointer_vector_push_value_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable dword-pointer vector append helper. The function checks count `[this+0x04]` against capacity `[this+0x08]`, grows the backing dword array at `[this+0x00]` by `0x10` entries through `0x0053b070` when full, preserves existing contents, writes the caller dword into the next slot, increments the count, and stores allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation" +0x0058133d,52,dword_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same dword-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last dword through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation" +0x00581371,8,dword_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same dword-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation" +0x00581379,19,string_pointer_vector_reset_5dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one five-dword string-pointer vector record. The function clears storage pointer, count, capacity, status, and accumulated-byte counter fields `[this+0x00..+0x10]`.","objdump + local disassembly + container-helper correlation + string-vector correlation" +0x0058138c,49,string_pointer_vector_release_storage_and_owned_strings,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release helper for the string-pointer vector record. When storage `[this+0x00]` is live, the helper walks all counted string pointers, frees each owned string through `0x0053b080`, then frees the pointer array itself through the same allocator shim.","objdump + local disassembly + container-helper correlation + string-vector correlation" +0x005813bd,179,string_pointer_vector_push_copy_or_null_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable string-pointer vector append helper. The function grows the pointer array at `[this+0x00]` by `0x10` entries when count reaches capacity, then either stores a null pointer for a null caller string or allocates and copies a private NUL-terminated copy of the caller string, updates accumulated-byte counter `[this+0x10]`, stores the resulting pointer in the next slot, increments the count, and records allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation" +0x00581470,52,string_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same string-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last string pointer through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation" +0x005814a4,8,string_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same string-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation + string-vector correlation" +0x005814ac,232,string_pointer_vector_build_newline_joined_text_object,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary owner above the string-pointer vector helper strip. When accumulated-byte count `[this+0x10]` is nonzero, the helper allocates one `0x10`-byte text object through `0x0053b070`, initializes it through `0x00581673`, asks that object to allocate a text buffer sized for total string bytes plus one newline per stored string plus the trailing NUL through vtable slot `+0x18`, and then copies each stored string from the vector into the owned buffer separated by literal `0x0a` bytes before returning the object through the caller outparam. This is the safest current read for building one newline-joined text object from the stored string vector rather than a generic vector wrapper.","objdump + local disassembly + string-vector correlation + text-object correlation" +0x00581594,21,text_object_vtable_0x5e0bd8_destruct_release_owned_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the small text object family rooted at vtable `0x005e0bd8`. The helper reinstalls that vtable and frees owned text buffer `[this+0x0c]` through `0x0053b080` when it is live.","objdump + local disassembly + text-object correlation" +0x005815a9,38,text_object_vtable_0x5e0bd8_allocate_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Allocation helper for the same text object family. The function stores the requested byte length in `[this+0x08]`, allocates that many bytes through `0x0053b070`, writes the result to `[this+0x0c]`, and returns either `0` or allocation failure `0x8007000e`.","objdump + local disassembly + text-object correlation" +0x005815cf,11,text_object_vtable_0x5e0bd8_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for the same text object family. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + text-object correlation + refcount correlation" +0x005815dc,30,text_object_vtable_0x5e0bd8_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the same text object family. The function decrements refcount `[this+0x04]`, and when it reaches zero tail-calls release wrapper `0x00581610(1)`.","objdump + local disassembly + text-object correlation + refcount correlation" +0x005815fc,18,text_object_vtable_0x5e0bd8_get_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns owned text buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation" +0x00581606,8,text_object_vtable_0x5e0bd8_get_buffer_length,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns stored buffer length `[this+0x08]`.","objdump + local disassembly + text-object correlation" +0x00581610,26,text_object_vtable_0x5e0bd8_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the same text object family. The helper re-enters destructor `0x00581594`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + text-object correlation + refcount correlation" +0x0058162c,71,text_object_vtable_0x5e0bd8_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the same text object family. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8510`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + text-object correlation + COM-correlation" +0x00581673,24,text_object_vtable_0x5e0bd8_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the same text object family. The helper installs vtable `0x005e0bd8`, seeds refcount `[this+0x04] = 1`, and clears buffer-length `[this+0x08]` plus owned-buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation" +0x00581690,64,math_apply_2d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small SSE helper over one caller output buffer, one XY input pair, and one basis or translation block. The function multiplies the input X and Y scalars by the first two 16-byte rows at `[basis+0x00]` and `[basis+0x10]`, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. This is the safest current read for the shared 2D-basis-plus-translation vec4 builder rather than a gameplay-specific transform.","objdump + local disassembly + SSE arithmetic inspection" +0x005816d0,96,math_apply_2d_basis_rows_translation_and_project_xy_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective sibling to `0x00581690`. The helper builds the same intermediate 4-lane vector from the caller XY pair and basis or translation rows, then derives a reciprocal from lane 3 and uses it to scale the vector before storing only the low 64 bits through the caller output. Current evidence is strongest for a shared transform-plus-project helper that returns projected XY rather than a gameplay-specific projection owner.","objdump + local disassembly + SSE arithmetic inspection" +0x00581730,57,math_apply_2d_basis_rows_to_vec2_without_translation,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small translation-free sibling to `0x00581690`. The helper multiplies the caller XY pair by the first two 16-byte basis rows at `[basis+0x00]` and `[basis+0x10]`, sums the lanes, and stores only the low 64 bits to the caller output. This is the safest current read for the shared 2D basis-to-vec2 helper rather than another owner-specific math body.","objdump + local disassembly + SSE arithmetic inspection" +0x00581770,192,math_apply_3d_basis_rows_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 3D SSE transform helper over one caller output buffer, one XYZ input triple, and one basis block. The function multiplies the input X, Y, and Z scalars by the first three 16-byte rows at `[basis+0x00]`, `[basis+0x10]`, and `[basis+0x20]`, sums the lanes, and stores the resulting XYZ triple through the caller output. It uses a separate fast path when the basis pointer is 16-byte aligned, but both legs preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection" +0x00581830,192,math_apply_3d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Translation-bearing sibling to `0x00581770`. The helper multiplies the caller XYZ triple by the first three 16-byte basis rows, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. As with the sibling, the body has aligned and unaligned load paths but the same observable transform semantics.","objdump + local disassembly + SSE arithmetic inspection" +0x005818f0,256,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective 3D sibling to `0x00581830`. The helper builds the same 4-lane transformed vector from the caller XYZ triple and basis or translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the resulting XYZ triple through the caller output. Both the aligned and unaligned legs preserve the same transform-plus-project semantics.","objdump + local disassembly + SSE arithmetic inspection" +0x005819f0,192,math_apply_4d_basis_rows_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 4D SSE transform helper over one caller output buffer, one XYZW input vector, and one 4x4 basis block. The function multiplies each input lane by the corresponding 16-byte row at `[basis+0x00]`, `[basis+0x10]`, `[basis+0x20]`, and `[basis+0x30]`, sums the lanes, and stores the full vec4 result through the caller output. The body preserves the same semantics across aligned and unaligned basis-pointer paths.","objdump + local disassembly + SSE arithmetic inspection" +0x00581ab0,336,math_apply_4d_basis_rows_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch sibling to `0x005819f0`. The helper takes one 4x4 source row block, applies the same 4-row basis block to each of its four input vec4 rows, and writes the four transformed vec4 rows to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`. This is the safest current read for the shared four-row 4D basis application helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection" +0x00581c00,208,math_normalize_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small vec3 normalization helper. The function computes squared length from the caller XYZ triple, compares it against a tiny epsilon table under `0x00dbc000`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result. This is the safest current read for the shared normalize-or-zero vec3 helper rather than a gameplay-specific metric.","objdump + local disassembly + SSE arithmetic inspection" +0x00581cd0,216,math_normalize_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00581c00`. The helper computes squared length from the caller XYZW tuple, compares it against a nearby epsilon table under `0x00dbc00c`, returns a zero vec4 when the length is too small, and otherwise applies the same Newton-refined reciprocal-square-root scale before writing the normalized XYZW result. This is the safest current read for the shared normalize-or-zero vec4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection" +0x00581db0,1008,math_invert_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Primary 4x4 matrix inversion helper. The function derives the cofactor bands for the caller source matrix, accumulates the determinant, optionally stores that determinant through the caller outparam, returns failure when the determinant is zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the inverse to the caller output. This is the safest current read for the shared invert-4x4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection" +0x00582070,352,math_apply_4d_basis_rows_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output sibling to `0x00581ab0`. The helper applies one 4-row basis block to each row of a caller 4x4 source block, then repacks the four transformed vec4 rows into a transposed or column-packed output layout before storing them to the caller destination. This is the safest current read for the shared four-row 4D basis application helper with packed transposed output.","objdump + local disassembly + SSE arithmetic inspection" +0x005821d0,164,math_compute_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4D vector helper over three caller vec4 inputs. The function computes the alternating-sign generalized cross-product style combination of those three vectors and writes the resulting vec4 through the caller output. The final sign flip through mask `0x00627ce0` is part of the same determinant-style construction, so this is the safest current read for the shared 4D cross-product helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection" +0x00582280,160,math_normalize_vec4_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked vec4 normalization helper. The function computes squared length from the caller XYZW tuple, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon zeroing guard used by `0x00581cd0`.","objdump + local disassembly + SSE arithmetic inspection" +0x00582320,176,math_sample_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Cubic-basis interpolation helper over one scalar parameter and four caller vec3 control points. The function builds four basis weights from the scalar through the constant tables at `0x00627d10..0x00627d40`, multiplies each control point by its corresponding weight, and writes the blended vec3 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation" +0x005823e0,136,math_sample_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation" +0x00582470,165,math_sample_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation" +0x00582520,181,math_sample_alternate_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Alternate-basis vec3 interpolation sibling. The helper again derives four weights from the caller scalar parameter, but uses the alternate constant tables at `0x00627d50..0x00627d80` before applying those weights to four caller vec3 control points and writing the blended vec3 result. This is the safest current read for the alternate cubic-basis vec3 sampler rather than a subsystem-specific curve owner.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation" +0x005825e0,153,math_sample_alternate_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation" +0x00582680,133,math_sample_alternate_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation" +0x00582710,89,math_blend_vec3_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Two-scalar affine blend helper over three caller vec3 points. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from the caller origin point, two target points, and scalar weights `s` and `t`, then writes the blended vec3 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation" +0x00582770,70,math_blend_vec4_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 points and two scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation" +0x005827c0,79,math_blend_vec2_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 points and two scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation" +0x00582820,188,math_intersect_plane_vec4_with_vec3_segment,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Geometric intersection helper over one plane vec4 and two caller vec3 endpoints. The function evaluates the plane against both endpoints, derives the affine parameter along the segment between them, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the shared plane-versus-segment intersection helper rather than a subsystem-specific query.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation" +0x005828e0,203,math_measure_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4x4 determinant helper. The function forms the required cofactor combinations from the caller matrix rows, contracts them against the first row, and returns the resulting determinant scalar through the x87 return path. Current evidence is strongest for a shared determinant helper paired with the nearby inversion body `0x00581db0`.","objdump + local disassembly + SSE arithmetic inspection + matrix-correlation" +0x005829b0,226,math_build_plane_vec4_from_three_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-point plane builder over caller vec3 inputs. The function forms two edge vectors from the three points, computes their cross product, normalizes that resulting normal, stores the plane normal through output `[+0x00..+0x08]`, and writes the signed plane constant `-dot(normal, p0)` to `[out+0x0c]`. This is the safest current read for the shared plane-from-three-points helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation" +0x00582aa0,392,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Shared plane-driven 4x4 matrix builder over one caller plane vec4 and one second vec4 input. The function normalizes the plane against the XYZ-length of its first three lanes, computes one diagonal dot term against the second vec4, combines that term with per-plane outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as a projective plane-and-vec4 matrix helper, but not yet tight enough to overname it as one specific API variant.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation + projective-matrix correlation" +0x00582c30,209,math_build_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion-to-matrix helper. The function normalizes the caller quaternion-like vec4, applies the standard doubled-product combinations through the constant tables at `0x00627e10..0x00627e80`, and writes a 4x4 rotation matrix to the caller output. This is the safest current read for the shared quaternion-to-4x4 rotation-matrix builder rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" +0x00582d10,130,math_multiply_quaternions,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion product helper over two caller vec4 inputs. The function applies the expected sign-mask and shuffle pattern for Hamilton-product-style quaternion composition and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" +0x00582da0,128,math_normalize_quaternion_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked quaternion normalization helper. The function computes the caller quaternion length, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon guard used by the nearby zero-safe normalizers.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" +0x00582e40,109,math_invert_quaternion_by_conjugate_over_squared_length,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion inverse helper over one caller vec4. The function flips the sign of the spatial XYZ lanes, preserves the scalar W lane, divides that conjugate by the squared quaternion length, and writes the resulting vec4 through the caller output. This is the safest current read for the shared quaternion-inverse helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation" +0x00582eb0,274,math_build_quaternion_from_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Rotation-matrix-to-quaternion helper over one caller 3x3 row block. The function checks the matrix trace, takes the usual positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected off-diagonal differences and sums before writing the resulting vec4 to the caller output. This is the safest current read for the shared 3x3-rotation-matrix-to-quaternion builder.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation" +0x00582fd0,191,math_build_quaternion_from_three_euler_angles_via_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-angle quaternion builder over caller scalar inputs. The function packs the three caller angles with one zero lane, scales them by `0.5`, routes that half-angle tuple through packed trig helper `0x0058aa70`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. The current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation + packed-trig correlation" +0x005830a0,176,math_apply_packed_3x3_basis_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 3D basis helper over one caller vec3 input and one compact 3x3 basis block. The function multiplies the input X, Y, and Z scalars by three packed matrix rows and stores the resulting XYZ triple through the caller output, with aligned and unaligned load paths that preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation" +0x00583160,175,math_apply_packed_3x3_basis_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row translation-bearing sibling to `0x005830a0`. The helper multiplies one caller vec3 input by three packed basis rows, adds one packed translation row, and stores the resulting full vec4 through the caller output. Both aligned and unaligned load paths preserve the same transform semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation" +0x00583220,243,math_apply_packed_3x3_basis_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective packed-row sibling to `0x00583160`. The helper builds the same transformed 4-lane vector from one caller vec3 input plus packed basis and translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the projected XYZ triple through the caller output. The aligned and unaligned legs preserve the same transform-plus-project behavior.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + projection correlation" +0x00583320,184,math_apply_packed_4x4_basis_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4D basis helper over one caller vec4 input and one packed 4x4 row block. The function multiplies each input lane by its corresponding packed row, sums the four products, and stores the resulting vec4 through the caller output, again preserving the same behavior across aligned and unaligned load paths.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation" +0x005833e0,324,math_apply_packed_4x4_basis_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch packed-row sibling to `0x00583320`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation" +0x00583530,196,math_normalize_packed_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec3 normalization sibling to `0x00581c00`. The helper computes squared length from the caller XYZ triple, compares it against the nearby epsilon table under `0x00dbc180`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation" +0x00583600,216,math_normalize_packed_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec4 normalization sibling to `0x00581cd0`. The helper computes squared length from the caller XYZW tuple, compares it against the nearby epsilon table under `0x00dbc18c`, returns a zero vec4 when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZW result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation" +0x005836e0,695,math_invert_packed_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4x4 inversion sibling to `0x00581db0`. The helper expands the packed 4x4 source rows, derives the required cofactor bands and determinant scalar, optionally stores that determinant through the caller outparam, returns failure when the determinant collapses to zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the packed inverse to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-inversion correlation" +0x005839a0,342,math_apply_packed_4x4_basis_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output batch sibling to `0x005833e0`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block, then repacks the transformed lanes into a transposed or column-packed output layout before storing the four result rows.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + transposed-output correlation" +0x00583b00,164,math_compute_packed_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product style combination through shuffle, multiply, and subtract bands, applies the final sign-mask adjustment under `0x00627ee0`, and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + 4d-cross-product correlation" +0x00583cc0,201,math_measure_packed_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row determinant sibling to `0x005828e0`. The helper expands the packed 4x4 row block, forms the same cofactor combinations as the wider determinant strip, contracts them against the first packed row, and returns the resulting determinant scalar through the x87 return path.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-determinant correlation" +0x00583bb0,121,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_a,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Single-angle packed 4x4 rotation-matrix helper above interleaved trig worker `0x0058ac60`. The function broadcasts one caller angle, derives one interleaved sine/cosine tuple through `0x0058ac60`, combines that tuple with fixed identity-row constants, and writes one packed 4x4 axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation" +0x00583c30,128,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_b,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Sibling single-angle packed 4x4 rotation-matrix helper above `0x0058ac60`. Like `0x00583bb0`, it broadcasts one caller angle, derives one interleaved sine/cosine tuple through the shared trig worker, combines that tuple with fixed identity-row constants in a different lane arrangement, and writes one second packed 4x4 axial rotation-matrix variant to the caller output. The safest current read is a second fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation" +0x00583d90,226,math_build_plane_vec4_from_three_packed_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row three-point plane builder sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross product, normalizes that resulting normal, stores the plane normal through the caller output, and writes the signed plane constant to `[out+0x0c]`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation" +0x00583e80,392,math_build_packed_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes, computes one diagonal dot term against the second vec4 input, combines that term with per-plane outer-product bands, and writes the resulting packed 4x4 matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation + projective-matrix correlation" +0x00584010,209,math_build_packed_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row quaternion-to-matrix sibling to `0x00582c30`. The helper normalizes the caller quaternion-like vec4, applies the same doubled-product combinations through the packed constant tables at `0x00627f70..0x00627fe0`, and writes a packed 4x4 rotation matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation" +0x005840f0,274,math_build_quaternion_from_packed_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Packed-row rotation-matrix-to-quaternion sibling to `0x00582eb0`. The helper checks the packed 3x3 trace, takes the positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected packed off-diagonal differences and sums before writing the resulting vec4 to the caller output.","objdump + local disassembly + x87 arithmetic inspection + packed-matrix correlation + quaternion correlation" +0x00584210,191,math_build_quaternion_from_three_euler_angles_via_packed_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582fd0`. The helper packs three caller angles with one zero lane, scales them by `0.5`, routes that tuple through packed trig helper `0x0058ad50`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation + packed-trig correlation" +0x005842e0,151,math_multiply_quaternions_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582d10`. The helper loads two caller quaternion-like vec4 inputs, applies the same sign-mask and pairwise multiply-add or subtract pattern used by the SSE quaternion-product strip, and writes the resulting vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation" +0x00584379,90,math_normalize_vec4_or_zero_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 normalize-or-zero helper. The function computes squared length from the caller vec4, compares it against the nearby epsilon constant at `0x005df610`, and when the length is large enough scales the full vec4 by one reciprocal-square-root refinement before writing it to the caller output; smaller inputs collapse to zero through the same mask path.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation" +0x005843d6,179,math_normalize_vec3_with_optional_length_outparam_and_default_axis_fallback_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization helper with two optional outparams. The function computes the squared XYZ length from the caller source block, optionally writes the normalized vec3 through one caller outparam, optionally writes a derived scalar magnitude through another, and when the input collapses below the epsilon threshold falls back to a fixed default-axis vector plus zero magnitude. This is the safest current read for the shared vec3 normalize-with-length helper without overclaiming the exact downstream semantic of the scalar outparam.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation" +0x00584489,1073,math_build_quaternion_from_3x3_rotation_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582eb0`. The helper inspects the same 3x3 rotation-matrix trace and dominant diagonal cases, chooses one of the expected reconstruction branches, and writes the resulting quaternion vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix-correlation" +0x005848ba,195,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582fd0`. The helper halves the three caller Euler angles, routes those half angles through scalar trig worker `0x0058b660`, and combines the resulting sine and cosine values into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + trig correlation" +0x0058497f,106,math_build_quaternion_from_axis_vec3_and_angle_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle-to-quaternion helper. The function first normalizes one caller axis vec3 through `0x005896d2`, halves the caller angle, routes that half-angle through trig worker `0x0058b660`, scales the normalized axis by the sine-like lane, and writes the resulting quaternion vec4 with the cosine-like scalar lane in `W`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation" +0x005849eb,309,math_interpolate_quaternion_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion slerp helper over two caller quaternion-like vec4 inputs and one scalar interpolation factor. The function measures the 4D dot product, takes the expected small-angle fast path, otherwise derives one angular term through `0x0058af80` and two sine-weight terms through `0x0058b780`, then writes the weighted combination through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + slerp correlation" +0x00584b22,139,math_blend_three_quaternion_controls_by_two_parameter_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Two-parameter nested quaternion-slerp helper. The function first forms `u+v`, performs two intermediate slerps from one shared control quaternion to two neighboring controls through `0x005849eb`, derives relative blend weight `v/(u+v)`, and then slerps between those intermediates into the caller output. The safest current read is a barycentric or triangular nested-slerp helper rather than a tighter named spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation" +0x00584baf,144,math_blend_three_quaternion_controls_by_quadratic_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Quadratic nested quaternion-slerp helper. The function first builds two intermediate slerps at the same parameter `t` through `0x005849eb`, derives the classic quadratic blend scalar `2*t*(1-t)`, and then slerps between those intermediates into the caller output. This is the safest current read for a three-control quaternion curve helper without overclaiming the exact higher-level spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation" +0x00584c41,98,math_invert_quaternion_by_conjugate_over_squared_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582e40`. The helper conjugates the caller quaternion by negating `XYZ` while preserving `W`, divides that conjugate by the squared quaternion length, and writes the resulting inverse quaternion through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation" +0x00584ca5,165,math_build_axis_angle_vec4_from_quaternion_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-axis-angle extractor. The function reads the scalar `W` lane, derives one angular term through `0x0058b080` and `0x0058b780`, conditionally rescales the `XYZ` lanes by the reciprocal sine factor when that angle is not degenerate, and writes the resulting axis-angle-style vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation" +0x00584d4c,163,math_build_quaternion_from_scaled_axis_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scaled-axis-to-quaternion helper. The function measures the length of the caller vec3, routes that magnitude through trig worker `0x0058b660`, conditionally rescales the `XYZ` lanes by the reciprocal magnitude, and writes a quaternion-style vec4 whose `XYZ` lanes hold the scaled axis contribution and whose `W` lane receives the cosine-like scalar result. This is the safest current read for a shared scaled-axis-to-quaternion helper without overclaiming the exact upstream representation.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation" +0x00584df1,396,math_build_two_inner_quaternion_spline_controls_from_four_keys_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow quaternion spline-control builder over four caller key quaternions. The helper first aligns neighboring keys onto the same hemisphere by comparing sum-vs-difference norms, then around each interior key converts the two neighboring relative quaternions through the already-grounded inverse, axis-angle, and scaled-axis helpers, averages those tangent-like terms, exponentiates back into a quaternion, and multiplies by the interior key to write two inner control quaternions through the caller output buffer. The safest current read is a four-key inner-control builder for quaternion spline interpolation rather than a tighter spline-family label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + spline-control correlation" +0x0058584a,559,math_multiply_4x4_matrices_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller matrix from the split qword row layout used by the neighboring constructors into temporary contiguous rows on the stack, then multiplies a second caller 4x4 matrix by those repacked rows and writes the product through the caller output buffer. The safest current read is a non-alias-staging sibling of the later packed 4x4 multiply family rather than a subsystem-specific API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation" +0x00585a7c,207,math_compute_determinant_of_upper_3x3_basis_from_split_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scalar determinant helper over one split-layout 4x4 matrix. The function forms the expected 3x3 cofactor bands from the upper basis rows, completes the final cofactor expansion against the remaining basis row, accumulates the result to one scalar lane, and returns that determinant through `st0`. The safest current read is a determinant-of-basis helper rather than a tighter affine-class predicate.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + determinant correlation" +0x00585b4b,80,math_build_4x4_translation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow row-major translation-matrix constructor. The helper seeds the three identity rows from `0x005df668` and `0x005df660`, writes the three caller translation scalars into the trailing homogeneous row, and returns the finished 4x4 matrix through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation" +0x00585b9b,235,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes through `0x0058a988`, computes one diagonal dot term against the second vec4 input, combines that dot term with the expected negated outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as the MMX plane-driven projective matrix helper without overclaiming one specific API variant.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + geometry correlation + projective-matrix correlation" +0x00585c86,220,math_build_4x4_reflection_matrix_from_plane_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane-reflection matrix helper. The function normalizes the caller plane vec4 through `0x0058a988`, forms the expected `1 - 2*n*n^T` diagonal terms plus the paired `-2*n_i*n_j` off-diagonal bands, and writes the resulting homogeneous 4x4 reflection-style matrix to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + plane-reflection correlation" +0x00585d62,97,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through scalar trig worker `0x0058b660`, seeds the fixed identity rows from constants `0x005df668` and `0x005df660`, and writes one axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation" +0x00585dc5,94,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. Like `0x00585d62`, it routes one caller angle through `0x0058b660`, combines the resulting sine or cosine lanes with the same identity-row constants in a different layout, and writes one second axial rotation-matrix variant to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation" +0x00585e23,87,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_c,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Third MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through `0x0058b660`, seeds the remaining fixed identity rows, and writes one third axial rotation-matrix variant to the caller output. The safest current read is a third fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation" +0x00585e7c,67,math_build_4x4_scale_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow diagonal scale-matrix constructor. The helper writes the three caller scalar scale lanes onto the homogeneous 4x4 diagonal, clears the off-diagonal lanes, and seeds the trailing homogeneous `1.0f` row or column from `0x005df660`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + scale correlation" +0x00585ec3,110,math_transpose_or_repack_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Small MMX or 3DNow 4x4 matrix repack helper. It reads the caller matrix in one split qword layout, unpacks the low and high dword pairs across the four rows, and writes the reordered 4x4 matrix to the caller output. The safest current read is a transpose or row-column repack helper rather than a higher-level owner.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + repack correlation" +0x00585f32,57,math_build_identity_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"MMX or 3DNow identity-matrix constructor. The helper seeds the diagonal with `1.0f` from `0x005df590`, clears the off-diagonal lanes, and writes the resulting homogeneous 4x4 identity matrix to the caller output.","objdump + local disassembly + matrix correlation + identity correlation" +0x00585f6b,199,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. The function doubles the caller quaternion lanes, forms the expected pairwise product bands, combines them with the fixed `1 - 2*...` diagonal terms from `0x005df5a0`, and writes one 4x4 rotation-matrix layout to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation" +0x0058603d,181,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. It uses the same doubled-lane and pairwise-product construction as `0x00585f6b`, but writes the resulting rotation terms in a second lane layout to the caller output. The safest current read is a second quaternion-to-matrix variant rather than a tighter row- or column-major claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation" +0x005860f2,1655,math_build_4x4_transform_from_optional_translation_base_rotation_pivoted_post_rotation_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional base rotation quaternion, one optional base translation vec3, one optional pivot vec3, one optional post-rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when no base translation is present, otherwise seeds a pure translation matrix or translation-plus-base-rotation matrix, then optionally applies a second quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the post-rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a shared affine-transform builder rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation" +0x0058728a,421,math_build_4x4_rotation_matrix_from_three_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection,2,"MMX or 3DNow three-angle 4x4 rotation-matrix builder. The helper halves the three caller angle scalars through the `0.5f` pair at `0x005df630`, routes those half-angles through trig worker `0x0058b660`, combines the resulting sine or cosine lanes through the same doubled-product and `1 - 2*...` bands used by the nearby quaternion-to-matrix helpers, and writes one 4x4 rotation-matrix layout to the caller output. The safest current read is a three-angle rotation constructor via half-angle trig rather than a tighter Euler-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection + trig correlation + quaternion-formula correlation + matrix correlation" +0x0058742f,308,math_build_4x4_transform_from_uniform_scale_optional_pivoted_rotation_quaternion_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one uniform scalar scale, one optional pivot vec3, one optional rotation quaternion, and one optional trailing translation delta vec3. The helper first seeds a diagonal scale matrix from the caller scalar plus the fixed homogeneous `1.0f` lane at `0x005df580`, then optionally applies one quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection + matrix correlation + scale correlation + quaternion correlation + pivot-rotation correlation" +0x00587963,281,math_build_4x4_rotation_matrix_from_axis_vec3_and_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle 4x4 rotation-matrix helper. The function first normalizes one caller axis vec3 through `0x005896d2`, routes the caller angle through trig worker `0x0058b660`, forms the expected Rodrigues-style `axis*axis*(1-c)`, `axis*s`, and diagonal `c + axis*axis*(1-c)` bands, and writes the resulting 4x4 rotation matrix through the caller output buffer.","objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection + axis-angle correlation + trig correlation + matrix correlation" +0x00587a7c,4436,math_build_4x4_transform_from_optional_translation_two_optional_pivoted_rotation_quaternions_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional first pivot vec3, one optional first rotation quaternion, one optional base translation vec3, one optional second pivot vec3, one optional second rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when the base translation is absent, otherwise seeds a pure translation matrix or translation-plus-first-rotation matrix, optionally applies that first rotation about the first caller pivot, then optionally applies a second quaternion rotation about the second caller pivot, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a broader shared affine-transform builder with up to two pivoted quaternion stages rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation" +0x00588eb2,1013,math_multiply_4x4_matrices_with_alias_safe_rhs_staging_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller source matrix into a temporary contiguous row layout, multiplies those four rows by the second caller 4x4 matrix, and writes the product through the caller output buffer. When the destination aliases the right-hand input matrix it stages the product in temporary storage and copies it back afterward, so the safest current read is an alias-safe packed 4x4 multiply helper rather than a narrower subsystem API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation + alias-staging correlation" +0x00588bd0,738,math_invert_4x4_matrix_variant_b_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Alternate MMX or 3DNow 4x4 matrix inverse helper. Like `0x005892aa`, the function expands the caller matrix into cofactor-like bands, optionally writes one determinant scalar through a caller out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the reciprocal-determinant-scaled inverse matrix through the caller output buffer. The safest current read is a second inverse helper variant rather than a tighter matrix-class claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation" +0x005892aa,820,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix inverse helper. The function expands the caller matrix into the expected cofactor bands, accumulates the determinant into one optional caller scalar out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the adjugate scaled by the reciprocal determinant through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation" +0x005895de,28,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow_wrapper,support,cdecl,inferred,objdump + local disassembly,2,"Tiny FEMMS wrapper around `0x005892aa`. It forwards the three caller parameters unchanged to the broader MMX 4x4 inverse helper and then returns the caller output pointer.","objdump + local disassembly + wrapper correlation" +0x005895fa,112,math_apply_3d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581830`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation" +0x0058966b,103,math_apply_3d_basis_rows_to_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581770`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller basis block, sums the three product bands, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation" +0x005896d2,95,math_normalize_vec3_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization sibling to `0x00581c00`. The function computes squared length from the caller XYZ triple, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vector when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XYZ result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation" +0x00589731,113,math_blend_vec3_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec3 control points and two caller scalar weights, then writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation" +0x005897a2,213,math_sample_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582320`. The helper derives four cubic-basis weights from the caller scalar parameter through the same local constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation" +0x00589876,234,math_sample_alternate_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582520`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation" +0x00589960,140,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005818f0`. The helper builds the same translated four-lane transform result from one caller XYZ triple and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation" +0x005899eb,456,math_apply_4d_basis_rows_to_four_vec4_rows_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581ab0`. The helper applies one caller 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed vec4 rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation" +0x00589bb2,5,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow_thunk,support,cdecl,inferred,objdump + local disassembly,2,"Jump thunk into `0x00589960`, the MMX or 3DNow projective vec3 transform helper.","objdump + local disassembly + wrapper correlation" +0x00589bb7,392,math_apply_vec3_through_optional_4x4_chain_and_optional_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Broader MMX or 3DNow projective transform owner over one caller vec3, up to three optional 4x4 matrix inputs, and one optional integer viewport-style range block. The helper selects identity, one matrix, or the ordered composition of two or three matrices through `0x005899eb`, applies the resulting chain through `0x00589960`, and when the optional range block is present remaps the projected normalized result into that caller integer range before returning.","objdump + local disassembly + matrix correlation + projective correlation + viewport-range correlation" +0x00589d3f,518,math_apply_vec3_through_optional_inverse_4x4_chain_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Inverse-side sibling to `0x00589bb7`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, inverts the chosen chain through `0x005892aa`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the inverse chain through `0x00589960`. The safest current read is an MMX unproject or inverse-projective helper without overclaiming one subsystem-specific API.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation" +0x00589f67,303,math_apply_vec3_through_optional_inverse_4x4_chain_variant_b_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Adjacent inverse-side sibling to `0x00589d3f`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, routes the chosen chain through inverse helper variant `0x00588bd0`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the resulting inverse chain through `0x00589960`. The safest current read is a second MMX unproject or inverse-projective helper variant rather than a tighter API claim.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation" +0x0058a0b8,79,math_apply_2d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581690`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation" +0x0058a10d,55,math_apply_2d_basis_rows_to_vec2_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581730`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller basis block, sums the two product bands, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation" +0x0058a146,100,math_apply_2d_basis_rows_translation_and_project_vec2_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005816d0`. The helper builds the same translated four-lane transform result from one caller XY pair and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation" +0x0058a1aa,153,math_sample_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005823e0`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation" +0x0058a242,71,math_blend_vec2_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005827c0`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 control points and two caller scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation" +0x0058a28b,65,math_normalize_vec2_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 normalization sibling to `0x00582320`'s lower-dimensional normalize helpers. The function computes squared length from the caller XY pair, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vec2 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XY result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation" +0x0058a2ce,172,math_sample_alternate_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582680`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation" +0x0058a379,130,math_apply_4d_basis_rows_to_vec4_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow duplicate-layout sibling to `0x0058a9ec`. The helper broadcasts the caller XYZW lanes, multiplies those broadcasts by the four rows of one caller 4x4 basis block, sums the four product bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation" +0x0058a3fb,95,math_normalize_vec4_or_zero_below_epsilon_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow four-lane normalization sibling to `0x00584379`. The function computes squared length across all four caller lanes, compares that magnitude against the nearby epsilon constant at `0x005df610`, returns a zero vec4 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized vec4 result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation" +0x0058a45a,306,math_compute_4d_cross_product_from_three_vec4_inputs_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product-style combination through paired multiply-subtract bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + 4d-cross-product correlation + caller correlation" +0x0058a58c,113,math_blend_vec4_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to the earlier affine blend strip. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 control points and two caller scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation" +0x0058a5fd,200,math_sample_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x00582470`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation" +0x0058a6c5,223,math_sample_alternate_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x005825e0`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation" +0x0058a7a3,65,math_build_plane_vec4_from_normal_vec3_and_point_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane builder over one caller normal vec3 and one point on that plane. The helper copies the incoming normal into the output `XYZ` lanes, computes the signed plane constant as the negated dot product of that normal with the caller point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation" +0x0058a7e6,229,math_build_plane_vec4_from_three_vec3_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross-product-style normal, normalizes that resulting plane normal, derives the signed plane constant from one source point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation" +0x0058a8ca,190,math_intersect_origin_plane_normal_vec3_with_vec3_segment_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow geometric intersection helper over one plane-normal vec3 and two caller segment endpoints. The function derives the numerator and denominator for the plane-through-origin affine parameter, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the MMX origin-plane-versus-segment sibling rather than a subsystem-specific query.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + segment-intersection correlation" +0x0058a988,98,math_normalize_vec4_by_xyz_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow normalization helper over one caller vec4-like input. The function measures length from the first three lanes only, compares that squared XYZ length against the nearby epsilon constant at `0x005df610`, and when large enough scales the full four-lane payload by one reciprocal-square-root refinement before writing it through the caller output; smaller inputs collapse to zero through the same mask path. Current grounded callers are the broader matrix builders `0x00585b9b` and `0x00585c86`, so this is the safest current read for the shared normalize-by-XYZ-length helper rather than a full XYZW normalizer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation" +0x0058a9ec,124,math_apply_4d_basis_rows_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005819f0`. The helper broadcasts each input XYZW lane, multiplies those broadcasts by the corresponding four rows of one caller 4x4 basis block, sums the four product bands, and stores the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation" +0x0058ac60,229,math_compute_interleaved_packed_sine_cosine_lanes_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles. The function performs sign extraction, range reduction, quadrant selection, and polynomial evaluation through the constant tables at `0x00628320..0x006283f0`, then returns one interleaved sine/cosine-style lane tuple in `xmm0`. Current grounded callers are the single-angle packed axial rotation-matrix builders `0x00583bb0` and `0x00583c30`, so the safest current read is an interleaved packed sine/cosine helper rather than a generic scalar polynomial.","objdump + local disassembly + polynomial-approximation inspection + trig correlation" +0x0058ad50,329,math_compute_packed_sine_and_cosine_vectors_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles and two caller output buffers. The function performs sign extraction, range reduction, quadrant selection, and dual polynomial evaluation through the constant tables at `0x00628400..0x00628520`, then writes one packed pair of sine/cosine result vectors through the two caller outputs. Current grounded caller is `0x00584210`, the packed Euler-angle-to-quaternion helper, so the safest current read is a packed sin/cos vector generator rather than a subsystem-specific math body.","objdump + local disassembly + polynomial-approximation inspection + trig correlation" +0x0058af80,244,math_compute_scalar_atan2_style_angle_from_y_and_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar angle helper over two caller float lanes. The function compares magnitudes, forms one min-over-max style ratio, evaluates a polynomial over that ratio, and then restores quadrant and sign through the constant strip at `0x006285d8..0x00628638`. Current grounded caller is quaternion slerp helper `0x005849eb`, so the safest current read is a scalar `atan2`-style angle worker rather than a narrower subsystem label.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation" +0x0058b080,247,math_compute_scalar_arccos_style_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The function clamps or folds the incoming magnitude against the nearby constant strip at `0x006285d8..0x00628638`, evaluates a reciprocal-square-root-assisted polynomial, and restores the correct signed or reflected branch before returning one angle-like scalar in `mm0`. Current grounded caller is quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar arccos-style angle worker rather than a tighter half-angle claim.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation" +0x0058b180,226,math_compute_scalar_arccos_style_angle_variant_b_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Adjacent MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The body shares the same reciprocal-square-root-assisted polynomial strip as `0x0058b080`, but finishes through a different reflected or complemented angle reconstruction path before returning one scalar in `mm0`. The safest current read is a second arccos-style angle variant rather than a tighter named inverse-trig identity.","objdump + local disassembly + polynomial-approximation inspection + trig correlation" +0x0058b280,233,math_compute_scalar_natural_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar logarithm helper over one caller float lane. The function decomposes the input into exponent and mantissa bands, evaluates a polynomial over the reduced mantissa through the constant strip at `0x00628648..0x0062866c`, folds back the exponent contribution, and returns one natural-log-style scalar in `mm0`. The nearby wrapper `0x0058b380` scales this result by `0.434294...`, which is the strongest current evidence for the natural-log interpretation.","objdump + local disassembly + polynomial-approximation inspection + logarithm correlation" +0x0058b380,17,math_compute_scalar_base10_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny wrapper over `0x0058b280`. The helper calls the natural-log worker and then scales the result by the float constant at `0x0062868c`, `0.434294...`, before returning; the safest current read is a shared base-10 logarithm helper.","objdump + local disassembly + constant inspection + logarithm correlation" +0x0058b3a0,224,math_compute_scalar_exponential_e_to_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Shared MMX or 3DNow scalar exponential helper over one caller float lane. The function range-reduces the input through the nearby `log2(e)` and split-`ln(2)` constants at `0x0062863c..0x0062864c`, evaluates the reduced polynomial strip, reconstructs the exponent field by shifting the derived integer part into float-exponent position, and returns one `e^x`-style scalar in `mm0` with the expected overflow and underflow clamps. The safest current read is a scalar natural-exponential worker rather than a subsystem-specific transform helper.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + exponential correlation" +0x0058b480,24,math_compute_scalar_square_root_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Tiny MMX or 3DNow square-root helper over one caller scalar lane. The body seeds one reciprocal-square-root estimate through `pfrsqrt`, refines it with `pfrsqit1` and `pfrcpit2`, multiplies that reciprocal-square-root by the original input, and returns the resulting square-root-style scalar in `mm0`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + square-root correlation" +0x0058b4a0,8,math_clear_scalar_float_sign_bit_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar absolute-value helper. The function clears the sign bit of the caller float lane with the mask at `0x00628578` and returns the resulting non-negative scalar in `mm0`.","objdump + local disassembly + constant inspection + absolute-value correlation" +0x0058b4c0,50,math_round_scalar_upward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a positive fractional remainder is still present, and adds one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `ceil`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation" +0x0058b500,37,math_round_scalar_downward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a negative fractional remainder is still present, and subtracts one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `floor`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation" +0x0058b540,64,math_split_scalar_float_into_normalized_mantissa_and_exponent_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar decomposition helper over one caller float lane. The function masks off sign and exponent bits, rebuilds a normalized mantissa lane with fixed exponent bits through the constants at `0x00628540..0x00628588`, derives the unbiased exponent as an integer-float lane, and returns the pair packed in `mm0`. The safest current read is a `frexp`-style mantissa or exponent splitter rather than a tighter ABI claim.","objdump + local disassembly + constant inspection + exponent-mantissa correlation" +0x0058b580,94,math_scale_scalar_float_by_integral_power_of_two_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar scaling helper over one caller float lane and one caller integer-like exponent lane. The function extracts the current exponent field, adds the requested exponent delta, reconstructs the float when the result stays in range, and otherwise returns the expected underflow or signed-overflow infinities through the mask strip at `0x00628568..0x00628580`. The safest current read is an `ldexp`-style scalar multiply-by-`2^n` helper.","objdump + local disassembly + constant inspection + exponent-mantissa correlation + scaling correlation" +0x0058b5de,18,math_split_scalar_float_into_fractional_and_integral_float_lanes_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar split helper over one caller float lane. The body truncates the input to integer with `pf2id` or `pi2fd`, subtracts that integral part from the original value, and returns the fractional and integral float lanes packed together in `mm0`. The safest current read is a compact `modf`-style split helper rather than a dedicated subsystem formatter.","objdump + local disassembly + split correlation" +0x0058b600,72,math_compute_scalar_fmod_style_remainder_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + arithmetic inspection,2,"Shared MMX or 3DNow scalar remainder helper over one caller dividend lane and one caller divisor lane. When the divisor is non-zero it multiplies the dividend by the reciprocal divisor, truncates that quotient toward zero, keeps only the fractional remainder, rescales by the divisor, and returns the resulting same-sign remainder in `mm0`; a zero divisor falls back to the constant at `0x00628578`. The safest current read is an `fmod`-style remainder helper rather than a tighter IEEE remainder claim.","objdump + local disassembly + arithmetic inspection + remainder correlation" +0x0058b660,280,math_compute_scalar_cosine_and_sine_pair_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The function performs sign extraction, range reduction, quadrant handling, and polynomial evaluation through the constant strip at `0x00628558..0x00628694`, then returns one packed cosine/sine-style lane pair in `mm0`. Current grounded callers are the MMX Euler-angle, axis-angle, scaled-axis, and single-angle rotation-matrix helpers, so the safest current read is a scalar cos/sin pair worker rather than a subsystem-specific helper.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation" +0x0058b780,280,math_compute_scalar_sine_lane_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The body matches `0x0058b660` through the same range-reduction and polynomial path, but duplicates the sine-like result lane before returning. Current grounded callers are quaternion slerp helper `0x005849eb` and quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar sine worker with duplicated output lane.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation" +0x0058b9e0,408,math_compute_scalar_power_x_to_y_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Broader MMX or 3DNow scalar power helper over one caller base lane and one caller exponent lane. The function preserves the sign of negative bases only when the exponent truncates to an integer with odd parity, derives the logarithm-like core from the absolute base through the same exponent or mantissa constants used by the adjacent scalar log worker, multiplies that core by the exponent, and then rebuilds the final result through the same exponential-style polynomial and exponent-field reconstruction family used by `0x0058b3a0`. The safest current read is a shared `pow(x, y)`-style helper rather than a narrower transform-specific claim.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + power correlation" +0x00571016,26,refcounted_object_vtable_0x5def30_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for object family `0x005def30`. The helper re-enters destructor `0x0057ad20`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x0057aedb`.","objdump + local disassembly + object-family correlation + refcount correlation" +0x00571032,26,refcounted_object_vtable_0x5def5c_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for sibling object family `0x005def5c`. The helper re-enters destructor `0x0057af0e`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + object-family correlation + refcount correlation" 0x0054eb10,376,shell_input_handle_window_command_and_toggle_messages,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one shell window-command or toggle-style input message into the shell-input ring. The helper tracks the last packed command or coordinate tuple under `[this+0xa94/+0xa98/+0xa9c]`, iterates eight local branch families, toggles selected state bits in `[this+0xa8c]`, synthesizes 12-dword records with types such as `1`, `2`, `5`, `6`, `7`, `8`, `9`, `10`, and `11`, and enqueues those records through `0x0054e880`. Current grounded caller is the `WM_COMMAND` branch in `shell_controller_window_message_dispatch` `0x0054e3a0`, so this is the safest current read for the shell-input command or toggle message owner rather than a generic control callback.","objdump + caller inspection + local disassembly + event-ring correlation + command-message correlation" 0x0054ee50,544,shell_input_handle_window_mouse_message_and_enqueue_events,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Primary shell mouse-message handler for the `0x0200..0x0208` window-message family. The helper first deduplicates repeated `WM_MOUSEMOVE` coordinates against globals `0x0062545c/0x00625460`, then routes the live message through the shared shell-input command or toggle worker `0x0054eb10` and the surrounding pointer-state branches. Current evidence grounds this as the mouse-message ingress owner beneath `shell_controller_window_message_dispatch` `0x0054e3a0`, with local state updates flowing into the event-ring helpers `0x0054e880`, `0x0054e9c0`, and `0x0054ea20`.","objdump + caller inspection + local disassembly + mouse-message correlation + event-ring correlation" 0x0054f290,480,shell_input_apply_window_key_transition,shell,thiscall,inferred,objdump + analysis-context,4,Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller.,objdump + analysis-context + import table + callsite inspection diff --git a/docs/atlas/company-and-ledger.md b/docs/atlas/company-and-ledger.md index 9990725..9a88c79 100644 --- a/docs/atlas/company-and-ledger.md +++ b/docs/atlas/company-and-ledger.md @@ -2,7 +2,7 @@ Primary atlas sources: -- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md) +- [event-editors-companydetail-and-loadscreen.md](/home/jan/projects/rrt/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md) This view isolates the company-side shell panes, linked-transit company maintenance, city-connection news, and annual finance-policy thresholds. diff --git a/docs/atlas/editor-and-site-service.md b/docs/atlas/editor-and-site-service.md index 61ad918..71520f9 100644 --- a/docs/atlas/editor-and-site-service.md +++ b/docs/atlas/editor-and-site-service.md @@ -2,8 +2,8 @@ Primary atlas sources: -- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md) -- [input-save-load-and-simulation.md#station-detail-overlay](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md#station-detail-overlay) +- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md) +- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md) This view isolates the map-editor page families, candidate and site-service runtime chain, and the station-detail or station-list read-side consumers. diff --git a/docs/atlas/route-entry-and-trackers.md b/docs/atlas/route-entry-and-trackers.md index f52e915..c1f5007 100644 --- a/docs/atlas/route-entry-and-trackers.md +++ b/docs/atlas/route-entry-and-trackers.md @@ -2,7 +2,7 @@ Primary atlas sources: -- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md) +- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md) This note isolates the lower route-entry, linked-site, route-link, and auxiliary tracker families that are easy to lose inside the broader runtime section. diff --git a/docs/atlas/runtime-and-world-tools.md b/docs/atlas/runtime-and-world-tools.md index 10a83e4..ff889db 100644 --- a/docs/atlas/runtime-and-world-tools.md +++ b/docs/atlas/runtime-and-world-tools.md @@ -2,7 +2,7 @@ Primary atlas sources: -- [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md) +- [runtime-roots-camera-and-support-families.md](/home/jan/projects/rrt/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md) This view keeps together the runtime-side shell input path, world-view tool surfaces, world bring-up pipeline, and the large shell-window families that hang off the recurring frame owner. diff --git a/docs/control-loop-atlas.md b/docs/control-loop-atlas.md index b88c1e9..21183c1 100644 --- a/docs/control-loop-atlas.md +++ b/docs/control-loop-atlas.md @@ -54,6 +54,13 @@ Detailed section: Detailed section: [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md) +Subsections: +- [runtime-roots-camera-and-support-families.md](/home/jan/projects/rrt/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md) +- [post-load-generation-paintterrain-and-save-load-restore.md](/home/jan/projects/rrt/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md) +- [event-editors-companydetail-and-loadscreen.md](/home/jan/projects/rrt/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md) +- [editor-breadth.md](/home/jan/projects/rrt/docs/control-loop-atlas/editor-breadth.md) +- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md) + ## Next Mapping Passes Detailed section: diff --git a/docs/control-loop-atlas/README.md b/docs/control-loop-atlas/README.md index e318814..c7339e6 100644 --- a/docs/control-loop-atlas/README.md +++ b/docs/control-loop-atlas/README.md @@ -15,4 +15,12 @@ section files when adding or reviewing grounded narrative content. - [map-and-scenario-content-load.md](/home/jan/projects/rrt/docs/control-loop-atlas/map-and-scenario-content-load.md) - [multiplayer-session-and-transport-flow.md](/home/jan/projects/rrt/docs/control-loop-atlas/multiplayer-session-and-transport-flow.md) - [input-save-load-and-simulation.md](/home/jan/projects/rrt/docs/control-loop-atlas/input-save-load-and-simulation.md) + +Input/Save/Load subsections: + +- [runtime-roots-camera-and-support-families.md](/home/jan/projects/rrt/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md) +- [post-load-generation-paintterrain-and-save-load-restore.md](/home/jan/projects/rrt/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md) +- [event-editors-companydetail-and-loadscreen.md](/home/jan/projects/rrt/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md) +- [editor-breadth.md](/home/jan/projects/rrt/docs/control-loop-atlas/editor-breadth.md) +- [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md) - [next-mapping-passes.md](/home/jan/projects/rrt/docs/control-loop-atlas/next-mapping-passes.md) diff --git a/docs/control-loop-atlas/editor-breadth.md b/docs/control-loop-atlas/editor-breadth.md new file mode 100644 index 0000000..48f8c5a --- /dev/null +++ b/docs/control-loop-atlas/editor-breadth.md @@ -0,0 +1,912 @@ +# Input, Save/Load, and Simulation: Editor Breadth + +### Editor Breadth + +The broader map-editor page owner is now bounded through + `map_editor_panel_select_active_section` `0x004ce070` and + `map_editor_panel_dispatch_active_section_message` `0x004cf700`, which switch among the grounded + setup pages, `Cities/Regions`, `Territories`, the `Players` and `Player Pool` setup slices, the + now-grounded `Building Density` page, the locomotives-available and industry-availability pages, + the economic and special-condition pages, the `Port/Warehouse Cargos` page, and the later report + pages. The mid-editor ownership is materially clearer now too: the chairman-slot editor is the + `Players` page, the available-chairman editor is the `Player Pool` page, and the former unnamed + dual tri-state page now lines up with localized page text `997` `Building Density` plus help text + `1017` and the direct field captions `1642` `Starting Building Density Level:` and `1644` + `Building Density Growth:`. Both controls are now bounded as stored ordinal bytes `0/1/2` rather + than loose labels: the first three-choice control is the map-wide starting-density selector, with + its default middle state `1` matching the documented `100%` baseline from `1643`; the second is + the paired overall growth selector whose effects later appear in the city-growth side of the + simulation. `map_editor_city_region_panel_construct` and + `map_editor_city_region_panel_handle_message` own the city-or-region editing lane with rename and + copy-industry-data flows. That copy side is tighter now too: the handler first enters + `0x00420e00`, which rebuilds the selected region's profile collection `[region+0x37f]`, clones + the source region's live label-weight entries when a source region is present, and otherwise + reseeds a fixed default weight set through repeated `0x004206b0` calls. The no-source companion + `0x00420ed0` now makes that split explicit: it rebuilds the same subcollection and then picks one + of two fixed default label-weight sets based on region class dword `[region+0x23e]`, using one + all-`0.2f` family for nonzero-class regions and one class-`0` family that starts with `0.3f` + before continuing with repeated `0.2f` entries. The lower mutator + `0x004206b0` then linearly scans the selected region subcollection by profile label, creates a + new profile only when the copied weight is positive, removes an existing profile when the copied + weight is non-positive, updates `[entry+0x1e]` otherwise, and refreshes the region's derived + availability-summary bytes `[region+0x2f6/+0x2fa/+0x2fe]` through `0x00420410`; `map_editor_territory_panel_construct` and + the adjacent no-source companion `0x00420ed0` is tighter too: it rebuilds the same collection + root `[region+0x37f]` but then seeds one of two fixed default profile-label sets directly through + repeated `0x004206b0` calls, splitting by region class dword `[region+0x23e]`. Nonzero-class + regions take one all-`0.2f` default set, while class-0 regions take a different set that starts + with one `0.3f` weight before continuing with repeated `0.2f` entries. That makes `0x420ed0` + the true class-split default-profile companion to the source-cloning helper at `0x420e00`, + rather than just more of the same editor copy path. Two neighboring collection queries are tight + enough now too. `0x00421d20` counts how many live regions have at least one profile row in + `[region+0x37f]` whose label matches the candidate-name string for one caller-supplied candidate + id; `0x00421e30` resolves the Nth such matching region. Both helpers reuse the same + `0x0041fac0` ordinal label-and-weight copy helper we just grounded, only increment once per + region, and skip nonzero-class regions whose companion count `[region+0x242]` is nonpositive. + Those two queries are what the editor summary side at `0x004cdd56/0x004cdeab` uses before it + formats per-region lists for one selected industry or profile name. The adjacent world-facing + query strip is bounded too: `0x00422010` scans the live region collection for class-0 regions + whose normalized coordinates fall inside one caller-supplied float rectangle, keeps the nearest + region id `[region+0x23a]` by squared XY distance through `0x0051db80`, and returns `0` when no + qualifying region is found; `0x004220b0` is the small wrapper above it that returns the matched + region name `[region+0x356]` or the fallback localized scratch string at `0x0062ba90`. + `map_editor_territory_panel_construct` and + `map_editor_territory_panel_handle_message` own the territory rename and border-remap lane; + `map_editor_locomotive_availability_panel_construct` plus + `map_editor_locomotive_availability_panel_handle_message` now bound the locomotive policy page + over `0x006ada84`; `map_editor_industry_availability_panel_construct` plus + `map_editor_industry_availability_panel_handle_message` do the same for the industry candidate + pool at `0x0062b268`; and `map_editor_port_warehouse_cargo_panel_construct` plus + `map_editor_port_warehouse_cargo_panel_handle_message` now ground the recipe-book page that edits + port or warehouse cargo policies through twelve per-book state blocks at + `[0x006cec78+0x0fe7+index*0x4e1]`. Each book now has a shared maximum annual production float at + `book+0x3ed` and five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`; each + line is bounded as a mode dword, annual amount, a supplied-cargo token at `+0x08`, and a + demanded-cargo token at `+0x1c`. The constructor and handler now make those fields materially + tighter too: the row pair shown in `Supply Only` and `Production Demand->Supply` is the `+0x08` + supplied-cargo selector, the row pair shown in `Demand Only` and `Production Demand->Supply` is + the `+0x1c` demanded-cargo selector, and the single amount field at `+0x04` is labeled `Annual + Demand:` only in mode `1` but `Annual Supply:` in modes `2/3`. The stronger new runtime-side + result is now a full chain rather than only the importer: + `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` first imports those same five + lines into one repeated array of identical `0xbc`-byte runtime descriptors with no row-index + special casing, and the candidate-side rebuild pass at + `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` then + projects those descriptors into the live structure collection at `0x0062ba8c` before + `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` rebuilds the + per-cargo runtime summary tables. The current local file-side result is now tighter too: the + grounded recipe-book root at `0x0fe7` is preserved byte-for-byte across the checked map/save + scenario pairs, so the loader can safely treat the twelve `0x4e1`-byte books as preserved + scenario payload rather than a drifting save-only band. A conservative summary probe now only + reports per-book head signatures, raw cap dwords at `+0x3ed`, and five raw line summaries rooted + at `+0x3f1` so the file-side structure stays aligned with this grounded ownership. The + player-facing line modes remain `Disabled`, `Demand Only`, `Supply Only`, and + `Production Demand->Supply`, and the fourth mode is tighter now too: current wording around + `1674`, `1675`, and `504` plus the downstream scaling path says it is the + production-line mode governed by the shared annual production cap, where the entered annual amount + stays on the supply side while the demanded side becomes the normalized input branch. The + candidate-side accumulator pass reinforces that split by applying the shared production cap only + to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The + lower gameplay side is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels` + `0x00412650` is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds + four per-cargo summary banks and returns one direct-supply channel, one cap-normalized supply + channel, one demand or input channel, and one scaled production-output subrow channel for a + requested cargo id. The internal indexing is tighter now too: the direct-supply lane indexes from + `[desc+0x1c]`, the demand or input lane uses that same resolved cargo id in the no-subrow branch, + and the scaled production-output lane indexes each subordinate row directly from + `[desc+0x44+row*0x1c]`, with no post-resolution failure guard between the importer writes and the + summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if + the imported low-16 marker rows fail the exact matcher at `0x0041e9f0`, the resulting `0` ids + will still hit the first summary-bank bucket inside `0x00412650`, but the semantic meaning of + cargo id `0` itself remains ungrounded. The sibling helper + `structure_candidate_supports_or_references_cargo_id` + `0x004129d0` then uses those same banks plus the cached cargo-membership arrays to answer whether + a live candidate materially references a cargo at all. One compare step tighter, the raw line + lanes now split cleanly by scenario family while still preserving map->save identity inside each + checked pair. `Alternate USA.gmp` and `Autosave.gms` match at the raw line-content level: books + `0..4` keep mixed line areas, their `line02` slots carry the recurring nonzero mode words + `0x00110000`, `0x000b0000`, `0x000b0000`, `0x00130000`, and `0x00180000`, and the same `line02` + slots also carry one recurring supplied token `0x000040a0`; the neighboring `line00/line01` + slots carry the same recurring demanded token lanes such as `0x00010000`, `0x72470000`, + `0x6f430000`, `0x694c0000`, and `0x694d0000`. `Southern Pacific.gmp` and `p.gms` also match at + the raw line-content level, but the same rooted line slots stay zero in the checked pair. + `Spanish Mainline.gmp` and `g.gms` again match at the raw line-content level yet carry a distinct + nonzero pattern: books `0..4` keep mixed line areas, line-level supplied tokens include + `0x00170000`, `0x00150000`, `0x00004040`, and `0x00004000`, demanded tokens include + `0x00010000`, `0x68430000`, and `0x6c410000`, and the later `line02` mode words stabilize at + `0x00070000` then `0x00010000`. So the loader can now safely treat these raw line lanes as + preserved scenario payload with family-specific signatures, even though the exact cargo-id and + mode-enum semantics still need separate grounding. One inference is tighter now too: when those + demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte + order reads as short two-letter stems such as `Gr`, `Co`, `Li`, `Mi`, `Ch`, and `Al`, which fit + the current scenario cargo-name families `Grain`, `Corn`, `Livestock`, `Milk`, `Cheese`, and + `Alcohol` from `RT3.lng`; the runtime probe now exposes those only as probable ASCII stems, not + as fully grounded cargo-id decodes. The supplied-token side is now bounded as a separate layout + family rather than forced into that same stem model: the `Alternate USA` family uses one stable + low-16 marker `0x000040a0` only in `book00..04.line02`, the `Southern Pacific` family leaves the + supplied lanes zero in the checked pair, and the `Spanish Mainline` family splits between two + high-16 numeric tokens `0x00170000` and `0x00150000` in `book00/01.line01` plus the later low-16 + markers `0x00004040`, `0x00004000`, and `0x00004040` in `book02..04.line02`. The probe now + exposes those conservatively as token-layout classes `high16-ascii-stem`, `high16-numeric`, and + `low16-marker`, without claiming that the non-stem numeric or marker families are decoded yet. + One more structural layer is stable enough to name conservatively: the checked nonzero recipe + rows repeatedly fall into four line-signature classes. `Alternate USA` books `0..4` all expose + one `demand-numeric-entry` at `line00` (`0x00010000`), one `demand-stem-entry` at `line01` + (`Gr/Co/Li/Mi` stems), and one `supply-marker-entry` at `line02` (nonzero mode plus + `0x000040a0`). `Spanish Mainline` books `2..4` expose that same three-line pattern with + `Ch/Al` stems and the `0x00004040/0x00004000` marker family, while books `0/1` only expose the + earlier `supply-numeric-entry` form at `line01`. So the loader can now distinguish recurring row + roles such as demand-stem versus supply-marker without pretending the marker payloads themselves + are decoded. The importer-side branch map is tighter now too because local `objdump` over + `0x00435630` shows that only nonzero mode dwords materialize into `0xbc` runtime descriptors: + mode `0` lines are skipped entirely, mode `1` enters the demand-only branch, mode `3` enters the + dual demand-plus-supply branch, and every other nonzero mode falls into the supply-side branch. + In the checked corpus that means the recurring `demand-numeric-entry` and `demand-stem-entry` + rows in `Alternate USA` and `Spanish Mainline` are preserved scenario-side line records but do + not become live runtime descriptors, while the later `supply-marker-entry` rows are the ones that + actually reach the runtime import path. The runtime probe now exposes that directly as + `imports_to_runtime_descriptor` plus one conservative `runtime_import_branch_kind`. + The raw token windows beneath those branch labels are tighter now too. The checked mode-zero + demand rows preserve string-bearing windows at `line+0x1c`, and the current probe shows those + conservatively as prefixed ASCII previews such as `..Grain`, `..Corn`, `..Livestock`, and + `..Milk`; local `objdump` over `0x0041e9f0` then shows the importer feeding the corresponding + token buffer into an exact cargo-name matcher built over the live cargo collection at + `0x0062ba8c`. By contrast, the imported `supply-marker-entry` rows feed nonprintable windows such + as `.@...` from `line+0x08` through that same matcher, and the resolver path currently shows no + special-case decoding for those marker forms. So the strongest static read is now: the stem-like + demand rows preserve cargo-name text but are skipped because their mode is zero, while the + nonzero imported marker rows are the live descriptor inputs yet likely fail exact cargo-name + resolution unless another upstream transform exists. + The wrapper layer above that query no longer looks like a hiding place for special treatment + either. Local `objdump` now shows `0x00412960` simply summing the two supply-side floats returned + by `0x00412650`, while `0x004129a0` returns the single scaled production-output lane directly; + neither wrapper checks for cargo id `0` after the query returns. The broader world-side + accumulator at `0x0041e7be` is tighter in the same way: it calls `0x00412650`, requires all four + returned channels to be positive before continuing, and only then scales those four channel + values by one linked-instance count from `0x00413940` into caller-owned accumulators. So the + current strongest read remains structural rather than semantic: unresolved marker rows can still + propagate through the first bank bucket, but the first place that meaning matters is a normal + positivity-gated cargo-channel consumer, not a dedicated null-cargo branch. + The caller side is narrower than before too. The steady-state site bitset owner + `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` starts its inner cargo + loop at id `1` and only walks upward through the current live cargo count, so it never + intentionally queries cargo id `0`. The broader placed-structure sweep around `0x00452e60` + tightens the same boundary from above: when the requested cargo id is nonzero it resolves the + backing candidate and enters `structure_candidate_supports_or_references_cargo_id`, but when the + requested id is exactly `0` it skips that cargo-reference helper entirely and falls through to a + different linked-site or station-or-transit gate. Current local `objdump` now shows that bypass + first requiring one subtype latch through the placed-structure vtable `+0x70`, then resolving the + linked site id at `[site+0x2a8]` through the placed-structure collection `0x006cec20`, and then + forwarding that linked peer into the narrower predicate at `0x0047fd50`. That narrower helper is + tighter than before too: it resolves the linked peer's backing candidate through the peer site id + at `[peer+0x04]`, reads candidate class byte `[candidate+0x8c]`, and returns true only for the + first three class values `0/1/2` while rejecting `3/4` and anything above `4`. So current local + callers treat cargo id `0` as a nonstandard request bound to one linked-site reachability or + classification side path, not one ordinary cargo lane they routinely probe. + The vtable-`+0x70` latch itself is bounded a bit better now too. It still lacks a direct field + decode, but every local callsite we checked around `0x0040d230`, `0x0040dba0`, `0x0040dbf0`, and + `0x0040f670` uses that slot only as the precondition for touching `[site+0x2a8]` and the + neighboring linked-site helpers `0x0047dda0`, `0x0047fd50`, and `0x004138b0`. That makes the + safest current read a linked-site-bearing or linked-site-capable latch, strongly aligned with the + subtype-`1` construction lane that is the only grounded writer of `[site+0x2a8]`, rather than a + broad cargo or route-style predicate. + The neighboring maintenance pair tightens that linked-site read further. Local `objdump` now + shows `0x0040dba0` and `0x0040dbf0` as complementary tiny helpers that each require the same + vtable-`+0x70` latch, resolve optional linked peer id `[site+0x2a8]` through `0x006cec20`, + forward that linked peer (or null) into `0x0047dda0`, and then mirror opposite values into local + byte `[site+0x42]` (`0` for `0x0040dba0`, `1` for `0x0040dbf0`). The route-entry side beneath + them is tighter too: `0x0047dda0` reads route-entry anchor id `[peer+0x08]`, resolves that anchor + through `0x006cfca8`, and only dispatches one of two route-entry vtable calls when + `0x0048a090(1)` reports that all three anchor-slot dwords `[entry+0x206]`, `[entry+0x20a]`, and + `[entry+0x20e]` are still `-1`. So the strongest current read is no longer just "linked-site + capable" in the abstract: this latch consistently fronts the local linked-peer class gate + `0x0047fd50`, the paired `[site+0x42]` route-entry state toggles, and the later linked-peer + collection sweep `0x004138b0`, which keeps the `cargo id 0` bypass path firmly on the + linked-site route-anchor or classification side rather than on an ordinary cargo lane. + One smaller ownership boundary is tighter too: byte `[site+0x42]` is not private scratch owned + only by that pair. Local `objdump` shows tiny direct setters at `0x0040cbc0` and `0x0040cbd0` + plus a raw getter at `0x0040cbf0`, so the `0x0040dba0/0x0040dbf0` pair is writing one shared + placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution + is tighter now too: there are later mode-gated reads at other addresses that also touch a + `+0x42` byte on their own object layouts, but current local evidence does not yet prove those are + the same placed-structure owner family, so the safest current note keeps only the immediate + `0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0` cluster grounded together. + The vtable side sharpens that split too. A local `.rdata` scan shows `0x0040dba0` and + `0x0040dbf0` each appearing exactly once, together with `0x0040cbf0`, in one method table rooted + at `0x005c8c50`; the constructor chain is tighter now too, because `0x0040c950` installs that + same table as one concrete placed-structure specialization above the common base table + `0x005cb4c0`, while `0x0040c970` tears the same specialization back down to the base before the + temporary object is freed. By contrast the raw set or get trio + `0x0040cbc0/0x0040cbd0/0x0040cbf0` also appears in several sibling tables such as `0x005c9750` + and `0x005dd1f0`. So the strongest current structural read is that byte `[site+0x42]` belongs + to one broader placed-structure virtual interface, while the linked-peer route-entry toggles are + one specialization-specific override pair inside that family rather than generic setters used by + every sibling. + One negative boundary is tighter now too: the + raw token words in this recipe block do not look like the already grounded shell-side + `AnyCargo/AnyFreight/AnyExpress` selector-table ids from `0x00621e04/0x00621e10`, so the current + best read is that these on-disk line tokens are not just copied UI selector ordinals or the same + small express-side id family in another wrapper. One broader collection pass also now ties + the editor rule side back into runtime filtering: + `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0` rebuilds + per-candidate flag `[candidate+0x56]` across the live structure collection, and current grounded + callers show it rerunning directly off the runtime cargo-economy latch at `[0x006cec74+0x25f]`, + which aligns this lane with the editor's `Disable Cargo Economy` special condition rather than + leaving it as a purely editor-owned recipe page. The first common live gate beneath that filter is + now bounded too: `structure_candidate_is_enabled_for_current_year` `0x0041e220` is the shared + year-and-filter check used by the collection refresh and later candidate-selection branches, while + `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0` is a setup-side local service + scorer that already consumes the same enabled candidate records through world-grid sampling. One + steady-state world-side consumer is now grounded as well: + `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` walks linked placed + structures, filters live category-`2` candidates through + `structure_candidate_is_enabled_for_current_year`, and compacts the direct and scaled supply-side + channels from `0x00412960` and `0x004129a0` into per-cargo bitsets on the placed-structure record. + The next site-side owner layer is tighter now too: + `placed_structure_refresh_linked_candidate_flag4` `0x0042c8f0` refreshes the sibling state bit at + `[site+0x0e6]`, `placed_structure_refresh_candidate_service_state` `0x0042cdf0` ties that flag + refresh to the cargo-service bitset rebuild, + `placed_structure_rebuild_candidate_local_service_tables` `0x0042ce00` then performs the heavier + per-site candidate score rebuild over the aligned float and word tables at `[site+0x107]`, + `[site+0x02]`, and `[site+0x6c]`, and `placed_structure_refresh_local_service_score_bundle` + `0x0042d580` is now the local wrapper that chains that rebuild into the neighboring post-passes + before the world-grid owner continues. Those post-passes are tighter too: + `placed_structure_apply_route_linked_service_caps` `0x0042cc50` is the first route-backed cap pass + over the rebuilt local tables, + `placed_structure_redistribute_local_service_pressure_from_neighbors` `0x0042c1b0` is the + neighboring-site redistribution pass, and `placed_structure_clamp_candidate_service_age_table` + `0x0042cb30` is the final recent-service clamp over the primary per-candidate word table. Above + that refresh lane, `placed_structure_query_candidate_local_service_metrics` `0x0047e240` is the + first higher-level query, `placed_structure_count_candidates_with_local_service_metrics` + `0x0047e330` counts how many candidates currently produce that query, + `placed_structure_get_nth_candidate_id_with_local_service_metrics` `0x0047e620` is the ordinal + selector over that same visible candidate family, + `placed_structure_query_cached_express_service_class_score` `0x0047e390` caches one parallel class + score for the express family now strongly aligned with `Passengers`, `Mail`, and `Troops`, + `placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site` + `0x0047eb90` rebuilds one peer-site comparison cache over the same local-service inputs, and + `placed_structure_select_best_candidate_id_by_local_service_score` `0x0047f910` is the best-hit + selector above the direct and directional local-service query pair. Those site-side scores now + have grounded shell read-side consumers too: + `shell_station_detail_format_freight_and_express_summary` `0x00506be0` formats the visible + `Freight: %1` and `Express: %1` lines in `StationDetail.win`, and the same station-detail family + now has a deeper candidate-service lane: + `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` stores the active + `(station id, candidate id)` pair for the world-side preview scan and now grounds the whole + world-side arming strip through + `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active` + `0x00452f60`, + `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`, + `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` + `0x00452db0`, and + `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`, + `shell_station_detail_clear_active_candidate_service_preview` `0x00504a90` tears that pair back + down, `shell_station_detail_update_candidate_service_entry` `0x00504ba0` is the shell-side entry + updater above that preview pair, `shell_station_detail_format_candidate_local_service_summary` + `0x00504bea` uses `placed_structure_query_candidate_local_service_metrics` together with localized + ids `681`, `682`, and `2813` to build the visible candidate service text, + `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150` now grounds the paired `To` + and `From` hauled-traffic strip widgets, `shell_station_detail_present_to_from_haul_stats_popup` + `0x00504770` owns their click-through annual and lifetime `hauled TO/FROM this station` popup, + `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470` owns the five-row + nearby-structure jump lane, and `shell_station_detail_refresh_candidate_service_rows` `0x00505760` + is now the larger row-list owner that enumerates active candidate-service entries and wires + `shell_station_detail_update_candidate_service_entry` into the per-row click path. The broader + owner above those lanes is tighter now too: `shell_station_detail_window_refresh_controls` + `0x00506610` is the real `StationDetail.win` refresh pass, validating the current station from the + detail manager, publishing the upper summary lane, splitting the `0xb3b7/0xb3b8` action strip by + scenario latch `[0x006cec74+0x1db]`, routing that scenario branch through + `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590`, routing + class `3/4` sites into the alternate branch + `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and otherwise rebuilding the nearby-structure lane, the paired `To/From` widgets, + and the candidate-service rows together. The broader message side is bounded now too: + `shell_station_detail_window_handle_message` `0x00505e50` owns the wide `StationDetail.win` + switch over message ids `0`, `0xca`, `0xcb`, and `0x3ea`, routes candidate-service rows + `0xb4dc..0xb5a3` into preview arm or clear or a Ctrl-modified `Overview.win` handoff, routes + nearby-structure rows `0xb40a..0xb413` into the detail transition and optional world-centering + path, refreshes control `0xb3f8` on the `0x3ea` branch, and dispatches the lower + `0xb3b5..0xb3bf` action band through the selected-station ownership and class-gated helper strip. + The compact siblings under that pass are tighter now too: + `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` is the dirty + clear owner over the dynamic row bands and the paired haul widgets, `shell_station_detail_has_valid_selected_station` + `0x00504370` is the bare selected-station validity probe, `shell_station_detail_selected_station_belongs_to_selected_company` + `0x00504390` is the selected-company ownership gate, and + `shell_station_detail_present_selected_station_not_controlled_notice` `0x005043f0` is the + localized not-controlled popup beneath the same action family, + `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` is the + scenario-latched station-to-station triplet popup that formats three per-destination scalar lanes + with `%5.2f` or `N/C`, and + `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0` is the alternate + class-`3/4` branch that rebuilds the `Trains Serviced` / `Trains Maintained` matrix before + reusing the shared haul-popup callback wiring, + `shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0` + refreshes the lower class-gated action strip rather than the older guessed `0xb3f8` lane. The + adjacent lifecycle and navigation side is tighter now too: + `shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton` `0x00505bf0` + is the real `StationDetail.win` destructor, and + `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` + `0x00505cb0` plus wrappers `0x00505e30` and `0x00505e40` now bound the next-or-previous station + stepping path that keeps the selection inside the same owner and station-site class family before + optionally recentering the world view. The broader shell command layer above that station-detail + branch is tighter now too: + `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00` and + `shell_command_step_active_window_subject_backward_or_publish_contextual_notice` `0x00440f20` + are the paired next-or-previous shell commands that first prefer `StationDetail.win`, then the + live building-detail family, then `CompanyDetail.win`, and finally the sibling singleton at + `0x006d3b20` before falling back to the localized notice pairs `0x017a/0x017b` and + `0x017c/0x017d`. The adjacent direct subject-openers are tighter now too: + `shell_open_or_focus_train_detail_for_current_or_first_owned_train` `0x00441040` reuses current + detail subject `[detail+0x78]` or falls back to the first owned train for the selected chairman + company before re-entering `shell_detail_panel_transition_manager` with mode `2`, while + `shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station` `0x004410d0` + reuses `[detail+0x80]` or falls back to the first owned linked station before the same transition + manager is re-entered with mode `5`. Two later registered command siblings are now bounded only + structurally but still usefully: `0x00441160` requires active scenario plus live world root + `0x0062c120` and dispatches either + `world_enable_preview_mode_0x15_latch_and_enter_if_idle` `0x00453370` or + `world_disable_preview_mode_0x15_latch_and_clear_if_active` `0x00453780` by the query at + `world_query_preview_mode_0x15_latch_active` `0x00450150`, + while `0x004411a0` requires active scenario plus live route-store root `0x006cfca8` and + dispatches either `0x00491880` or `0x004932a0` by the boolean result of `0x004934a0(0)`. + The next registered shell-command strip is bounded the same way now: + `shell_command_toggle_shared_world_preview_global_0x62be84` `0x00441240` flips the shared + preview-oriented global `0x0062be84`, + `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260` + and `...variant_1...` `0x004412a0` both route through + `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`, + which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across + detail controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards + the selected variant into + `world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty` `0x0043a0a0`, and + `shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds` `0x004412e0` + re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` and then rewrites the + paired shell-state dwords at `[0x006cec74+0x1df/+0x1e3]` through `0x00482850`. Those three + commands are still structurally named rather than semantically named, but the current static owner + boundaries are now explicit. The same command band is tighter at both edges too: `0x004411e0` + simply flips presenter dword `[0x006d4024+0x114276]` when the main shell presenter is live, and + `0x00441200` is the adjacent active-scenario gate that injects shell message `0xcb` for control + `0x9858` through + `shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars` `0x00538e00`. The later edge + of the same shell strip is bounded too: + `0x00441ac0` and `0x00441af0` are the two small active-scenario plus shell-idle wrappers over + `shell_map_file_entry_coordinator` `0x00445ac0`, forwarding flag triplets `(0,0,0)` and + `(0,1,0)` respectively, while `0x00441b20` is the neighboring live-world clamp that ensures + `[world+0x168d]` never falls below `[world+0x1689]`. The next broader neighbor is now grounded + too: `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` is the + real editor-map-mode toggle owner above `0x00482e50`. It branches on current shell mode + `[0x006cec74+0x68]`, uses one-shot latches `0x0062be88` and `0x0062be8c` to gate localized + warnings `0x017e` and `0x0b24`, and on the non-editor side can instead raise warning `0x0b6e` + when `0x004349a0` reports more than one active profile. After those gates it forwards target mode + `([shell+0x68] == 0)` into + `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. + The adjacent startup-year strip is grounded now too: + `shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar` `0x00441cb0` + and `shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar` + `0x00441d20` are the paired registered commands beneath localized ids `0x0db5/0x0db6`. Both + require active scenario state plus the same single-profile gate from `0x004349a0`, clear shell + dwords `[0x006cec74+0x233]` and `[+0x124]`, then adjust startup scalar `[0x006cec78+0xbfa]` by + `+0.5` or `-0.5` before re-entering + `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute + counter `[0x006cec78+0x15]` and refreshing the live world view through `0x00439a80`. The exact + player-facing command labels are still open, but the static owner boundary is now clear: these + are not generic shell scalars, they are the paired half-step selected-year presentation commands. + The adjacent progress-status side is tighter now too: + `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90` is the shared save or load + progress payload builder, and + `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` is the + throttled callback installed at `0x00442960` through global `0x00d93988`. That callback advances + the progress latches `0x0062bec8/0x0062becc/0x0062c118`, rebuilds the percent payload through + `0x00441d90`, republishes it through `0x00538c70`, and services the shell frame through + `0x00482160`. The surrounding `0x00445de0` callers keep that pair on the save or load progress + side of the shell strip rather than as another input-command family. The adjacent companion-image + file seam is bounded now too: + `shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags` + `0x00441f70` and + `shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path` + `0x004420f0` are the paired `_A.tga` / `_A.jpg` import and export helpers around the same + tagged selector strip at `0x00441ec0`. Both derive an extensionless stem through + `support_copy_string_stem_before_first_dot` `0x0051dde0`, choose the `_A.tga` versus `_A.jpg` + suffix by selector byte `[record+0x09]`, and then shuttle the file bytes through the shared + staging descriptor rooted at `0x0062bed4/0x0062bed8`. That keeps the family grounded on the same + fallback descriptor later reused by + `world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback` `0x00535430`, + instead of leaving it as an isolated save-side file copier. The neighboring exporter + `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100` + `0x00442ba0` is bounded now too: it copies the live setup payload from `[this+0x66be]`, + patches world dimensions and three shell bytes into offsets `+0x01..+0x0b`, and then + normalizes the embedded `0x100 x 0x100` pixel block at `+0x03c2` through `0x0047a120` + before the save-side callers forward that same record into `0x00441ec0` or the tagged + slot-table serializer at `0x00446312`. The broader sibling + `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46` + `0x00442740` is bounded now too: it copies the embedded preview pixels at `[record+0x03c2]` + into a temporary `0x40000`-byte RGBA buffer, constructs one temporary `0xec`-byte surface-like + owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, forwards the caller path + plus fixed selector `0x46` into `0x00542f50`, stores the returned dword into payload field + `[record+0x18]`, and then releases the temporary owner again through `0x00542c90` and + `0x0053b080`. That keeps the short save-side branch at `0x00445925` grounded as a one-shot + preview-surface query helper rather than leaving another anonymous image-copy leaf between the + tagged export path and the progress notice strip. The broader sibling + `shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback` + `0x004427c0` is now bounded as the temporary-path owner above that same tag strip: it derives + `%1.tmp` from the source path, installs progress callback `0x00441e20` in `0x00d93988`, + rewrites the middle payload band rooted at `+0x03ce` through `0x00553000`, writes the result + back out through `0x005a276f`, updates payload dword `[record+0x18]`, and only then re-enters + `0x00441ec0`. + The sibling `shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags` + `0x00442900` is bounded now too: it takes the live payload record in `EAX`, reads the full + companion file named by the caller path, installs the same progress callback, rewrites the + middle payload through `0x00553000` using stored offsets `[record+0x18/+0x1c]`, and then writes + the output back in four spans: the leading `0x03ce` bytes, the transformed middle payload, the + untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. It then stores the + caller path back into `[record+0x18]` and re-enters `0x00441ec0`. That closes the offset-driven + save-side sibling reached from `0x004459dd` after `0x00441f70`, so the companion-payload strip + is no longer split between one named temp-path owner and one anonymous offset-band rewrite body. + The underlying temporary-surface seam beneath those save-side helpers is bounded now too. + `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10` + scans the eight-entry row band `[this+0xa0..+0xbc]`, allocates one `0x32`-byte row, seeds width, + height, and type, and returns the chosen slot index; `0x00541ba0` is the indexed release-side + companion. `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` is the + named-resource dispatcher used by `0x00442740`: it opens the caller-seeded resource path, + forwards the result into `0x005428c0`, and then dispatches by imported row type + `[row+0x18] = 2/3/4`. `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish` + `0x005438d0` is the commit-side publish helper over the active RGBA backing buffer + `[row+0x26]`, while `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` + `0x00543980` is the constructor or ensure owner that allocates one first-use slot through + `0x00541b10(..., width, height, 3)` and then commits the caller pixels through `0x005438d0`. + That keeps the save-side preview seam tied back to the same reusable surface-owner family already + visible in the world-presentation and shell-overlay branches, instead of leaving the temporary + preview query path grounded only at the leaf helper level. + The lower surface-owner base is bounded now too. `surface_owner_base_init_and_register_on_global_list` + `0x00540e30` seeds the fixed owner label, capability bytes, helper-object pair, row-slot bands, + and global intrusive registration under `0x00ccbb2c`; `surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers` + `0x00540fc0` is the shared maintenance owner that recomputes cached byte totals `[this+0xcc/+0xd0]` + across the eight row slots and also owns the full row-buffer release pass; and + `surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate` `0x00541210` + is the row-side repack body that converts the active backing pixels into the live 16-bit buffer + `[row+0x2a]`, either through a palette-like accumulated-channel path or a direct nibble-packed + conversion path depending on owner byte `[this+0x96]`. That closes the reusable surface family + one layer deeper instead of stopping at the first slot allocator and commit helpers. + The two remaining compact helpers in that same seam are bounded now too. + `surface_owner_query_dimension_cap_from_mode_and_quality_band` `0x00541160` derives the active + power-of-two size cap `0x100/0x200/0x400/0x800` from owner byte `[this+0x05]`, shell gate + `[0x006d4024+0x11422f]`, and selector dword `[this+0xd8]`, while + `surface_owner_probe_named_file_for_type2_header_signature` `0x005411c0` is the adjacent file + probe that opens one named path, reads `0x12` header bytes, and accepts only the local type-`2` + signature. The broader survivor above them is bounded now too: + `surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream` `0x005428c0` + allocates temporary alpha and RGB planes from the active row, splits the current backing pixels, + seeds the local codec object, and then writes the tagged record family `0xbaba/0xbabb/0xbabe` + into the already-open stream, either directly or through the transformed payload path via + `0x00553000`. That closes the immediate import-export seam under `0x00542f50`; the next open + work in this branch is no longer a still-missing leaf, but the broader type-specific row owners. + Those are bounded now too. `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` + `0x00541c30` is the type-`4` importer that validates the `0xbabe` lead tag plus the later + `0xbaba/0xbabb` branches, reconstructs one RGBA row from the tagged payload bands, and then + re-enters `0x00541210`. `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer` + `0x00542030` is the type-`3` importer that validates the recovered width, height, and pixel-size + header, allocates a full RGBA destination plus temporary staging, and decodes the supported + `0x18`/`0x20` source families into RGBA rows. `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` + `0x00542d50` is the type-`2` importer: it validates `DDS `, enforces the dimension cap from + `0x00541160`, copies the block-compressed payload from offset `0x80`, stores format tag + `DXT3`, and optionally materializes the live companion buffer through `0x005423d0`. + That closes the current type-dispatch branch under `0x00542f50` without leaving its three row + owners as anonymous stream bodies. + The direct export-side sibling is bounded now too. + `surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file` `0x00542b30` + is the paired file-write alternative to `0x00542f50`: it opens one caller path in `wb` mode, + builds the compact `0x12`-byte header with row type `2`, first-row width and height, fixed + pixel-size byte `0x20`, and one optional `0x20` flag bit from the second caller argument, then + optionally forces RGBA materialization through `0x00541970` and writes the first-row RGBA payload + `[row+0x26]` plus that header to the open stream. The paired callers at `0x00520cda`, + `0x00520f61`, and `0x00534dd6` all use it as the direct-file branch immediately before the same + temporary-surface release through `0x00542c90 + 0x0053b080`, so the current export/import seam is + no longer split between one named importer and one anonymous file-write sibling. + The small dispatch sub-strip under that importer is bounded now too. + `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0` is the direct selector over + embedded row type `[row+0x18]`, routing type `2/3/4` to `0x00542d50/0x00542030/0x00541c30`. + The wrapper immediately above it, + `surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure` `0x00543000`, + clears selector field `[this+0x07]`, allocates one fresh row slot through `0x00541b10`, + re-enters `0x00542fb0`, drops the slot again through `0x00541ba0` on the `1/2` failure paths, + and then refreshes cached byte totals through `0x00540fc0`. That closes the type-dispatch seam + between the file-open owner and the per-row import bodies instead of leaving one more anonymous + slot wrapper in the middle. + The lower lifecycle in that same surface-owner family is tighter now too. + `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` is the + shared query-or-materialize helper for non-type-`2` rows: it optionally returns width and height, + returns `[row+0x26]` when RGBA backing pixels already exist, and otherwise expands the live + 16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords before storing the new backing + pointer back into `[row+0x26]`. The broader sibling + `surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers` `0x00542550` + is the next owner above that helper: when shell capability byte `[0x006d4024+0x11422d]` is live + and local latch `[this+0x95]` is still clear, it revisits the active row slots, skips type-`2` + and already-processed rows, forces RGBA materialization through `0x00541970`, marks row byte + `[row+0x21]`, seeds row state `[row+0x1c] = 0x3c`, discards the previous 16-bit output buffer, + and rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA + source, halving `[row+0x04]` on the `0x20`-pixel-size branch. The release-side owner is bounded + now too: `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90` + releases optional helper roots `[this+0xdc/+0xe4]`, unlinks the owner from the global intrusive + list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter when `[this+0x93]` + is set, and then drops both the selector-side handle and all row slots through + `0x00541780` and `surface_owner_release_all_row_slots_0xa0` `0x00542870`. That closes the + reusable surface-owner seam one level deeper instead of stopping at construction, import, and + commit helpers. + The remaining tiny surface-owner leaves in that strip are bounded now too. + `surface_owner_query_first_row_width_or_one` `0x00541aa0` and + `surface_owner_query_first_row_height_or_one` `0x00541ad0` are the fallback-safe first-row + geometry getters used by later projection and world-presentation math paths, while + `surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0` `0x00541bf0` + simply refreshes cached scalar `[this+0xd4]` from the live shell presenter and returns + `[this+0xc0]`. The last tiny release helper `surface_owner_release_selector_handle_0x07_if_present` + `0x00541c10` does exactly what the current name says: when `[this+0x07]` is live it re-enters + `0x00541780` and clears that handle back to zero. + The later owner `shell_apply_scenario_name_specific_post_load_world_and_object_fixups` + `0x00442c30` is bounded now too: `world_entry_transition_and_runtime_bringup` re-enters it at + `0x00444b50` with the loaded scenario title, and it dispatches on many fixed `.rdata` names + including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, + `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, + `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload + byte `[this+0x66de]`. The matched branches then perform targeted live-world edits rather than a + generic title-side publish: they patch object-state dwords and bytes inside collections rooted at + `0x0062be18`, `0x0062bae0`, and `0x006ada80`, adjust selected float and scalar fields, copy + paired ten-dword record blocks when specific name/class pairs match, flip secondary-raster bits + through table `0x005ee508..0x005ee5cc`, retune a later collection at `0x0062b268`, and inject + scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated + `0x0051e5d0`. That finally makes the broad post-load scenario-fixup seam explicit instead of + leaving it as an unbounded string-switch body beneath world entry. + One neighboring status helper is bounded now too: + `shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks` `0x00442660` is the + shared byte-delta and elapsed-time notice builder used by both the bundle-service strip and the + save-side progress loop. It measures the current byte counter through `0x00530b70`, formats the + rounded kilobyte delta and elapsed ticks through `%5d` and `% 4d`, packages them through + `0x005193f0 -> 0x00518de0 -> 0x0051d680`, and then updates the running previous-counter latch + `0x0062c11c`. + That setter writes `[shell+0x68]`, then either rebuilds the editor-side shell surface through + `0x004d4500` or refreshes the detail-panel and world side through `0x004d44a0`, `0x004dfda0`, + and `0x0044fb70`, before both branches pulse graphics side effects through `0x00484d70(0x0d, 1)`. + The adjacent display-settings strip is bounded now too: + `shell_command_cycle_display_resolution_forward` `0x00483680` is the registered `+1` command + wrapper into `shell_cycle_display_resolution_and_publish_status` `0x00483780`, while + `0x00483990` and `0x004839a0` are the plain `+1` and `-1` wrappers into that same shared owner. + The owner requires the live shell presenter `0x006d4024`, walks the supported resolution tables + at `0x00620e64/0x00620e7c`, applies the chosen size through `0x005206b0`, publishes the updated + size string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, and then refreshes dependent + presentation state through `0x004625b0`, `0x00484910(1)`, and `0x004821d0`. After that point the + embedded world-view controller strip is tighter now too. + `world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet` + `0x00439820` samples a five-point local clearance ring around the current eye X/Z pair through + `0x00534490`, keeps the highest sample, expands it through `0x0052d0c0` plus fixed margins, and + republishes the eye triplet through `0x0052d1e0` when the current eye height needs to be lifted. + The embedded controller base beneath that path is now first-class instead of only being referenced + indirectly: `0x0052d140` stores the four blend scalars at `[+0x50..+0x5c]`, `0x0052d180` stores + the focus triplet and raises dirty byte `[+0x64]` when it changes, `0x0052d1e0` stores the eye + triplet and refreshes sampled vertical delta `[+0x66]`, `0x0052d230` extracts focus-to-eye + distance plus heading/pitch-like angles, `0x0052d2b0` serializes the focus, eye, and orientation + lanes into one camera-view snapshot record, `0x0052d400` is the inverse helper that rebuilds the + focus triplet from eye, heading, pitch, and distance, `0x0052d450` rebuilds the eye triplet from + focus, heading, pitch, and distance, `0x0052d640` clamps distance against sampled eye height, + `0x0052d750` is the stream-load companion that rehydrates one stored camera-view snapshot back + into the controller base, and `0x0052d570/0x0052d5a0/0x0052d6f0/0x0052d860` are the + base-reset, default-seed, seed, and reset-plus-seed constructor owners. One level higher, + the compact accessor and dirty-latch strip is bounded now too: `0x0052cd20/0x0052cd60` export the + current eye triplet as packed or split outparams, `0x0052cd40/0x0052cd80` do the same for the + focus triplet, `0x0052cda0/0x0052cdc0` are the matching load-store helpers for auxiliary triplet + `[+0x2c..+0x34]`, `0x0052cde0/0x0052ce20` snapshot the current focus, heading, and distance bands + into the two cached companion strips when their paired dirty latches are cleared, and + `0x0052ce70` refreshes shell presenter scalar `[+0x6a]` while consuming the primary dirty latch + back to zero; the next compact query strip is bounded now too: `0x0052cea0` exports heading and + pitch lanes `[+0x10/+0x14]`, `0x0052cec0` samples owner height at current eye X/Z, + `0x0052cf00` broadens that into a clamped XY-extent peak-height query, `0x0052d0c0` is the + current-eye wrapper into that peak-height query, and `0x0052d0f0` is the normalized scalar-band + containment predicate over `[+0x50..+0x5c]`. One level higher, + `world_view_refresh_dependent_projection_visibility_and_presentation_scalars` `0x0043bde0` + now bounds the larger refresh pass that derives visibility and presentation-side scalars from the + current focus and eye triplets before later motion and input branches resume. The load-side owner + one layer above that strip is bounded now too: + `world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars` `0x0043ac30` + releases any pending helper handle, clears presenter ownership, resets the local controller strip, + rehydrates one stored camera-view snapshot through `0x0052d750`, conditionally loads one + extra-row band into `[this+0x10e]`, reseeds the four controller blend scalars through + `0x0052d140(0, 0, 1.0, 0.7)`, and then normalizes heading before control returns to the broader + world-view owner family. The adjacent low-side layout-state strip is bounded now too: + `0x00544290/0x00544360` publish or reset the local descriptor blocks rooted at + `[layout+0x352f]` and `[layout+0x34ef]`; the next setter strip `0x00544cb0..0x005450a0` + publishes or clears bound-node property pairs `0x0d/0x0e`, packed property `0x3c`, grouped + property `0x0b`, the broader capability and mode-gated slot strips + `0x1d/0x13/0x14/0x12` and `0x15/0x1a/0x11/0x10`, plus the cached-byte-backed property `0x89`; + and `0x005450c0/0x005450e0/0x00545130` export the cached local block `[layout+0x24f0]` and the + negated local scalar triplet `[layout+0x2517/+0x251b/+0x251f]`, with the middle lane clamped up + to `0.5f`. One level lower, `0x00545180` builds the generated default preset table rooted at + `[layout+0x840]` as `0x90` fixed `0x33`-byte rows from an angular sweep, while + `0x00545400/0x00545470/0x005454a0` are the adjacent indexed row setters and query helpers over + that same table and `0x00545420/0x00545440` are the paired scalar-array siblings for + `[layout+0x25f7/+0x25ff]`; the next local strip `0x005457c0/0x005458a0/0x005458d0` publishes + one property-`0x8b` stack descriptor on the bound node and borrows or releases the current + segment-record window handle `[layout+0x265b]` with global counter `0x00ccd824`; the immediate + sibling wrappers `0x005459f0/0x00545a20/0x00545a40/0x00545a70/0x00545aa0/0x00545ac0/0x00545af0/0x00545b90/0x00545bb0/0x00545be0` + repeat the same borrow-release pattern for the adjacent table handles `[layout+0x2643/+0x2647/+0x264b/+0x264f/+0x2653/+0x263f]`. + The last clean local leaves after that are `0x00545ca0/0x00545d50/0x00545d60/0x00545db0/0x00545e00`, + which cover the first-slot clear plus type-`1` span commit, the accumulated span counter query, + the counter reset and optional bound-node reseed, the bound-node finalize-and-optional-clear + helper, and the small bound-node signature classifier. One level up, the next owner body is + bounded now too: `0x00545e30` queries one external/provider report and builds summary text in + buffer `[layout+0x43c]`, falling back to localized id `0x73` when the provider lookup fails and + otherwise appending the localized fragment strip `0x74..0x7d` plus the fixed format family + `%1(16-bit HW) ` / `%1(8-bit HW) ` / `%1(8-bit) ` / `%1(16-bit) ` from the returned report. The + adjacent reset-and-property strip is also tighter now: `0x005464d0` runs one repeated four-pass + bound-node reset sequence, `0x00546540/0x00546560` force property `0x17` to `7` or `4`, + `0x00546580/0x005465a0` clear or raise property `0xa8`, `0x005467a0/0x005467e0` are the paired + one-bit gate writes for property `0x1c`, and `0x00546810/0x00546850/0x00546890` are the + template-gated and clear-side mode writes for property `0x16` via local mode byte + `[layout+0x254a]`. One level higher again, `0x0054a0c0` is now bounded as the broader setup-side + owner above that strip: it binds one external source onto the bound presentation node, falls + back to the midband release helper when that bind fails, conditionally reapplies the cached + gamma-ramp scalar from `[[layout+0x83c]+0x2f]`, seeds optional handle `[layout+0x33ab]` through + the small `0x00570fbd -> 0x00570f86` refcounted `0x14`-byte object helper pair, which now opens + into a tighter row-container family: `0x0057091d` reserves one `0x40`-byte row block from the + fixed template `0x0056cd2c`, with `0x005708ce/0x005708f2` as the aligned block alloc/free + helpers, `0x00570908/0x005709da` as the destructor and release-side wrappers, + `0x00570fa1` as the direct refcount-drop path, `0x0057098b` answering only `IUnknown` plus one + custom IID, and `0x005709f6` as the first grow-and-duplicate-last-row owner. The next + current-entry strip is also bounded now: + `0x00570aac` seeds the current `0x40`-byte entry to an identity 4x4 matrix, `0x00570b0d` + stores one caller matrix directly into that current slot, and `0x00570b2c/0x00570b76` are the + two immediate left/right composition siblings over the same current matrix through + `0x0056d3cd`. One level wider, the same family now has three helper-generated matrix-pair + variants too: `0x00570bc0/0x00570c2f` build a temporary matrix through `0x0056df7d`, + `0x00570c9e/0x00570d1a` do the same through `0x0056e1a8`, and `0x00570d96/0x00570e12` plus + `0x00570e8e/0x00570f0a` do the same through `0x0056dc9a` and `0x0056dd2a`, with each pair + preserving the same right- and left-side current-matrix composition split. The adjacent helper + region is now bounded as one sibling COM-style object pair too: `0x0057aef3/0x0057aedb/0x00571016` + are the init, refcount-drop, and release-side wrappers for vtable `0x005def30`, with + `0x0057ad5a` as the direct addref helper, + `0x0057ad20` as its destructor and `0x0057ae97` as its `IUnknown` plus custom-IID query gate, + `0x0057ad67` as its resource-field bind plus attached-object and payload-copy owner, + `0x0057add4/0x0057adfb` as the attached-object getter and fixed payload copy-out helpers, and + `0x0057ae0f/0x0057ae1e/0x0057ae2d/0x0057ae53/0x0057ae79/0x0057ae88` as the direct pass-through + wrappers over resource field `[+0x48]` and payload block `[+0x08]`, + while `0x0057af0e/0x00571032` are the destructor and release-side wrapper for sibling vtable + `0x005def5c`, with `0x0057af4e` as the matching addref helper, `0x0057af5b` as the target-attach + plus cached-flag derivation owner, `0x0057afd0` as the target getter, and `0x0057aff6` as the + one-shot target-handle release helper, `0x0057b021` as the paired two-handle clear path, + `0x0057b065` as the matching `IUnknown` plus custom-IID query gate, `0x0057b0a9` as the + refcount-drop helper, `0x0057b0c1` as the first broader target-handle and property-strip + seeding owner, and `0x0057b4fd` as the next target-side transform-block builder over optional + anchor pairs plus caller angle and scale. The resource-field branch under `0x0057ae0f..0x0057ae88` + is now tighter too: `0x00580867` is the small constructor-style init for the `0xb0`-byte + target-service object, clearing the embedded entry-band roots, ready byte, auxiliary handle + fields, and cache link; `0x005808b2` is the matching full destructor, releasing the two + target-bound service handles, both embedded eight-entry bands, attached object, target, the + auxiliary handle family rooted at `[+0x6c/+0x98/+0x9c/+0xa8]`, and then unlinking the object + from the global cache chain rooted at `0x00db89e4`; `0x005809ab` is the release-side wrapper for + that destructor; `0x005809c7` seeds service handles `[+0x64]` and `[+0x68]`, invokes attached + object `[+0x0c]` through slot `+0x10`, republishes those two handles through target slots `+0xdc` + and `+0xd8`, and latches ready byte `[+0x60]`; `0x00580a54` is the paired clear-side sibling + that releases handle `[+0x64]` through target slot `+0xd8`, notifies the attached object through + slot `+0x1c`, and clears `[+0x60]`; `0x00580a84` is the broader release body over those target + handles plus the two embedded eight-entry bands rooted at `[+0x10]` and `[+0x30]`; + `0x00580aff` is the setup-side entry-band owner that chooses one of two fixed parameter triples + from local mode byte `[+0x50]`, seeds scalars `[+0x54/+0x58/+0x5c]` through `0x00570669` and + `0x00570691`, and dispatches live per-entry objects through slot `+0x3c`; `0x00580bb9` is the + small auxiliary-handle release helper over the pointer band rooted at `[+0xa8]`; `0x00580bdc` + is the direct refcount-drop path; `0x00580be8` is the constructor-side owner that stores target + `[+0x04]`, derives mode byte `[+0x50]`, seeds the fixed scalar triple `[+0x54] = 0x15`, + `[+0x58] = 0x40`, `[+0x5c] = 0x10`, builds the entry bands, and binds the auxiliary handle + family rooted at `[+0x6c]`, `[+0x98]`, and `[+0x9c]`; and `0x00580d29` is the primary + payload-dispatch and layout-style service owner below the `0x0057ae2d/0x0057ae53` wrappers, + taking the target-service object, caller payload block, five caller arguments, and fixed + mode-variant flag while using service handle `[+0x6c]` plus external callbacks + `0x005c81e4/0x005c8248/0x005c824c`, + and `0x0058123c` is the cache-or-create factory above that strip, walking the same global cache + root `0x00db89e4` for a matching target, otherwise allocating one `0xb0`-byte object, running + `0x00580867`, and finishing construction through `0x00580be8`. Immediately below that service + factory the local container strip is now bounded too: `0x005812b1/0x005812c1/0x005812cf/ + 0x0058133d/0x00581371` form the reset, release, push, pop, and status helpers for one growable + dword-pointer vector, while `0x00581379/0x0058138c/0x005813bd/0x00581470/0x005814a4` do the same + for the sibling growable string-pointer vector with accumulated byte count at `[+0x10]`, and + `0x005814ac` is the first owner above that string-vector family, building one newline-joined + text object from the stored strings. The adjacent object strip is now bounded too: + `0x00581673/0x005815cf/0x005815dc/0x00581610` are the init, addref, refcount-drop, and release + wrappers for vtable `0x005e0bd8`, `0x00581594` is the destructor, `0x005815a9` allocates the + owned text buffer, `0x005815fc/0x00581606` are the direct getters for that buffer and its stored + length, and `0x0058162c` is the matching `IUnknown` plus custom-IID query gate. The adjacent + SIMD math strip is now bounded too: `0x00581690` applies the first two basis rows plus + translation row `[+0x30]` to one XY pair and stores the full vec4 result, `0x005816d0` is the + projective sibling that scales by a reciprocal derived from lane 3 and returns projected XY, and + `0x00581730` is the translation-free low-64-bit sibling over just the first two basis rows, + while `0x00581770/0x00581830/0x005818f0` are the corresponding 3D XYZ helpers for basis-only, + basis-plus-translation, and projected basis-plus-translation output, `0x005819f0` is the direct + 4D vec4-by-4x4 basis application helper, `0x00581ab0` is the four-row batch sibling over a full + 4x4 source block, and `0x00581c00/0x00581cd0` are the shared normalize-or-zero helpers for vec3 + and vec4 input. One level wider, `0x00581db0` is now bounded as the shared 4x4 inversion helper + with optional determinant outparam, `0x00582070` is the packed-output batch sibling to the + earlier four-row 4D basis application helper, `0x005821d0` is a standalone 4D cross-product-like + helper over three vec4 inputs, `0x00582280` is the unchecked vec4 normalization sibling, and + `0x00582320/0x005823e0/0x00582470/0x00582520` are the first cubic-basis interpolation helpers + in the same math strip for vec3, vec2, vec4, and the first alternate-basis vec3 case. + The same family now extends cleanly through `0x005825e0` and `0x00582680` as the alternate-basis + vec4 and vec2 siblings, then into `0x00582710/0x00582770/0x005827c0` as the two-scalar affine + blend helpers computing `p0 + s*(p1-p0) + t*(p2-p0)` for vec3, vec4, and vec2 inputs. + The next geometry leaves are bounded too: `0x00582820` is the plane-versus-segment intersection + helper over one plane vec4 and two vec3 endpoints, `0x005828e0` is the standalone 4x4 + determinant helper beside the nearby inversion body, and `0x005829b0` builds one plane vec4 + from three vec3 points by cross product, normalization, and signed-distance writeout. The next + quaternion strip is now bounded too: `0x00582c30` builds one 4x4 rotation matrix from a + quaternion-like vec4, `0x00582d10` is the quaternion product helper, and `0x00582da0` is the + unchecked quaternion-normalization sibling. The adjacent plane-and-quaternion leaves are tighter + now too: `0x00582aa0` is the shared plane-driven projective 4x4 matrix builder over one plane + vec4 and one second vec4 input, `0x00582e40` is the quaternion inverse helper that conjugates + the spatial XYZ lanes and divides by squared length, `0x00582eb0` rebuilds one quaternion from a + caller 3x3 rotation-matrix block, and `0x00582fd0` builds one quaternion from three caller Euler + angles by halving them, routing the packed tuple through trig helper `0x0058aa70`, and then + combining the resulting sine and cosine lanes. The next packed-row sibling strip is now bounded + too: `0x005830a0` applies one compact 3x3 basis block to one vec3 input, `0x00583160` is the + translation-bearing vec4 sibling, `0x00583220` is the packed projective vec3 sibling that scales + by a reciprocal derived from lane 3, `0x00583320` is the packed 4x4 vec4 application helper, + `0x005833e0` is its four-row batch sibling over a full caller 4x4 source block, + `0x00583530/0x00583600` are the packed vec3 and vec4 normalize-or-zero siblings of + `0x00581c00/0x00581cd0`, `0x005836e0` is the packed 4x4 inversion sibling with optional + determinant outparam, `0x005839a0` is the packed-output batch sibling of `0x005833e0`, and + `0x00583b00` is the packed-row sibling of the earlier 4D cross-product helper. The same packed + analogue strip now extends further: `0x00583cc0` is the packed 4x4 determinant sibling, + `0x00583d90` is the packed three-point plane builder, `0x00583e80` is the packed plane-driven + projective 4x4 matrix builder, `0x00584010` is the packed quaternion-to-matrix sibling, + `0x005840f0` rebuilds one quaternion from a packed 3x3 rotation-matrix block, and + `0x00584210` is the packed Euler-angle-to-quaternion sibling using packed trig helper + `0x0058ad50`. The lower trig seam is bounded now too: `0x00583bb0` and `0x00583c30` are the two + single-angle packed axial rotation-matrix variants above the same trig layer, `0x0058ac60` is + the interleaved packed sine/cosine helper they share, and `0x0058ad50` is the wider packed + sin/cos vector generator used by the packed Euler-angle-to-quaternion helper. The MMX or 3DNow + analogue seam is bounded now too: `0x005842e0` is the quaternion-product sibling, + `0x00584379/0x005843d6` are the vec4 and vec3 normalize-or-zero siblings, + `0x00584489` rebuilds one quaternion from a 3x3 rotation-matrix block, + `0x005848ba` is the MMX or 3DNow Euler-angle-to-quaternion sibling using scalar trig helper + `0x0058b660`, `0x0058497f` is the explicit axis-angle-to-quaternion sibling, + `0x005849eb` is the core quaternion slerp helper, `0x00584b22` and `0x00584baf` are the next + two nested-slerp multi-control helpers, `0x00584c41` is the quaternion inverse sibling, + `0x00584ca5` extracts an axis-angle-style vec4 from one quaternion, and `0x00584d4c` is the + scaled-axis-to-quaternion sibling. The next broader MMX owner is bounded now too: `0x00584df1` + takes four caller key quaternions, aligns neighboring keys onto a common hemisphere, converts the + two relative deltas around each interior key through the already-grounded inverse and + axis-angle-style helpers, averages those tangent-like terms, exponentiates back into quaternions, + and multiplies by the interior keys to write two inner spline-control quaternions. The immediate + plane-and-matrix seam after that is tighter now too: `0x00585b4b` is the row-major MMX + translation-matrix constructor, `0x00585b9b` is the MMX sibling to the shared plane-driven + projective 4x4 matrix builder, `0x00585c86` is the paired plane-reflection matrix helper, and + `0x0058a988` is the shared normalize-by-XYZ-length helper beneath those plane-driven bodies, while + `0x0058a8ca` is the MMX origin-plane-versus-segment intersection sibling and `0x0058a9ec` is the + MMX 4D vec4-by-4x4 basis application sibling. The immediate matrix seam after that is bounded + too: `0x00585d62/0x00585dc5/0x00585e23` are the three single-angle MMX axial 4x4 rotation-matrix + variants, `0x00585e7c` is the MMX diagonal scale-matrix constructor rather than a translation + helper, `0x00585ec3` is the small 4x4 transpose or repack helper, `0x00585f32` is the MMX + identity-matrix constructor, and `0x00585f6b/0x0058603d` are the two MMX quaternion-to-4x4 + rotation-matrix variants. The adjacent broader matrix owner beneath that constructor strip is + bounded too: `0x0058584a` is the non-alias-staging MMX 4x4 multiply sibling that repacks one + split-qword matrix to temporary contiguous rows before multiplying it through the second caller + matrix, `0x00585a7c` is the scalar determinant helper for the upper 3x3 basis of the same + split-layout 4x4 matrix family, `0x005860f2` is the broader affine-transform owner that builds + one matrix from optional base translation, base rotation, pivoted post-rotation, and trailing + translation-delta inputs, `0x0058728a` is the adjacent three-angle rotation-matrix builder that + uses half-angle trig rather than the single-angle strip, `0x0058742f` is the uniform-scale + sibling that adds one optional pivoted quaternion rotation and one trailing translation delta, + `0x00587963` is the axis-angle rotation-matrix sibling over a normalized axis vec3 plus one + caller angle, and `0x00587a7c` is the broader shared transform owner that supports one base + translation, up to two optional pivoted quaternion rotations, and one trailing translation delta. + One lower MMX sibling strip is bounded now too: `0x005895fa` is the + 3D basis-plus-translation-to-vec4 sibling of `0x00581830`, `0x0058966b` is the basis-only vec3 + sibling of `0x00581770`, `0x005896d2` is the vec3 normalize-or-zero sibling of `0x00581c00`, and + `0x00589731` is the two-scalar affine vec3 blend sibling of `0x00582710`. The next MMX + interpolation strip is bounded too: `0x005897a2` is the cubic-basis vec3 sibling of + `0x00582320`, `0x00589876` is the alternate-basis vec3 sibling of `0x00582520`, `0x00589960` is + the projective 3D basis-plus-translation sibling of `0x005818f0`, `0x005899eb` is the four-row + 4D basis application sibling of `0x00581ab0`, and `0x0058a1aa` is the cubic-basis vec2 sibling + of `0x005823e0`. The remaining low-dimensional MMX strip is bounded now too: `0x0058a0b8` is the + 2D basis-plus-translation-to-vec4 sibling of `0x00581690`, `0x0058a10d` is the basis-only vec2 + sibling of `0x00581730`, `0x0058a146` is the projective 2D sibling of `0x005816d0`, + `0x0058a242` is the affine vec2 blend sibling of `0x005827c0`, `0x0058a28b` is the vec2 + normalize-or-zero sibling, `0x0058a2ce` is the alternate-basis vec2 sibling of `0x00582680`, + `0x0058a379` is the duplicate-layout 4D vec4-by-4x4 basis application sibling, `0x0058a3fb` is + the four-lane normalize-or-zero sibling, `0x0058a45a` is the MMX 4D cross-product sibling of + `0x005821d0`, `0x0058a58c` is the affine vec4 blend sibling, `0x0058a5fd` and `0x0058a6c5` are + the cubic and alternate-basis vec4 siblings of `0x00582470` and `0x005825e0`, `0x0058a7a3` + builds one plane vec4 from a normal vec3 plus point, and `0x0058a7e6` is the three-point plane + builder sibling of `0x005829b0`. The broader MMX matrix seam just above those leaves is bounded + now too: `0x00588eb2` is the alias-safe packed 4x4 multiply owner over two caller matrices, + `0x00588bd0` and `0x005892aa` are the two broader MMX 4x4 inverse helpers with optional + determinant output, `0x005895de` is the thin FEMMS wrapper over `0x005892aa`, `0x00589bb2` is + the tiny thunk into the projective vec3 apply helper `0x00589960`, + `0x00589bb7` selects identity or the ordered composition of up to three optional 4x4 inputs + through `0x005899eb`, applies the resulting chain through `0x00589960`, and optionally remaps + the normalized result into one caller integer viewport-style range block, `0x00589d3f` is the + inverse-side sibling that composes the same optional chain, inverts it through `0x005892aa`, + optionally maps one caller integer viewport-style coordinate triple back into normalized + projective space, and then applies the inverse chain through `0x00589960`, and `0x00589f67` is + the adjacent inverse-projective sibling that uses alternate inverse helper `0x00588bd0` before + the same viewport-normalize and projective-apply tail. The scalar trig roots beneath the + quaternion side are bounded now too: `0x0058af80` is the shared scalar `atan2`-style angle + worker, `0x0058b080` is the shared scalar arccos-style angle worker, `0x0058b180` is the + adjacent alternate arccos-style branch, `0x0058b280` and `0x0058b380` are the scalar natural-log + and base-10-log helpers, `0x0058b3a0` is the scalar natural-exponential helper, `0x0058b480`, + `0x0058b4a0`, `0x0058b4c0`, and `0x0058b500` are the scalar square-root, absolute-value, + ceil-style, and floor-style helpers, `0x0058b540` and `0x0058b580` are the adjacent + `frexp`-style split and `ldexp`-style scale helpers, `0x0058b5de` and `0x0058b600` are the + compact `modf`-style split and `fmod`-style remainder helpers, `0x0058b660` returns one + cosine/sine-style lane pair from one caller angle, + `0x0058b780` is the paired scalar sine-lane helper used when callers only need that one branch + duplicated, and `0x0058b9e0` is the broader scalar `pow(x, y)` owner that stitches the adjacent + log and exponential strips back together. After that point the strip stops looking like separate + command leaves and turns back into broader owner bodies. The next adjacent command leaves are + bounded the same way: + `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340` is a guarded hop into + the real cheat-code owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` + `0x00437d70`. That owner increments the shared shell counter at `[0x006d401c+0xc60]`, opens the + localized cheat prompt `2922` `Do I detect a cheater in the house?\n\nEnter code (or to + cancel):`, and then scans the fixed 26-entry table at `0x005ee2c8`. The active selector strip is + now grounded: winner/loss strings `3618/3619/3620/3622` route through `0x004367c0`, selector `1` + jumps to the out-of-line reset branch at `0x004d676c` that clears the selected-company stat bands + rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`, selectors `2` and `3` + post deltas into the selected company and selected chairman profile through `0x0042a080` and + `0x00476050`, selector `4` resolves one locomotive by primary or alias stem through + `0x00461c00` and applies it to every selected-company train through `0x004aefb0`, selector `5` + forces territory-access byte `1` across the live territory table through `0x00424030`, selector + `7` now reads more tightly as the train-crash branch because `0x004ad7a0(1)` is also the direct + shell-command owner behind the `365` warning `There is no train available to crash!`, and + selectors `6/8/9/10` toggle bytes `[state+0x4c8f/+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also + contains the later cheat labels + `3634` `Orca` and the alias-only tail `Katie..Seymour`, but those rows currently sit above the + visible jump-table bound `0x0a`, so the safest static read is that they are unreached or handled + elsewhere rather than active cases in this owner. By contrast + `shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0` `0x00441360` + requires the same single-profile gate, resolves one subject through `0x0040b2d0(0, 1)`, and then + forwards that result into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. + The neighboring current-train command strip is bounded now too. Shared helper `0x00441790` + resolves either the currently focused world-view train or one fallback train, but only keeps it + when the owner company matches the current scenario-selected company. On top of that resolver, + `0x00441810` is the direct `Current train crashes` command: it opens localized warning `365` + when no owned train survives, otherwise it forwards the train into the crash owner + `0x004ad7a0(1)`. `0x004418a0` is the paired `Current train breaks down` command with the same + gate and warning `366`, but it forwards into the named breakdown owner `0x004ada00(1)`. + `0x00441870` is the simpler `Current train whistles` command, which resolves the same owned train, + finds the train-side visual owner through `0x004a77b0`, and writes request dword `1` into + `[owner+0x33a]`. The immediately adjacent helper strip is bounded now too: `0x004a77d0` is a + tiny two-float query over the same linked route object, defaulting both caller outputs to `10.0f` + when `[train+0x41]` is empty and otherwise tail-calling the lower linked-route metric helper + `0x0041add0`; and `0x004a7810` is the neighboring linked-route row-band refresh that walks + `[route+0x316]` / `[route+0x31a]`, treats literal `steam` emitter definitions specially through + `effect_name_matches_literal_steam` `0x004749a0`, and flips row byte `[row+0x1d8]` accordingly. + The shell command strip on the other side is tighter too: `0x00441900`, `0x00441940`, + `0x00441980`, `0x004419c0`, and `0x00441a00` are the five repeated `Overview.win` page toggles + over detail-manager mode `9`, each closing the current page through + `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when that exact page is already + active and otherwise requesting mode `9` with page ordinals `0..4`. + `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50` feeds the + station-list summary `%1 has %2 freight loads and %3 express loads available for hauling...`, and + the paired modifier helper `shell_station_list_handle_center_or_rename_action` `0x00506d50` owns + the visible Shift-center and Ctrl-rename row actions. The list owner itself is tighter now too: + `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30` is the real + `StationList.win` row and status refresh pass, clearing and repopulating controls `0x61a9` and + `0x61aa`, wiring the visible summary and modifier callbacks, mirroring the shared selected-station + latch at `[0x006cec78+0x4cba]` when it still belongs to the current company, and updating the two + status labels `0x61af` and `0x61b0`. The row-side callout lane is tighter too: + `shell_station_list_row_callback_publish_station_callout_card` `0x00506ac0` is the actual + row callback beneath both list controls, resolving the selected station, deriving one category + header through `0x0053de00` and `0x00552560`, and then publishing the station-name plus freight + and express callout card through repeated `shell_publish_text_callout_presentation` calls. The + side-selector branch is tighter too: + `shell_station_list_window_handle_message` no longer just re-enters the raw `StationPick.win` + constructor. It flips the active side bit at `0x006d1710` and then re-enters the modal helper + `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`, which + allocates one helper window, runs `shell_station_pick_window_construct` `0x00507620`, brackets the + modal show path, and returns the staged selected station id from `0x00622ae8`. Inside that helper + family, `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event` + `0x005075c0` now bounds the small message-normalization strip beneath controls `0x80e8..0x80ea`. + The Shift-center side is tighter now too: + the shared helper `0x00433900` takes one object pointer plus one small mode, derives one + mode-specific `(distance,height)` preset from the target's virtual classification, and then + re-enters `0x0043c9a0` to center the live world view on that object. The report side is clearer + as well: + `0x004d3060` is the dedicated `Stats - Trees` constructor over `map_editor_tree_stats_report`, + `0x004d3080` is the actual `General Validation` constructor over + `map_editor_general_validation_report`, and the same page table also now grounds `Stats - Cargo`, + `Stats - City/Region`, `Stats - City Count`, `Event Variable Values`, and the neighboring + event-validation page. The remaining open editor edge is therefore mostly the deeper gameplay + meaning of those site-side service scores and flag bits, not page ownership. diff --git a/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md b/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md new file mode 100644 index 0000000..4a119a0 --- /dev/null +++ b/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md @@ -0,0 +1,423 @@ +# Input, Save/Load, and Simulation: Event Editors, CompanyDetail, and LoadScreen + +### Event Editors and Scenario Action Windows + +The event side is tighter too: + that `0x00433130` pass in turn materializes each live event record through + `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. Current shell-side xrefs + now tighten that event branch too: the first rebuilt linked row family under `0x0042db20` aligns + with the standalone condition list later queried by `EventConditions.win`, while the second + rebuilt family aligns with the four grouped effect lists later deep-copied through + `scenario_event_clone_runtime_record_deep_copy` `0x0042e050` during event duplication and effect + staging. The condition side is tighter now too: the tiny helper cluster + `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is no longer just "some adjacent list scans". + Current evidence bounds it as four predicates over the standalone `0x1e`-row condition list, + testing class bits `0x01`, `0x02`, `0x04`, or any of those bits in the static table + `0x005f3e04 + id*0x81`, with special fallback checks through event fields `[event+0x7f9]`, + `[event+0x7fa]`, and `[event+0x7f0] == 0x63`. The shell side is tighter too: vtable slot + `0x005d0cd8` now binds `shell_event_conditions_window_handle_message` `0x004d59e0`, and vtable + slot `0x005d0cf8` binds `shell_event_effects_window_handle_message` `0x004d7060`. The effects + side is tighter too: the lower helper trio is no longer anonymous. `0x004d5d00` now reads as the + effect-type selector refresh under control family `0x4fb2`, `0x004d5f50` reads as the selected + effect parameter-row repaint, `0x004d6090` is the heavier staged-effect editor refresh over the + `0x4fc7/0x4fce/0x4ff6/0x4ff9/0x4ffc/0x5041/0x5044/0x5046/0x5047` bands, and `0x004d67f0` + commits the current editor state back into the staged effect row at `[this+0x78]`. The verb side + is tighter now too: `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0` and + `shell_open_event_effects_modal_and_return_result` `0x004d9e40` are the shared modal openers + above the two editor windows; `0x004da640`, `0x004da700`, and `0x004d9ed0` now read as the add, + edit, and remove verbs for standalone condition rows; `0x004da7c0`, `0x004da860`, and + `0x004da920` are the matching add, edit, and remove verbs for grouped effect rows; and + `0x004d8120` is now the heavier condition-row list panel refresh those condition-side verbs + re-enter after mutation. The conditions-side refresh split is tighter too: `0x0042d700` + aggregates standalone condition-list class or modifier flags, `0x0042d740` aggregates grouped + effect-row type flags for one selected grouped list, `0x004d9970` owns the condition-class + summary and grouped-row status bands, `0x004d77b0` owns the grouped summary-band affordance gate + for `0x4fed..0x4ff0` when selector `0x5000` lands on `0x5002`, `0x004d9d10` owns the smaller + grouped-effect territory-target affordance on control `0x500b`, `0x004d9f50` owns the selected-event mode + strip and summary text panels, and `0x004d9390` is the mode-dependent detail-row switch beneath + that strip. `0x004da0f0` is tighter too: selector `0x5001` now has the strongest current + RT3.lng fit as the condition-side `Test against...` mode above `0x004d9970`, while selector + `0x5002` has the strongest current fit as the grouped-effect-side `Apply effects...` mode. + That `0x5002` branch now clearly builds control `0x5014` from RT3.lng `1160..1164` as `to the + company/player/player (i.e. chairman)/territory for which the condition is TRUE` before + enabling the adjacent `0x5005`, `0x500a`, and `0x5014..0x501c` family. The strongest current + RT3.lng fit for the remaining visible target-scope strip is now `0x5015 = to the whole game`, + `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories`, and + `0x501a..0x501c = to all/human/AI players`; the grouped effect-row type mask matches that split + directly through bits `0x08`, `0x01`, `0x04`, and `0x02`. The + selected-event strip is tighter now too: `0x004db120` is the broader selected-event repaint and + navigation refresh above those smaller helpers, `0x004db520` and `0x004db5e0` are the previous + and next selected-event stepping verbs, `0x004db8b0` is the add-or-clone event modal helper, + `0x004dba90` is the rename verb, `0x004d9360` is the delete verb, `0x004db6a0` is the live + selected-event id setter behind control `0x4e84`, and `0x004db6f0` is the callback-binding plus + pending-selection bootstrap path that seeds the strip during window bring-up. The larger + dispatcher at `0x004dbb80` now makes the strip explicit: `0x4e85..0x4e8a` are previous, next, + add blank, clone selected, rename, and delete event, while the later grouped band commits current + summary state through `0x004d8d50` before changing grouped selector `[this+0x9c]` via `0x004dbf93`. + The selection bootstrap side is tighter too: `0x004daf40` is now the placeholder reset helper for + the selected-event summary controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`. + The grouped target-scope side is tighter too: `0x004d8ea0` now reads as the commit helper for current + selected-event text panels before selection or grouped-action changes, `0x004d8d50` now records + the hidden selector family `0x5006..0x500e -> 0..8`, and `0x004dab60` projects that ordinal + one-to-one onto the visible grouped-effect target-scope display strip `0x5014..0x501c`. That + split is firmer now: `0x5006..0x500e` are the canonical hidden selectors that get stored into + `[event + group + 0x7fb]`, while `0x5014..0x501c` are the visible mirror rows republished from + that same ordinal rather than a second independently named selector family. The grouped row and + stored-summary refresh side is tighter too: `0x004d88f0` is now the selected grouped-effect + row-list renderer for `0x4ed5`, formatting the grouped `0x28`-byte rows through RT3.lng + `1154..1159`, and `0x004da9a0` is the current grouped-summary-state republisher that reloads + `0x500a`, `0x500b`, and visible action selection `0x5014..0x501c` from `[event + group + ...]` + before tailing back into `0x004da0f0`, + `0x004dbfca` as the grouped target-scope mode selector that persists the chosen control id into + `0x00622074`, with `0x5001/0x5002` now strongest-fit as `Test against...` and + `Apply effects...`, `0x004dbeeb` as the pending shared summary-text triplet publish helper for + `0x4eac/0x4ed9/0x4edb`, + `0x004d91e0` as the selected-event summary-header and grouped-mode commit helper above + `0x004d8d50`, and `0x004dbe7a` as the narrower `0x4ec6/0x4ec7` choice-event single-player-only + warning modal branch rooted at RT3.lng `3887`. The remaining gaps on + this lane are narrower again because the grouped-band `0x4dc09c` table now closes one earlier + overclaim: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into + `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` only route to the smaller + `0x004d9d10` affordance path and the rest of `0x4ff1..0x5013` are default no-ops. The open + question is therefore no longer whether those visible target-scope rows are direct selector verbs; + current evidence says they are not. + The local slot records are rooted at + `[world+0x69d8]`, + `[slot+0x01]` polarity and the external role gate at `[world+0x0bc3+slot*9]` are now grounded, and + `[slot+0x03]` now looks like the distinguished primary-human-seat marker because current grounded + writes seed it only on slot zero and later logic moves it solely by whole-record compaction. The + open question is no longer whether the seeded trio lands in the visible shell company roster; + current evidence says it does, and ordinary `Start New Company` now looks like a fresh-company + allocator through `start_new_company_dialog_commit_create_company` and + `start_new_company_request_create_company`, not like the path that claims one of the seeded named + railroads. The immediate post-roster station branch is now clearly separate: current grounded + resource names and handlers put mode `8` on `StationDetail.win`, mode `5` on `StationList.win`, + and the subordinate modal selector helper on `StationPick.win` through + `shell_station_pick_window_open_modal_and_return_selected_station_id` above + `shell_station_pick_window_construct`. The company-side ownership question has therefore moved + down a layer rather than staying open. We now have a recovered `CompanyDetail.win` + owner family through `shell_company_detail_window_refresh_controls`, + `shell_company_detail_window_construct`, and `shell_company_detail_window_handle_message`; the + same owner now has one broader bounded read-side lane too, because control `0x9470` uses + `shell_company_detail_render_financial_history_panel` to draw the five-step Revenue or Expenses or + Interest or Profit or Lifetime strip, sibling control `0x9471` reuses + `shell_format_company_financial_summary_card` through + `shell_company_detail_render_company_summary_card`, controls `0x947d` and `0x947e` now ground a + bond maturity and repay panel through `shell_company_detail_render_bond_maturity_and_repay_panel`, + control `0x9488` now grounds the debt or credit or rate summary block through + `shell_company_detail_render_debt_credit_and_rate_summary_panel`, control `0x948a` now grounds the + share-value and dividend-payout block through + `shell_company_detail_render_share_value_and_dividend_summary_panel`, while the broader six-row + per-share stock-data family is now bounded under `shell_format_company_stock_data_panel`, and the + adjacent territory selector lane is bounded through + `shell_company_detail_select_territory_access_row`, + `shell_company_detail_render_territory_access_row`, + `shell_company_detail_sync_selected_territory_from_picker`, and + `shell_company_detail_refresh_selected_territory_access_summary`; the first finance-action layer + beneath it is bounded through the bond, stock-issue, stock-buyback, and dividend-rate helpers; the + territory-access side is bounded too through + `shell_company_detail_refresh_selected_territory_access_summary`, + `shell_company_detail_buy_territory_access_rights_flow`, and the underlying company access-rights + helpers; and the full takeover and merger vote-result lane is now grounded through + `shell_resolve_chairmanship_takeover_vote_and_commit_outcome`, + `shell_present_chairmanship_takeover_vote_outcome_dialog`, + `shell_resolve_merger_vote_and_commit_outcome`, and `shell_present_merger_vote_outcome_dialog`. + The remaining company-side uncertainty is therefore narrower than before: the broader support and + valuation side is now tighter too because + `company_compute_cached_recent_per_share_performance_subscore`, + `company_compute_five_year_weighted_shareholder_return`, and + `company_compute_public_support_adjusted_share_price_scalar` bound the recent per-share + performance and investor-support/share-price blend beneath those vote resolvers; the recent + per-share feeder now has a grounded four-lane tail too, with current partial-year weight + `(5 * [world+0x0f]) - 5`, prior full-year weights `48/36/24/12` on `0x1f/0x1e`, dividend + non-decline pair weights `9/8/7/6` on `0x20`, lane weights `40/10/20/30`, the startup age ramp + `0/0/0/100 -> 25/25/35/100 -> 50/50/65/100 -> 75/75/85/100 -> 100/100/100/100`, a strongest-lane + `*1.25` boost, a weakest-lane `*0.8` reduction, and separate bounded-intermediate versus final + difficulty applications under `0x005f33b8`; the next consumer `0x00424fd0` is also tighter now, + with the young-company interpolation against `[company+0x57]`, caller pressure clamped to + `[-0.2, 0.2]`, one `(shares / 20000)^0.33` share-count growth term, and the later threshold + ladder `0.6 / 0.45 / 0.3 / 1.7 / 2.5 / 4.0 / 6.0` before the issue-`0x37` multiplier, + `scenario_state_compute_issue_opinion_multiplier` now bounds the + next layer of optional company, chairman, and territory-specific opinion overrides on the active + scenario state, and the broader stat-reader family around + `company_read_control_transfer_metric_slot` and + `company_read_year_or_control_transfer_metric_value` is no longer just a merger-premium helper. + Current grounded callers show the same metric family feeding the annual shareholder-revolt and + creditor-liquidation lane surfaced by localized ids `300..304`, while the debt-side shell and + bond lane now separately close `0x38` as `Credit Rating` and `0x39` as `Prime Rate`. That means + the remaining gap is now mostly gone on the UI side too: issue `0x37` is already bounded to the + same investor-confidence family as the equity-support and governance-pressure paths, and current + grounded UI evidence still stops at the investor-attitude sentence family rather than one + standalone caption. The calendar side is tighter now too: + `[world+0x15]` is the absolute counter for the same mixed-radix `12 x 28 x 3 x 60` + year-plus-subfield tuple packed by `0x0051d3c0` and unpacked by `0x0051d460`, not just a vague + “calendar-like” blob. The `TrackLay.win` family now clearly owns `Lay single track.` `Lay double track.` + and `Bulldoze` as its three primary modes, its bridge selector, its wrapped frequency preferences, + and a strongly aligned pair of `Auto-Hide Trees During Track Lay` and `Auto-Show Grade During + Track Lay` toggles; the `StationPlace.win` family now clearly owns its six top-level category + buttons, the station-style scroller, and the station-rotation controls. The older `Building + placement center` string 671 no longer looks like a live StationPlace control label in the current + recovered flow, because the active constructor, preview, refresh, and dispatcher paths all use + neighboring ids such as 669 and 2208 without a direct recovered lookup of 671. On save or load the + broad serialize-versus-restore split is now grounded, the non-Quicksave `.gmp/.gmx/.gmc/.gms` + families are separated, and the auxiliary `.gmt` path is at least bounded to the preview-surface + side owner. The higher-value shell-facing gap has therefore shifted upward to the remaining + semantics of the post-load generation phases, the later recurring structure-population cadence, + the deeper vote-weight formulas inside takeover and merger resolution, and the still-open meaning + of the packed simulation calendar tuple. + +### CompanyDetail and Section Ownership + +The shell detail family now has an explicit + section-selector lane in addition to the read-side panels already mapped. Controls + `0x9472..0x9475` directly select the four visible CompanyDetail sections through `0x006cfe60`, + `0x9476..0x9479` are the companion visual controls for that same tab strip, and section `0` is now + bounded more tightly as the chairman or governance slice around the portrait-backed chairman band + on `0x9480` plus the dynamic overview widget `0x947f`. That widget is no longer just a vague + status line: the section-0 refresh binds it through a dedicated stack-built dynamic text path, + and the strongest current shared formatter candidate is + `shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0`, which first renders a + five-line company-metric preamble through localized ids `1211..1215`: `Revenues` from slot + `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load + mile` from the derived `slot 0x2c / slot 0x17` branch, and `Average speed` from slot `0x26` + rendered through `1216` `%1 m.p.h.`. It then splits the governance summary more concretely: no + linked chairman emits `3045`, wholly owned companies emit `3046` for the scenario-selected + chairman or `3047` for another linked chairman, and investor-owned companies emit the + investor-attitude lines `3048/3049` with one adjective from the table at `0x00622170`. That + branch is no longer using unnamed helpers either: `company_get_linked_chairman_profile_record` + `0x00426ef0` resolves the linked chairman profile and `chairman_profile_owns_all_company_shares` + `0x004768c0` is the full-ownership test behind the `3046/3047` split. The salary side is tighter + too: the formatter computes one signed delta from `[company+0x14f]` and `[company+0x0d59]`, then + chooses `3050..3052` for the scenario-selected chairman or `3053..3055` for another linked + chairman depending on whether that delta is negative, positive, or zero. The bonus line is + narrower still: it only appears when the display year matches `[company+0x34f]`, using amount + `[company+0x353]` with `3056` or `3057`. It then appends the + `1218` `Economy status - %1.` tail caption and stages the adjacent selected-company report or + list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`, + `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`, + `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`. + Current evidence still does not recover separate `CompanyDetail.win` action controls for that + strip under `shell_company_detail_window_handle_message`, so it currently reads as staged + overview text or help content rather than as a closed launcher family. The direct `0x947f` + formatter call is still indirect, but the widget boundary is tighter too: the generic shell + helpers `shell_control_refresh_matching_dynamic_text_payload` `0x00540a47` and + `shell_control_release_dynamic_text_payload` `0x005639d2` now show that type `0x6f` controls + free or swap one heap-backed text payload and then short-circuit as a special dynamic-text case, + which strengthens the reading of `0x947f` as a display-only overview widget rather than a normal + callback control. One adjacent boundary is tighter now too: the broader overview wrapper at + `shell_render_company_overview_panel_header_and_optional_change_affordance` `0x004e5a80` owns + the fallback no-company texts `1210`, `3043`, and `3888`, styles controls `0x3f06` and `0x3f07`, + and on the narrower selected-company branch appends `3044` `Click to change company name and + logo.` plus the neighboring `1941` `Change` affordance before falling through into the shared + `0x004e5cf0` text body. That keeps the name/logo affordance outside the ordinary + `CompanyDetail.win` action dispatcher and makes the `0x947f` alignment cleaner. The message-side + action band is tighter too: `0x94b5` grounds + territory-access purchase, `0x94b6` grounds bankruptcy, `0x94cf..0x94d2` ground bond issue, stock + issue, stock buyback, and dividend-rate changes, `0x9493` routes into the destructive + company-clear helper that deactivates the selected company and clears chairman/share links, + `0x94d6` grounds bankruptcy, `0x94d7..0x94da` ground bond issue, stock issue, stock buyback, and + dividend-rate changes, `0x94db` grounds merger, `0x94dc` grounds resignation, and `0x9538` grounds + chairmanship takeover. The finance-side dialog family is tighter too: the bond-issue lane now has + the dedicated modal renderer `shell_company_detail_render_issue_bond_offer_dialog` `0x004c3560` + for underwriter terms `968..972`, the stock-issue lane has + `shell_company_detail_render_issue_stock_offer_dialog` `0x004c3b50` for the staged offer lines + `975..978`, and the buyback lane has + `shell_company_detail_render_stock_buyback_offer_dialog` `0x004c4300` for broker lines + `981..984`. The compact summary card on sibling control `0x9471` is tighter too: + `shell_format_company_financial_summary_card` at `0x004bfb30` now clearly renders `Cash:`, + `Revenue:`, and `Profits:` from company slots `0x0d`, `0x2c`, and `0x2b`, rather than one looser + unnamed finance block. The dividend lane is now split the same way: + `shell_company_detail_setup_dividend_rate_adjust_controls` `0x004c4c70` binds the paired adjust + controls `0x99e8` and `0xc0f9`, + `shell_company_detail_render_change_dividend_rate_dialog` `0x004c4e30` renders localized ids + `988..990`, and + `shell_company_detail_handle_change_dividend_rate_dialog_message` `0x004c5140` clamps the staged + dividend rate against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260` and + raises localized id `991` when the board refuses a higher dividend, all before the existing + company commit path. All four finance verbs now converge through the shared + callback-driven modal opener `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, which + is also reused by the multiplayer staged text-entry lane. The front controls in section `0` are + tighter too: `0x948b` is a + tutorial-guarded escape or back control that shows localized id `3724` `This option is disabled in + the tutorial.` before falling back to the shell detail-manager escape path, `0x9491` and `0x9492` + only restyle the paired visuals `0x948f` and `0x9490`, and `0x9494` opens localized id `3635` + `Enter the amount that your company's cash should be` and writes the accepted value directly into + the selected company cash pair. The neighboring debt section is tighter now too: controls + `0x947d` and `0x947e` no longer read as one-off bond widgets, but as the owners of two repayable + bond-slot row bands, `0x94e8..0x950f` and `0x9510..0x9537`. Those row controls now clearly + converge on the same repayment path in the message dispatcher: they reject unaffordable repayment + through localized id `2990`, open the early-repayment confirmation rooted at `2991`, and then + either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package + the request through the multiplayer shell transport. The render-side owner is tighter too: + `shell_company_detail_render_bond_maturity_and_repay_panel` formats `Due %1` and `Repay this + bond.` for the selected debt slot while the tiny binder + `shell_company_detail_bind_bond_row_band_for_active_panel` switches between the two row bands. + Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone + action cases. The message-side jump table now makes that passive/action split explicit too: in the + dispatch byte map rooted at `0x004c6640`, controls `0x94d6..0x94dc` map to cases `0x06..0x0c`, + control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5` + stay on the default path. The refresh-side ownership is tighter too: the helper now explicitly + loops over `0x94d4..0x9537` as the selected-company-owned band and over `0x9538..0x959b` as the + linked-chairman-owned band, and those two loops do not use the same style polarity. + `0x94d4..0x9537` take style `0x65` when the selected company matches the scenario-selected + company and `0x87` when it differs, while `0x9538..0x959b` take style `0x87` when the selected + company's linked chairman matches the scenario-selected chairman and `0x65` otherwise. The + selected-company action side + is tighter now too: scenario toggle `0x006cec78+0x4a8f` re-enables bankruptcy `0x94d6` together + with passive companion row `0x94d4`, `+0x4a8b` re-enables issue bonds `0x94d7` together with + passive companion row `0x94d5`, `+0x4a87` re-enables stock issue and stock buyback + `0x94d8..0x94d9`, `+0x4a93` re-enables dividend `0x94da` together with the same passive + companion row `0x94d5`, `+0x4adb` re-enables merger `0x94db`, `+0x4acb` re-enables resignation + `0x94dc`, and `+0x4acf` re-enables chairmanship takeover `0x9538`. That makes `0x94d4/0x94d5` + read more like passive companion or heading widgets than hidden verbs. The constructor boundary + is tighter too: current `CompanyDetail.win` setup still only binds explicit callbacks for + `0x9470`, `0x9471`, `0x947d`, `0x947e`, and `0x948c..0x948e`, not for the wider section-0 row + bands. That keeps the remaining `0x94d4..0x959b` content looking more like resource-defined + display rows that are gated and restyled by refresh than like individually code-rendered widgets. + That leaves the main remaining CompanyDetail-specific shell edge at the exact `0x947f` formatter + binding plus the still-unsplit render-side governance rows inside `0x94d4..0x959b`. +### Adjacent LoadScreen.win Report Family + +The neighboring shell lane around controls + `0x3ef6..0x4073` is now separated from `CompanyDetail` instead of being treated as one more + extension of the `0x947f` overview path. The real outer owner is + `shell_load_screen_window_construct` `0x004ea620`, which binds `LoadScreen.win`, randomizes the + `LoadScreen%d.imb` background family, stores the singleton at `0x006d10b0`, and seeds the first + visible page-strip controls. Above the older page-specific work, the real message owner is now + `shell_load_screen_window_handle_message` `0x004e3a80`: it owns page id `[this+0x78]`, + page-local substate `[this+0x7c]`, page-kind `[this+0x80]`, current company `[this+0x88]`, + current chairman profile `[this+0x8c]`, display year `[this+0x9c]`, and the page-local report + row latch `[this+0x118]`, then fans back into the shared selector + `shell_load_screen_select_page_subject_and_refresh` `0x004e2c10`, the company-step helper + `0x004e3a00`, and narrower page branches such as `0x004e45d0`. The matching render-side owner is + now bounded too: `shell_load_screen_render_active_page_panel` at `0x004ea060` formats the common + heading and panel frame, then switches on page id `[this+0x78]` and hands control down into the + active page body. That older branch is now demoted to what it actually is: + `shell_load_screen_profile_stock_holdings_page_handle_message`, the page-specific handler beneath + the stock-holdings slice. Inside that same family, + `shell_load_screen_render_profile_stock_holdings_summary_panel` at `0x004e5300` grounds the + selected-profile holdings page: it resolves the current chairman profile from `[this+0x8c]`, + renders the top summary rows `1204` `Stock Value:`, `1205` `Total Assets:`, and + `1206` `Stock Holdings:`, then walks the active company roster and formats one row per positive + holding through `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`, + falling back to `1209` `None` when no positive holdings survive. It also appends `3029` + `Click to change player name and portrait.` plus the adjacent `1941` `Change` affordance only + when the rendered profile matches the scenario-selected chairman. The earlier pages are tighter + now too: `0x004e68e0` is the selected-company financial ranking page using the active company + roster plus `1235..1245` for revenue, profit, cash, track mileage, and report affordances; and + `0x004e6ef0` is the active-chairman wealth ranking page using the chairman profile collection + plus `1237`, `1241`, `1246..1250` for cash, stock, total, and purchasing-power style comparisons. + The later sibling renderers are broader than that one holdings page now too: `0x004e7670` is the + selected-company train list page using `1235..1267`, `0x004e8270` is the selected-company + building list page using `1268..1278`, `0x004e8bb0` is the selected-company station list page + using `1279..1288`, and `0x004e9460` is the map-wide cargo list page using `1289..1298` over the + live candidate collection rather than one company roster. The last broad early-page owner is + tighter now too: `0x004e9b20` is the shared multi-year company report-table renderer for page + `4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`, all driven from + `0x004ea060` with one caller-supplied mode byte and yearly company rows built through + `company_read_year_or_control_transfer_metric_value`. The row families are bounded too: + income-statement rows `1301..1315`, balance-sheet rows `2816` and `1317..1322`, and + haulage-report rows `1323..1335`. The only special rows inside that family are now tighter too: + `0x00425880` and `0x004258c0` provide the negative-cash and positive-cash interest-rate inserts + for the `%1/%2` placeholders in strings `2815` and `2816`, so they are no longer anonymous + private math blobs. The adjacent early siblings are tighter now too: `0x004e5130` is the + selected-company `Stock Data` page wrapper that falls back through `1299` and otherwise reuses + `0x004c0160` to render the `Largest Shareholders`, `Shares`, and `Per Share Data` family; + `0x004e6ef0` is the `Player List` page; `0x004e5300` is the `Player Detail` holdings page; and + `0x004e51ea` is the `Game Status` briefing panel that pulls current scenario briefing text from + the live scenario text store and appends the `1772/1773` `Briefing` affordance. The active-page + renderer at `0x004ea060` is now tighter too because its 13-byte page descriptor table at + `0x006220a0` has been decoded directly as `{ page kind, title string id, `0x3ef8` backlink + page, selected-company-header flag }`. The currently grounded rendered title order is: + `XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`, + `HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`, + `TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`, + and `INDUSTRY LIST`. Its live body bindings are now bounded too: page `0` falls back to + `1203` `Unable to display page`, page `1` is the company overview wrapper, page `2` is the + company list page, pages `3..5` are income statement, balance sheet, and haulage report, page + `6` is stock data, page `7` is player list, page `8` is player detail, page `9` is game status, + page `0x0a` is train list, page `0x0b` currently falls back to `1203`, page `0x0c` is station + list, page `0x0d` currently falls back to `1203`, page `0x0e` is cargo list, and page `0x0f` + is industry list. The row-click path is tighter now too: player-list rows re-enter page `8` + directly, but train, station, and industry rows leave `LoadScreen.win` through the shell + detail-panel manager at `0x004ddbd0` instead of switching to title-table pages `0x0b` or + `0x0d`. Page `0` is tighter now too: its descriptor is kind `0`, title `1200` `XXX`, backlink + `0`, and header flag `0`, and no current post-constructor selector path has been recovered for + it. The descriptor side now also bounds the only known reverse route for the dormant detail + titles: `0x3ef8` is the table-driven backlink affordance, so if page `0x0b` or `0x0d` were ever + selected, the known reverse path would return to train-list page `0x0a` or station-list page + `0x0c` respectively rather than through a separate detail-only owner. + The launcher side is tighter too: current grounded `shell_open_or_focus_load_screen_page` + callers cover pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, + and no current recovered opener or row-click route selects `0x0b` or `0x0d`. So the + `LoadScreen.win` family now has a much cleaner shape: one outer message owner + `0x004e3a80`, one active-page render owner `0x004ea060`, and then the narrower page-specific + handlers and renderers beneath them. The launcher side is tighter now too: `0x004e4ee0` is the + shared open-or-focus ledger-page owner above this family. Outside sandbox it either re-enters + `shell_load_screen_select_page_subject_and_refresh` on the live runtime at `0x006d10a8` or + allocates that transient runtime, seeds it through `0x004e4b10`, and enters the visible modal + loop; inside sandbox it raises localized id `3899` `The ledger is not available in sandbox mode.` + instead. + The direct shell-command strip above that opener is now explicit too: `0x00440700..0x0044086e` + are just tiny `scenario-present -> open page` wrappers for pages `1`, `3`, `4`, `5`, `6`, + `0x0a`, `0x0c`, `0x0f`, `0x0e`, `2`, `7`, and `9` respectively. So the recovered launcher range + is no longer only “callers of `0x004e4ee0`” in the abstract; each of those small shell-command + stubs now just forwards one fixed page id into the shared opener. + instead. That narrows the remaining `LoadScreen.win` gap again: `TRAIN DETAIL` and + `STATION DETAIL` now read as dormant title-table entries unless some still-unrecovered nonstandard + selector reaches them. The live auto-load boundary is tighter now too: hook-driven + `shell_transition_mode(4, 0)` now completes old-mode teardown, reconstructs and republishes + `LoadScreen.win`, and returns cleanly, but the later post-transition service ticks still keep + `[0x006cec78] = 0`, `[shell_state+0x0c]` on the same `LoadScreen.win` singleton, and + `[LoadScreen.win+0x78] = 0` through at least counts `2..8`. So the next runtime edge is no + longer the old mode-`4` teardown or publish band; it is the `LoadScreen.win` message owner + `0x004e3a80` itself, because later service alone is not promoting the plain load screen into the + separate startup-runtime object path. One later runtime probe did not actually reach that edge: + the `0x004e3a80` hook installed, but the run never produced any ready-count, staging, + transition, post-transition, or load-screen-message lines, only ordinary shell node-vcall + traffic. So that result is now treated as a gate-or-cadence miss rather than as evidence against + the `LoadScreen.win` message path itself. The newer shell-state service trace tightens it again: + on a successful staged run the later service ticks do execute in `mode_id = 4`, but the + `0x004e3a80` message hook still stays silent while the state remains frozen in the plain + `LoadScreen.win` shape. So the next runtime boundary is now the shell-runtime prime call + `0x00538b60` beneath `shell_state_service_active_mode_frame` `0x00482160`, not the message owner + alone. The first direct `0x00538b60` probe run is not trustworthy yet, though: it stopped + immediately after the first shell-state service-entry line, before any ready-count or + runtime-prime entry logs. So that result is currently treated as probe validation work, not as a + real boundary move inside RT3. The static service branch is conditional too: `0x00482160` only + enters `0x00538b60` when `[shell_state+0xa0] == 0`, so silence from the runtime-prime hook does + not yet prove the shell stops before that call unless the service-entry logs also show the `+0xa0` + gate open. The newer run now closes that condition: `[shell_state+0xa0]` is `0`, and the + `0x00538b60` runtime-prime hook enters and returns cleanly. The newer run closes the next owner + too: `0x00520620` `shell_service_frame_cycle` also enters and returns cleanly on the same frozen + mode-`4` path, and the logged fields match its generic branch rather than a startup-promotion + lane (`[+0x1c] = 0`, `[+0x28] = 0`, `flag_56 = 0`, `[+0x58]` pulsed then cleared, and + `0x006cec78` stayed `0`). The static body under the same owner is tighter now too: `0x00538b60` + first re-enters `0x0054f6a0`, refreshes the primary timed-text lane from `[owner+0x1c]` through + `0x005386e0` when that deadline has expired, walks the registered shell-window list from tail + `[owner+0x04]` backward through `+0x54` while servicing each node through `0x0053fda0` and + `0x0051f1d0`, and only then conditionally presents the secondary and primary text lanes through + `0x005519f0`. So the next runtime boundary under the same shell-state service pass is now one + level deeper: the per-object service walker `0x0053fda0` beneath `0x00538b60`. The newer run + closes that owner too: it enters and returns cleanly while servicing the `LoadScreen.win` object + itself, with `field_1d = 1`, `field_5c = 1`, and a stable child list under `[obj+0x70/+0x74]`, + and its first child-service vcall target at slot `+0x18` stays `0x005595d0`. Since `0x006cec78` + still stays `0` through those clean object-service passes, the next runtime boundary is now the + child-service target `0x005595d0`, not the higher object walker. The newer child-service run + narrows that again: the first sixteen `0x005595d0` calls are stable child lanes under the same + `LoadScreen.win` parent, with `[child+0x86]` pointing back to the load-screen object, + `field_b0 = 0`, and a split where earlier children carry `flag_68 = 0x03` and return `4` while + later siblings carry `flag_68 = 0x00` and return `0`. The static body matches that read too: + `0x005595d0` is gated by `0x00558670` and then spends most of its work in draw or overlay + helpers `0x54f710`, `0x54f9f0`, `0x54fdd0`, `0x53de00`, and `0x552560`, so it now reads as + another presentation-side service lane rather than the missing startup-runtime promotion. The + widened allocator-window trace then reconciled the runtime with + the static mode-`4` branch one step further: the first transition-window allocation is `0x7c`, + which matches the static pre-construct `0x48302a -> 0x53b070` alloc exactly, and the later + `0x111/0x84/0x3a/0x25...` allocations all occur before `LoadScreen.win` construct returns, so + they now read as constructor-side child or control setup. That means the allocator probe did not + disprove the still-silent startup-runtime slice; it simply exhausted its log budget inside the + constructor before the post-construct block. The later reset-at-return run is now the decisive + one: after `LoadScreen.win` construct returns there are still no further allocator hits before + publish and transition return, which matches the corrected jump-table decode because mode `4` + does not own the `0x46c40 -> 0x4336d0 -> 0x438890` startup-runtime path. diff --git a/docs/control-loop-atlas/input-save-load-and-simulation.md b/docs/control-loop-atlas/input-save-load-and-simulation.md index 7797edd..d4d4d42 100644 --- a/docs/control-loop-atlas/input-save-load-and-simulation.md +++ b/docs/control-loop-atlas/input-save-load-and-simulation.md @@ -1,4117 +1,33 @@ ## Input, Save/Load, and Simulation +This section is now subdivided by domain. Use the subsection files below for new edits and review. +This compatibility file keeps the established section anchors stable for existing links. + ### Runtime Roots and Cadence +Moved to: [runtime-roots-camera-and-support-families.md](/home/jan/projects/rrt/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md) -- Roots: the shell controller window-message ingress `shell_controller_window_message_dispatch` at - `0x0054e3a0`, the shell input-state object initialized at `0x006d4018` through - `shell_input_state_init` `0x0054e710`, the saved-world restore path - `world_load_saved_runtime_state_bundle` at `0x00446d40`, the live-world save path - `world_runtime_serialize_smp_bundle` at `0x00446240`, `world_entry_transition_and_runtime_bringup` - at `0x00443a50`, the frame-owned cadence `simulation_frame_accumulate_and_step_world` at - `0x00439140`, the recurring `GameMessage.win` service branch through - `game_message_window_service_if_present` `0x004e0720`, the world-facing `GameUppermost.win` - overlay branch ensured by `shell_ensure_game_uppermost_window` `0x004e0e40` and serviced through - `game_uppermost_window_service_world_hotspot_band` `0x004e0780`, and the lower step family rooted - at `simulation_advance_to_target_calendar_point` `0x0040ab50` with periodic branches through - `simulation_service_periodic_boundary_work` `0x0040a590`. -- Trigger/Cadence: shell-side input is event-driven by controller-window `WM_*` traffic while save - or load work is triggered either directly from shell commands or through the `fileopt.win` branch - flags into the `.smp` runtime-state family; post-bring-up world service becomes recurring once a - world root exists at `0x0062c120`, but the current grounded top-level cadence still remains the - shell-owned `shell_service_pump_iteration` path, which calls - `simulation_frame_accumulate_and_step_world` directly and lets it accumulate elapsed wall-clock - time into one or more simulation-step quanta. A second ingress is now bounded too: - `simulation_run_chunked_fast_forward_burst` at `0x00437b20` repeatedly calls the same lower - stepper `simulation_advance_to_target_calendar_point`, but current grounded callers put that - helper inside the larger post-load generation pipeline `world_run_post_load_generation_pipeline` - at `0x004384d0` under the `Seeding Economy...` phase rather than under the ordinary player-facing - speed buttons. That setup pipeline is now clearer at the progress-banner level too: on the fuller - setup path it first runs one preliminary named-candidate availability prepass through `0x00437743` - before any visible progress banner is posted. One startup-side selector edge is tighter now too: - `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` reaches an early - selector-`2` branch at `0x00438a66..0x00438c00` that refreshes one support-family type-`7` - record from setup path buffer `0x006d1370` through `0x0053d130`, strips the basename extension - into a local label buffer, briefly drops the nested mouse-cursor hold through `0x0053f310`, - builds three progress-text payloads, and re-enters the hold through `0x0053f2f0` before the - common world-root bring-up continues. After that, localized id `318` - `Computing Transportation and Pricing...` stays visible while the pipeline runs - `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection-owned staging pass - `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, - `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair - `world_region_collection_seed_default_regions` `0x00421b60` plus - `world_region_collection_refresh_neighbor_and_profile_bands` `0x00420f30`. One save-load-side - status-stack strip is now tighter too: `0x004422d0/0x00442330` push and pop the same four shell - dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` - through the local stack `0x0062be90` with depth `0x0062bedc`, and the paired wrappers - `0x004423a0/0x004423d0` bracket that same band while also servicing the live TrackLay.win and - StationPlace.win tool objects through `0x0050e070`, `0x00507a50`, `0x0050a530`, and - `0x0050e1e0`. The live `.smp` serializer uses the higher pair, while `world_entry_transition_and_runtime_bringup` - `0x00443a50` and `world_load_saved_runtime_state_bundle` `0x00446d40` also use the raw - push/pop pair directly around their heavier bundle and status spans. - `world_region_border_overlay_rebuild` `0x004882e0`. The transport/pricing side is tighter now - too: `0x0044fb70` first routes one null-build path through the preview ensure wrapper - `0x0044faf0`, whose deeper worker `0x0044f840` allocates a default target through - `0x00534930`, seeds five palette entries through `0x0051de10`, maps each target pixel back into - the live secondary raster through `0x00533970/0x00533980`, uses the low-3-bit class split plus a - local `+/-4` neighborhood and `0x0051db80` to choose the preview color, and only then re-enters - `0x0044e940` on the full rectangle. The later `322` side is tighter now too: the top owner - `0x0044d410` rejects while generation counter `[world+0x2205]` is live or when `0x00449e90` - cannot supply a surviving work rect, then forwards that rect into `0x005374d0`, `0x00533e70`, - and `0x00537010`, notifies the shell owner at `0x0062be68`, and refreshes neighboring region or - manager companions through `0x00421f50`, `0x00461770`, and `0x00415340`. `0x00421f50` itself is - now bounded as the narrow class-0 side of that refresh: it scans the live region collection for - class-0 records whose normalized coordinates fall inside the caller-supplied float rectangle and - republishes each surviving region's current-position triplet through `0x00455a70(0)`. The local - companion-float strip under that same owner is tighter now too: `0x0044d4e0` and `0x0044d6e0` - are sibling five-pass cross-neighbor relaxers over `[world+0x1605]`; both clamp the caller - rectangle, average the four cardinal neighbors, subtract the current sample, scale the delta by - one fixed coefficient and caller gain, and then feed the surviving rectangle back into - `0x0044d410`. The first helper only checks raster bit `0x01` in `[world+0x2135]`, while the - second adds the tighter acceptance gate `0x004499c0` and can skip the final `0x0044d410` tail - when its caller disables that refresh. Their center-biased sibling `0x0044d880` is now bounded - too: it seeds one baseline from the current center sample when its caller gain is positive, - expands one square neighborhood by radius, and raises surrounding cells toward that baseline - through the same `0x0051dc00` falloff model before tailing into `0x0044d410`. The local - peak-oriented sibling `0x0044da70` then raises one clamped square neighborhood by quantized - local maxima and on its optional branch also consults `0x00534f00` before keeping the larger - peak. So the `0x0044d4e0/0x0044d6e0/0x0044d880/0x0044da70` band now reads as the local - companion-float refinement layer immediately beneath the shared `Calculating Heights...` owner - rather than a set of unrelated scalar writes. The default-region side is tighter too: - one earlier class-0-only helper `0x0041fb00` now sits directly under that same family too: - it skips nonzero `[region+0x23e]` records, rounds the region center through - `0x00455800/0x00455810/0x005a10d0`, stamps one orientation-dependent local secondary-overlay - pattern through `0x00534e10` plus `0x004497a0`, and then runs one bounded scored refinement pass - through `0x0051db80`, `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0`. The finalizer - `0x00421730` then clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the - full live world raster, seeds each live region's cached bounds fields, and repopulates that same - raster by writing the nearest class-0 region id `[region+0x23a]` into empty or weaker cell slots - from one bounded center-and-radius sweep. The region-profile side is tighter too: `0x0041f940` - counts only the current subcollection entries whose backing - candidates pass `0x0041f998`, and that smaller predicate now has one real content split instead - of staying anonymous. Candidates whose subtype byte is not `2` pass immediately, while subtype-2 - candidates only pass when either availability word `[candidate+0xba]` or runtime recipe latch - `[candidate+0x7ac]` is nonzero; `0x00412af0/0x00412b70` now ground the lookup step beneath both - counters as a casefolded profile-label-to-candidate resolver over the global candidate pool - `0x0062b268`; and the stricter year-filtered counter `0x0041f9b0` then stacks the subtype and - `[candidate+0x26] <= max_year` gates on top of that same availability test. Two adjacent - collection helpers are grounded now too. `0x0041fa30` linearly scans the same region profile - collection `[region+0x37f]`, compares labels through `0x005a57cf`, and returns profile-weight - float `[entry+0x1e]` from the first casefolded match or the shared zero float when none match; - `0x0041fac0` resolves one 1-based ordinal out of that same collection and copies both the - matched profile label and weight `[entry+0x1e]` to caller-owned outputs. Those reads line up with - the editor copy-industry mutator `0x004206b0`, which already treats `[entry+0x1e]` as the live - editable profile-weight lane. That border - pass is now tighter too: the - outer owner refreshes the companion region set `0x006cfc9c` through the reset-and-assign wrapper - `0x00487650` above the heavier record initializer `0x00487540`, then re-enters `0x004881b0` to - refresh the raw per-region cell-count band from the live world raster, and the inner emitter - `0x00487de0` clears prior chunked segment queues through `0x00533cf0`, scans the live region - raster, and appends fresh border-segment records through `0x00536ea0`. The lower presentation - helper strip under the same owner is now explicit too: `0x00533970/0x00533980` query the cached - world-grid X/Y maxima, `0x00533990` stores the secondary-overlay shift field `[world+0x15e1]`, - `0x005339a0` builds one plane equation from three XYZ points, and `0x00533a30` uses the same - three-point patch to solve one sampled height at caller-supplied `(x,z)`, - `0x00533ae0/0x00533af0/0x00533b00` expose the secondary-raster and companion byte-raster roots, - and `0x00533b20/0x00533b30/0x00533b70/0x00533b90` expose the normalized coordinate, strip-offset, - and sample-triplet tables used by shell-side overlay staging. The adjacent queue side is tighter - now too: `0x00533bc0/0x00533bd0/0x00533be0` are the direct append, remove, and root getters for - shell queue `[this+0x166d]`; `0x00533bf0/0x00533c20` are the cell-addressed attach/detach - helpers over nearby-presentation table `[this+0x1671]`; `0x00533c50/0x00533c70/0x00533ca0` do - the same for the region-border overlay chunk table `[this+0x1679]`; and - `0x00533dd0/0x00533e00` are the matching geographic-label cell-table attach/detach wrappers over - `[this+0x1675]`. The geographic-label text side is tighter now too: beneath - `shell_emit_geographic_label_text_span` `0x0053a960`, the support strip `0x0053b090`, - `0x0053b390`, `0x0053b590`, and `0x0053b5c0` now reads as one banked fixed-record loader and - keyed lookup family with a small recent-query cache plus a string-hash helper. The static load - loop at `0x0053ce09` seeds those banks from the pointer table rooted at `0x00624e48`, while the - lookup core partitions rows by `key & 0x1f` into `32` per-bank buckets and keeps a `10`-entry - recent-query cache rooted at `[this+0x4290c]`. The adjacent stream and staging side is bounded - too: `0x0053b630/0x0053b690/0x0053b6f0/0x0053b7c0/0x0053b830` now read as the current-entry - ordinal resolver, current-stream close/open helpers, and the shared byte-read strip, while - `0x0053b850/0x0053b8d0/0x0053b920/0x0053b970` own the local `13`-byte staging-table growth, - type-`7` service passes, and bucket-chain reset. The next owner layer is tighter now too: - `0x0053b9e0` is the broader `Pack System Leak Count : %1` report-and-reset pass, releasing the - four owned report-slot roots at `[this+0x429b0..+0x429bc]` plus sibling global `0x00ccba50`, - formatting staging-row fields through `0x0051b700`, publishing them through callback slot - `0x005c8078`, then tearing the staging slab and all per-bank handles back down. The keyed query - side now extends cleanly beyond raw lookup: `0x0053bd40` seeks the selected-or-current payload - stream and returns the handle, `0x0053be10` resolves or lazily opens one keyed typed auxiliary - object including a descriptor rooted at `data\\Other\\AirplaneTypes.txt`, `0x0053c930` is the - composite-string lookup wrapper, and `0x0053c9c0` is the matching payload-length resolver. The - local row side is now first-class too: `0x0053bf60`, `0x0053c000`, and `0x0053c070` release, - drop references on, and acquire-or-create refcounted staging rows with typed payload roots at - `[row+0x09]`, while `0x0053c900` resets the adjacent stream-plus-recent-query-cache strip. - `0x0053ca20/0x0053ca90` now bound the current-selection push/pop frame stack at `[this+0x20428]`, - and `0x0053cb10` is the small two-`u32` plus optional heap-blob reader sitting directly on top - of the shared byte-read helper. The broader bootstrap owner is tighter too: `0x0053cb60` zeroes - the whole family, allocates the four owned report slots, walks the static root-pointer table - `0x00624e14..0x00624e48`, loads banks through `0x0053b090`, and then routes selected keys such - as `companyLogo`, `portrait`, and `trainSkin` back through the typed-object strip into those - report slots. The nearby wrappers `0x0053d0f0/0x0053d110` are just the string-keyed type-`1` - and type-`6` staging-row acquire helpers above `0x0053c070`. The adjacent `0x0053d130` is - tighter now too: it strips one caller path to the final basename, derives a second stem copy - through `0x0051d8a0`, gates on `support_query_path_is_openable_for_read` `0x0051e430`, and only - then refreshes one type-`7` staging row through `0x0053c710` before resetting owner dword - `[this+0x427b0] = -1`. Immediately after that, the local - utility strip `0x0053d1d0..0x0053d470` now resolves as one scored binary-heap plus scored-node - queue family: `0x0053d1d0/0x0053d240/0x0053d2e0/0x0053d300` are the heap reorder and top-score - helpers, while `0x0053d320/0x0053d390/0x0053d440/0x0053d470` are the queue acquire, pop-highest, - membership, and release-side helpers. The sibling heap-owner body now lands too: - `0x0053d4c0/0x0053d540/0x0053d5d0/0x0053d630` are the pooled scored-heap insert, pop-top, - release, and construct-with-capacity paths over the same score-at-`+0x04` node shape. The - adjacent extended owner is now bounded too: `0x0053d6f0/0x0053d740` are the release and - construct-with-capacity paths for the sibling scored-heap owner that carries one extra sentinel - header at `[this+0x10]` plus best-score lane `[this+0x14]`, and current callers are the hotkey - report iterator `0x0045f250` and the nearby shell/runtime owner around `0x00522c67`. The next - support strip is tighter too: `0x0053d810/0x0053d870` are the CRC32-like NUL-string and fixed - byte-span hash helpers over table `0x00624e48`, while `0x0053d8a0/0x0053d960/0x0053d9e0/ - 0x0053daa0/0x0053dae0/0x0053db20/0x0053dbf0` now resolve as one intrusive `u32 -> ptr` - hash-table family with optional pooled `0x10`-byte nodes: release, insert, remove-and-return, - contains, lookup, callback iteration, and construct-with-bucket-count-and-node-capacity. - That family is already grounded on real world owners too, not just support-side data-structure - shape: connected-component and local bucket maps under `0x00416170/0x00419110`, selected owner - hashes under `0x00531ef0`, and the shell-side cleanup owner around `0x00522e7e` all use the same - pooled hash helpers. Beneath both the scored heaps and that hash family, `0x0053dcb0/ - 0x0053dcf0` are now bounded as the shared fixed-stride pool-descriptor release and reset helpers, - with freelist seeding over caller stride and count rather than one owner-family-specific allocator. - The next typed payload branch in the same banked-record family is tighter now too: row type `6` - is no longer just “some constructor under `0x0053c070`”. `0x0053ee70/0x0053e370` now read as the - construct wrapper and full constructor for one shell image-marker payload that parses a grounded - keyword set from the banked record text (`Image`, `ImageWH`, `ImageWHForceScale`, - `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`, - `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`, - `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`, - `HorizontalScaleModifier`, `VerticalScaleModifier`), registers one shell helper token through - `[0x006d401c+0xc69]`, and then hands off to `0x0053de60`. That heavier sibling is now bounded as - the payload's screen-metrics and VRAM-policy variant-table refresh owner: it derives current - screen-space scale from shell display state, resolves one selected TGA or DDS resource through - `0x0053c1c0`, and rebuilds the live variant array `[this+0x24]` through `0x005520a0` for later - consumers such as `shell_queue_world_anchor_marker` `0x00552560`. The rebuild and release side - is explicit too: `0x0053e2b0` releases current variants and the loaded image handle before - tail-jumping back into `0x0053de60`, while `0x0053e2e0/0x0053ee60` are the real destructor and - release thunk for the same type-`6` payload family. - The nearby overlay builders are tighter now too. `0x00478200` is no longer just a generic - single-marker wrapper: it validates owner id `[this+0x11b]` against collection `0x0062bae0`, - resolves that live city-database-style owner, samples normalized XY through `0x00455800` and - `0x00455810`, derives one localized label through `0x0053de00([this+0xaf],2)`, measures - projected half-height through `0x00477a10`, and then queues the finished marker through - `0x005521a0/0x00552160/0x00552560`. The broader sibling `0x00478330` now reads as the real - active-mode overlay-list owner: it derives the current world-space view box from - `[this+0xc3/+0xc7/+0xcb/+0xcf]` plus live world dims, runs six category passes `0..5`, pulls one - active-mode collection through `0x005130f0 -> 0x004b2b70` or `0x0050f600`, walks live placed - structures in `0x006cec20` through `0x0047fd50`, `0x0047df30`, and `0x0047df50`, and emits one - repeated label-marked overlay stream through `0x00477a10`, `0x004779c0`, and - `0x00552560`. After those category passes it also walks `0x006cfcbc` and can add one final - focused-region marker from `[this+0x113]` through `0x0048a170` with label id `0x3c`. The local - overlay-state helper strip under those builders is tighter now too. `0x00477af0` is the actual - default reset for the state band `[this+0xa3..+0x11f]`, seeding minimum span floor - `[this+0x11f]`, default cell bounds `[this+0xbb/+0xbf/+0xcb/+0xcf]`, scale lanes - `[this+0xd3/+0xd7/+0xdb]`, and normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]`. `0x00477a70` - is the paired scaled-max-span helper over the rebuilt cell bounds, while `0x00478dc0` and - `0x00479510` are now bounded as the two heavier owner passes above that strip: the first rebuilds - world-cell bounds and normalized rect from mode flags, raster bit `0x02`, and optional - placed-structure scans, while the second clamps and recenters those bounds and then refreshes the - normalized rect again after drag- or zoom-side updates. One input-side owner is bounded now too: - `0x00477c10` maps one screen-space point into a world-cell pair under the current overlay-state - bounds, and the larger sibling `0x00478cb0` is the drag-side loop above it that repeatedly - applies those deltas through `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0` - before re-entering the same overlay-state rebuild or clamp family. The next query above that is - tighter now too: `0x00479b50` is the nearest-target resolver for this overlay family, first - searching placed structures in `0x006cec20` through `0x0047df30/0x0047df50` and `0x0051db80`, - then optionally falling back to regions in `0x006cfca8` through `0x0048a170` when the shell-side - metric flag bit `0x4` is set. The click-side owner above that is bounded now too: `0x00479d30` - first maps the cursor through `0x00477c10`, resolves the nearest target through `0x00479b50`, - then either publishes restriction notices `0x0c12/0x0c13`, forwards one compact selector-`0x384` - request into the Multiplayer preview owner at `0x006cd8d8`, or dispatches that same local target - through the active-mode handler pair `0x004b3160/0x004b2c10` before easing the shell scalar tail - through `0x0045ea20`. The broader raster owner above this branch is bounded now too: - `0x0047a120` first stages one visible overlay rect through `0x00534930/0x00534c50`, optionally - allocates the target RGBA buffer, and then rasterizes the visible map window through the world - classification helpers `0x00534e50`, `0x00534f00`, `0x00449bd0`, and `0x00448aa0`, mapping the - result through palette table `0x005f2c34` and finally marking city-database owners from - `0x0062bae0`. The small constructor strip under that raster owner is tighter now too: - `0x0047b070` and `0x0047b0d0` are the two concrete constructors for vtable `0x005ce840`, both - reusing `0x00477af0` for default state and then seeding the trailing template byte - `[this+0xa2]`. The release and service strip under the same vtable is tighter now too: - `0x0047b110` drops template handle `[this+0xaf]` and surface root `[this+0xab]` before tailing - into the base release; `0x0047b170` is the main service body that refreshes bounds through - `0x00479510`, draws the current overlay surface, and then queues either the repeated marker list - `0x00478330`, the single city-database marker `0x00478200`, or the fallback quad path - `0x00477d80`; and `0x0047b3d0` is the narrow wrapper that reruns `0x0047a120` into a temporary - raster target and commits the result back into live surface handle `[this+0xab]`. The next local - owner strip is tighter now too: `0x0047b470` ensures surface handle `[this+0xab]` by deriving - zoom-scaled requested dimensions from the current shell zoom table at `[0x006d4024+0x11421e]`, - growing them as powers of two under controller caps, allocating one `0xec`-byte surface owner - through `0x00543980`, and immediately rerasterizing through `0x0047b3d0`; `0x0047b5e0` is the - hover-update sibling that either tracks hovered classification id `[this+0x117]` under overlay - flag `0x00400000` or refreshes nearest target ids `[this+0x10f/+0x113]` through `0x00479b50` - before forwarding the live cursor band into `0x00558760`; and `0x0047b720` is now bounded as the - main message dispatcher for the same family, with current grounded cases for id `6`, refresh pair - `0xba/0xbb`, and scalar-update id `0xbc`, dispatching into the click owner `0x00479d30`, the - drag owner `0x00478cb0`, the ensure-surface path `0x0047b470`, the reraster path `0x0047b3d0`, - and the bounds rebuild owner `0x00478dc0`. The adjacent global marker strip is tighter now too: - `0x0047ba60` clears the ten-entry global pointer-marker slot table at `0x006ceba4`, - `0x0047bb90` is the matching release loop, and `0x0047ba80` rebuilds one indexed slot by - constructing a `0x26e`-byte specialization-root object through `0x0045b680`, seeding it from - literal roots `pointer`, `pointer2`, or `pointer3` through `0x0045b9b0`, publishing the caller - world anchor through `0x004556f0`, applying scalar `0.8f` through `0x00455720`, and clearing bit - `0x20` in the derived state byte. Current grounded callers are the clustered world-side branches - at `0x0051677b`, `0x00516797`, `0x005167df`, and `0x005167fe`, so this now reads as a real - shell-side global pointer-marker slot family rather than loose specialization constructors. - That keeps the label side grounded as a real support-family database strip rather than a loose - collection of anonymous bootstrap helpers. If shell-state gate - `[0x006cec74+0x174]` is set it then posts id `320` `Setting Up Buildings...` for - `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0` - it then posts id `321` `Seeding Economy...` for `simulation_run_chunked_fast_forward_burst` - `0x00437b20`; only after those setup-side gates does the code post id `319` - `Setting up Players and Companies...`. That `319` lane is no longer just a shell-state placeholder: its - earlier hidden prepass is tighter now too: `0x00437743` is the scenario-side named - candidate-availability seeding pass over the live candidate pool `0x0062b268`, feeding the - override collection at `[state+0x66b2]` through `0x00434f20` before any visible banner is posted. - That grounded write path is narrower than the static file evidence, though: the startup reset - helper `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0` explicitly clears - `[state+0x66b2]` before the dispatch path begins, and the current exported write-side callers - we can name after that reset are still just the live-pool preseed `0x00437743`, the sibling - startup lane `0x00436ad7`, and the editor-side `Industry (Overall)` toggle handler - `0x004cf430` through `0x00434f20`. So while the fixed `0x6a70..0x73c0` candidate-availability - block is now well grounded as bundled map/save source data, a direct bulk-import path from that - block into the live runtime collection `[state+0x66b2]` is still not grounded by the current - disassembly notes. - That candidate-side table now has a grounded fixed record layout too: each entry is a `0x22`-byte - blob with a zero-terminated candidate-name slot at `[entry+0x00..+0x1d]` and one trailing - availability dword at `[entry+0x1e]`, read through `0x00434ea0` and mirrored later into - `[candidate+0x7ac]`. The same scenario state keeps a locomotive-side sibling collection at - `[state+0x66b6]`, read through `0x00435030` and updated through `0x004350b0`, which is now the - shared named locomotive-availability lane beneath the `Locomotives` editor page and the - startup-side locomotive seeding branches. That locomotive-side table is the same pattern at a - larger width: each entry is a `0x41`-byte blob with a zero-terminated locomotive-name slot at - `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`, later mirrored into - `[loco+0x7b]`. Both override dwords now read most safely as simple availability bits rather than - wider mode enums. That `319` lane is no longer just a shell-state placeholder: its - primary grounded work is still the chairman-profile pair - `world_seed_default_chairman_profile_slots` `0x004377a0` plus - `world_build_chairman_profile_slot_records` `0x00437220`, which seed the 16 selector bytes at - `[0x006cec7c+0x87]`, materialize the per-slot chairman records from the scenario selectors, - campaign override flag `[0x006cec7c+0xc5]`, and the static persona table at `0x005f2d28`, and then - publish the selected chairman-profile and linked company summary pair through `[state+0x25]` and - `[state+0x21]`. The local slot-record shape is tighter too because the shell editor panel around - `0x004cc2d0` now surfaces it directly: `[slot+0x00]` is the staged chairman profile id, - `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, - `[slot+0x02]` combines with the separate per-slot gate at `[world+0x0bc3+slot*9]` to surface - `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and - `[slot+0x04]` is the numeric tuning field. Both the selector seeder and the record materializer - treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded - writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. - That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat - flag rather than a generic role byte. The summary fields are tighter too: current direct accessors - now show `[state+0x25]` as the selected chairman profile id in `0x006ceb9c`, while `[state+0x21]` - is the linked owning company id copied from `[profile+0x1dd]` through - `scenario_state_set_selected_chairman_profile` `0x00434890`. The raw id strip under those record - helpers is tighter now too: `0x004337a0` reads `[state+0x21]` directly as the selected company - id, `0x004337b0` reads `[state+0x25]` directly as the selected chairman profile id, and - `0x00433790` is the paired raw selected-company setter that the company and chairman reassignment - flows use when the visible ownership summary changes without re-entering the full profile setter. - The underlying profile constructor family is grounded now too. `0x00476140` is the broad - named-profile constructor beneath both chairman seeding passes: it stores the caller id at - `[profile+0x00]`, marks the record live through `[profile+0x04] = 1`, seeds byte and guard lanes - across `[profile+0x291..+0x295]` and `[profile+0x1e1]`, zeroes the large per-company and tail - bands `[profile+0x2ab..]` and `[profile+0xc66..]`, copies the caller byte into `[profile+0x15c]`, - seeds `[profile+0x158]` to `7.763f`, formats localized fallback name `0x0b87` when the caller - name is empty, copies the caller biography into `[profile+0x27]`, and picks one static persona - row through `0x004760f0`. That helper is now bounded as the wrapped-unused-row allocator over the - static persona table at `0x005f2d28`, marking one zero flag byte at stride `0x27` after a - modulo-`0x29` search. The neighboring raw company-slot strip is explicit too: `0x004760a0` - resolves indexed dword slot `[profile + company_index*4 + 0x2ab]` when the caller's generation - stamp differs from `[profile+0xc43]`, and `0x004760c6` is the paired store-side helper for the - same slot plus optional stamp write. The adjacent profile-metric strip used by the player-list - page is tighter now too: `0x00476320` sums the per-company holding band `[profile+0x15d..]` - against either cached company scalar `0x00423eb0` or the broader support-adjusted company scalar - `0x00424fd0`, while `0x004763b0` folds those same per-company contributions through one extra - thresholded transform before accumulating them. The active-profile collection helpers are direct - now too: `0x004778c0` returns the live record id of the Nth active chairman profile, and - `0x00477920` counts how many active chairman profiles precede one caller-selected live record id. - The neighboring transaction and cached-metric strip is tighter now too. `0x00476780` is the - direct-total-plus-cash query (`0x00476320 + [profile+0x154]`), while `0x00476c20` is the - threshold-adjusted-total-plus-cash sibling (`0x004763b0 + [profile+0x154]`). `0x004767a0` - selects between raw cash `[profile+0x154]`, the direct holding total, or their sum, and - `0x00476810` caches selectors `0` and `1` into the local qword band rooted at `[profile+0x1e9]`. - The trade-side helpers now split cleanly too: `0x00476460` is the sell-side mutator that reduces - one company holding slot `[profile + company_id*4 + 0x15d]`, converts the resulting proceeds - through `0x00424fd0(-units,1)`, and adds the scaled result back into `[profile+0x154]`; the buy - companion is `0x00477110`, which first reuses the feasibility gate `0x00476ff0`, then increases - that same holding slot and subtracts the scaled purchase cost from `[profile+0x154]`. Between - them, `0x00476e50` computes the rounded `1000`-sized trade block by mode, and `0x00476ff0` - performs the actual buy-affordability check against current cash plus an optional direct-holdings - fallback; the reduction-side sibling `0x00476c40` uses the same threshold-adjusted-total-plus-cash - lane from `0x00476c20` as its optional fallback when the direct holding slot is too small. One - broader periodic scalar is grounded now too: `0x00476560` walks raw issue `0x39` - through `scenario_state_sum_issue_opinion_terms_raw` plus the scenario baseline at `0x00433740`, - clamps the resulting factor against several `[profile+0x154]` thresholds, and then adds the - final scaled delta back into `[profile+0x154]`; current grounded caller `0x0040a760` applies - that adjustment across every active chairman profile before the later trigger-kind-`2` pass. - The adjacent start-new-company gate is explicit now too: `0x00476d10` first rejects through - localized id `2952` `You're not able to start a new company.` when scenario gate `0x00476a60` - is active; otherwise it treats `0x004763b0(1) + [profile+0x154]` as the relevant purchasing-power - lane, succeeds only when that total reaches threshold `0x005c8830`, and on failure formats the - richer localized warning `271` `You don't have enough money to start a new company!...` using the - selected chairman profile's current purchasing-power figure from `0x004348c0`. - The adjacent persona-row lookup strip is partly explicit now too: `0x00476bb0` returns the - matched static persona row index for current profile stem `[profile+0xc47]`, while `0x00476b30` - returns the same matched row's `+0x20` asset-stem pointer or falls back to `[profile+0x20]`, - and `0x00476ab0` is the structural `+0x40` string-pointer sibling for that same row family. - The adjacent chairman refresh owner is tighter now too: `0x00433850` uses the guard pair - `0x0062be20/0x0062be1c` to walk the active-chairman collection through - `0x00477820/0x00477860 -> 0x004771e0` until no nested mutation asks for another pass. - The editor-side scenario setup surface beside that chairman panel is clearer now too. - `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` republishes the scenario - description from `[0x006cec78+0x672e]`, the start-year trio `[+0x66ca]`, `[+0x66d2]`, and - `[+0x66ce]`, the direct campaign-designated bit `[+0x66de]` through control `0x5b6e`, and the - inverse of the paired metadata byte `[+0x66f3]` through control `0x5b74`. The resource-side - anchor is now explicit too: `editorDetail.win` carries localized ids `3160/3161` `Campaign - Scenario` and `If checked, this map will be reserved as a campaign scenario.` inside the control - record rooted at `0x5b6e`, so `[+0x66de]` is now the grounded campaign-scenario flag rather than - an anonymous metadata boolean. `map_editor_scenario_metadata_panel_refresh_briefing_mode` - `0x004ca670` now bounds the single-player versus multiplayer briefing switch by flipping selector - `0x621f50`, publishing localized headings `1491` and `3586`, and refreshing the two briefing texts - from `[state+0x4f30]` and `[+0x5ae9]`. The companion dispatcher - `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0` makes the year semantics tighter - too: it commits the description and both briefing texts from edit-control payloads, toggles the - same two booleans, and clamps the three year fields to `1829..2100` while maintaining `minimum <= - default <= maximum`, which now lines up directly with the editor strings `Description:` `Minimum - Start Year:` `Default Start Year:` `Maximum Start Year:` `Briefing` and `Multi-Player Briefing`. - The neighboring special-conditions page is clearer as well: - `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0` now grounds the live owner - for the `Setup_Options_Buttons.imb` list rooted at `0xa7fa`, walks the 49-entry static rule table - at `0x005f3ab0`, counts enabled flags from `[0x006cec78+0x4a7f]`, and publishes the `Special - Conditions In Effect` summary from localized id `1053`. The same page now has a bounded live - dispatcher too: `map_editor_scenario_special_conditions_panel_handle_message` `0x004cb8e0` handles - both bulk selection controls and direct row-state changes, commits them back into - `[0x006cec78+0x4a7f]`, and then re-enters the panel constructor to refresh the summary. That table - is no longer just a raw id run; it now clearly includes the finance and construction restrictions - `2535..2563`, plus later editor toggles such as `Use Bio-Accelerator Cars`, `Disable Cargo - Economy`, `Disable Train Crashes`, `Disable Train Crashes AND Breakdowns`, and `AI Ignore - Territories At Startup`. The neighboring available-chairman page is tighter too. - `map_editor_available_chairman_panel_construct` `0x004ca540` now bounds the shell-side owner for - the 40-entry persona-availability surface under `0x5aa0..0x5b03`: it walks the same persona table - family at `0x005f2d28`, publishes one localized chairman-name row per profile, counts enabled - availability bytes from `[0x006cec78+0x6987..]`, and emits the summary `%1 out of %2 are - selected.` from localized id `1035`. The live state owner beside it is now grounded as well: - `map_editor_available_chairman_panel_handle_message` `0x004cb6f0` handles three bulk-selection - controls `0x5aa1..0x5aa3` by rewriting that same availability-byte array from preset bytes - embedded in the persona table, and it also commits direct per-row toggle changes from - `0x5aaa..0x5b03` back into `[state+0x6987..]` before refreshing the page. So the editor lane now - has three distinct scenario-setup slices rather than one chairman-only blob: chairman slots, - scenario metadata and briefings, plus both a rule-toggle matrix and an available-chairman pool. - There is now one adjacent company-side lane too: current neighboring setup flow conditionally - enters `world_conditionally_seed_named_starting_railroad_companies` `0x0047d440` when the - Multiplayer preview owner `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is - set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is - clear. That helper no longer looks like a generic company refresh. It seeds exactly three fixed - named railroad-company records from `RT3.lng` ids `575..577`: `Missouri Pacific`, `New York - Central`, and `Grand Trunk Railroad`. The first seeded company is tied back to the selected - chairman-profile summary and becomes the selected company id. The second railroad is tighter now - too: it only receives a chairman link when `profile_collection_count_active_chairman_records` - finds at least two live chairman records, and the helper then binds the zero-based second active - chairman through `profile_collection_get_nth_active_chairman_record` with ordinal `1`. The third - railroad currently gets no matching chairman-link branch in the grounded setup flow and therefore - remains an unchaired named company in the live roster. The shell UI above that setup lane is now - tighter as well: `shell_company_list_window_construct` `0x004c7200` builds a live company-list - window over the company collection at `0x0062be10`, `shell_company_list_window_refresh_rows` - `0x004c6c30` formats the active companies with localized strings `267..270`, and only then - conditionally appends one synthetic row id `0x7fff` through - `shell_company_list_format_company_or_start_row` `0x004c6b40` so `<>` appears - as a separate affordance rather than as part of the seeded trio itself. Current shell paging - around that same roster is tighter too because the live company collection now has a grounded - active-only ordinal helper family: `company_collection_count_active_companies` `0x00429a50`, - `company_collection_count_active_companies_before_company_id` `0x004299f0`, and - `company_collection_get_nth_active_company_id` `0x00429990`. Those helpers now anchor the “current - company among active companies” math used by shell-side detail and picker flows rather than - leaving it as anonymous collection glue. `shell_company_list_window_handle_message` `0x004c6f30` - then routes the synthetic row into `start_new_company_dialog_open` `0x0047d080`, whose commit path - now grounds through `start_new_company_dialog_commit_create_company` `0x0047d120`. That lower - helper unlinks any current chairman-owned company, allocates a fresh company id from the live - collection at `0x0062be10`, initializes it through `0x00428420`, and only then publishes the new - selected company. The neighboring compact request helper - `start_new_company_request_create_company` `0x0047d320` does the same fresh-company path from a - request block and is already reached from the startup-company branch at `0x00470e48`. The dialog - side is tighter now too: `0x0047c070` and `0x0047bea0` rebuild the two funding-band globals from - the selected chairman profile through `0x00476c20` and `0x00476950`, publish their range cards - into controls `0x714f` and `0x7150`, `0x0047c190` republishes the current pair `0x006cec14` and - `0x006cec10` into controls `0x7149` and `0x714a`, `0x0047c220` snaps those two current funding - lanes back onto the active band steps, and `0x0047c360` is the small child-control callback gate - over that same funding family. The immediate pre-open helper `0x0047d020` is now bounded too: it - seeds the staged dialog name buffer and then runs the same clustered funding-band rebuild sequence - before `start_new_company_dialog_open` continues into the constructor/callback modal path. The - constructor and message side are bounded enough now too: `0x0047c590` constructs the modal dialog - controls for `0x714f/0x7150/0x7149/0x714a/0x714b/0x714c/0x714d/0x714e`, installs callback - `0x0047c360` on the funding-band pair, and publishes the live dialog root at `0x006cec18`, - while `0x0047c3a0` is the main dialog message owner over shell messages `0xca/0xcb`, the staged - name field `0x714b`, the two funding-step controls `0x714c/0x714d`, the companion summary lane - `0x714e`, and the modal notice branch rooted at `0x03f2/0x03f4`. The - immediate sibling shell branch below that roster is still station-oriented: current grounded - resource names and handlers put one branch on `shell_station_detail_window_construct` - `0x005068c0`, another on `shell_station_list_window_construct` `0x005074c0`, and the subordinate - selector lane on `shell_station_pick_window_open_modal_and_return_selected_station_id` - `0x005078c0` above `shell_station_pick_window_construct` `0x00507620`. But the broader - company-detail ownership question is no longer open. There is now a separately grounded - `CompanyDetail.win` family rooted at `shell_company_detail_window_construct` `0x004c5540`, with - `shell_company_detail_window_handle_message` `0x004c56a0` as its main dispatcher and - `shell_company_detail_window_refresh_controls` `0x004c2ca0` as the shared repopulation pass for - the selected-company presentation and tabbed control bands around `0x9476..0x9490`. A grounded - direct shell-command strip now sits cleanly above those two company panels too: `0x00433a40` is - the shared availability gate for both the company-list and selected-company-detail lanes, - rejecting only when scenario toggle `[0x006cec78+0x4aef]` is set. `0x004405a0` uses that gate to - open detail-panel mode `7` as the direct company-list path, while `0x004405d0` first recovers - the selected-company id through `0x004337a0`, optionally offers `Start New Company` through - `0x0047d080` after warning `368` when no company is selected, and only then opens detail-panel - mode `8` for the selected-company `CompanyDetail.win` lane. A grounded - shell detail-manager caller reaches that constructor at `0x004dde24`, the first finance-action - layer beneath it is now bounded through `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, - `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, - `shell_company_detail_buyback_stock_flow` `0x004c46d0`, and - `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, and the first non-finance layer is - now bounded too through `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`, - `shell_company_detail_bankruptcy_flow` `0x004c5b99`, the territory-access family rooted at - `shell_company_detail_refresh_selected_territory_access_summary` `0x004c1b60` plus - `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, backed by - `company_clear_selected_chairman_if_current_profile` `0x00428a10`, - `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90`, - `company_has_territory_access_rights` `0x00424010`, `company_set_territory_access_rights_byte` - `0x00424030`, and `company_can_purchase_territory_access_rights` `0x00426be0`, plus the two - control-transfer lanes. `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0` now - grounds the special chairman's election path: it checks the caller's current stock ownership in - the target company, rejects insufficient holdings through localized id `623`, rejects recent - failed attempts through id `624`, and then opens the confirmation under id `625` before seeding - the local takeover-election state or packaging the same request through the multiplayer shell - transport. The follow-on resolver `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` - `0x0050c940` now closes the single-player election loop too: it walks the active chairman profile - collection, computes weighted votes for and against the takeover, compares the affirmative total - against half the target-company value, presents the result through - `shell_present_chairmanship_takeover_vote_outcome_dialog` `0x0050c500` in single-player or - localized id `3082` in multiplayer, and then either transfers chairmanship through `0x00428a30` or - stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field. - `shell_company_detail_attempt_merger_flow` `0x004ec640` now grounds the merger side too: it - rejects empty worlds through id `727`, rejects recent failed attempts through id `728`, checks the - proposed premium against company cash through localized id `3889`, and then commits into the - resolver family. That merger resolver is now bounded too: - `shell_resolve_merger_vote_and_commit_outcome` `0x004ebd10` walks the active chairman profile - collection, computes weighted votes for and against the proposed merger, compares the affirmative - total against half the target-company value, presents the result through - `shell_present_merger_vote_outcome_dialog` `0x004eb890` in single-player or localized id `3059` in - multiplayer, and then either commits the merger through `0x00427e20` or stamps the current year - into `[company+0x15f]` as the grounded merger-cooldown field. The vote-bias side beneath that - resolver is tighter now too: `scenario_state_compute_issue_opinion_multiplier` `0x00436590` is no - longer just an abstract issue table lookup because its merger callsite uses issue id `0x3a`, which - lines up directly with localized id `726` saying merger votes depend on public attitude toward the - management of the two companies. By contrast the broader support-adjusted share-price helper - `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` uses issue id `0x37`, - and the shared setter under that lane is tighter now too: `0x004339b0` clamps one small - scenario-side issue value into `[state+0x2d]` with range `0..4`, derives one companion scalar in - `[state+0x29]`, and then forces a live-company sweep through `0x00424fd0` so the support-adjusted - share-price family is recomputed immediately after the issue lane changes. The finance-side debt - helpers now bound `0x38` and `0x39` separately as the explicit - credit-rating and prime-rate lanes. That leaves `0x37` as the broader investor-confidence lane - behind equity support, share price, and adjacent governance pressure, with the strongest current - text anchors coming from the investor-attitude strings `1217` and `3048/3049` about company or - chairman performance rather than from the merger-only management-attitude term. One older local lead is now ruled out too: the - `0x460900..0x460cac` / `0x473620` setup block is the camera-view command family over localized ids - `3474..3493` (`Select/Assign Camera View 1..9` and `0`), not issue-opinion infrastructure, so it - should no longer be used as evidence for the player-facing meaning of issue `0x37`. The editor-side - `Stock Prices` label is also no longer being used as direct evidence here: the `0x4ca980` / - `0x4cadf0` panel owns a separate float-tuning block `[state+0x0bde..0x0bf6]`, with - `[state+0x0bde]` merely mirroring `[state+0x0be2]`, so that label belongs to a different - settings family than the issue table behind `0x37`. A direct shell-resource follow-up now narrows - the remaining caption question too: the extracted `CompanyDetail.win` blob from `rt3_2WIN.PK4` - contains no plain-English investor or finance caption for this lane, which matches the owner-side - read that section-0 is a dynamic `0x947f` text widget fed by - `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a separate - fixed label row. The supporting stat layer is bounded more cleanly now too: the - surrounding `0x0b` setup in the merger and takeover offer builders is formatter mode rather than a - player-facing issue number, while the company-side stat wrapper - `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` now reads as a generic - stat-family accessor over year-relative series or the bounded slot family in - `company_read_control_transfer_metric_slot` `0x0042a2e0`. Its recurring family token `0x2329` is - no longer treated as an issue id here either; it is the stat-family selector paired with localized - company-stat label id `2329`. That means the paired raw and scaled helpers at `0x004241e0` and - `0x00424200` now read as narrow control-transfer offer policy totals instead of direct - issue-argument consumers, and the same broader support-and-governance metric family now also feeds - the annual shareholder-revolt and creditor-liquidation lane surfaced by localized ids `300..304`. - The editor-side help text cluster around ids `2433..2437` is no longer floating either: current - grounded map-editor code now has a live economic tuning family beside the chairman-slot panel. - `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` binds six slider controls through - `map_editor_economic_cost_slider_dispatch` `0x004ca980` into the scenario-state float block - `[0x006cec78+0x0be2..0x0bf6]`, while the surrounding descriptor table at `0x00611c70..0x00612220` - pairs that wider editor lane with localized fields `Prime Rate`, `Merger Premium`, and `Build - Stations Cost` through `Steam Engine Cost` plus the comparison or help texts `2433..2437`. The - broader shell-state master flag at `[0x006cec74+0x68]` still sits above the remaining post-load - phases, plus two narrower per-phase gates: `[0x006cec74+0x174]` directly fronts id `320` `Setting - Up Buildings...` and the later region-owned structure-demand and placement pass through - `world_region_collection_run_building_population_pass` `0x00421c20` plus the deeper per-region - worker `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, while - `[0x006cec74+0x178]` directly fronts id `321` `Seeding Economy...` and the chunked burst helper - `simulation_run_chunked_fast_forward_burst`, whose grounded tail now also sweeps the live region - collection through `world_region_refresh_cached_category_totals_and_weight_slots` `0x00423d30`; - id `322` then fronts `Calculating Heights...`. The - master `+0x68` flag is no longer just structural: the shell load/save coordinators now use the - same flag to force the editor-map `.gmp` family, so current evidence treats it as the broader - editor-map mode above those later setup branches rather than an unnamed generic toggle. That - worker is no longer one opaque building bucket: current grounded categories split into `House`, a - weighted region-profile family surfaced through the `Industry Weightings` stats path, and a third - branch whose low-level fallback token is `Commercial` but whose aligned stats label is `City - Support`. The same placement-commit gate beneath it, `world_region_validate_and_commit_candidate_placement` - `0x00422a70`, is also corroborated by the separate world-side randomized batch helper - `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, which retries - placements around one compact center/radius record rather than the ordinary per-region demand - deficits. That batch placer now sits under a wider compact runtime-effect dispatcher, - `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, so the world-side - branch is no longer just “another caller near `0x43051e`” but one real effect family alongside - the ordinary region-demand worker. Above that, the live scenario event collection at `0x0062be18` - now has a tighter runtime-effect lane too: `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` - `0x004323a0` services one live runtime-effect record, dispatches its linked compact effects - through `0x00431b20`, and can synthesize follow-on records through - `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` - `0x00430b50`, which in turn allocates new live records through - `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`. - Above that, `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` - `0x00432f40` now bounds the collection-wide loop that services those live runtime-effect records - for one trigger kind. That trigger split is tighter now too: recurring simulation maintenance - drives kinds `1`, `0`, `3`, and `2`; the neighboring route-style follow-on drives `5` and `4`; - startup-company and named-railroad creation branches drive `7`; kind `6` is now bounded as a - mixed post-change family spanning the placed-structure post-create tail, one build-version-gated - company-startup or roster-refresh tail, and the route-entry post-change sweep on `0x006cfca8`; - one world-entry-side one-shot gate drives `8` and then clears shell-profile latch - `[0x006cec7c+0x97]`; the briefing-text query lane is kind `9`; and the collection dirty latch - still forces the internal rerun at kind `0x0a`. - That moves this branch out of the “isolated world-side placement oddity” bucket and into a real - scenario-runtime effect pipeline with a mostly bounded trigger-kind family. - The same lower helper also reappears later on a slower - simulation-side cadence with - scale `1/12`, so it no longer looks like one-time setup glue only. The actual game-speed control - family remains separate, rooted at `world_set_game_speed_mode` `0x00434680`, - `world_adjust_game_speed_mode_delta` `0x00434850`, and `world_toggle_pause_or_restore_game_speed` - `0x00437a60`. The direct shell command stub above that family is now explicit too: `0x00440880` - just re-enters the pause-or-resume toggle with flag `1` and then issues one indexed shell - feedback nudge through `0x0045ea20` with selector `0x2c` and scalar `0.5f`. That feedback path - is tighter now too: `0x0045ea20` is the reusable indexed audio-feedback helper over the - table-driven pairs at `0x005f0828/0x005f082c`, and `0x00531e10` is the shell-audio-service sink - that only dispatches those nudges when the live service gates are satisfied. -### Camera View Command Strip - -The adjacent shell-command family at `0x004408f0..0x00440c30` is now - grounded as the ten-slot `Assign/Select Camera View` owner rather than as a generic modal strip. - `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0` snapshots one `0x30`-byte - record inside the live world-view owner through `world_view_store_camera_view_slot_snapshot` - `0x0043b2c0`, storing both the live view tuple `[view+0x04..+0x24]` and one saved focus-kind pair - from `[0x006cec78+0x45/+0x49]`; `shell_select_camera_view_slot_or_publish_unassigned_warning` - `0x004409c0` then re-enters `world_view_restore_camera_view_slot_snapshot_if_populated` - `0x0043ca20`, which restores the same fields, optionally replays the saved focus through - `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and returns silently on success. - Only empty slots surface the shared shell modal path, using localized ids `371..373` after one - label-format pass through `0x0051b700`. The wrapper strip `0x00440b00..0x00440c30` is now fully - bounded too: `0x00440b00/10/20/30/40/50/60/70/80/90` are `Assign Camera View 1..9/0`, while - `0x00440ba0/b0/c0/d0/e0/f0/c00/c10/c20/c30` are `Select Camera View 1..9/0`, and the - registration block at `0x00460903..0x00460cac` ties those wrappers to localized command ids - `3474..3493`. -### CompanyDetail Addendum - -The shared helper `shell_company_detail_resolve_selected_company` at - `0x004c16f0` now bounds the common current-company accessor beneath the whole pane, and the - read-side owner also has a separate active-company navigation family through - `shell_company_detail_step_selected_active_company_delta` at `0x004c3470` plus the next or - previous wrappers at `0x004c3540` and `0x004c3550`. The section switch in - `shell_company_detail_window_refresh_controls` is now grounded too: section index `0x006cfe60` - selects a chairman/governance slice, a debt-and-capital slice, a per-share slice, or a - territory-access slice, published through the tab band around `0x9472..0x9479`, with adjacent - section-navigation controls around `0x947b..0x947c` and `0x948f..0x9490`. -### Key Dispatchers - -`shell_controller_window_message_dispatch`, - `shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`, - `shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`, - `world_runtime_serialize_smp_bundle`, `simulation_frame_accumulate_and_step_world`, - `game_message_window_service_if_present`, `game_message_window_service_frame`, - `game_uppermost_window_handle_message`, `game_uppermost_window_service_world_hotspot_band`, - `game_uppermost_window_refresh_controls`, - `world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`, - `world_view_step_zoom_bucket`, `world_seed_default_chairman_profile_slots`, - `world_build_chairman_profile_slot_records`, - `world_conditionally_seed_named_starting_railroad_companies`, - `scenario_state_set_selected_chairman_profile`, - `scenario_state_get_selected_chairman_profile_record`, - `scenario_state_get_selected_chairman_company_record`, `shell_company_list_window_construct`, - `shell_company_list_window_refresh_rows`, `shell_company_list_window_handle_message`, - `start_new_company_dialog_open`, `start_new_company_dialog_commit_create_company`, - `start_new_company_request_create_company`, `shell_station_detail_window_construct`, - `shell_station_list_window_construct`, `shell_station_list_window_handle_message`, - `shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`, - `map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_handle_message`, - `map_editor_chairman_slot_panel_refresh_selected_slot`, - `map_editor_chairman_slot_panel_cycle_selected_slot_profile`, - `map_editor_available_chairman_panel_construct`, - `map_editor_available_chairman_panel_handle_message`, - `map_editor_scenario_metadata_panel_refresh_briefing_mode`, - `map_editor_scenario_metadata_panel_refresh_controls`, - `map_editor_scenario_metadata_panel_handle_message`, - `map_editor_scenario_special_conditions_panel_construct`, - `map_editor_scenario_special_conditions_panel_handle_message`, - `map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`, - `station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`, - `track_lay_window_refresh_controls`, `track_lay_window_service_frame`, - `track_lay_window_handle_message`, `simulation_advance_to_target_calendar_point`, the smaller - single-step helper at `0x00409e80`, `0x0040a9c0`, `0x0040a910`, and - `simulation_service_periodic_boundary_work`. -### State Anchors - -Shell input object `0x006d4018`, per-key state table starting at `[input+0x100]`, - packed shell input flags at `[input+0xa8c]` now grounded as Right Shift `0x1`, Left Shift `0x2`, - Control `0x4`, and Alt `0x20`, nested dispatch counter `[input+0xa90]`, global shell controller - `0x006d4024`, active world root `0x0062c120`, `GameMessage.win` object `0x006d081c`, - `GameUppermost.win` overlay object `0x006d0820`, `StationPlace.win` tool object `0x006d1720`, - `TrackLay.win` tool object `0x006d1a8c`, accumulated leftover simulation time at `[this+0x4c80]`, - shell and mode globals at `0x006cec74`, `0x006cec78`, and `0x006cec7c`, world manager collections - at `0x0062be10`, `0x006ceb9c`, `0x006cfcbc`, `0x006cec20`, `0x0062bae0`, and `0x006acd34`, plus - the packed calendar-like tuple fields around `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and - `[this+0x14]`. -### Subsystem Handoffs - -The controller window dispatcher now looks like the first grounded input - ingress. It translates keyboard and mouse `WM_*` traffic into shell controller state and the - separate input object at `0x006d4018`; read-side cursor and camera helpers later snapshot that - object through `shell_input_snapshot_dispatch_state` and gate world-relative interaction through - `shell_input_cursor_inside_active_view`. Current grounded consumers around `0x00478cb0`, - `0x004e0780`, `0x0053f450`, and `0x0053fe90` still sit on the shell controller path and consult - `0x006d4024` or the world owner at `0x0062be68`, so there is still no evidence for a distinct - gameplay-only input object after world entry. Instead, the first deeper world-mode interaction - branch now looks like a shared world-view coordinator layered on top of the same shell-fed input - state. Shell_transition_mode ensures the `GameUppermost.win` object at `0x006d0820`; its message - dispatcher `game_uppermost_window_handle_message` owns the narrow action band `0x7918` through - `0x7921`; and the recurring service helper `game_uppermost_window_service_world_hotspot_band` - rate-limits those hotspot actions, rechecks `shell_input_cursor_inside_active_view`, and then pans - the live world view through `world_view_pan_relative_offset_in_camera_plane` `0x0043d130`. The - same lower setter family is also reached from the cursor-drag path through - `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`. Above both of those sits the - larger recurring service `world_view_service_shell_input_pan_and_hover` `0x0043db00`, which now - has one grounded keyboard branch beneath it: - `world_view_service_keyboard_turn_pan_and_zoom_bindings` `0x0043d740`. That helper resolves four - binding-pair families from the shell input table via `0x0054e7d0`, and the localized labels are - now grounded from `Data/Language/RT3.lng`: `Camera Forward` and `Camera Backward` feed the first - signed pan channel, `Camera Left` and `Camera Right` feed the second signed pan channel, `Camera - Zoom In` and `Camera Zoom Out` feed the signed zoom-step channel that `0x0043db00` smooths into - `world_view_step_zoom_bucket` `0x0043cc30`, and `Camera Rotate Left` plus `Camera Rotate Right` - feed the continuous heading-turn branch through `0x0043c810`. The setup side is now better bounded - too: `world_view_seed_keyboard_binding_slot_pairs` at `0x00439e40` seeds the eight slot pairs at - `[this+0x0a6]` through `[this+0x0e2]` from the global action-binding registry through - `shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id` `0x0045f370` using - the distinct registry keys `0x0043d2a0` through `0x0043d310`, and the registration block at - `0x00460769` through `0x004608e7` plus the shared installer - `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` show those roots - are defaulted to the expected Up Down Left and Right virtual keys before runtime polling begins. - The adjacent lookup strip is tighter now too: `shell_input_binding_registry_resolve_entry_by_action_stem` - `0x0045ede0` resolves one action stem into the live binding registry, while - `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and - `shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400` are the small - display-label and primary-code wrappers above that resolver. The camera-view modal family at - `0x004408f0/0x004409c0` now uses that same strip directly when formatting the optional focus-label - lines inside the assign/select camera-view confirmations. The lower label path is now bounded too: - `shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90` is the actual - registry-entry formatter with the three localized prefix fragments `0xdef/0xdf0/0xdf1` plus the - descriptor-table caption fallback at `0x005f0a34`, and - `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` - `0x0045ed90` is the descriptor-side bucket-key helper used by the installer when the target mode - mask is singular. The same local family now reaches one step further into the hotkeys sidecar: - `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250` builds a - temporary sorted report queue over the live registry, `shell_input_write_hotkeys_report_file` - `0x0045f550` writes the resulting table to `hotkeys\hotkeys.txt`, and the hotkey reassignment path - uses the smaller helpers `0x0045ec00`, `0x0045ec70`, `0x0045ecd0`, `0x0045ed70`, `0x0045ef00`, - and `0x0045f8a0` to split imported `foo+bar` labels, recover one action id from the descriptor - table, decode a compact modifier code, expand that code back into the live registry mask, and - finally rebucket or replace the live binding entry. The surrounding registry lifecycle is tighter - now too: `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0` - seeds the fixed defaults from `0x005ecadc` and then appends the smaller manual shell-command - strip; `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070` is the - hard reset that also flushes `hotkeys\hotkeys.txt`; and - `shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file` - `0x00461120` rebuilds the pool roots, reseeds defaults, and tail-jumps into - `shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels` `0x0045f420` - when the caller requests saved-hotkey import. - Beneath that camera stack, the enclosing frame - path now has one grounded non-view sidecar: after `0x0043db00` it reads the active controller-view - object pointer at `[0x006d4024+0x18]+0x366e`, compares it against the latched target at - `[frame_owner+0x66a2]`, fires exit and enter-style vtable callbacks on pointer changes through - slots `+0x64` and `+0x60`, and only latches the new object when the object passes its own slot - `+0x1c` availability test and shell detail control id `0x07d6` on `0x006d0818` has flag bit `0x4`. - That `0x07d6` gate is now more bounded than before: the dedicated `TrackLay.win` tool family - rooted at `0x006d1a8c` special-cases the same control id in both `track_lay_window_service_frame` - and `track_lay_window_handle_message`, uses world hit tests through `0x00448ac0` to arm and - release a drag latch on that surface, and routes the resulting command work through the shared - track-lay mode state at `0x00622b0c`. The surrounding `track_lay_window_refresh_controls` pass now - shows that this is not just one isolated drag handler: the same tool family owns three mutually - exclusive primary mode buttons at `0x985e` `0x985f` and `0x9860`, and current primary evidence now - bounds those values as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40` - from the localized strings 2054 2055 and 1721 plus the matching control-routing branches in - `track_lay_window_handle_message`. The same family also owns the downstream route-entry policy - bridge at `0x004955b0`: current caller evidence says that helper maps the live TrackLay primary - mode into endpoint-synthesis policy `1` or `4` before the tool re-enters `0x00493cf0`, which is - the strongest current bridge from the player-facing single-track versus double-track buttons into - the lower route-builder policy bytes. The same family also owns a bridge-type preference selector - rooted at `0x006cec74+0x138`, two wrapped `Never` through `Common` frequency settings at - `0x006cec74+0x140` and `0x006cec74+0x13c`, two boolean track-lay preference toggles, and the - electrify-all-track action path. Those last two toggles are now tighter than before: current - evidence strongly aligns control `0x986e` and state `0x006cec74+0x144` with `Auto-Hide Trees - During Track Lay` from strings 1838 and 1839, while control `0x986d` and state `0x006cec78+0x4c74` - align with `Auto-Show Grade During Track Lay` from strings 3904 and 3905. That mapping is still - evidence-backed rather than absolutely direct from a recovered resource table, but the state - ownership and control order now make it the strongest current fit. That makes `0x07d6` look like - the shared main-world interaction surface inside a broader TrackLay world-command subsystem, not - an unrelated detail button. The neighboring `StationPlace.win` family is now grounded on that same - surface too: the shell detail-panel constructor family allocates it through - `station_place_window_construct` at `0x00509d80`, publishes it at `0x006d1720`, services it each - frame through `station_place_window_service_frame` at `0x0050a530`, and routes player-facing - commands through `station_place_window_handle_message` at `0x005091b0`. That dispatcher - special-cases the same `0x07d6` control, and the shared helper - `station_place_world_surface_sync_and_dispatch` at `0x00508bb0` either accepts that direct surface - traffic or falls back to the same detail-panel control looked up through `0x006d0818`, rechecks - flag bit `0x4`, hit-tests the world through `0x00448ac0`, stages world coordinates into - `0x006d1738/0x006d173c`, refreshes the remaining preview metric field through - `station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and updates the live - station-placement selection state at `0x00622af0`, `0x00622aec`, and `0x006d1740`. The tool-side - save and restore choreography is tighter now too: `station_place_window_release_cached_selection_handles_and_world_followons` - `0x005079c0` releases cached helper handles `[this+0x7c/+0x80/+0x88/+0x84]` through the matching - global owners after re-entering world and placed-structure follow-ons, and the thin wrapper - `0x00507a50` is the entry used by the broader save-load status-stack helpers. The category side - of that state is now tighter too: the shared helper `0x0044bd10` quantizes the staged world coordinates into the - current cell, resolves the mixed byte-or-word region id from `[world+0x212d]`, looks up the - owning city-or-region entry through `0x0062bae0`, and returns `[entry+0x272]` with fallback - `5`; the StationPlace world-surface branches at `0x00508b80`, `0x00508d59`, and `0x0050a4e6` - use that result directly to refresh the current selection category latch at `0x00622af0`. - Together with - `station_place_select_category_and_refresh` `0x00508880`, - `station_place_refresh_category_controls` `0x00507b90`, and `station_place_format_preview_panel` - `0x00508730`, that makes StationPlace a second grounded consumer of the shared main-world - interaction surface rather than only a sibling constructor plus frame hook. The StationPlace - control semantics are now tighter too: the top category strip at `0x697c` through `0x6981` now - grounds as small station, medium station, large station, service tower, maintenance facility, and - non-station building from `RT3.lng` strings 2197 through 2202. For the three station categories - only, the secondary strip at `0x6988` and `0x6989` plus display field `0x698c` no longer looks - like another placement mode family; it is a building-style scroller. The click handlers on - `0x6988` and `0x6989` cycle the style override in `0x00622aec`, and the display path builds the - active style token from `StationSml`, `StationMed`, or `StationLrg` plus the localized - architecture styles `Victorian`, `Tudor`, `Southwest`, `Persian`, `Kyoto`, and `Clapboard` from - `RT3.lng` ids 2672 through 2667. One layer lower, the remaining opaque controls are now much - tighter: `0x6985` and `0x6986` are no longer a generic assist toggle but the two station-rotation - policy choices from strings 2207 and 2206, switching between auto-orienting the building to track - or obstacles and strictly obeying the rotation specified by the circle above. The dedicated - control at `0x6987` is the station-rotation circle itself, wired through - `station_place_rotation_circle_callback_publish_current_heading_widget` `0x00507a90` and aligned - with `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` - string 2208. The lower rotation strip is now grounded too: - `station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` owns the write to - `0x006d172c` and the live selected-site pose refresh, `station_place_window_drag_rotate_selected_site_toward_world_cursor` - `0x00507d80` is the drag-update branch under the dispatcher, and - `station_place_step_rotation_by_integer_notches` `0x005086c0` is the discrete notch helper used by - the neighboring StationPlace rotation-step branches. That matches the lower behavior too: when the - strict-rotation choice is off, both preview and commit paths route staged coordinates through - `station_place_window_try_auto_orient_candidate_to_covering_route_entry_and_validate_placement` - `0x00508040`, which performs the extra orientation search before validation by retrying a small - orientation-mode set around the reusable covering-route-entry helper `0x00417b40`; when strict - rotation is on, that pass is skipped and the current angle in `0x006d172c` is used directly. The - preview strip is tighter now too: `station_place_format_preview_panel` `0x00508730` is the real - owner for controls `0x6982/0x6983/0x6984`, and the middle field `0x6983` is no longer anonymous. - `station_place_refresh_preview_metric_control_0x6983` `0x00508550` resolves the staged world-cell - category through `0x0044ad60`, reads the linked profile scalar at `[profile+0x22]`, chooses issue - slot `0x3b` or `0x3c` from candidate subtype byte `[candidate+0x32]`, folds that scalar through - `scenario_state_compute_issue_opinion_multiplier` `0x00436590`, and then passes it through the - version-gated quantizer `0x005084a0` before formatting the visible text into control `0x6983`. - The singleton-side entry above that strip is explicit now too: - `station_place_format_preview_panel_if_live_singleton_and_valid_selection` `0x00508860` only - forwards non-`-1` selection ids into that refresh path when `0x006d1720` is live. - One layer below preview versus commit, the shared gate is also tighter now: - `station_place_validate_current_selection_at_world_coords_and_optionally_format_status` - `0x00507e80` is the common validation-and-status path beneath the preview and commit branches, - publishing red, yellow, or green feedback through `0x0040cb10` around the same - `placed_structure_validate_projected_candidate_placement` `0x004197e0` core. The - direct shell UI also exposes the same discrete view-step family through - `world_view_step_heading_quadrant` `0x0043cb00` and - `world_view_step_zoom_bucket` `0x0043cc30`. The neighboring gating predicates - `world_view_should_drive_primary_pan_channel` and `world_view_should_drive_secondary_pan_channel` - test packed shell input bits `0x3`, and `shell_input_apply_window_key_transition` now grounds - those bits as the left and right Shift modifiers from scan codes `0x2a` and `0x36`. That means - cursor drag, overlay hotspots, held Shift state, direct keyboard turn/pan/zoom bindings, the - TrackLay and StationPlace world-command surfaces, and at least one frame-owned hover or - focus-target branch all converge under the same shell-fed world-mode input path rather than a - separate gameplay-input stack. -### Evidence - -Function-map rows for `shell_controller_window_message_dispatch`, - `shell_drain_pending_window_messages`, `shell_input_state_init`, - `shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`, - `shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`, - `world_runtime_serialize_smp_bundle`, `world_entry_transition_and_runtime_bringup`, - `simulation_frame_accumulate_and_step_world`, `game_message_window_service_if_present`, - `game_message_window_service_frame`, `shell_ensure_game_uppermost_window`, - `game_uppermost_window_construct`, `game_uppermost_window_handle_message`, - `game_uppermost_window_service_world_hotspot_band`, `world_view_set_focus_position_xyz`, - `world_view_apply_screen_delta_to_focus_position`, - `world_view_pan_relative_offset_in_camera_plane`, `world_view_seed_keyboard_binding_slot_pairs`, - `world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`, - `world_view_step_zoom_bucket`, `world_view_should_drive_primary_pan_channel`, - `world_view_should_drive_secondary_pan_channel`, `world_view_service_shell_input_pan_and_hover`, - `world_seed_default_chairman_profile_slots`, `world_build_chairman_profile_slot_records`, - `world_conditionally_seed_named_starting_railroad_companies`, - `profile_collection_count_active_chairman_records`, - `profile_collection_get_nth_active_chairman_record`, - `scenario_state_set_selected_chairman_profile`, - `scenario_state_get_selected_chairman_profile_record`, - `scenario_state_get_selected_chairman_company_record`, `start_new_company_dialog_open`, - `start_new_company_dialog_commit_create_company`, `start_new_company_request_create_company`, - `shell_company_list_format_company_or_start_row`, - `shell_company_list_activate_or_shift_center_company`, `shell_company_list_window_refresh_rows`, - `shell_company_list_window_handle_message`, `shell_company_list_window_construct`, - `shell_company_detail_window_refresh_controls`, `shell_company_detail_window_construct`, - `shell_company_detail_window_handle_message`, `shell_station_detail_window_construct`, - `shell_station_list_window_construct`, `shell_station_list_window_handle_message`, - `shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`, - `map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_refresh_slot_list`, - `map_editor_chairman_slot_panel_refresh_selected_slot`, - `map_editor_chairman_slot_panel_refresh_slot_counters`, - `map_editor_chairman_slot_panel_cycle_selected_slot_profile`, - `map_editor_chairman_slot_panel_handle_message`, `map_editor_available_chairman_panel_construct`, - `map_editor_available_chairman_panel_handle_message`, - `map_editor_scenario_metadata_panel_refresh_briefing_mode`, - `map_editor_scenario_metadata_panel_refresh_controls`, - `map_editor_scenario_metadata_panel_handle_message`, - `map_editor_scenario_special_conditions_panel_construct`, - `map_editor_scenario_special_conditions_panel_handle_message`, - `map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`, - `station_place_refresh_category_controls`, `station_place_format_selected_site_summary`, - `station_place_format_preview_panel`, `station_place_select_category_and_refresh`, - `station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`, - `station_place_window_construct`, `station_place_window_service_frame`, - `track_lay_window_refresh_controls`, `track_lay_window_construct`, - `track_lay_window_service_frame`, `track_lay_window_handle_message`, and - `simulation_service_periodic_boundary_work`, plus the shell-input disassembly around `0x0054f290`, - `0x0054e880`, `0x0054e9c0`, `0x0054ea20`, `0x0054eb10`, and `0x0054ee50`, - the world-view setup and service branches around `0x00439e40`, `0x0043d740`, `0x0043db00`, - `0x0043cb00`, and `0x0043cc30`, the `319` setup-side branches around `0x004377a0`, `0x00437220`, - `0x00477820`, `0x00477860`, `0x0047d440`, `0x004c6c30`, `0x004c6f30`, `0x0047d080`, `0x0047d120`, - `0x0047d320`, `0x004c2ca0`, `0x004c5540`, `0x004c56a0`, `0x005068c0`, `0x005071e0`, `0x005074c0`, - and `0x005076c0`, the direct summary-field helpers around `0x00434870` `0x00434890` and - `0x004348c0`, the company-link writers at `0x00427c70` and `0x00427d74`, the company constructor - at `0x00428420`, the startup-company branch around `0x00470e48`, the shell company-list strings - `266` `<>`, `267` `You are the chairman of the %1!`, `268` `The %1 has no - chairman at the moment.`, `269` `%1 is the chairman of the %2.`, `270` `Double-click for - details.`, and `2992` `Shift-Click to center on this company's primary station.`, the - `CompanyDetail.imb` and `CompanyDetail.win` resource strings in `.rdata`, the `StationDetail.imb`, - `StationDetail.win`, `StationList.win`, and `StationPick.win` resource strings in `.rdata`, the - shell editor window branches around `0x004c9da0`, `0x004ca010`, `0x004ca1c0`, `0x004ca540`, - `0x004ca670`, `0x004ca790`, `0x004ca980`, `0x004cb2b0`, `0x004cb4a0`, `0x004cb6f0`, `0x004cb8e0`, - `0x004cc250`, `0x004cc2d0`, `0x004ceb90`, and `0x004cecc0`, the localized chairman-slot strings - `2997` through `3001` `Optional` `Mandatory` `Human or Computer` `Computer` and `Human`, the - localized scenario-editor strings `1483..1492` `Description:` through `Type the briefing for this - map.`, the localized summary strings `1035` `%1 out of %2 are selected.` and `1053` `Special - Conditions In Effect`, the 40-entry persona availability page under `0x5aa0..0x5b03`, the 36-entry - special-condition table at `0x005f3ab0` covering ids `2535..2563`, `2874`, `3722`, `3835`, `3850`, - `3852`, and `3920`, the static persona table at `0x005f2d28`, the selector array at - `0x006cec7c+0x87`, the persona collection at `0x006ceb9c`, the localized persona strings in - `Data/Language/RT3.lng` including `2730` `Unassigned`, the named-chairman range `2731+`, and the - neighboring biography range `2495+`, plus the seeded railroad-name strings `575` `Missouri - Pacific`, `576` `New York Central`, and `577` `Grand Trunk Railroad`, the StationPlace.win - constructor plus category, dispatcher, rotation-circle, shared-world-surface, preview-build, and - recurring service branches around `0x00507a90`, `0x00507b90`, `0x00508550`, `0x00508730`, - `0x00508880`, `0x00508bb0`, `0x005091b0`, `0x00509d80`, and `0x0050a530`, the StationPlace string - cluster `Place a small station` 2197 `Place a medium station` 2198 `Place a large station` 2199 - `Place a service tower` 2200 `Place a maintenance facility` 2201 `Place a non-station building` - 2202 `Scroll through building styles.` 2203 `When placing the building, it will strictly adhere to - the rotation specified by the circle above.` 2206 `When placing the building, it will rotate - itself as needed to orient to track or avoid obstacles.` 2207 `Click to rotate the building. You - can also use bracket keys [ and ] to rotate buildings.` 2208 and the architecture-style labels - `Clapboard` 2667 `Kyoto` 2668 `Persian` 2669 `Southwest` 2670 `Tudor` 2671 and `Victorian` 2672, - the TrackLay.win constructor and dispatcher family around `0x0050d2d0`, `0x0050e400`, - `0x0050e070`, `0x0050e1e0`, and `0x0050e5c0`, the localized `Never` through `Common` strings 615 through 618, - the track-lay strings `Bulldoze` 1721 `Lay single track.` 2054 `Lay double track.` 2055 and 3114, - and the deeper shared bulldoze helper at `0x0044b160`. That helper is no longer just a vague - proximity scan: it validates the active company unless editor mode is active, emits the exact - RT3.lng bulldoze rejection ladder `419..424`, reads company cash through `0x0042a5d0`, - debits approved bulldoze cost through `0x0042a080`, and then scans nearby route entries, - linked structures, city-or-region records, route blockers, and placed structures before - committing the mutation. The nested tool-side entry is tighter now too: `0x0050e070` increments - the TrackLay reentry guard, snapshots several live route-owner fields from `0x006cfca8` into the - tool object, refreshes tool-local state through `0x0050dab0`, and only then tails into the later - restore or service branch `0x0050d1e0`. That tail is now tighter too: `0x0050d1e0` resets the - route-owner search state through `0x0049ad90/0x00495540`, drops invalid cached route ids from the - TrackLay tool or deletes non-admitted live entries when route latch `[route+0x118]` is set, - clears `[tool+0x78]`, and then conditionally refreshes shell presenter slot `[presenter+0x3741]` - through `0x00523e20`. The destructor side is tighter too: `0x0050db10` restores the TrackLay - vtable, re-enters that same cleanup tail, runs the route-owner post-change sweep - `0x004a3db0`, clears singleton `0x006d1a8c`, conditionally replays world follow-ons around - `0x00453510`, and only then tails into the common shell destroy path `0x0053f7d0`. Two smaller - TrackLay-side helpers are tighter now too: `0x0050dc00` refreshes the version-gated action rows - `0x986a..0x986c` plus `0x9872` before re-entering the main control refresh, and `0x0050dc80` - owns the active route-latch branch that either forwards into `0x004a00b0` or clears route latch - `[0x006cfca8+0x118]` plus local byte `[tool+0x82]`. The broader shared route or hit-test owner - under both message and recurring service is now tighter too: `0x0050dce0` first drops any cached - tool route id, then either seeds or updates the current route-owner selection from a world-surface - hit test through `0x00448ac0`, `0x00493600`, `0x0049ace0`, and `0x0049b180`, or refreshes the - active route-owner path through `0x004955b0`, `0x00493cf0`, and `0x004a04c0`, with the cleanup - side posting the fixed shell payload and optionally deleting route ids `[+0x125]` and `[+0x129]`. - The smallest active-route companion is tighter now too: `0x0050dab0` only runs when latch - `[0x006cfca8+0x118]` and route id `[+0x125]` are both live, then resolves that entry, re-enters - `0x0049afe0`, `0x0048b660`, and `0x0049b070`, and returns. - dispatching the selected delete branch through `0x004937f0`, `0x004941a0`, `0x0048abf0`, or the - surrounding placed-structure virtual slot `+0x58`. That makes the TrackLay `Bulldoze` mode - tighter than before: the tool-side mode latch at `0x00622b0c == 0x40` is only the front-end - selector, while the actual world-side bulldoze choice and failure policy sits under `0x0044b160` - and is reused by neighboring world-surface callers beyond TrackLay itself. - the TrackLay preference strings `Auto-Hide Trees During Track Lay` 1838 `If 'Auto-Hide Trees - During Track Lay' is checked, trees will automatically be reduced to small stumps whenever you are - in track laying mode.` 1839 `Auto-Show Grade During Track Lay` 3904 and `If 'Auto-Show Grade - During Track Lay' is checked, you'll see the grade number over the track while laying track - - useful for trying to keep your slopes to a minimum.` 3905, the electrify-all confirmation and - failure strings 3083 3084 3837 and 3900, the binding-registry lookup path at `0x0045f370`, the - registration block at `0x00460769` through `0x004608e7`, and the localized labels in - `Data/Language/RT3.lng` ids `3466` through `3473`. -### Open Questions - -Current evidence grounds the shell-controller-backed input and frame path as the - only coordinator after world entry; no separate outer gameplay loop or gameplay-only input - object is grounded yet. The new setup-pipeline evidence also points the same way: the - currently grounded chunked burst path at `0x00437b20` now looks subordinate to - `world_run_post_load_generation_pipeline` rather than to the ordinary speed controls, and even - there it still reuses the same lower stepper and pumps shell work between chunks instead of - revealing a detached gameplay loop owner. The player-facing speed-control family is now cleaner - too: `world_set_game_speed_mode` owns the bounded `Paused` through `Very Fast` ladder plus the - hidden `Ultra Fast 6..9` extension, `world_toggle_pause_or_restore_game_speed` uses `[this+0x1d]` - as the resume slot, and the multiplayer host restriction now looks attached to that same setter - family rather than to the setup-side burst helper. The frame-owned shell coupling is tighter now - too: inside `simulation_frame_accumulate_and_step_world` itself, one direct branch opens or - focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page`, and the post-step - shell-window ladder also probes several sibling shell windows by the same presence-plus-dirty - pattern, including the live `LoadScreen` singleton, the shared callback-driven custom modal, the - shared file-options dialog, `SettingsWindow.win`, the now-grounded `Overview.win` and - `BuildingDetail.win` singletons, the adjacent tool-window strip now grounded as - `Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintRegion.win`, `PaintSound.win`, - `PaintTerrain.win`, `PaintTerritory.win`, and `StockBuy.win`, and now the shell-side - `Trainbuy.win` singleton too. The `SettingsWindow.win` side is tighter now too: - `shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60` - rebuilds the hotkeys list control `0x757a` from the same sorted binding-report iterator - `0x0045f250`, using the temporary `0x88`-stride list model at `0x006d1354` before restoring the - previous selection. The message owner above it is bounded now too: - `shell_settings_window_handle_message` `0x004fede0` is the actual dispatcher for the singleton, - and its currently grounded hotkeys cases are the reset-to-defaults path - `0x00500147 -> 0x00461120(0) -> 0x0045f550 -> 0x004fec60` and the selected-row reassignment path - `0x00500186..0x0050022b`, which resolves one chosen hotkey row from control `0x757a`, validates - the destination bucket through `0x0045ed90`, skips Enter and Escape, expands the compact modifier - code through `0x0045ed70`, commits the rebucket through `0x0045ef00`, and then rewrites the same - report file plus rebuilds the list. The page-refresh side is bounded now too: - `shell_settings_window_refresh_selected_page_controls` `0x00500410` republishes the category - strip `0x7533..0x7540`, uses the local in-refresh guard byte `0x006d135d`, and then dispatches - the current page through the `0x005005e0` table; page `7` is now directly grounded as the - hotkeys page because it dispatches into `0x004fec60`. The category table at `0x00622870` now - grounds the whole page order as `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`, - `Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`, - `Miscellaneous`, and `Sandbox Options`, with only the second dword in each table row still - unresolved as a small subgroup or style flag. Several page bodies are now grounded too: - `0x004fda20` is the `Gameplay` refresh owner, `0x004fdb90` the `Sound` refresh owner, - `0x004fe770` the top-level `Graphics` refresh owner, `0x004fe960` the `Model Detail` refresh - owner, `0x004feb20` the `Draw Distance` refresh owner, `0x004febd0` the `Textures` refresh - owner, `0x004fdd70` the first `Miscellaneous` refresh owner, `0x004fdf20` the `Scrolling` - refresh owner, `0x004fdfd0` the `Camera Controls` refresh owner, `0x004fd940` the `Dialogs` - refresh owner, `0x004fd730` the later `Miscellaneous` refresh owner, and `0x004fd8d0` the - `Sandbox Options` refresh owner. The neighboring companion helpers are tighter now too: - `0x004fd550` refreshes the `Draw Distance` companion strip under controls - `0x7566/0x7596/0x7560/0x7562/0x7564`, `0x004fd650` does the same for the `Textures` companion - strip under `0x756e/0x756a/0x756c/0x7570`, `0x004fe4c0` rebuilds the graphics custom-resolution - list on `0x7553` from the live display-mode table filtered to `640x480 .. 1600x1200` and - formatted through `%1x%2`, and `0x004fe6f0/0x004fe730` are the small primary-selector mirror - helpers for `Draw Distance` `0x755f` and `Textures` `0x7569`. The `Camera Controls` page is - stronger now too: `0x7587` is the day-night cycling selector rooted at `Normal day/night - cycling` through `Frozen at 11pm`, while `0x7588` is the weather-cycling selector rooted at - `Normal weather cycling` through `Frozen at storms`. The callback strip under the dispatcher is - tighter now as well: `0x004fefb0` is the sound-backend selection-change owner for - `0x7551/0x7550`, `0x004ff070` is the custom-resolution selection owner, `0x004ff0d0` the - top-level graphics selector-change owner, `0x004ff1b0` the main draw-distance selector-change - owner, `0x004ff2e0` the textures selector-change owner, and `0x004ffbc0` the graphics - custom-resolution or range-refresh branch that persists `engine.cfg`, rebuilds the custom list, - and republishes `0x7555/0x7578`. The small wrapper `0x00500620` is the nonreentrant `if live, - refresh page` gate above that body. The tiny helper strip beneath those branches is at least - bounded now too: `0x00531640/0x005316d0` query the active sound-backend index and availability - flag from the shell audio service, `0x0053ef60/0x0053ef70` read the graphics-backend status - slots used by controls `0x757c/0x759a`, and `0x0051fd40/0x0051fd60` are the small graphics-range - custom-mode flag and scalar queries behind `0x7555/0x7578`. The next apply-strip under the same - family is tighter now too: `0x004fe270` applies a changed custom-resolution tuple and persists - it, `0x004fe2d0` applies the top-level graphics selector then republishes `0x757c/0x759a`, - `0x004fe3b0` applies the draw-distance selector then refreshes `0x004fd550`, `0x004fe400` - applies the textures selector then refreshes `0x004fd650`, `0x004fe140` is the small composite - backend-status predicate used by the timer-gated graphics service branch, and `0x004fe160` is - the sound-backend follow-on refresh path. The graphics service tail is tighter now too: - `0x004ffafb` is the timer-gated backend-service-plus-graphics-page repaint branch using - `0x0051d890` against deadline `0x006d136c`, the follow-on calls `0x0053f170/0x0053f2c0`, and a - shortened `60` ms rearm after it repaints `0x004fe770`, while `0x004ffb64` is the sibling - backend-service branch that uses `0x0053f0f0/0x0053f210` and only raises the shell refresh latch - without repainting the page directly. The same `MouseCursor.cpp` owner family is tighter now too: - `0x0053f000` is the live cursor-shape selector that lazily loads native handles, updates the - shell-side presentation payload, and toggles cursor visibility on the `0 <-> nonzero` boundary; - `0x0053f0f0`, `0x0053f170`, and `0x0053f210` are the three local hidden or release-transition - branches that mirror shell latches `[0x006d4024+0x11473a/+0x11473e]`; `0x0053f2f0/0x0053f310` - are the nested hold-counter helpers; `0x0053f330` is the constructor-side reset and latch-sync - owner; `0x0053f400` is the coarse global-latch service; and `0x0053f450` is the inside-view - watcher paired with `shell_input_cursor_inside_active_view` `0x0054f540`. The same pair is now - grounded on the heavier save/load paths too: `world_entry_transition_and_runtime_bringup` - `0x00443a50` pushes the hold at `0x443b04` before the larger startup-dispatch and staged - rehydrate work, then pops it at `0x444c03` after the late world or shell rebuild tail; the live - `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240` does the same thing through - `0x446271` and `0x446d09` around its bundle-write and fixed status-publish span. The exact - save/load-side status stack under those spans is tighter now too: `0x004422d0/0x00442330` push - and pop shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte - `[0x006cec78+0x4c74]` through `0x0062be90`, while `0x004423a0/0x004423d0` layer the same band - under active TrackLay.win and StationPlace.win service. The per-frame tail is - tighter now too: `0x0054f5b0` queues one 12-dword shell-input event record into the rotating - ring at `[input+0x128]`; `0x0054f6a0` and `0x0054f6b0` are the two neighboring fixed-value - seeders for shared phase scalar `0x00d93850` used by shell-side branches `0x00538b72`, - `0x0052819d`, and `0x0052b9f8`; and `0x0054f6c0`, `0x0054f6d0`, and `0x0054f6e0` are the tiny - primary-motion scalar reset, snapshot, and restore leaves that `0x0053f4e0` uses around the - later cursor-presentation pass. The graphics-range - callback strip beneath that is bounded now too: `0x004ffd10` is the user-facing custom-mode - toggle rooted at control `0x7555`, using - `0x0051fd00`, `0x0051fd40`, `0x00520fd0`, and the localized dialog ids `0x0e16/0x0e17/0x0e93`; - `0x004ffe72` flips the graphics-range scalar through `0x00521030`; and the adjacent - display-runtime toggles `0x004ffea4`, `0x004ffeff`, `0x004fff2d`, `0x004fff59`, `0x004fff85`, - `0x004fffde`, and `0x0050000a` now bound a compact persisted graphics or model-detail option - strip over controller fields `[0x006d4024+0x1146eb]`, `[+0x114697]`, `[+0x1146e9]`, `[+0x1146b8]`, - `[+0x1146af]`, `[+0x1146a8]`, and `[+0x1146e3]` rather than one anonymous tail blob. The lower - setter layer is tighter too: `0x0051fd00` is the current `has live custom payload` predicate for - the graphics-range family, `0x00520fd0` stores the custom-mode flag and re-applies the current - range when possible, `0x00521030` stores the scalar and re-applies it when the graphics mode is - live, and `0x0051d890` is the shared elapsed-tick helper over the bootstrap-seeded tick count. - The same local support strip is broader now too: `0x0051e1d0` is the mode-`0` alternate sibling - of the packed preview-color ramp at `0x0051dfc0`; `0x0051e430/0x0051e480` are the shared - path-openability and file-size probes; `0x0051e4e0/0x0051e560` are the bounded ASCII clipboard - export and import helpers; `0x0051e6e0` is the nonempty digits-only predicate used by nearby - text-entry validation branches; `0x0051e720/0x0051e740` own the active debug-log filename - (`rt3_debug.txt` / `language_debug.txt`) and the one-time `.\\data\\log\\%s` separator write; - and `0x0051e810` is now grounded as the `MouseCursor.cpp` `ShowCursor` refcount and live-position - sync helper that the warning-modal strip also reuses. The immediate shell-controller strip under - that is tighter now too: `0x0051ea80` is the small core-state reset plus default seeding path - rerun by `0x0051ff90`; `0x0051f000` registers the static `World` window class through wndproc - `0x0054e3a0`; `0x0051f070/0x0051f080` and `0x0051f090/0x0051f0a0` are the paired controller - accessors and setters for the live presentation owner and world-basis owner; `0x0051f0c0`, - `0x0051f0d0`, and `0x0051f0e0` are the small indexed input-subobject flag write or query helpers - beneath the shell window-message path; `0x0051f100` materializes the active display-mode tuple - from `[controller+0x34]` and selector `[+0x11421e]`; `0x0051f1a0` is the current - graphics-mode-byte accessor over `[controller+0x114226]`; and the nearby shared shell-presenter - helper `0x00527de0` is now bounded as the common scalar-caption publisher reused by several tool - windows. It scales one caller float through `0x005dd158`, forwards that value into nested - presenter field `[this+0x364d]` through `0x0052ea90`, scales a second caller float through - `0x005c8568`, and stores that auxiliary caption-side weight in `[this+0x3728]`. Grounded callers - now include `Bulldoze.win`, `ChangeTrees.win`, the world-surface brush ordinal setter, - `PaintRegion.win`, `PaintSound.win`, `PaintTerrain.win`, and `PaintTerritory.win`, so this is the - shared shell scalar-caption lane rather than a window-specific text formatter. The neighboring page-owned dispatcher - leaves are tighter now too: `0x004ff58a`, `0x004ff5b6`, - and `0x004ff5e6` are direct persisted toggles for the later `Miscellaneous` input page fields - `[0x006d4024+0x1146d7]`, `[0x006cec74+0x28b]`, and `[0x006cec74+0x283]`, with the last one also - republishing a `Game.win` affordance through `0x004dd8d0`; `0x004ff637`, `0x004ff667`, - `0x004ff697`, `0x004ff6c7`, `0x004ff6f7`, and `0x004ff727` are the page-owned toggle leaves for - the `Dialogs` page fields `[0x006cec74+0xf8]` and `[+0x26b/+0x26f/+0x273/+0x277/+0x27b]`; and - `0x004ff757`, `0x004ff796`, `0x004ff7c6`, and `0x004ff84e` are the remaining compact `Gameplay` - page toggle leaves over `[0x006d4024+0x114742]`, `[0x006cec74+0x0a8]`, `[+0x263]`, and - `[+0x309]`, with the `+0x114742` path also nudging `BuildingDetail.win` and the `+0x263/+0x309` - paths triggering narrow live-tool follow-ons. The next tiny leaves are bounded now too: - `0x00500036` is the direct apply leaf for the graphics-misc option family mirrored through - `0x00484af0(0x0c)` into control `0x7586`; `0x0050006c/0x0050009c/0x005000cc` are the shared - setup-config toggles over `[0x006cec74+0x247/+0x24b/+0x243]` that persist the same three booleans - later mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`; and `0x005000fc` is the direct - scrolling-page boolean-companion setter for `[0x006cec74+0x120]` and control `0x7585`. - neighboring stock-buy lane is tighter now too: `0x00433aa0` is the shared `StockBuy.win` - availability gate, rejecting when scenario toggle `[0x006cec78+0x4aa7]` is set or when no - selected-company id is present at `[scenario+0x21]`. The direct shell opener `0x00440660` and - the page-side launcher `0x004de50f` both use that gate before entering detail-panel mode `0x0c`, - whose same-mode refresh tail re-enters `0x00493150`. The shell-side control strip under that - window is tighter now too: `0x0050a660` is the raw selected-chairman-row setter for global - `0x006d19f4`, `0x0050a570` is the selected-company stock-data panel callback wired to control - `0x3aa0` and feeding the shared stock formatter `0x004c0160`, `0x0050a6d0` publishes the current - selected company id into `0x00622b00` and restyles control `0x3a9b`, `0x0050a670` is the shared - live-window refresh wrapper hit by the buy/sell chairman mutators after they touch - `[profile+0x154]` and the per-company holding band, `0x0050a5e0` is the constructor-wired - invalidation callback for control `0x3a9a`, and `0x0050a6a0` is the unconditional invalidation - sibling used by the local in-window trade branches after they commit the rounded block. One level - higher, `0x0050a730` is now bounded as the broad row/card refresh owner: it walks the active - chairman profiles through `0x00477820/0x00477860`, lays out the selected and unselected profile - cards through the cached widget roots `0x006d19d8/0x006d19dc/0x006d19e8/0x006d19ec`, resolves - persona/name labels through `0x00476bb0`, and pulls the same currently grounded metric lanes - from `0x00476320`, `0x00476780`, and `0x00476c20`. The selected-company panel under control - `0x3a9a` is separate and broader: `0x0050ae50` is now bounded as the main selected-company - summary renderer, resolving the current company through `0x00518140`, the current chairman row - through `0x00477860`, choosing one of panel roots `0x006d19e8/0x006d19ec`, and then formatting a - mixed text-plus-metric surface through helpers such as `0x00423eb0`, `0x00426b10`, and - `0x00426ef0`. The adjacent publish side is bounded too: `0x0050b910` formats the selected company - ownership line through localized ids - `0x0e10/0x0e11/0x0e12` plus the resolved company and owner labels, and `0x0050ba00` is the - shared selected-company summary refresh tail over controls `0x3a9a/0x3a9b`; `0x0050c130` is the - narrow mode-`0x0b` refresh wrapper that re-enters that tail only when the current detail-panel - object is actually `StockBuy.win`; and `0x0050c470` is the selected-company clamp/setter sibling - that republishes `0x00622b00` before re-entering the same summary tail. The payload-driven trade - commits are explicit now too: `0x0050c150` resolves one chairman record from payload - `[profile_id, company_id]`, derives the rounded buy block through `0x00476e50`, and commits it - through `0x00477110`; `0x0050c1f0` is the same sibling for the rounded sell block and - `0x00476460`. Both also emit the local selected-chairman shell cue before the shared - `StockBuy.win` refresh tail when the payload chairman matches the currently selected chairman in - `0x006cec78`. The message-owner and teardown side are bounded now too: `0x0050bbe0` is the real - `StockBuy.win` dispatcher, with `0xcb` control bands for chairman-row selection - `0x3afc..0x3b5f`, company-row selection `0x3d54..0x3db7`, company wrap/step controls - `0x3aa1..0x3aa3`, and toggle-byte writes `0x3aad..0x3ab2`, while `0xca` owns the local buy row - band `0x3c8c..0x3cef` and sell row band `0x3cf0..0x3d53`. The buy-side confirmation path now has - one extra leaf too: `0x0050a600` is the callback-driven tutorial gate for the localized - `0x0292` confirmation modal, opening the sibling tutorial modal `0x0e8c` only on `0xcb` control - `0x03f4` while tutorial flag `0x006d3b4c` is live. The destructor counterpart `0x0050bac0` - releases the cached roots `0x006d19d8..0x006d19ec`, frees the per-company cached stock-data - handles in `0x006d1748`, invalidates controls `0x3b60` and `0x3e4e`, clears singleton - `0x006d19f0`, and then tails into the common shell-object teardown. The - remaining adjacent detail-panel gates are now at least structurally bounded too even though their - target families are still unnamed: `0x00434db0` layers extra scenario toggle `[0x006cec78+0x4a7f]` - on top of the broader company-list/detail gate before allowing mode `0x0b`, while `0x00434e20` - only hard-blocks mode `0x06` when all three toggles `[+0x4ab3/+0x4ab7/+0x4abf]` are set and - otherwise, outside editor-map mode, still requires a selected-company id before the direct - openers `0x00440530` and `0x00440690` hand those modes to `shell_detail_panel_transition_manager`. - The - train-buy family is no longer just an unnamed probe pair either: the opener path is now grounded - under the same shell-owned cadence through `shell_can_open_trainbuy_window_or_warn` and - `shell_open_or_focus_trainbuy_window`, and its current family semantics already extend beyond a - bare locomotive picker into selected-train upgrade summary and route-edit affordances. The direct - shell opener `0x004406c0` now aligns with the page-side launcher `0x004de7d9`: both use - `shell_can_open_trainbuy_window_or_warn` `0x00433b00` before calling - `shell_open_or_focus_trainbuy_window` `0x00512c50`. The - selected-train side is tighter now too: we have explicit query helpers for the selected train - record, id, validity, and company ownership, plus one explicit ownership-mismatch warning modal. - That same pass also clarified one boundary we should not conflate: the neighboring shell family - rooted at `0x006d3b20` is now grounded separately as `TrainDetail.win`. It reuses the same - selected-train context and some of the same helpers, but it is not the same `Trainbuy.win` - singleton family. The `TrainDetail.win` side now has its own constructor, opener, refresh path, - and message owner above the broader train-command strip. Its inner `0xcb` strip is tighter now - too: one bounded branch is the selected-train engine-replacement or trainbuy handoff lane using - warning ids `593/594`, and another is the selected-train retirement lane using `595/596/597` - with either a local teardown path or multiplayer opcode `0x37`. The remaining train-command - family is narrower too: the shared `0x33`-stride helper trio at `0x004b2f00`, `0x004b3000`, and - `0x004b3160` now looks like a real train route-stop or waypoint list rather than a generic row - buffer, and route-entry flag byte `+0x28` now has one grounded top-level split: sign bit clear - entries are the live placed-structure-backed family, while sign bit set entries use the direct - route-node payload side. The helper `train_route_list_count_live_site_reference_entries` - `0x004b2b80` now counts the first family explicitly. One deeper lower-bit result is grounded too: - both `train_route_list_insert_staged_entry_at_index` and the auxiliary finalize helper - `train_finalize_aux_route_entry_buffer_preserving_subflags` `0x004a94b0` explicitly preserve - bits `0x40`, `0x20`, and `0x10` in the same flag byte during route-entry rewrites. Those bits are - also no longer copy-only: the neighboring shell helper - `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20` now consumes them to - restyle the `BuildingDetail.win` row bands `0x7d07..0x7d1c` and `0x7f58..0x801f`. The exact - player-facing labels for those rows are still open, but the subflags now have one real shell-side - consumer instead of only preservation logic. The broader `BuildingDetail.win` refresh family is - tighter too: `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0` now - clearly owns the selected subject rows around `0x7d06`, `0x7d96..`, and `0x7d0e`, resolving - ordinary ids through the live candidate collection and the special express-side ids through the - embedded `AnyCargo.imb`, `AnyFreight.imb`, and `PassMail.imb` paths. The first fixed triplet is - now table-grounded instead of only inferred: `0x00621df8` seeds the short-label controls - `0x7dc8..0x7dca` with RT3.lng `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while - `0x00621e10` seeds the adjacent `0x7e90..0x7e92` icon-name triplet with `AnyCargo`, - `AnyFreight`, and `PassMail` before `%1.imb` formatting. RT3.lng also tightens the longer popup - side now: `0x00621e04` feeds the first clickable selector triplet `0x7f58..0x7f5a` with - `494/497/498`, so the help text there is `Any Cargo`, `Any Freight\n(Freight is everything but - Passengers, Mail, and Troops)`, and `Any Express\n(Express is Passengers, Mail, and Troops)`. - The sibling special service rows still align to `Dining Car` and `Caboose`. The extracted - `BuildingDetail.win` blob now sharpens the resource boundary too: its embedded text table is - currently sparse rather than rich, exposing the help line for `0x7d01`, repeated - `BuildingDetail.imb` asset strings, and one standalone caption entry `Cargo`. That makes - `Cargo` the strongest current resource-side anchor for the row header around `0x7d06`. The - ordinary deeper rows are tighter now too: they do not look like hidden caption-table entries, - but like live candidate-derived rows. The current path validates each ordinary id through - `indexed_collection_entry_id_is_live` `0x00517d40`, resolves the concrete candidate record - through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then reuses candidate - field `[record+0x04]` as one shared stem for both the row asset `%s.imb` path and the - neighboring display-label lookup through - `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. That lookup is now - bounded too: it scans the static stem table at `0x006243c8`, already grounding entries such as - `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng - `3202..3220`, and only falls back to localized id `3866` when no table entry matches before the - fixed `0x384..0x386` express-side triplet takes over. One neighboring candidate-side helper is - tighter now too: `structure_candidate_query_route_style_or_local_availability_metric` - `0x0041e650` shares the same route-style byte at `[candidate+0x46]`, returning the cached local - float at `[candidate+0x5a]` for ordinary candidates but switching route-style rows to one - normalized count over the world-side route-link collection `0x006ada90` keyed by candidate class - `[candidate+0x3e]`. That collection is tighter now too: it is constructed during world bring-up - by `placed_structure_route_link_collection_construct` `0x00468110`, and current grounded - creation flow through `placed_structure_route_link_allocate_site_pair_for_candidate_class` - `0x00467f50` seeds class byte `+0x10`, a masked initial state template, and the strongest - current creation-side site-pair fields at `+0x0c` and `+0x0e` before - `placed_structure_route_link_attach_site_owner` `0x00467eb0` links the new route-link record - into the placed-structure-owned chain at `[site+0x272]`. The owner-side split is tighter now - too: route-link field `+0x08` is the separate route-node-style owner anchor used by - `placed_structure_route_link_attach_route_node_owner` `0x00467f20`, while `+0x0a/+0x0c/+0x0e` - now read as the site-reference triple matched by - `placed_structure_route_link_collection_remove_links_touching_site_id` `0x004681f0`. Creation - flow now sharpens that further: `+0x0c` is the strongest current candidate for the stable - first-site field seeded before owner attachment, `+0x0a` is the mutable owner-site anchor - installed by the attach helper, and `+0x0e` is the stable second-site field. One more split is - tighter now too: `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` - currently uses `+0x0a` and `+0x0e` as the active endpoint site pair while recomputing state - byte `+0x12`; `+0x0c` is still not directly read there. The family also has a clearer release - and refresh side now: `placed_structure_route_link_release_and_detach` `0x004680b0` rolls back - the class counters and then tails into `placed_structure_route_link_detach_current_owner_chain` - `0x00467df0`, while - `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` - explicitly reruns the per-record endpoint-pair reconciler across the whole live route-link - collection. One layer above that, - `placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state` - `0x00468300` now looks like the full-family refresh owner: it clears three route-style class - lanes in the world-grid tables rooted at `[0x0062c120+0x2129]`, then clears bit `0x2` across - the live route-link records and reruns the endpoint-pair reconciler. That now lines up with the - visible shell split: non-route candidates keep the richer local metric and price lane, while - route-style candidates use one world-side route-link family instead. The emission side is - tighter now too: `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` - `0x0040fef0` scans the live placed-structure collection for one best peer site by - class-specific weight, distance window, and type gate, then only creates a new route-link - through `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` when - `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0` says the chosen site - pair does not already share a route-entry key. One layer above that, - `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` now reads - as the broader per-site owner of this lane: it computes per-class route-style score scalars from - local site state and scenario multipliers, drives the first three route-style emission attempts, - and then continues into a larger descriptor-driven scoring phase. Inside that larger pass, - `placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link` `0x0042cab0` - now cleanly shows the split between ordinary candidates, which add directly into the local - route-style grid lane at `[site+candidate*4+0x103]`, and remapped route-style candidates, which - re-enter the peer-link emitter. One layer above that, the broader post-create or post-edit site - rebuild `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10` - conditionally re-enters `0x004101e0` with stack flag `1` when its local latch at `[site+0x29e]` - stays clear, so the route-style lane is no longer floating under an unnamed single-site caller. - The placement side is tighter now too: the direct constructor - `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` is the shared allocator - immediately beneath the current placement-side callers before they hand the new site into - `0x0040ef10`, and the lower constructor - `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now bounds the - actual field-seeding layer beneath that allocator. The old unresolved higher placement chooser is - bounded more cleanly now too: the `0x00403ed5` and `0x0040446b` direct-placement commits sit - inside one larger helper, - `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`. That shared - heavy builder is now the common target of the compact wrapper `0x00404640`, the peer-route - candidate builder `0x004046a0`, the region-entry pair wrapper - `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry - paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` - `0x00404ce0`. Internally it now has three bounded lanes: - an early route-entry search or synthesis attempt through - `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, - a single-endpoint direct-placement lane that scans `Maintenance` and `ServiceTower` candidates - and commits through `0x00403ed5 -> 0x004134d0 -> 0x0040ef10`, - and a later paired-endpoint fallback lane that seeds two endpoint candidates from the same stem - family, walks a temporary route-entry list, and commits through - `0x0040446b -> 0x004134d0 -> 0x0040ef10`. - That early lane can now be described more concretely: it can reuse supplied route-entry - endpoints, synthesize a missing leading endpoint from the caller's coordinates, seed the - route-store builder-state block, and then hand off to the deeper path-search core without - placing a new site. The previously vague side family at `0x006cfcb4` is tighter too: current - evidence now bounds it as a small auxiliary route-entry tracker collection with an allocator at - `0x004a42b0`, a refcount or destroy path at `0x004a4340`, a direct route-entry group-id setter - at `0x00489f80`, an endpoint-membership probe at `0x00494ed0`, a boolean-latch refresh or - owner-notify path at `0x00494fb0`, and a two-endpoint merge or bind helper at `0x00494f00`. - One smaller constructor-side ownership split is tighter now too: the cached `u16` chain fields - `[site+0x26e]`, `[site+0x270]`, and `[site+0x383]` are no longer free-floating. Constructor-side - helper `0x0041f7e0` prepends one new peer into that chain by storing the old head from - `[this+0x383]` into `[peer+0x270]` and then replacing `[this+0x383]` with the peer's own - placed-structure id `[peer+0x2a4]`; the direct resolver `0x0041f810` turns the cached head id - back into one live record through `0x0062b26c`; and the removal-side companion `0x0041f850` - removes one peer from the same chain before clearing `[peer+0x26e/+0x270]`. That caller split is - now strong enough to treat this as one cached single-link or predecessor-chain family beneath - placed-structure construction and rebuild rather than as unrelated scratch words. - That bind side is tighter now too: the trackers group route entries only when a route-key-like - value from `0x0048aa70`, the route-entry signature word `+0x22e`, and the boolean latch derived - from byte `+0x44` all agree. The deeper handoff under that lane is no longer anonymous either: - `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380` is now - bounded as the internal search core that runs the first candidate sweep, quality gates, and the - later route-extension fallbacks before returning one resolved route-entry id or `-1`. The first - sweep now has a bounded owner at `0x0049bd40`, and the two later fallback helpers are bounded as - the route-entry point-window coverage query `0x00494cb0` and the frontier-extension helper - `0x0049c900`. The math side is bounded more cleanly now too: the family reuses - `math_measure_float_xy_pair_distance` `0x0051db80` for its direct point-to-point scalar, - `math_compute_quadrant_adjusted_heading_angle_from_xy_pair` `0x004952f0` for heading-angle - construction, `math_normalize_subtracted_angle_delta_and_report_wrap` `0x004953c0` for wrapped - angle deltas, and now one tighter visual-side strip too: `0x00539230` applies one local - float-preset layout from state byte `[entry+0x218]`, `0x00539380` loads the matching - table-driven profile bands and optional display latch `[entry+0x44]`, `0x005394b0` exports four - consecutive `3*dword` triplet bands from the entry into caller buffers, and `0x005391b0` - releases one optional world-space attachment before the entry's vtable slot `+0x00` teardown - fires. The adjacent publish side is bounded too: `0x00539580` broadcasts one caller-supplied - three-scalar packet across the optional attached-handle list at `[entry+0x08]`, and - `0x005395d0` ensures that same list, adds one new handle, and immediately republishes one - aggregate scalar derived from local bands `[+0x18/+0x24/+0x30/+0x3c]` together with head lanes - `[+0x0c/+0x10]`. The next owner layer is tighter now too: `0x00539640` is the heavy derived-band - rebuild that turns those four triplets plus profile weights `[entry+0x1f5/+0x1f9/+0x1fd]` into - the larger scalar bands rooted at `[entry+0x63]` through `[entry+0x1d3]`, refreshes center - scalars `[entry+0x0c/+0x10]`, re-enters root query `0x00534490` several times, and conditionally - maintains the optional `0xc0`-byte display buffer at `[entry+0x1e3]` according to display-state - byte `[entry+0x44]`. The surrounding wrappers are coherent with that same ownership split: - `0x0053a740` copies caller triplets into `[entry+0x14/+0x20/+0x2c/+0x38]`, refreshes optional - attachment id `[entry+0x55]` through `0x00533e00/0x00533dd0`, and republishes center lanes - `[entry+0x1ed/+0x1f1]`; `0x0053a890` reprojects the stored triplets through `0x00534490` and - rebuilds; `0x0053a920` fills all four triplets from one uniform scalar before rebuilding; - `0x0053ac40` rebinds the root pointer, clears attachment state, and optionally rebuilds from the - current triplets; `0x0053aca0` is the concrete default constructor for the same route-entry - object family; and `0x0053ae10` is the construction-time root-bind plus state-profile-and-triplet - initializer. The attachment manager beneath that strip is tighter too: `0x0053a5b0` is the tiny - broadcast wrapper over current head lanes, `0x0053a5d0` is the heavier ensure-and-clone path - that seeds one new attached handle from the first live entry when a list already exists, and - `0x0053a6d0` tears that attached-handle list back down. The collection side is tighter too: - `0x00491af0` constructs the indexed - `0x006cfca8` owner beneath the world bundle-load path, and the later post-load `319` lane now - uses `0x00491c20` as a dedicated collection-wide refresh pass that re-enters `0x00539640` on - every live route entry. That keeps the route-entry visual or presentation side grounded as a real - sibling strip to the search and regrouping code, not loose per-caller scratch fields. - angle-delta checks, and `math_abs_double_with_crt_special_case_handling` `0x005a152e` for the - absolute-value side of the quality gates. Current evidence also bounds the threshold shape a - little more tightly: the initial sweep and later extension path both reuse one signed angle-bias - term `+/-0.181000038854627`, and the first sweep switches between a looser `1.4` and stricter - `1.8` quality multiplier depending on route-policy byte `4` or the broader display-runtime - preference `[0x006cec78+0x4c74]`, already grounded elsewhere as `Auto-Show Grade During Track - Lay`. - The small policy-byte semantics are still not fully closed, but current evidence is tighter than - before. Literal byte `1` is now the strongest current match for direct linked-site - endpoint-anchor creation or replacement, because the linked-site constructor and neighboring - repair branches around `0x00480463`, `0x00480a77`, and `0x00480b69` all feed that byte into - `0x00493cf0` before rebinding one chosen route-entry anchor through `0x0048abc0`. Literal byte - `2` now looks broader: the later world-side caller at `0x00480cd0` and the linked-site refresh - helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` both - reach `0x004a01a0` with both optional endpoint-entry ids unset and that byte, so the strongest - current read is a full linked-site route-anchor rebuild between optional endpoint entries rather - than the narrower direct creation lane. The TrackLay side now gives one tighter user-facing - anchor too: the live mode field `0x00622b0c` is already grounded as `Lay single track.` `0x1` - versus `Lay double track.` `0x4`, and the small mapper `0x004955b0` collapses that state into - the endpoint-policy bytes later passed to `0x00493cf0`, so the strongest current read is - `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`. - Bytes `1/2` are still the ones that enable the - auxiliary tracker lane in `0x004a01a0`, while byte `4` now reads more narrowly as the larger - company-side endpoint-synthesis charge inside `0x00493cf0`, because that helper feeds `-1` - versus `-2` into the saturating company counter helper `0x00423ec0` on `[company+0x7680]` - rather than skipping the company branch entirely. That counter is tighter now too: nearby - company initialization seeds it to `50` when scenario byte `0x4aaf` is enabled and to sentinel - `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed - fallback `29999`. Current language-table correlation also gives `0x4aaf` a stronger - player-facing meaning: it is the live gate behind `Company track laying is limited...` and the - event variable label `Company Track Pieces Buildable`. So the current strongest read is - available track-laying capacity, not an abstract company route-budget. That site-side helper - also closes one adjacent ownership gap: beneath - `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, it rebuilds - one linked site's route-entry anchor and display-name buffer. That path is tighter now than just - “bind anchor then touch `0x006cfcb4`”: after the literal-policy-`2` rebuild succeeds it - re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, - which can now be described more concretely. Its early prepass at `0x004a4380` can split one - mismatching adjacent subchain into a fresh tracker group; its later helper at `0x004a4ce0` can - transfer one compatible adjacent chain between neighboring groups; and the repair-side helper at - `0x004a4ff0` can reseed a whole route-entry component into a fresh tracker when the old group id - is missing or invalid. The regrouping pass also still rewrites compatible endpoint slots through - `0x004950f0` and refreshes one nearby cached-match payload band through `0x00495020` before the - helper resumes the name-buffer work. The remaining display-name side still matches the earlier - grounded text family: copy the resolved city name when available, append civic suffixes - `Township`, `New`, `Modern`, or `Renaissance`, append `Service Tower` or `Maintenance Facility` - on the linked-instance class branches, and otherwise fall back through the older - `Junction`..`Center` and `Anytown` text families. - The higher owner-refresh side of that same tracker family is tighter now too. The reusable gate - at `0x004a4c00` no longer looks like a stray predicate: it explicitly requires both route-entry - trackers to keep matching cached fields `+0x18/+0x1c/+0x1d/+0x1e` and both route entries to keep - their special side fields `+0x20e/+0x222` unset before adjacent-chain transfer is allowed. The - collection-wide traversal sweep at `0x004a5fc0` is bounded now as the connected-component refresh - owner over tracker field `+0x0c`, with a temporary queue at `[this+0x94]` and direct fallback - into the reseed helper `0x004a4ff0` whenever one neighboring route entry has lost valid tracker - ownership. Above both of those sits `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` - `0x004a6360`, which now reads as the owner-side latch-change refresher invoked from - `0x00494fb0`: it starts from one owner route-entry id, confirms both bound endpoint entries agree - on the boolean class state implied by route-entry byte `+0x44`, and then probes both endpoint - sides for adjacent route-entry groups that can be absorbed through the `0x004a4c00 -> 0x004a4ce0` - gate-and-transfer pair. The sibling query side is bounded now too: - `aux_route_entry_tracker_collection_query_component_label_by_tracker_id` `0x004a6320` is the - dirty-aware accessor for tracker field `+0x0c`, while - `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` is the remaining - mode-switched lower metric dispatcher beneath the heavier chooser at `0x004a6630`, forwarding - fixed route-entry-pair candidate sets into either `0x004a5280` or `0x004a5900` depending on the - shared hundredths-scaled build-version query - `runtime_query_hundredths_scaled_build_version` `0x00482e00` over `0x006cec74`. The current - caller thresholds `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` now line up with executable - build values `1.03`, `1.04`, `1.05`, and `1.06`, and the version source itself can come from - the multiplayer companion path as well as the local executable, so this split is no longer - best-read as a time- or era-side cutover at all. It now reads more cleanly as a pre-`1.03` - versus `1.03+` route-metric compatibility dispatcher. That lower split is tighter now too: - `0x004a5280` is the weighted recursive branch with heuristic ordering, per-tracker best-cost - cache `0x006cfcac`, and prune threshold `0x006cfcb0`, while `0x004a5900` is the alternate - recursive neighbor-walk branch that stays within compatible component labels through - `0x004a62c0` and accumulates step and mismatch penalties over route-entry links - `+0x206/+0x20a/+0x20e`. Above both of them, - `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` - `0x004a6630` is now bounded as the real chooser: direct fixed-pair query when both entries pass - `0x0048b870`, otherwise endpoint-pair fallback across the two tracker groups. - The adjacent route-style rebuild side is tighter now too: the same build-version family reaches - `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0`, where build - `1.04+` keeps one `Recycling Plant` stem-specific compatibility branch alive and build `1.05+` - skips one older descriptor-side attenuation fallback. There is also one neighboring world-side - compatibility lane now bounded below the same family: `placed_structure_collect_connected_component_tile_bounds_with_version_gate` - `0x004160c0` skips one older recursive component-bounds walk through `0x00415f20` on build - `1.03+` when scenario field `[0x006cec78+0x46c38]` is already active. The wrapper above that - path is bounded now too: `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` - `0x00416170` walks the caller rectangle, maps tile keys into the component table rooted at - `0x0062ba7c`, and only re-enters `0x004160c0` when the current owner still has no cached bounds - and the local world or scenario suppressors stay clear. The higher neighboring raster side is - tighter too. `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610` is the - shared projected-rectangle helper above `world_grid_refresh_flagged_region_float_extrema_and_mean` - `0x00415020`: it refreshes the temporary sample band at `0x0062b7d0`, publishes the surviving - rectangle through `0x0044d410`, and on the single-sample path re-enters - `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` to flip mask bit - `0x01` for the corresponding non-sentinel cells. Current grounded callers for `0x00418610` are - the neighboring placed-structure local-runtime helper `0x00418be0` and the heavier placement - validator `0x004197e0`, so this adjacent family now reads more like projected placement or local - raster prep than an unowned generic world-grid scan. One neighboring caller into the same - height-support band is tighter now too: the world-side branch at `0x00419070..0x004190f0` - walks one admitted local window, dispatches the acceptance-gated relaxer `0x0044d6e0` once per - cell with a one-cell radius and no immediate tail refresh, and only after that outer loop - completes re-enters `0x0044d410` on the full surviving rectangle. The higher owner split is - tighter now too. - `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` - `0x00418be0` is the broader construction or rebuild lane: resolve one candidate id from a stem, - build projected scratch through `0x00416ec0`, then publish the projected rectangle and validate - its side windows through `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` - `0x00416620`. That publish pass is bounded now too: it stages `0x0062b308/0x0062b30c/0x0062b310`, - validates the rectangle against route-entry coverage through - `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, can branch into - the special projected-slot picker `placed_structure_try_select_projected_rect_profile_slot` - `0x00415570`, and refreshes the compact per-cell side tables through - `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` before the - finished scratch is copied into one queued runtime record and the new record re-enters - `0x00416170` when its rectangle is valid. The smaller sibling - `0x00419200` is now bounded beneath that same projected-rectangle family too: it is the tiny - getter over the temporary dword cell-value bank at `0x0062b300`, flattening one caller cell - through live world width `[0x0062c120+0x2155]` and returning the corresponding dword when the - bank exists, else `0`. Current grounded caller is the later world-side branch at `0x0048af99`. - The smaller sibling - `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` - `0x00418a60` now reads as the current-subject clone path above the same connected-component and - mask-refresh helpers, returning the cloned local runtime record later stored into `[site+0x24e]` - by `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` - `0x0040e450`. The higher wrapper above that clone path is bounded now too: - `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0` - first drains the temporary site-id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` through - `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and - `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`, rebuilding one cloned - local-runtime record per queued placed structure through `0x0040e450`, and only then sweeps all - live placed structures through the side refresh helper - `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10`. - The constructor or ownership split beneath that family is tighter now too. The shared allocator - `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` no longer just reaches - an anonymous `0x3e1`-byte scratch object: it first constructs one concrete placed-structure - specialization through `placed_structure_construct_concrete_specialization_vtable_5c8c50` - `0x0040c950`, which calls `0x0045b680` to seed the common base table `0x005cb4c0`, clear the - derived field band `[this+0x23a..+0x26a]`, and re-enter the older base initializer - `0x00455610`, then installs the specialization table `0x005c8c50`. The paired cleanup path at - `0x0040c970` now reads like the matching teardown thunk: it briefly reinstalls `0x005c8c50`, - then immediately demotes the record back to the base table through `0x0045b040 -> - 0x00455650` before the stack object is freed or unwound. The corresponding serializer entry - `0x0040c980` is equally tight now: it simply tails into `0x0045b560`, which first re-enters the - base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1` and - `0x5dc2` over `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. - One nearby string clue is useful but narrower than it first looked. The specialization table at - `0x005c8c50` is immediately followed by `RadioStation` and `Radio Station`, but the local member - method `0x0040ce60` now shows why: it compares site stem `[this+0x3ae]` against `Radio Station`, - canonicalizes that stem to `RadioStation` on match, and then re-enters `0x0040cd70` plus - `0x0045c150`. So those adjacent strings ground one stem-normalization lane inside the - specialization, not the specialization name by themselves. The small virtual-slot and cached-id - side is tighter now too. The same `0x005c8c50` table carries three literal-false stubs - `0x0040cc10/0x0040cc20/0x0040cc30`, one literal-true stub `0x0040ccc0`, and the narrower - linked-site-id presence predicate `0x0040ccb0`, which simply returns whether `[this+0x2a8]` is - nonzero. Beneath the stem-normalization path, `0x0040cd70` is now bounded as the common cached - source/candidate resolver: it clears `[this+0x3cc]` and `[this+0x3d0]`, scans source collection - `0x0062b2fc` for a stem match against `[this+0x3ae]`, stores the matched source id into - `[this+0x3cc]` plus the linked candidate/profile id from `[source+0x173]` into `[this+0x3d0]`, - and when no match exists formats localized id `0x00ad` through `0x0051e980` with the current - stem buffer. That warning path is tighter now too: `0x0051e980` is the guarded warning-modal - publisher that forces cursor visibility through `MouseCursor.cpp` before showing the shared - warning box. The two tiny followers `0x0040cec0` and `0x0040cee0` then resolve those cached ids - back into concrete source and candidate records through `0x0062b2fc` and `0x0062b268` - respectively. The derived payload and transient family under that same table is tighter now too. - `0x0045c150` is the clear payload-loader - counterpart to `0x0045b560`: it reinitializes the derived field band, opens the `0x5dc1/0x5dc2` - payload bracket, restores the two payload strings into `[this+0x23e]` and `[this+0x242]`, clears - the transient roots `[this+0x24e]`, `[this+0x256]`, `[this+0x25a]`, and `[this+0x25e]`, and then - rebuilds follow-on specialization state through `0x0045b5f0` and `0x0045b6f0`. The neighboring - builder pair is coherent too: `0x0045b210` formats `amb_%1_01.wav`, allocates a `0x141`-byte - transient object, stores it at `[this+0x24a]`, and registers it through `0x0052da00`, while - `0x0045c310` allocates the separate primary transient handle at `[this+0x246]` from payload - strings `[this+0x23e]` and `[this+0x242]`, then publishes it through `0x00530720` and - `0x0052d8a0`. The next rebuild layer is tighter now too. `0x0045b5f0` resolves one current - world-position tuple through `0x0052e720 -> 0x0051f090 -> 0x00534490`, then uses that derived - scalar to refresh the ambient-side transient again through `0x0045b210`. Above that, - `0x0045b6f0` clears the optional handles at `[this+0x25a]` and `[this+0x25e]`, then probes and - materializes a larger named variant family rooted in `[this+0x23e]` through strings such as - `%1_`, `%1_Upgrade1`, `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and - `%1_Upgrade1Light%2.3dp`, looping across numbered variants and publishing surviving records - through `0x0052d8a0`. One higher timed branch is bounded now too: `0x0045baf0` advances the two - timer-like fields `[this+0x26a]` and `[this+0x266]`, gates on nearby world-distance and - candidate-side checks, and then formats one output around `rnd_%1_%2.wav` plus the same anim or - light string family before dispatching through `0x00531e50` under owner `0x006d402c`. Their - release-side companions `0x0045b160` and `0x0045c3c0` tear down those same transient roots and - payload strings again, and the recurring service slice `0x0045be50` updates the derived scalar - triplet `[this+0x22e]`, `[this+0x232]`, and `[this+0x236]` before republishing it through - `0x00530720`. The string literals `amb_%1_01.wav`, `%1_Anim%2.3dp`, - `%1_Upgrade1Anim%2.3dp`, `%1_Upgrade1Light%2.3dp`, and `rnd_%1_%2.wav` therefore ground the - derived band `[this+0x23e..+0x26a]` as one payload-plus-transient owner family with ambient, - animation, light, and random-sound components, rather than more linked-site or route-entry ids. - One broader specialization-side build pass under that same family is bounded now too. - `0x0045b760` first scans one base-or-upgrade descriptor family rooted in `[this+0x23e]` - through `%1_` or `%1_Upgrade1`, probing each numbered hit through `0x0053c930` and dispatching - every accepted one through vtable slot `+0x7c`. It then builds the matching attached-emitter list - through `0x0045e940`, ensures the shared `%1_Anim.3dp` payload root exists through `0x0045ae80`, - and finally scans the paired animation family through `%1_Anim%2.3dp` or - `%1_Upgrade1Anim%2.3dp`, materializing each accepted hit into a `0x206` record through - `0x00530640`, publishing that record through `0x0052d8a0`, hashing the generated name through - `0x0053d810`, and forwarding the result into `[this+0x256]` through `0x0045a7f0`. So that - specialization side now has one explicit base-or-upgrade descriptor and animation-record build - pass above the later timed anim/light/random-sound service slice, not just the narrower - `%1_Anim` and `%1_Upgrade1Light` helpers. - The shared `%1_Anim.3dp` collection under that build pass is tighter now too. `0x0045ae80` - formats literal `%1_Anim.3dp`, probes the named-bank owner `0x006d4020`, reads the matched - payload bytes, and lazily allocates the intrusive shared list root `0x006acd5c`, so this is the - bootstrap for the specialization-side shared animation payload family rather than just another - bank-read leaf. `0x0045a7f0` then acts as the keyed replace-or-publish helper over that same - family: it rewrites matching keys across the current `0x006acd50/0x006acd4c` row collection, - mirrors the replacement into the per-row four-lane pointer bands, inserts newly active rows into - the intrusive list rooted at `0x006acd5c`, and when selector table `0x006acd44` is live it - allocates one selector-`0` effect slot through `0x00475ed0` before forwarding it into - `0x00475240(-1,0)`. The smaller helper `0x0045a700` is the keyed three-float accumulator beneath - that same path: it scans the live `0x168`-byte rows in `0x006acd50`, filters on one key dword - plus row flag bit `0x400`, and accumulates one output anchor delta from the shared basis bands in - `0x006acd4c+0x04/+0x34` or `+0x40/+0x70`. The service side above the collection is also bounded: - `0x0045af50` clears globals `0x006acd44/48/54`, publishes the current row collection into - `0x006acd50/0x006acd4c`, releases oversize selector roots through `0x00475100`, and prunes every - intrusive active record in `0x006acd5c` whose owner pointer at `[record+0xf0]` matches the - current collection owner. The heavier per-record body is `0x0045a9c0`: it honors the current - controller gates in `0x006acd48/58`, clears and re-arms the selected effect-slot band in - `0x006acd44`, optionally mirrors one caller dword into row field `[row+0x80]`, updates timing and - mode fields across every matching shared row, derives local scalar deltas through `0x0045a280`, - optionally subtracts keyed anchor deltas through `0x0045a700`, and republishes the finished two - owner triplets through `0x0052e8b0` and `0x00530720`. - `0x0045ade0` seeds cursor `0x006acd60` from `[0x006cec78+0x15]`, then services the intrusive - list in `0x0f`-tick windows by dispatching the heavier per-record body at `0x0045a9c0(owner, - cursor, 0)` for every linked record whose owner pointer at `[record+0xf0]` is live. So the - specialization transient family now includes a concrete shared `%1_Anim.3dp` payload root, - keyed record replacement, keyed anchor accumulation, and a bounded 15-tick shared service loop, - not just the base builder at `0x0045b760`. - The low-side leaves under that same family are tighter now too. `0x0045b050` is the explicit - field reset for payload roots `[this+0x23e/+0x242]`, transient handles `[this+0x246/+0x24a/+0x24e]`, - selector slot `[this+0x262] = -1`, timer fields `[this+0x266/+0x26a]`, and the packed flag band - `[this+0x23a..+0x23d]`, with an optional tail into `0x00455610` when the caller requests a - broader base clear. `0x0045b0b0` is the paired integer-triplet publish leaf: it forwards one - caller triplet through `0x0052e680` on the specialization owner and, when present, repeats that - same publish into the primary transient `[this+0x246]`. `0x0045b0f0` is the neighboring packed - RGB-triplet forwarder into vtable slot `+0x58`. The two tiny wrappers around them are now - explicit too: `0x0045b040` demotes the specialization straight back to base vtable `0x005cb4c0` - before tailing into the common cleanup body `0x00455650`, while `0x0045b110` is just the direct - wrapper into the shared world-anchor triplet publisher `0x00455660`. - One intermediate transient build layer is bounded now too. `0x0040cf00` first requires - creation-mode byte `[this+0x3d4] == 1` and live seed handle `[this+0x24e]`, re-enters - `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, - `[this+0x21]`, `[this+0x3a]`, and `0x005c8cf4`, and then allocates a second transient handle - into `[this+0x25a]` through `0x00475ed0`. It follows that with one current world-position - resolve through `0x00414450` and `0x0052e720`, several local offset-triplet writes through - `0x00475010`, and four numbered channel updates through `0x00475030` with selector ids `1..4`. - That is enough to bound it as another specialization-side transient-handle builder beneath the - same payload family as `0x0045c310` and `0x0045b210`, without yet over-naming the user-facing - subtype or effect semantics of the built handle. The adjacent data-loading strip under that same - transient family is tighter now too. `0x00474700` reloads `particles.dat` into global root - `0x006cea5c` and then registers literal `ParticlesTexture` through owner `0x006d4030`; - `0x00474790` reloads `emitters.dat` into global root `0x006cea60`; `0x00474820` hashes one - caller-supplied emitter name and resolves the first matching entry out of that `emitters.dat` - table; `0x00474860` is the adjacent formatted-variant iterator that walks the same table through - `%s%s%i.3dp`, saving the selected row root into `0x006cea90` and the generated variant name into - `0x006cea94`; `0x00474970` is the small handle-array release helper used by the same - emitter-template teardown side; and `0x004749a0` is the tiny exact-compare predicate for literal - `steam`. The lower definition-to-handle materialization body is bounded now too: `0x004749d0` - copies scaled float and packed dword bands from one emitter-definition row into the attached - emitter handle, resolves the named particle row from `particles.dat` through `0x0053d810`, and - mirrors that particle row into `[handle+0x10c..]` before returning the live handle. The - higher creator above that materializer is tighter now too: `0x00474e20` first strips special - high bits for `CargoMoney_DollarSign`, clears incoming flag `0x400` when definition gate - `[def+0xb8]` is zero, and then either hashes the definition name plus owner token and clones one - owner-side template through `0x00556ce0`, or allocates a fresh `0x1fd` runtime emitter through - `0x00556920` before re-entering `0x004749d0`. On success it publishes that emitter through - `0x0052d950`, stores the definition owner pointer into `[emitter+0x60]`, and when final flags - carry `0x02000000` it forces persistent flag dword `[emitter+0xbc] = 1`. One larger owner-stem - branch above that iterator is bounded now too: `0x0045e940` rejects `Stadium`, clears caller flag - bit `0x10` for `ParticleCar`, repeatedly pulls formatted variants through `0x00474860`, - instantiates each accepted variant through `0x00474e20`, sets emitter flag `0x02` for - `Nuclear`, and optionally returns the created emitter list through the caller array. So the - `0x00474e20/0x00475010/0x00475030` emitter builders are now sitting on top of a grounded pair - of particle and emitter data tables plus one concrete owner-stem-driven variant-list builder, - not just anonymous global payload roots. The small shared slot utilities - under those builders are tighter now too: `0x00474fe0` is the shared per-slot flag broadcast - into `[emitter+0xbc]`; `0x00475010` caches one shared anchor - triplet into globals `0x006cea68/0x006cea6c/0x006cea70`, `0x00475030` republishes that cached - triplet into either all emitters in one slot container or one selected emitter index at - `[emitter+0x1b0..+0x1b8]`, `0x00475240` toggles the per-emitter enable byte `[emitter+0x1d8]` - for either all or one selected emitter, and `0x004752b0` is the paired boolean query that - reports true only when that same byte is zero. The update side is explicit too: `0x00474f70` - runs `0x00555e50(0)` across either one supplied slot container or every slot in the global linked - list rooted at `0x006cea74`. The release side is explicit too: `0x00475100` - tears emitter slots down, optionally unlinks them from the global active list - `0x006cea74/0x006cea78/0x006cea7c`, and then either recycles or frees the slot depending on - whether it falls inside the pooled descriptor rooted at `0x006cea58`. Two named bundle builders - are grounded now too: `0x004752d0` builds the three-emitter `BrokenDown_Steam` + - `FlamespoutB` + `Crash_SmokeA` bundle, while `0x00475550` builds the two-emitter - `BrokenDown_Steam` + `BrokenDown_Smoke` bundle. The next owner layer above those helpers is - grounded now too. `0x00474ce0` is the global particle/emitter bootstrap: it reloads - `emitters.dat`, reloads `particles.dat`, publishes the mode-`1` ratio labels through - `0x00474690`, lazily allocates pooled slot root `0x006cea58`, allocates backing slab - `0x006cea54`, seeds that slab into the pooled descriptor through `0x0053dcf0(0x38, 0x2710, 1)`, - clears the global linked-slot heads and shared anchor globals, rebuilds the flagged templates - through `0x00474c60`, and finally publishes enable-state `1` through owner `0x006d4030`. - `0x00474db0` is the teardown-side companion that frees `0x006cea54`, `0x006cea5c`, - `0x006cea60`, and then resets and frees the pooled slot root `0x006cea58`. That makes the - effect-slot builders a real subsystem rooted at `0x006cea54..0x006cea98`, not just a loose - string-and-handle utility strip. The named bundle surface is broader now too: `0x00475420` - selects one `Volcano_BlackSmoke*` + `Volcano_Lava*` pair from the caller float tier - `0.5/0.75/1.0/1.5/2.0` and builds the two-emitter volcano bundle; `0x00475650` builds the - three-emitter `ServiceTower_Water2` + `ServiceTower_Water` + `ServiceTower_Water3` water bundle - from the paired `ServiceTower_Anim2#water.3dp`, `ServiceTower_Anim3#water.3dp`, and - `ServiceTower_Anim4#water.3dp` definitions; `0x004757b0` builds the three-emitter - `Rocket_Flame` + `Rocket_Smoke` + `Rocket_Sparkle` fireworks bundle from the paired - `Fireworks_Anim2/3/4#water.3dp` definitions; `0x00475910` is the adjacent randomized - one-emitter fireworks builder that rotates among `Fireworks1/2/3`, uses - `Fireworks_Anim5#water.3dp`, and writes fixed dword `0x3c` into `[emitter+0xbc]`; - `0x004759f0` and `0x00475b30` build the one-emitter `CargoMoney_DollarSign` and - `SpendMoney_DollarSign` bundles; `0x00475a90` builds the one-emitter `SelectObject` bundle; - `0x00475bd0` builds the five-emitter directional construction bundle from `Construct_Pos`, - `Construct_Left`, `Construct_Right`, `Construct_Back`, and `Construct_Forward`; `0x00475dc0` - selects between one-emitter `Mist` and `MistSmall`; and `0x00475e30` builds the one-emitter - `Vent` bundle. The next local owner above that catalog is grounded too: `0x00475ed0` is the - selector-driven named-bundle dispatcher that chooses one of those builders from the caller - selector, mirrors the first emitter's attachment token into `[slot+0x04]`, stores caller mode - into `[slot+0x34]`, and when that mode equals `1` links the finished slot into the global active - list `0x006cea74/0x006cea78/0x006cea7c`. So that specialization-side transient path now has a - much broader data-backed effect catalog and a concrete selector-driven bundle owner above it, not - just the earlier broken-down bundles. - One adjacent train-side effect strip is bounded now too, and it should stay separate from the - concrete placed-structure specialization family. `0x0045d130` resolves one owner profile - through `0x006ada84`, allocates a `0x141`-byte handle, initializes it through `0x00554830` - using one mode-selected train sound stem from the tiny selector at `0x0045d22e`, applies two - fixed parameter writes through `0x00554340` and `0x00554450`, stores the result at `[this+0x336]`, - and registers it through `0x0052da00`. `0x0045d260` is the paired live-handle updater: it clamps - one caller-scaled rate into `0x1f40..0xac44`, forwards that through `0x005542c0`, pushes the - caller gain through `0x00554450`, and when the current handle mode at `[handle+0x138]` equals - `1` also forwards zero through `0x005543f0`. The broader owner above both helpers is - `0x0045d2e0`: it republishes the current world anchor through `0x0052e720`, updates an existing - live sound handle at `[this+0x346]` when one exists, or otherwise selects one new sound stem from - fixed `Train_Burning.wav`, fixed `Train_Breakdown_loop.wav`, or one dynamic table-driven name - after the `0x0041b8f0 -> 0x004a8840` branch, then creates the fresh sound handle through - `0x00531e50`, stores it at `[this+0x346]`, sets fixed flag bits `0x18`, seeds two scale fields - from the chosen mode factor, and clears the three train-state latches `[this+0x33a/+0x33e/+0x342]` - again. So the neighboring `0x0045d130/0x0045d260/0x0045d2e0` family is now bounded as a - train breakdown-or-burning sound/effect handle strip rather than more placed-structure emitter - state. - The larger owner above that train-side strip is bounded now too. `0x0045d4b0` optionally clears - prior state through `0x00455610`, copies the caller primary and secondary stems into - `[this+0x32e]` and `[this+0x332]`, probes the named-bank owner `0x006d4020` for the secondary - stem, then falls back through the primary stem and the suffixed `_C.tga` form. It resolves one - `ServicePoint.3dp` payload into `[this+0x23e/+0x23a]`, one `Body.3dp` payload into - `[this+0x242/+0x246]`, counts existing `%1_Truck%2.3dp` variants into `[this+0x31a]`, allocates - the larger per-variant table at `[this+0x316]`, and then enters the later subloops that fill the - cargo-icon, bogie, drivewheel, piston, connecting-rod, coupling-bar, body, and track-point - bands. That keeps the `0x0045d130/0x0045d260/0x0045d2e0` sound helpers nested under a broader - train visual/profile preload owner rather than floating as an isolated sound-only strip. - The release and load sides of that same train family are bounded now too. `0x0045e390` drops the - optional sound handle `[this+0x346]` through `0x00531ef0` plus the mode-gated `0x005317b0` path, - clears the live train-effect handle root `[this+0x336]` by re-entering `0x0045cc90(0)` and - `0x0045cf40(0)`, iterates the variant table at `[this+0x316]` to free per-row pointer arrays, - two heap buffers, and any nested owned list rooted at `[row+0x0c]->[+0x75]`, then frees the main - table and the two payload strings `[this+0x32e]` and `[this+0x332]`. `0x0045e530` is the - load-side owner: it opens tags `0x61a9` and `0x61aa`, reads two heap strings, optionally rewrites - the first string by scanning the live collection at `[0x006d4020+0x429b8]`, rebuilds the train - visual family through `0x0045d4b0` with unit scale, republishes the early per-row handles through - `0x005548d0`, and under scenario latch `[0x006cec78+0x46c34] > 0x2585` also enters the optional - child-record branch under tag `0x61b2` before closing `0x61ab`. That makes the train-side strip a - real payload-owned family with explicit preload, service, load, and teardown phases rather than a - one-off visual helper. - Two shared selector-slot toggles under that same family are bounded now too. `0x0045cc90` owns - the three selector-driven effect slots at `[table+0x34]`, `[table+0x38]`, and `[table+0x3c]`: - in build mode it allocates selectors `1`, `2`, and `3` through `0x00475ed0`, reseeds their - shared anchors through `0x00475010/0x00475030`, and then enables every live emitter in the main - row-object list by writing byte `1` into `[emitter+0x1d8]`; in release mode it tears those same - three slots down through `0x00475100`, clears the table fields again, and disables the same - emitter list by writing byte `0`. `0x0045cf40` is the same pattern for selector `5` into - `[table+0x40]`. So the train visual family now has one explicit selector-slot toggle layer above - the named `0x00475ed0` bundle catalog, rather than touching those effect slots only through the - broader load and teardown owners. - One smaller service leaf under that same family is grounded now too. `0x0045e8c0` walks the - fixed 32-entry row-object strip rooted at `[this+0x277]` and dispatches vtable slot `+0x10` on - every live row object. When the caller supplies a valid selected row index instead of `-1`, it - re-enters that selected row through vtable slot `+0x0c`, and when the paired per-row flag byte in - the neighboring strip is nonzero it also pushes `0,0,1.0f,1.0f` through `0x0052eab0` on that - selected row object. The current grounded callers at `0x0041c680` and `0x0041c69a` derive the - selected row from byte `[cargo+0x20]`, so this is best read as the row-object service plus - selected-entry refresh leaf under the train visual family, not a generic object-list sweep. - One adjacent helper block is tighter now too, and it should stay separate from the concrete - `0x005c8c50` vtable rather than being folded into it. The small predicates - `0x0040cc40/0x0040cc60/0x0040cc80` all follow the same `[this+0x173] -> 0x0062b268` chain into - one linked candidate/profile record. `0x0040cc40` returns whether candidate subtype byte - `[candidate+0x32]` equals `1`, `0x0040cc60` returns raw candidate byte `[candidate+0xba]`, and - `0x0040cc80` returns the stricter conjunction `subtype == 1 && class == 3` using class byte - `[candidate+0x8c]`. The current grounded caller for all three is - `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where they derive - the two boolean mode inputs for `0x00415020`; that makes them a shared candidate-profile helper - cluster adjacent to the specialization family, not direct overrides in the `0x005c8c50` table. - The neighboring `0x0040ccf0` stays on the same “adjacent but not the same vtable” side of the - boundary: it resolves one linked instance through `0x0047de00`, follows that instance's vtable - `+0x80` owner chain, and returns candidate class byte `[candidate+0x8c]`. Current grounded - callers at `0x00480fb5` and `0x004b03ce` compare that returned class against `3` and `4`, so the - current safest note is simply “linked-instance candidate-class reader.” One gated collection-side - scan in the same neighborhood is bounded now too. `0x0040cd10` first requires shell latch - `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current - subject's center world-grid cell through `0x00455f60`, reads the local site roster count and id - list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through - `0x006cec20`. Its current grounded caller is the broader collection sweep at `0x00413860`, so - the strongest current read is a gated center-cell site-roster scan rather than one more direct - specialization override. - One small neighboring world-grid helper is grounded cleanly enough to keep too. `0x0040ccd0` - takes one live world root, one X-like index, and one Y-like index, multiplies the Y-like term by - world width `[world+0x2145]`, adds the X-like term, scales the resulting slot by fixed cell - stride `0x1d7`, and returns the corresponding cell pointer under base `[world+0x2129]`. Current - grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386` and - several world-grid overlay passes in the `0x004525bc..0x00452bb2` range, so that helper is now - best read as the shared `(x,y) -> world-cell*` resolver rather than another object-specific - method. - The next sibling table at `0x005c9750` is tighter now too, though still not fully decoded. The - structural anchor is `map_load_city_database` `0x00474610`: that loader stages bundle tags - `0x61a9..0x61ab`, iterates one collection, and dispatches each entry through vtable slot `+0x44`. - In `0x005c9750`, that same slot resolves into the sibling record family beside - `0x0041ab70/0x0041ab80`, which is enough to treat the table as the city-database entry family - rather than a generic unresolved runtime object. The small load-side slot `0x0041ab70` simply - jumps into `0x0045c6f0`, which restores two strings into `[this+0x32e]` and `[this+0x332]`, - stages the same `0x61a9/0x61aa/0x61ab` tag family, and iterates the child runtime band rooted at - `[this+0x316]`. The one real behavioral slot we recovered there is `0x0041ab80`: it refreshes - one named handle through owner `0x006d4020`, writes the resulting handle into `[this+0x1c]`, - queries three base floats through `0x0045c480`, and returns one scaled float derived from the - first queried component. That method is currently called from later world-side branches at - `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantics of the handle and - the many constant-return virtuals in the same table are still open, but the family boundary is no - longer arbitrary: this is now the current city-database entry vtable cluster, not another - placed-structure specialization. One correction matters here too: the lower - `0x00455660/0x00455800/0x00455810/0x00455930` helpers are no longer city-only. Local `.rdata` - now shows the same shared slots under both the city-entry table `0x005c9750` and the sibling - `Infrastructure` table `0x005cfd00`, whose constructors at `0x0048a240/0x0048a2dc/0x00490a3c` - all re-enter `0x00455b20`, install `0x005cfd00`, and seed the same scalar-band family through - `0x00455b70` with the literal stem `Infrastructure`. So the safest current family name for those - low helpers is the broader `0x23a` runtime-object band rather than city-entry-only. `0x00455800` - and `0x00455810` are simply the paired normalized coordinate getters over `[this+0x1e2]` and - `[this+0x1ea]`, which explains why they recur all over the city-side, route-link, and - placed-structure placement code. The narrower helper `0x00455660` sits above those getters: it - scales the caller-supplied normalized coordinate pair, converts it through - `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied integer height bias, optionally - rounds that height through `0x005a10d0` when the auxiliary-preview gate `0x00434050` is active, - and finally publishes the resulting world-anchor triplet through `0x00530720`. One - serializer-side sibling is bounded too. `0x00455930` queries two triplet-like scalar bands - through `0x0052e720` and `0x0052e880` and writes the resulting six dwords through `0x00531030`; - its load-side stream counterpart `0x00455870` reads the same six four-byte lanes back through - `0x00531150`, republishes the first triplet through `0x00530720`, republishes the second through - `0x0052e8b0`, and returns the summed byte count. The neighboring tagged string-triplet serializer - `0x004559d0` is now no longer reversed either: it writes bracket tags `0x55f1/0x55f2/0x55f3` - through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through - `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before the closing - tag. - -### Shared Runtime-Object and Support Families - -The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` is the - common local-state reset that clears the list and handle roots, resets the string/scalar side - bands, preserves only selected low bits of `[this+0x20]`, and reseeds the recurring default - `1.0f` lanes; `0x0052ebd0/0x0052ec50` are the load/save companions for the two flag bits stored - in that same byte; `0x0052eb90` releases every entry hanging from list root `[this+0x79]` - through `0x00554d50`; and `0x0052eca0` is the grouped-table cursor over `[this+0x14]`, - `[this+0x21]`, and `[this+0x3a]` that returns the next `0x45`-byte subrecord in the current - group when one exists. The next shared initializer `0x0052edf0` then binds caller - pointer `[this+0x04]`, resolves optional handles into `[this+0x10]` and `[this+0x1c]`, copies - one anchor triplet into `[this+0x1e2/+0x1e6/+0x1ea]`, sets bit `0x08`, and seeds packed color - `[this+0x43] = 0x007f7f7f`; its release-side siblings `0x0052eeb0` and `0x0052ef10` clear the - two owned list roots `[this+0x79]` and `[this+0x7d]` through distinct per-entry destructors - before freeing the list roots themselves. The broader release body `0x0052ef70` sits above that - strip: it clears the active shell preview-owner latch when it still points at `this`, drops the - dependent handle at `[this+0x0c]`, recursively tears down the nested object list `[this+0x75]`, - clears sibling owned list `[this+0x81]`, detaches any world binding rooted at `[this+0x04/+0x08]`, - and finally frees the optional handles at `[this+0x10]` and `[this+0x1c]`. The next shared - dirty-bit helper `0x0052f120` is now bounded too: when byte `[this+0x20]` still carries bit - `0x02`, it rebuilds the cached 16-dword transform-style block at `[this+0x14e]` from scale - `[this+0x36]`, anchor triplet `[this+0x1e2/+0x1e6/+0x1ea]`, and either the live local vector - lanes `[this+0x4b/+0x4f/+0x53]` or the stored fallback block at `[this+0x18e]`, then flips the - dirty bit over to the cached-ready bit `0x04`. The next two adjacent helpers are bounded too: - `0x0052f1e0` is a pure five-vec3 boolean geometry predicate built from signed-volume or - separating-plane style tests, and `0x0052f370` is the quantized selector that rounds world - coordinates, folds them through table `0x006d9098`, samples one grouped metric through owner - `[this+0x04]`, updates byte `[this+0x5c]`, and then chooses the active `0x45`-byte subrecord by - storing index `[this+0x21]` and pointer `[this+0x18]`. The adjacent emission owner `0x0052f500` - is tighter now too: it starts from that selected grouped subrecord, snapshots the global packet - write pointer and remaining count at `0x00cc3b64/0x00cc3b5c`, optionally refreshes the cached - transform block and applies the five-vec3 predicate when state bit `0x01` is active, and then - emits the selected `0x45`-byte records into one run of `0x20`-byte output packets while - advancing the shared packet cursor. The next shared helpers under that emission band are now - bounded too. `0x0052fb70` is the packed-color propagation helper over `[this+0x43/+0x47]`: when - shell gate `[0x006d4024+0x114742]` is live it combines stored high-byte state with either dim - RGB `0x003c3c3c` or full-bright RGB `0x00ffffff`, pushes the same dim-or-bright triplet into the - child list `[this+0x75]` through `0x0052e680`, and optionally recurses that update over the whole - child tree; when the shell gate is absent it instead stores the raw byte into `[this+0x47]` and - only recurses that byte state. `0x0052fd60` then republishes current anchor triplet - `[this+0x1e2/+0x1e6/+0x1ea]` into every attached entry hanging from list root `[this+0x81]` - through `0x005545d0`. The heavier relocation sibling `0x0052fdc0` marks the object dirty, adds a - caller-supplied triplet delta to the same anchor, quantizes old and new X/Z lanes against the - live world grid, rebinds world handle `[this+0x08]` through `0x00533c20/0x00533bf0` when the - quantized cell changes, and on success re-enters `0x0052fd60`; out-of-bounds moves restore the - prior anchor and fail. One more adjacent rotation-side helper is now bounded too: `0x0052ffb0` - converts the current local 4-dword orientation block at `[this+0x1ce..+0x1da]` into a temporary - axis-angle representation, scales the recovered angle by the caller float, and rebuilds the - stored orientation block by re-entering `0x0052e9f0`. The immediate anchor-publish sibling - `0x00530720` is now explicit too: it is the absolute-triplet form of the same relocation family, - storing one caller-supplied anchor directly into `[this+0x1e2/+0x1e6/+0x1ea]`, optionally - rebinding world handle `[this+0x08]` when the quantized X/Z cell changes, and then re-entering - `0x0052fd60`. The adjacent packet-side query `0x00530030` is bounded as well: it starts from the - currently selected grouped `0x45`-byte subrecord, snapshots the same global packet source span as - `0x0052f500`, lazily refreshes cached basis lanes when needed, transforms one caller-supplied - input triplet through that basis, and then walks the remaining packet span until - `0x0052f1e0` reports one overlap or the span is exhausted. One sibling-table strip is now - explicit too. Table `0x005dd1f0` has the tiny wrappers `0x00530640`, `0x00530670`, and - `0x00530680` as its shared seeded-constructor, reset, and release thunks over `0x0052edf0`, - `0x0052ecd0`, and `0x0052ef70`, while `0x005305c0` is the small list-bit propagator that sets or - clears bit `0` in `[entry+0xb0]` across owned list `[this+0x79]`. The first heavier body under - that same table is now bounded too: `0x00530690` copies one pair of 16-dword cached blocks from a - source object into `[this+0x10e]` and `[this+0xce]`, refreshes local cached transform - `[this+0x14e]`, and recurses the same copy into child list `[this+0x75]`. The `Infrastructure` - side is tighter now too. The optional child - The next adjacent field-accessor strip is explicit too: `0x00533100/0x00533120` are the indexed - float set/get helpers for `[this+0x14e4 + index*4]`; `0x00533130/40`, `0x00533150/60`, - `0x00533170/80`, and `0x00533190/a0` are four direct dword set/get pairs over - `[this+0x1534]`, `[this+0x1540]`, `[this+0x153c]`, and `[this+0x1544]`; `0x005331b0/c0` are the - float set/get pair for `[this+0x14e0]`; and `0x005331d0` is the direct getter for `[this+0x1548]`. - The important caller-side grounding is narrow but real: `0x0052f370` samples one indexed float - through `0x00533120` while choosing the active grouped subrecord, and `shell_emit_ranked_overlay_cell_items` - `0x00524780` reads the current threshold pair through `0x00533160` and `0x00533180`. So this - strip is now bounded as a genuine shared field-accessor family under the same runtime-object - owner, even though the exact high-level meanings of those fields remain open. - attach helper `0x0048a1e0` allocates and seeds one fresh `Infrastructure` child and, when the - owner already has more than one child, clones the first child's two triplet bands into that new - child before attaching it. The looped rebuild `0x0048dd50` then rebuilds the owner-visible - `Infrastructure` children one ordinal at a time, tears down the higher extras above ordinal `5`, - refreshes cached primary-child slot `[this+0x248]` when needed, and finishes with the same - world-cell and route-side follow-on family around `0x00448a70`, `0x00493660`, and `0x0048b660`. - The smaller attach helper `0x00490a3c` is now bounded too: it conditionally allocates one - `Infrastructure` child from a caller-supplied payload stem, attaches it to the current owner, and - then seeds three caller-supplied position lanes through `0x00539530` and `0x0053a5b0`. The - direct route-entry side of the same family is no longer anonymous either: `0x0048e140`, - `0x0048e160`, and `0x0048e180` are the three direct resolvers over owner fields - `[this+0x206/+0x20a/+0x20e]` into the live route-entry collection `0x006cfca8`. Another shared - sibling family is tight enough now too: the real - packed-byte-triplet owner is `0x0052e680`, and the two local - wrappers `0x00455820` and `0x00455840` both force its recursion flag on. `0x00455820` forwards - three explicit byte arguments, while `0x00455840` unpacks one packed `u24`-style dword into - three byte lanes first. The downstream setter writes packed byte-triplet lane `[this+0x43]`, - defaults that lane to `0x007f7f7f` when all three bytes are zero, and when recursion is enabled - it walks child list `[this+0x75]` through `0x00556ef0/0x00556f00` and re-applies the same packed - update recursively to every child. The shared formatter thunk `0x00455860` is no longer a blind - jump target either: `0x00530820` now reads as the common group-selection status-label formatter - over the same `0x23a` family. It only answers when shell gate `[0x006d4024+0x1146be]` is live, - state bit `0x10` is clear, vtable slot `+0x14` says the current object should answer, and the - owned-entry bit propagator `0x005305c0` succeeds. Under that gate it formats one caller-owned - text buffer from either a fixed fallback block, a simple mode-`1` `X` or index form, or a - grouped-table form built from the current `0x45`-byte subrecord's float lane plus current index - `[this+0x21]`. The sibling `Infrastructure` table `0x005cfd00` also still carries three tiny - fixed-return slots after that shared formatter path: two return literal `0x46`, and one returns - fixed float `1.25f`, so those slots are now bounded as small table constants rather than as - missing behavior. One nearby global helper family is bounded enough too: `0x005309d0` lazily - clears and arms the indexed table rooted at `0x00ccb880`, `0x00530a00` services or releases one - slot in that table according to its local state dword, `0x00530b70/0x00530b90/0x00530c10` query - one slot's primary handle metric, primary handle, and payload-length lanes, and `0x00530ba0` - performs the release-side cleanup for one slot's owned buffers. Current callers are broad - enough that the table's exact resource type still stays open, but the init/service/query/cleanup - split is now grounded. The broader bundle or stream slot layer under that same table is bounded - now too: `0x00530c80` is the common open-or-reuse entry for named slots, `0x00531030` and - `0x00531150` are the shared write and read byte pumps, `0x00531340` and `0x00531360` are the - four-byte tagged-header wrappers used all over map, setup, world, and runtime bundle code, and - `0x00531380/0x00531410` are the shared variable-length heap-string load/save helpers built on - top of those byte pumps. The immediate neighbors are bounded too: `0x00531490` writes one raw - NUL-terminated string without the length prefix, `0x005314b0` is a callback-driven selector over - global `0x00ccba08`, and `0x00531500` is a small gate that only returns true when `[this+0x04]` - equals `1` and global `0x00ccb9f4` is nonnull. The next adjacent strip is now bounded - structurally too even though the owning subsystem is still open: `0x00531520..0x005317b0` - mostly share the inverse gate `[this+0x04] == 1 && 0x00ccb9f4 == 0`, then forward into one of - three global owners `0x00ccba00`, `0x00ccb9f8`, or `0x00ccb9fc`. The clearest member of that - strip is `0x005315c0`, a plain 3x4 affine point transform over three caller-supplied float - pointers. The rest are still best read as structural wrappers: `0x00531640` resolves the - zero-based index of the first callback-selected string matching the current `0x00ccb9fc` string - source, `0x005316d0` forwards one callback-selected entry pointer into `0x00569730`, and - `0x00531710/0x00531730/0x00531750/0x00531770/0x00531790/0x005317b0` are the small - mode-gated dispatch or query wrappers into the neighboring `0x5695..0x56ac..` family. The next - adjacent owner strip is bounded enough now too: `0x00531800/0x00531840` are the null-`0x00ccb9f4` - guarded call wrappers into `0x0056ae80(0x00ccb9f8)` and `0x00569cf0(0x00ccb9fc)` with scoped - reentrancy counter `0x00ccb9f0`; `0x00531880` releases optional handle `[this+0x4c]` through - two function-pointer calls when global `0x00624d58 == 1`; `0x005318b0` spin-waits for that same - reentrancy counter to drain; `0x005318c0` picks between owners `0x00ccb9f8` and `0x00ccb9fc` - from global selector `0x00ccba04`; and `0x005318f0` is the shared constructor that allocates - and initializes globals `0x00ccb9f8`, `0x00ccb9fc`, and `0x00ccba00`, then arms mode flag - `[this+0x04] = 1` when all three are live. The next owner block is no longer just a loose - cluster either: `0x00531a10` is the full teardown path for that same family, first raising - `0x00ccb9f4`, optionally fading scalar lanes `[0x00ccba00+0x104]` and `[0x00ccb9fc+0x58]` - through `0x00557d90/0x00569ae0/0x00569ca0` plus a `0x10`-tick sleep, then spin-waiting on - `0x005318b0`, releasing optional handle `[this+0x4c]`, shutting the three globals down, and - clearing `[this+0x04]` again. `0x00531c00` is the symmetric rebuild side: it force-calls - `0x00531a10(this,1)`, reconstructs the family through `0x005318f0`, and seeds the default live - state through `0x005696b0`, `0x00569660`, `0x00557d90`, `0x0056a8e0`, and `0x00569ae0` from - shell-owned scalars. The smaller strip between them is bounded structurally too: `0x00531d30` - refreshes the primary scalar and dispatches `0x00557e50`; `0x00531dc0` is the dual-scalar idle - predicate over `[0x00ccb9f8+0x20]` and `[0x00ccb9fc+0x58]`; `0x00531e50` is the string-driven - sibling of `0x00531e10`, tail-jumping into `0x0056a520` when the same family is ready; `0x00531e90` - stages one 16-dword local payload block into `[this+0x08..+0x44]` and forces - `[0x00ccb9fc+0x60] = 2`; `0x00531ed0` and `0x00531ef0` are the small active-mode field and - selected-hash-root queries; `0x00531f40` services `0x00ccb9f8/0x00ccb9fc` and clears staged flag - `[this+0x48]`; `0x00531f90` registers one of the guarded callbacks `0x00531800/0x00531840`; and - `0x00531fd0` is the timed primary-scalar transition service that coordinates `0x00ccba00` with - globals `0x00624d58/0x00624d60` under the same reentrancy counter `0x00ccb9f0`. The local - controller layer above that family is bounded now too: `0x00532150/0x00532200` are the - construct/destruct pair for the controller object itself, `0x00532230` rebuilds from one - callback-selected entry through `0x005314b0 -> 0x00531c00`, and `0x00532260` rebinds primary - handle `[this+0x4c]` while registering transition callback `0x00531fd0` and seeding selector - `[this+0x50]`. One other sibling table is bounded enough now - to keep separate too: local `.rdata` at `0x005c9a60` carries the same shared low `0x23a` slots - plus table-specific overrides `0x0041f680`, `0x0041f720`, `0x0041f7b0`, `0x0041f7e0`, - `0x0041f810`, and `0x0041f850`, with nearby literals `(%1)` and `Marker09`. The exact subtype - name behind that table is still open, but the behavior split is strong enough: `0x0041f680` - first refreshes the current global preview/helper owner through `0x00455de0` and then forwards - mode `1` plus handle `[this+0x23a]` into `0x004cf830`; `0x0041f720` formats `[this+0x356]`, - publishes the resulting shell text, and conditionally dispatches `0x00452fa0` with action - `0x12` when world state `[0x0062c120+0x2175]` is `0` or `0x15`; `0x0041f7b0` publishes one - fixed payload and only then jumps to `0x00453510` when that same world state is `0x12`. The - same table also has a tighter adjacent helper strip now: `0x0041f6a0` is the direct - `[this+0x37f] -> 0x00517cf0` slot-count query, `0x0041f6b0` is the rounded normalized-coordinate - world-scalar query above `0x0044afa0`, and that deeper helper is no longer opaque: it first - computes one distance-like term from the current cell to global preview-anchor fields - `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`, samples the - companion float raster `[world+0x1605]` at the current cell plus two 8-direction rings, keeps - the strongest local rise above the center sample, adds one thresholded preview-scalar bias from - `[0x0062be68+0x20]`, and then adds `0x32` more when the small global gate `0x0041fff0` passes. - That gate itself now reads as a shared shell/preview threshold test: it returns true when - `[0x006cec74+0x2bb] == 2`, or when the same mode dword is merely nonzero and preview scalar - `[0x0062be68+0x20]` exceeds the float threshold at `0x005c9a9c`. `0x0041f6e0` resolves the - current center world-grid cell and checks one packed `u16` token through `0x0042b2d0`, and - `0x0041f6f0` is the raw byte getter over `[this+0x42]`. One nearby mode-gated flag reader is - bounded too: `0x0041f910` returns - literal `1` when shell mode gate `0x004338c0` is inactive or the object class dword - `[this+0x23e]` is nonzero, and only on the class-0 path does it return the same byte - `[this+0x42]`. That gate itself is tighter now too: `0x004338c0` is just the normalized boolean - wrapper over `0x004d4150`, which returns nonzero when the shell-side owner field at `0x006d07b4` - is live. The release side under that same sibling family is bounded too: `0x00420650` - lazily seeds `[this+0x317]` from shell-profile word `[0x006cec78+0x0d]` before re-entering - `0x00420350`, and that body is now bounded as the local scalar refresh over `[this+0x31b]`: - it compares the seeded word against the current shell-profile word, maps the delta through one - bounded piecewise float curve, and applies one extra affine adjustment when `[this+0x23e]` is - nonzero. `0x00420670` then frees the optional dynamic payload at - `[this+0x37f]`, clears the cached `u16` link chain through `0x0041f8d0`, and tails into base - cleanup `0x00455d20`; and the small collection-side wrapper `0x00421700` simply resolves one - entry id, re-enters `0x00420670`, and erases that id from the owning collection. The - city-entry family also now has one tighter - helper-object branch. `0x00474030` - switches over mode enum `0..10`, maps those cases into `0x00475ed0` with selector families - `4/0xd/0xe` and fixed scalar presets `0.5/0.75/1.0/1.5/2.0`, and on success publishes the - caller-supplied world triplet through `[helper+0x4]`. The refresh helper `0x00474260` first - reloads payload through `0x00455fc0`, then samples the current normalized coordinates plus one - world-height scalar from `0x00448bd0`, and rebuilds `[this+0x23a]` through that same - mode-selected helper builder using mode `[this+0x242]`. The surrounding collection-side and - teardown helpers are tight enough now too. `0x004743d0` and `0x00474400` are the two release - siblings over the same helper field `[this+0x23a]`: both destroy that helper through `0x00475100` - when live and clear the field, but `0x004743d0` tails into the smaller base cleanup - `0x00455650`, while `0x00474400` tails into the heavier dynamic-payload cleanup `0x00455d20`. - The small predicate `0x00474430` simply returns `1` unless shell mode gate `0x004338c0` is - active, in which case it returns byte `[this+0x42]`; the exact meaning of that flag byte is still - open, but the mode-gated query itself is bounded now. One level higher, `0x00474450` constructs - the collection rooted at vtable `0x005ce4a8` with fixed parameters `(0,0,0,0x14,0x0a,0,0)`, and - bootstrap caller `0x004487a9` stores that collection into global `0x006cea50`. The collection's - entry path is also bounded now: `0x004744a0` seeds a stack-local temporary entry through - `0x00474110`, allocates one `0x250`-byte live record, resolves it, constructs it through - `0x00474130`, and then tears the temporary entry down through `0x004743d0`; `0x00474510` - resolves one entry id, releases it through `0x00474400`, and removes it from the collection. The - collection-owned load loop at `0x00474540` sits directly beneath `map_load_city_database` - `0x00474610`: it opens the same `0x61a9/0x61aa/0x61ab` bracket on the caller-supplied bundle, - binds the selected path context, iterates the current collection, dispatches each record through - vtable slot `+0x40`, accumulates the returned byte counts, and tears down the temporary entry - after each record. That still leaves broader semantic questions open, but the current static edges - around the city-entry family are now largely exhausted. The adjacent scaffolding is bounded too. - Base helper `0x00455b20` initializes the shared `0x23a`-sized record family by installing base - vtable `0x005cb1c0`, clearing the scalar bands `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroing - the seven-dword block `[+0x212..+0x22a]`, and re-entering `0x0052ecd0`; that is why it shows up - not only in the city-entry temporary constructor `0x00474110`, but also in several later object - construction paths outside the city family. The city collection itself now has a bounded teardown - side too: `0x00474480` is the small release-and-free wrapper for the collection rooted at - `0x005ce4a8`, and teardown caller `0x004492c3` uses it before freeing the global collection - pointer at `0x006cea50`. On the load side, `0x00445713`'s broader setup branch re-enters - `map_load_city_database` `0x00474610` on that same global `0x006cea50` collection. Outside the - city-specific branch, the two tiny dispatch wrappers `0x00455a40` and `0x00455a50` are also now - bounded as raw vtable-slot helpers: the first jumps through entry slot `+0x44`, while the second - pushes one caller argument into slot `+0x40` and then clears the global roots - `0x006acd38/0x006acd3c/0x006acd40`. Finally, `0x00455a70` is now bounded as the generic - current-position triplet publisher that queries `0x0052e720`, converts through - `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied height bias, optionally rounds - under `0x00434050`, and publishes through `0x00530720`. The temporary-entry constructor and live - entry constructor are bounded now too. `0x00474110` is the tiny stack-local initializer: it - re-enters shared base init `0x00455b20`, clears helper fields `[+0x23a]` and `[+0x242]`, - installs vtable `0x005ce428`, and returns. `0x00474130` is the real live-entry constructor: it - stores the entry id into `[+0x23e]`, clears the trailing helper payload block `[+0x246..+0x24e]`, - stores mode `[+0x242]`, derives one world-height scalar from the supplied coordinate pair through - `0x00448bd0`, builds helper field `[+0x23a]` through `0x00474030`, and then seeds the remaining - default scalar or flag tuple through `0x00455b70` using the fixed defaults at - `0x005ce49c/0x005ce4a0/0x005ce4a4`. That broader helper is no longer city-specific either: - `0x00455b70` is now bounded as the shared scalar-band initializer that clears the same - `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]` family, optionally copies up to three caller-supplied - strings into `[+0x206/+0x20a/+0x20e]`, synthesizes one default local token buffer when the middle - string is absent, chooses one effective mode string from the third or first input, derives one - owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and - then seeds the remaining scalar band through `0x0052edf0` and `0x0052e670`. - The same specialization also now has one tighter UI-facing side. The override trio - `0x0040e4e0`, `0x0040e880`, and `0x0040e9d0` all sit in the same `0x005c8c50` table and reuse - the linked-site-capable vtable `+0x70` latch together with creation-mode byte `[this+0x3d4]`. - `0x0040e4e0` is the strongest current owner for contextual status text: it branches across - linked-peer checks, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current - owner state, and candidate or linked-peer display labels, then formats localized ids such as - `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd` before pushing the result through - shell presenter `0x00538c70`. `0x0040e880` pairs with that publisher on the action side: it - first resets the same presenter through the fixed token at `0x005c87a8`, then dispatches several - world-side follow-ons through `0x00413620`, `0x00453510`, `0x00452db0`, and `0x00452fa0` under - the same linked-peer and world-mode gates. `0x0040e9d0` is the narrower query-style formatter: - when shell branch `[0x006cec74+0x74]` is live it formats one localized label with the fixed - suffix `\nAbsIndex %d`, otherwise it can return one company-side owner label through - `0x00426b10`, and only then falls back to `0x00455860`. So the current best read is that this - concrete specialization owns both the ambient or animation transient family and one linked-peer - status or action UI surface, without yet proving the user-facing subtype name. - One smaller subtype hook cluster is tighter now too. The concrete table also carries - `0x0040d170` and `0x0040d1b0`, both of which resolve the current candidate through cached stem id - `[this+0x3cc]` and then test candidate dword `[candidate+0x4b]`. When that flag is nonzero, - `0x0040d170` tail-calls the primary transient builder `0x0045c310` and `0x0040d1b0` tail-calls - the matching release path `0x0045c3c0`. The same neighborhood now also gives direct cached-record - resolvers instead of more anonymous pointer math: `0x0040d1f0` returns the linked peer from - `[this+0x2a8]` through `0x006cec20`, while `0x0040d210` returns the owner-side record from - `[this+0x276]` through `0x0062be10`. That makes the specialization-side ownership split cleaner: - the `0x005c8c50` family is not only formatting labels and driving side effects, it also has a - direct candidate-flag hook for building or dropping the primary transient handle. - The last lower side reads are tighter now too. `0x0040e450` first seeds the projected-slot cache - through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470` before it re-enters - `0x00418a60`, and the broader stem-based builder at `0x00418be0` now has one named optional side - renderer instead of an anonymous callsite: - `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`. - The side refresh split is bounded now too. `0x0040ee10` publishes one local position or scalar - triplet through the shared setter `0x00530720`, then tails into - `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`; - that smaller follow-on only runs on the current subtype-`1`, class-`3`, linked-site branch, and - recomputes one local-runtime triplet from the linked peer's route-entry anchor when that anchor - is still live. The heavier sibling above that side refresh is bounded now too: - `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` is the - world-coordinate mutation helper that recomputes `[site+0x388]` and `[site+0x38c]`, rewrites the - world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`, updates the subtype-`4` - proximity-bucket family when needed, rebuilds the same local position or scalar triplet, and - then tails into the linked-site anchor follow-on at `0x0040e360`. One later caller into that - same side-refresh family is bounded now too: `0x00419110` clamps a caller rectangle to the live - world bounds, resolves one per-cell bucket chain through the hashed map at `[arg0+0x88]` and - `0x0053dae0`, and then re-enters `0x0040eba0` for every bucketed site in that rectangle using - the stored per-entry coordinate pair plus two zero flags. Current grounded caller is the edit-side - branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, - so this now looks like a bucket-map-driven local-runtime side-state refresh wrapper rather than - another broad site sweep. - The sibling policy-`1` side is tighter now too. The constructor lane no longer stops at “one - linked site id at `[site+0x2a8]`”: the subtype-`1` branch in - `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now clearly - allocates that linked record through - `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, whose lower - constructor is `placed_structure_construct_linked_site_record_from_anchor_and_coords` - `0x00480210`. That lower constructor seeds the linked record's own id and anchor-site id, clears - the local route-anchor and display-name fields, projects the anchor footprint into world space, - and then either binds an already-covered route entry through - `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` or - falls through into the neighboring policy-`1` route-entry synthesis family around `0x00493cf0` - before rebinding the chosen route entry through `0x0048abc0`. - The cleanup side is tighter now too. Linked-site removal now has a bounded owner at - `placed_structure_collection_remove_linked_site_record` `0x004813d0`: it resolves the linked - record through `0x006cec20`, runs the per-record teardown - `placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, removes the - live entry from the collection, and only then re-enters the still-bounded company-wide follow-on - at `0x00429c10` when the removed record passed the narrower transit-like latch. That per-record - teardown is no longer just “clear some scratch fields.” It now clearly clears the route-style - scratch lane, clears the five proximity buckets at `[site+0x590..0x5b8]`, detaches or invalidates - the current route-entry anchor, frees the three per-site byte arrays at `[site+0x24..0x2c]`, - clears this site's indexed byte from the corresponding arrays of later placed-structure records, - and then re-enters `0x00436040` with the current site id. - That company-side follow-on is no longer just one opaque callback either. It is now bounded as - `company_collection_refresh_active_company_linked_transit_site_peer_caches` `0x00429c10`, which - walks the active company roster and re-enters - `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each company. That per-company - fast pass stamps a refresh tick at `[company+0x0d3e]`, clears and repopulates the - placed-structure-side cache cells addressed through `[site+0x5bd][company_id]`, marks the - eligible linked transit sites for that company, allocates one `0x0d`-stride peer table for each - eligible site, and fills those peer rows from - `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` - `0x004a6630`. That helper no longer reads as one anonymous route sweep: it either uses the fixed - pair directly or falls back across tracker endpoint combinations before returning the winning - route-entry id, one route-step count, and one companion mismatch count. The fast cache now reads - more cleanly too: peer-record dword `+0x05` stores that step count, while float `+0x09` stores - the normalized continuity share derived from `(steps - mismatches) / max(steps, 1)`, not a raw - delta-per-step ratio. The - adjacent timed wrapper `company_service_linked_transit_site_caches` `0x00409720` now shows the - cadence too: `0x004093d0` is the shorter-interval refresh, while the older heavier sibling at - `0x00407bd0` was only revisited on the longer interval. - That heavier sibling is now bounded too: - `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` no longer looks like a - generic tail refresh. It reuses the fast peer tables, rebuilds candidate-local amount bands plus - normalized issue-opinion scales, and then folds the peer-side route metrics back into three - per-site cache floats with a cleaner split: - `+0x12` is the raw surviving site-score total, - `+0x0e` is the continuity-and-step-weighted companion total, - and `+0x16` is the promoted final site-ranking lane chosen from the strongest grouped candidate - bands. - That also closes most of the cross-version impact question: - the pre-`1.03` versus `1.03+` tracker metric split now looks like it mainly perturbs the weighted - `+0x0e` lane and the promoted `+0x16` lane, not the raw `+0x12` total. - That final lane then feeds the neighboring selectors - `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280` and - `company_build_linked_transit_autoroute_entry` `0x00408380`. That makes the company-side follow-on - read more like a linked-transit autoroute cache family than a generic company maintenance pass. - The neighboring reachability gate is tighter now too: - `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860` caches one company-side - route-entry anchor, and - `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0` - uses that anchor to decide whether a foreign linked transit site can still participate in the - current company's fast peer cache. - The first direct train-side consumer above that cache family is bounded now too: - `train_try_append_linked_transit_autoroute_entry` `0x00409770`. After servicing the owning - company's caches, it asks `0x00408380` for one staged `0x33`-byte route entry using the train's - current anchor site, then either appends that entry through `0x004b3160` and refreshes the new - trailing selection through `0x004b2f00`, or rotates one existing slot in place when the local - two-entry cap has already been reached. So this edge now reaches an actual train-side autoroute - append lane rather than stopping at anonymous company-side cache cells. The weighted cache lanes - still do not escape that route-choice family directly: this train-side append path only inherits - the weighted site and peer choice by calling `0x00408380`, not by reading cache `+0x0e/+0x16` - itself. - The train-side follow-on above that seed path is bounded now too. The owning company can count - its live roster through `company_count_owned_trains` `0x004264c0`, measure one aggregate linked - transit site pressure through `company_compute_owned_linked_transit_site_score_total` - `0x00408f70`, and then rebalance that roster through - `company_balance_linked_transit_train_roster` `0x00409950`. - The aggregate helper no longer reads as a raw sum either: - it starts from the site-cache `+0x12` totals, converts that into one tentative roster target - through year and site-count ladders, and on build `1.03+` adds one special distance-side scaling - branch when exactly two eligible linked transit sites survive. - Because it consumes `+0x12` rather than `+0x0e` or `+0x16`, current evidence now says the tracker - compatibility split is more important for seeded route choice and ranked site choice than for the - final company train-count target itself. The local linked-transit chain is now bounded enough to - say that directly: weighted cache lanes feed `0x00408280 -> 0x00408380 -> 0x00409770/0x00409830`, - while the separate pressure or roster lane feeds `0x00408f70 -> 0x00409950` from raw `+0x12`. - The balancer then applies two age bands to company-owned trains: - very old trains are removed when the roster already exceeds target or upgraded when it still - needs capacity, while the mid-age band can trigger one narrower upgrade pass. - After that it fills any remaining deficit by either packaging multiplayer opcode `0x75` or - locally re-entering - `company_try_add_linked_transit_train_and_publish_news` `0x00409830`. The two visible news - helpers under it are bounded too: `0x00409830` emits RT3.lng `2896` for a newly added train, - while `company_publish_train_upgrade_news` `0x00409300` emits RT3.lng `2897` for the upgrade - branch. - The subtype-`4` sibling side is bounded now too. The nearby-site bucket family now has: - `placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0`, - `placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10`, and - `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, plus the two collection sweeps - `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480` and - `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0`. - Current evidence says those five buckets store `(peer site id, distance)` pairs for nearby - station-or-transit peers, grouped through the five-way classifier at `0x0040d350`. The older - stream-backed side is bounded too: `placed_structure_collection_load_dynamic_side_buffers_from_stream` - `0x00481430` walks the live placed-structure collection and re-enters - `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0`, which repopulates the - route-entry list, the three per-site byte arrays, the five proximity buckets, and the trailing - scratch band from the caller-supplied persistence stream. - The linked-site route-entry list itself is tighter now too. The refresh or teardown branch at - `0x0040e102` re-enters `placed_structure_remove_route_entry_key_and_compact` `0x0047d810`, which - removes one matching `u16` key from the six-byte list rooted at `[site+0x462]/[site+0x466]`, - compacts the surviving entries into a replacement buffer, and decrements the stored route-entry - count. - The broader linked-site mutable runtime strip is tighter now too. - `placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch` - `0x0047f320` is no longer just a teardown-side stub: it resolves an effective comparison mode - from the linked candidate class byte `[candidate+0x8c]` unless the caller overrides it, derives - one radius threshold from current world coordinates `[site+0x4a8/+0x4ac]`, frees the prior - sampled-cell buffer at `[site+0x34]`, always clears the route-link scratch pair - `[site+0x462]/[site+0x466]`, and then scans one bounded world-grid rectangle through - `[0x0062c120+0x2129]` with per-cell distance measured by `0x0051db80`. For accepted cells it - emits temporary twelve-byte `(grid x, grid y, sampled score)` rows through `0x0042b190`, - `0x0042c530`, and `0x0042c580`; when caller arg0 is zero it compacts one representative subset - of those temporary rows into the persistent list at `[site+0x34]/[site+0x38]`, while nonzero - arg0 callers use the same helper as a clear-and-scan companion without the final materialization - step. Current grounded callers are the linked-site refresh and teardown strip - `0x00480542/0x004805c2/0x00480727/0x004807e2`. - The proximity-bucket rebuild side above that list is tighter now too. - `placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells` - `0x0047fef0` first requires the current record to pass the narrower station-or-transit class gate - `0x0047fd50`, quantizes the current site position through `0x00455800/0x00455810`, walks the - surrounding live cell window through `[0x0062c120+0x2129]`, follows each cell's linked - placed-structure chain through word field `[cell+0x0d6]` plus next-id `[peer+0x2a2]`, keeps only - peers whose resolved candidate subtype byte `[candidate+0x32]` equals `4`, and appends the - surviving `(peer site id, distance)` pairs into the same five bucket arrays rooted at - `[site+0x590..+0x5a4]`. So the narrower one-peer append helper `0x0047fdb0` now has a real - broader owner rather than only collection sweeps. - The whole linked-site refresh owner is correspondingly clearer now too. - `placed_structure_refresh_linked_site_runtime_side_buffers_and_route_entry_anchor` `0x00480710` - first clears the current proximity buckets through `0x0047dcd0`, runs `0x0047f320(1,arg1)` - against the pre-update state, republishes the current site position into the world-grid owner map - through `0x0042bbf0/0x0042bbb0`, reruns `0x0047f320(0,-1)` to materialize the current - sampled-cell list, and then rebuilds the nearby-transit buckets through `0x0047fef0`. After that - it either reuses a still-valid route-entry anchor through - `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` and - `placed_structure_rebind_route_entry_anchor_to_site_id` `0x0048abc0`, or synthesizes a - replacement through `0x00493cf0` before rebinding it the same way; when an old anchor survives - but now points at a different owner, the helper clears the prior `[entry+0x222]` back to `-1`. - The world-cell owner and route-gather helpers beneath that strip are bounded now too. Word - `[cell+0xd4]` is the head of one placed-structure owner chain: `0x0042bbb0` prepends the current - site id into that chain by writing the previous head into `[site+0x3c]` through the tiny setter - `0x0047d6f0`, while `0x0042bbf0` removes one site id from the same chain by walking the linked - `[site+0x3c]` next pointers until it can splice the requested site out. The sampled-cell rebuild - also now has its lower route-gather leaf: `0x0042c530` walks one world cell's linked-site chain - from word `[cell+0xd6]` through next-id `[site+0x2a2]` and appends each visited site id plus the - caller payload into the six-byte route-entry list helper `0x0042b190`. That same compact list now - has its two local companions bounded too: `0x0042b230` removes one row by leading `u16` key, and - `0x0042b2d0` is the shared contains-key predicate over the same `[...+0xeb]/[...+0xef]` list. - The neighboring `[cell+0xd6]` linked-site chain is bounded now too. `0x0042c9a0` prepends one - site id into that chain by writing the previous head into `[site+0x2a2]` through the tiny setter - `0x0040cb00`, storing the new head back into `[cell+0xd6]`, and then re-entering the paired - rebuild helpers `0x0042c690` and `0x0042c8f0`. `0x0042c9f0` is the remove companion over the - same chain: it walks the linked `[site+0x2a2]` next pointers until it can splice the requested - site id out of the `[cell+0xd6]` head chain, then reruns the same two rebuild helpers. - The two remaining numeric leaves under this strip are bounded now too. `0x0042c580` accumulates - the directional word fan from `[cell+0xf3 + dir*2]` while stepping toward one caller-supplied - grid target through the fixed offset tables at `0x00624b28/0x00624b48`, and that is the floating - sampled-score source later stored by `0x0047f320`. `0x0042c960` is the shared rounded - issue-opinion-scaled word-lane query: it multiplies one local word lane `[this+index*2] << 4` - against the scenario-side scale returned by `0x00437d20(index)` and rounds the result through - `0x005a10d0`. - The broader company-side owner above these pieces is tighter now too. The periodic service pass - `company_service_periodic_city_connection_finance_and_linked_transit_lanes` `0x004019e0` now - reads as the current outer owner for this branch: it sequences the city-connection announcement - lanes, the linked-transit train-roster balancer, the acquisition-side sibling - `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`, the annual finance-policy helper - `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, and the shorter-versus- - longer linked-transit cache refresh tail through `0x004093d0` and `0x00407bd0`. That outer pass - also has one tighter temporary-state role now: it clears company bytes `0x0d17/0x0d18/0x0d56`, - mirrors `0x0d17` into scenario field `0x006cec78+0x4c74` only while the earlier route-building - side runs, and restores the original scenario value on exit. Current evidence now ties `0x0d17` - to the shared preferred-locomotive chooser `0x004078a0`: the override is only armed when that - helper picks one locomotive whose engine-type dword is `2`. That engine-type lane now best reads - as electric rather than an unnamed class slot, because the linked approval helper around - `0x0041d550` now reads as a real locomotive-era and engine-type policy gate, dispatching the same - `0/1/2` field across three scenario-opinion lanes while the local player-facing engine-type - family is explicitly `Steam / Diesel / Electric`. That same gate also now ties the later scenario - bytes `0x4c97..0x4c99` back to the editor-side `Locomotives` page rather than treating them as - anonymous availability flags: they are the live `All Steam Locos Avail.`, `All Diesel Locos - Avail.`, and `All Electric Locos Avail.` policy bytes behind `0x004cd680` / `0x004cf0d0`. The - current logic is also tighter than a plain override tier: a positive engine-family opinion result - can carry the gate by itself only while none of those three editor bytes is enabled; once any of - them is nonzero, `0x0041d550` instead requires one matching intersection between the record-local - family bytes and the enabled editor family bytes. The `WhaleL` carveout is narrower now too: - current data-file correlation ties that stem to the `Orca NX462` / `WhaleL_NE` locomotive family, - and it explicitly zeros that positive-opinion result before the later family-availability checks, - so it loses the shortcut rather than gaining a special approval path. The same - chooser now also has a bounded fallback below it, `locomotive_collection_select_best_era_matched_non_electric_fallback_id` - `0x00461cd0`, which explicitly skips engine-type `2` and chooses the lowest-penalty remaining - locomotive by era mismatch and approval gates. The route-search side is tighter too: this - electric-only override now clearly feeds the first path-sweep branch in `0x0049bd40`, forcing the - larger `1.8` initial quality multiplier instead of `1.4`, which is the same branch otherwise - chosen by explicit route-policy byte `4`. So the later annual finance helper is reading - same-cycle side-channel state from the earlier city-connection and linked-transit branches, not - unrelated long-lived finance fields. The inner - finance helper is not debt-only either. Current grounded outcomes include bankruptcy news - `2881`, the debt restructure family `2882..2886`, a later share-repurchase headline `2887`, and - the dividend-side adjustment branch. The main commit verbs under that helper are now grounded too: - `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, - `company_issue_bond_and_record_terms` `0x004275c0`, - `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and - `company_issue_public_shares_and_raise_capital` `0x00427450`. The threshold side is tighter now - too. The earliest creditor-pressure lane requires scenario mode `0x0c`, the bankruptcy toggle - `[0x006cec78+0x4a8f]` to be clear, at least `13` years since `[company+0x163]`, and at least - `4` years since founding year `[company+0x157]`; it then scans the last three years of the - derived net-profits and revenue lanes `0x2b` and `0x2c`, chooses one negative pressure ladder - `-600000 / -1100000 / -1600000 / - -2000000` from the current slot-`0x2c` bands around `120000 / 230000 / 340000`, requires the - broader support-adjusted share-price or public-support scalar at least `15` or `20` depending on - whether all three sampled years failed, checks the current fuel-cost lane in slot `0x09` against - `0.08` times that ladder, and requires the - three-year slot-`0x2b` total to clear one final `-60000` gate before it falls into the - bankruptcy commit and RT3.lng `2881` headline. - The middle debt-capital layer is split more clearly now too. With `[+0x4a8b]` clear, one annual - bond lane first simulates full repayment through `company_repay_bond_slot_and_compact_debt_table` - and then uses the post-repayment cash window with fixed `-250000` and `-30000` thresholds plus - the broader linked-transit train-service latch `[company+0x0d56]` to decide whether to append one - or more `500000` principal, `30`-year bonds. The repurchase lane is separate again: when the - city-connection announcement-side latch `[company+0x0d18]` is set, growth setting `2` does not - suppress it, and `[+0x4a87]` is clear, it starts from one `1000`-share batch, can replace its - default `1.0` factor with one linked-chairman personality scalar, scales that by `1.6` when - growth setting `1` is active, and then runs one `800000` stock-value gate plus one - support-adjusted-share-price-times-factor-times-`1000`-times-`1.2` affordability gate before the - repeated `1000`-share buyback commits behind RT3.lng `2887`. The ordering above this helper is - tighter now too: - `company_service_periodic_city_connection_finance_and_linked_transit_lanes` clears those latches - first, runs the city-connection and linked-transit branches, and only then enters the annual - finance helper, so these look like same-cycle reaction gates rather than long-lived balance-sheet - flags. - After the earlier debt or bankruptcy outcomes stay inactive, the later stock-capital lane also - has a tighter bounded shape now too: it only opens on build `1.03+`, only after the earlier - bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles - `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since - founding. It derives one issue batch from outstanding shares rounded down to `1000`-share lots - with floor `2000`, trims that batch until the broader support-adjusted share-price scalar times - batch no longer exceeds the `55000` gate, recomputes the pressured support-adjusted share-price - scalar and the paired `price/book` ratio, then tests the remaining gates in a fixed order: - share-price floor `22`, proceeds floor `55000`, current cash from `0x2329/0x0d` against the - chosen highest-coupon bond principal plus `5000`, one later stock-issue cooldown gate that - converts the current issue mixed-radix calendar tuple at `[company+0x16b/+0x16f]` through - `calendar_point_pack_tuple_to_absolute_counter` `0x0051d3c0` and compares the result against the - active world absolute calendar counter `[world+0x15]`, and only then the coupon-versus-price-to-book - approval ladder `0.07/1.3 -> 0.14/0.35`. The issue mutator preserves the previous tuple in - `[company+0x173/+0x177]` and refreshes the current tuple from `[world+0x0d/+0x11]` on the - derived-pricing lane. On success it issues two - same-sized tranches through repeated `company_issue_public_shares_and_raise_capital` calls and - publishes a separate equity-offering news family rooted at localized id `4053`, not the earlier - debt or buyback headline family. - The dividend side is bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be - clear, mode `0x0c`, at least `1` year since `[company+0x0d2d]`, and at least `2` years since - founding, then averages the last three years of the net-profits lane `0x2b`, folds in the - unassigned-share pool and the current `0x0d` band, applies the map-editor building-growth - setting `[0x006cec78+0x4c7c]`, treats growth setting `1` as a `0.66` scale-down and setting `2` - as a zeroing pass on the current dividend, quantizes surviving adjustments in tenths, and - finally clamps against - `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. - The linked-transit route-seeding side has one tighter sibling now too: - `company_reset_linked_transit_caches_and_reseed_empty_train_routes` `0x00401940`. It clears the - two company-side linked-transit cache timestamps, forces one immediate cache rebuild through - `0x00409720`, strips route lists from company-owned trains in modes `0x0a/0x13`, and then - re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770` only when a train's - route list has become empty. - On the wider chooser question, the current evidence is also tighter than before: every recovered - external owner of `0x00402cb0` is still in the city-connection family, so the two later direct - placement lanes currently read as city-connection fallback behavior rather than a broadly shared - world placement service. - It can still unwind through route-state cleanup without committing new placed structures, so the - exact lower helper semantics are not fully closed, but the broader chooser is no longer - anonymous and its main policy split is now visible. The two lower helpers directly under those - commit lanes are bounded now too: - `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840` is the shared - projected-footprint offset helper over candidate bytes `[candidate+0xb8]` and `[candidate+0xb9]`, - and `placed_structure_validate_projected_candidate_placement` `0x004197e0` is the shared - go-or-no-go validator that checks company, territory, world-tile, and footprint occupancy state - before either direct-placement commit is allowed to fire. Its strongest current subtype branch is - a station-attachment or upgrade-style lane keyed by `[candidate+0x32] == 1`, which now has the - concrete failure family `2901..2906`: blocked upgrade footprint, ground not flat enough, not - your track, insufficient track-laying capacity, cannot connect to existing track, and ground too - steep. That tightens the chooser materially without yet proving that the validator is - station-only for every caller. - The recurring outer owner is tighter now too: - `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580` walks every - fourth live placed structure from a scenario-time-derived offset and re-enters the per-site - rebuild with stack flag `0`, giving the route-style lane a concrete recurring maintenance sweep - under `simulation_service_periodic_boundary_work` rather than only a floating caller note. One - neighboring helper is now bounded on the message side too: - `shell_building_detail_handle_subject_value_row_band_action` `0x004ba270` switches over the - clicked row family `0x7d07..0x7d14`, treats subject bytes `+0x21/+0x22/+0x23` as one current - selection plus one bounded low/high pair, increments the family dirty latch at `0x006cfe0c` on - change, and republishes the refreshed value through the shared shell control helper on code - `0x66`. One neighboring helper is now bounded on the side-list path too: - `shell_building_detail_propagate_selected_subject_state_into_side_list` `0x004b9ec0` walks the - sibling list owner at `0x006cfe08`, copies the active subject state into each side-list record, - mirrors the current service or capability id at `+0x24`, and preserves the `0x40/0x20/0x10` - subflags from the active subject. That means the value-row actions and later selector rows now - read as propagating one shared building-detail state across the sibling list rather than only - mutating one isolated subject record. One neighboring helper is - now bounded separately too: `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20` - owns the mutually exclusive value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and - `0x7d13/0x7d14`, choosing among them from the same selected-subject flag byte and payload fields - at `+0x22/+0x23`, while the larger cargo-or-service row owner also gates the extra visual lanes - `0x7d6a`, `0x7d6b`, and `0x7d9d` from that same subflag family. The asset-string block is tighter - too: that branch family now explicitly uses `AnyCargo.imb`, `AnyFreight.imb`, `PassMail.imb`, - `Caboose.imb`, and `Dining.imb`, with the bit-`0x20` special lane already aligned to - `Caboose.imb` and the sibling bit-`0x10` special lane now aligned to `Dining.imb`. The larger - `0x7f58..0x801f` band is no longer just a styled row family either: - `shell_building_detail_present_flagged_service_capability_popup` `0x004b9fd0` is now grounded as - its explanatory popup callback. It resolves either one fixed express-side row from `0x00621e04` - or one active candidate or service id from `[subject+0x24]`, then formats one popup through the - shell message-box path. The neighboring refresh helper `shell_building_detail_refresh_flagged_service_capability_rows` - `0x004b9a20` is tighter now too: `0x7d07..0x7d1c` is not one anonymous block, but a real mask - partition over subject bits `0x20` and `0x10`, with one zero-mask pair, one bit-`0x20`-only - pair, one exclusive-or pair, and later one-bit and two-bit indicator rows. RT3.lng now closes - the fixed popup text family too: the single-line branch uses - `3922` `%1\nLoads available at %2: %3`, while the richer ordinary-candidate branch uses - `2981` `%1\nLoads available at %2: %3 Current Price: %4` and can append - `2982` `Price at next station, %1: %2 (%3%4)`. The selector band is narrower too: current - refresh-side evidence shows `0x7f58..0x801f` as one selected-ordinal highlight family over the - three fixed express rows plus the ordinary active-candidate rows, not as a generic unstructured - list. The neighboring `0x8020..0x8051` band is tighter too: it is primarily the matching - remove-entry family for the selected subject's live id list, with two special row indices - re-routing into the `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction - when the current `0x20/0x10` service-bit combination demands it. That means the exact captions - are no longer broadly open across the whole selector family: the fixed express-side rows, the - mask partitions, and the add/remove structure are grounded, and the remaining caption gap is - mostly the ordinary candidate rows further down the same band. The top-level toggles are - tighter now too: the paired - `0x7d02/0x7d03` controls are the real mode switch over subject bit `0x40`, choosing between the - bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`, while - the smaller `0x7d0f/0x7d10` controls flip the same special-service subflags later rendered as - `Caboose` and `Dining Car`. One adjacent control is tighter now too: the extracted - `BuildingDetail.win` resource contains the plain-English line `Set the initial cargo amount for - 'Disable Cargo Economy' scenarios.`, and the `0x7d01` plus `0x7d09/0x7d0a` message-side branch - can mirror the current subject or selection through - `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` into the auxiliary - owner queue at `[0x006cd8d8+0x8f48]`, with side-owner presence now explicitly grounded through - `shell_has_auxiliary_preview_owner` `0x00434050`. That queued request is tighter too: both - current callsites forward the same side-list mirror latch at `[0x006cfe08+0x0c]`, so the - auxiliary owner now clearly sees not just the staged subject but also whether the local - `BuildingDetail` side-list is in mirrored-subject mode. The same `0x7d01` lane also now has one - clear rejection note: localized id `3587` `This option is only available by following the - tutorial.` now sits behind the active tutorial flag at `0x006d3b4c` and the cached previous - tutorial expected-control id at `0x00622b38`, while the neighboring tutorial helper - `tutorial_advance_step_and_refresh_expected_control_ids` `0x00516be0` now grounds - `0x00622b34/0x00622b38/0x00622b3c` as the current and previous expected-control cache rather - than anonymous globals. The last field is tighter now too: `0x00622b3c` is currently best read - as the active tutorial step's alternate-accepted companion control id, because the generic shell - control path compares clicked control ids against it directly and suppresses the `3587` tutorial - rejection when they match. That does not fully close the player-facing caption bind for every - control, but it does bound the neighboring side-owner sync and tutorial-rejection lane instead - of leaving it as anonymous glue. - The extra pre-insert gate is narrower than it - first looked. It is now grounded as tutorial-only: - `tutorial_validate_train_route_station_indicator_step` `0x00516d00` checks the current tutorial - step from the shell tutorial descriptor table at `0x00622b48` before a live station-or-transit - site id can be committed into the staged route entry, and the currently accepted steps align with - localized prompts `3777` and `3778`, the two train-routing tutorial instructions that tell the - player to click the Milan and Turin station indicators. Outside that tutorial state family, the - route-entry insertion path is not gated there. The adjacent validator is tighter now too: - `train_route_list_validate_reachability_and_station_pair` `0x004b2c10` walks that same route list, - resolves placed-structure-backed entries through the live placed-structure and route-node - collections, uses the direct route-node payload branch for the remaining entry family, and fails - with `3089..3091` when the resulting route cannot be traversed or does not preserve a valid - terminal station pair. The post-validation follow-on is bounded too: - `train_current_route_context_uses_strict_reachability_mode` `0x004a9460` is now the small shared - gate above the stricter branch, keyed off the current linked route object's downstream class type, - and `train_set_route_operating_mode_and_scalar` `0x004ab980` now reads as the shared train mode - setter beneath route editing, with the local and multiplayer insertion paths choosing mode - `0x13` only when that stricter second validation succeeds and mode `0x0a` on the looser fallback - path. The first - deeper world-mode interaction branch is now better - bounded: `GameUppermost.win` hotspots, cursor drag, held Shift state, discrete shell view-step - commands, direct keyboard turn/pan/zoom bindings, the `TrackLay.win` and `StationPlace.win` - world-command surfaces, and a frame-owned hover or focus-target transition branch all feed the - same shell-controller-backed path. The remaining uncertainty has moved farther from basic - ownership: the hover-target branch clearly exists, and `0x07d6` now looks like the shared - main-world interaction surface rather than a generic detail button for one tool family only. One - more shell-side consumer is bounded now too: `0x004bc350` is a world-surface brush handler over - that same `0x07d6` control plus the adjacent mode family `0x0faa..0x0faf` and ordinal strip - `0x0fa0..0x0fa7`. That family is no longer just a generic unlabeled brush owner: the - detail-panel manager now grounds the sibling tool-window strip immediately above it as - `Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintTerrain.win`, `PaintRegion.win`, - `PaintSound.win`, and `PaintTerritory.win`, each with its own constructor, refresh pass, and - message owner beneath the same controller rooted at `0x006d0818`. Once its local drag latch is - active it dispatches the current mode dword at `[0x006d0818+0x8c]` into the companion-float - helpers `0x0044d4e0`, `0x0044d880`, and `0x0044da70`, or into the secondary-raster nibble path - `0x00448e20 -> 0x00419110`, so the remaining uncertainty has narrowed from ownership to the - exact one-to-one mode-button mapping inside that grounded tool-window strip. The - `PaintTerrain.win` side is tighter now too: constructor `0x004f7ce0` seeds shell singleton - `0x006d1304`, callback root `0x006d1334`, a constructor-time bulk-update latch at - `0x006d1330/0x006d1331`, and the broader terrain mode or scalar state from `0x00622748..0x00622788` - plus `0x006d1308..0x006d1324`; it then registers the callback strip `0x004f5960`, - `0x004f59f0`, `0x004f6070`, and `0x004f69e0` through `0x00540120`. The direct message owner - under that same family is no longer just a loose branch fan-out either: `0x004f6f50` owns - messages `2/0xca/0xcb`, keeps control `0x07d6` as the live world-surface drag latch, routes - explicit undo control `0x2775` into `0x004f5c30`, maps the selector and mode strips - `0x2711..0x2730`, `0x27d9..0x27df`, `0x283d..0x2843`, `0x28a1..0x28e6`, `0x2915..0x291e`, - `0x2964..0x2967`, and `0x29cd..` into the cached terrain lanes, and then fans the active drag - path into preview helpers `0x004f6930`, `0x004fb5e0`, `0x004fc280`, `0x004fc4d0`, and - `0x004fc630` depending on the current terrain mode. Inside that same family - `0x004f5a80/0x004f5c30` are now the bounded local undo snapshot pair, `0x004f5dd0` is the - tiny active-scalar-group selector, `0x004f6b50` owns the ten-entry mode strip rooted at - `0x28dd`, `0x004f6390` is the broad mode-panel repaint owner, `0x004f6250` is the - mode-dependent world-dispatch bridge, `0x004f6930` samples the current preview raster at - world coordinates, and `0x004fb5e0` is the heavier preview-raster rebuild and shell-surface - publish worker. The next local helpers under that same family are tighter now too: - `0x004f5ea0` and `0x004f5ec0` are just the two tiny special-mode predicates - `(mode 5, variant 2)` and `(mode 4, variant 2)`, `0x004f8770` is the weighted RGB sampler - over the current preview or undo-backed raster neighborhood, `0x004f89b0` is the local - byte-grid connected-component grower over the eight-neighbor tables `0x00624b28/0x00624b48`, - and `0x004f8bb0` is the main drag-path preview compositor that consumes the drag sample strip - `[this+0xf0/+0xf4/+0xf8]`, allocates temporary float or byte grids, and then rasterizes the - surviving preview rectangle through the current terrain descriptor tables at `0x005f3500`, - the weighted color sampler `0x004f8770`, the component grower `0x004f89b0`, and several live - world samplers before writing final RGBA pixels back into the preview surface. The late tail - under that same compositor is tighter too: the mode-`4`, variant-`2` path toggles - secondary-raster byte-2 bit `0x20` by comparing current and previous cells through - `0x00534f40`; the broader mode-`4/5` world-facing branch samples class set `2/4/5` through - `0x00534ec0`, re-enters `0x0044de30` and `0x0044df10`, latches pending world coordinates into - `[0x006d1304+0x78/+0x7c]`, and rewrites the low nibble plus the signed overlay-vector planes - through `0x00448df0`, `0x00448e20`, `0x00448ec0`, `0x00448ee0`, `0x00448e60`, and - `0x00448e90`. After the optional mode-`5` smoothing sweep through `0x004f8370`, the publish - tail either materializes one shell preview surface through `0x0051f090 -> 0x00534730` or, for - the mode-`4/5` world-facing variants, converts the surviving preview rectangle back into - world-space bounds and re-enters `0x0044e940`, `0x00452f20`, and `0x0044d410`. The companion - preview-rebuild owner `0x004fb5e0` is tighter on entry, too: `0x004f726c` is the early - rebuild path that first copies the live preview raster into `[this+0x118]` and snapshots undo - state through `0x004f5a80`, while `0x004f7ada` is the later drag-active path that first - allocates a temporary occupancy mask before rebuilding and then conditionally mirrors that - mask through `0x00450520` on the world-mode-`0x17` side path. So the remaining uncertainty - has narrowed again from family ownership to the exact meaning of a few per-mode scalar and - token lanes, not to whether `PaintTerrain.win` itself is still a mixed shell/world owner. +Related headings in the same file: +- `Camera View Command Strip` +- `CompanyDetail Addendum` +- `Key Dispatchers` +- `State Anchors` +- `Subsystem Handoffs` +- `Evidence` +- `Open Questions` +- `Shared Runtime-Object and Support Families` ### Post-load Generation, PaintTerrain, and Save/Load Restore - -The same brush strip is tighter now too: - `0x004bc210` stores the selected ordinal and refreshes one scalar caption - from table `0x00621e24`, `0x004bc260` exposes the cached world coordinate pair plus the - currently selected scalar, and `0x004bc290` restyles the ordinal strip `0x0fa1..0x0fa7` plus - the mapped mode strip `0x0faa..0x0faf` against the current mode dword `[0x006d0818+0x8c]`. The - next unresolved layer is narrower and more semantic: the setup side now has one grounded - owner, `world_run_post_load_generation_pipeline`, and its building-side branch is no longer just - one opaque block. We now have a region family, a region-border overlay rebuild, a region-owned - structure-demand and placement dispatcher, and a deeper per-region worker that computes category - demand, subtracts existing coverage, and tries candidate placements. The category map is tighter - too: category `0` falls back to `House`, category `2` is the year-gated weighted region-profile - family that also feeds the localized `Industry Weightings` stats panel, and category `3` now - reaches a separate pool-driven picker whose fallback label is `Commercial` but whose aligned - player-facing stats bucket is `City Support`. The normalized region band is tighter too: - `world_region_normalize_cached_structure_balance_scalars` `0x00422320` no longer just writes an - anonymous cached preview band at `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. Current growth-report - evidence now grounds `[region+0x2e2]` as the weighted-profit-margin scalar and `[region+0x2ee]` - as the annual-density-adjust scalar later formatted as a percent in `Stats - City/Region`, with - `[region+0x2e6/+0x2ea]` left as the intermediate normalized-delta and clamped companion slots - beneath that final adjust term. The per-region prepass feeding that normalization is tighter too: - `0x00420d40` clears `[region+0x306/+0x30a/+0x30e]`, walks the linked placed-structure chain from - `[region+0x383]`, accumulates two local placed-structure metrics through `0x0040ca70` and - `0x0040ca80`, and only for class-0 candidates also folds source field `[source+0x141]` through - `0x0040cec0` into the third accumulator before tailing into the later scalar refresh. That tail - helper `0x00420560` is tighter now too: on class-0 regions it revisits the same linked chain and - folds a class-mix contribution into `[region+0x312]`, with one source-derived term for candidate - class `0`, a separate branch keyed by `[candidate+0x78c]` and `[site+0x246]` for class `2`, one - fixed increment for class `3`, and no current contribution from class `1`. One neighboring - collection-side dispatcher is tighter now too: `0x00433b80` only runs when global mutation depth - `0x0062be40` is back at zero and then conditionally fans into the optional refresh hooks - `0x00481430`, `0x00413860`, `0x004b2a90`, and `0x004931e0`. The periodic boundary - side is narrower now too. `0x00422100`, reached only from - `simulation_service_periodic_boundary_work` `0x0040a590`, first requires several live world - state gates to stay clear, derives one year-sensitive random threshold from selected-year fields - plus world width, then scans the region collection for eligible class-0 regions whose transient - dwords `[region+0x276]` and `[region+0x302]` are both clear and which fail the city-connection - peer probe `0x00420030(1,1,0,0)`. When the gate passes it picks one random eligible region, - derives one small severity bucket from `[region+0x25e]`, stores the scaled amount back into - `[region+0x276]`, and appends one queued `0x20`-byte record through `0x004337c0` with literal - kind `7`, the chosen region id, that amount, the fixed payload `0x005c87a8`, and sentinel dwords - `-1/-1`. That append helper is now grounded directly too: `0x004337c0` allocates one zeroed - linked `0x20`-byte node, copies one string or payload seed into `[node+0x04..]`, stores the six - trailing caller dwords at `[node+0x08..+0x1c]`, and appends the finished node to the singly - linked list rooted at `[state+0x66a6]`. The gameplay label for that queued-record family is still - open, but the structural link from periodic region selection into the scenario-state queue is now - direct instead of speculative. One neighboring narrow counter is bounded too: `0x00422850` - counts class-0 regions that pass a second `0x00420030` peer-probe variant with fixed flags - `(1,1,1)` plus one caller-supplied trailing dword, and current callers are the query/script - dispatch at `0x0042f856` and the later region-stats formatter at - `0x004d2088`. The - remaining setup-side uncertainty has therefore narrowed - again: the region seed and border-overlay pair clearly complete before the `Setting up Players and - Companies...` banner is posted; `[0x006cec74+0x174]` now looks like the direct building-population - gate; `[0x006cec74+0x178]` now looks like the direct seeding-burst gate and selected-year-adjust - policy; and `[0x006cec74+0x68]` now aligns with editor-map mode because the same flag forces the - `.gmp` family in the shell file coordinators while suppressing the later building and seeding - branches and diverting the deeper region worker into alternate logic. One write side for that - `[shell+0x178]` policy is now grounded too: inside `shell_dispatch_ui_command` `0x00464410`, - command ids `0x9d26..0x9d28` store `command_id - 0x9d26` directly into `[0x006cec74+0x178]`, - yielding live values `0`, `1`, and `2`. That means the later restore branch is no longer gated - by an abstract hidden shell latch; at least one of its adjustment inputs is an explicit UI - launch policy and current evidence still does not show that value being recovered from saved - state. The `319` lane itself is no longer the - open structural gap; it now clearly owns chairman-profile slot seeding, profile-record - materialization, a shell editor surface over the same local record family, and a separate - live-company presentation path through the company-list window. The later interior order of that - same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` it - refreshes the auxiliary route-entry tracker collection `0x006cfcb4`, then runs - `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, - then a flagged world-grid cleanup sweep through the compact grid-flag query - `0x00448af0` plus the neighboring local chunk-cell write helper `0x00533fe0`, and only after - that the later route-entry post-pass at `0x00491c20`. The same `319` lane is tighter internally - now too: - before that later world and shell reactivation tail, `world_entry_transition_and_runtime_bringup` - runs one distinct post-bundle status and runtime refresh phase that posts progress ids `0x196` - and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes the - live event collection at `0x0062be18` through - `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the - scenario-side port-or-warehouse cargo recipe runtime tables through `0x00435630`, and then runs - the named-candidate availability preseed through `0x00437743`. One later subphase is tighter now - too: before the broad world-reactivation sweep it posts progress ids `0x32dc/0x3714/0x3715`, - reloads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged - runtime-profile bytes back into `0x006cec7c` while latch `[profile+0x97]` is set, mirrors the - grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world - bytes `[world+0x66de]` and `[world+0x66f2]`, and restores the selected year/profile lane through - a tighter two-stage calendar path than before. Current local disassembly now shows the raw saved - lane at `[profile+0x77]` first feeding helper `0x0051d3f0` with constant components - `(month=1, day=1, subphase=0, tick=0)`, which writes the resulting Jan-1-style tuple dwords - into `[world+0x05/+0x09]`. Only after that seed does the same lane enter one mode-sensitive - adjustment branch: non-editor startup mode can decrement the lane by `1` or `3` depending on - shell-state editor gate `[0x006cec74+0x68]`, shell-side selected-year-adjust policy - `[0x006cec74+0x178]`, and the saved special-condition slot `[0x006cec78+0x4af7]`, and only that - adjusted lane then feeds - helper `0x0051d390` before `world_set_selected_year_and_refresh_calendar_presentation_state` - `0x00409e80` stores the final absolute counter into `[world+0x15]` and refreshes - `[world+0x0d/+0x11]`. That means the restore no longer reads as a direct - `[profile+0x77] -> [world+0x15]` copy; the raw lane seeds the tuple immediately, but the final - absolute-counter restore still depends on live shell/startup context. That dependency is tighter - now too: current local evidence shows `[shell+0x178] == 1` decrementing the restored lane by - `1`, `[shell+0x178] == 2` subtracting `3`, and otherwise a nonzero - `[0x006cec78+0x4af7]` supplying the fallback `-1` branch. That field is no longer unresolved: - current local disassembly now shows `0x00436d10` bulk-zeroing the dword table rooted at - `[startup+0x4a7f]` through `rep stos`, which includes `+0x4af7`, while the editor-side special - conditions owner at `0x004cb2b0/0x004cb8e0` counts and commits that same 49-entry table from the - static rule descriptors at `0x005f3ab0`. The `.smp` save or restore family now grounds that live - band directly too: `world_runtime_serialize_smp_bundle` `0x00446240` writes `49` dwords from - `[world+0x4a7f..+0x4b3f]` plus one trailing scalar at `[world+0x4b43]`, and - `world_load_saved_runtime_state_bundle` `0x00446d40` restores the same fixed `0xc8`-byte band - symmetrically. Slot `30` in that table is localized pair `3722/3723` - `Disable Cargo Economy`, so `+0x4af7` now reads as the live copy of that saved scenario rule, - not a startup-runtime-only mystery latch. The neighboring fixed reads line up with the same rule - cluster too: `+0x4aef` is slot `28` `Completely Disable Money-Related Things`, `+0x4af3` is slot - `29` `Use Bio-Accelerator Cars`, `+0x4afb` is slot `31` `Use Wartime Cargos`, `+0x4aff` is slot - `32` `Disable Train Crashes`, `+0x4b03` is slot `33` `Disable Train Crashes AND Breakdowns`, and - `+0x4b07` is slot `34` `AI Ignore Territories At Startup`. So the remaining loader gap is - narrower than before: the restore still depends on live shell policy `[shell+0x178]`, but the - `+0x4af7` input itself is save-derived scenario rule data rather than something that requires - runtime tracing to discover. Its read-side family is no longer isolated to the selected-year - restore either: it also shapes the chunk size in - `simulation_run_chunked_fast_forward_burst` `0x00437b20` and appears in candidate/local-service - selection and station-detail-side scoring branches around `0x0047f910`, `0x00410d87`, and - `0x005069c6`, which now makes this whole slot cluster look like broader runtime consumers of - scenario special conditions rather than one startup-only mode enum. One file-side anchor is now - tighter too: the checked classic and 1.05 `gmp/gms/gmx` corpus does expose the same aligned - `0x0d64..0x0e2c` `50`-dword band as the grounded `.smp` runtime save or restore copy into - `[world+0x4a7f..+0x4b43]`, but most checked file families only populate a sparse subset of that - band. The first `36` dwords still behave like the older inferred fixed rule matrix with hidden - slot `35` fixed to sentinel value `1`, while the trailing `13` unlabeled rule lanes plus one - scalar vary much more selectively by file family. Current local corpus scans make that split - concrete: the grounded 1.05 scenario-save family (`p.gms`, `q.gms`) stably lights lanes - `35, 37, 39, 44, 45, 46, 47, 48`; the base 1.05 save family (`Autosave.gms`, `nom.gms`) only - shares lane `35` stably and otherwise varies sparsely through `42`, `45`, and `47`; the checked - grounded 1.05 maps, the lone 1.05 alt save, and the visible sandbox-family `.gmx` files keep - only the sentinel lane `35` nonzero. So the current loader boundary is narrower than before: the - `.smp` path still gives a grounded direct runtime-band restore, and checked `gmp/gms/gmx` files - now show a partially populated projection of that same aligned band rather than a wholly separate - fixed record family. The overlap against the later scalar window is now explicit too: trailing - band indices `36..49` are byte-identical with post-window offsets `0x00..0x34`, so every nonzero - lane in that prefix of the post-sentinel scalar window is also a nonzero lane in the aligned - runtime-rule band. That means the real “other fields” boundary inside the post-sentinel window - starts only at `0x0e2c`: `0x0df4..0x0e2c` is the aligned-band overlap prefix, while - `0x0e2c..0x0f30` is the later tail that still looks like save-side scalar state. Local corpus - scans now make that tail split more specific. The base 1.05 save family - (`Autosave.gms`, `nom.gms`) shares a stable tail subset at relative offsets - `0xb4`, `0xc0`, `0xe0`, `0xfc`, and `0x100`, with additional per-file lanes around them. The - 1.05 scenario-save family (`p.gms`, `q.gms`) has a much denser stable tail covering - `0x08`, `0x0c`, `0x10`, `0x14`, `0x20`, `0x24`, `0x28`, `0x30`, `0x34`, `0x3c`, `0x5c`, - `0x6c`, `0xa0`, `0xa8`, `0xbc`, `0xc0`, `0xc4`, `0xc8`, `0xcc`, `0xdc`, `0xe0`, `0xe4`, - `0xe8`, `0xf4`, `0xf8`, and `0xfc`; those values still differ per save, but the occupancy is - stable. The lone 1.05 alt save (`g.gms`) only lights `0x20`, `0x34`, `0xf0`, and `0xf4`. - Grounded map families and classic saves keep the tail zeroed, while the only current map-side - outlier remains `Tutorial_2.gmp` under the broad unknown map-family bucket. The immediately - following fixed file window at `0x0df4..0x0f30` is now bounded separately as well: checked maps - and classic saves leave that whole post-sentinel band zeroed, - while checked 1.05 saves carry sparse nonzero dwords there, many of which decode cleanly as - normal little-endian `f32` values. That makes the adjacent band look like a 1.05 save-only - runtime band rather than scenario-static payload, even though its semantics are still open. - One numeric alignment inside that band is now exact too: the tail start `0x0e2c` is the same - relative distance from the aligned runtime-rule base `0x0d64` as live object offset `+0x4b47` - is from grounded world-rule base `[world+0x4a7f]`, so the bounded tail window - `0x0e2c..0x0f30` is offset-aligned with live bytes `[world+0x4b47..+0x4c4b]`. The first - grounded live field at that boundary is no longer anonymous. `0x004367c0` sets one outcome mode - in `[world+0x4a73]`, zeros `[world+0x4d]`, snapshots the selected-year lane to `[world+0x4c88]`, - and then copies localized id `2923` `You lose.` or `2924` `You win, cheater...` into - `[world+0x4b47]`; `0x00472dd0` formats localized id `3918` `%1 has won the game!` with one live - profile name and writes that string into the same destination; and one compact runtime-effect - branch inside `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20` resets - the same destination to the fixed placeholder token at `0x005c87a8`. That gives a grounded live - interpretation for the start of the tail: `[world+0x4b47]` is the start of a victory or outcome - status-text buffer, not a float lane. The same evidence also gives a useful caution: those live - helpers copy up to `0x12c` bytes into `[world+0x4b47..+0x4c73]`, so the current bounded file-tail - window `0x0e2c..0x0f30` cuts through the first `0x104` bytes of a grounded text field rather - than ending on a clean live-field boundary. One small continuation probe now tightens that edge: - the remaining file window `0x0f30..0x0f58` is exactly the last `0x28` bytes needed to reach the - clean live-field boundary at `[world+0x4c73]`, and checked 1.05 saves still carry sparse nonzero - bytes in that continuation window rather than a trailing text-looking suffix. Checked 1.05 save - bytes in the aligned region therefore still do not resemble preserved text; they stay mostly zero - at the beginning and many nonzero lanes decode as ordinary `f32` values. So the safest current - note is: the tail is offset-aligned with the live object beyond `+0x4b43`, but it is not yet a - validated byte-for-byte mirror of the live `[world+0x4b47]` status-text buffer, and the current - nonzero save-side content continues right up to the first clean field edge at `0x0f58`. The next - exact grounded fields after that edge are byte lanes, not restored dwords: `0x0f59` maps to - `[world+0x4c74]` `Auto-Show Grade During Track Lay`, `0x0f5d` maps to `[world+0x4c78]` - `Starting Building Density Level`, `0x0f61` maps to `[world+0x4c7c]` `Building Density Growth`, - `0x0f65` maps to grounded dword `[world+0x4c80]` `leftover simulation time accumulator`, and - `0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The first later grounded - dword after that is `[world+0x4c8c]` at `0x0f71`. That means the simple 4-byte file-lane model - stops matching grounded live field boundaries immediately after the text-buffer edge: the post- - `0x0f58` file bytes are still offset-correlated to live state, but they are no longer naturally - dword-aligned with the next grounded object fields. The new byte-neighborhood probe makes the - mismatch more concrete. In checked 1.05 scenario saves, the exact grounded byte offsets - themselves do not look like clean selector values: `p.gms` carries `0x33` at `0x0f5d` and `0x8c` - at `0x0f6d`, while `q.gms` carries `0xcc` and `0xba` at those same offsets. The only clean - float-looking starts in that neighborhood instead appear one byte earlier, at `0x0f5c` and - `0x0f6c`: `p.gms` decodes those as roughly `7.6` and `6.0172`, while `q.gms` decodes them as - roughly `23.6` and `44.6824`. That tightens the current read further: the checked save bytes - remain offset-correlated to the live `[world+0x4c74..+0x4c8c]` neighborhood, but they are still - not a validated byte-for-byte mirror of the exact live field layout. Local - A second byte-oriented neighborhood immediately after that now has the same kind of split rather - than a clean restored-field mirror. The earlier grounded anchors in that band all stay zero in - the checked 1.05 saves: exact file offset `0x0f87` maps to selected-year bucket companion scalar - `[world+0x4ca2]`, while `0x0f93` and `0x0f97` map to the two startup-dispatch reset-owned bands - `[world+0x4cae]` and `[world+0x4cb2]`, and the local corpus leaves all three exact dword starts - zeroed. The same is true for the later exact byte-owned policy lanes: file offsets `0x0f78`, - `0x0f7c`, `0x0f7d`, and `0x0f7e` map cleanly to grounded byte fields `[world+0x4c93]` and - `[world+0x4c97..+0x4c99]`: the linked-site removal follow-on gate plus the three editor - locomotives-page policy bytes `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All - Electric Locos Avail.`. In the checked 1.05 save corpus those four exact byte lanes all stay - `0`, which is at least structurally clean. The later grounded dword fields in the same - neighborhood are less direct again. Exact file offset `0x0f9f` maps to `[world+0x4cba]` (the - station-list selected-station mirror) and exact offset `0x0fa3` maps to cached - available-locomotive rating `[world+0x4cbe]`, but the checked save bytes at those exact dword - starts do not look like clean preserved ids or floats. The only stable float-looking starts sit - three bytes earlier, at `0x0f9c` and `0x0fa0`: `p.gms` yields roughly `96.8754` and `186.4795`, - `q.gms` yields `329.9467` and the same `0x0fa0`-side candidate shape, `g.gms` yields `7.0` and - `95.8507`, and `Autosave.gms` only shows the later `0x0fa0` candidate at about `68.2629`. So - this later band now has the same conservative read as the post-text one: the save bytes are - still offset-correlated to grounded live fields, but the exact live byte or dword layout is not - yet validated as a direct on-disk mirror. - One more structural cut is now grounded beyond that neighborhood. The aligned scalar plateau - `0x0fa7..0x0fe7` ends exactly at the later recipe-book root `[world+0x0fe7]` already grounded in - the port-or-warehouse cargo editor and runtime rebuild path. We still do not have live semantic - names for the plateau itself, but its aligned dword run now splits cleanly by save family. The - base 1.05 saves (`Autosave.gms`, `nom.gms`) carry one stable signature with - `0x0faf = 0x8000003f`, `0x0fb3 = 0x75c28f3f`, repeated `0x75c28f3c` lanes through `0x0fbf`, a - sign-flipped lane `0x0fc3 = 0xa3d70a3c`, one tiny marker at `0x0fc7 = 0x0000003b`, and - `0x0fcb = 0x00300000`. The scenario-save family (`p.gms`, `q.gms`) carries a different stable - plateau over the same offsets, beginning `0x0faf = 0x4000003f`, `0x0fb3 = 0xe560423f`, then - `0x03126f3b`, `0x1374bc3c`, and paired `0x23d70a3c` lanes at `0x0fbf/0x0fc3`, with - `0x0fc7 = 0x0000003c`. The alt-save family (`g.gms`) follows the base signature through - `0x0fc7`, then diverges sharply into the same `0xcdcdcd..` fill pattern already seen in its - earlier header lanes. So the current best fit for `0x0fa7..0x0fe7` is a family-shaped aligned - scalar plateau that belongs to save-side runtime state and terminates immediately before the - grounded recipe-book block, not one more directly named live-field mirror. One conservative - loader-side summary probe now starts exactly at that recipe root instead of extending the plateau - model further. The fixed recipe-book block spans twelve books from `0x0fe7` with stride `0x4e1`, - and the checked map/save pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> - p.gms`, and `Spanish Mainline.gmp -> g.gms` preserve that rooted block byte-for-byte in the - sampled local corpus. The current probe therefore treats it as preserved scenario payload rather - than save-only runtime drift and only reports per-book signatures: a coarse head kind over the - pre-line region, the raw `book+0x3ed` annual-production dword, and one raw summary for each of - the five fixed `0x30`-byte cargo lines beginning at `book+0x3f1`: coarse line kind, raw mode - dword, raw annual-amount dword, and the raw supplied/demanded cargo-token dwords at `+0x08` and - `+0x1c`. That is enough to separate zero, `0xcd`-filled, and mixed books or lines without - overstating line semantics beyond the grounded editor/runtime ownership already documented below. - Local - corpus clustering now makes the remaining split more specific. The base 1.05 save family - (`Autosave.gms`, `nom.gms`) shares a narrow tail-heavy subset with stable relative offsets - `0xec`, `0xf8`, `0x118`, `0x134`, and `0x138`, while still varying in value across files. The - 1.05 scenario-save family (`p.gms`, `q.gms`) shares a much broader stable set spanning almost the - whole window from `0x04` through `0x134`, again with per-file scalar differences but consistent - occupancy. Pairwise compare runs tighten that read further: `Autosave.gms` vs `nom.gms` does not - preserve one common numeric tail signature even at the shared base-save offsets, and `p.gms` vs - `q.gms` keeps the broad scenario-save occupancy pattern but still changes every shared value, with - `q.gms` additionally lighting two extra lanes at `0x78` and `0x84`. So the current best fit is - “family-shaped live scalar state” rather than family-default constants. The lone 1.05 alt-save - sample (`g.gms`) only lights up four lanes at `0x58`, `0x6c`, - `0x128`, and `0x12c`. The checked 1.05 maps and classic saves stay zero in that same bounded - window, which strengthens the current read that this is runtime-save scalar state rather than - generic map payload. One older unknown map-family outlier in the local corpus does still carry a - populated window: `Tutorial_2.gmp` under the classic install tree. So the safest current note is - “zero for grounded map families and classic save families, nonzero for observed 1.05 save - families, with one older unknown-map exception.” Static consumer grounding is still sparse for - that tail: direct object-offset hits currently only name the trailing scalar `[world+0x4b43]` - through the editor panel and `.smp` save or restore family, while local opcode searches do not - yet surface equally direct reads for the intervening `+0x4b0b..+0x4b3f` tail lanes. So the - save-file family clustering is now strong, but those later tail scalars remain structurally - bounded rather than semantically named. The - same branch is no longer world-entry-only either: current local - disassembly now shows the identical lane-adjust and - `0x51d3f0 -> 0x51d390 -> 0x409e80` sequence in the post-fast-forward selected-year tail at - `0x004370e0`, which lines up with the existing post-fast-forward callers already mapped under - `0x00433bd0`, `0x00435603`, `0x0041e970`, and `0x00436af0`. That restore now - also has some neighboring slot semantics bounded well enough to carry in the loader notes. Slot - `31` `[0x006cec78+0x4afb]` is no longer best read as an unnamed runtime cargo-economy latch: - local disassembly now ties it directly to the saved special-condition table entry `Use Wartime - Cargos`, and the strongest current runtime owner is - `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Inside that - candidate-collection sweep the branch at `0x0041ed37` only activates when slot `31` is set and - then treats the string family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and - `Diesel` as one special cargo set before writing the live candidate filter byte `[entry+0x56]`. - That makes the old read-side note around `0x00412560` tighter too: the neighboring descriptor - gate is now best understood as using the live copy of the `Use Wartime Cargos` scenario rule, - not an anonymous cargo-economy mode byte. Slot `34` `[0x006cec78+0x4b07]` is similarly bounded - on the runtime side: the wrapper at `0x004013f0`, which sits immediately above the broader - company-start or city-connection chooser `0x00404ce0`, snapshots region dword `[entry+0x2d]` - across all `0x18` live region records in `0x006cfc9c`, zeros that field while the chooser runs, - and then restores the original values on exit. That is a strong current fit for the editor rule - `AI Ignore Territories At Startup`, even though the exact meaning of region field `+0x2d` - remains open. Slot `29` `[0x006cec78+0x4af3]` is less semantically tidy but still worth carrying - as a bounded consumer family: the branch at `0x0041d286` activates one later placed-structure or - building-side scoring path only when that slot is nonzero and the linked candidate or era record - at `[entry+0x41]` equals `5`, while two already-grounded world helpers - `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` and - `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670` also gate on the same - slot. So the identity of slot `29` as saved rule data is grounded, but the downstream runtime - semantics are still mixed enough that the loader should preserve the raw value without trying to - rename its whole consumer family yet. The neighboring train-safety slots are now bounded enough - to keep as a cautious runtime split too. Slot `33` `[0x006cec78+0x4b03]` - `Disable Train Crashes AND Breakdowns` is the coarse gate in the currently recovered train-side - deterioration family around `0x004af8a0`: the very first branch at `0x004af8ab` jumps straight - to the function tail when the slot is set, bypassing the year-scaled threshold build, the later - random or threshold comparison, and the two follow-on state transitions at `0x004ad7a0` and - `0x004ada00`. Slot `32` `[0x006cec78+0x4aff]` `Disable Train Crashes` is narrower in the same - family: after the threshold path has already run, the branch at `0x004af9c1` uses slot `32` to - suppress only the lower failure-transition path and force the milder follow-on at `0x004ada00`. - That same slot-`33` read also appears in the smaller train-side scalar query at `0x004ac460`, - where setting it returns one fixed float immediately before the ordinary route-object-dependent - calculation runs. So the current best loader-facing read is: slot `33` is the broad train - deterioration bypass, slot `32` is the narrower crash-only branch inside that same family, but - the exact player-facing names of the two unnamed train helpers still need one more naming pass. - That restore now - also has one concrete file-side correlation in the classic `.gms` family: local save inspection - now consistently finds `0x32dc` at `0x76e8`, `0x3714` at `0x76ec`, and `0x3715` at `0x77f8` in - `Autosave.gms`, `kk.gms`, and `hh.gms`, leaving one exact `0x108`-byte span from `0x76f0` to - `0x77f8` between `0x3714` and `0x3715`. That span already carries staged-profile-looking payload - text such as `British Isles.gmp`, so the current static-file evidence now supports the atlas-side - `0x108` packed-profile note for the classic save family even though the exact field layout inside - that block is still unresolved. The same classic corpus is tighter now too: inside that - `0x108` span the map-path C string begins at relative offset `0x13`, the display-name C string - begins at `0x46`, the block is otherwise almost entirely zeroed, and the three local samples are - byte-identical except for the leading dword at `+0x00` (`3` in `Autosave.gms` and `hh.gms`, - `5` in `kk.gms`). The currently atlas-tracked bytes `[profile+0x77]`, `[profile+0x82]`, - `[profile+0x97]`, and `[profile+0xc5]` are all `0` in that classic sample set, so the current - file-side evidence grounds the block boundaries and the embedded strings but does not yet show - live examples of those branch-driving latches being set. One 1.05-era file-side analogue is now - visible too, but only as an inference from repeated save structure rather than a disassembly-side - field map: local `.gms` files in `rt3_105/Saved Games` carry one compact string-bearing block at - `0x73c0` with the same broad shape as the classic profile slab, including a leading dword at - `+0x00`, one map-path string at `+0x10`, one display-name string at `+0x43`, and a small - nonzero tail around `+0x76..+0x88`. In that 1.05 corpus the analogue bytes at relative `+0x77` - and `+0x82` are now nonzero in every checked sample (`Autosave.gms`/`nom.gms` show `0x07` and - `0x4d`; `p.gms`/`q.gms` show `0x07` and `0x90`; `g.gms` shows `0x07` and `0xa3`), while - relative `+0x97` and `+0xc5` remain `0`. The compared 1.05 save set is tighter now too: - `Autosave.gms` and `nom.gms` cluster together on `Alternate USA.gmp` with `+0x82 = 0x4d`, - `g.gms` carries `Spanish Mainline.gmp` with `+0x82 = 0xa3`, and `p.gms`/`q.gms` cluster on - `Southern Pacific.gmp` with `+0x82 = 0x90`; across all five files the same inferred analogue - lane at `+0x77` stays fixed at `0x07`, while the same map- or scenario-sensitive tail word at - `+0x80` tracks those `0x4d/0xa3/0x90` byte lanes (`0x364d0000`, `0x29a30000`, `0x1b900000`). - The leading dword at `+0x00` also splits the same corpus, with `Autosave.gms` alone at `3` and - the other four checked 1.05 saves at `5`. That is enough to say the wider save corpus does - contain nonzero candidates for two of the atlas-tracked profile lanes, and that one of them - varies coherently with the loaded scenario family, but not yet enough to claim that the 1.05 - block reuses the exact same semantic field assignments as the classic one. The loader-side - family split is tighter now too: `p.gms` and `q.gms` no longer live under a generic fallback; - their save headers now classify as one explicit `rt3-105-scenario-save` branch with preamble - words `0x00040001/0x00018000/0x00000746` and the early secondary window - `0x00130000/0x86a00100/0x21000001/0xa0000100`, while `g.gms` now classifies as a second - explicit `rt3-105-alt-save` branch with the different preamble lane - `0x0001c001/.../0x00000754` and early window - `0x00010000/0x49f00100/0x00000002/0xa0000000`. That branch now carries the same bootstrap, - anchor-cycle, named 1.05 trailer, and narrow profile-block extraction path as the other 1.05 - saves. The bridge just below that trailer is now explicit too: the common 1.05 save branch - carries selector/descriptor `0x7110 -> 0x7801` in `Autosave.gms` and `0x7110 -> 0x7401` in - `nom.gms`, and both still reach the same first later candidate at - `span_target + 0x189c`, well before the packed profile at `span_target + 0x3d48`; the - `rt3-105-alt-save` branch instead carries `0x54cd -> 0x5901` and its first later candidate - lands at `packed_profile + 0x104`, essentially on the profile tail; the scenario-save branch - still diverges locally with `0x0001 -> 0x0186` and never enters that later `0x32c8`-spanned - bridge at all. The common-branch bridge payload is narrower now too: both checked base saves - expose the same 0x20-byte primary block at `0x4f14` followed by the same denser secondary block - at `0x671c`, `0x1808` bytes later, and that secondary block now appears to run intact up to the - packed-profile start at `0x73c0` for a total observed span of `0xca4` bytes. The trailing slice - of that secondary block is now typed one level further: a small header at `secondary+0x354` - carries the observed stride `0x22`, capacity `0x44`, and count `0x43`, followed by a fixed-width - 67-entry name table starting at `secondary+0x3b5` and running through names like - `AluminumMill`, `AutoPlant`, `Bakery`, `Port00..11`, and `Warehouse00..11`, with a short footer - (`dc3200001437000000`) after the last entry. The trailing per-entry word is now surfaced too: - most entries carry `0x00000001`, while the currently observed zero-trailer subset is - `Nuclear Power Plant`, `Recycling Plant`, and `Uranium Mine`. That footer is tighter now too: - it parses directly as `0x32dc`, `0x3714`, and one trailing zero byte, so the shared - map/save catalog currently ends on the same two grounded late-rehydrate progress ids that the - classic staged-profile band already exposed. The strongest structural read is therefore that the - entire `0x6a70..0x73c0` catalog region is shared verbatim between `Alternate USA.gmp` and the - derived `Autosave.gms`, not rebuilt independently during save. Combined with the earlier - grounded record-layout work under `0x00437743`, `0x00434ea0`, and `0x00434f20`, the current - safest semantic read is that this shared catalog is the bundled source form of the scenario-side - named candidate-availability table later mirrored into `[state+0x66b2]`, with each entry's - trailing dword now reading as the same availability override bit later copied into - `[candidate+0x7ac]`. The loader-side coverage is tighter now too: the same table parser now - attaches both to the common-save bridge payload and directly to the fixed source range in - `.gmp` files and the non-common `rt3-105-scenario-save` / `rt3-105-alt-save` branches. That - makes the scenario variation explicit instead of anecdotal. `Alternate USA` keeps only three - zero-availability names in this table (`Nuclear Power Plant`, `Recycling Plant`, `Uranium - Mine`), `Southern Pacific` widens the zero set to twelve (`AutoPlant`, `Chemical Plant`, - `Electric Plant`, `Farm Rubber`, `FarmRice`, `FarmSugar`, `Nuclear Power Plant`, `Plastics - Factory`, `Recycling Plant`, `Tire Factory`, `Toy Factory`, `Uranium Mine`), and `Spanish - Mainline` widens it again to forty-two, including `Bauxite Mine`, `Logging Camp`, `Oil Well`, - `Port00`, and the `Warehouse00..11` run while also flipping `Recycling Plant` back to - available. The header lanes just ahead of the table vary coherently with those scenario - branches too: `Alternate USA` carries `header_word_0 = 0x10000000`, `Southern Pacific` - carries `0x00000000`, and `Spanish Mainline` carries `0xcdcdcdcd`, while the structural - fields from `header_word_2` onward remain stable (`0x332e`, `0x1`, `0x22`, `0x44`, `0x43`) - and the 9-byte footer still decodes as `0x32dc`, `0x3714`, `0x00` in all three checked maps. - A wider corpus scan over the visible `.gmp`/`.gms` files makes those two anonymous header - lanes less mysterious too: the parser currently sees only three stable - `(header_word_0, header_word_1)` pairs across 79 files with this table shape, namely - `(0x00000000, 0x00000000)`, `(0x10000000, 0x00009000)`, and - `(0xcdcdcdcd, 0xcdcdcdcd)`. The zero-availability count varies widely underneath the first and - third pairs (`0..56` under the zero pair, `14..67` under the `0xcdcdcdcd` pair), so those two - lanes no longer look like counts or direct availability payload; the safest current read is - that they are coarse scenario-family or source-template markers above the stable - `0x332e/0x22/0x44/0x43` table header, with `0xcdcdcdcd` still plausibly acting as one reused - filler or sentinel lane rather than a meaningful numeric threshold. Current exported - disassembly notes still do not ground one direct loader-side or editor-side consumer of - `header_word_0` or `header_word_1` themselves, so that family-marker read remains an - inference from corpus structure rather than a named field assignment. - The new loader-side compare command makes the save-copy claim sharper too: for the checked - pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and - `Spanish Mainline.gmp -> g.gms`, the parsed candidate-availability table contents now match - exactly entry-for-entry, with the only reported differences being the outer container family - (`map` vs `save`) and source-kind path (`map-fixed-catalog-range` vs the save-side branch). - has the explicit companion `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, which - rebuilds the dependent selected-year bucket floats after the packed year changes; and then - rehydrates the named locomotive availability collection at `[world+0x66b6]` through - `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`. - That locomotive-side restore is tighter now too: its tail explicitly re-enters - `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`, which rebuilds one - cached available-locomotive rating at `[state+0x4cbe]` from the current year plus the strongest - surviving available locomotive-side rating scalar `[loco+0x20]`, and the tiny query sibling - `0x00434080` is now bounded as the shell-side clamped read helper over that same cached field, - with the grounded shell-side reader later bucketing that value against `40/50/70/85/100`. The - same rehydrate band also refreshes the live structure-candidate filter and year-visible counts - through `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, - rebuilding the paired per-slot bands at `[candidates+0x246]` and `[candidates+0x16e]` and the - aggregate counts at `[candidates+0x31a]` and `[candidates+0x242]`; the same late checkpoint also - re-enters `placed_structure_collection_seed_candidate_subtype2_runtime_latch` `0x00434d40`, - which seeds runtime dword `[candidate+0x7b0]` across subtype-`2` candidate records before the - later world-wide reactivation sweep. That checkpoint also now has an explicit shell-facing scalar - publisher: `world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides` - `0x004354a0` writes one clamped `0..255` value into the current shell presentation object, - sourcing it either from the shell selector override pairs or from the scenario-side year-threshold - band rooted at `[state+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`; and just ahead of the later - scenario-side recipe rebuild, the same band also re-enters - `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, which only falls into its - heavier rebuild body while `[state+0x3a] < 2` and otherwise leaves the derived year-threshold - companion slots `[state+0x51/+0x55/+0x59/+0x5d/+0x61]` unchanged. The neighboring late status - checkpoints around progress ids `0x196` and `0x197` also share one explicit stage gate now: - `world_query_global_stage_counter_reached_late_reactivation_threshold` `0x00444dc5` compares the - global counter `0x00620e94` against threshold `0x9901`, and the two current callers use a - negative result to clear `[world+0x39]` before the broader world and shell reactivation sweep. - The later reactivation tail is tighter now too: it includes the region-center world-grid flag - reseed pass - `0x0044c4b0`, which clears bit `0x10` across the live grid and then marks one representative - center cell for each class-`0` region through `0x00455f60`; its immediate sibling `0x0044c450` - then reruns `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` across every - live grid cell. The small secondary-raster premark helper `0x0044c570` is bounded now too: it - only admits cells whose current raster byte has no bits in mask `0x3e` and whose parallel class - query `0x00534e10` is false, then rewrites that masked class field to `0x02` and widens the same - cached bounds-and-count band `[world+0x21c6..+0x21d6]`. The next helper `0x0044ce60` scans the secondary raster at `[world+0x2135]` - for cells with any bits in mask `0x3e`, caching min/max bounds plus a marked-cell count in - `[world+0x21c6..+0x21d6]`; the larger sibling `0x0044c670` then consumes those cached bounds to - normalize the same raster and rebuild one dependent overlay/cache surface before the later - route-style rebuild, shell-window, and briefing branches. That overlay side is tighter now too: - after `0x0044c670` resolves scaled surface dimensions through `0x00534c50`, it walks one local - `3 x 32` sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only - secondary-raster classes `4..0x0d`, folds several interpolated `0x0051db80` samples into one - strongest local score, writes packed overlay pixels into the staged surface buffer, and only then - publishes that staged overlay through `0x00534af0`. The lower helper layer under that overlay - pass is tighter now too: `0x00534e10` is the reusable secondary-raster class-set - predicate for classes `1/3/4/5`, `0x00534e50` is the smaller neighboring class-subset predicate - for `1/4`, `0x00534ec0` covers `2/4/5`, `0x00534f00` covers `3/5`, `0x00534e90` is the - marked-bit query over the same 3-byte cell family, and the nearby local counter `0x0044bdb0` - is now bounded as the 8-neighbor count companion for that same `2/4/5` subset, walking the - shared `0x00624b28/0x00624b48` offset tables and re-entering `0x00534ec0` on each bounded - neighbor cell. The first caller cluster around `0x0044bf9d..0x0044c37b` therefore reads as a - secondary-raster neighborhood service band rather than a generic map scan. - `0x00533e70` and `0x00534160` are the coarser siblings over the overlay table at `[world+0x1685]`: - the first clears coarse chunk objects across one clamped rectangle, while the second ensures one - chunk object and seeds local marks through its deeper stamp helper. One level up, the neighboring - rect owner `0x005374d0` now reads as the shared secondary-overlay refresh pass: it reruns the - local sample and unsigned-word reducers `0x00536230/0x00536420`, rebuilds the signed vector byte - planes through `0x00536710`, and then rebuilds the multiscale support surfaces through - `0x00533890`, whose inner reducers now explicitly target the packed sample-triplet buffer plus - the float and unsigned-word support planes rooted at the five-entry per-scale families - `[world+0x15f1..+0x1601]`, `[world+0x1605..+0x1615]`, and `[world+0x1619..+0x1629]`. The setup - side of that same family is tighter now too: - `0x005375c0` is the shared ensure-and-seed owner that allocates the sample, sidecar, mask, - raster, vector, and coarse-cell tables together; crucially, it seeds `[world+0x1655]` with byte - `0x02` and `[world+0x1659]` with byte `0x01`, which closes the default-fill split. The local - component-walk owner under the same neighborhood band is tighter now too: `0x0044c200` - allocates a temporary `width*height` visit bitmap at `0x0062c128`, seeds one class-`2/4/5` - starting cell, derives an initial direction index through the remap table `0x005ee5d4`, and then - fans into the deeper recursive walker `0x0044be20`. That deeper walker widens dirty bounds - `[world+0x21ad..+0x21b9]`, stamps one companion-word orientation lane through `0x005ee5cc`, - reuses `0x00534ec0` plus `0x0044bdb0` to filter admissible neighbors, tracks temporary - visitation in `0x0062c128`, and then applies the local byte-1 edge-bit `0x04/0x08` updates - before returning. So the `0x0044bf9d..0x0044c422` cluster now reads as a real connected-component - walk plus edge-flag refresh layer over the secondary raster rather than only a loose group of - local neighbor counters. The adjacent mutation strip is tighter now too: `0x0044dcf0` refreshes - companion-word bit `0x200` in one local rectangle by checking whether any neighbor belongs to - class set `2/4/5`, while `0x0044df10` clears three local sidecar byte planes, demotes class `4` - to `1` and class `5` to `3`, and then reruns that marked-bit refresh over the surrounding - `+/-1` window. One level up, `0x0044e500` is the rect-wide owner that recomputes byte-1 edge - bits `0x04/0x08` for class-`2/4/5` cells, dispatches `0x0044df10` on incompatible local - patterns, and finally consumes the pending global seed pair at `[0x006d1304+0x78/+0x7c]` - through `0x0044c200`. The shell-side owner of that pending pair is tighter now too: - `[0x006d1304]` is the live `PaintTerrain.win` shell singleton while the callback-heavy side also - keeps a second rooted pointer at `0x006d1334`; the tool constructor snapshots the broader - terrain-paint state into both families while the world-side raster owner still only consumes - `[0x006d1304+0x78/+0x7c]` as one pending component-seed pair. Its radial sibling `0x0044e7d0` - is narrower: - after validating world-space - coordinates through `0x00414bd0`, it stamps class-`2` marks into the secondary raster by walking - one clamped bounding box and admitting cells only when the radial falloff helper `0x0051db80` - stays positive before re-entering `0x0044c570`. The two small support predicates under that same - strip are now explicit too: `0x00414bd0` is the float grid-bounds gate, and `0x00449df0` is the - integer rectangle clamp-and-validity helper shared by the local mutation owners. One level up, - the broader rect-scoped owner is tighter now too: - `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` - first reclamps the caller rectangle through `0x00449df0`, reruns the local edge-refresh owner - `0x0044e500`, lazily ensures one presentation target through - `0x0051f090/0x00534910/0x00534920/0x00534930`: the first helper resolves the shared - world-presentation owner, `0x00534910/0x00534920` expose the current staging flag and buffer - root, and `0x00534930` captures one normalized-bounds rect into that staging buffer before the - later publish step `0x00534af0`. The same family then resolves scaled target dimensions through - `0x00534c50` before allocating one temporary `width*height` mask. Its main scan then - walks the live secondary raster `[world+0x165d]` through the same class predicates - `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four - sidecar byte planes `[world+0x1631..+0x163d]`, while the broader per-cell pass writes packed - values into the ensured target through `0x00534730` and also updates nibble lanes at byte offsets - `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it - notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the - temporary mask, expands the caller rectangle by dirty bounds `[world+0x21ad..+0x21b9]` through - `0x00536710`, and finally seeds companion byte `[world+0x162d]` with `0xc4` on cells selected - from mask plane `[world+0x1655]`. So the `0x0044e500 -> 0x0044e940` band is now a real - derived-surface and companion-plane rebuild family rather than only a loose collection of local - raster mutations. The local - evidence now also supports a stronger negative conclusion: unlike `[world+0x1655]`, that second - mask plane is not part of the actively rebuilt runtime overlay path, and in the grounded local - corpus it behaves only as a separately seeded, cleared, and persisted sibling plane. One level - lower, the - base-plane allocator `0x00532c80` now reads more cleanly too: it is the narrower owner that - clears `[world+0x15e1]`, optionally applies the current grid dimensions, allocates the base - float-summary plane `[world+0x1605]`, the four sidecar byte planes `[world+0x1631..+0x163d]`, - both one-byte mask planes `[world+0x1655/+0x1659]`, and the packed secondary raster - `[world+0x165d]`, then seeds those planes with the same `0x02/0x01/0x00` default split. The - load-side owner for those same planes is tighter now too: the constructor thunk `0x0044e910` - immediately feeds the heavier payload body `0x0044cfb0`, which reads the rooted chunk families - `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, allocates the core world-grid - and secondary-raster arrays `[world+0x2129..+0x2141]` plus the route-entry collection - `0x006cfca8`, initializes every grid-cell record through `0x0042ae50`, and only then hands off - into `world_compute_transport_and_pricing_grid` `0x0044fb70`, the neighboring presentation - refresh `0x00449f20`, and the shell-mode pulse `0x00484d70`. So the `0x0044e910 -> 0x0044cfb0` - load side is now bounded as the heavy world-grid and secondary-raster bundle-load body rather - than just another anonymous constructor tail. One - level higher again, the broader world-presentation reinitializer `0x00537e60` now sits above - that base allocator and the larger support-family ensure path `0x005375c0`: it stores the live - grid dimensions, hard-resets the whole overlay runtime family through `0x00532590`, - and that reset strip is no longer opaque either: the immediately preceding local helpers - `0x00532310..0x00532550` now bound one compact overlay-local state family under the same owner. - `0x00532310/0x00532360/0x00532370/0x00532380` own the seven-dword companion block - `[world+0x15b5..+0x15cd]` together with live flag byte `[world+0x15b4]`; `0x005323f0`, - `0x00532460`, and `0x00532490` are the ensure, publish, and query strip for cached surface root - `[world+0x478]` using saved dimensions `[world+0x159c/+0x15a0]`; `0x005324e0/0x00532500` are the - live-flag setters for `[world+0x159b]`; `0x00532510` is the direct setter for mode byte - `[world+0x159a]`; and `0x00532520/0x00532550` own the four-dword saved dimension quad - `[world+0x15a4..+0x15b0]`. So the broader `0x00532590` reset really does sit at the base of a - concrete local cached-surface and companion-block owner family, not just a pile of unrelated - presentation fields. The reinitializer then - reinitializes the secondary-overlay family for those dimensions, and then republishes the - neighboring overlay constants and support owners used by both the world-side reattach branch and - the `.smp` restore-side presentation rebuild path, including several owners that all funnel - through the shared static-template slot allocator `0x00532ad0` over the local `0x100` pointer - band at `[world+0x08]`. Those neighboring owners are tighter now too: `0x00535070` is the small - primary overlay-surface-or-template setup owner; `0x00535100` is the heavier requested-dimension - apply and four-slot overlay-surface rebuild owner used by the setup-side regenerate branch and - the load-side bundle path; while `0x005356e0` and `0x00535890` seed two - larger static-template slot bands rooted at `[world+0x1568/+0x156c/+0x1574/+0x1578]` and - `[world+0x1560/+0x1564]` respectively; the remaining heavier sibling `0x00535430` now reads as a - shared four-slot overlay-surface rebuild owner that resamples one source or fallback descriptor - into a short local slot strip above `[world+0x155c]`. The immediate helper strip under that same - family is tighter now too: `0x00534f60` is the small presentation-owner base init above - `0x00532590`; `0x00534f80` releases one transient surface handle at `[world+0x478]` and clears - byte `[world+0x159b]`; `0x00532760` releases the current overlay slot chosen by selector - `[world+0x1558]`; `0x005327a0` clamps two requested surface dimensions down to supported - power-of-two sizes while also enforcing shell display caps from `[0x006d4024+0x114243/+0x114247]`; - `0x00532860` is the local twelve-slot stitching pass over the parallel bands rooted at - `[world+0x08/+0x0c/+0x18]`, copying terminal rows and edge dwords between those sibling slot - surfaces before finalizing the primary band through `0x00541c10`; - `0x00532960` is the adjacent paired projection helper that maps two caller counters through the - current `16x16` and `4x4` rounded grid quanta and writes the resulting coarse offsets back to two - out-pointers; - `0x005329e0` maps one `(x,y)` pair into a `1`-based coarse `4x4` overlay region id using the - current rounded grid dimensions; `0x00532a30` is the direct getter for local dword `[world+0x1554]`, - which still reads only as the live count or tag for this overlay slot band; - `0x00532a40` and `0x00532aa0` are the time-selected query helpers over the first and second - template-seeded slot bands rooted at `[world+0x1568/+0x156c]` and `[world+0x1560/+0x1564]`; and - `0x00532a90` is the direct getter for trailing fallback slot `[world+0x1578]`. The next adjacent - owner is tighter now too: `0x00532b30` is the shared release/reset path for the local overlay - slot band at `[world+0x08]`, with a split release policy keyed by shell flag - `[0x006d4024+0x11422e]` and a special forced-direct range for slot ids `1..0x10`, after which it - clears band fields `[world+0x1554/+0x1568/+0x1570/+0x155c/+0x1560/+0x1564]`. The tail of that - same reinitializer is tighter one level up too: `0x00527ce0` is the broader ensure owner that - watches current grid extents plus world tag `[world+0x2121]`, re-enters `0x00532860` when those - cached values change, rebuilds or releases local helper `[this+0x65]`, and then clears the two - large global scratch planes rooted at `0x008f2520` and `0x00b33530`. The tail of that same - reinitializer is - tighter now too: after the larger support-family setup it seeds one seven-entry default overlay - companion set through `0x005373b0`, whose inner allocator `0x00535950` populates the local - `0x1b`-entry slot table from the static template rows `0x005dd300..0x005dd378`. The lifecycle - side is tighter in the same way now: `0x00536044` is the shared teardown owner that frees those same - three five-entry support families together with both mask planes, the packed secondary raster, - the vector-byte planes, the local staging buffer, and the neighboring sidecar or coarse-cell - tables. The remaining base-float lane is tighter too: the larger rebuild owner - `0x00538360` now clearly writes one base float-summary field into `[world+0x1605]`, clears both - one-byte mask planes, and then only repopulates the primary mask plane `[world+0x1655]` for the - qualifying class-`1` interior cells before re-entering `0x00532d90` to normalize that base - float-summary plane globally and `0x00532f60` to expand positive cells through one caller radius. - That asymmetry is now enough to close the local semantic edge: `[world+0x1655]` is the actively - rebuilt primary overlay mask, while `[world+0x1659]` is only the separately seeded and persisted - secondary mask sibling with no comparably grounded distinct read-side consumer. The only grounded - getter call to its root accessor `0x00533b60` is the shell staging branch at `0x00525bad`, and - that branch immediately discards the returned pointer. The bundle side is now explicit too: - `.smp` save-load treats the two mask planes as separate payloads with chunk ids `0x2cee` for - `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, while the neighboring `0x2d49/0x2d50` - branches are the separate packed secondary-raster import lanes rather than alternate consumers - of the second mask plane. So, in the mapped local code, `0x1659` is best treated as a persisted - compatibility or seed-state sibling, not as a second actively consumed runtime overlay mask. The - transport/pricing preview side is tighter now too: `0x00538060` sits directly beneath - `0x0044faf0`, first seeds one preview handle through `0x00535430` using the short `C_` - descriptor, temporarily overrides shell globals - `[0x006d4024+0x11423b/+0x11423f/+0x114254/+0x114255]`, and then loads `%1.tga` through - `0x0053c1c0 -> 0x00541970`. It clamps that sampled image into the `0x401 x 0x401` range, - rewrites `[world+0x1605]` plus the mask/raster family `[world+0x1655/+0x1659/+0x165d]` from the - sampled pixels, optionally re-enters `0x00532d90/0x00532f60`, republishes the seeded preview - handle through `0x0053c000`, and then re-enters `0x005375c0(1, 0, 0)`. The small shell-global - owner it also touches is tighter now too: `0x006d401c` is constructed by `0x00538640`, - `0x005386e0` publishes the primary timed text lane, `0x005387a0` publishes the secondary fixed - `10000` ms lane, `0x00538810` finds the first registered shell window containing one child - control id by walking each window through `0x0053f830`, and `0x00538840/0x00538880/0x00538890` - manage the owner's local `1000`-slot active-token table keyed by child control id. The adjacent - list strip is tighter too: `0x00538990` is the registered-window virtual-slot-`0` gate that - stops on the first zero return, `0x005389c0` is the shared unlink helper for the same doubly - linked list rooted at `[owner+0x00/+0x04]`, `0x00538a60` is the zero-counter gate over - `[owner+0xc60]`, `0x00538a70` is the matching full reset-and-release body used during bootstrap - teardown, and `0x00538a10/0x00538a20/0x00538a30/0x00538a40` are the direct getter, setter, - increment, and clamped decrement helpers for the owner's scalar lanes `[+0xc5c]` and `[+0xc60]`. - The next shell-runtime strip is tighter now too: `0x005388d0` is the shared `12`-dword - descriptor dispatcher with the optional override validator at `[owner+0xc75]` and the recursive - `kind 6 -> 0xb7` rewrite; `0x00538c70` is the prioritized cached-text owner over - `[owner+0xbd8/+0xbdc/+0xbe0/+0xbe4]` that emits descriptor kind `0xae` through `0x005388d0`; - `0x00538e00` is the five-scalar descriptor-synthesis wrapper above that same dispatcher; - `0x00538e50` is the sorted registered-window insert owner over node key `[node+0x21]`; - `0x00538ec0` is the refresh sweep over the indexed helper collection rooted at `[owner+0xc69]`; - and `0x00538f10` is the broader optional-window publish plus blocking descriptor loop used by - modal launchers and some shell transition paths. +Moved to: [post-load-generation-paintterrain-and-save-load-restore.md](/home/jan/projects/rrt/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md) ### Event Editors and Scenario Action Windows +Moved to: [event-editors-companydetail-and-loadscreen.md](/home/jan/projects/rrt/docs/control-loop-atlas/event-editors-companydetail-and-loadscreen.md) -The event side is tighter too: - that `0x00433130` pass in turn materializes each live event record through - `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. Current shell-side xrefs - now tighten that event branch too: the first rebuilt linked row family under `0x0042db20` aligns - with the standalone condition list later queried by `EventConditions.win`, while the second - rebuilt family aligns with the four grouped effect lists later deep-copied through - `scenario_event_clone_runtime_record_deep_copy` `0x0042e050` during event duplication and effect - staging. The condition side is tighter now too: the tiny helper cluster - `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is no longer just "some adjacent list scans". - Current evidence bounds it as four predicates over the standalone `0x1e`-row condition list, - testing class bits `0x01`, `0x02`, `0x04`, or any of those bits in the static table - `0x005f3e04 + id*0x81`, with special fallback checks through event fields `[event+0x7f9]`, - `[event+0x7fa]`, and `[event+0x7f0] == 0x63`. The shell side is tighter too: vtable slot - `0x005d0cd8` now binds `shell_event_conditions_window_handle_message` `0x004d59e0`, and vtable - slot `0x005d0cf8` binds `shell_event_effects_window_handle_message` `0x004d7060`. The effects - side is tighter too: the lower helper trio is no longer anonymous. `0x004d5d00` now reads as the - effect-type selector refresh under control family `0x4fb2`, `0x004d5f50` reads as the selected - effect parameter-row repaint, `0x004d6090` is the heavier staged-effect editor refresh over the - `0x4fc7/0x4fce/0x4ff6/0x4ff9/0x4ffc/0x5041/0x5044/0x5046/0x5047` bands, and `0x004d67f0` - commits the current editor state back into the staged effect row at `[this+0x78]`. The verb side - is tighter now too: `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0` and - `shell_open_event_effects_modal_and_return_result` `0x004d9e40` are the shared modal openers - above the two editor windows; `0x004da640`, `0x004da700`, and `0x004d9ed0` now read as the add, - edit, and remove verbs for standalone condition rows; `0x004da7c0`, `0x004da860`, and - `0x004da920` are the matching add, edit, and remove verbs for grouped effect rows; and - `0x004d8120` is now the heavier condition-row list panel refresh those condition-side verbs - re-enter after mutation. The conditions-side refresh split is tighter too: `0x0042d700` - aggregates standalone condition-list class or modifier flags, `0x0042d740` aggregates grouped - effect-row type flags for one selected grouped list, `0x004d9970` owns the condition-class - summary and grouped-row status bands, `0x004d77b0` owns the grouped summary-band affordance gate - for `0x4fed..0x4ff0` when selector `0x5000` lands on `0x5002`, `0x004d9d10` owns the smaller - grouped-effect territory-target affordance on control `0x500b`, `0x004d9f50` owns the selected-event mode - strip and summary text panels, and `0x004d9390` is the mode-dependent detail-row switch beneath - that strip. `0x004da0f0` is tighter too: selector `0x5001` now has the strongest current - RT3.lng fit as the condition-side `Test against...` mode above `0x004d9970`, while selector - `0x5002` has the strongest current fit as the grouped-effect-side `Apply effects...` mode. - That `0x5002` branch now clearly builds control `0x5014` from RT3.lng `1160..1164` as `to the - company/player/player (i.e. chairman)/territory for which the condition is TRUE` before - enabling the adjacent `0x5005`, `0x500a`, and `0x5014..0x501c` family. The strongest current - RT3.lng fit for the remaining visible target-scope strip is now `0x5015 = to the whole game`, - `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories`, and - `0x501a..0x501c = to all/human/AI players`; the grouped effect-row type mask matches that split - directly through bits `0x08`, `0x01`, `0x04`, and `0x02`. The - selected-event strip is tighter now too: `0x004db120` is the broader selected-event repaint and - navigation refresh above those smaller helpers, `0x004db520` and `0x004db5e0` are the previous - and next selected-event stepping verbs, `0x004db8b0` is the add-or-clone event modal helper, - `0x004dba90` is the rename verb, `0x004d9360` is the delete verb, `0x004db6a0` is the live - selected-event id setter behind control `0x4e84`, and `0x004db6f0` is the callback-binding plus - pending-selection bootstrap path that seeds the strip during window bring-up. The larger - dispatcher at `0x004dbb80` now makes the strip explicit: `0x4e85..0x4e8a` are previous, next, - add blank, clone selected, rename, and delete event, while the later grouped band commits current - summary state through `0x004d8d50` before changing grouped selector `[this+0x9c]` via `0x004dbf93`. - The selection bootstrap side is tighter too: `0x004daf40` is now the placeholder reset helper for - the selected-event summary controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`. - The grouped target-scope side is tighter too: `0x004d8ea0` now reads as the commit helper for current - selected-event text panels before selection or grouped-action changes, `0x004d8d50` now records - the hidden selector family `0x5006..0x500e -> 0..8`, and `0x004dab60` projects that ordinal - one-to-one onto the visible grouped-effect target-scope display strip `0x5014..0x501c`. That - split is firmer now: `0x5006..0x500e` are the canonical hidden selectors that get stored into - `[event + group + 0x7fb]`, while `0x5014..0x501c` are the visible mirror rows republished from - that same ordinal rather than a second independently named selector family. The grouped row and - stored-summary refresh side is tighter too: `0x004d88f0` is now the selected grouped-effect - row-list renderer for `0x4ed5`, formatting the grouped `0x28`-byte rows through RT3.lng - `1154..1159`, and `0x004da9a0` is the current grouped-summary-state republisher that reloads - `0x500a`, `0x500b`, and visible action selection `0x5014..0x501c` from `[event + group + ...]` - before tailing back into `0x004da0f0`, - `0x004dbfca` as the grouped target-scope mode selector that persists the chosen control id into - `0x00622074`, with `0x5001/0x5002` now strongest-fit as `Test against...` and - `Apply effects...`, `0x004dbeeb` as the pending shared summary-text triplet publish helper for - `0x4eac/0x4ed9/0x4edb`, - `0x004d91e0` as the selected-event summary-header and grouped-mode commit helper above - `0x004d8d50`, and `0x004dbe7a` as the narrower `0x4ec6/0x4ec7` choice-event single-player-only - warning modal branch rooted at RT3.lng `3887`. The remaining gaps on - this lane are narrower again because the grouped-band `0x4dc09c` table now closes one earlier - overclaim: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into - `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` only route to the smaller - `0x004d9d10` affordance path and the rest of `0x4ff1..0x5013` are default no-ops. The open - question is therefore no longer whether those visible target-scope rows are direct selector verbs; - current evidence says they are not. - The local slot records are rooted at - `[world+0x69d8]`, - `[slot+0x01]` polarity and the external role gate at `[world+0x0bc3+slot*9]` are now grounded, and - `[slot+0x03]` now looks like the distinguished primary-human-seat marker because current grounded - writes seed it only on slot zero and later logic moves it solely by whole-record compaction. The - open question is no longer whether the seeded trio lands in the visible shell company roster; - current evidence says it does, and ordinary `Start New Company` now looks like a fresh-company - allocator through `start_new_company_dialog_commit_create_company` and - `start_new_company_request_create_company`, not like the path that claims one of the seeded named - railroads. The immediate post-roster station branch is now clearly separate: current grounded - resource names and handlers put mode `8` on `StationDetail.win`, mode `5` on `StationList.win`, - and the subordinate modal selector helper on `StationPick.win` through - `shell_station_pick_window_open_modal_and_return_selected_station_id` above - `shell_station_pick_window_construct`. The company-side ownership question has therefore moved - down a layer rather than staying open. We now have a recovered `CompanyDetail.win` - owner family through `shell_company_detail_window_refresh_controls`, - `shell_company_detail_window_construct`, and `shell_company_detail_window_handle_message`; the - same owner now has one broader bounded read-side lane too, because control `0x9470` uses - `shell_company_detail_render_financial_history_panel` to draw the five-step Revenue or Expenses or - Interest or Profit or Lifetime strip, sibling control `0x9471` reuses - `shell_format_company_financial_summary_card` through - `shell_company_detail_render_company_summary_card`, controls `0x947d` and `0x947e` now ground a - bond maturity and repay panel through `shell_company_detail_render_bond_maturity_and_repay_panel`, - control `0x9488` now grounds the debt or credit or rate summary block through - `shell_company_detail_render_debt_credit_and_rate_summary_panel`, control `0x948a` now grounds the - share-value and dividend-payout block through - `shell_company_detail_render_share_value_and_dividend_summary_panel`, while the broader six-row - per-share stock-data family is now bounded under `shell_format_company_stock_data_panel`, and the - adjacent territory selector lane is bounded through - `shell_company_detail_select_territory_access_row`, - `shell_company_detail_render_territory_access_row`, - `shell_company_detail_sync_selected_territory_from_picker`, and - `shell_company_detail_refresh_selected_territory_access_summary`; the first finance-action layer - beneath it is bounded through the bond, stock-issue, stock-buyback, and dividend-rate helpers; the - territory-access side is bounded too through - `shell_company_detail_refresh_selected_territory_access_summary`, - `shell_company_detail_buy_territory_access_rights_flow`, and the underlying company access-rights - helpers; and the full takeover and merger vote-result lane is now grounded through - `shell_resolve_chairmanship_takeover_vote_and_commit_outcome`, - `shell_present_chairmanship_takeover_vote_outcome_dialog`, - `shell_resolve_merger_vote_and_commit_outcome`, and `shell_present_merger_vote_outcome_dialog`. - The remaining company-side uncertainty is therefore narrower than before: the broader support and - valuation side is now tighter too because - `company_compute_cached_recent_per_share_performance_subscore`, - `company_compute_five_year_weighted_shareholder_return`, and - `company_compute_public_support_adjusted_share_price_scalar` bound the recent per-share - performance and investor-support/share-price blend beneath those vote resolvers; the recent - per-share feeder now has a grounded four-lane tail too, with current partial-year weight - `(5 * [world+0x0f]) - 5`, prior full-year weights `48/36/24/12` on `0x1f/0x1e`, dividend - non-decline pair weights `9/8/7/6` on `0x20`, lane weights `40/10/20/30`, the startup age ramp - `0/0/0/100 -> 25/25/35/100 -> 50/50/65/100 -> 75/75/85/100 -> 100/100/100/100`, a strongest-lane - `*1.25` boost, a weakest-lane `*0.8` reduction, and separate bounded-intermediate versus final - difficulty applications under `0x005f33b8`; the next consumer `0x00424fd0` is also tighter now, - with the young-company interpolation against `[company+0x57]`, caller pressure clamped to - `[-0.2, 0.2]`, one `(shares / 20000)^0.33` share-count growth term, and the later threshold - ladder `0.6 / 0.45 / 0.3 / 1.7 / 2.5 / 4.0 / 6.0` before the issue-`0x37` multiplier, - `scenario_state_compute_issue_opinion_multiplier` now bounds the - next layer of optional company, chairman, and territory-specific opinion overrides on the active - scenario state, and the broader stat-reader family around - `company_read_control_transfer_metric_slot` and - `company_read_year_or_control_transfer_metric_value` is no longer just a merger-premium helper. - Current grounded callers show the same metric family feeding the annual shareholder-revolt and - creditor-liquidation lane surfaced by localized ids `300..304`, while the debt-side shell and - bond lane now separately close `0x38` as `Credit Rating` and `0x39` as `Prime Rate`. That means - the remaining gap is now mostly gone on the UI side too: issue `0x37` is already bounded to the - same investor-confidence family as the equity-support and governance-pressure paths, and current - grounded UI evidence still stops at the investor-attitude sentence family rather than one - standalone caption. The calendar side is tighter now too: - `[world+0x15]` is the absolute counter for the same mixed-radix `12 x 28 x 3 x 60` - year-plus-subfield tuple packed by `0x0051d3c0` and unpacked by `0x0051d460`, not just a vague - “calendar-like” blob. The `TrackLay.win` family now clearly owns `Lay single track.` `Lay double track.` - and `Bulldoze` as its three primary modes, its bridge selector, its wrapped frequency preferences, - and a strongly aligned pair of `Auto-Hide Trees During Track Lay` and `Auto-Show Grade During - Track Lay` toggles; the `StationPlace.win` family now clearly owns its six top-level category - buttons, the station-style scroller, and the station-rotation controls. The older `Building - placement center` string 671 no longer looks like a live StationPlace control label in the current - recovered flow, because the active constructor, preview, refresh, and dispatcher paths all use - neighboring ids such as 669 and 2208 without a direct recovered lookup of 671. On save or load the - broad serialize-versus-restore split is now grounded, the non-Quicksave `.gmp/.gmx/.gmc/.gms` - families are separated, and the auxiliary `.gmt` path is at least bounded to the preview-surface - side owner. The higher-value shell-facing gap has therefore shifted upward to the remaining - semantics of the post-load generation phases, the later recurring structure-population cadence, - the deeper vote-weight formulas inside takeover and merger resolution, and the still-open meaning - of the packed simulation calendar tuple. +Related headings in the same file: +- `CompanyDetail and Section Ownership` +- `Adjacent LoadScreen.win Report Family` -### CompanyDetail and Section Ownership - -The shell detail family now has an explicit - section-selector lane in addition to the read-side panels already mapped. Controls - `0x9472..0x9475` directly select the four visible CompanyDetail sections through `0x006cfe60`, - `0x9476..0x9479` are the companion visual controls for that same tab strip, and section `0` is now - bounded more tightly as the chairman or governance slice around the portrait-backed chairman band - on `0x9480` plus the dynamic overview widget `0x947f`. That widget is no longer just a vague - status line: the section-0 refresh binds it through a dedicated stack-built dynamic text path, - and the strongest current shared formatter candidate is - `shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0`, which first renders a - five-line company-metric preamble through localized ids `1211..1215`: `Revenues` from slot - `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load - mile` from the derived `slot 0x2c / slot 0x17` branch, and `Average speed` from slot `0x26` - rendered through `1216` `%1 m.p.h.`. It then splits the governance summary more concretely: no - linked chairman emits `3045`, wholly owned companies emit `3046` for the scenario-selected - chairman or `3047` for another linked chairman, and investor-owned companies emit the - investor-attitude lines `3048/3049` with one adjective from the table at `0x00622170`. That - branch is no longer using unnamed helpers either: `company_get_linked_chairman_profile_record` - `0x00426ef0` resolves the linked chairman profile and `chairman_profile_owns_all_company_shares` - `0x004768c0` is the full-ownership test behind the `3046/3047` split. The salary side is tighter - too: the formatter computes one signed delta from `[company+0x14f]` and `[company+0x0d59]`, then - chooses `3050..3052` for the scenario-selected chairman or `3053..3055` for another linked - chairman depending on whether that delta is negative, positive, or zero. The bonus line is - narrower still: it only appears when the display year matches `[company+0x34f]`, using amount - `[company+0x353]` with `3056` or `3057`. It then appends the - `1218` `Economy status - %1.` tail caption and stages the adjacent selected-company report or - list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`, - `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`, - `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`. - Current evidence still does not recover separate `CompanyDetail.win` action controls for that - strip under `shell_company_detail_window_handle_message`, so it currently reads as staged - overview text or help content rather than as a closed launcher family. The direct `0x947f` - formatter call is still indirect, but the widget boundary is tighter too: the generic shell - helpers `shell_control_refresh_matching_dynamic_text_payload` `0x00540a47` and - `shell_control_release_dynamic_text_payload` `0x005639d2` now show that type `0x6f` controls - free or swap one heap-backed text payload and then short-circuit as a special dynamic-text case, - which strengthens the reading of `0x947f` as a display-only overview widget rather than a normal - callback control. One adjacent boundary is tighter now too: the broader overview wrapper at - `shell_render_company_overview_panel_header_and_optional_change_affordance` `0x004e5a80` owns - the fallback no-company texts `1210`, `3043`, and `3888`, styles controls `0x3f06` and `0x3f07`, - and on the narrower selected-company branch appends `3044` `Click to change company name and - logo.` plus the neighboring `1941` `Change` affordance before falling through into the shared - `0x004e5cf0` text body. That keeps the name/logo affordance outside the ordinary - `CompanyDetail.win` action dispatcher and makes the `0x947f` alignment cleaner. The message-side - action band is tighter too: `0x94b5` grounds - territory-access purchase, `0x94b6` grounds bankruptcy, `0x94cf..0x94d2` ground bond issue, stock - issue, stock buyback, and dividend-rate changes, `0x9493` routes into the destructive - company-clear helper that deactivates the selected company and clears chairman/share links, - `0x94d6` grounds bankruptcy, `0x94d7..0x94da` ground bond issue, stock issue, stock buyback, and - dividend-rate changes, `0x94db` grounds merger, `0x94dc` grounds resignation, and `0x9538` grounds - chairmanship takeover. The finance-side dialog family is tighter too: the bond-issue lane now has - the dedicated modal renderer `shell_company_detail_render_issue_bond_offer_dialog` `0x004c3560` - for underwriter terms `968..972`, the stock-issue lane has - `shell_company_detail_render_issue_stock_offer_dialog` `0x004c3b50` for the staged offer lines - `975..978`, and the buyback lane has - `shell_company_detail_render_stock_buyback_offer_dialog` `0x004c4300` for broker lines - `981..984`. The compact summary card on sibling control `0x9471` is tighter too: - `shell_format_company_financial_summary_card` at `0x004bfb30` now clearly renders `Cash:`, - `Revenue:`, and `Profits:` from company slots `0x0d`, `0x2c`, and `0x2b`, rather than one looser - unnamed finance block. The dividend lane is now split the same way: - `shell_company_detail_setup_dividend_rate_adjust_controls` `0x004c4c70` binds the paired adjust - controls `0x99e8` and `0xc0f9`, - `shell_company_detail_render_change_dividend_rate_dialog` `0x004c4e30` renders localized ids - `988..990`, and - `shell_company_detail_handle_change_dividend_rate_dialog_message` `0x004c5140` clamps the staged - dividend rate against `company_compute_board_approved_dividend_rate_ceiling` `0x00426260` and - raises localized id `991` when the board refuses a higher dividend, all before the existing - company commit path. All four finance verbs now converge through the shared - callback-driven modal opener `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, which - is also reused by the multiplayer staged text-entry lane. The front controls in section `0` are - tighter too: `0x948b` is a - tutorial-guarded escape or back control that shows localized id `3724` `This option is disabled in - the tutorial.` before falling back to the shell detail-manager escape path, `0x9491` and `0x9492` - only restyle the paired visuals `0x948f` and `0x9490`, and `0x9494` opens localized id `3635` - `Enter the amount that your company's cash should be` and writes the accepted value directly into - the selected company cash pair. The neighboring debt section is tighter now too: controls - `0x947d` and `0x947e` no longer read as one-off bond widgets, but as the owners of two repayable - bond-slot row bands, `0x94e8..0x950f` and `0x9510..0x9537`. Those row controls now clearly - converge on the same repayment path in the message dispatcher: they reject unaffordable repayment - through localized id `2990`, open the early-repayment confirmation rooted at `2991`, and then - either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package - the request through the multiplayer shell transport. The render-side owner is tighter too: - `shell_company_detail_render_bond_maturity_and_repay_panel` formats `Due %1` and `Repay this - bond.` for the selected debt slot while the tiny binder - `shell_company_detail_bind_bond_row_band_for_active_panel` switches between the two row bands. - Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone - action cases. The message-side jump table now makes that passive/action split explicit too: in the - dispatch byte map rooted at `0x004c6640`, controls `0x94d6..0x94dc` map to cases `0x06..0x0c`, - control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5` - stay on the default path. The refresh-side ownership is tighter too: the helper now explicitly - loops over `0x94d4..0x9537` as the selected-company-owned band and over `0x9538..0x959b` as the - linked-chairman-owned band, and those two loops do not use the same style polarity. - `0x94d4..0x9537` take style `0x65` when the selected company matches the scenario-selected - company and `0x87` when it differs, while `0x9538..0x959b` take style `0x87` when the selected - company's linked chairman matches the scenario-selected chairman and `0x65` otherwise. The - selected-company action side - is tighter now too: scenario toggle `0x006cec78+0x4a8f` re-enables bankruptcy `0x94d6` together - with passive companion row `0x94d4`, `+0x4a8b` re-enables issue bonds `0x94d7` together with - passive companion row `0x94d5`, `+0x4a87` re-enables stock issue and stock buyback - `0x94d8..0x94d9`, `+0x4a93` re-enables dividend `0x94da` together with the same passive - companion row `0x94d5`, `+0x4adb` re-enables merger `0x94db`, `+0x4acb` re-enables resignation - `0x94dc`, and `+0x4acf` re-enables chairmanship takeover `0x9538`. That makes `0x94d4/0x94d5` - read more like passive companion or heading widgets than hidden verbs. The constructor boundary - is tighter too: current `CompanyDetail.win` setup still only binds explicit callbacks for - `0x9470`, `0x9471`, `0x947d`, `0x947e`, and `0x948c..0x948e`, not for the wider section-0 row - bands. That keeps the remaining `0x94d4..0x959b` content looking more like resource-defined - display rows that are gated and restyled by refresh than like individually code-rendered widgets. - That leaves the main remaining CompanyDetail-specific shell edge at the exact `0x947f` formatter - binding plus the still-unsplit render-side governance rows inside `0x94d4..0x959b`. -### Adjacent LoadScreen.win Report Family - -The neighboring shell lane around controls - `0x3ef6..0x4073` is now separated from `CompanyDetail` instead of being treated as one more - extension of the `0x947f` overview path. The real outer owner is - `shell_load_screen_window_construct` `0x004ea620`, which binds `LoadScreen.win`, randomizes the - `LoadScreen%d.imb` background family, stores the singleton at `0x006d10b0`, and seeds the first - visible page-strip controls. Above the older page-specific work, the real message owner is now - `shell_load_screen_window_handle_message` `0x004e3a80`: it owns page id `[this+0x78]`, - page-local substate `[this+0x7c]`, page-kind `[this+0x80]`, current company `[this+0x88]`, - current chairman profile `[this+0x8c]`, display year `[this+0x9c]`, and the page-local report - row latch `[this+0x118]`, then fans back into the shared selector - `shell_load_screen_select_page_subject_and_refresh` `0x004e2c10`, the company-step helper - `0x004e3a00`, and narrower page branches such as `0x004e45d0`. The matching render-side owner is - now bounded too: `shell_load_screen_render_active_page_panel` at `0x004ea060` formats the common - heading and panel frame, then switches on page id `[this+0x78]` and hands control down into the - active page body. That older branch is now demoted to what it actually is: - `shell_load_screen_profile_stock_holdings_page_handle_message`, the page-specific handler beneath - the stock-holdings slice. Inside that same family, - `shell_load_screen_render_profile_stock_holdings_summary_panel` at `0x004e5300` grounds the - selected-profile holdings page: it resolves the current chairman profile from `[this+0x8c]`, - renders the top summary rows `1204` `Stock Value:`, `1205` `Total Assets:`, and - `1206` `Stock Holdings:`, then walks the active company roster and formats one row per positive - holding through `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`, - falling back to `1209` `None` when no positive holdings survive. It also appends `3029` - `Click to change player name and portrait.` plus the adjacent `1941` `Change` affordance only - when the rendered profile matches the scenario-selected chairman. The earlier pages are tighter - now too: `0x004e68e0` is the selected-company financial ranking page using the active company - roster plus `1235..1245` for revenue, profit, cash, track mileage, and report affordances; and - `0x004e6ef0` is the active-chairman wealth ranking page using the chairman profile collection - plus `1237`, `1241`, `1246..1250` for cash, stock, total, and purchasing-power style comparisons. - The later sibling renderers are broader than that one holdings page now too: `0x004e7670` is the - selected-company train list page using `1235..1267`, `0x004e8270` is the selected-company - building list page using `1268..1278`, `0x004e8bb0` is the selected-company station list page - using `1279..1288`, and `0x004e9460` is the map-wide cargo list page using `1289..1298` over the - live candidate collection rather than one company roster. The last broad early-page owner is - tighter now too: `0x004e9b20` is the shared multi-year company report-table renderer for page - `4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`, all driven from - `0x004ea060` with one caller-supplied mode byte and yearly company rows built through - `company_read_year_or_control_transfer_metric_value`. The row families are bounded too: - income-statement rows `1301..1315`, balance-sheet rows `2816` and `1317..1322`, and - haulage-report rows `1323..1335`. The only special rows inside that family are now tighter too: - `0x00425880` and `0x004258c0` provide the negative-cash and positive-cash interest-rate inserts - for the `%1/%2` placeholders in strings `2815` and `2816`, so they are no longer anonymous - private math blobs. The adjacent early siblings are tighter now too: `0x004e5130` is the - selected-company `Stock Data` page wrapper that falls back through `1299` and otherwise reuses - `0x004c0160` to render the `Largest Shareholders`, `Shares`, and `Per Share Data` family; - `0x004e6ef0` is the `Player List` page; `0x004e5300` is the `Player Detail` holdings page; and - `0x004e51ea` is the `Game Status` briefing panel that pulls current scenario briefing text from - the live scenario text store and appends the `1772/1773` `Briefing` affordance. The active-page - renderer at `0x004ea060` is now tighter too because its 13-byte page descriptor table at - `0x006220a0` has been decoded directly as `{ page kind, title string id, `0x3ef8` backlink - page, selected-company-header flag }`. The currently grounded rendered title order is: - `XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`, - `HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`, - `TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`, - and `INDUSTRY LIST`. Its live body bindings are now bounded too: page `0` falls back to - `1203` `Unable to display page`, page `1` is the company overview wrapper, page `2` is the - company list page, pages `3..5` are income statement, balance sheet, and haulage report, page - `6` is stock data, page `7` is player list, page `8` is player detail, page `9` is game status, - page `0x0a` is train list, page `0x0b` currently falls back to `1203`, page `0x0c` is station - list, page `0x0d` currently falls back to `1203`, page `0x0e` is cargo list, and page `0x0f` - is industry list. The row-click path is tighter now too: player-list rows re-enter page `8` - directly, but train, station, and industry rows leave `LoadScreen.win` through the shell - detail-panel manager at `0x004ddbd0` instead of switching to title-table pages `0x0b` or - `0x0d`. Page `0` is tighter now too: its descriptor is kind `0`, title `1200` `XXX`, backlink - `0`, and header flag `0`, and no current post-constructor selector path has been recovered for - it. The descriptor side now also bounds the only known reverse route for the dormant detail - titles: `0x3ef8` is the table-driven backlink affordance, so if page `0x0b` or `0x0d` were ever - selected, the known reverse path would return to train-list page `0x0a` or station-list page - `0x0c` respectively rather than through a separate detail-only owner. - The launcher side is tighter too: current grounded `shell_open_or_focus_load_screen_page` - callers cover pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, - and no current recovered opener or row-click route selects `0x0b` or `0x0d`. So the - `LoadScreen.win` family now has a much cleaner shape: one outer message owner - `0x004e3a80`, one active-page render owner `0x004ea060`, and then the narrower page-specific - handlers and renderers beneath them. The launcher side is tighter now too: `0x004e4ee0` is the - shared open-or-focus ledger-page owner above this family. Outside sandbox it either re-enters - `shell_load_screen_select_page_subject_and_refresh` on the live runtime at `0x006d10a8` or - allocates that transient runtime, seeds it through `0x004e4b10`, and enters the visible modal - loop; inside sandbox it raises localized id `3899` `The ledger is not available in sandbox mode.` - instead. - The direct shell-command strip above that opener is now explicit too: `0x00440700..0x0044086e` - are just tiny `scenario-present -> open page` wrappers for pages `1`, `3`, `4`, `5`, `6`, - `0x0a`, `0x0c`, `0x0f`, `0x0e`, `2`, `7`, and `9` respectively. So the recovered launcher range - is no longer only “callers of `0x004e4ee0`” in the abstract; each of those small shell-command - stubs now just forwards one fixed page id into the shared opener. - instead. That narrows the remaining `LoadScreen.win` gap again: `TRAIN DETAIL` and - `STATION DETAIL` now read as dormant title-table entries unless some still-unrecovered nonstandard - selector reaches them. The live auto-load boundary is tighter now too: hook-driven - `shell_transition_mode(4, 0)` now completes old-mode teardown, reconstructs and republishes - `LoadScreen.win`, and returns cleanly, but the later post-transition service ticks still keep - `[0x006cec78] = 0`, `[shell_state+0x0c]` on the same `LoadScreen.win` singleton, and - `[LoadScreen.win+0x78] = 0` through at least counts `2..8`. So the next runtime edge is no - longer the old mode-`4` teardown or publish band; it is the `LoadScreen.win` message owner - `0x004e3a80` itself, because later service alone is not promoting the plain load screen into the - separate startup-runtime object path. One later runtime probe did not actually reach that edge: - the `0x004e3a80` hook installed, but the run never produced any ready-count, staging, - transition, post-transition, or load-screen-message lines, only ordinary shell node-vcall - traffic. So that result is now treated as a gate-or-cadence miss rather than as evidence against - the `LoadScreen.win` message path itself. The newer shell-state service trace tightens it again: - on a successful staged run the later service ticks do execute in `mode_id = 4`, but the - `0x004e3a80` message hook still stays silent while the state remains frozen in the plain - `LoadScreen.win` shape. So the next runtime boundary is now the shell-runtime prime call - `0x00538b60` beneath `shell_state_service_active_mode_frame` `0x00482160`, not the message owner - alone. The first direct `0x00538b60` probe run is not trustworthy yet, though: it stopped - immediately after the first shell-state service-entry line, before any ready-count or - runtime-prime entry logs. So that result is currently treated as probe validation work, not as a - real boundary move inside RT3. The static service branch is conditional too: `0x00482160` only - enters `0x00538b60` when `[shell_state+0xa0] == 0`, so silence from the runtime-prime hook does - not yet prove the shell stops before that call unless the service-entry logs also show the `+0xa0` - gate open. The newer run now closes that condition: `[shell_state+0xa0]` is `0`, and the - `0x00538b60` runtime-prime hook enters and returns cleanly. The newer run closes the next owner - too: `0x00520620` `shell_service_frame_cycle` also enters and returns cleanly on the same frozen - mode-`4` path, and the logged fields match its generic branch rather than a startup-promotion - lane (`[+0x1c] = 0`, `[+0x28] = 0`, `flag_56 = 0`, `[+0x58]` pulsed then cleared, and - `0x006cec78` stayed `0`). The static body under the same owner is tighter now too: `0x00538b60` - first re-enters `0x0054f6a0`, refreshes the primary timed-text lane from `[owner+0x1c]` through - `0x005386e0` when that deadline has expired, walks the registered shell-window list from tail - `[owner+0x04]` backward through `+0x54` while servicing each node through `0x0053fda0` and - `0x0051f1d0`, and only then conditionally presents the secondary and primary text lanes through - `0x005519f0`. So the next runtime boundary under the same shell-state service pass is now one - level deeper: the per-object service walker `0x0053fda0` beneath `0x00538b60`. The newer run - closes that owner too: it enters and returns cleanly while servicing the `LoadScreen.win` object - itself, with `field_1d = 1`, `field_5c = 1`, and a stable child list under `[obj+0x70/+0x74]`, - and its first child-service vcall target at slot `+0x18` stays `0x005595d0`. Since `0x006cec78` - still stays `0` through those clean object-service passes, the next runtime boundary is now the - child-service target `0x005595d0`, not the higher object walker. The newer child-service run - narrows that again: the first sixteen `0x005595d0` calls are stable child lanes under the same - `LoadScreen.win` parent, with `[child+0x86]` pointing back to the load-screen object, - `field_b0 = 0`, and a split where earlier children carry `flag_68 = 0x03` and return `4` while - later siblings carry `flag_68 = 0x00` and return `0`. The static body matches that read too: - `0x005595d0` is gated by `0x00558670` and then spends most of its work in draw or overlay - helpers `0x54f710`, `0x54f9f0`, `0x54fdd0`, `0x53de00`, and `0x552560`, so it now reads as - another presentation-side service lane rather than the missing startup-runtime promotion. The - widened allocator-window trace then reconciled the runtime with - the static mode-`4` branch one step further: the first transition-window allocation is `0x7c`, - which matches the static pre-construct `0x48302a -> 0x53b070` alloc exactly, and the later - `0x111/0x84/0x3a/0x25...` allocations all occur before `LoadScreen.win` construct returns, so - they now read as constructor-side child or control setup. That means the allocator probe did not - disprove the still-silent startup-runtime slice; it simply exhausted its log budget inside the - constructor before the post-construct block. The later reset-at-return run is now the decisive - one: after `LoadScreen.win` construct returns there are still no further allocator hits before - publish and transition return, which matches the corrected jump-table decode because mode `4` - does not own the `0x46c40 -> 0x4336d0 -> 0x438890` startup-runtime path. ### Editor Breadth - -The broader map-editor page owner is now bounded through - `map_editor_panel_select_active_section` `0x004ce070` and - `map_editor_panel_dispatch_active_section_message` `0x004cf700`, which switch among the grounded - setup pages, `Cities/Regions`, `Territories`, the `Players` and `Player Pool` setup slices, the - now-grounded `Building Density` page, the locomotives-available and industry-availability pages, - the economic and special-condition pages, the `Port/Warehouse Cargos` page, and the later report - pages. The mid-editor ownership is materially clearer now too: the chairman-slot editor is the - `Players` page, the available-chairman editor is the `Player Pool` page, and the former unnamed - dual tri-state page now lines up with localized page text `997` `Building Density` plus help text - `1017` and the direct field captions `1642` `Starting Building Density Level:` and `1644` - `Building Density Growth:`. Both controls are now bounded as stored ordinal bytes `0/1/2` rather - than loose labels: the first three-choice control is the map-wide starting-density selector, with - its default middle state `1` matching the documented `100%` baseline from `1643`; the second is - the paired overall growth selector whose effects later appear in the city-growth side of the - simulation. `map_editor_city_region_panel_construct` and - `map_editor_city_region_panel_handle_message` own the city-or-region editing lane with rename and - copy-industry-data flows. That copy side is tighter now too: the handler first enters - `0x00420e00`, which rebuilds the selected region's profile collection `[region+0x37f]`, clones - the source region's live label-weight entries when a source region is present, and otherwise - reseeds a fixed default weight set through repeated `0x004206b0` calls. The no-source companion - `0x00420ed0` now makes that split explicit: it rebuilds the same subcollection and then picks one - of two fixed default label-weight sets based on region class dword `[region+0x23e]`, using one - all-`0.2f` family for nonzero-class regions and one class-`0` family that starts with `0.3f` - before continuing with repeated `0.2f` entries. The lower mutator - `0x004206b0` then linearly scans the selected region subcollection by profile label, creates a - new profile only when the copied weight is positive, removes an existing profile when the copied - weight is non-positive, updates `[entry+0x1e]` otherwise, and refreshes the region's derived - availability-summary bytes `[region+0x2f6/+0x2fa/+0x2fe]` through `0x00420410`; `map_editor_territory_panel_construct` and - the adjacent no-source companion `0x00420ed0` is tighter too: it rebuilds the same collection - root `[region+0x37f]` but then seeds one of two fixed default profile-label sets directly through - repeated `0x004206b0` calls, splitting by region class dword `[region+0x23e]`. Nonzero-class - regions take one all-`0.2f` default set, while class-0 regions take a different set that starts - with one `0.3f` weight before continuing with repeated `0.2f` entries. That makes `0x420ed0` - the true class-split default-profile companion to the source-cloning helper at `0x420e00`, - rather than just more of the same editor copy path. Two neighboring collection queries are tight - enough now too. `0x00421d20` counts how many live regions have at least one profile row in - `[region+0x37f]` whose label matches the candidate-name string for one caller-supplied candidate - id; `0x00421e30` resolves the Nth such matching region. Both helpers reuse the same - `0x0041fac0` ordinal label-and-weight copy helper we just grounded, only increment once per - region, and skip nonzero-class regions whose companion count `[region+0x242]` is nonpositive. - Those two queries are what the editor summary side at `0x004cdd56/0x004cdeab` uses before it - formats per-region lists for one selected industry or profile name. The adjacent world-facing - query strip is bounded too: `0x00422010` scans the live region collection for class-0 regions - whose normalized coordinates fall inside one caller-supplied float rectangle, keeps the nearest - region id `[region+0x23a]` by squared XY distance through `0x0051db80`, and returns `0` when no - qualifying region is found; `0x004220b0` is the small wrapper above it that returns the matched - region name `[region+0x356]` or the fallback localized scratch string at `0x0062ba90`. - `map_editor_territory_panel_construct` and - `map_editor_territory_panel_handle_message` own the territory rename and border-remap lane; - `map_editor_locomotive_availability_panel_construct` plus - `map_editor_locomotive_availability_panel_handle_message` now bound the locomotive policy page - over `0x006ada84`; `map_editor_industry_availability_panel_construct` plus - `map_editor_industry_availability_panel_handle_message` do the same for the industry candidate - pool at `0x0062b268`; and `map_editor_port_warehouse_cargo_panel_construct` plus - `map_editor_port_warehouse_cargo_panel_handle_message` now ground the recipe-book page that edits - port or warehouse cargo policies through twelve per-book state blocks at - `[0x006cec78+0x0fe7+index*0x4e1]`. Each book now has a shared maximum annual production float at - `book+0x3ed` and five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`; each - line is bounded as a mode dword, annual amount, a supplied-cargo token at `+0x08`, and a - demanded-cargo token at `+0x1c`. The constructor and handler now make those fields materially - tighter too: the row pair shown in `Supply Only` and `Production Demand->Supply` is the `+0x08` - supplied-cargo selector, the row pair shown in `Demand Only` and `Production Demand->Supply` is - the `+0x1c` demanded-cargo selector, and the single amount field at `+0x04` is labeled `Annual - Demand:` only in mode `1` but `Annual Supply:` in modes `2/3`. The stronger new runtime-side - result is now a full chain rather than only the importer: - `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` first imports those same five - lines into one repeated array of identical `0xbc`-byte runtime descriptors with no row-index - special casing, and the candidate-side rebuild pass at - `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` then - projects those descriptors into the live structure collection at `0x0062ba8c` before - `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` rebuilds the - per-cargo runtime summary tables. The current local file-side result is now tighter too: the - grounded recipe-book root at `0x0fe7` is preserved byte-for-byte across the checked map/save - scenario pairs, so the loader can safely treat the twelve `0x4e1`-byte books as preserved - scenario payload rather than a drifting save-only band. A conservative summary probe now only - reports per-book head signatures, raw cap dwords at `+0x3ed`, and five raw line summaries rooted - at `+0x3f1` so the file-side structure stays aligned with this grounded ownership. The - player-facing line modes remain `Disabled`, `Demand Only`, `Supply Only`, and - `Production Demand->Supply`, and the fourth mode is tighter now too: current wording around - `1674`, `1675`, and `504` plus the downstream scaling path says it is the - production-line mode governed by the shared annual production cap, where the entered annual amount - stays on the supply side while the demanded side becomes the normalized input branch. The - candidate-side accumulator pass reinforces that split by applying the shared production cap only - to the supply-half runtime branch and bypassing that scaling on the normalized demand half. The - lower gameplay side is tighter now too: `structure_candidate_query_cargo_runtime_summary_channels` - `0x00412650` is the first grounded consumer beneath that rebuild chain, because it lazily rebuilds - four per-cargo summary banks and returns one direct-supply channel, one cap-normalized supply - channel, one demand or input channel, and one scaled production-output subrow channel for a - requested cargo id. The internal indexing is tighter now too: the direct-supply lane indexes from - `[desc+0x1c]`, the demand or input lane uses that same resolved cargo id in the no-subrow branch, - and the scaled production-output lane indexes each subordinate row directly from - `[desc+0x44+row*0x1c]`, with no post-resolution failure guard between the importer writes and the - summary-bank updates. So the strongest current read is narrower than a full cargo-id decode: if - the imported low-16 marker rows fail the exact matcher at `0x0041e9f0`, the resulting `0` ids - will still hit the first summary-bank bucket inside `0x00412650`, but the semantic meaning of - cargo id `0` itself remains ungrounded. The sibling helper - `structure_candidate_supports_or_references_cargo_id` - `0x004129d0` then uses those same banks plus the cached cargo-membership arrays to answer whether - a live candidate materially references a cargo at all. One compare step tighter, the raw line - lanes now split cleanly by scenario family while still preserving map->save identity inside each - checked pair. `Alternate USA.gmp` and `Autosave.gms` match at the raw line-content level: books - `0..4` keep mixed line areas, their `line02` slots carry the recurring nonzero mode words - `0x00110000`, `0x000b0000`, `0x000b0000`, `0x00130000`, and `0x00180000`, and the same `line02` - slots also carry one recurring supplied token `0x000040a0`; the neighboring `line00/line01` - slots carry the same recurring demanded token lanes such as `0x00010000`, `0x72470000`, - `0x6f430000`, `0x694c0000`, and `0x694d0000`. `Southern Pacific.gmp` and `p.gms` also match at - the raw line-content level, but the same rooted line slots stay zero in the checked pair. - `Spanish Mainline.gmp` and `g.gms` again match at the raw line-content level yet carry a distinct - nonzero pattern: books `0..4` keep mixed line areas, line-level supplied tokens include - `0x00170000`, `0x00150000`, `0x00004040`, and `0x00004000`, demanded tokens include - `0x00010000`, `0x68430000`, and `0x6c410000`, and the later `line02` mode words stabilize at - `0x00070000` then `0x00010000`. So the loader can now safely treat these raw line lanes as - preserved scenario payload with family-specific signatures, even though the exact cargo-id and - mode-enum semantics still need separate grounding. One inference is tighter now too: when those - demanded-token words are zero in the low 16 bits and printable in the high 16 bits, the byte - order reads as short two-letter stems such as `Gr`, `Co`, `Li`, `Mi`, `Ch`, and `Al`, which fit - the current scenario cargo-name families `Grain`, `Corn`, `Livestock`, `Milk`, `Cheese`, and - `Alcohol` from `RT3.lng`; the runtime probe now exposes those only as probable ASCII stems, not - as fully grounded cargo-id decodes. The supplied-token side is now bounded as a separate layout - family rather than forced into that same stem model: the `Alternate USA` family uses one stable - low-16 marker `0x000040a0` only in `book00..04.line02`, the `Southern Pacific` family leaves the - supplied lanes zero in the checked pair, and the `Spanish Mainline` family splits between two - high-16 numeric tokens `0x00170000` and `0x00150000` in `book00/01.line01` plus the later low-16 - markers `0x00004040`, `0x00004000`, and `0x00004040` in `book02..04.line02`. The probe now - exposes those conservatively as token-layout classes `high16-ascii-stem`, `high16-numeric`, and - `low16-marker`, without claiming that the non-stem numeric or marker families are decoded yet. - One more structural layer is stable enough to name conservatively: the checked nonzero recipe - rows repeatedly fall into four line-signature classes. `Alternate USA` books `0..4` all expose - one `demand-numeric-entry` at `line00` (`0x00010000`), one `demand-stem-entry` at `line01` - (`Gr/Co/Li/Mi` stems), and one `supply-marker-entry` at `line02` (nonzero mode plus - `0x000040a0`). `Spanish Mainline` books `2..4` expose that same three-line pattern with - `Ch/Al` stems and the `0x00004040/0x00004000` marker family, while books `0/1` only expose the - earlier `supply-numeric-entry` form at `line01`. So the loader can now distinguish recurring row - roles such as demand-stem versus supply-marker without pretending the marker payloads themselves - are decoded. The importer-side branch map is tighter now too because local `objdump` over - `0x00435630` shows that only nonzero mode dwords materialize into `0xbc` runtime descriptors: - mode `0` lines are skipped entirely, mode `1` enters the demand-only branch, mode `3` enters the - dual demand-plus-supply branch, and every other nonzero mode falls into the supply-side branch. - In the checked corpus that means the recurring `demand-numeric-entry` and `demand-stem-entry` - rows in `Alternate USA` and `Spanish Mainline` are preserved scenario-side line records but do - not become live runtime descriptors, while the later `supply-marker-entry` rows are the ones that - actually reach the runtime import path. The runtime probe now exposes that directly as - `imports_to_runtime_descriptor` plus one conservative `runtime_import_branch_kind`. - The raw token windows beneath those branch labels are tighter now too. The checked mode-zero - demand rows preserve string-bearing windows at `line+0x1c`, and the current probe shows those - conservatively as prefixed ASCII previews such as `..Grain`, `..Corn`, `..Livestock`, and - `..Milk`; local `objdump` over `0x0041e9f0` then shows the importer feeding the corresponding - token buffer into an exact cargo-name matcher built over the live cargo collection at - `0x0062ba8c`. By contrast, the imported `supply-marker-entry` rows feed nonprintable windows such - as `.@...` from `line+0x08` through that same matcher, and the resolver path currently shows no - special-case decoding for those marker forms. So the strongest static read is now: the stem-like - demand rows preserve cargo-name text but are skipped because their mode is zero, while the - nonzero imported marker rows are the live descriptor inputs yet likely fail exact cargo-name - resolution unless another upstream transform exists. - The wrapper layer above that query no longer looks like a hiding place for special treatment - either. Local `objdump` now shows `0x00412960` simply summing the two supply-side floats returned - by `0x00412650`, while `0x004129a0` returns the single scaled production-output lane directly; - neither wrapper checks for cargo id `0` after the query returns. The broader world-side - accumulator at `0x0041e7be` is tighter in the same way: it calls `0x00412650`, requires all four - returned channels to be positive before continuing, and only then scales those four channel - values by one linked-instance count from `0x00413940` into caller-owned accumulators. So the - current strongest read remains structural rather than semantic: unresolved marker rows can still - propagate through the first bank bucket, but the first place that meaning matters is a normal - positivity-gated cargo-channel consumer, not a dedicated null-cargo branch. - The caller side is narrower than before too. The steady-state site bitset owner - `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` starts its inner cargo - loop at id `1` and only walks upward through the current live cargo count, so it never - intentionally queries cargo id `0`. The broader placed-structure sweep around `0x00452e60` - tightens the same boundary from above: when the requested cargo id is nonzero it resolves the - backing candidate and enters `structure_candidate_supports_or_references_cargo_id`, but when the - requested id is exactly `0` it skips that cargo-reference helper entirely and falls through to a - different linked-site or station-or-transit gate. Current local `objdump` now shows that bypass - first requiring one subtype latch through the placed-structure vtable `+0x70`, then resolving the - linked site id at `[site+0x2a8]` through the placed-structure collection `0x006cec20`, and then - forwarding that linked peer into the narrower predicate at `0x0047fd50`. That narrower helper is - tighter than before too: it resolves the linked peer's backing candidate through the peer site id - at `[peer+0x04]`, reads candidate class byte `[candidate+0x8c]`, and returns true only for the - first three class values `0/1/2` while rejecting `3/4` and anything above `4`. So current local - callers treat cargo id `0` as a nonstandard request bound to one linked-site reachability or - classification side path, not one ordinary cargo lane they routinely probe. - The vtable-`+0x70` latch itself is bounded a bit better now too. It still lacks a direct field - decode, but every local callsite we checked around `0x0040d230`, `0x0040dba0`, `0x0040dbf0`, and - `0x0040f670` uses that slot only as the precondition for touching `[site+0x2a8]` and the - neighboring linked-site helpers `0x0047dda0`, `0x0047fd50`, and `0x004138b0`. That makes the - safest current read a linked-site-bearing or linked-site-capable latch, strongly aligned with the - subtype-`1` construction lane that is the only grounded writer of `[site+0x2a8]`, rather than a - broad cargo or route-style predicate. - The neighboring maintenance pair tightens that linked-site read further. Local `objdump` now - shows `0x0040dba0` and `0x0040dbf0` as complementary tiny helpers that each require the same - vtable-`+0x70` latch, resolve optional linked peer id `[site+0x2a8]` through `0x006cec20`, - forward that linked peer (or null) into `0x0047dda0`, and then mirror opposite values into local - byte `[site+0x42]` (`0` for `0x0040dba0`, `1` for `0x0040dbf0`). The route-entry side beneath - them is tighter too: `0x0047dda0` reads route-entry anchor id `[peer+0x08]`, resolves that anchor - through `0x006cfca8`, and only dispatches one of two route-entry vtable calls when - `0x0048a090(1)` reports that all three anchor-slot dwords `[entry+0x206]`, `[entry+0x20a]`, and - `[entry+0x20e]` are still `-1`. So the strongest current read is no longer just "linked-site - capable" in the abstract: this latch consistently fronts the local linked-peer class gate - `0x0047fd50`, the paired `[site+0x42]` route-entry state toggles, and the later linked-peer - collection sweep `0x004138b0`, which keeps the `cargo id 0` bypass path firmly on the - linked-site route-anchor or classification side rather than on an ordinary cargo lane. - One smaller ownership boundary is tighter too: byte `[site+0x42]` is not private scratch owned - only by that pair. Local `objdump` shows tiny direct setters at `0x0040cbc0` and `0x0040cbd0` - plus a raw getter at `0x0040cbf0`, so the `0x0040dba0/0x0040dbf0` pair is writing one shared - placed-structure state byte rather than inventing a route-entry-only scratch lane. One caution - is tighter now too: there are later mode-gated reads at other addresses that also touch a - `+0x42` byte on their own object layouts, but current local evidence does not yet prove those are - the same placed-structure owner family, so the safest current note keeps only the immediate - `0x0040cbc0/0x0040cbd0/0x0040cbf0/0x0040dba0/0x0040dbf0` cluster grounded together. - The vtable side sharpens that split too. A local `.rdata` scan shows `0x0040dba0` and - `0x0040dbf0` each appearing exactly once, together with `0x0040cbf0`, in one method table rooted - at `0x005c8c50`; the constructor chain is tighter now too, because `0x0040c950` installs that - same table as one concrete placed-structure specialization above the common base table - `0x005cb4c0`, while `0x0040c970` tears the same specialization back down to the base before the - temporary object is freed. By contrast the raw set or get trio - `0x0040cbc0/0x0040cbd0/0x0040cbf0` also appears in several sibling tables such as `0x005c9750` - and `0x005dd1f0`. So the strongest current structural read is that byte `[site+0x42]` belongs - to one broader placed-structure virtual interface, while the linked-peer route-entry toggles are - one specialization-specific override pair inside that family rather than generic setters used by - every sibling. - One negative boundary is tighter now too: the - raw token words in this recipe block do not look like the already grounded shell-side - `AnyCargo/AnyFreight/AnyExpress` selector-table ids from `0x00621e04/0x00621e10`, so the current - best read is that these on-disk line tokens are not just copied UI selector ordinals or the same - small express-side id family in another wrapper. One broader collection pass also now ties - the editor rule side back into runtime filtering: - `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0` rebuilds - per-candidate flag `[candidate+0x56]` across the live structure collection, and current grounded - callers show it rerunning directly off the runtime cargo-economy latch at `[0x006cec74+0x25f]`, - which aligns this lane with the editor's `Disable Cargo Economy` special condition rather than - leaving it as a purely editor-owned recipe page. The first common live gate beneath that filter is - now bounded too: `structure_candidate_is_enabled_for_current_year` `0x0041e220` is the shared - year-and-filter check used by the collection refresh and later candidate-selection branches, while - `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0` is a setup-side local service - scorer that already consumes the same enabled candidate records through world-grid sampling. One - steady-state world-side consumer is now grounded as well: - `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` walks linked placed - structures, filters live category-`2` candidates through - `structure_candidate_is_enabled_for_current_year`, and compacts the direct and scaled supply-side - channels from `0x00412960` and `0x004129a0` into per-cargo bitsets on the placed-structure record. - The next site-side owner layer is tighter now too: - `placed_structure_refresh_linked_candidate_flag4` `0x0042c8f0` refreshes the sibling state bit at - `[site+0x0e6]`, `placed_structure_refresh_candidate_service_state` `0x0042cdf0` ties that flag - refresh to the cargo-service bitset rebuild, - `placed_structure_rebuild_candidate_local_service_tables` `0x0042ce00` then performs the heavier - per-site candidate score rebuild over the aligned float and word tables at `[site+0x107]`, - `[site+0x02]`, and `[site+0x6c]`, and `placed_structure_refresh_local_service_score_bundle` - `0x0042d580` is now the local wrapper that chains that rebuild into the neighboring post-passes - before the world-grid owner continues. Those post-passes are tighter too: - `placed_structure_apply_route_linked_service_caps` `0x0042cc50` is the first route-backed cap pass - over the rebuilt local tables, - `placed_structure_redistribute_local_service_pressure_from_neighbors` `0x0042c1b0` is the - neighboring-site redistribution pass, and `placed_structure_clamp_candidate_service_age_table` - `0x0042cb30` is the final recent-service clamp over the primary per-candidate word table. Above - that refresh lane, `placed_structure_query_candidate_local_service_metrics` `0x0047e240` is the - first higher-level query, `placed_structure_count_candidates_with_local_service_metrics` - `0x0047e330` counts how many candidates currently produce that query, - `placed_structure_get_nth_candidate_id_with_local_service_metrics` `0x0047e620` is the ordinal - selector over that same visible candidate family, - `placed_structure_query_cached_express_service_class_score` `0x0047e390` caches one parallel class - score for the express family now strongly aligned with `Passengers`, `Mail`, and `Troops`, - `placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site` - `0x0047eb90` rebuilds one peer-site comparison cache over the same local-service inputs, and - `placed_structure_select_best_candidate_id_by_local_service_score` `0x0047f910` is the best-hit - selector above the direct and directional local-service query pair. Those site-side scores now - have grounded shell read-side consumers too: - `shell_station_detail_format_freight_and_express_summary` `0x00506be0` formats the visible - `Freight: %1` and `Express: %1` lines in `StationDetail.win`, and the same station-detail family - now has a deeper candidate-service lane: - `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` stores the active - `(station id, candidate id)` pair for the world-side preview scan, - `shell_station_detail_clear_active_candidate_service_preview` `0x00504a90` tears that pair back - down, `shell_station_detail_update_candidate_service_entry` `0x00504ba0` is the shell-side entry - updater above that preview pair, `shell_station_detail_format_candidate_local_service_summary` - `0x00504bea` uses `placed_structure_query_candidate_local_service_metrics` together with localized - ids `681`, `682`, and `2813` to build the visible candidate service text, - `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150` now grounds the paired `To` - and `From` hauled-traffic strip widgets, `shell_station_detail_present_to_from_haul_stats_popup` - `0x00504770` owns their click-through annual and lifetime `hauled TO/FROM this station` popup, - `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470` owns the five-row - nearby-structure jump lane, and `shell_station_detail_refresh_candidate_service_rows` `0x00505760` - is now the larger row-list owner that enumerates active candidate-service entries and wires - `shell_station_detail_update_candidate_service_entry` into the per-row click path. The broader - owner above those lanes is tighter now too: `shell_station_detail_window_refresh_controls` - `0x00506610` is the real `StationDetail.win` refresh pass, validating the current station from the - detail manager, publishing the upper summary lane, splitting the `0xb3b7/0xb3b8` action strip by - scenario latch `[0x006cec74+0x1db]`, routing that scenario branch through - `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590`, routing - class `3/4` sites into the alternate branch - `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and otherwise rebuilding the nearby-structure lane, the paired `To/From` widgets, - and the candidate-service rows together. The compact siblings under that pass are tighter now too: - `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` is the dirty - clear owner over the dynamic row bands and the paired haul widgets, `shell_station_detail_has_valid_selected_station` - `0x00504370` is the bare selected-station validity probe, `shell_station_detail_selected_station_belongs_to_selected_company` - `0x00504390` is the selected-company ownership gate, and - `shell_station_detail_present_selected_station_not_controlled_notice` `0x005043f0` is the - localized not-controlled popup beneath the same action family, - `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` is the - scenario-latched station-to-station triplet popup that formats three per-destination scalar lanes - with `%5.2f` or `N/C`, and - `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0` is the alternate - class-`3/4` branch that rebuilds the `Trains Serviced` / `Trains Maintained` matrix before - reusing the shared haul-popup callback wiring, - `shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0` - refreshes the lower class-gated action strip rather than the older guessed `0xb3f8` lane. - `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50` feeds the - station-list summary `%1 has %2 freight loads and %3 express loads available for hauling...`, and - the paired modifier helper `shell_station_list_handle_center_or_rename_action` `0x00506d50` owns - the visible Shift-center and Ctrl-rename row actions. The list owner itself is tighter now too: - `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30` is the real - `StationList.win` row and status refresh pass, clearing and repopulating controls `0x61a9` and - `0x61aa`, wiring the visible summary and modifier callbacks, mirroring the shared selected-station - latch at `[0x006cec78+0x4cba]` when it still belongs to the current company, and updating the two - status labels `0x61af` and `0x61b0`. The row-side callout lane is tighter too: - `shell_station_list_row_callback_publish_station_callout_card` `0x00506ac0` is the actual - row callback beneath both list controls, resolving the selected station, deriving one category - header through `0x0053de00` and `0x00552560`, and then publishing the station-name plus freight - and express callout card through repeated `shell_publish_text_callout_presentation` calls. The - side-selector branch is tighter too: - `shell_station_list_window_handle_message` no longer just re-enters the raw `StationPick.win` - constructor. It flips the active side bit at `0x006d1710` and then re-enters the modal helper - `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`, which - allocates one helper window, runs `shell_station_pick_window_construct` `0x00507620`, brackets the - modal show path, and returns the staged selected station id from `0x00622ae8`. Inside that helper - family, `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event` - `0x005075c0` now bounds the small message-normalization strip beneath controls `0x80e8..0x80ea`. - The Shift-center side is tighter now too: - the shared helper `0x00433900` takes one object pointer plus one small mode, derives one - mode-specific `(distance,height)` preset from the target's virtual classification, and then - re-enters `0x0043c9a0` to center the live world view on that object. The report side is clearer - as well: - `0x004d3060` is the dedicated `Stats - Trees` constructor over `map_editor_tree_stats_report`, - `0x004d3080` is the actual `General Validation` constructor over - `map_editor_general_validation_report`, and the same page table also now grounds `Stats - Cargo`, - `Stats - City/Region`, `Stats - City Count`, `Event Variable Values`, and the neighboring - event-validation page. The remaining open editor edge is therefore mostly the deeper gameplay - meaning of those site-side service scores and flag bits, not page ownership. +Moved to: [editor-breadth.md](/home/jan/projects/rrt/docs/control-loop-atlas/editor-breadth.md) ### Station-detail overlay - -The shell-side candidate preview pair now has a grounded world consumer - too. `world_render_station_candidate_service_map_overlay` at `0x0043f640` reads the active - `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, scans the placed-structure - collection, and then splits the legend by candidate mode. When the active candidate carries a - nonzero route-style byte at `[candidate+0x46]`, the overlay uses the heavier helper - `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` in both - directions between the preview station and each scanned site and formats the resulting directional - rows as `3874` `Coming To %1` and `3875` `Going From %1`. When that byte is zero, the same overlay - falls back to the direct local-service path through - `placed_structure_query_candidate_local_service_metrics` and formats the two legend rows instead - as `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes - collapse to `3878` `--None--`, and one title lane falls back to literal `All`. Current disassembly - no longer supports treating `3872` `Already Connected by Another Company` or `3873` `Not - Connected` as direct overlay-body emits. -#### Corrected boundary - -The neighboring connection-state note pair now appears - to live in a city connection-bonus label formatter, not in `0x0043f640`. That formatter is now - bounded as `city_site_format_connection_bonus_status_label` at `0x004207d0`: it directly chooses - localized ids `3868` through `3873` after consulting the reusable city-peer scan - `city_connection_bonus_exists_matching_peer_site` at `0x00420030`. Separately, `3879` `Out of - Sync` is grounded under the multiplayer preview dataset path instead: - `multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync` at `0x0046b780` checks - global `0x006cd91c`, raises the `Out of Sync` shell status through `0x5386e0`, and then continues - through the wider multiplayer preview launch-state service. So the station-detail overlay - currently owns only the `Coming To`, `Going From`, `Current Supply`, `Current Demand`, `--None--`, - and `All` legend lanes. -#### Ownership side - -One reusable site helper is grounded now too. - `placed_structure_query_linked_company_id` at `0x0047efe0` resolves the current placed structure's - linked instance through `0x0062b26c` and returns its company id from `[instance+0x276]`; the - adjacent city bonus formatter at `0x004207d0` compares that id against the active company selector - before choosing whether a scanned site should carry `3871` `Connected By Another Company` or - `3872` `Already Connected by Another Company`. The larger caller boundary is no longer open - either: the first bounded announcement owner above this formatter family is now - `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, which re-enters the - peer-route candidate builder at `0x004046a0` and later publishes one of the localized - city-connection bonus news strings `2888`, `2890`, or `2921` through the shell news path. -#### Peer-selector side - -The city bonus formatter no longer depends only on - boolean peer existence. The companion helper - `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` is now grounded as the - first-match selector paired with `city_connection_bonus_exists_matching_peer_site`: it walks the - same city-peer candidate set, applies the same site-class table plus the narrower - station-or-transit and linked-instance class-byte flags, and returns one representative matching - peer site id instead of a boolean. `city_site_format_connection_bonus_status_label` reuses that - selector after the note checks so it can recover one linked company context from the selected - peer. The remaining open edge here is therefore above this formatter family, not inside the - peer-scan pair itself. -#### Caller side - -The reusable bridge between the status formatter and the - company news lane is now bounded too. `city_connection_bonus_build_peer_route_candidate` at - `0x004046a0` reuses `city_connection_bonus_select_first_matching_peer_site` with both selector - flags forced on, samples the selected peer's derived coordinates through `0x0047df30` and - `0x0047df50`, and then either tries the shared heavy builder - `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0` or falls - back to the smaller wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` - `0x00404640` before handing the result back to the company-side announcement sweep at - `0x00406050`. The score side of that announcement lane is tighter now as well: - `city_compute_connection_bonus_candidate_weight` at `0x004010f0` provides the per-city opportunity - weight, `company_query_min_linked_site_distance_to_xy` at `0x00405920` provides the nearest - linked-site distance term, `company_count_linked_transit_sites` at `0x00426590` provides one of - the company-side caps, `company_compute_connection_bonus_value_ladder` at `0x00425320` supplies - the bounded company-side value scalar, and - `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580` now bounds the - shared prime-rate-side helper that this lane reuses beside the raw issue-`0x39` total, - `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` now bounds the raw additive - issue-total helper beneath that term, and `company_connection_bonus_lane_is_unlocked` at - `0x00427590` is the small boolean gate above the ladder. Wider governance and CompanyDetail xrefs - now tighten slot `0x2b` into the rolling net-profits lane reused by annual finance checks and a - per-share/history formatter, while the report-history descriptor table now aligns raw slot `0x09` - with the Income Statement fuel-cost lane surfaced by tooltip `1309`. The wider result now reads - more like recent net profits minus recent fuel burden than a governance-pressure term. That now - also sharpens the annual finance lane at `0x00401c50`: the first bankruptcy branch reads as - sustained cash-and-debt stress over recent profits and fuel burden, the later fallback branch as - a deeper `-300000` cash / three bad years cleanup trigger, and the later stock-issue branch reads - as a price-to-book-versus-coupon approval ladder rather than a generic support vote. The tail is - cleaner now too: it compares total retired versus newly issued principal to choose the `2882..2886` - debt headline family, then publishes `2887` separately from the accumulated repurchased-share - count. The sibling news owner above the same - city-pair route family is bounded now too: - `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` - filters and scores candidate city entries, re-enters the same shared heavy builder through - `city_connection_try_build_route_between_region_entry_pair` `0x00404c60` for the dense pair - sweep and the final retry, and then publishes `2889` `%1 has started a new company - the %2` - or `2890` `%1 has connected %2 to %3.` through the shell news path. The remaining open edge on - this branch is therefore narrower now: it is mostly whether `0x39` should be read as the - narrower city-connection public-opinion lane or as part of a broader management-attitude family, - not the ownership of the connection-bonus formatter, peer-route candidate path, or company news - gate. -#### Route-list side - -The neighboring helper - `placed_structure_append_unique_route_entry` at `0x0047f010` is now grounded as the - append-if-missing builder for the six-byte route-entry list rooted at `[site+0x462]` and - `[site+0x466]`. That matters here because the directional overlay query at `0x0047e690` consumes - the same list, so the remaining uncertainty is no longer list ownership. It is down to the exact - semantics of each entry's `u32` payload. -#### Route-entry and Cache Side - -The adjacent helper strip is tighter now too. - `placed_structure_service_candidate_local_service_comparison_cache_decay_and_row_propagation` - `0x0047df70` is the recurring age-and-propagation service pass over the paired comparison-cache - float tables `[site+0x3e]` and `[site+0x112]` with age stamps at `[site+0x1e6]`; it zeroes stale - entries older than `0x1d8800`, decays younger ones by the fixed `0x005ce900/0x005ce8f8` scales, - and then propagates stronger marked row values back through the three five-float row bands rooted - at `[site+0x24/+0x28/+0x2c]`. The wrapper - `placed_structure_query_candidate_route_or_local_service_comparison_score` `0x0047e9a0` is now - bounded too: it delegates to `placed_structure_query_candidate_directional_route_overlay_summary` - `0x0047e690` when the requested candidate carries a grouped routing class, otherwise it uses the - simpler local `[cell+0x103]` lane and the current sample list at `[site+0x34/+0x38]` before - writing back into the same comparison-cache bands. The route-entry strip beneath the linked-peer - family is no longer open either: `placed_structure_resolve_route_entry_anchor_record` - `0x0047f310` is the direct resolver over `[site+0x08]`, and - `placed_structure_route_anchor_matches_or_reaches_route_entry_id` `0x0047f250` is the boolean - gate above it, first checking a direct match against `[site+0x08]` and then re-entering - `0x0048e050(mode 2, fallback -1)` on the resolved route-entry record. The route-link companion - `route_link_route_entry_reaches_peer_site_route_group` `0x0047f2d0` is tighter now too: it reads - the peer site's route-entry anchor from `[peer+0x08]`, resolves the current link's own anchor, - and re-enters `0x0048e3c0` to test whether the two anchors belong to the same reachable - route-side family. One smaller linked-peer-side setter is grounded as well: - `placed_structure_set_overlay_mark_byte_and_refresh_linked_peer_overlay_if_changed` `0x0047f290` - updates byte `[site+0x5bc]` and then re-enters - `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0` when the - byte changes. -#### Terrain-class Side - -The nearby linked-instance raster wrappers are no - longer anonymous. `world_resolve_secondary_raster_class_record_at_float_xy` `0x0044e270` is the - world-side float-XY lookup over `[world+0x2131]` plus class table `0x006cfc9c`; - `placed_structure_query_linked_instance_secondary_raster_class_id` `0x0047f170` is the raw - linked-instance wrapper that returns the shifted class id directly; and the paired - record-returning wrappers `placed_structure_resolve_linked_instance_secondary_raster_class_record` - `0x0047f0e0` and - `placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query` - `0x0047f1f0` now bound the two record-returning lanes used by the later world-side and - linked-peer filters. That means the remaining uncertainty in this neighborhood is no longer the - route-entry or terrain-class helper ownership; it is the broader user-facing meaning of the later - callers that consume those gates. +Moved to: [station-detail-overlay.md](/home/jan/projects/rrt/docs/control-loop-atlas/station-detail-overlay.md) diff --git a/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md new file mode 100644 index 0000000..e3529b5 --- /dev/null +++ b/docs/control-loop-atlas/post-load-generation-paintterrain-and-save-load-restore.md @@ -0,0 +1,652 @@ +# Input, Save/Load, and Simulation: Post-load Generation, PaintTerrain, and Save/Load Restore + +### Post-load Generation, PaintTerrain, and Save/Load Restore + +The same brush strip is tighter now too: + `0x004bc210` stores the selected ordinal and refreshes one scalar caption + from table `0x00621e24`, `0x004bc260` exposes the cached world coordinate pair plus the + currently selected scalar, and `0x004bc290` restyles the ordinal strip `0x0fa1..0x0fa7` plus + the mapped mode strip `0x0faa..0x0faf` against the current mode dword `[0x006d0818+0x8c]`. The + next unresolved layer is narrower and more semantic: the setup side now has one grounded + owner, `world_run_post_load_generation_pipeline`, and its building-side branch is no longer just + one opaque block. We now have a region family, a region-border overlay rebuild, a region-owned + structure-demand and placement dispatcher, and a deeper per-region worker that computes category + demand, subtracts existing coverage, and tries candidate placements. The category map is tighter + too: category `0` falls back to `House`, category `2` is the year-gated weighted region-profile + family that also feeds the localized `Industry Weightings` stats panel, and category `3` now + reaches a separate pool-driven picker whose fallback label is `Commercial` but whose aligned + player-facing stats bucket is `City Support`. The normalized region band is tighter too: + `world_region_normalize_cached_structure_balance_scalars` `0x00422320` no longer just writes an + anonymous cached preview band at `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. Current growth-report + evidence now grounds `[region+0x2e2]` as the weighted-profit-margin scalar and `[region+0x2ee]` + as the annual-density-adjust scalar later formatted as a percent in `Stats - City/Region`, with + `[region+0x2e6/+0x2ea]` left as the intermediate normalized-delta and clamped companion slots + beneath that final adjust term. The per-region prepass feeding that normalization is tighter too: + `0x00420d40` clears `[region+0x306/+0x30a/+0x30e]`, walks the linked placed-structure chain from + `[region+0x383]`, accumulates two local placed-structure metrics through `0x0040ca70` and + `0x0040ca80`, and only for class-0 candidates also folds source field `[source+0x141]` through + `0x0040cec0` into the third accumulator before tailing into the later scalar refresh. That tail + helper `0x00420560` is tighter now too: on class-0 regions it revisits the same linked chain and + folds a class-mix contribution into `[region+0x312]`, with one source-derived term for candidate + class `0`, a separate branch keyed by `[candidate+0x78c]` and `[site+0x246]` for class `2`, one + fixed increment for class `3`, and no current contribution from class `1`. One neighboring + collection-side dispatcher is tighter now too: `0x00433b80` only runs when global mutation depth + `0x0062be40` is back at zero and then conditionally fans into the optional refresh hooks + `0x00481430`, `0x00413860`, `0x004b2a90`, and `0x004931e0`. The periodic boundary + side is narrower now too. `0x00422100`, reached only from + `simulation_service_periodic_boundary_work` `0x0040a590`, first requires several live world + state gates to stay clear, derives one year-sensitive random threshold from selected-year fields + plus world width, then scans the region collection for eligible class-0 regions whose transient + dwords `[region+0x276]` and `[region+0x302]` are both clear and which fail the city-connection + peer probe `0x00420030(1,1,0,0)`. When the gate passes it picks one random eligible region, + derives one small severity bucket from `[region+0x25e]`, stores the scaled amount back into + `[region+0x276]`, and appends one queued `0x20`-byte record through `0x004337c0` with literal + kind `7`, the chosen region id, that amount, the fixed payload `0x005c87a8`, and sentinel dwords + `-1/-1`. That append helper is now grounded directly too: `0x004337c0` allocates one zeroed + linked `0x20`-byte node, copies one string or payload seed into `[node+0x04..]`, stores the six + trailing caller dwords at `[node+0x08..+0x1c]`, and appends the finished node to the singly + linked list rooted at `[state+0x66a6]`. The gameplay label for that queued-record family is still + open, but the structural link from periodic region selection into the scenario-state queue is now + direct instead of speculative. One neighboring narrow counter is bounded too: `0x00422850` + counts class-0 regions that pass a second `0x00420030` peer-probe variant with fixed flags + `(1,1,1)` plus one caller-supplied trailing dword, and current callers are the query/script + dispatch at `0x0042f856` and the later region-stats formatter at + `0x004d2088`. The + remaining setup-side uncertainty has therefore narrowed + again: the region seed and border-overlay pair clearly complete before the `Setting up Players and + Companies...` banner is posted; `[0x006cec74+0x174]` now looks like the direct building-population + gate; `[0x006cec74+0x178]` now looks like the direct seeding-burst gate and selected-year-adjust + policy; and `[0x006cec74+0x68]` now aligns with editor-map mode because the same flag forces the + `.gmp` family in the shell file coordinators while suppressing the later building and seeding + branches and diverting the deeper region worker into alternate logic. One write side for that + `[shell+0x178]` policy is now grounded too: inside `shell_dispatch_ui_command` `0x00464410`, + command ids `0x9d26..0x9d28` store `command_id - 0x9d26` directly into `[0x006cec74+0x178]`, + yielding live values `0`, `1`, and `2`. That means the later restore branch is no longer gated + by an abstract hidden shell latch; at least one of its adjustment inputs is an explicit UI + launch policy and current evidence still does not show that value being recovered from saved + state. The `319` lane itself is no longer the + open structural gap; it now clearly owns chairman-profile slot seeding, profile-record + materialization, a shell editor surface over the same local record family, and a separate + live-company presentation path through the company-list window. The later interior order of that + same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` it + refreshes the auxiliary route-entry tracker collection `0x006cfcb4`, then runs + `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, + then a flagged world-grid cleanup sweep through the compact grid-flag query + `0x00448af0` plus the neighboring local chunk-cell write helper `0x00533fe0`, and only after + that the later route-entry post-pass at `0x00491c20`. The same `319` lane is tighter internally + now too: + before that later world and shell reactivation tail, `world_entry_transition_and_runtime_bringup` + runs one distinct post-bundle status and runtime refresh phase that posts progress ids `0x196` + and `0x197` through `0x005193f0/0x00540120` with paired `0x004834e0` follow-ons, refreshes the + live event collection at `0x0062be18` through + `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`, rebuilds the + scenario-side port-or-warehouse cargo recipe runtime tables through `0x00435630`, and then runs + the named-candidate availability preseed through `0x00437743`. One later subphase is tighter now + too: before the broad world-reactivation sweep it posts progress ids `0x32dc/0x3714/0x3715`, + reloads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged + runtime-profile bytes back into `0x006cec7c` while latch `[profile+0x97]` is set, mirrors the + grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world + bytes `[world+0x66de]` and `[world+0x66f2]`, and restores the selected year/profile lane through + a tighter two-stage calendar path than before. Current local disassembly now shows the raw saved + lane at `[profile+0x77]` first feeding helper `0x0051d3f0` with constant components + `(month=1, day=1, subphase=0, tick=0)`, which writes the resulting Jan-1-style tuple dwords + into `[world+0x05/+0x09]`. Only after that seed does the same lane enter one mode-sensitive + adjustment branch: non-editor startup mode can decrement the lane by `1` or `3` depending on + shell-state editor gate `[0x006cec74+0x68]`, shell-side selected-year-adjust policy + `[0x006cec74+0x178]`, and the saved special-condition slot `[0x006cec78+0x4af7]`, and only that + adjusted lane then feeds + helper `0x0051d390` before `world_set_selected_year_and_refresh_calendar_presentation_state` + `0x00409e80` stores the final absolute counter into `[world+0x15]` and refreshes + `[world+0x0d/+0x11]`. That means the restore no longer reads as a direct + `[profile+0x77] -> [world+0x15]` copy; the raw lane seeds the tuple immediately, but the final + absolute-counter restore still depends on live shell/startup context. That dependency is tighter + now too: current local evidence shows `[shell+0x178] == 1` decrementing the restored lane by + `1`, `[shell+0x178] == 2` subtracting `3`, and otherwise a nonzero + `[0x006cec78+0x4af7]` supplying the fallback `-1` branch. That field is no longer unresolved: + current local disassembly now shows `0x00436d10` bulk-zeroing the dword table rooted at + `[startup+0x4a7f]` through `rep stos`, which includes `+0x4af7`, while the editor-side special + conditions owner at `0x004cb2b0/0x004cb8e0` counts and commits that same 49-entry table from the + static rule descriptors at `0x005f3ab0`. The `.smp` save or restore family now grounds that live + band directly too: `world_runtime_serialize_smp_bundle` `0x00446240` writes `49` dwords from + `[world+0x4a7f..+0x4b3f]` plus one trailing scalar at `[world+0x4b43]`, and + `world_load_saved_runtime_state_bundle` `0x00446d40` restores the same fixed `0xc8`-byte band + symmetrically. Slot `30` in that table is localized pair `3722/3723` + `Disable Cargo Economy`, so `+0x4af7` now reads as the live copy of that saved scenario rule, + not a startup-runtime-only mystery latch. The neighboring fixed reads line up with the same rule + cluster too: `+0x4aef` is slot `28` `Completely Disable Money-Related Things`, `+0x4af3` is slot + `29` `Use Bio-Accelerator Cars`, `+0x4afb` is slot `31` `Use Wartime Cargos`, `+0x4aff` is slot + `32` `Disable Train Crashes`, `+0x4b03` is slot `33` `Disable Train Crashes AND Breakdowns`, and + `+0x4b07` is slot `34` `AI Ignore Territories At Startup`. So the remaining loader gap is + narrower than before: the restore still depends on live shell policy `[shell+0x178]`, but the + `+0x4af7` input itself is save-derived scenario rule data rather than something that requires + runtime tracing to discover. Its read-side family is no longer isolated to the selected-year + restore either: it also shapes the chunk size in + `simulation_run_chunked_fast_forward_burst` `0x00437b20` and appears in candidate/local-service + selection and station-detail-side scoring branches around `0x0047f910`, `0x00410d87`, and + `0x005069c6`, which now makes this whole slot cluster look like broader runtime consumers of + scenario special conditions rather than one startup-only mode enum. One file-side anchor is now + tighter too: the checked classic and 1.05 `gmp/gms/gmx` corpus does expose the same aligned + `0x0d64..0x0e2c` `50`-dword band as the grounded `.smp` runtime save or restore copy into + `[world+0x4a7f..+0x4b43]`, but most checked file families only populate a sparse subset of that + band. The first `36` dwords still behave like the older inferred fixed rule matrix with hidden + slot `35` fixed to sentinel value `1`, while the trailing `13` unlabeled rule lanes plus one + scalar vary much more selectively by file family. Current local corpus scans make that split + concrete: the grounded 1.05 scenario-save family (`p.gms`, `q.gms`) stably lights lanes + `35, 37, 39, 44, 45, 46, 47, 48`; the base 1.05 save family (`Autosave.gms`, `nom.gms`) only + shares lane `35` stably and otherwise varies sparsely through `42`, `45`, and `47`; the checked + grounded 1.05 maps, the lone 1.05 alt save, and the visible sandbox-family `.gmx` files keep + only the sentinel lane `35` nonzero. So the current loader boundary is narrower than before: the + `.smp` path still gives a grounded direct runtime-band restore, and checked `gmp/gms/gmx` files + now show a partially populated projection of that same aligned band rather than a wholly separate + fixed record family. The overlap against the later scalar window is now explicit too: trailing + band indices `36..49` are byte-identical with post-window offsets `0x00..0x34`, so every nonzero + lane in that prefix of the post-sentinel scalar window is also a nonzero lane in the aligned + runtime-rule band. That means the real “other fields” boundary inside the post-sentinel window + starts only at `0x0e2c`: `0x0df4..0x0e2c` is the aligned-band overlap prefix, while + `0x0e2c..0x0f30` is the later tail that still looks like save-side scalar state. Local corpus + scans now make that tail split more specific. The base 1.05 save family + (`Autosave.gms`, `nom.gms`) shares a stable tail subset at relative offsets + `0xb4`, `0xc0`, `0xe0`, `0xfc`, and `0x100`, with additional per-file lanes around them. The + 1.05 scenario-save family (`p.gms`, `q.gms`) has a much denser stable tail covering + `0x08`, `0x0c`, `0x10`, `0x14`, `0x20`, `0x24`, `0x28`, `0x30`, `0x34`, `0x3c`, `0x5c`, + `0x6c`, `0xa0`, `0xa8`, `0xbc`, `0xc0`, `0xc4`, `0xc8`, `0xcc`, `0xdc`, `0xe0`, `0xe4`, + `0xe8`, `0xf4`, `0xf8`, and `0xfc`; those values still differ per save, but the occupancy is + stable. The lone 1.05 alt save (`g.gms`) only lights `0x20`, `0x34`, `0xf0`, and `0xf4`. + Grounded map families and classic saves keep the tail zeroed, while the only current map-side + outlier remains `Tutorial_2.gmp` under the broad unknown map-family bucket. The immediately + following fixed file window at `0x0df4..0x0f30` is now bounded separately as well: checked maps + and classic saves leave that whole post-sentinel band zeroed, + while checked 1.05 saves carry sparse nonzero dwords there, many of which decode cleanly as + normal little-endian `f32` values. That makes the adjacent band look like a 1.05 save-only + runtime band rather than scenario-static payload, even though its semantics are still open. + One numeric alignment inside that band is now exact too: the tail start `0x0e2c` is the same + relative distance from the aligned runtime-rule base `0x0d64` as live object offset `+0x4b47` + is from grounded world-rule base `[world+0x4a7f]`, so the bounded tail window + `0x0e2c..0x0f30` is offset-aligned with live bytes `[world+0x4b47..+0x4c4b]`. The first + grounded live field at that boundary is no longer anonymous. `0x004367c0` sets one outcome mode + in `[world+0x4a73]`, zeros `[world+0x4d]`, snapshots the selected-year lane to `[world+0x4c88]`, + and then copies localized id `2923` `You lose.` or `2924` `You win, cheater...` into + `[world+0x4b47]`; `0x00472dd0` formats localized id `3918` `%1 has won the game!` with one live + profile name and writes that string into the same destination; and one compact runtime-effect + branch inside `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20` resets + the same destination to the fixed placeholder token at `0x005c87a8`. That gives a grounded live + interpretation for the start of the tail: `[world+0x4b47]` is the start of a victory or outcome + status-text buffer, not a float lane. The same evidence also gives a useful caution: those live + helpers copy up to `0x12c` bytes into `[world+0x4b47..+0x4c73]`, so the current bounded file-tail + window `0x0e2c..0x0f30` cuts through the first `0x104` bytes of a grounded text field rather + than ending on a clean live-field boundary. One small continuation probe now tightens that edge: + the remaining file window `0x0f30..0x0f58` is exactly the last `0x28` bytes needed to reach the + clean live-field boundary at `[world+0x4c73]`, and checked 1.05 saves still carry sparse nonzero + bytes in that continuation window rather than a trailing text-looking suffix. Checked 1.05 save + bytes in the aligned region therefore still do not resemble preserved text; they stay mostly zero + at the beginning and many nonzero lanes decode as ordinary `f32` values. So the safest current + note is: the tail is offset-aligned with the live object beyond `+0x4b43`, but it is not yet a + validated byte-for-byte mirror of the live `[world+0x4b47]` status-text buffer, and the current + nonzero save-side content continues right up to the first clean field edge at `0x0f58`. The next + exact grounded fields after that edge are byte lanes, not restored dwords: `0x0f59` maps to + `[world+0x4c74]` `Auto-Show Grade During Track Lay`, `0x0f5d` maps to `[world+0x4c78]` + `Starting Building Density Level`, `0x0f61` maps to `[world+0x4c7c]` `Building Density Growth`, + `0x0f65` maps to grounded dword `[world+0x4c80]` `leftover simulation time accumulator`, and + `0x0f6d` maps to byte `[world+0x4c88]` `selected-year lane snapshot`. The first later grounded + dword after that is `[world+0x4c8c]` at `0x0f71`. That means the simple 4-byte file-lane model + stops matching grounded live field boundaries immediately after the text-buffer edge: the post- + `0x0f58` file bytes are still offset-correlated to live state, but they are no longer naturally + dword-aligned with the next grounded object fields. The new byte-neighborhood probe makes the + mismatch more concrete. In checked 1.05 scenario saves, the exact grounded byte offsets + themselves do not look like clean selector values: `p.gms` carries `0x33` at `0x0f5d` and `0x8c` + at `0x0f6d`, while `q.gms` carries `0xcc` and `0xba` at those same offsets. The only clean + float-looking starts in that neighborhood instead appear one byte earlier, at `0x0f5c` and + `0x0f6c`: `p.gms` decodes those as roughly `7.6` and `6.0172`, while `q.gms` decodes them as + roughly `23.6` and `44.6824`. That tightens the current read further: the checked save bytes + remain offset-correlated to the live `[world+0x4c74..+0x4c8c]` neighborhood, but they are still + not a validated byte-for-byte mirror of the exact live field layout. Local + A second byte-oriented neighborhood immediately after that now has the same kind of split rather + than a clean restored-field mirror. The earlier grounded anchors in that band all stay zero in + the checked 1.05 saves: exact file offset `0x0f87` maps to selected-year bucket companion scalar + `[world+0x4ca2]`, while `0x0f93` and `0x0f97` map to the two startup-dispatch reset-owned bands + `[world+0x4cae]` and `[world+0x4cb2]`, and the local corpus leaves all three exact dword starts + zeroed. The same is true for the later exact byte-owned policy lanes: file offsets `0x0f78`, + `0x0f7c`, `0x0f7d`, and `0x0f7e` map cleanly to grounded byte fields `[world+0x4c93]` and + `[world+0x4c97..+0x4c99]`: the linked-site removal follow-on gate plus the three editor + locomotives-page policy bytes `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All + Electric Locos Avail.`. In the checked 1.05 save corpus those four exact byte lanes all stay + `0`, which is at least structurally clean. The later grounded dword fields in the same + neighborhood are less direct again. Exact file offset `0x0f9f` maps to `[world+0x4cba]` (the + station-list selected-station mirror) and exact offset `0x0fa3` maps to cached + available-locomotive rating `[world+0x4cbe]`, but the checked save bytes at those exact dword + starts do not look like clean preserved ids or floats. The only stable float-looking starts sit + three bytes earlier, at `0x0f9c` and `0x0fa0`: `p.gms` yields roughly `96.8754` and `186.4795`, + `q.gms` yields `329.9467` and the same `0x0fa0`-side candidate shape, `g.gms` yields `7.0` and + `95.8507`, and `Autosave.gms` only shows the later `0x0fa0` candidate at about `68.2629`. So + this later band now has the same conservative read as the post-text one: the save bytes are + still offset-correlated to grounded live fields, but the exact live byte or dword layout is not + yet validated as a direct on-disk mirror. + One more structural cut is now grounded beyond that neighborhood. The aligned scalar plateau + `0x0fa7..0x0fe7` ends exactly at the later recipe-book root `[world+0x0fe7]` already grounded in + the port-or-warehouse cargo editor and runtime rebuild path. We still do not have live semantic + names for the plateau itself, but its aligned dword run now splits cleanly by save family. The + base 1.05 saves (`Autosave.gms`, `nom.gms`) carry one stable signature with + `0x0faf = 0x8000003f`, `0x0fb3 = 0x75c28f3f`, repeated `0x75c28f3c` lanes through `0x0fbf`, a + sign-flipped lane `0x0fc3 = 0xa3d70a3c`, one tiny marker at `0x0fc7 = 0x0000003b`, and + `0x0fcb = 0x00300000`. The scenario-save family (`p.gms`, `q.gms`) carries a different stable + plateau over the same offsets, beginning `0x0faf = 0x4000003f`, `0x0fb3 = 0xe560423f`, then + `0x03126f3b`, `0x1374bc3c`, and paired `0x23d70a3c` lanes at `0x0fbf/0x0fc3`, with + `0x0fc7 = 0x0000003c`. The alt-save family (`g.gms`) follows the base signature through + `0x0fc7`, then diverges sharply into the same `0xcdcdcd..` fill pattern already seen in its + earlier header lanes. So the current best fit for `0x0fa7..0x0fe7` is a family-shaped aligned + scalar plateau that belongs to save-side runtime state and terminates immediately before the + grounded recipe-book block, not one more directly named live-field mirror. One conservative + loader-side summary probe now starts exactly at that recipe root instead of extending the plateau + model further. The fixed recipe-book block spans twelve books from `0x0fe7` with stride `0x4e1`, + and the checked map/save pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> + p.gms`, and `Spanish Mainline.gmp -> g.gms` preserve that rooted block byte-for-byte in the + sampled local corpus. The current probe therefore treats it as preserved scenario payload rather + than save-only runtime drift and only reports per-book signatures: a coarse head kind over the + pre-line region, the raw `book+0x3ed` annual-production dword, and one raw summary for each of + the five fixed `0x30`-byte cargo lines beginning at `book+0x3f1`: coarse line kind, raw mode + dword, raw annual-amount dword, and the raw supplied/demanded cargo-token dwords at `+0x08` and + `+0x1c`. That is enough to separate zero, `0xcd`-filled, and mixed books or lines without + overstating line semantics beyond the grounded editor/runtime ownership already documented below. + Local + corpus clustering now makes the remaining split more specific. The base 1.05 save family + (`Autosave.gms`, `nom.gms`) shares a narrow tail-heavy subset with stable relative offsets + `0xec`, `0xf8`, `0x118`, `0x134`, and `0x138`, while still varying in value across files. The + 1.05 scenario-save family (`p.gms`, `q.gms`) shares a much broader stable set spanning almost the + whole window from `0x04` through `0x134`, again with per-file scalar differences but consistent + occupancy. Pairwise compare runs tighten that read further: `Autosave.gms` vs `nom.gms` does not + preserve one common numeric tail signature even at the shared base-save offsets, and `p.gms` vs + `q.gms` keeps the broad scenario-save occupancy pattern but still changes every shared value, with + `q.gms` additionally lighting two extra lanes at `0x78` and `0x84`. So the current best fit is + “family-shaped live scalar state” rather than family-default constants. The lone 1.05 alt-save + sample (`g.gms`) only lights up four lanes at `0x58`, `0x6c`, + `0x128`, and `0x12c`. The checked 1.05 maps and classic saves stay zero in that same bounded + window, which strengthens the current read that this is runtime-save scalar state rather than + generic map payload. One older unknown map-family outlier in the local corpus does still carry a + populated window: `Tutorial_2.gmp` under the classic install tree. So the safest current note is + “zero for grounded map families and classic save families, nonzero for observed 1.05 save + families, with one older unknown-map exception.” Static consumer grounding is still sparse for + that tail: direct object-offset hits currently only name the trailing scalar `[world+0x4b43]` + through the editor panel and `.smp` save or restore family, while local opcode searches do not + yet surface equally direct reads for the intervening `+0x4b0b..+0x4b3f` tail lanes. So the + save-file family clustering is now strong, but those later tail scalars remain structurally + bounded rather than semantically named. The + same branch is no longer world-entry-only either: current local + disassembly now shows the identical lane-adjust and + `0x51d3f0 -> 0x51d390 -> 0x409e80` sequence in the post-fast-forward selected-year tail at + `0x004370e0`, which lines up with the existing post-fast-forward callers already mapped under + `0x00433bd0`, `0x00435603`, `0x0041e970`, and `0x00436af0`. That restore now + also has some neighboring slot semantics bounded well enough to carry in the loader notes. Slot + `31` `[0x006cec78+0x4afb]` is no longer best read as an unnamed runtime cargo-economy latch: + local disassembly now ties it directly to the saved special-condition table entry `Use Wartime + Cargos`, and the strongest current runtime owner is + `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Inside that + candidate-collection sweep the branch at `0x0041ed37` only activates when slot `31` is set and + then treats the string family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and + `Diesel` as one special cargo set before writing the live candidate filter byte `[entry+0x56]`. + That makes the old read-side note around `0x00412560` tighter too: the neighboring descriptor + gate is now best understood as using the live copy of the `Use Wartime Cargos` scenario rule, + not an anonymous cargo-economy mode byte. Slot `34` `[0x006cec78+0x4b07]` is similarly bounded + on the runtime side: the wrapper at `0x004013f0`, which sits immediately above the broader + company-start or city-connection chooser `0x00404ce0`, snapshots region dword `[entry+0x2d]` + across all `0x18` live region records in `0x006cfc9c`, zeros that field while the chooser runs, + and then restores the original values on exit. That is a strong current fit for the editor rule + `AI Ignore Territories At Startup`, even though the exact meaning of region field `+0x2d` + remains open. Slot `29` `[0x006cec78+0x4af3]` is less semantically tidy but still worth carrying + as a bounded consumer family: the branch at `0x0041d286` activates one later placed-structure or + building-side scoring path only when that slot is nonzero and the linked candidate or era record + at `[entry+0x41]` equals `5`, while two already-grounded world helpers + `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` and + `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670` also gate on the same + slot. So the identity of slot `29` as saved rule data is grounded, but the downstream runtime + semantics are still mixed enough that the loader should preserve the raw value without trying to + rename its whole consumer family yet. The neighboring train-safety slots are now bounded enough + to keep as a cautious runtime split too. Slot `33` `[0x006cec78+0x4b03]` + `Disable Train Crashes AND Breakdowns` is the coarse gate in the currently recovered train-side + deterioration family around `0x004af8a0`: the very first branch at `0x004af8ab` jumps straight + to the function tail when the slot is set, bypassing the year-scaled threshold build, the later + random or threshold comparison, and the two follow-on state transitions at `0x004ad7a0` and + `0x004ada00`. Slot `32` `[0x006cec78+0x4aff]` `Disable Train Crashes` is narrower in the same + family: after the threshold path has already run, the branch at `0x004af9c1` uses slot `32` to + suppress only the lower failure-transition path and force the milder follow-on at `0x004ada00`. + That same slot-`33` read also appears in the smaller train-side scalar query at `0x004ac460`, + where setting it returns one fixed float immediately before the ordinary route-object-dependent + calculation runs. So the current best loader-facing read is: slot `33` is the broad train + deterioration bypass, slot `32` is the narrower crash-only branch inside that same family, but + the exact player-facing names of the two unnamed train helpers still need one more naming pass. + That restore now + also has one concrete file-side correlation in the classic `.gms` family: local save inspection + now consistently finds `0x32dc` at `0x76e8`, `0x3714` at `0x76ec`, and `0x3715` at `0x77f8` in + `Autosave.gms`, `kk.gms`, and `hh.gms`, leaving one exact `0x108`-byte span from `0x76f0` to + `0x77f8` between `0x3714` and `0x3715`. That span already carries staged-profile-looking payload + text such as `British Isles.gmp`, so the current static-file evidence now supports the atlas-side + `0x108` packed-profile note for the classic save family even though the exact field layout inside + that block is still unresolved. The same classic corpus is tighter now too: inside that + `0x108` span the map-path C string begins at relative offset `0x13`, the display-name C string + begins at `0x46`, the block is otherwise almost entirely zeroed, and the three local samples are + byte-identical except for the leading dword at `+0x00` (`3` in `Autosave.gms` and `hh.gms`, + `5` in `kk.gms`). The currently atlas-tracked bytes `[profile+0x77]`, `[profile+0x82]`, + `[profile+0x97]`, and `[profile+0xc5]` are all `0` in that classic sample set, so the current + file-side evidence grounds the block boundaries and the embedded strings but does not yet show + live examples of those branch-driving latches being set. One 1.05-era file-side analogue is now + visible too, but only as an inference from repeated save structure rather than a disassembly-side + field map: local `.gms` files in `rt3_105/Saved Games` carry one compact string-bearing block at + `0x73c0` with the same broad shape as the classic profile slab, including a leading dword at + `+0x00`, one map-path string at `+0x10`, one display-name string at `+0x43`, and a small + nonzero tail around `+0x76..+0x88`. In that 1.05 corpus the analogue bytes at relative `+0x77` + and `+0x82` are now nonzero in every checked sample (`Autosave.gms`/`nom.gms` show `0x07` and + `0x4d`; `p.gms`/`q.gms` show `0x07` and `0x90`; `g.gms` shows `0x07` and `0xa3`), while + relative `+0x97` and `+0xc5` remain `0`. The compared 1.05 save set is tighter now too: + `Autosave.gms` and `nom.gms` cluster together on `Alternate USA.gmp` with `+0x82 = 0x4d`, + `g.gms` carries `Spanish Mainline.gmp` with `+0x82 = 0xa3`, and `p.gms`/`q.gms` cluster on + `Southern Pacific.gmp` with `+0x82 = 0x90`; across all five files the same inferred analogue + lane at `+0x77` stays fixed at `0x07`, while the same map- or scenario-sensitive tail word at + `+0x80` tracks those `0x4d/0xa3/0x90` byte lanes (`0x364d0000`, `0x29a30000`, `0x1b900000`). + The leading dword at `+0x00` also splits the same corpus, with `Autosave.gms` alone at `3` and + the other four checked 1.05 saves at `5`. That is enough to say the wider save corpus does + contain nonzero candidates for two of the atlas-tracked profile lanes, and that one of them + varies coherently with the loaded scenario family, but not yet enough to claim that the 1.05 + block reuses the exact same semantic field assignments as the classic one. The loader-side + family split is tighter now too: `p.gms` and `q.gms` no longer live under a generic fallback; + their save headers now classify as one explicit `rt3-105-scenario-save` branch with preamble + words `0x00040001/0x00018000/0x00000746` and the early secondary window + `0x00130000/0x86a00100/0x21000001/0xa0000100`, while `g.gms` now classifies as a second + explicit `rt3-105-alt-save` branch with the different preamble lane + `0x0001c001/.../0x00000754` and early window + `0x00010000/0x49f00100/0x00000002/0xa0000000`. That branch now carries the same bootstrap, + anchor-cycle, named 1.05 trailer, and narrow profile-block extraction path as the other 1.05 + saves. The bridge just below that trailer is now explicit too: the common 1.05 save branch + carries selector/descriptor `0x7110 -> 0x7801` in `Autosave.gms` and `0x7110 -> 0x7401` in + `nom.gms`, and both still reach the same first later candidate at + `span_target + 0x189c`, well before the packed profile at `span_target + 0x3d48`; the + `rt3-105-alt-save` branch instead carries `0x54cd -> 0x5901` and its first later candidate + lands at `packed_profile + 0x104`, essentially on the profile tail; the scenario-save branch + still diverges locally with `0x0001 -> 0x0186` and never enters that later `0x32c8`-spanned + bridge at all. The common-branch bridge payload is narrower now too: both checked base saves + expose the same 0x20-byte primary block at `0x4f14` followed by the same denser secondary block + at `0x671c`, `0x1808` bytes later, and that secondary block now appears to run intact up to the + packed-profile start at `0x73c0` for a total observed span of `0xca4` bytes. The trailing slice + of that secondary block is now typed one level further: a small header at `secondary+0x354` + carries the observed stride `0x22`, capacity `0x44`, and count `0x43`, followed by a fixed-width + 67-entry name table starting at `secondary+0x3b5` and running through names like + `AluminumMill`, `AutoPlant`, `Bakery`, `Port00..11`, and `Warehouse00..11`, with a short footer + (`dc3200001437000000`) after the last entry. The trailing per-entry word is now surfaced too: + most entries carry `0x00000001`, while the currently observed zero-trailer subset is + `Nuclear Power Plant`, `Recycling Plant`, and `Uranium Mine`. That footer is tighter now too: + it parses directly as `0x32dc`, `0x3714`, and one trailing zero byte, so the shared + map/save catalog currently ends on the same two grounded late-rehydrate progress ids that the + classic staged-profile band already exposed. The strongest structural read is therefore that the + entire `0x6a70..0x73c0` catalog region is shared verbatim between `Alternate USA.gmp` and the + derived `Autosave.gms`, not rebuilt independently during save. Combined with the earlier + grounded record-layout work under `0x00437743`, `0x00434ea0`, and `0x00434f20`, the current + safest semantic read is that this shared catalog is the bundled source form of the scenario-side + named candidate-availability table later mirrored into `[state+0x66b2]`, with each entry's + trailing dword now reading as the same availability override bit later copied into + `[candidate+0x7ac]`. The loader-side coverage is tighter now too: the same table parser now + attaches both to the common-save bridge payload and directly to the fixed source range in + `.gmp` files and the non-common `rt3-105-scenario-save` / `rt3-105-alt-save` branches. That + makes the scenario variation explicit instead of anecdotal. `Alternate USA` keeps only three + zero-availability names in this table (`Nuclear Power Plant`, `Recycling Plant`, `Uranium + Mine`), `Southern Pacific` widens the zero set to twelve (`AutoPlant`, `Chemical Plant`, + `Electric Plant`, `Farm Rubber`, `FarmRice`, `FarmSugar`, `Nuclear Power Plant`, `Plastics + Factory`, `Recycling Plant`, `Tire Factory`, `Toy Factory`, `Uranium Mine`), and `Spanish + Mainline` widens it again to forty-two, including `Bauxite Mine`, `Logging Camp`, `Oil Well`, + `Port00`, and the `Warehouse00..11` run while also flipping `Recycling Plant` back to + available. The header lanes just ahead of the table vary coherently with those scenario + branches too: `Alternate USA` carries `header_word_0 = 0x10000000`, `Southern Pacific` + carries `0x00000000`, and `Spanish Mainline` carries `0xcdcdcdcd`, while the structural + fields from `header_word_2` onward remain stable (`0x332e`, `0x1`, `0x22`, `0x44`, `0x43`) + and the 9-byte footer still decodes as `0x32dc`, `0x3714`, `0x00` in all three checked maps. + A wider corpus scan over the visible `.gmp`/`.gms` files makes those two anonymous header + lanes less mysterious too: the parser currently sees only three stable + `(header_word_0, header_word_1)` pairs across 79 files with this table shape, namely + `(0x00000000, 0x00000000)`, `(0x10000000, 0x00009000)`, and + `(0xcdcdcdcd, 0xcdcdcdcd)`. The zero-availability count varies widely underneath the first and + third pairs (`0..56` under the zero pair, `14..67` under the `0xcdcdcdcd` pair), so those two + lanes no longer look like counts or direct availability payload; the safest current read is + that they are coarse scenario-family or source-template markers above the stable + `0x332e/0x22/0x44/0x43` table header, with `0xcdcdcdcd` still plausibly acting as one reused + filler or sentinel lane rather than a meaningful numeric threshold. Current exported + disassembly notes still do not ground one direct loader-side or editor-side consumer of + `header_word_0` or `header_word_1` themselves, so that family-marker read remains an + inference from corpus structure rather than a named field assignment. + The new loader-side compare command makes the save-copy claim sharper too: for the checked + pairs `Alternate USA.gmp -> Autosave.gms`, `Southern Pacific.gmp -> p.gms`, and + `Spanish Mainline.gmp -> g.gms`, the parsed candidate-availability table contents now match + exactly entry-for-entry, with the only reported differences being the outer container family + (`map` vs `save`) and source-kind path (`map-fixed-catalog-range` vs the save-side branch). + has the explicit companion `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, which + rebuilds the dependent selected-year bucket floats after the packed year changes; and then + rehydrates the named locomotive availability collection at `[world+0x66b6]` through + `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`. + That locomotive-side restore is tighter now too: its tail explicitly re-enters + `scenario_state_refresh_cached_available_locomotive_rating` `0x00436af0`, which rebuilds one + cached available-locomotive rating at `[state+0x4cbe]` from the current year plus the strongest + surviving available locomotive-side rating scalar `[loco+0x20]`, and the tiny query sibling + `0x00434080` is now bounded as the shell-side clamped read helper over that same cached field, + with the grounded shell-side reader later bucketing that value against `40/50/70/85/100`. The + same rehydrate band also refreshes the live structure-candidate filter and year-visible counts + through `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, + rebuilding the paired per-slot bands at `[candidates+0x246]` and `[candidates+0x16e]` and the + aggregate counts at `[candidates+0x31a]` and `[candidates+0x242]`; the same late checkpoint also + re-enters `placed_structure_collection_seed_candidate_subtype2_runtime_latch` `0x00434d40`, + which seeds runtime dword `[candidate+0x7b0]` across subtype-`2` candidate records before the + later world-wide reactivation sweep. That checkpoint also now has an explicit shell-facing scalar + publisher: `world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides` + `0x004354a0` writes one clamped `0..255` value into the current shell presentation object, + sourcing it either from the shell selector override pairs or from the scenario-side year-threshold + band rooted at `[state+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`; and just ahead of the later + scenario-side recipe rebuild, the same band also re-enters + `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, which only falls into its + heavier rebuild body while `[state+0x3a] < 2` and otherwise leaves the derived year-threshold + companion slots `[state+0x51/+0x55/+0x59/+0x5d/+0x61]` unchanged. The neighboring late status + checkpoints around progress ids `0x196` and `0x197` also share one explicit stage gate now: + `world_query_global_stage_counter_reached_late_reactivation_threshold` `0x00444dc5` compares the + global counter `0x00620e94` against threshold `0x9901`, and the two current callers use a + negative result to clear `[world+0x39]` before the broader world and shell reactivation sweep. + The later reactivation tail is tighter now too: it includes the region-center world-grid flag + reseed pass + `0x0044c4b0`, which clears bit `0x10` across the live grid and then marks one representative + center cell for each class-`0` region through `0x00455f60`; its immediate sibling `0x0044c450` + then reruns `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` across every + live grid cell. The small secondary-raster premark helper `0x0044c570` is bounded now too: it + only admits cells whose current raster byte has no bits in mask `0x3e` and whose parallel class + query `0x00534e10` is false, then rewrites that masked class field to `0x02` and widens the same + cached bounds-and-count band `[world+0x21c6..+0x21d6]`. The next helper `0x0044ce60` scans the secondary raster at `[world+0x2135]` + for cells with any bits in mask `0x3e`, caching min/max bounds plus a marked-cell count in + `[world+0x21c6..+0x21d6]`; the larger sibling `0x0044c670` then consumes those cached bounds to + normalize the same raster and rebuild one dependent overlay/cache surface before the later + route-style rebuild, shell-window, and briefing branches. That overlay side is tighter now too: + after `0x0044c670` resolves scaled surface dimensions through `0x00534c50`, it walks one local + `3 x 32` sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only + secondary-raster classes `4..0x0d`, folds several interpolated `0x0051db80` samples into one + strongest local score, writes packed overlay pixels into the staged surface buffer, and only then + publishes that staged overlay through `0x00534af0`. The lower helper layer under that overlay + pass is tighter now too: `0x00534e10` is the reusable secondary-raster class-set + predicate for classes `1/3/4/5`, `0x00534e50` is the smaller neighboring class-subset predicate + for `1/4`, `0x00534ec0` covers `2/4/5`, `0x00534f00` covers `3/5`, `0x00534e90` is the + marked-bit query over the same 3-byte cell family, and the nearby local counter `0x0044bdb0` + is now bounded as the 8-neighbor count companion for that same `2/4/5` subset, walking the + shared `0x00624b28/0x00624b48` offset tables and re-entering `0x00534ec0` on each bounded + neighbor cell. The first caller cluster around `0x0044bf9d..0x0044c37b` therefore reads as a + secondary-raster neighborhood service band rather than a generic map scan. + `0x00533e70` and `0x00534160` are the coarser siblings over the overlay table at `[world+0x1685]`: + the first clears coarse chunk objects across one clamped rectangle, while the second ensures one + chunk object and seeds local marks through its deeper stamp helper. One level up, the neighboring + rect owner `0x005374d0` now reads as the shared secondary-overlay refresh pass: it reruns the + local sample and unsigned-word reducers `0x00536230/0x00536420`, rebuilds the signed vector byte + planes through `0x00536710`, and then rebuilds the multiscale support surfaces through + `0x00533890`, whose inner reducers now explicitly target the packed sample-triplet buffer plus + the float and unsigned-word support planes rooted at the five-entry per-scale families + `[world+0x15f1..+0x1601]`, `[world+0x1605..+0x1615]`, and `[world+0x1619..+0x1629]`. The setup + side of that same family is tighter now too: + `0x005375c0` is the shared ensure-and-seed owner that allocates the sample, sidecar, mask, + raster, vector, and coarse-cell tables together; crucially, it seeds `[world+0x1655]` with byte + `0x02` and `[world+0x1659]` with byte `0x01`, which closes the default-fill split. The local + component-walk owner under the same neighborhood band is tighter now too: `0x0044c200` + allocates a temporary `width*height` visit bitmap at `0x0062c128`, seeds one class-`2/4/5` + starting cell, derives an initial direction index through the remap table `0x005ee5d4`, and then + fans into the deeper recursive walker `0x0044be20`. That deeper walker widens dirty bounds + `[world+0x21ad..+0x21b9]`, stamps one companion-word orientation lane through `0x005ee5cc`, + reuses `0x00534ec0` plus `0x0044bdb0` to filter admissible neighbors, tracks temporary + visitation in `0x0062c128`, and then applies the local byte-1 edge-bit `0x04/0x08` updates + before returning. So the `0x0044bf9d..0x0044c422` cluster now reads as a real connected-component + walk plus edge-flag refresh layer over the secondary raster rather than only a loose group of + local neighbor counters. The adjacent mutation strip is tighter now too: `0x0044dcf0` refreshes + companion-word bit `0x200` in one local rectangle by checking whether any neighbor belongs to + class set `2/4/5`, while `0x0044df10` clears three local sidecar byte planes, demotes class `4` + to `1` and class `5` to `3`, and then reruns that marked-bit refresh over the surrounding + `+/-1` window. One level up, `0x0044e500` is the rect-wide owner that recomputes byte-1 edge + bits `0x04/0x08` for class-`2/4/5` cells, dispatches `0x0044df10` on incompatible local + patterns, and finally consumes the pending global seed pair at `[0x006d1304+0x78/+0x7c]` + through `0x0044c200`. The shell-side owner of that pending pair is tighter now too: + `[0x006d1304]` is the live `PaintTerrain.win` shell singleton while the callback-heavy side also + keeps a second rooted pointer at `0x006d1334`; the tool constructor snapshots the broader + terrain-paint state into both families while the world-side raster owner still only consumes + `[0x006d1304+0x78/+0x7c]` as one pending component-seed pair. Its radial sibling `0x0044e7d0` + is narrower: + after validating world-space + coordinates through `0x00414bd0`, it stamps class-`2` marks into the secondary raster by walking + one clamped bounding box and admitting cells only when the radial falloff helper `0x0051db80` + stays positive before re-entering `0x0044c570`. The two small support predicates under that same + strip are now explicit too: `0x00414bd0` is the float grid-bounds gate, and `0x00449df0` is the + integer rectangle clamp-and-validity helper shared by the local mutation owners. One level up, + the broader rect-scoped owner is tighter now too: + `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` + first reclamps the caller rectangle through `0x00449df0`, reruns the local edge-refresh owner + `0x0044e500`, lazily ensures one presentation target through + `0x0051f090/0x00534910/0x00534920/0x00534930`: the first helper resolves the shared + world-presentation owner, `0x00534910/0x00534920` expose the current staging flag and buffer + root, and `0x00534930` captures one normalized-bounds rect into that staging buffer before the + later publish step `0x00534af0`. The same family then resolves scaled target dimensions through + `0x00534c50` before allocating one temporary `width*height` mask. Its main scan then + walks the live secondary raster `[world+0x165d]` through the same class predicates + `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four + sidecar byte planes `[world+0x1631..+0x163d]`, while the broader per-cell pass writes packed + values into the ensured target through `0x00534730` and also updates nibble lanes at byte offsets + `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it + notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the + temporary mask, expands the caller rectangle by dirty bounds `[world+0x21ad..+0x21b9]` through + `0x00536710`, and finally seeds companion byte `[world+0x162d]` with `0xc4` on cells selected + from mask plane `[world+0x1655]`. So the `0x0044e500 -> 0x0044e940` band is now a real + derived-surface and companion-plane rebuild family rather than only a loose collection of local + raster mutations. The local + evidence now also supports a stronger negative conclusion: unlike `[world+0x1655]`, that second + mask plane is not part of the actively rebuilt runtime overlay path, and in the grounded local + corpus it behaves only as a separately seeded, cleared, and persisted sibling plane. One level + lower, the + base-plane allocator `0x00532c80` now reads more cleanly too: it is the narrower owner that + clears `[world+0x15e1]`, optionally applies the current grid dimensions, allocates the base + float-summary plane `[world+0x1605]`, the four sidecar byte planes `[world+0x1631..+0x163d]`, + both one-byte mask planes `[world+0x1655/+0x1659]`, and the packed secondary raster + `[world+0x165d]`, then seeds those planes with the same `0x02/0x01/0x00` default split. The + load-side owner for those same planes is tighter now too: the constructor thunk `0x0044e910` + immediately feeds the heavier payload body `0x0044cfb0`, which reads the rooted chunk families + `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, allocates the core world-grid + and secondary-raster arrays `[world+0x2129..+0x2141]` plus the route-entry collection + `0x006cfca8`, initializes every grid-cell record through `0x0042ae50`, and only then hands off + into `world_compute_transport_and_pricing_grid` `0x0044fb70`, the neighboring presentation + refresh `0x00449f20`, and the shell-mode pulse `0x00484d70`. So the `0x0044e910 -> 0x0044cfb0` + load side is now bounded as the heavy world-grid and secondary-raster bundle-load body rather + than just another anonymous constructor tail. One + level higher again, the broader world-presentation reinitializer `0x00537e60` now sits above + that base allocator and the larger support-family ensure path `0x005375c0`: it stores the live + grid dimensions, hard-resets the whole overlay runtime family through `0x00532590`, + and that reset strip is no longer opaque either: the immediately preceding local helpers + `0x00532310..0x00532550` now bound one compact overlay-local state family under the same owner. + `0x00532310/0x00532360/0x00532370/0x00532380` own the seven-dword companion block + `[world+0x15b5..+0x15cd]` together with live flag byte `[world+0x15b4]`; `0x005323f0`, + `0x00532460`, and `0x00532490` are the ensure, publish, and query strip for cached surface root + `[world+0x478]` using saved dimensions `[world+0x159c/+0x15a0]`; `0x005324e0/0x00532500` are the + live-flag setters for `[world+0x159b]`; `0x00532510` is the direct setter for mode byte + `[world+0x159a]`; and `0x00532520/0x00532550` own the four-dword saved dimension quad + `[world+0x15a4..+0x15b0]`. So the broader `0x00532590` reset really does sit at the base of a + concrete local cached-surface and companion-block owner family, not just a pile of unrelated + presentation fields. The reinitializer then + reinitializes the secondary-overlay family for those dimensions, and then republishes the + neighboring overlay constants and support owners used by both the world-side reattach branch and + the `.smp` restore-side presentation rebuild path, including several owners that all funnel + through the shared static-template slot allocator `0x00532ad0` over the local `0x100` pointer + band at `[world+0x08]`. Those neighboring owners are tighter now too: `0x00535070` is the small + primary overlay-surface-or-template setup owner; `0x00535100` is the heavier requested-dimension + apply and four-slot overlay-surface rebuild owner used by the setup-side regenerate branch and + the load-side bundle path; while `0x005356e0` and `0x00535890` seed two + larger static-template slot bands rooted at `[world+0x1568/+0x156c/+0x1574/+0x1578]` and + `[world+0x1560/+0x1564]` respectively; the remaining heavier sibling `0x00535430` now reads as a + shared four-slot overlay-surface rebuild owner that resamples one source or fallback descriptor + into a short local slot strip above `[world+0x155c]`. The immediate helper strip under that same + family is tighter now too: `0x00534f60` is the small presentation-owner base init above + `0x00532590`; `0x00534f80` releases one transient surface handle at `[world+0x478]` and clears + byte `[world+0x159b]`; `0x00532760` releases the current overlay slot chosen by selector + `[world+0x1558]`; `0x005327a0` clamps two requested surface dimensions down to supported + power-of-two sizes while also enforcing shell display caps from `[0x006d4024+0x114243/+0x114247]`; + `0x00532860` is the local twelve-slot stitching pass over the parallel bands rooted at + `[world+0x08/+0x0c/+0x18]`, copying terminal rows and edge dwords between those sibling slot + surfaces before finalizing the primary band through `0x00541c10`; + `0x00532960` is the adjacent paired projection helper that maps two caller counters through the + current `16x16` and `4x4` rounded grid quanta and writes the resulting coarse offsets back to two + out-pointers; + `0x005329e0` maps one `(x,y)` pair into a `1`-based coarse `4x4` overlay region id using the + current rounded grid dimensions; `0x00532a30` is the direct getter for local dword `[world+0x1554]`, + which still reads only as the live count or tag for this overlay slot band; + `0x00532a40` and `0x00532aa0` are the time-selected query helpers over the first and second + template-seeded slot bands rooted at `[world+0x1568/+0x156c]` and `[world+0x1560/+0x1564]`; and + `0x00532a90` is the direct getter for trailing fallback slot `[world+0x1578]`. The next adjacent + owner is tighter now too: `0x00532b30` is the shared release/reset path for the local overlay + slot band at `[world+0x08]`, with a split release policy keyed by shell flag + `[0x006d4024+0x11422e]` and a special forced-direct range for slot ids `1..0x10`, after which it + clears band fields `[world+0x1554/+0x1568/+0x1570/+0x155c/+0x1560/+0x1564]`. The tail of that + same reinitializer is tighter one level up too: `0x00527ce0` is the broader ensure owner that + watches current grid extents plus world tag `[world+0x2121]`, re-enters `0x00532860` when those + cached values change, rebuilds or releases local helper `[this+0x65]`, and then clears the two + large global scratch planes rooted at `0x008f2520` and `0x00b33530`. The tail of that same + reinitializer is + tighter now too: after the larger support-family setup it seeds one seven-entry default overlay + companion set through `0x005373b0`, whose inner allocator `0x00535950` populates the local + `0x1b`-entry slot table from the static template rows `0x005dd300..0x005dd378`. The lifecycle + side is tighter in the same way now: `0x00536044` is the shared teardown owner that frees those same + three five-entry support families together with both mask planes, the packed secondary raster, + the vector-byte planes, the local staging buffer, and the neighboring sidecar or coarse-cell + tables. The remaining base-float lane is tighter too: the larger rebuild owner + `0x00538360` now clearly writes one base float-summary field into `[world+0x1605]`, clears both + one-byte mask planes, and then only repopulates the primary mask plane `[world+0x1655]` for the + qualifying class-`1` interior cells before re-entering `0x00532d90` to normalize that base + float-summary plane globally and `0x00532f60` to expand positive cells through one caller radius. + That asymmetry is now enough to close the local semantic edge: `[world+0x1655]` is the actively + rebuilt primary overlay mask, while `[world+0x1659]` is only the separately seeded and persisted + secondary mask sibling with no comparably grounded distinct read-side consumer. The only grounded + getter call to its root accessor `0x00533b60` is the shell staging branch at `0x00525bad`, and + that branch immediately discards the returned pointer. The bundle side is now explicit too: + `.smp` save-load treats the two mask planes as separate payloads with chunk ids `0x2cee` for + `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, while the neighboring `0x2d49/0x2d50` + branches are the separate packed secondary-raster import lanes rather than alternate consumers + of the second mask plane. So, in the mapped local code, `0x1659` is best treated as a persisted + compatibility or seed-state sibling, not as a second actively consumed runtime overlay mask. The + transport/pricing preview side is tighter now too: `0x00538060` sits directly beneath + `0x0044faf0`, first seeds one preview handle through `0x00535430` using the short `C_` + descriptor, temporarily overrides shell globals + `[0x006d4024+0x11423b/+0x11423f/+0x114254/+0x114255]`, and then loads `%1.tga` through + `0x0053c1c0 -> 0x00541970`. It clamps that sampled image into the `0x401 x 0x401` range, + rewrites `[world+0x1605]` plus the mask/raster family `[world+0x1655/+0x1659/+0x165d]` from the + sampled pixels, optionally re-enters `0x00532d90/0x00532f60`, republishes the seeded preview + handle through `0x0053c000`, and then re-enters `0x005375c0(1, 0, 0)`. The small shell-global + owner it also touches is tighter now too: `0x006d401c` is constructed by `0x00538640`, + `0x005386e0` publishes the primary timed text lane, `0x005387a0` publishes the secondary fixed + `10000` ms lane, `0x00538810` finds the first registered shell window containing one child + control id by walking each window through `0x0053f830`, and `0x00538840/0x00538880/0x00538890` + manage the owner's local `1000`-slot active-token table keyed by child control id. The adjacent + list strip is tighter too: `0x00538990` is the registered-window virtual-slot-`0` gate that + stops on the first zero return, `0x005389c0` is the shared unlink helper for the same doubly + linked list rooted at `[owner+0x00/+0x04]`, `0x00538a60` is the zero-counter gate over + `[owner+0xc60]`, `0x00538a70` is the matching full reset-and-release body used during bootstrap + teardown, and `0x00538a10/0x00538a20/0x00538a30/0x00538a40` are the direct getter, setter, + increment, and clamped decrement helpers for the owner's scalar lanes `[+0xc5c]` and `[+0xc60]`. + The next shell-runtime strip is tighter now too: `0x005388d0` is the shared `12`-dword + descriptor dispatcher with the optional override validator at `[owner+0xc75]` and the recursive + `kind 6 -> 0xb7` rewrite; `0x00538c70` is the prioritized cached-text owner over + `[owner+0xbd8/+0xbdc/+0xbe0/+0xbe4]` that emits descriptor kind `0xae` through `0x005388d0`; + `shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars` `0x00538e00` is the five-scalar + descriptor-synthesis wrapper above that same dispatcher; + `0x00538e50` is the sorted registered-window insert owner over node key `[node+0x21]`; + `0x00538ec0` is the refresh sweep over the indexed helper collection rooted at `[owner+0xc69]`; + and `0x00538f10` is the broader optional-window publish plus blocking descriptor loop used by + modal launchers and some shell transition paths. diff --git a/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md new file mode 100644 index 0000000..0654134 --- /dev/null +++ b/docs/control-loop-atlas/runtime-roots-camera-and-support-families.md @@ -0,0 +1,2656 @@ +# Input, Save/Load, and Simulation: Runtime Roots, Camera, and Support Families + +### Runtime Roots and Cadence + +- Roots: the shell controller window-message ingress `shell_controller_window_message_dispatch` at + `0x0054e3a0`, the shell input-state object initialized at `0x006d4018` through + `shell_input_state_init` `0x0054e710`, the saved-world restore path + `world_load_saved_runtime_state_bundle` at `0x00446d40`, the live-world save path + `world_runtime_serialize_smp_bundle` at `0x00446240`, `world_entry_transition_and_runtime_bringup` + at `0x00443a50`, the frame-owned cadence `simulation_frame_accumulate_and_step_world` at + `0x00439140`, the recurring `GameMessage.win` service branch through + `game_message_window_service_if_present` `0x004e0720`, the world-facing `GameUppermost.win` + overlay branch ensured by `shell_ensure_game_uppermost_window` `0x004e0e40` and serviced through + `game_uppermost_window_service_world_hotspot_band` `0x004e0780`, and the lower step family rooted + at `simulation_advance_to_target_calendar_point` `0x0040ab50` with periodic branches through + `simulation_service_periodic_boundary_work` `0x0040a590`. +- Trigger/Cadence: shell-side input is event-driven by controller-window `WM_*` traffic while save + or load work is triggered either directly from shell commands or through the `fileopt.win` branch + flags into the `.smp` runtime-state family; post-bring-up world service becomes recurring once a + world root exists at `0x0062c120`, but the current grounded top-level cadence still remains the + shell-owned `shell_service_pump_iteration` path, which calls + `simulation_frame_accumulate_and_step_world` directly and lets it accumulate elapsed wall-clock + time into one or more simulation-step quanta. A second ingress is now bounded too: + `simulation_run_chunked_fast_forward_burst` at `0x00437b20` repeatedly calls the same lower + stepper `simulation_advance_to_target_calendar_point`, but current grounded callers put that + helper inside the larger post-load generation pipeline `world_run_post_load_generation_pipeline` + at `0x004384d0` under the `Seeding Economy...` phase rather than under the ordinary player-facing + speed buttons. That setup pipeline is now clearer at the progress-banner level too: on the fuller + setup path it first runs one preliminary named-candidate availability prepass through `0x00437743` + before any visible progress banner is posted. One startup-side selector edge is tighter now too: + `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` reaches an early + selector-`2` branch at `0x00438a66..0x00438c00` that refreshes one support-family type-`7` + record from setup path buffer `0x006d1370` through `0x0053d130`, strips the basename extension + into a local label buffer, briefly drops the nested mouse-cursor hold through `0x0053f310`, + builds three progress-text payloads, and re-enters the hold through `0x0053f2f0` before the + common world-root bring-up continues. After that, localized id `318` + `Computing Transportation and Pricing...` stays visible while the pipeline runs + `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early collection-owned staging pass + `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, + `world_setup_building_collection_phase` `0x0041ea50`, and the conditional region pair + `world_region_collection_seed_default_regions` `0x00421b60` plus + `world_region_collection_refresh_neighbor_and_profile_bands` `0x00420f30`. One save-load-side + status-stack strip is now tighter too: `0x004422d0/0x00442330` push and pop the same four shell + dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` + through the local stack `0x0062be90` with depth `0x0062bedc`, and the paired wrappers + `0x004423a0/0x004423d0` bracket that same band while also servicing the live TrackLay.win and + StationPlace.win tool objects through `0x0050e070`, `0x00507a50`, `0x0050a530`, and + `0x0050e1e0`. The live `.smp` serializer uses the higher pair, while `world_entry_transition_and_runtime_bringup` + `0x00443a50` and `world_load_saved_runtime_state_bundle` `0x00446d40` also use the raw + push/pop pair directly around their heavier bundle and status spans. + `world_region_border_overlay_rebuild` `0x004882e0`. The transport/pricing side is tighter now + too: `0x0044fb70` first routes one null-build path through the preview ensure wrapper + `0x0044faf0`, whose deeper worker `0x0044f840` allocates a default target through + `0x00534930`, seeds five palette entries through `0x0051de10`, maps each target pixel back into + the live secondary raster through `0x00533970/0x00533980`, uses the low-3-bit class split plus a + local `+/-4` neighborhood and `0x0051db80` to choose the preview color, and only then re-enters + `0x0044e940` on the full rectangle. The later `322` side is tighter now too: the top owner + `0x0044d410` rejects while generation counter `[world+0x2205]` is live or when `0x00449e90` + cannot supply a surviving work rect, then forwards that rect into `0x005374d0`, `0x00533e70`, + and `0x00537010`, notifies the shell owner at `0x0062be68`, and refreshes neighboring region or + manager companions through `0x00421f50`, `0x00461770`, and `0x00415340`. `0x00421f50` itself is + now bounded as the narrow class-0 side of that refresh: it scans the live region collection for + class-0 records whose normalized coordinates fall inside the caller-supplied float rectangle and + republishes each surviving region's current-position triplet through `0x00455a70(0)`. The local + companion-float strip under that same owner is tighter now too: `0x0044d4e0` and `0x0044d6e0` + are sibling five-pass cross-neighbor relaxers over `[world+0x1605]`; both clamp the caller + rectangle, average the four cardinal neighbors, subtract the current sample, scale the delta by + one fixed coefficient and caller gain, and then feed the surviving rectangle back into + `0x0044d410`. The first helper only checks raster bit `0x01` in `[world+0x2135]`, while the + second adds the tighter acceptance gate `0x004499c0` and can skip the final `0x0044d410` tail + when its caller disables that refresh. Their center-biased sibling `0x0044d880` is now bounded + too: it seeds one baseline from the current center sample when its caller gain is positive, + expands one square neighborhood by radius, and raises surrounding cells toward that baseline + through the same `0x0051dc00` falloff model before tailing into `0x0044d410`. The local + peak-oriented sibling `0x0044da70` then raises one clamped square neighborhood by quantized + local maxima and on its optional branch also consults `0x00534f00` before keeping the larger + peak. So the `0x0044d4e0/0x0044d6e0/0x0044d880/0x0044da70` band now reads as the local + companion-float refinement layer immediately beneath the shared `Calculating Heights...` owner + rather than a set of unrelated scalar writes. The default-region side is tighter too: + one earlier class-0-only helper `0x0041fb00` now sits directly under that same family too: + it skips nonzero `[region+0x23e]` records, rounds the region center through + `0x00455800/0x00455810/0x005a10d0`, stamps one orientation-dependent local secondary-overlay + pattern through `0x00534e10` plus `0x004497a0`, and then runs one bounded scored refinement pass + through `0x0051db80`, `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0`. The finalizer + `0x00421730` then clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the + full live world raster, seeds each live region's cached bounds fields, and repopulates that same + raster by writing the nearest class-0 region id `[region+0x23a]` into empty or weaker cell slots + from one bounded center-and-radius sweep. The region-profile side is tighter too: `0x0041f940` + counts only the current subcollection entries whose backing + candidates pass `0x0041f998`, and that smaller predicate now has one real content split instead + of staying anonymous. Candidates whose subtype byte is not `2` pass immediately, while subtype-2 + candidates only pass when either availability word `[candidate+0xba]` or runtime recipe latch + `[candidate+0x7ac]` is nonzero; `0x00412af0/0x00412b70` now ground the lookup step beneath both + counters as a casefolded profile-label-to-candidate resolver over the global candidate pool + `0x0062b268`; and the stricter year-filtered counter `0x0041f9b0` then stacks the subtype and + `[candidate+0x26] <= max_year` gates on top of that same availability test. Two adjacent + collection helpers are grounded now too. `0x0041fa30` linearly scans the same region profile + collection `[region+0x37f]`, compares labels through `0x005a57cf`, and returns profile-weight + float `[entry+0x1e]` from the first casefolded match or the shared zero float when none match; + `0x0041fac0` resolves one 1-based ordinal out of that same collection and copies both the + matched profile label and weight `[entry+0x1e]` to caller-owned outputs. Those reads line up with + the editor copy-industry mutator `0x004206b0`, which already treats `[entry+0x1e]` as the live + editable profile-weight lane. That border + pass is now tighter too: the + outer owner refreshes the companion region set `0x006cfc9c` through the reset-and-assign wrapper + `0x00487650` above the heavier record initializer `0x00487540`, then re-enters `0x004881b0` to + refresh the raw per-region cell-count band from the live world raster, and the inner emitter + `0x00487de0` clears prior chunked segment queues through `0x00533cf0`, scans the live region + raster, and appends fresh border-segment records through `0x00536ea0`. The lower presentation + helper strip under the same owner is now explicit too: `0x00533970/0x00533980` query the cached + world-grid X/Y maxima, `0x00533990` stores the secondary-overlay shift field `[world+0x15e1]`, + `0x005339a0` builds one plane equation from three XYZ points, and `0x00533a30` uses the same + three-point patch to solve one sampled height at caller-supplied `(x,z)`, + `0x00533ae0/0x00533af0/0x00533b00` expose the secondary-raster and companion byte-raster roots, + and `0x00533b20/0x00533b30/0x00533b70/0x00533b90` expose the normalized coordinate, strip-offset, + and sample-triplet tables used by shell-side overlay staging. The adjacent queue side is tighter + now too: `0x00533bc0/0x00533bd0/0x00533be0` are the direct append, remove, and root getters for + shell queue `[this+0x166d]`; `0x00533bf0/0x00533c20` are the cell-addressed attach/detach + helpers over nearby-presentation table `[this+0x1671]`; `0x00533c50/0x00533c70/0x00533ca0` do + the same for the region-border overlay chunk table `[this+0x1679]`; and + `0x00533dd0/0x00533e00` are the matching geographic-label cell-table attach/detach wrappers over + `[this+0x1675]`. The downstream layout-state staging side is bounded now too: + `0x005454c0` snapshots the current slot-triplet table into the history list `[layout+0x259f]`, + `0x00545520` is the optional per-slot item-binding setter over `[layout+0x2593]`, normalizing + mismatched item mode tokens through `0x005435d0` before publishing node property slot `+0xf4` on + `[layout+0x25df]`, and `0x00548940` is the paired seeded-triplet applier that walks the + temporary `0x18`-byte record list at `[layout+0x259b]` and forwards both triplet halves into + `0x005455e0/0x005456d0` for the first `N` destination slots. The neighboring probe strip is + bounded now too: `0x00548820` seeds every live slot to the fixed triplet pattern `(1,2,1)` in + both triplet halves, `0x005488a0` snapshots the current slot-triplet table into that same seeded + list and can immediately re-apply it, while `0x005489f0` uses literal `TextureForTests` to run + one layout-side binding probe whose boolean result is later mirrored into shell capability bytes + `[0x006d4024+0x114250/+0x114251]`. The setup-side owner over that same strip is bounded now too: + `0x0055ddc0` chooses one small resolution tier from shell dimensions + `[0x006d4024+0x11423b/+0x11423f]`, seeds a sequence of fixed slot-triplet patterns, snapshots the + resulting tables into local probe handles, and then drives the same `TextureForTests` probe to + populate shell capability bytes `[0x006d4024+0x114250/+0x114251]`. The broader lifecycle side is bounded too: + `0x00547610` is the one-shot publisher for cached bound-node pair `[layout+0x2607/+0x260b]`, + `0x00547640` clears that publish gate again, `0x00542c10` is the shell-side sweep that releases + the active global layout-cache entries rooted at `0x00ccbb2c`, `0x0054be60` exports the live + `0x72c`-byte preset table `[layout+0x840]` into the global default cache `0x00ccbb68` and refreshes + the shell-side state, `0x00548c50` is the pre-release cleanup owner for history list `[layout+0x259f]`, + seeded list `[layout+0x259b]`, and optional slot bindings `[layout+0x2593]`, `0x0054a190` is the + broader bound-presentation release body that drops the same node and controller slot + `[0x006d4024+0x08]`, `0x005463e0` and `0x005465c0` are the two adjacent notice-emitting handle-bank + cleanup strips beneath it, with `0x005463e0` now grounded as the five-handle midband release set + `[layout+0x260f/+0x2617/+0x261f/+0x2627/+0x262f]`, and `0x00547650` is the capability-gated property-strip owner over the + bound node plus auxiliary handles `[layout+0x2623/+0x2633]`, + `0x005478a0` is the trig-derived alternate property strip over `[layout+0x261b/+0x262b]`, + `0x00547c30` is the shared four-scalar publisher that stores local band + `[layout+0x36df/+0x36e3/+0x36e7/+0x36eb]` and emits the derived property-`0x07` block, + `0x00546d40` is the descriptor-publish helper fed by local scalar bands `[layout+0x2517..+0x25ff]` + plus seeded handle `[layout+0x36fd]`, and the lower bind/publish strip is bounded now too: + `0x005471f0` is the shared table-bind helper that chooses node property `0x112` or `0x142` by + record size and can also publish one companion dword through property `0x154`; + `0x005472a0/0x00547300` are the clear/publish helpers for property `0x1b`; + `0x00547320/0x00547380` are the capability-gated apply/clear helpers for the + `0x0f/0x18/0x19` property strip; + `0x00548030/0x00548060` are the two adjacent fixed property-pair setters for + `0x13/0x14 = 1/6` and `0x13/0x14 = 5/6`; + `0x00544360` is the identity-reset publisher for local descriptor `[layout+0x34ef]`, + `0x00544290` is the sibling descriptor publisher for `[layout+0x352f]` from one integer span + pair, and the next rect-strip owner is bounded now too: `0x00548120` resets the identity block, + ensures fallback handle `[layout+0x25e3]`, and refreshes the current span; `0x00548180` stores + normalized local rect band `[layout+0x2523/+0x2527/+0x252b/+0x252f]`, publishes either a dynamic + or fallback block, and then refreshes the same span; `0x0052d4d0` is the controller-side bridge + that materializes one active-display rectangle from normalized scalar band + `[controller+0x50..+0x5c]`; and `0x005482e0` is the join point that either feeds that rectangle + into `0x00548180` or falls back to a direct width/height span refresh through `0x00544290`; + `0x0054bb10` is the alternate segment-record bind over `[layout+0x263f]`; + `0x0054bbd0` and `0x0054bbf0` are the two tiny wrappers that reuse `0x005471f0` for the + `0x264f/+0x2653` and `0x2647/+0x264b` bind-and-publish pairs. The next owner layer is bounded too: + `0x0054a500` is the wider branch that clears the visited-byte strip, pulses the surrounding + property gates, derives two normalized shell scalars, and then either rescales rows from handle + `[layout+0x2663]` through the local four-scalar band or publishes the local descriptor set rooted + at `[layout+0x35af]` before committing the same variant-bank-backed batch ranges; + `0x0054ab20`, `0x0054b030`, and `0x0054b4e0` are the three setup-side batch-refresh owners that + all walk the `0x2d`-stride batch records rooted at `[layout+0x266f]`, but split cleanly into a + three-slot candidate-binding variant, a two-slot candidate-binding variant, and a narrower + `0x265f`-backed capability-variant branch, + `0x0055dd80` is the small direct release helper for subordinate layout-state field `[owner+0x2d]`, + and `0x0055e060` is the wider owner teardown that releases the surrounding handle bands and the + same subordinate layout-state object before the family falls back to the higher-level shell + teardown path. The geographic-label text side is tighter now too: beneath + `shell_emit_geographic_label_text_span` `0x0053a960`, the support strip `0x0053b090`, + `0x0053b390`, `0x0053b590`, and `0x0053b5c0` now reads as one banked fixed-record loader and + keyed lookup family with a small recent-query cache plus a string-hash helper. The static load + loop at `0x0053ce09` seeds those banks from the pointer table rooted at `0x00624e48`, while the + lookup core partitions rows by `key & 0x1f` into `32` per-bank buckets and keeps a `10`-entry + recent-query cache rooted at `[this+0x4290c]`. The adjacent stream and staging side is bounded + too: `0x0053b630/0x0053b690/0x0053b6f0/0x0053b7c0/0x0053b830` now read as the current-entry + ordinal resolver, current-stream close/open helpers, and the shared byte-read strip, while + `0x0053b850/0x0053b8d0/0x0053b920/0x0053b970` own the local `13`-byte staging-table growth, + type-`7` service passes, and bucket-chain reset. The next owner layer is tighter now too: + `0x0053b9e0` is the broader `Pack System Leak Count : %1` report-and-reset pass, releasing the + four owned report-slot roots at `[this+0x429b0..+0x429bc]` plus sibling global `0x00ccba50`, + formatting staging-row fields through `0x0051b700`, publishing them through callback slot + `0x005c8078`, then tearing the staging slab and all per-bank handles back down. The keyed query + side now extends cleanly beyond raw lookup: `0x0053bd40` seeks the selected-or-current payload + stream and returns the handle, `0x0053be10` resolves or lazily opens one keyed typed auxiliary + object including a descriptor rooted at `data\\Other\\AirplaneTypes.txt`, `0x0053c930` is the + composite-string lookup wrapper, and `0x0053c9c0` is the matching payload-length resolver. The + local row side is now first-class too: `0x0053bf60`, `0x0053c000`, and `0x0053c070` release, + drop references on, and acquire-or-create refcounted staging rows with typed payload roots at + `[row+0x09]`, while `0x0053c900` resets the adjacent stream-plus-recent-query-cache strip. + `0x0053ca20/0x0053ca90` now bound the current-selection push/pop frame stack at `[this+0x20428]`, + and `0x0053cb10` is the small two-`u32` plus optional heap-blob reader sitting directly on top + of the shared byte-read helper. The broader bootstrap owner is tighter too: `0x0053cb60` zeroes + the whole family, allocates the four owned report slots, walks the static root-pointer table + `0x00624e14..0x00624e48`, loads banks through `0x0053b090`, and then routes selected keys such + as `companyLogo`, `portrait`, and `trainSkin` back through the typed-object strip into those + report slots. The nearby wrappers `0x0053d0f0/0x0053d110` are just the string-keyed type-`1` + and type-`6` staging-row acquire helpers above `0x0053c070`. The adjacent `0x0053d130` is + tighter now too: it strips one caller path to the final basename, derives a second stem copy + through `0x0051d8a0`, gates on `support_query_path_is_openable_for_read` `0x0051e430`, and only + then refreshes one type-`7` staging row through `0x0053c710` before resetting owner dword + `[this+0x427b0] = -1`. Immediately after that, the local + utility strip `0x0053d1d0..0x0053d470` now resolves as one scored binary-heap plus scored-node + queue family: `0x0053d1d0/0x0053d240/0x0053d2e0/0x0053d300` are the heap reorder and top-score + helpers, while `0x0053d320/0x0053d390/0x0053d440/0x0053d470` are the queue acquire, pop-highest, + membership, and release-side helpers. The sibling heap-owner body now lands too: + `0x0053d4c0/0x0053d540/0x0053d5d0/0x0053d630` are the pooled scored-heap insert, pop-top, + release, and construct-with-capacity paths over the same score-at-`+0x04` node shape. The + adjacent extended owner is now bounded too: `0x0053d6f0/0x0053d740` are the release and + construct-with-capacity paths for the sibling scored-heap owner that carries one extra sentinel + header at `[this+0x10]` plus best-score lane `[this+0x14]`, and current callers are the hotkey + report iterator `0x0045f250` and the nearby shell/runtime owner around `0x00522c67`. The next + support strip is tighter too: `0x0053d810/0x0053d870` are the CRC32-like NUL-string and fixed + byte-span hash helpers over table `0x00624e48`, while `0x0053d8a0/0x0053d960/0x0053d9e0/ + 0x0053daa0/0x0053dae0/0x0053db20/0x0053dbf0` now resolve as one intrusive `u32 -> ptr` + hash-table family with optional pooled `0x10`-byte nodes: release, insert, remove-and-return, + contains, lookup, callback iteration, and construct-with-bucket-count-and-node-capacity. + That family is already grounded on real world owners too, not just support-side data-structure + shape: connected-component and local bucket maps under `0x00416170/0x00419110`, selected owner + hashes under `0x00531ef0`, and the shell-side cleanup owner around `0x00522e7e` all use the same + pooled hash helpers. Beneath both the scored heaps and that hash family, `0x0053dcb0/ + 0x0053dcf0` are now bounded as the shared fixed-stride pool-descriptor release and reset helpers, + with freelist seeding over caller stride and count rather than one owner-family-specific allocator. + The next typed payload branch in the same banked-record family is tighter now too: row type `6` + is no longer just “some constructor under `0x0053c070`”. `0x0053ee70/0x0053e370` now read as the + construct wrapper and full constructor for one shell image-marker payload that parses a grounded + keyword set from the banked record text (`Image`, `ImageWH`, `ImageWHForceScale`, + `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`, + `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`, + `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`, + `HorizontalScaleModifier`, `VerticalScaleModifier`), registers one shell helper token through + `[0x006d401c+0xc69]`, and then hands off to `0x0053de60`. That heavier sibling is now bounded as + the payload's screen-metrics and VRAM-policy variant-table refresh owner: it derives current + screen-space scale from shell display state, resolves one selected TGA or DDS resource through + `0x0053c1c0`, and rebuilds the live variant array `[this+0x24]` through `0x005520a0` for later + consumers such as `shell_queue_world_anchor_marker` `0x00552560`. The rebuild and release side + is explicit too: `0x0053e2b0` releases current variants and the loaded image handle before + tail-jumping back into `0x0053de60`, while `0x0053e2e0/0x0053ee60` are the real destructor and + release thunk for the same type-`6` payload family. + The nearby overlay builders are tighter now too. `0x00478200` is no longer just a generic + single-marker wrapper: it validates owner id `[this+0x11b]` against collection `0x0062bae0`, + resolves that live city-database-style owner, samples normalized XY through `0x00455800` and + `0x00455810`, derives one localized label through `0x0053de00([this+0xaf],2)`, measures + projected half-height through `0x00477a10`, and then queues the finished marker through + `0x005521a0/0x00552160/0x00552560`. The broader sibling `0x00478330` now reads as the real + active-mode overlay-list owner: it derives the current world-space view box from + `[this+0xc3/+0xc7/+0xcb/+0xcf]` plus live world dims, runs six category passes `0..5`, pulls one + active-mode collection through `0x005130f0 -> 0x004b2b70` or `0x0050f600`, walks live placed + structures in `0x006cec20` through `0x0047fd50`, `0x0047df30`, and `0x0047df50`, and emits one + repeated label-marked overlay stream through `0x00477a10`, `0x004779c0`, and + `0x00552560`. After those category passes it also walks `0x006cfcbc` and can add one final + focused-region marker from `[this+0x113]` through `0x0048a170` with label id `0x3c`. The local + overlay-state helper strip under those builders is tighter now too. `0x00477af0` is the actual + default reset for the state band `[this+0xa3..+0x11f]`, seeding minimum span floor + `[this+0x11f]`, default cell bounds `[this+0xbb/+0xbf/+0xcb/+0xcf]`, scale lanes + `[this+0xd3/+0xd7/+0xdb]`, and normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]`. `0x00477a70` + is the paired scaled-max-span helper over the rebuilt cell bounds, while `0x00478dc0` and + `0x00479510` are now bounded as the two heavier owner passes above that strip: the first rebuilds + world-cell bounds and normalized rect from mode flags, raster bit `0x02`, and optional + placed-structure scans, while the second clamps and recenters those bounds and then refreshes the + normalized rect again after drag- or zoom-side updates. One input-side owner is bounded now too: + `0x00477c10` maps one screen-space point into a world-cell pair under the current overlay-state + bounds, and the larger sibling `0x00478cb0` is the drag-side loop above it that repeatedly + applies those deltas through `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0` + before re-entering the same overlay-state rebuild or clamp family. The next query above that is + tighter now too: `0x00479b50` is the nearest-target resolver for this overlay family, first + searching placed structures in `0x006cec20` through `0x0047df30/0x0047df50` and `0x0051db80`, + then optionally falling back to regions in `0x006cfca8` through `0x0048a170` when the shell-side + metric flag bit `0x4` is set. The click-side owner above that is bounded now too: `0x00479d30` + first maps the cursor through `0x00477c10`, resolves the nearest target through `0x00479b50`, + then either publishes restriction notices `0x0c12/0x0c13`, forwards one compact selector-`0x384` + request into the Multiplayer preview owner at `0x006cd8d8`, or dispatches that same local target + through the active-mode handler pair `0x004b3160/0x004b2c10` before easing the shell scalar tail + through `0x0045ea20`. The broader raster owner above this branch is bounded now too: + `0x0047a120` first stages one visible overlay rect through `0x00534930/0x00534c50`, optionally + allocates the target RGBA buffer, and then rasterizes the visible map window through the world + classification helpers `0x00534e50`, `0x00534f00`, `0x00449bd0`, and `0x00448aa0`, mapping the + result through palette table `0x005f2c34` and finally marking city-database owners from + `0x0062bae0`. The small constructor strip under that raster owner is tighter now too: + `0x0047b070` and `0x0047b0d0` are the two concrete constructors for vtable `0x005ce840`, both + reusing `0x00477af0` for default state and then seeding the trailing template byte + `[this+0xa2]`. The release and service strip under the same vtable is tighter now too: + `0x0047b110` drops template handle `[this+0xaf]` and surface root `[this+0xab]` before tailing + into the base release; `0x0047b170` is the main service body that refreshes bounds through + `0x00479510`, draws the current overlay surface, and then queues either the repeated marker list + `0x00478330`, the single city-database marker `0x00478200`, or the fallback quad path + `0x00477d80`; and `0x0047b3d0` is the narrow wrapper that reruns `0x0047a120` into a temporary + raster target and commits the result back into live surface handle `[this+0xab]`. The next local + owner strip is tighter now too: `0x0047b470` ensures surface handle `[this+0xab]` by deriving + zoom-scaled requested dimensions from the current shell zoom table at `[0x006d4024+0x11421e]`, + growing them as powers of two under controller caps, allocating one `0xec`-byte surface owner + through `0x00543980`, and immediately rerasterizing through `0x0047b3d0`; `0x0047b5e0` is the + hover-update sibling that either tracks hovered classification id `[this+0x117]` under overlay + flag `0x00400000` or refreshes nearest target ids `[this+0x10f/+0x113]` through `0x00479b50` + before forwarding the live cursor band into `0x00558760`; and `0x0047b720` is now bounded as the + main message dispatcher for the same family, with current grounded cases for id `6`, refresh pair + `0xba/0xbb`, and scalar-update id `0xbc`, dispatching into the click owner `0x00479d30`, the + drag owner `0x00478cb0`, the ensure-surface path `0x0047b470`, the reraster path `0x0047b3d0`, + and the bounds rebuild owner `0x00478dc0`. The adjacent global marker strip is tighter now too: + `0x0047ba60` clears the ten-entry global pointer-marker slot table at `0x006ceba4`, + `0x0047bb90` is the matching release loop, and `0x0047ba80` rebuilds one indexed slot by + constructing a `0x26e`-byte specialization-root object through `0x0045b680`, seeding it from + literal roots `pointer`, `pointer2`, or `pointer3` through `0x0045b9b0`, publishing the caller + world anchor through `0x004556f0`, applying scalar `0.8f` through `0x00455720`, and clearing bit + `0x20` in the derived state byte. Current grounded callers are the clustered world-side branches + at `0x0051677b`, `0x00516797`, `0x005167df`, and `0x005167fe`, so this now reads as a real + shell-side global pointer-marker slot family rather than loose specialization constructors. + That keeps the label side grounded as a real support-family database strip rather than a loose + collection of anonymous bootstrap helpers. If shell-state gate + `[0x006cec74+0x174]` is set it then posts id `320` `Setting Up Buildings...` for + `world_region_collection_run_building_population_pass` `0x00421c20`; if `[0x006cec74+0x178] > 0` + it then posts id `321` `Seeding Economy...` for `simulation_run_chunked_fast_forward_burst` + `0x00437b20`; only after those setup-side gates does the code post id `319` + `Setting up Players and Companies...`. That `319` lane is no longer just a shell-state placeholder: its + earlier hidden prepass is tighter now too: `0x00437743` is the scenario-side named + candidate-availability seeding pass over the live candidate pool `0x0062b268`, feeding the + override collection at `[state+0x66b2]` through `0x00434f20` before any visible banner is posted. + That grounded write path is narrower than the static file evidence, though: the startup reset + helper `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0` explicitly clears + `[state+0x66b2]` before the dispatch path begins, and the current exported write-side callers + we can name after that reset are still just the live-pool preseed `0x00437743`, the sibling + startup lane `0x00436ad7`, and the editor-side `Industry (Overall)` toggle handler + `0x004cf430` through `0x00434f20`. So while the fixed `0x6a70..0x73c0` candidate-availability + block is now well grounded as bundled map/save source data, a direct bulk-import path from that + block into the live runtime collection `[state+0x66b2]` is still not grounded by the current + disassembly notes. + That candidate-side table now has a grounded fixed record layout too: each entry is a `0x22`-byte + blob with a zero-terminated candidate-name slot at `[entry+0x00..+0x1d]` and one trailing + availability dword at `[entry+0x1e]`, read through `0x00434ea0` and mirrored later into + `[candidate+0x7ac]`. The same scenario state keeps a locomotive-side sibling collection at + `[state+0x66b6]`, read through `0x00435030` and updated through `0x004350b0`, which is now the + shared named locomotive-availability lane beneath the `Locomotives` editor page and the + startup-side locomotive seeding branches. That locomotive-side table is the same pattern at a + larger width: each entry is a `0x41`-byte blob with a zero-terminated locomotive-name slot at + `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`, later mirrored into + `[loco+0x7b]`. Both override dwords now read most safely as simple availability bits rather than + wider mode enums. That `319` lane is no longer just a shell-state placeholder: its + primary grounded work is still the chairman-profile pair + `world_seed_default_chairman_profile_slots` `0x004377a0` plus + `world_build_chairman_profile_slot_records` `0x00437220`, which seed the 16 selector bytes at + `[0x006cec7c+0x87]`, materialize the per-slot chairman records from the scenario selectors, + campaign override flag `[0x006cec7c+0xc5]`, and the static persona table at `0x005f2d28`, and then + publish the selected chairman-profile and linked company summary pair through `[state+0x25]` and + `[state+0x21]`. The local slot-record shape is tighter too because the shell editor panel around + `0x004cc2d0` now surfaces it directly: `[slot+0x00]` is the staged chairman profile id, + `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, + `[slot+0x02]` combines with the separate per-slot gate at `[world+0x0bc3+slot*9]` to surface + `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and + `[slot+0x04]` is the numeric tuning field. Both the selector seeder and the record materializer + treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded + writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. + That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat + flag rather than a generic role byte. The summary fields are tighter too: current direct accessors + now show `[state+0x25]` as the selected chairman profile id in `0x006ceb9c`, while `[state+0x21]` + is the linked owning company id copied from `[profile+0x1dd]` through + `scenario_state_set_selected_chairman_profile` `0x00434890`. The raw id strip under those record + helpers is tighter now too: `0x004337a0` reads `[state+0x21]` directly as the selected company + id, `0x004337b0` reads `[state+0x25]` directly as the selected chairman profile id, and + `0x00433790` is the paired raw selected-company setter that the company and chairman reassignment + flows use when the visible ownership summary changes without re-entering the full profile setter. + The underlying profile constructor family is grounded now too. `0x00476140` is the broad + named-profile constructor beneath both chairman seeding passes: it stores the caller id at + `[profile+0x00]`, marks the record live through `[profile+0x04] = 1`, seeds byte and guard lanes + across `[profile+0x291..+0x295]` and `[profile+0x1e1]`, zeroes the large per-company and tail + bands `[profile+0x2ab..]` and `[profile+0xc66..]`, copies the caller byte into `[profile+0x15c]`, + seeds `[profile+0x158]` to `7.763f`, formats localized fallback name `0x0b87` when the caller + name is empty, copies the caller biography into `[profile+0x27]`, and picks one static persona + row through `0x004760f0`. That helper is now bounded as the wrapped-unused-row allocator over the + static persona table at `0x005f2d28`, marking one zero flag byte at stride `0x27` after a + modulo-`0x29` search. The neighboring raw company-slot strip is explicit too: `0x004760a0` + resolves indexed dword slot `[profile + company_index*4 + 0x2ab]` when the caller's generation + stamp differs from `[profile+0xc43]`, and `0x004760c6` is the paired store-side helper for the + same slot plus optional stamp write. The adjacent profile-metric strip used by the player-list + page is tighter now too: `0x00476320` sums the per-company holding band `[profile+0x15d..]` + against either cached company scalar `0x00423eb0` or the broader support-adjusted company scalar + `0x00424fd0`, while `0x004763b0` folds those same per-company contributions through one extra + thresholded transform before accumulating them. The active-profile collection helpers are direct + now too: `0x004778c0` returns the live record id of the Nth active chairman profile, and + `0x00477920` counts how many active chairman profiles precede one caller-selected live record id. + The neighboring transaction and cached-metric strip is tighter now too. `0x00476780` is the + direct-total-plus-cash query (`0x00476320 + [profile+0x154]`), while `0x00476c20` is the + threshold-adjusted-total-plus-cash sibling (`0x004763b0 + [profile+0x154]`). `0x004767a0` + selects between raw cash `[profile+0x154]`, the direct holding total, or their sum, and + `0x00476810` caches selectors `0` and `1` into the local qword band rooted at `[profile+0x1e9]`. + The trade-side helpers now split cleanly too: `0x00476460` is the sell-side mutator that reduces + one company holding slot `[profile + company_id*4 + 0x15d]`, converts the resulting proceeds + through `0x00424fd0(-units,1)`, and adds the scaled result back into `[profile+0x154]`; the buy + companion is `0x00477110`, which first reuses the feasibility gate `0x00476ff0`, then increases + that same holding slot and subtracts the scaled purchase cost from `[profile+0x154]`. Between + them, `0x00476e50` computes the rounded `1000`-sized trade block by mode, and `0x00476ff0` + performs the actual buy-affordability check against current cash plus an optional direct-holdings + fallback; the reduction-side sibling `0x00476c40` uses the same threshold-adjusted-total-plus-cash + lane from `0x00476c20` as its optional fallback when the direct holding slot is too small. One + broader periodic scalar is grounded now too: `0x00476560` walks raw issue `0x39` + through `scenario_state_sum_issue_opinion_terms_raw` plus the scenario baseline at `0x00433740`, + clamps the resulting factor against several `[profile+0x154]` thresholds, and then adds the + final scaled delta back into `[profile+0x154]`; current grounded caller `0x0040a760` applies + that adjustment across every active chairman profile before the later trigger-kind-`2` pass. + The adjacent start-new-company gate is explicit now too: `0x00476d10` first rejects through + localized id `2952` `You're not able to start a new company.` when scenario gate `0x00476a60` + is active; otherwise it treats `0x004763b0(1) + [profile+0x154]` as the relevant purchasing-power + lane, succeeds only when that total reaches threshold `0x005c8830`, and on failure formats the + richer localized warning `271` `You don't have enough money to start a new company!...` using the + selected chairman profile's current purchasing-power figure from `0x004348c0`. + The adjacent persona-row lookup strip is partly explicit now too: `0x00476bb0` returns the + matched static persona row index for current profile stem `[profile+0xc47]`, while `0x00476b30` + returns the same matched row's `+0x20` asset-stem pointer or falls back to `[profile+0x20]`, + and `0x00476ab0` is the structural `+0x40` string-pointer sibling for that same row family. + The adjacent chairman refresh owner is tighter now too: `0x00433850` uses the guard pair + `0x0062be20/0x0062be1c` to walk the active-chairman collection through + `0x00477820/0x00477860 -> 0x004771e0` until no nested mutation asks for another pass. + The editor-side scenario setup surface beside that chairman panel is clearer now too. + `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` republishes the scenario + description from `[0x006cec78+0x672e]`, the start-year trio `[+0x66ca]`, `[+0x66d2]`, and + `[+0x66ce]`, the direct campaign-designated bit `[+0x66de]` through control `0x5b6e`, and the + inverse of the paired metadata byte `[+0x66f3]` through control `0x5b74`. The resource-side + anchor is now explicit too: `editorDetail.win` carries localized ids `3160/3161` `Campaign + Scenario` and `If checked, this map will be reserved as a campaign scenario.` inside the control + record rooted at `0x5b6e`, so `[+0x66de]` is now the grounded campaign-scenario flag rather than + an anonymous metadata boolean. `map_editor_scenario_metadata_panel_refresh_briefing_mode` + `0x004ca670` now bounds the single-player versus multiplayer briefing switch by flipping selector + `0x621f50`, publishing localized headings `1491` and `3586`, and refreshing the two briefing texts + from `[state+0x4f30]` and `[+0x5ae9]`. The companion dispatcher + `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0` makes the year semantics tighter + too: it commits the description and both briefing texts from edit-control payloads, toggles the + same two booleans, and clamps the three year fields to `1829..2100` while maintaining `minimum <= + default <= maximum`, which now lines up directly with the editor strings `Description:` `Minimum + Start Year:` `Default Start Year:` `Maximum Start Year:` `Briefing` and `Multi-Player Briefing`. + The neighboring special-conditions page is clearer as well: + `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0` now grounds the live owner + for the `Setup_Options_Buttons.imb` list rooted at `0xa7fa`, walks the 49-entry static rule table + at `0x005f3ab0`, counts enabled flags from `[0x006cec78+0x4a7f]`, and publishes the `Special + Conditions In Effect` summary from localized id `1053`. The same page now has a bounded live + dispatcher too: `map_editor_scenario_special_conditions_panel_handle_message` `0x004cb8e0` handles + both bulk selection controls and direct row-state changes, commits them back into + `[0x006cec78+0x4a7f]`, and then re-enters the panel constructor to refresh the summary. That table + is no longer just a raw id run; it now clearly includes the finance and construction restrictions + `2535..2563`, plus later editor toggles such as `Use Bio-Accelerator Cars`, `Disable Cargo + Economy`, `Disable Train Crashes`, `Disable Train Crashes AND Breakdowns`, and `AI Ignore + Territories At Startup`. The neighboring available-chairman page is tighter too. + `map_editor_available_chairman_panel_construct` `0x004ca540` now bounds the shell-side owner for + the 40-entry persona-availability surface under `0x5aa0..0x5b03`: it walks the same persona table + family at `0x005f2d28`, publishes one localized chairman-name row per profile, counts enabled + availability bytes from `[0x006cec78+0x6987..]`, and emits the summary `%1 out of %2 are + selected.` from localized id `1035`. The live state owner beside it is now grounded as well: + `map_editor_available_chairman_panel_handle_message` `0x004cb6f0` handles three bulk-selection + controls `0x5aa1..0x5aa3` by rewriting that same availability-byte array from preset bytes + embedded in the persona table, and it also commits direct per-row toggle changes from + `0x5aaa..0x5b03` back into `[state+0x6987..]` before refreshing the page. So the editor lane now + has three distinct scenario-setup slices rather than one chairman-only blob: chairman slots, + scenario metadata and briefings, plus both a rule-toggle matrix and an available-chairman pool. + There is now one adjacent company-side lane too: current neighboring setup flow conditionally + enters `world_conditionally_seed_named_starting_railroad_companies` `0x0047d440` when the + Multiplayer preview owner `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is + set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is + clear. That helper no longer looks like a generic company refresh. It seeds exactly three fixed + named railroad-company records from `RT3.lng` ids `575..577`: `Missouri Pacific`, `New York + Central`, and `Grand Trunk Railroad`. The first seeded company is tied back to the selected + chairman-profile summary and becomes the selected company id. The second railroad is tighter now + too: it only receives a chairman link when `profile_collection_count_active_chairman_records` + finds at least two live chairman records, and the helper then binds the zero-based second active + chairman through `profile_collection_get_nth_active_chairman_record` with ordinal `1`. The third + railroad currently gets no matching chairman-link branch in the grounded setup flow and therefore + remains an unchaired named company in the live roster. The shell UI above that setup lane is now + tighter as well: `shell_company_list_window_construct` `0x004c7200` builds a live company-list + window over the company collection at `0x0062be10`, `shell_company_list_window_refresh_rows` + `0x004c6c30` formats the active companies with localized strings `267..270`, and only then + conditionally appends one synthetic row id `0x7fff` through + `shell_company_list_format_company_or_start_row` `0x004c6b40` so `<>` appears + as a separate affordance rather than as part of the seeded trio itself. Current shell paging + around that same roster is tighter too because the live company collection now has a grounded + active-only ordinal helper family: `company_collection_count_active_companies` `0x00429a50`, + `company_collection_count_active_companies_before_company_id` `0x004299f0`, and + `company_collection_get_nth_active_company_id` `0x00429990`. Those helpers now anchor the “current + company among active companies” math used by shell-side detail and picker flows rather than + leaving it as anonymous collection glue. `shell_company_list_window_handle_message` `0x004c6f30` + then routes the synthetic row into `start_new_company_dialog_open` `0x0047d080`, whose commit path + now grounds through `start_new_company_dialog_commit_create_company` `0x0047d120`. That lower + helper unlinks any current chairman-owned company, allocates a fresh company id from the live + collection at `0x0062be10`, initializes it through `0x00428420`, and only then publishes the new + selected company. The neighboring compact request helper + `start_new_company_request_create_company` `0x0047d320` does the same fresh-company path from a + request block and is already reached from the startup-company branch at `0x00470e48`. The dialog + side is tighter now too: `0x0047c070` and `0x0047bea0` rebuild the two funding-band globals from + the selected chairman profile through `0x00476c20` and `0x00476950`, publish their range cards + into controls `0x714f` and `0x7150`, `0x0047c190` republishes the current pair `0x006cec14` and + `0x006cec10` into controls `0x7149` and `0x714a`, `0x0047c220` snaps those two current funding + lanes back onto the active band steps, and `0x0047c360` is the small child-control callback gate + over that same funding family. The immediate pre-open helper `0x0047d020` is now bounded too: it + seeds the staged dialog name buffer and then runs the same clustered funding-band rebuild sequence + before `start_new_company_dialog_open` continues into the constructor/callback modal path. The + constructor and message side are bounded enough now too: `0x0047c590` constructs the modal dialog + controls for `0x714f/0x7150/0x7149/0x714a/0x714b/0x714c/0x714d/0x714e`, installs callback + `0x0047c360` on the funding-band pair, and publishes the live dialog root at `0x006cec18`, + while `0x0047c3a0` is the main dialog message owner over shell messages `0xca/0xcb`, the staged + name field `0x714b`, the two funding-step controls `0x714c/0x714d`, the companion summary lane + `0x714e`, and the modal notice branch rooted at `0x03f2/0x03f4`. The + immediate sibling shell branch below that roster is still station-oriented: current grounded + resource names and handlers put one branch on `shell_station_detail_window_construct` + `0x005068c0`, another on `shell_station_list_window_construct` `0x005074c0`, and the subordinate + selector lane on `shell_station_pick_window_open_modal_and_return_selected_station_id` + `0x005078c0` above `shell_station_pick_window_construct` `0x00507620`. But the broader + company-detail ownership question is no longer open. There is now a separately grounded + `CompanyDetail.win` family rooted at `shell_company_detail_window_construct` `0x004c5540`, with + `shell_company_detail_window_handle_message` `0x004c56a0` as its main dispatcher and + `shell_company_detail_window_refresh_controls` `0x004c2ca0` as the shared repopulation pass for + the selected-company presentation and tabbed control bands around `0x9476..0x9490`. A grounded + direct shell-command strip now sits cleanly above those two company panels too: `0x00433a40` is + the shared availability gate for both the company-list and selected-company-detail lanes, + rejecting only when scenario toggle `[0x006cec78+0x4aef]` is set. `0x004405a0` uses that gate to + open detail-panel mode `7` as the direct company-list path, while `0x004405d0` first recovers + the selected-company id through `0x004337a0`, optionally offers `Start New Company` through + `0x0047d080` after warning `368` when no company is selected, and only then opens detail-panel + mode `8` for the selected-company `CompanyDetail.win` lane. A grounded + shell detail-manager caller reaches that constructor at `0x004dde24`, the first finance-action + layer beneath it is now bounded through `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, + `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, + `shell_company_detail_buyback_stock_flow` `0x004c46d0`, and + `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, and the first non-finance layer is + now bounded too through `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`, + `shell_company_detail_bankruptcy_flow` `0x004c5b99`, the territory-access family rooted at + `shell_company_detail_refresh_selected_territory_access_summary` `0x004c1b60` plus + `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, backed by + `company_clear_selected_chairman_if_current_profile` `0x00428a10`, + `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90`, + `company_has_territory_access_rights` `0x00424010`, `company_set_territory_access_rights_byte` + `0x00424030`, and `company_can_purchase_territory_access_rights` `0x00426be0`, plus the two + control-transfer lanes. `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0` now + grounds the special chairman's election path: it checks the caller's current stock ownership in + the target company, rejects insufficient holdings through localized id `623`, rejects recent + failed attempts through id `624`, and then opens the confirmation under id `625` before seeding + the local takeover-election state or packaging the same request through the multiplayer shell + transport. The follow-on resolver `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` + `0x0050c940` now closes the single-player election loop too: it walks the active chairman profile + collection, computes weighted votes for and against the takeover, compares the affirmative total + against half the target-company value, presents the result through + `shell_present_chairmanship_takeover_vote_outcome_dialog` `0x0050c500` in single-player or + localized id `3082` in multiplayer, and then either transfers chairmanship through `0x00428a30` or + stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field. + `shell_company_detail_attempt_merger_flow` `0x004ec640` now grounds the merger side too: it + rejects empty worlds through id `727`, rejects recent failed attempts through id `728`, checks the + proposed premium against company cash through localized id `3889`, and then commits into the + resolver family. That merger resolver is now bounded too: + `shell_resolve_merger_vote_and_commit_outcome` `0x004ebd10` walks the active chairman profile + collection, computes weighted votes for and against the proposed merger, compares the affirmative + total against half the target-company value, presents the result through + `shell_present_merger_vote_outcome_dialog` `0x004eb890` in single-player or localized id `3059` in + multiplayer, and then either commits the merger through `0x00427e20` or stamps the current year + into `[company+0x15f]` as the grounded merger-cooldown field. The vote-bias side beneath that + resolver is tighter now too: `scenario_state_compute_issue_opinion_multiplier` `0x00436590` is no + longer just an abstract issue table lookup because its merger callsite uses issue id `0x3a`, which + lines up directly with localized id `726` saying merger votes depend on public attitude toward the + management of the two companies. By contrast the broader support-adjusted share-price helper + `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` uses issue id `0x37`, + and the shared setter under that lane is tighter now too: `0x004339b0` clamps one small + scenario-side issue value into `[state+0x2d]` with range `0..4`, derives one companion scalar in + `[state+0x29]`, and then forces a live-company sweep through `0x00424fd0` so the support-adjusted + share-price family is recomputed immediately after the issue lane changes. The finance-side debt + helpers now bound `0x38` and `0x39` separately as the explicit + credit-rating and prime-rate lanes. That leaves `0x37` as the broader investor-confidence lane + behind equity support, share price, and adjacent governance pressure, with the strongest current + text anchors coming from the investor-attitude strings `1217` and `3048/3049` about company or + chairman performance rather than from the merger-only management-attitude term. One older local lead is now ruled out too: the + `0x460900..0x460cac` / `0x473620` setup block is the camera-view command family over localized ids + `3474..3493` (`Select/Assign Camera View 1..9` and `0`), not issue-opinion infrastructure, so it + should no longer be used as evidence for the player-facing meaning of issue `0x37`. The editor-side + `Stock Prices` label is also no longer being used as direct evidence here: the `0x4ca980` / + `0x4cadf0` panel owns a separate float-tuning block `[state+0x0bde..0x0bf6]`, with + `[state+0x0bde]` merely mirroring `[state+0x0be2]`, so that label belongs to a different + settings family than the issue table behind `0x37`. A direct shell-resource follow-up now narrows + the remaining caption question too: the extracted `CompanyDetail.win` blob from `rt3_2WIN.PK4` + contains no plain-English investor or finance caption for this lane, which matches the owner-side + read that section-0 is a dynamic `0x947f` text widget fed by + `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a separate + fixed label row. The supporting stat layer is bounded more cleanly now too: the + surrounding `0x0b` setup in the merger and takeover offer builders is formatter mode rather than a + player-facing issue number, while the company-side stat wrapper + `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` now reads as a generic + stat-family accessor over year-relative series or the bounded slot family in + `company_read_control_transfer_metric_slot` `0x0042a2e0`. Its recurring family token `0x2329` is + no longer treated as an issue id here either; it is the stat-family selector paired with localized + company-stat label id `2329`. That means the paired raw and scaled helpers at `0x004241e0` and + `0x00424200` now read as narrow control-transfer offer policy totals instead of direct + issue-argument consumers, and the same broader support-and-governance metric family now also feeds + the annual shareholder-revolt and creditor-liquidation lane surfaced by localized ids `300..304`. + The editor-side help text cluster around ids `2433..2437` is no longer floating either: current + grounded map-editor code now has a live economic tuning family beside the chairman-slot panel. + `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` binds six slider controls through + `map_editor_economic_cost_slider_dispatch` `0x004ca980` into the scenario-state float block + `[0x006cec78+0x0be2..0x0bf6]`, while the surrounding descriptor table at `0x00611c70..0x00612220` + pairs that wider editor lane with localized fields `Prime Rate`, `Merger Premium`, and `Build + Stations Cost` through `Steam Engine Cost` plus the comparison or help texts `2433..2437`. The + broader shell-state master flag at `[0x006cec74+0x68]` still sits above the remaining post-load + phases, plus two narrower per-phase gates: `[0x006cec74+0x174]` directly fronts id `320` `Setting + Up Buildings...` and the later region-owned structure-demand and placement pass through + `world_region_collection_run_building_population_pass` `0x00421c20` plus the deeper per-region + worker `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, while + `[0x006cec74+0x178]` directly fronts id `321` `Seeding Economy...` and the chunked burst helper + `simulation_run_chunked_fast_forward_burst`, whose grounded tail now also sweeps the live region + collection through `world_region_refresh_cached_category_totals_and_weight_slots` `0x00423d30`; + id `322` then fronts `Calculating Heights...`. The + master `+0x68` flag is no longer just structural: the shell load/save coordinators now use the + same flag to force the editor-map `.gmp` family, so current evidence treats it as the broader + editor-map mode above those later setup branches rather than an unnamed generic toggle. That + worker is no longer one opaque building bucket: current grounded categories split into `House`, a + weighted region-profile family surfaced through the `Industry Weightings` stats path, and a third + branch whose low-level fallback token is `Commercial` but whose aligned stats label is `City + Support`. The same placement-commit gate beneath it, `world_region_validate_and_commit_candidate_placement` + `0x00422a70`, is also corroborated by the separate world-side randomized batch helper + `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, which retries + placements around one compact center/radius record rather than the ordinary per-region demand + deficits. That batch placer now sits under a wider compact runtime-effect dispatcher, + `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, so the world-side + branch is no longer just “another caller near `0x43051e`” but one real effect family alongside + the ordinary region-demand worker. Above that, the live scenario event collection at `0x0062be18` + now has a tighter runtime-effect lane too: `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` + `0x004323a0` services one live runtime-effect record, dispatches its linked compact effects + through `0x00431b20`, and can synthesize follow-on records through + `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` + `0x00430b50`, which in turn allocates new live records through + `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`. + Above that, `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` + `0x00432f40` now bounds the collection-wide loop that services those live runtime-effect records + for one trigger kind. That trigger split is tighter now too: recurring simulation maintenance + drives kinds `1`, `0`, `3`, and `2`; the neighboring route-style follow-on drives `5` and `4`; + startup-company and named-railroad creation branches drive `7`; kind `6` is now bounded as a + mixed post-change family spanning the placed-structure post-create tail, one build-version-gated + company-startup or roster-refresh tail, and the route-entry post-change sweep on `0x006cfca8`; + one world-entry-side one-shot gate drives `8` and then clears shell-profile latch + `[0x006cec7c+0x97]`; the briefing-text query lane is kind `9`; and the collection dirty latch + still forces the internal rerun at kind `0x0a`. + That moves this branch out of the “isolated world-side placement oddity” bucket and into a real + scenario-runtime effect pipeline with a mostly bounded trigger-kind family. + The same lower helper also reappears later on a slower + simulation-side cadence with + scale `1/12`, so it no longer looks like one-time setup glue only. The actual game-speed control + family remains separate, rooted at `world_set_game_speed_mode` `0x00434680`, + `world_adjust_game_speed_mode_delta` `0x00434850`, and `world_toggle_pause_or_restore_game_speed` + `0x00437a60`. The direct shell command stub above that family is now explicit too: `0x00440880` + just re-enters the pause-or-resume toggle with flag `1` and then issues one indexed shell + feedback nudge through `0x0045ea20` with selector `0x2c` and scalar `0.5f`. That feedback path + is tighter now too: `0x0045ea20` is the reusable indexed audio-feedback helper over the + table-driven pairs at `0x005f0828/0x005f082c`, and `0x00531e10` is the shell-audio-service sink + that only dispatches those nudges when the live service gates are satisfied. +### Camera View Command Strip + +The adjacent shell-command family at `0x004408f0..0x00440c30` is now + grounded as the ten-slot `Assign/Select Camera View` owner rather than as a generic modal strip. + `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0` snapshots one `0x30`-byte + record inside the live world-view owner through `world_view_store_camera_view_slot_snapshot` + `0x0043b2c0`, storing both the live view tuple `[view+0x04..+0x24]` and one saved focus-kind pair + from `[0x006cec78+0x45/+0x49]`; `shell_select_camera_view_slot_or_publish_unassigned_warning` + `0x004409c0` then re-enters `world_view_restore_camera_view_slot_snapshot_if_populated` + `0x0043ca20`, which restores the same fields, optionally replays the saved focus through + `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and returns silently on success. + Only empty slots surface the shared shell modal path, using localized ids `371..373` after one + label-format pass through `0x0051b700`. The wrapper strip `0x00440b00..0x00440c30` is now fully + bounded too: `0x00440b00/10/20/30/40/50/60/70/80/90` are `Assign Camera View 1..9/0`, while + `0x00440ba0/b0/c0/d0/e0/f0/c00/c10/c20/c30` are `Select Camera View 1..9/0`, and the + registration block at `0x00460903..0x00460cac` ties those wrappers to localized command ids + `3474..3493`. +### CompanyDetail Addendum + +The shared helper `shell_company_detail_resolve_selected_company` at + `0x004c16f0` now bounds the common current-company accessor beneath the whole pane, and the + read-side owner also has a separate active-company navigation family through + `shell_company_detail_step_selected_active_company_delta` at `0x004c3470` plus the next or + previous wrappers at `0x004c3540` and `0x004c3550`. The section switch in + `shell_company_detail_window_refresh_controls` is now grounded too: section index `0x006cfe60` + selects a chairman/governance slice, a debt-and-capital slice, a per-share slice, or a + territory-access slice, published through the tab band around `0x9472..0x9479`, with adjacent + section-navigation controls around `0x947b..0x947c` and `0x948f..0x9490`. +### Key Dispatchers + +`shell_controller_window_message_dispatch`, + `shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`, + `shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`, + `world_runtime_serialize_smp_bundle`, `simulation_frame_accumulate_and_step_world`, + `game_message_window_service_if_present`, `game_message_window_service_frame`, + `game_uppermost_window_handle_message`, `game_uppermost_window_service_world_hotspot_band`, + `game_uppermost_window_refresh_controls`, + `world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`, + `world_view_step_zoom_bucket`, `world_seed_default_chairman_profile_slots`, + `world_build_chairman_profile_slot_records`, + `world_conditionally_seed_named_starting_railroad_companies`, + `scenario_state_set_selected_chairman_profile`, + `scenario_state_get_selected_chairman_profile_record`, + `scenario_state_get_selected_chairman_company_record`, `shell_company_list_window_construct`, + `shell_company_list_window_refresh_rows`, `shell_company_list_window_handle_message`, + `start_new_company_dialog_open`, `start_new_company_dialog_commit_create_company`, + `start_new_company_request_create_company`, `shell_station_detail_window_construct`, + `shell_station_list_window_construct`, `shell_station_list_window_handle_message`, + `shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`, + `map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_handle_message`, + `map_editor_chairman_slot_panel_refresh_selected_slot`, + `map_editor_chairman_slot_panel_cycle_selected_slot_profile`, + `map_editor_available_chairman_panel_construct`, + `map_editor_available_chairman_panel_handle_message`, + `map_editor_scenario_metadata_panel_refresh_briefing_mode`, + `map_editor_scenario_metadata_panel_refresh_controls`, + `map_editor_scenario_metadata_panel_handle_message`, + `map_editor_scenario_special_conditions_panel_construct`, + `map_editor_scenario_special_conditions_panel_handle_message`, + `map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`, + `station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`, + `track_lay_window_refresh_controls`, `track_lay_window_service_frame`, + `track_lay_window_handle_message`, `simulation_advance_to_target_calendar_point`, the smaller + single-step helper at `0x00409e80`, `0x0040a9c0`, `0x0040a910`, and + `simulation_service_periodic_boundary_work`. +### State Anchors + +Shell input object `0x006d4018`, per-key state table starting at `[input+0x100]`, + packed shell input flags at `[input+0xa8c]` now grounded as Right Shift `0x1`, Left Shift `0x2`, + Control `0x4`, and Alt `0x20`, nested dispatch counter `[input+0xa90]`, global shell controller + `0x006d4024`, active world root `0x0062c120`, `GameMessage.win` object `0x006d081c`, + `GameUppermost.win` overlay object `0x006d0820`, `StationPlace.win` tool object `0x006d1720`, + `TrackLay.win` tool object `0x006d1a8c`, accumulated leftover simulation time at `[this+0x4c80]`, + shell and mode globals at `0x006cec74`, `0x006cec78`, and `0x006cec7c`, world manager collections + at `0x0062be10`, `0x006ceb9c`, `0x006cfcbc`, `0x006cec20`, `0x0062bae0`, and `0x006acd34`, plus + the packed calendar-like tuple fields around `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and + `[this+0x14]`. +### Subsystem Handoffs + +The controller window dispatcher now looks like the first grounded input + ingress. It translates keyboard and mouse `WM_*` traffic into shell controller state and the + separate input object at `0x006d4018`; read-side cursor and camera helpers later snapshot that + object through `shell_input_snapshot_dispatch_state` and gate world-relative interaction through + `shell_input_cursor_inside_active_view`. Current grounded consumers around `0x00478cb0`, + `0x004e0780`, `0x0053f450`, and `0x0053fe90` still sit on the shell controller path and consult + `0x006d4024` or the world owner at `0x0062be68`, so there is still no evidence for a distinct + gameplay-only input object after world entry. Instead, the first deeper world-mode interaction + branch now looks like a shared world-view coordinator layered on top of the same shell-fed input + state. Shell_transition_mode ensures the `GameUppermost.win` object at `0x006d0820`; its message + dispatcher `game_uppermost_window_handle_message` owns the narrow action band `0x7918` through + `0x7921`; and the recurring service helper `game_uppermost_window_service_world_hotspot_band` + rate-limits those hotspot actions, rechecks `shell_input_cursor_inside_active_view`, and then pans + the live world view through `world_view_pan_relative_offset_in_camera_plane` `0x0043d130`. The + same lower setter family is also reached from the cursor-drag path through + `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`. Above both of those sits the + larger recurring service `world_view_service_shell_input_pan_and_hover` `0x0043db00`, which now + has one grounded keyboard branch beneath it: + `world_view_service_keyboard_turn_pan_and_zoom_bindings` `0x0043d740`. That helper resolves four + binding-pair families from the shell input table via `0x0054e7d0`, and the localized labels are + now grounded from `Data/Language/RT3.lng`: `Camera Forward` and `Camera Backward` feed the first + signed pan channel, `Camera Left` and `Camera Right` feed the second signed pan channel, `Camera + Zoom In` and `Camera Zoom Out` feed the signed zoom-step channel that `0x0043db00` smooths into + `world_view_step_zoom_bucket` `0x0043cc30`, and `Camera Rotate Left` plus `Camera Rotate Right` + feed the continuous heading-turn branch through `0x0043c810`. The setup side is now better bounded + too: `world_view_seed_keyboard_binding_slot_pairs` at `0x00439e40` seeds the eight slot pairs at + `[this+0x0a6]` through `[this+0x0e2]` from the global action-binding registry through + `shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id` `0x0045f370` using + the distinct registry keys `0x0043d2a0` through `0x0043d310`, and the registration block at + `0x00460769` through `0x004608e7` plus the shared installer + `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` show those roots + are defaulted to the expected Up Down Left and Right virtual keys before runtime polling begins. + The adjacent lookup strip is tighter now too: `shell_input_binding_registry_resolve_entry_by_action_stem` + `0x0045ede0` resolves one action stem into the live binding registry, while + `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and + `shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400` are the small + display-label and primary-code wrappers above that resolver. The camera-view modal family at + `0x004408f0/0x004409c0` now uses that same strip directly when formatting the optional focus-label + lines inside the assign/select camera-view confirmations. The lower label path is now bounded too: + `shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90` is the actual + registry-entry formatter with the three localized prefix fragments `0xdef/0xdf0/0xdf1` plus the + descriptor-table caption fallback at `0x005f0a34`, and + `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` + `0x0045ed90` is the descriptor-side bucket-key helper used by the installer when the target mode + mask is singular. The same local family now reaches one step further into the hotkeys sidecar: + `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250` builds a + temporary sorted report queue over the live registry, `shell_input_write_hotkeys_report_file` + `0x0045f550` writes the resulting table to `hotkeys\hotkeys.txt`, and the hotkey reassignment path + uses the smaller helpers `0x0045ec00`, `0x0045ec70`, `0x0045ecd0`, `0x0045ed70`, `0x0045ef00`, + and `0x0045f8a0` to split imported `foo+bar` labels, recover one action id from the descriptor + table, decode a compact modifier code, expand that code back into the live registry mask, and + finally rebucket or replace the live binding entry. The surrounding registry lifecycle is tighter + now too: `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0` + seeds the fixed defaults from `0x005ecadc` and then appends the smaller manual shell-command + strip; `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070` is the + hard reset that also flushes `hotkeys\hotkeys.txt`; and + `shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file` + `0x00461120` rebuilds the pool roots, reseeds defaults, and tail-jumps into + `shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels` `0x0045f420` + when the caller requests saved-hotkey import. + Beneath that camera stack, the enclosing frame + path now has one grounded non-view sidecar: after `0x0043db00` it reads the active controller-view + object pointer at `[0x006d4024+0x18]+0x366e`, compares it against the latched target at + `[frame_owner+0x66a2]`, fires exit and enter-style vtable callbacks on pointer changes through + slots `+0x64` and `+0x60`, and only latches the new object when the object passes its own slot + `+0x1c` availability test and shell detail control id `0x07d6` on `0x006d0818` has flag bit `0x4`. + That `0x07d6` gate is now more bounded than before: the dedicated `TrackLay.win` tool family + rooted at `0x006d1a8c` special-cases the same control id in both `track_lay_window_service_frame` + and `track_lay_window_handle_message`, uses world hit tests through `0x00448ac0` to arm and + release a drag latch on that surface, and routes the resulting command work through the shared + track-lay mode state at `0x00622b0c`. The surrounding `track_lay_window_refresh_controls` pass now + shows that this is not just one isolated drag handler: the same tool family owns three mutually + exclusive primary mode buttons at `0x985e` `0x985f` and `0x9860`, and current primary evidence now + bounds those values as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40` + from the localized strings 2054 2055 and 1721 plus the matching control-routing branches in + `track_lay_window_handle_message`. The same family also owns the downstream route-entry policy + bridge at `0x004955b0`: current caller evidence says that helper maps the live TrackLay primary + mode into endpoint-synthesis policy `1` or `4` before the tool re-enters `0x00493cf0`, which is + the strongest current bridge from the player-facing single-track versus double-track buttons into + the lower route-builder policy bytes. The same family also owns a bridge-type preference selector + rooted at `0x006cec74+0x138`, two wrapped `Never` through `Common` frequency settings at + `0x006cec74+0x140` and `0x006cec74+0x13c`, two boolean track-lay preference toggles, and the + electrify-all-track action path. Those last two toggles are now tighter than before: current + evidence strongly aligns control `0x986e` and state `0x006cec74+0x144` with `Auto-Hide Trees + During Track Lay` from strings 1838 and 1839, while control `0x986d` and state `0x006cec78+0x4c74` + align with `Auto-Show Grade During Track Lay` from strings 3904 and 3905. That mapping is still + evidence-backed rather than absolutely direct from a recovered resource table, but the state + ownership and control order now make it the strongest current fit. That makes `0x07d6` look like + the shared main-world interaction surface inside a broader TrackLay world-command subsystem, not + an unrelated detail button. The neighboring `StationPlace.win` family is now grounded on that same + surface too: the shell detail-panel constructor family allocates it through + `station_place_window_construct` at `0x00509d80`, publishes it at `0x006d1720`, services it each + frame through `station_place_window_service_frame` at `0x0050a530`, and routes player-facing + commands through `station_place_window_handle_message` at `0x005091b0`. That dispatcher + special-cases the same `0x07d6` control, and the shared helper + `station_place_world_surface_sync_and_dispatch` at `0x00508bb0` either accepts that direct surface + traffic or falls back to the same detail-panel control looked up through `0x006d0818`, rechecks + flag bit `0x4`, hit-tests the world through `0x00448ac0`, stages world coordinates into + `0x006d1738/0x006d173c`, refreshes the remaining preview metric field through + `station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and updates the live + station-placement selection state at `0x00622af0`, `0x00622aec`, and `0x006d1740`. The tool-side + save and restore choreography is tighter now too: `station_place_window_release_cached_selection_handles_and_world_followons` + `0x005079c0` releases cached helper handles `[this+0x7c/+0x80/+0x88/+0x84]` through the matching + global owners after re-entering world and placed-structure follow-ons, and the thin wrapper + `0x00507a50` is the entry used by the broader save-load status-stack helpers. The category side + of that state is now tighter too: the shared helper `0x0044bd10` quantizes the staged world coordinates into the + current cell, resolves the mixed byte-or-word region id from `[world+0x212d]`, looks up the + owning city-or-region entry through `0x0062bae0`, and returns `[entry+0x272]` with fallback + `5`; the StationPlace world-surface branches at `0x00508b80`, `0x00508d59`, and `0x0050a4e6` + use that result directly to refresh the current selection category latch at `0x00622af0`. + Together with + `station_place_select_category_and_refresh` `0x00508880`, + `station_place_refresh_category_controls` `0x00507b90`, and `station_place_format_preview_panel` + `0x00508730`, that makes StationPlace a second grounded consumer of the shared main-world + interaction surface rather than only a sibling constructor plus frame hook. The StationPlace + control semantics are now tighter too: the top category strip at `0x697c` through `0x6981` now + grounds as small station, medium station, large station, service tower, maintenance facility, and + non-station building from `RT3.lng` strings 2197 through 2202. For the three station categories + only, the secondary strip at `0x6988` and `0x6989` plus display field `0x698c` no longer looks + like another placement mode family; it is a building-style scroller. The click handlers on + `0x6988` and `0x6989` cycle the style override in `0x00622aec`, and the display path builds the + active style token from `StationSml`, `StationMed`, or `StationLrg` plus the localized + architecture styles `Victorian`, `Tudor`, `Southwest`, `Persian`, `Kyoto`, and `Clapboard` from + `RT3.lng` ids 2672 through 2667. One layer lower, the remaining opaque controls are now much + tighter: `0x6985` and `0x6986` are no longer a generic assist toggle but the two station-rotation + policy choices from strings 2207 and 2206, switching between auto-orienting the building to track + or obstacles and strictly obeying the rotation specified by the circle above. The dedicated + control at `0x6987` is the station-rotation circle itself, wired through + `station_place_rotation_circle_callback_publish_current_heading_widget` `0x00507a90` and aligned + with `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` + string 2208. The lower rotation strip is now grounded too: + `station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` owns the write to + `0x006d172c` and the live selected-site pose refresh, `station_place_window_drag_rotate_selected_site_toward_world_cursor` + `0x00507d80` is the drag-update branch under the dispatcher, and + `station_place_step_rotation_by_integer_notches` `0x005086c0` is the discrete notch helper used by + the neighboring StationPlace rotation-step branches. That matches the lower behavior too: when the + strict-rotation choice is off, both preview and commit paths route staged coordinates through + `station_place_window_try_auto_orient_candidate_to_covering_route_entry_and_validate_placement` + `0x00508040`, which performs the extra orientation search before validation by retrying a small + orientation-mode set around the reusable covering-route-entry helper `0x00417b40`; when strict + rotation is on, that pass is skipped and the current angle in `0x006d172c` is used directly. The + preview strip is tighter now too: `station_place_format_preview_panel` `0x00508730` is the real + owner for controls `0x6982/0x6983/0x6984`, and the middle field `0x6983` is no longer anonymous. + `station_place_refresh_preview_metric_control_0x6983` `0x00508550` resolves the staged world-cell + category through `0x0044ad60`, reads the linked profile scalar at `[profile+0x22]`, chooses issue + slot `0x3b` or `0x3c` from candidate subtype byte `[candidate+0x32]`, folds that scalar through + `scenario_state_compute_issue_opinion_multiplier` `0x00436590`, and then passes it through the + version-gated quantizer `0x005084a0` before formatting the visible text into control `0x6983`. + The singleton-side entry above that strip is explicit now too: + `station_place_format_preview_panel_if_live_singleton_and_valid_selection` `0x00508860` only + forwards non-`-1` selection ids into that refresh path when `0x006d1720` is live. + One layer below preview versus commit, the shared gate is also tighter now: + `station_place_validate_current_selection_at_world_coords_and_optionally_format_status` + `0x00507e80` is the common validation-and-status path beneath the preview and commit branches, + publishing red, yellow, or green feedback through `0x0040cb10` around the same + `placed_structure_validate_projected_candidate_placement` `0x004197e0` core. The + direct shell UI also exposes the same discrete view-step family through + `world_view_step_heading_quadrant` `0x0043cb00` and + `world_view_step_zoom_bucket` `0x0043cc30`. The neighboring gating predicates + `world_view_should_drive_primary_pan_channel` and `world_view_should_drive_secondary_pan_channel` + test packed shell input bits `0x3`, and `shell_input_apply_window_key_transition` now grounds + those bits as the left and right Shift modifiers from scan codes `0x2a` and `0x36`. That means + cursor drag, overlay hotspots, held Shift state, direct keyboard turn/pan/zoom bindings, the + TrackLay and StationPlace world-command surfaces, and at least one frame-owned hover or + focus-target branch all converge under the same shell-fed world-mode input path rather than a + separate gameplay-input stack. +### Evidence + +Function-map rows for `shell_controller_window_message_dispatch`, + `shell_drain_pending_window_messages`, `shell_input_state_init`, + `shell_input_apply_window_key_transition`, `shell_input_snapshot_dispatch_state`, + `shell_input_cursor_inside_active_view`, `world_load_saved_runtime_state_bundle`, + `world_runtime_serialize_smp_bundle`, `world_entry_transition_and_runtime_bringup`, + `simulation_frame_accumulate_and_step_world`, `game_message_window_service_if_present`, + `game_message_window_service_frame`, `shell_ensure_game_uppermost_window`, + `game_uppermost_window_construct`, `game_uppermost_window_handle_message`, + `game_uppermost_window_service_world_hotspot_band`, `world_view_set_focus_position_xyz`, + `world_view_apply_screen_delta_to_focus_position`, + `world_view_pan_relative_offset_in_camera_plane`, `world_view_seed_keyboard_binding_slot_pairs`, + `world_view_service_keyboard_turn_pan_and_zoom_bindings`, `world_view_step_heading_quadrant`, + `world_view_step_zoom_bucket`, `world_view_should_drive_primary_pan_channel`, + `world_view_should_drive_secondary_pan_channel`, `world_view_service_shell_input_pan_and_hover`, + `world_seed_default_chairman_profile_slots`, `world_build_chairman_profile_slot_records`, + `world_conditionally_seed_named_starting_railroad_companies`, + `profile_collection_count_active_chairman_records`, + `profile_collection_get_nth_active_chairman_record`, + `scenario_state_set_selected_chairman_profile`, + `scenario_state_get_selected_chairman_profile_record`, + `scenario_state_get_selected_chairman_company_record`, `start_new_company_dialog_open`, + `start_new_company_dialog_commit_create_company`, `start_new_company_request_create_company`, + `shell_company_list_format_company_or_start_row`, + `shell_company_list_activate_or_shift_center_company`, `shell_company_list_window_refresh_rows`, + `shell_company_list_window_handle_message`, `shell_company_list_window_construct`, + `shell_company_detail_window_refresh_controls`, `shell_company_detail_window_construct`, + `shell_company_detail_window_handle_message`, `shell_station_detail_window_construct`, + `shell_station_list_window_construct`, `shell_station_list_window_handle_message`, + `shell_station_pick_window_construct`, `shell_station_pick_window_populate_station_rows`, + `map_editor_chairman_slot_panel_construct`, `map_editor_chairman_slot_panel_refresh_slot_list`, + `map_editor_chairman_slot_panel_refresh_selected_slot`, + `map_editor_chairman_slot_panel_refresh_slot_counters`, + `map_editor_chairman_slot_panel_cycle_selected_slot_profile`, + `map_editor_chairman_slot_panel_handle_message`, `map_editor_available_chairman_panel_construct`, + `map_editor_available_chairman_panel_handle_message`, + `map_editor_scenario_metadata_panel_refresh_briefing_mode`, + `map_editor_scenario_metadata_panel_refresh_controls`, + `map_editor_scenario_metadata_panel_handle_message`, + `map_editor_scenario_special_conditions_panel_construct`, + `map_editor_scenario_special_conditions_panel_handle_message`, + `map_editor_economic_cost_slider_panel_construct`, `map_editor_economic_cost_slider_dispatch`, + `station_place_refresh_category_controls`, `station_place_format_selected_site_summary`, + `station_place_format_preview_panel`, `station_place_select_category_and_refresh`, + `station_place_world_surface_sync_and_dispatch`, `station_place_window_handle_message`, + `station_place_window_construct`, `station_place_window_service_frame`, + `track_lay_window_refresh_controls`, `track_lay_window_construct`, + `track_lay_window_service_frame`, `track_lay_window_handle_message`, and + `simulation_service_periodic_boundary_work`, plus the shell-input disassembly around `0x0054f290`, + `0x0054e880`, `0x0054e9c0`, `0x0054ea20`, `0x0054eb10`, and `0x0054ee50`, + the world-view setup and service branches around `0x00439e40`, `0x0043d740`, `0x0043db00`, + `0x0043cb00`, and `0x0043cc30`, the `319` setup-side branches around `0x004377a0`, `0x00437220`, + `0x00477820`, `0x00477860`, `0x0047d440`, `0x004c6c30`, `0x004c6f30`, `0x0047d080`, `0x0047d120`, + `0x0047d320`, `0x004c2ca0`, `0x004c5540`, `0x004c56a0`, `0x005068c0`, `0x005071e0`, `0x005074c0`, + and `0x005076c0`, the direct summary-field helpers around `0x00434870` `0x00434890` and + `0x004348c0`, the company-link writers at `0x00427c70` and `0x00427d74`, the company constructor + at `0x00428420`, the startup-company branch around `0x00470e48`, the shell company-list strings + `266` `<>`, `267` `You are the chairman of the %1!`, `268` `The %1 has no + chairman at the moment.`, `269` `%1 is the chairman of the %2.`, `270` `Double-click for + details.`, and `2992` `Shift-Click to center on this company's primary station.`, the + `CompanyDetail.imb` and `CompanyDetail.win` resource strings in `.rdata`, the `StationDetail.imb`, + `StationDetail.win`, `StationList.win`, and `StationPick.win` resource strings in `.rdata`, the + shell editor window branches around `0x004c9da0`, `0x004ca010`, `0x004ca1c0`, `0x004ca540`, + `0x004ca670`, `0x004ca790`, `0x004ca980`, `0x004cb2b0`, `0x004cb4a0`, `0x004cb6f0`, `0x004cb8e0`, + `0x004cc250`, `0x004cc2d0`, `0x004ceb90`, and `0x004cecc0`, the localized chairman-slot strings + `2997` through `3001` `Optional` `Mandatory` `Human or Computer` `Computer` and `Human`, the + localized scenario-editor strings `1483..1492` `Description:` through `Type the briefing for this + map.`, the localized summary strings `1035` `%1 out of %2 are selected.` and `1053` `Special + Conditions In Effect`, the 40-entry persona availability page under `0x5aa0..0x5b03`, the 36-entry + special-condition table at `0x005f3ab0` covering ids `2535..2563`, `2874`, `3722`, `3835`, `3850`, + `3852`, and `3920`, the static persona table at `0x005f2d28`, the selector array at + `0x006cec7c+0x87`, the persona collection at `0x006ceb9c`, the localized persona strings in + `Data/Language/RT3.lng` including `2730` `Unassigned`, the named-chairman range `2731+`, and the + neighboring biography range `2495+`, plus the seeded railroad-name strings `575` `Missouri + Pacific`, `576` `New York Central`, and `577` `Grand Trunk Railroad`, the StationPlace.win + constructor plus category, dispatcher, rotation-circle, shared-world-surface, preview-build, and + recurring service branches around `0x00507a90`, `0x00507b90`, `0x00508550`, `0x00508730`, + `0x00508880`, `0x00508bb0`, `0x005091b0`, `0x00509d80`, and `0x0050a530`, the StationPlace string + cluster `Place a small station` 2197 `Place a medium station` 2198 `Place a large station` 2199 + `Place a service tower` 2200 `Place a maintenance facility` 2201 `Place a non-station building` + 2202 `Scroll through building styles.` 2203 `When placing the building, it will strictly adhere to + the rotation specified by the circle above.` 2206 `When placing the building, it will rotate + itself as needed to orient to track or avoid obstacles.` 2207 `Click to rotate the building. You + can also use bracket keys [ and ] to rotate buildings.` 2208 and the architecture-style labels + `Clapboard` 2667 `Kyoto` 2668 `Persian` 2669 `Southwest` 2670 `Tudor` 2671 and `Victorian` 2672, + the TrackLay.win constructor and dispatcher family around `0x0050d2d0`, `0x0050e400`, + `0x0050e070`, `0x0050e1e0`, and `0x0050e5c0`, the localized `Never` through `Common` strings 615 through 618, + the track-lay strings `Bulldoze` 1721 `Lay single track.` 2054 `Lay double track.` 2055 and 3114, + and the deeper shared bulldoze helper at `0x0044b160`. That helper is no longer just a vague + proximity scan: it validates the active company unless editor mode is active, emits the exact + RT3.lng bulldoze rejection ladder `419..424`, reads company cash through `0x0042a5d0`, + debits approved bulldoze cost through `0x0042a080`, and then scans nearby route entries, + linked structures, city-or-region records, route blockers, and placed structures before + committing the mutation. The nested tool-side entry is tighter now too: `0x0050e070` increments + the TrackLay reentry guard, snapshots several live route-owner fields from `0x006cfca8` into the + tool object, refreshes tool-local state through `0x0050dab0`, and only then tails into the later + restore or service branch `0x0050d1e0`. That tail is now tighter too: `0x0050d1e0` resets the + route-owner search state through `0x0049ad90/0x00495540`, drops invalid cached route ids from the + TrackLay tool or deletes non-admitted live entries when route latch `[route+0x118]` is set, + clears `[tool+0x78]`, and then conditionally refreshes shell presenter slot `[presenter+0x3741]` + through `0x00523e20`. The destructor side is tighter too: `0x0050db10` restores the TrackLay + vtable, re-enters that same cleanup tail, runs the route-owner post-change sweep + `0x004a3db0`, clears singleton `0x006d1a8c`, conditionally replays the shared world-side + preview-mode clear owner + `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`, and only then + tails into the common shell destroy path `0x0053f7d0`. Two smaller + TrackLay-side helpers are tighter now too: `0x0050dc00` refreshes the version-gated action rows + `0x986a..0x986c` plus `0x9872` before re-entering the main control refresh, and `0x0050dc80` + owns the active route-latch branch that either forwards into `0x004a00b0` or clears route latch + `[0x006cfca8+0x118]` plus local byte `[tool+0x82]`. The broader shared route or hit-test owner + under both message and recurring service is now tighter too: `0x0050dce0` first drops any cached + tool route id, then either seeds or updates the current route-owner selection from a world-surface + hit test through `0x00448ac0`, `0x00493600`, `0x0049ace0`, and `0x0049b180`, or refreshes the + active route-owner path through `0x004955b0`, `0x00493cf0`, and `0x004a04c0`, with the cleanup + side posting the fixed shell payload and optionally deleting route ids `[+0x125]` and `[+0x129]`. + The smallest active-route companion is tighter now too: `0x0050dab0` only runs when latch + `[0x006cfca8+0x118]` and route id `[+0x125]` are both live, then resolves that entry, re-enters + `0x0049afe0`, `0x0048b660`, and `0x0049b070`, and returns. + dispatching the selected delete branch through `0x004937f0`, `0x004941a0`, `0x0048abf0`, or the + surrounding placed-structure virtual slot `+0x58`. That makes the TrackLay `Bulldoze` mode + tighter than before: the tool-side mode latch at `0x00622b0c == 0x40` is only the front-end + selector, while the actual world-side bulldoze choice and failure policy sits under `0x0044b160` + and is reused by neighboring world-surface callers beyond TrackLay itself. + the TrackLay preference strings `Auto-Hide Trees During Track Lay` 1838 `If 'Auto-Hide Trees + During Track Lay' is checked, trees will automatically be reduced to small stumps whenever you are + in track laying mode.` 1839 `Auto-Show Grade During Track Lay` 3904 and `If 'Auto-Show Grade + During Track Lay' is checked, you'll see the grade number over the track while laying track - + useful for trying to keep your slopes to a minimum.` 3905, the electrify-all confirmation and + failure strings 3083 3084 3837 and 3900, the binding-registry lookup path at `0x0045f370`, the + registration block at `0x00460769` through `0x004608e7`, and the localized labels in + `Data/Language/RT3.lng` ids `3466` through `3473`. +### Open Questions + +Current evidence grounds the shell-controller-backed input and frame path as the + only coordinator after world entry; no separate outer gameplay loop or gameplay-only input + object is grounded yet. The new setup-pipeline evidence also points the same way: the + currently grounded chunked burst path at `0x00437b20` now looks subordinate to + `world_run_post_load_generation_pipeline` rather than to the ordinary speed controls, and even + there it still reuses the same lower stepper and pumps shell work between chunks instead of + revealing a detached gameplay loop owner. The player-facing speed-control family is now cleaner + too: `world_set_game_speed_mode` owns the bounded `Paused` through `Very Fast` ladder plus the + hidden `Ultra Fast 6..9` extension, `world_toggle_pause_or_restore_game_speed` uses `[this+0x1d]` + as the resume slot, and the multiplayer host restriction now looks attached to that same setter + family rather than to the setup-side burst helper. The frame-owned shell coupling is tighter now + too: inside `simulation_frame_accumulate_and_step_world` itself, one direct branch opens or + focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page`, and the post-step + shell-window ladder also probes several sibling shell windows by the same presence-plus-dirty + pattern, including the live `LoadScreen` singleton, the shared callback-driven custom modal, the + shared file-options dialog, `SettingsWindow.win`, the now-grounded `Overview.win` and + `BuildingDetail.win` singletons, the adjacent tool-window strip now grounded as + `Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintRegion.win`, `PaintSound.win`, + `PaintTerrain.win`, `PaintTerritory.win`, and `StockBuy.win`, and now the shell-side + `Trainbuy.win` singleton too. The `SettingsWindow.win` side is tighter now too: + `shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60` + rebuilds the hotkeys list control `0x757a` from the same sorted binding-report iterator + `0x0045f250`, using the temporary `0x88`-stride list model at `0x006d1354` before restoring the + previous selection. The message owner above it is bounded now too: + `shell_settings_window_handle_message` `0x004fede0` is the actual dispatcher for the singleton, + and its currently grounded hotkeys cases are the reset-to-defaults path + `0x00500147 -> 0x00461120(0) -> 0x0045f550 -> 0x004fec60` and the selected-row reassignment path + `0x00500186..0x0050022b`, which resolves one chosen hotkey row from control `0x757a`, validates + the destination bucket through `0x0045ed90`, skips Enter and Escape, expands the compact modifier + code through `0x0045ed70`, commits the rebucket through `0x0045ef00`, and then rewrites the same + report file plus rebuilds the list. The page-refresh side is bounded now too: + `shell_settings_window_refresh_selected_page_controls` `0x00500410` republishes the category + strip `0x7533..0x7540`, uses the local in-refresh guard byte `0x006d135d`, and then dispatches + the current page through the `0x005005e0` table; page `7` is now directly grounded as the + hotkeys page because it dispatches into `0x004fec60`. The category table at `0x00622870` now + grounds the whole page order as `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`, + `Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`, + `Miscellaneous`, and `Sandbox Options`, with only the second dword in each table row still + unresolved as a small subgroup or style flag. Several page bodies are now grounded too: + `0x004fda20` is the `Gameplay` refresh owner, `0x004fdb90` the `Sound` refresh owner, + `0x004fe770` the top-level `Graphics` refresh owner, `0x004fe960` the `Model Detail` refresh + owner, `0x004feb20` the `Draw Distance` refresh owner, `0x004febd0` the `Textures` refresh + owner, `0x004fdd70` the first `Miscellaneous` refresh owner, `0x004fdf20` the `Scrolling` + refresh owner, `0x004fdfd0` the `Camera Controls` refresh owner, `0x004fd940` the `Dialogs` + refresh owner, `0x004fd730` the later `Miscellaneous` refresh owner, and `0x004fd8d0` the + `Sandbox Options` refresh owner. The neighboring companion helpers are tighter now too: + `0x004fd550` refreshes the `Draw Distance` companion strip under controls + `0x7566/0x7596/0x7560/0x7562/0x7564`, `0x004fd650` does the same for the `Textures` companion + strip under `0x756e/0x756a/0x756c/0x7570`, `0x004fe4c0` rebuilds the graphics custom-resolution + list on `0x7553` from the live display-mode table filtered to `640x480 .. 1600x1200` and + formatted through `%1x%2`, and `0x004fe6f0/0x004fe730` are the small primary-selector mirror + helpers for `Draw Distance` `0x755f` and `Textures` `0x7569`. The `Camera Controls` page is + stronger now too: `0x7587` is the day-night cycling selector rooted at `Normal day/night + cycling` through `Frozen at 11pm`, while `0x7588` is the weather-cycling selector rooted at + `Normal weather cycling` through `Frozen at storms`. The callback strip under the dispatcher is + tighter now as well: `0x004fefb0` is the sound-backend selection-change owner for + `0x7551/0x7550`, `0x004ff070` is the custom-resolution selection owner, `0x004ff0d0` the + top-level graphics selector-change owner, `0x004ff1b0` the main draw-distance selector-change + owner, `0x004ff2e0` the textures selector-change owner, and `0x004ffbc0` the graphics + custom-resolution or range-refresh branch that persists `engine.cfg`, rebuilds the custom list, + and republishes `0x7555/0x7578`. The small wrapper `0x00500620` is the nonreentrant `if live, + refresh page` gate above that body. The tiny helper strip beneath those branches is at least + bounded now too: `0x00531640/0x005316d0` query the active sound-backend index and availability + flag from the shell audio service, `0x0053ef60/0x0053ef70` read the graphics-backend status + slots used by controls `0x757c/0x759a`, and `0x0051fd40/0x0051fd60` are the small graphics-range + custom-mode flag and scalar queries behind `0x7555/0x7578`. The next apply-strip under the same + family is tighter now too: `0x004fe270` applies a changed custom-resolution tuple and persists + it, `0x004fe2d0` applies the top-level graphics selector then republishes `0x757c/0x759a`, + `0x004fe3b0` applies the draw-distance selector then refreshes `0x004fd550`, `0x004fe400` + applies the textures selector then refreshes `0x004fd650`, `0x004fe140` is the small composite + backend-status predicate used by the timer-gated graphics service branch, and `0x004fe160` is + the sound-backend follow-on refresh path. The graphics service tail is tighter now too: + `0x004ffafb` is the timer-gated backend-service-plus-graphics-page repaint branch using + `0x0051d890` against deadline `0x006d136c`, the follow-on calls `0x0053f170/0x0053f2c0`, and a + shortened `60` ms rearm after it repaints `0x004fe770`, while `0x004ffb64` is the sibling + backend-service branch that uses `0x0053f0f0/0x0053f210` and only raises the shell refresh latch + without repainting the page directly. The same `MouseCursor.cpp` owner family is tighter now too: + `0x0053f000` is the live cursor-shape selector that lazily loads native handles, updates the + shell-side presentation payload, and toggles cursor visibility on the `0 <-> nonzero` boundary; + `0x0053f0f0`, `0x0053f170`, and `0x0053f210` are the three local hidden or release-transition + branches that mirror shell latches `[0x006d4024+0x11473a/+0x11473e]`; `0x0053f2f0/0x0053f310` + are the nested hold-counter helpers; `0x0053f330` is the constructor-side reset and latch-sync + owner; `0x0053f400` is the coarse global-latch service; and `0x0053f450` is the inside-view + watcher paired with `shell_input_cursor_inside_active_view` `0x0054f540`. The same pair is now + grounded on the heavier save/load paths too: `world_entry_transition_and_runtime_bringup` + `0x00443a50` pushes the hold at `0x443b04` before the larger startup-dispatch and staged + rehydrate work, then pops it at `0x444c03` after the late world or shell rebuild tail; the live + `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240` does the same thing through + `0x446271` and `0x446d09` around its bundle-write and fixed status-publish span. The exact + save/load-side status stack under those spans is tighter now too: `0x004422d0/0x00442330` push + and pop shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte + `[0x006cec78+0x4c74]` through `0x0062be90`, while `0x004423a0/0x004423d0` layer the same band + under active TrackLay.win and StationPlace.win service. The per-frame tail is + tighter now too: `0x0054f5b0` queues one 12-dword shell-input event record into the rotating + ring at `[input+0x128]`; `0x0054f6a0` and `0x0054f6b0` are the two neighboring fixed-value + seeders for shared phase scalar `0x00d93850` used by shell-side branches `0x00538b72`, + `0x0052819d`, and `0x0052b9f8`; and `0x0054f6c0`, `0x0054f6d0`, and `0x0054f6e0` are the tiny + primary-motion scalar reset, snapshot, and restore leaves that `0x0053f4e0` uses around the + later cursor-presentation pass. The graphics-range + callback strip beneath that is bounded now too: `0x004ffd10` is the user-facing custom-mode + toggle rooted at control `0x7555`, using + `0x0051fd00`, `0x0051fd40`, `0x00520fd0`, and the localized dialog ids `0x0e16/0x0e17/0x0e93`; + `0x004ffe72` flips the graphics-range scalar through `0x00521030`; and the adjacent + display-runtime toggles `0x004ffea4`, `0x004ffeff`, `0x004fff2d`, `0x004fff59`, `0x004fff85`, + `0x004fffde`, and `0x0050000a` now bound a compact persisted graphics or model-detail option + strip over controller fields `[0x006d4024+0x1146eb]`, `[+0x114697]`, `[+0x1146e9]`, `[+0x1146b8]`, + `[+0x1146af]`, `[+0x1146a8]`, and `[+0x1146e3]` rather than one anonymous tail blob. The lower + setter layer is tighter too: `0x0051fd00` is the current `has live custom payload` predicate for + the graphics-range family, `0x00520fd0` stores the custom-mode flag and re-applies the current + range when possible, `0x00521030` stores the scalar and re-applies it when the graphics mode is + live, and `0x0051d890` is the shared elapsed-tick helper over the bootstrap-seeded tick count. + The same local support strip is broader now too: `0x0051e1d0` is the mode-`0` alternate sibling + of the packed preview-color ramp at `0x0051dfc0`; `0x0051e430/0x0051e480` are the shared + path-openability and file-size probes; `0x0051e4e0/0x0051e560` are the bounded ASCII clipboard + export and import helpers; `0x0051e6e0` is the nonempty digits-only predicate used by nearby + text-entry validation branches; `0x0051e720/0x0051e740` own the active debug-log filename + (`rt3_debug.txt` / `language_debug.txt`) and the one-time `.\\data\\log\\%s` separator write; + and `0x0051e810` is now grounded as the `MouseCursor.cpp` `ShowCursor` refcount and live-position + sync helper that the warning-modal strip also reuses. The immediate shell-controller strip under + that is tighter now too: `0x0051ea80` is the small core-state reset plus default seeding path + rerun by `0x0051ff90`; `0x0051f000` registers the static `World` window class through wndproc + `0x0054e3a0`; `0x0051f070/0x0051f080` and `0x0051f090/0x0051f0a0` are the paired controller + accessors and setters for the live presentation owner and world-basis owner; `0x0051f0c0`, + `0x0051f0d0`, and `0x0051f0e0` are the small indexed input-subobject flag write or query helpers + beneath the shell window-message path; `0x0051f100` materializes the active display-mode tuple + from `[controller+0x34]` and selector `[+0x11421e]`; `0x0051f1a0` is the current + graphics-mode-byte accessor over `[controller+0x114226]`; and the nearby shared shell-presenter + helper `0x00527de0` is now bounded as the common scalar-caption publisher reused by several tool + windows. It scales one caller float through `0x005dd158`, forwards that value into nested + presenter field `[this+0x364d]` through `0x0052ea90`, scales a second caller float through + `0x005c8568`, and stores that auxiliary caption-side weight in `[this+0x3728]`. Grounded callers + now include `Bulldoze.win`, `ChangeTrees.win`, the world-surface brush ordinal setter, + `PaintRegion.win`, `PaintSound.win`, `PaintTerrain.win`, and `PaintTerritory.win`, so this is the + shared shell scalar-caption lane rather than a window-specific text formatter. The neighboring page-owned dispatcher + leaves are tighter now too: `0x004ff58a`, `0x004ff5b6`, + and `0x004ff5e6` are direct persisted toggles for the later `Miscellaneous` input page fields + `[0x006d4024+0x1146d7]`, `[0x006cec74+0x28b]`, and `[0x006cec74+0x283]`, with the last one also + republishing a `Game.win` affordance through `0x004dd8d0`; `0x004ff637`, `0x004ff667`, + `0x004ff697`, `0x004ff6c7`, `0x004ff6f7`, and `0x004ff727` are the page-owned toggle leaves for + the `Dialogs` page fields `[0x006cec74+0xf8]` and `[+0x26b/+0x26f/+0x273/+0x277/+0x27b]`; and + `0x004ff757`, `0x004ff796`, `0x004ff7c6`, and `0x004ff84e` are the remaining compact `Gameplay` + page toggle leaves over `[0x006d4024+0x114742]`, `[0x006cec74+0x0a8]`, `[+0x263]`, and + `[+0x309]`, with the `+0x114742` path also nudging `BuildingDetail.win` and the `+0x263/+0x309` + paths triggering narrow live-tool follow-ons. The next tiny leaves are bounded now too: + `0x00500036` is the direct apply leaf for the graphics-misc option family mirrored through + `0x00484af0(0x0c)` into control `0x7586`; `0x0050006c/0x0050009c/0x005000cc` are the shared + setup-config toggles over `[0x006cec74+0x247/+0x24b/+0x243]` that persist the same three booleans + later mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`; and `0x005000fc` is the direct + scrolling-page boolean-companion setter for `[0x006cec74+0x120]` and control `0x7585`. + neighboring stock-buy lane is tighter now too: `0x00433aa0` is the shared `StockBuy.win` + availability gate, rejecting when scenario toggle `[0x006cec78+0x4aa7]` is set or when no + selected-company id is present at `[scenario+0x21]`. The direct shell opener `0x00440660` and + the page-side launcher `0x004de50f` both use that gate before entering detail-panel mode `0x0c`, + whose same-mode refresh tail re-enters `0x00493150`. The shell-side control strip under that + window is tighter now too: `0x0050a660` is the raw selected-chairman-row setter for global + `0x006d19f4`, `0x0050a570` is the selected-company stock-data panel callback wired to control + `0x3aa0` and feeding the shared stock formatter `0x004c0160`, `0x0050a6d0` publishes the current + selected company id into `0x00622b00` and restyles control `0x3a9b`, `0x0050a670` is the shared + live-window refresh wrapper hit by the buy/sell chairman mutators after they touch + `[profile+0x154]` and the per-company holding band, `0x0050a5e0` is the constructor-wired + invalidation callback for control `0x3a9a`, and `0x0050a6a0` is the unconditional invalidation + sibling used by the local in-window trade branches after they commit the rounded block. One level + higher, `0x0050a730` is now bounded as the broad row/card refresh owner: it walks the active + chairman profiles through `0x00477820/0x00477860`, lays out the selected and unselected profile + cards through the cached widget roots `0x006d19d8/0x006d19dc/0x006d19e8/0x006d19ec`, resolves + persona/name labels through `0x00476bb0`, and pulls the same currently grounded metric lanes + from `0x00476320`, `0x00476780`, and `0x00476c20`. The selected-company panel under control + `0x3a9a` is separate and broader: `0x0050ae50` is now bounded as the main selected-company + summary renderer, resolving the current company through `0x00518140`, the current chairman row + through `0x00477860`, choosing one of panel roots `0x006d19e8/0x006d19ec`, and then formatting a + mixed text-plus-metric surface through helpers such as `0x00423eb0`, `0x00426b10`, and + `0x00426ef0`. The adjacent publish side is bounded too: `0x0050b910` formats the selected company + ownership line through localized ids + `0x0e10/0x0e11/0x0e12` plus the resolved company and owner labels, and `0x0050ba00` is the + shared selected-company summary refresh tail over controls `0x3a9a/0x3a9b`; `0x0050c130` is the + narrow mode-`0x0b` refresh wrapper that re-enters that tail only when the current detail-panel + object is actually `StockBuy.win`; and `0x0050c470` is the selected-company clamp/setter sibling + that republishes `0x00622b00` before re-entering the same summary tail. The payload-driven trade + commits are explicit now too: `0x0050c150` resolves one chairman record from payload + `[profile_id, company_id]`, derives the rounded buy block through `0x00476e50`, and commits it + through `0x00477110`; `0x0050c1f0` is the same sibling for the rounded sell block and + `0x00476460`. Both also emit the local selected-chairman shell cue before the shared + `StockBuy.win` refresh tail when the payload chairman matches the currently selected chairman in + `0x006cec78`. The message-owner and teardown side are bounded now too: `0x0050bbe0` is the real + `StockBuy.win` dispatcher, with `0xcb` control bands for chairman-row selection + `0x3afc..0x3b5f`, company-row selection `0x3d54..0x3db7`, company wrap/step controls + `0x3aa1..0x3aa3`, and toggle-byte writes `0x3aad..0x3ab2`, while `0xca` owns the local buy row + band `0x3c8c..0x3cef` and sell row band `0x3cf0..0x3d53`. The buy-side confirmation path now has + one extra leaf too: `0x0050a600` is the callback-driven tutorial gate for the localized + `0x0292` confirmation modal, opening the sibling tutorial modal `0x0e8c` only on `0xcb` control + `0x03f4` while tutorial flag `0x006d3b4c` is live. The destructor counterpart `0x0050bac0` + releases the cached roots `0x006d19d8..0x006d19ec`, frees the per-company cached stock-data + handles in `0x006d1748`, invalidates controls `0x3b60` and `0x3e4e`, clears singleton + `0x006d19f0`, and then tails into the common shell-object teardown. The + remaining adjacent detail-panel gates are now at least structurally bounded too even though their + target families are still unnamed: `0x00434db0` layers extra scenario toggle `[0x006cec78+0x4a7f]` + on top of the broader company-list/detail gate before allowing mode `0x0b`, while `0x00434e20` + only hard-blocks mode `0x06` when all three toggles `[+0x4ab3/+0x4ab7/+0x4abf]` are set and + otherwise, outside editor-map mode, still requires a selected-company id before the direct + openers `0x00440530` and `0x00440690` hand those modes to `shell_detail_panel_transition_manager`. + The + train-buy family is no longer just an unnamed probe pair either: the opener path is now grounded + under the same shell-owned cadence through `shell_can_open_trainbuy_window_or_warn` and + `shell_open_or_focus_trainbuy_window`, and its current family semantics already extend beyond a + bare locomotive picker into selected-train upgrade summary and route-edit affordances. The direct + shell opener `0x004406c0` now aligns with the page-side launcher `0x004de7d9`: both use + `shell_can_open_trainbuy_window_or_warn` `0x00433b00` before calling + `shell_open_or_focus_trainbuy_window` `0x00512c50`. The + selected-train side is tighter now too: we have explicit query helpers for the selected train + record, id, validity, and company ownership, plus one explicit ownership-mismatch warning modal. + That same pass also clarified one boundary we should not conflate: the neighboring shell family + rooted at `0x006d3b20` is now grounded separately as `TrainDetail.win`. It reuses the same + selected-train context and some of the same helpers, but it is not the same `Trainbuy.win` + singleton family. The `TrainDetail.win` side now has its own constructor, opener, refresh path, + and message owner above the broader train-command strip. Its inner `0xcb` strip is tighter now + too: one bounded branch is the selected-train engine-replacement or trainbuy handoff lane using + warning ids `593/594`, and another is the selected-train retirement lane using `595/596/597` + with either a local teardown path or multiplayer opcode `0x37`. The remaining train-command + family is narrower too: the shared `0x33`-stride helper trio at `0x004b2f00`, `0x004b3000`, and + `0x004b3160` now looks like a real train route-stop or waypoint list rather than a generic row + buffer, and route-entry flag byte `+0x28` now has one grounded top-level split: sign bit clear + entries are the live placed-structure-backed family, while sign bit set entries use the direct + route-node payload side. The helper `train_route_list_count_live_site_reference_entries` + `0x004b2b80` now counts the first family explicitly. One deeper lower-bit result is grounded too: + both `train_route_list_insert_staged_entry_at_index` and the auxiliary finalize helper + `train_finalize_aux_route_entry_buffer_preserving_subflags` `0x004a94b0` explicitly preserve + bits `0x40`, `0x20`, and `0x10` in the same flag byte during route-entry rewrites. Those bits are + also no longer copy-only: the neighboring shell helper + `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20` now consumes them to + restyle the `BuildingDetail.win` row bands `0x7d07..0x7d1c` and `0x7f58..0x801f`. The exact + player-facing labels for those rows are still open, but the subflags now have one real shell-side + consumer instead of only preservation logic. The broader `BuildingDetail.win` refresh family is + tighter too: `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0` now + clearly owns the selected subject rows around `0x7d06`, `0x7d96..`, and `0x7d0e`, resolving + ordinary ids through the live candidate collection and the special express-side ids through the + embedded `AnyCargo.imb`, `AnyFreight.imb`, and `PassMail.imb` paths. The first fixed triplet is + now table-grounded instead of only inferred: `0x00621df8` seeds the short-label controls + `0x7dc8..0x7dca` with RT3.lng `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while + `0x00621e10` seeds the adjacent `0x7e90..0x7e92` icon-name triplet with `AnyCargo`, + `AnyFreight`, and `PassMail` before `%1.imb` formatting. RT3.lng also tightens the longer popup + side now: `0x00621e04` feeds the first clickable selector triplet `0x7f58..0x7f5a` with + `494/497/498`, so the help text there is `Any Cargo`, `Any Freight\n(Freight is everything but + Passengers, Mail, and Troops)`, and `Any Express\n(Express is Passengers, Mail, and Troops)`. + The sibling special service rows still align to `Dining Car` and `Caboose`. The extracted + `BuildingDetail.win` blob now sharpens the resource boundary too: its embedded text table is + currently sparse rather than rich, exposing the help line for `0x7d01`, repeated + `BuildingDetail.imb` asset strings, and one standalone caption entry `Cargo`. That makes + `Cargo` the strongest current resource-side anchor for the row header around `0x7d06`. The + ordinary deeper rows are tighter now too: they do not look like hidden caption-table entries, + but like live candidate-derived rows. The current path validates each ordinary id through + `indexed_collection_entry_id_is_live` `0x00517d40`, resolves the concrete candidate record + through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then reuses candidate + field `[record+0x04]` as one shared stem for both the row asset `%s.imb` path and the + neighboring display-label lookup through + `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. That lookup is now + bounded too: it scans the static stem table at `0x006243c8`, already grounding entries such as + `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng + `3202..3220`, and only falls back to localized id `3866` when no table entry matches before the + fixed `0x384..0x386` express-side triplet takes over. One neighboring candidate-side helper is + tighter now too: `structure_candidate_query_route_style_or_local_availability_metric` + `0x0041e650` shares the same route-style byte at `[candidate+0x46]`, returning the cached local + float at `[candidate+0x5a]` for ordinary candidates but switching route-style rows to one + normalized count over the world-side route-link collection `0x006ada90` keyed by candidate class + `[candidate+0x3e]`. That collection is tighter now too: it is constructed during world bring-up + by `placed_structure_route_link_collection_construct` `0x00468110`, and current grounded + creation flow through `placed_structure_route_link_allocate_site_pair_for_candidate_class` + `0x00467f50` seeds class byte `+0x10`, a masked initial state template, and the strongest + current creation-side site-pair fields at `+0x0c` and `+0x0e` before + `placed_structure_route_link_attach_site_owner` `0x00467eb0` links the new route-link record + into the placed-structure-owned chain at `[site+0x272]`. The owner-side split is tighter now + too: route-link field `+0x08` is the separate route-node-style owner anchor used by + `placed_structure_route_link_attach_route_node_owner` `0x00467f20`, while `+0x0a/+0x0c/+0x0e` + now read as the site-reference triple matched by + `placed_structure_route_link_collection_remove_links_touching_site_id` `0x004681f0`. Creation + flow now sharpens that further: `+0x0c` is the strongest current candidate for the stable + first-site field seeded before owner attachment, `+0x0a` is the mutable owner-site anchor + installed by the attach helper, and `+0x0e` is the stable second-site field. One more split is + tighter now too: `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` + currently uses `+0x0a` and `+0x0e` as the active endpoint site pair while recomputing state + byte `+0x12`; `+0x0c` is still not directly read there. The family also has a clearer release + and refresh side now: `placed_structure_route_link_release_and_detach` `0x004680b0` rolls back + the class counters and then tails into `placed_structure_route_link_detach_current_owner_chain` + `0x00467df0`, while + `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` + explicitly reruns the per-record endpoint-pair reconciler across the whole live route-link + collection. One layer above that, + `placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state` + `0x00468300` now looks like the full-family refresh owner: it clears three route-style class + lanes in the world-grid tables rooted at `[0x0062c120+0x2129]`, then clears bit `0x2` across + the live route-link records and reruns the endpoint-pair reconciler. That now lines up with the + visible shell split: non-route candidates keep the richer local metric and price lane, while + route-style candidates use one world-side route-link family instead. The emission side is + tighter now too: `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` + `0x0040fef0` scans the live placed-structure collection for one best peer site by + class-specific weight, distance window, and type gate, then only creates a new route-link + through `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` when + `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0` says the chosen site + pair does not already share a route-entry key. One layer above that, + `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` now reads + as the broader per-site owner of this lane: it computes per-class route-style score scalars from + local site state and scenario multipliers, drives the first three route-style emission attempts, + and then continues into a larger descriptor-driven scoring phase. Inside that larger pass, + `placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link` `0x0042cab0` + now cleanly shows the split between ordinary candidates, which add directly into the local + route-style grid lane at `[site+candidate*4+0x103]`, and remapped route-style candidates, which + re-enter the peer-link emitter. One layer above that, the broader post-create or post-edit site + rebuild `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10` + conditionally re-enters `0x004101e0` with stack flag `1` when its local latch at `[site+0x29e]` + stays clear, so the route-style lane is no longer floating under an unnamed single-site caller. + The placement side is tighter now too: the direct constructor + `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` is the shared allocator + immediately beneath the current placement-side callers before they hand the new site into + `0x0040ef10`, and the lower constructor + `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now bounds the + actual field-seeding layer beneath that allocator. The old unresolved higher placement chooser is + bounded more cleanly now too: the `0x00403ed5` and `0x0040446b` direct-placement commits sit + inside one larger helper, + `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`. That shared + heavy builder is now the common target of the compact wrapper `0x00404640`, the peer-route + candidate builder `0x004046a0`, the region-entry pair wrapper + `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry + paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` + `0x00404ce0`. Internally it now has three bounded lanes: + an early route-entry search or synthesis attempt through + `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, + a single-endpoint direct-placement lane that scans `Maintenance` and `ServiceTower` candidates + and commits through `0x00403ed5 -> 0x004134d0 -> 0x0040ef10`, + and a later paired-endpoint fallback lane that seeds two endpoint candidates from the same stem + family, walks a temporary route-entry list, and commits through + `0x0040446b -> 0x004134d0 -> 0x0040ef10`. + That early lane can now be described more concretely: it can reuse supplied route-entry + endpoints, synthesize a missing leading endpoint from the caller's coordinates, seed the + route-store builder-state block, and then hand off to the deeper path-search core without + placing a new site. The previously vague side family at `0x006cfcb4` is tighter too: current + evidence now bounds it as a small auxiliary route-entry tracker collection with an allocator at + `0x004a42b0`, a refcount or destroy path at `0x004a4340`, a direct route-entry group-id setter + at `0x00489f80`, an endpoint-membership probe at `0x00494ed0`, a boolean-latch refresh or + owner-notify path at `0x00494fb0`, and a two-endpoint merge or bind helper at `0x00494f00`. + One smaller constructor-side ownership split is tighter now too: the cached `u16` chain fields + `[site+0x26e]`, `[site+0x270]`, and `[site+0x383]` are no longer free-floating. Constructor-side + helper `0x0041f7e0` prepends one new peer into that chain by storing the old head from + `[this+0x383]` into `[peer+0x270]` and then replacing `[this+0x383]` with the peer's own + placed-structure id `[peer+0x2a4]`; the direct resolver `0x0041f810` turns the cached head id + back into one live record through `0x0062b26c`; and the removal-side companion `0x0041f850` + removes one peer from the same chain before clearing `[peer+0x26e/+0x270]`. That caller split is + now strong enough to treat this as one cached single-link or predecessor-chain family beneath + placed-structure construction and rebuild rather than as unrelated scratch words. + That bind side is tighter now too: the trackers group route entries only when a route-key-like + value from `0x0048aa70`, the route-entry signature word `+0x22e`, and the boolean latch derived + from byte `+0x44` all agree. The deeper handoff under that lane is no longer anonymous either: + `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380` is now + bounded as the internal search core that runs the first candidate sweep, quality gates, and the + later route-extension fallbacks before returning one resolved route-entry id or `-1`. The first + sweep now has a bounded owner at `0x0049bd40`, and the two later fallback helpers are bounded as + the route-entry point-window coverage query `0x00494cb0` and the frontier-extension helper + `0x0049c900`. The math side is bounded more cleanly now too: the family reuses + `math_measure_float_xy_pair_distance` `0x0051db80` for its direct point-to-point scalar, + `math_compute_quadrant_adjusted_heading_angle_from_xy_pair` `0x004952f0` for heading-angle + construction, `math_normalize_subtracted_angle_delta_and_report_wrap` `0x004953c0` for wrapped + angle deltas, and now one tighter visual-side strip too: `0x00539230` applies one local + float-preset layout from state byte `[entry+0x218]`, `0x00539380` loads the matching + table-driven profile bands and optional display latch `[entry+0x44]`, `0x005394b0` exports four + consecutive `3*dword` triplet bands from the entry into caller buffers, and `0x005391b0` + releases one optional world-space attachment before the entry's vtable slot `+0x00` teardown + fires. The adjacent publish side is bounded too: `0x00539580` broadcasts one caller-supplied + three-scalar packet across the optional attached-handle list at `[entry+0x08]`, and + `0x005395d0` ensures that same list, adds one new handle, and immediately republishes one + aggregate scalar derived from local bands `[+0x18/+0x24/+0x30/+0x3c]` together with head lanes + `[+0x0c/+0x10]`. The next owner layer is tighter now too: `0x00539640` is the heavy derived-band + rebuild that turns those four triplets plus profile weights `[entry+0x1f5/+0x1f9/+0x1fd]` into + the larger scalar bands rooted at `[entry+0x63]` through `[entry+0x1d3]`, refreshes center + scalars `[entry+0x0c/+0x10]`, re-enters root query `0x00534490` several times, and conditionally + maintains the optional `0xc0`-byte display buffer at `[entry+0x1e3]` according to display-state + byte `[entry+0x44]`. The surrounding wrappers are coherent with that same ownership split: + `0x0053a740` copies caller triplets into `[entry+0x14/+0x20/+0x2c/+0x38]`, refreshes optional + attachment id `[entry+0x55]` through `0x00533e00/0x00533dd0`, and republishes center lanes + `[entry+0x1ed/+0x1f1]`; `0x0053a890` reprojects the stored triplets through `0x00534490` and + rebuilds; `0x0053a920` fills all four triplets from one uniform scalar before rebuilding; + `0x0053ac40` rebinds the root pointer, clears attachment state, and optionally rebuilds from the + current triplets; `0x0053aca0` is the concrete default constructor for the same route-entry + object family; and `0x0053ae10` is the construction-time root-bind plus state-profile-and-triplet + initializer. The attachment manager beneath that strip is tighter too: `0x0053a5b0` is the tiny + broadcast wrapper over current head lanes, `0x0053a5d0` is the heavier ensure-and-clone path + that seeds one new attached handle from the first live entry when a list already exists, and + `0x0053a6d0` tears that attached-handle list back down. The collection side is tighter too: + `0x00491af0` constructs the indexed + `0x006cfca8` owner beneath the world bundle-load path, and the later post-load `319` lane now + uses `0x00491c20` as a dedicated collection-wide refresh pass that re-enters `0x00539640` on + every live route entry. That keeps the route-entry visual or presentation side grounded as a real + sibling strip to the search and regrouping code, not loose per-caller scratch fields. + angle-delta checks, and `math_abs_double_with_crt_special_case_handling` `0x005a152e` for the + absolute-value side of the quality gates. Current evidence also bounds the threshold shape a + little more tightly: the initial sweep and later extension path both reuse one signed angle-bias + term `+/-0.181000038854627`, and the first sweep switches between a looser `1.4` and stricter + `1.8` quality multiplier depending on route-policy byte `4` or the broader display-runtime + preference `[0x006cec78+0x4c74]`, already grounded elsewhere as `Auto-Show Grade During Track + Lay`. + The small policy-byte semantics are still not fully closed, but current evidence is tighter than + before. Literal byte `1` is now the strongest current match for direct linked-site + endpoint-anchor creation or replacement, because the linked-site constructor and neighboring + repair branches around `0x00480463`, `0x00480a77`, and `0x00480b69` all feed that byte into + `0x00493cf0` before rebinding one chosen route-entry anchor through `0x0048abc0`. Literal byte + `2` now looks broader: the later world-side caller at `0x00480cd0` and the linked-site refresh + helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` both + reach `0x004a01a0` with both optional endpoint-entry ids unset and that byte, so the strongest + current read is a full linked-site route-anchor rebuild between optional endpoint entries rather + than the narrower direct creation lane. The TrackLay side now gives one tighter user-facing + anchor too: the live mode field `0x00622b0c` is already grounded as `Lay single track.` `0x1` + versus `Lay double track.` `0x4`, and the small mapper `0x004955b0` collapses that state into + the endpoint-policy bytes later passed to `0x00493cf0`, so the strongest current read is + `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`. + Bytes `1/2` are still the ones that enable the + auxiliary tracker lane in `0x004a01a0`, while byte `4` now reads more narrowly as the larger + company-side endpoint-synthesis charge inside `0x00493cf0`, because that helper feeds `-1` + versus `-2` into the saturating company counter helper `0x00423ec0` on `[company+0x7680]` + rather than skipping the company branch entirely. That counter is tighter now too: nearby + company initialization seeds it to `50` when scenario byte `0x4aaf` is enabled and to sentinel + `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed + fallback `29999`. Current language-table correlation also gives `0x4aaf` a stronger + player-facing meaning: it is the live gate behind `Company track laying is limited...` and the + event variable label `Company Track Pieces Buildable`. So the current strongest read is + available track-laying capacity, not an abstract company route-budget. That site-side helper + also closes one adjacent ownership gap: beneath + `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, it rebuilds + one linked site's route-entry anchor and display-name buffer. That path is tighter now than just + “bind anchor then touch `0x006cfcb4`”: after the literal-policy-`2` rebuild succeeds it + re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, + which can now be described more concretely. Its early prepass at `0x004a4380` can split one + mismatching adjacent subchain into a fresh tracker group; its later helper at `0x004a4ce0` can + transfer one compatible adjacent chain between neighboring groups; and the repair-side helper at + `0x004a4ff0` can reseed a whole route-entry component into a fresh tracker when the old group id + is missing or invalid. The regrouping pass also still rewrites compatible endpoint slots through + `0x004950f0` and refreshes one nearby cached-match payload band through `0x00495020` before the + helper resumes the name-buffer work. The remaining display-name side still matches the earlier + grounded text family: copy the resolved city name when available, append civic suffixes + `Township`, `New`, `Modern`, or `Renaissance`, append `Service Tower` or `Maintenance Facility` + on the linked-instance class branches, and otherwise fall back through the older + `Junction`..`Center` and `Anytown` text families. + The higher owner-refresh side of that same tracker family is tighter now too. The reusable gate + at `0x004a4c00` no longer looks like a stray predicate: it explicitly requires both route-entry + trackers to keep matching cached fields `+0x18/+0x1c/+0x1d/+0x1e` and both route entries to keep + their special side fields `+0x20e/+0x222` unset before adjacent-chain transfer is allowed. The + collection-wide traversal sweep at `0x004a5fc0` is bounded now as the connected-component refresh + owner over tracker field `+0x0c`, with a temporary queue at `[this+0x94]` and direct fallback + into the reseed helper `0x004a4ff0` whenever one neighboring route entry has lost valid tracker + ownership. Above both of those sits `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` + `0x004a6360`, which now reads as the owner-side latch-change refresher invoked from + `0x00494fb0`: it starts from one owner route-entry id, confirms both bound endpoint entries agree + on the boolean class state implied by route-entry byte `+0x44`, and then probes both endpoint + sides for adjacent route-entry groups that can be absorbed through the `0x004a4c00 -> 0x004a4ce0` + gate-and-transfer pair. The sibling query side is bounded now too: + `aux_route_entry_tracker_collection_query_component_label_by_tracker_id` `0x004a6320` is the + dirty-aware accessor for tracker field `+0x0c`, while + `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` is the remaining + mode-switched lower metric dispatcher beneath the heavier chooser at `0x004a6630`, forwarding + fixed route-entry-pair candidate sets into either `0x004a5280` or `0x004a5900` depending on the + shared hundredths-scaled build-version query + `runtime_query_hundredths_scaled_build_version` `0x00482e00` over `0x006cec74`. The current + caller thresholds `>= 0x67`, `>= 0x68`, `>= 0x69`, and `>= 0x6a` now line up with executable + build values `1.03`, `1.04`, `1.05`, and `1.06`, and the version source itself can come from + the multiplayer companion path as well as the local executable, so this split is no longer + best-read as a time- or era-side cutover at all. It now reads more cleanly as a pre-`1.03` + versus `1.03+` route-metric compatibility dispatcher. That lower split is tighter now too: + `0x004a5280` is the weighted recursive branch with heuristic ordering, per-tracker best-cost + cache `0x006cfcac`, and prune threshold `0x006cfcb0`, while `0x004a5900` is the alternate + recursive neighbor-walk branch that stays within compatible component labels through + `0x004a62c0` and accumulates step and mismatch penalties over route-entry links + `+0x206/+0x20a/+0x20e`. Above both of them, + `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` + `0x004a6630` is now bounded as the real chooser: direct fixed-pair query when both entries pass + `0x0048b870`, otherwise endpoint-pair fallback across the two tracker groups. + The adjacent route-style rebuild side is tighter now too: the same build-version family reaches + `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0`, where build + `1.04+` keeps one `Recycling Plant` stem-specific compatibility branch alive and build `1.05+` + skips one older descriptor-side attenuation fallback. There is also one neighboring world-side + compatibility lane now bounded below the same family: `placed_structure_collect_connected_component_tile_bounds_with_version_gate` + `0x004160c0` skips one older recursive component-bounds walk through `0x00415f20` on build + `1.03+` when scenario field `[0x006cec78+0x46c38]` is already active. The wrapper above that + path is bounded now too: `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` + `0x00416170` walks the caller rectangle, maps tile keys into the component table rooted at + `0x0062ba7c`, and only re-enters `0x004160c0` when the current owner still has no cached bounds + and the local world or scenario suppressors stay clear. The higher neighboring raster side is + tighter too. `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610` is the + shared projected-rectangle helper above `world_grid_refresh_flagged_region_float_extrema_and_mean` + `0x00415020`: it refreshes the temporary sample band at `0x0062b7d0`, publishes the surviving + rectangle through `0x0044d410`, and on the single-sample path re-enters + `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` to flip mask bit + `0x01` for the corresponding non-sentinel cells. Current grounded callers for `0x00418610` are + the neighboring placed-structure local-runtime helper `0x00418be0` and the heavier placement + validator `0x004197e0`, so this adjacent family now reads more like projected placement or local + raster prep than an unowned generic world-grid scan. One neighboring caller into the same + height-support band is tighter now too: the world-side branch at `0x00419070..0x004190f0` + walks one admitted local window, dispatches the acceptance-gated relaxer `0x0044d6e0` once per + cell with a one-cell radius and no immediate tail refresh, and only after that outer loop + completes re-enters `0x0044d410` on the full surviving rectangle. The higher owner split is + tighter now too. + `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` + `0x00418be0` is the broader construction or rebuild lane: resolve one candidate id from a stem, + build projected scratch through `0x00416ec0`, then publish the projected rectangle and validate + its side windows through `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` + `0x00416620`. That publish pass is bounded now too: it stages `0x0062b308/0x0062b30c/0x0062b310`, + validates the rectangle against route-entry coverage through + `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, can branch into + the special projected-slot picker `placed_structure_try_select_projected_rect_profile_slot` + `0x00415570`, and refreshes the compact per-cell side tables through + `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` before the + finished scratch is copied into one queued runtime record and the new record re-enters + `0x00416170` when its rectangle is valid. The smaller sibling + `0x00419200` is now bounded beneath that same projected-rectangle family too: it is the tiny + getter over the temporary dword cell-value bank at `0x0062b300`, flattening one caller cell + through live world width `[0x0062c120+0x2155]` and returning the corresponding dword when the + bank exists, else `0`. Current grounded caller is the later world-side branch at `0x0048af99`. + The smaller sibling + `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` + `0x00418a60` now reads as the current-subject clone path above the same connected-component and + mask-refresh helpers, returning the cloned local runtime record later stored into `[site+0x24e]` + by `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` + `0x0040e450`. The higher wrapper above that clone path is bounded now too: + `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0` + first drains the temporary site-id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` through + `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and + `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`, rebuilding one cloned + local-runtime record per queued placed structure through `0x0040e450`, and only then sweeps all + live placed structures through the side refresh helper + `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10`. + The constructor or ownership split beneath that family is tighter now too. The shared allocator + `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` no longer just reaches + an anonymous `0x3e1`-byte scratch object: it first constructs one concrete placed-structure + specialization through `placed_structure_construct_concrete_specialization_vtable_5c8c50` + `0x0040c950`, which calls `0x0045b680` to seed the common base table `0x005cb4c0`, clear the + derived field band `[this+0x23a..+0x26a]`, and re-enter the older base initializer + `0x00455610`, then installs the specialization table `0x005c8c50`. The paired cleanup path at + `0x0040c970` now reads like the matching teardown thunk: it briefly reinstalls `0x005c8c50`, + then immediately demotes the record back to the base table through `0x0045b040 -> + 0x00455650` before the stack object is freed or unwound. The corresponding serializer entry + `0x0040c980` is equally tight now: it simply tails into `0x0045b560`, which first re-enters the + base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1` and + `0x5dc2` over `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. + One nearby string clue is useful but narrower than it first looked. The specialization table at + `0x005c8c50` is immediately followed by `RadioStation` and `Radio Station`, but the local member + method `0x0040ce60` now shows why: it compares site stem `[this+0x3ae]` against `Radio Station`, + canonicalizes that stem to `RadioStation` on match, and then re-enters `0x0040cd70` plus + `0x0045c150`. So those adjacent strings ground one stem-normalization lane inside the + specialization, not the specialization name by themselves. The small virtual-slot and cached-id + side is tighter now too. The same `0x005c8c50` table carries three literal-false stubs + `0x0040cc10/0x0040cc20/0x0040cc30`, one literal-true stub `0x0040ccc0`, and the narrower + linked-site-id presence predicate `0x0040ccb0`, which simply returns whether `[this+0x2a8]` is + nonzero. Beneath the stem-normalization path, `0x0040cd70` is now bounded as the common cached + source/candidate resolver: it clears `[this+0x3cc]` and `[this+0x3d0]`, scans source collection + `0x0062b2fc` for a stem match against `[this+0x3ae]`, stores the matched source id into + `[this+0x3cc]` plus the linked candidate/profile id from `[source+0x173]` into `[this+0x3d0]`, + and when no match exists formats localized id `0x00ad` through `0x0051e980` with the current + stem buffer. That warning path is tighter now too: `0x0051e980` is the guarded warning-modal + publisher that forces cursor visibility through `MouseCursor.cpp` before showing the shared + warning box. The two tiny followers `0x0040cec0` and `0x0040cee0` then resolve those cached ids + back into concrete source and candidate records through `0x0062b2fc` and `0x0062b268` + respectively. The derived payload and transient family under that same table is tighter now too. + `0x0045c150` is the clear payload-loader + counterpart to `0x0045b560`: it reinitializes the derived field band, opens the `0x5dc1/0x5dc2` + payload bracket, restores the two payload strings into `[this+0x23e]` and `[this+0x242]`, clears + the transient roots `[this+0x24e]`, `[this+0x256]`, `[this+0x25a]`, and `[this+0x25e]`, and then + rebuilds follow-on specialization state through `0x0045b5f0` and `0x0045b6f0`. The neighboring + builder pair is coherent too: `0x0045b210` formats `amb_%1_01.wav`, allocates a `0x141`-byte + transient object, stores it at `[this+0x24a]`, and registers it through `0x0052da00`, while + `0x0045c310` allocates the separate primary transient handle at `[this+0x246]` from payload + strings `[this+0x23e]` and `[this+0x242]`, then publishes it through `0x00530720` and + `0x0052d8a0`. The next rebuild layer is tighter now too. `0x0045b5f0` resolves one current + world-position tuple through `0x0052e720 -> 0x0051f090 -> 0x00534490`, then uses that derived + scalar to refresh the ambient-side transient again through `0x0045b210`. Above that, + `0x0045b6f0` clears the optional handles at `[this+0x25a]` and `[this+0x25e]`, then probes and + materializes a larger named variant family rooted in `[this+0x23e]` through strings such as + `%1_`, `%1_Upgrade1`, `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and + `%1_Upgrade1Light%2.3dp`, looping across numbered variants and publishing surviving records + through `0x0052d8a0`. One higher timed branch is bounded now too: `0x0045baf0` advances the two + timer-like fields `[this+0x26a]` and `[this+0x266]`, gates on nearby world-distance and + candidate-side checks, and then formats one output around `rnd_%1_%2.wav` plus the same anim or + light string family before dispatching through `0x00531e50` under owner `0x006d402c`. Their + release-side companions `0x0045b160` and `0x0045c3c0` tear down those same transient roots and + payload strings again, and the recurring service slice `0x0045be50` updates the derived scalar + triplet `[this+0x22e]`, `[this+0x232]`, and `[this+0x236]` before republishing it through + `0x00530720`. The string literals `amb_%1_01.wav`, `%1_Anim%2.3dp`, + `%1_Upgrade1Anim%2.3dp`, `%1_Upgrade1Light%2.3dp`, and `rnd_%1_%2.wav` therefore ground the + derived band `[this+0x23e..+0x26a]` as one payload-plus-transient owner family with ambient, + animation, light, and random-sound components, rather than more linked-site or route-entry ids. + One broader specialization-side build pass under that same family is bounded now too. + `0x0045b760` first scans one base-or-upgrade descriptor family rooted in `[this+0x23e]` + through `%1_` or `%1_Upgrade1`, probing each numbered hit through `0x0053c930` and dispatching + every accepted one through vtable slot `+0x7c`. It then builds the matching attached-emitter list + through `0x0045e940`, ensures the shared `%1_Anim.3dp` payload root exists through `0x0045ae80`, + and finally scans the paired animation family through `%1_Anim%2.3dp` or + `%1_Upgrade1Anim%2.3dp`, materializing each accepted hit into a `0x206` record through + `0x00530640`, publishing that record through `0x0052d8a0`, hashing the generated name through + `0x0053d810`, and forwarding the result into `[this+0x256]` through `0x0045a7f0`. So that + specialization side now has one explicit base-or-upgrade descriptor and animation-record build + pass above the later timed anim/light/random-sound service slice, not just the narrower + `%1_Anim` and `%1_Upgrade1Light` helpers. + The shared `%1_Anim.3dp` collection under that build pass is tighter now too. `0x0045ae80` + formats literal `%1_Anim.3dp`, probes the named-bank owner `0x006d4020`, reads the matched + payload bytes, and lazily allocates the intrusive shared list root `0x006acd5c`, so this is the + bootstrap for the specialization-side shared animation payload family rather than just another + bank-read leaf. `0x0045a7f0` then acts as the keyed replace-or-publish helper over that same + family: it rewrites matching keys across the current `0x006acd50/0x006acd4c` row collection, + mirrors the replacement into the per-row four-lane pointer bands, inserts newly active rows into + the intrusive list rooted at `0x006acd5c`, and when selector table `0x006acd44` is live it + allocates one selector-`0` effect slot through `0x00475ed0` before forwarding it into + `0x00475240(-1,0)`. The smaller helper `0x0045a700` is the keyed three-float accumulator beneath + that same path: it scans the live `0x168`-byte rows in `0x006acd50`, filters on one key dword + plus row flag bit `0x400`, and accumulates one output anchor delta from the shared basis bands in + `0x006acd4c+0x04/+0x34` or `+0x40/+0x70`. The service side above the collection is also bounded: + `0x0045af50` clears globals `0x006acd44/48/54`, publishes the current row collection into + `0x006acd50/0x006acd4c`, releases oversize selector roots through `0x00475100`, and prunes every + intrusive active record in `0x006acd5c` whose owner pointer at `[record+0xf0]` matches the + current collection owner. The heavier per-record body is `0x0045a9c0`: it honors the current + controller gates in `0x006acd48/58`, clears and re-arms the selected effect-slot band in + `0x006acd44`, optionally mirrors one caller dword into row field `[row+0x80]`, updates timing and + mode fields across every matching shared row, derives local scalar deltas through `0x0045a280`, + optionally subtracts keyed anchor deltas through `0x0045a700`, and republishes the finished two + owner triplets through `0x0052e8b0` and `0x00530720`. + `0x0045ade0` seeds cursor `0x006acd60` from `[0x006cec78+0x15]`, then services the intrusive + list in `0x0f`-tick windows by dispatching the heavier per-record body at `0x0045a9c0(owner, + cursor, 0)` for every linked record whose owner pointer at `[record+0xf0]` is live. So the + specialization transient family now includes a concrete shared `%1_Anim.3dp` payload root, + keyed record replacement, keyed anchor accumulation, and a bounded 15-tick shared service loop, + not just the base builder at `0x0045b760`. + The low-side leaves under that same family are tighter now too. `0x0045b050` is the explicit + field reset for payload roots `[this+0x23e/+0x242]`, transient handles `[this+0x246/+0x24a/+0x24e]`, + selector slot `[this+0x262] = -1`, timer fields `[this+0x266/+0x26a]`, and the packed flag band + `[this+0x23a..+0x23d]`, with an optional tail into `0x00455610` when the caller requests a + broader base clear. `0x0045b0b0` is the paired integer-triplet publish leaf: it forwards one + caller triplet through `0x0052e680` on the specialization owner and, when present, repeats that + same publish into the primary transient `[this+0x246]`. `0x0045b0f0` is the neighboring packed + RGB-triplet forwarder into vtable slot `+0x58`. The two tiny wrappers around them are now + explicit too: `0x0045b040` demotes the specialization straight back to base vtable `0x005cb4c0` + before tailing into the common cleanup body `0x00455650`, while `0x0045b110` is just the direct + wrapper into the shared world-anchor triplet publisher `0x00455660`. + One intermediate transient build layer is bounded now too. `0x0040cf00` first requires + creation-mode byte `[this+0x3d4] == 1` and live seed handle `[this+0x24e]`, re-enters + `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, + `[this+0x21]`, `[this+0x3a]`, and `0x005c8cf4`, and then allocates a second transient handle + into `[this+0x25a]` through `0x00475ed0`. It follows that with one current world-position + resolve through `0x00414450` and `0x0052e720`, several local offset-triplet writes through + `0x00475010`, and four numbered channel updates through `0x00475030` with selector ids `1..4`. + That is enough to bound it as another specialization-side transient-handle builder beneath the + same payload family as `0x0045c310` and `0x0045b210`, without yet over-naming the user-facing + subtype or effect semantics of the built handle. The adjacent data-loading strip under that same + transient family is tighter now too. `0x00474700` reloads `particles.dat` into global root + `0x006cea5c` and then registers literal `ParticlesTexture` through owner `0x006d4030`; + `0x00474790` reloads `emitters.dat` into global root `0x006cea60`; `0x00474820` hashes one + caller-supplied emitter name and resolves the first matching entry out of that `emitters.dat` + table; `0x00474860` is the adjacent formatted-variant iterator that walks the same table through + `%s%s%i.3dp`, saving the selected row root into `0x006cea90` and the generated variant name into + `0x006cea94`; `0x00474970` is the small handle-array release helper used by the same + emitter-template teardown side; and `0x004749a0` is the tiny exact-compare predicate for literal + `steam`. The lower definition-to-handle materialization body is bounded now too: `0x004749d0` + copies scaled float and packed dword bands from one emitter-definition row into the attached + emitter handle, resolves the named particle row from `particles.dat` through `0x0053d810`, and + mirrors that particle row into `[handle+0x10c..]` before returning the live handle. The + higher creator above that materializer is tighter now too: `0x00474e20` first strips special + high bits for `CargoMoney_DollarSign`, clears incoming flag `0x400` when definition gate + `[def+0xb8]` is zero, and then either hashes the definition name plus owner token and clones one + owner-side template through `0x00556ce0`, or allocates a fresh `0x1fd` runtime emitter through + `0x00556920` before re-entering `0x004749d0`. On success it publishes that emitter through + `0x0052d950`, stores the definition owner pointer into `[emitter+0x60]`, and when final flags + carry `0x02000000` it forces persistent flag dword `[emitter+0xbc] = 1`. One larger owner-stem + branch above that iterator is bounded now too: `0x0045e940` rejects `Stadium`, clears caller flag + bit `0x10` for `ParticleCar`, repeatedly pulls formatted variants through `0x00474860`, + instantiates each accepted variant through `0x00474e20`, sets emitter flag `0x02` for + `Nuclear`, and optionally returns the created emitter list through the caller array. So the + `0x00474e20/0x00475010/0x00475030` emitter builders are now sitting on top of a grounded pair + of particle and emitter data tables plus one concrete owner-stem-driven variant-list builder, + not just anonymous global payload roots. The small shared slot utilities + under those builders are tighter now too: `0x00474fe0` is the shared per-slot flag broadcast + into `[emitter+0xbc]`; `0x00475010` caches one shared anchor + triplet into globals `0x006cea68/0x006cea6c/0x006cea70`, `0x00475030` republishes that cached + triplet into either all emitters in one slot container or one selected emitter index at + `[emitter+0x1b0..+0x1b8]`, `0x00475240` toggles the per-emitter enable byte `[emitter+0x1d8]` + for either all or one selected emitter, and `0x004752b0` is the paired boolean query that + reports true only when that same byte is zero. The update side is explicit too: `0x00474f70` + runs `0x00555e50(0)` across either one supplied slot container or every slot in the global linked + list rooted at `0x006cea74`. The release side is explicit too: `0x00475100` + tears emitter slots down, optionally unlinks them from the global active list + `0x006cea74/0x006cea78/0x006cea7c`, and then either recycles or frees the slot depending on + whether it falls inside the pooled descriptor rooted at `0x006cea58`. Two named bundle builders + are grounded now too: `0x004752d0` builds the three-emitter `BrokenDown_Steam` + + `FlamespoutB` + `Crash_SmokeA` bundle, while `0x00475550` builds the two-emitter + `BrokenDown_Steam` + `BrokenDown_Smoke` bundle. The next owner layer above those helpers is + grounded now too. `0x00474ce0` is the global particle/emitter bootstrap: it reloads + `emitters.dat`, reloads `particles.dat`, publishes the mode-`1` ratio labels through + `0x00474690`, lazily allocates pooled slot root `0x006cea58`, allocates backing slab + `0x006cea54`, seeds that slab into the pooled descriptor through `0x0053dcf0(0x38, 0x2710, 1)`, + clears the global linked-slot heads and shared anchor globals, rebuilds the flagged templates + through `0x00474c60`, and finally publishes enable-state `1` through owner `0x006d4030`. + `0x00474db0` is the teardown-side companion that frees `0x006cea54`, `0x006cea5c`, + `0x006cea60`, and then resets and frees the pooled slot root `0x006cea58`. That makes the + effect-slot builders a real subsystem rooted at `0x006cea54..0x006cea98`, not just a loose + string-and-handle utility strip. The named bundle surface is broader now too: `0x00475420` + selects one `Volcano_BlackSmoke*` + `Volcano_Lava*` pair from the caller float tier + `0.5/0.75/1.0/1.5/2.0` and builds the two-emitter volcano bundle; `0x00475650` builds the + three-emitter `ServiceTower_Water2` + `ServiceTower_Water` + `ServiceTower_Water3` water bundle + from the paired `ServiceTower_Anim2#water.3dp`, `ServiceTower_Anim3#water.3dp`, and + `ServiceTower_Anim4#water.3dp` definitions; `0x004757b0` builds the three-emitter + `Rocket_Flame` + `Rocket_Smoke` + `Rocket_Sparkle` fireworks bundle from the paired + `Fireworks_Anim2/3/4#water.3dp` definitions; `0x00475910` is the adjacent randomized + one-emitter fireworks builder that rotates among `Fireworks1/2/3`, uses + `Fireworks_Anim5#water.3dp`, and writes fixed dword `0x3c` into `[emitter+0xbc]`; + `0x004759f0` and `0x00475b30` build the one-emitter `CargoMoney_DollarSign` and + `SpendMoney_DollarSign` bundles; `0x00475a90` builds the one-emitter `SelectObject` bundle; + `0x00475bd0` builds the five-emitter directional construction bundle from `Construct_Pos`, + `Construct_Left`, `Construct_Right`, `Construct_Back`, and `Construct_Forward`; `0x00475dc0` + selects between one-emitter `Mist` and `MistSmall`; and `0x00475e30` builds the one-emitter + `Vent` bundle. The next local owner above that catalog is grounded too: `0x00475ed0` is the + selector-driven named-bundle dispatcher that chooses one of those builders from the caller + selector, mirrors the first emitter's attachment token into `[slot+0x04]`, stores caller mode + into `[slot+0x34]`, and when that mode equals `1` links the finished slot into the global active + list `0x006cea74/0x006cea78/0x006cea7c`. So that specialization-side transient path now has a + much broader data-backed effect catalog and a concrete selector-driven bundle owner above it, not + just the earlier broken-down bundles. + One adjacent train-side effect strip is bounded now too, and it should stay separate from the + concrete placed-structure specialization family. `0x0045d130` resolves one owner profile + through `0x006ada84`, allocates a `0x141`-byte handle, initializes it through `0x00554830` + using one mode-selected train sound stem from the tiny selector at `0x0045d22e`, applies two + fixed parameter writes through `0x00554340` and `0x00554450`, stores the result at `[this+0x336]`, + and registers it through `0x0052da00`. `0x0045d260` is the paired live-handle updater: it clamps + one caller-scaled rate into `0x1f40..0xac44`, forwards that through `0x005542c0`, pushes the + caller gain through `0x00554450`, and when the current handle mode at `[handle+0x138]` equals + `1` also forwards zero through `0x005543f0`. The broader owner above both helpers is + `0x0045d2e0`: it republishes the current world anchor through `0x0052e720`, updates an existing + live sound handle at `[this+0x346]` when one exists, or otherwise selects one new sound stem from + fixed `Train_Burning.wav`, fixed `Train_Breakdown_loop.wav`, or one dynamic table-driven name + after the `0x0041b8f0 -> 0x004a8840` branch, then creates the fresh sound handle through + `0x00531e50`, stores it at `[this+0x346]`, sets fixed flag bits `0x18`, seeds two scale fields + from the chosen mode factor, and clears the three train-state latches `[this+0x33a/+0x33e/+0x342]` + again. So the neighboring `0x0045d130/0x0045d260/0x0045d2e0` family is now bounded as a + train breakdown-or-burning sound/effect handle strip rather than more placed-structure emitter + state. + The larger owner above that train-side strip is bounded now too. `0x0045d4b0` optionally clears + prior state through `0x00455610`, copies the caller primary and secondary stems into + `[this+0x32e]` and `[this+0x332]`, probes the named-bank owner `0x006d4020` for the secondary + stem, then falls back through the primary stem and the suffixed `_C.tga` form. It resolves one + `ServicePoint.3dp` payload into `[this+0x23e/+0x23a]`, one `Body.3dp` payload into + `[this+0x242/+0x246]`, counts existing `%1_Truck%2.3dp` variants into `[this+0x31a]`, allocates + the larger per-variant table at `[this+0x316]`, and then enters the later subloops that fill the + cargo-icon, bogie, drivewheel, piston, connecting-rod, coupling-bar, body, and track-point + bands. That keeps the `0x0045d130/0x0045d260/0x0045d2e0` sound helpers nested under a broader + train visual/profile preload owner rather than floating as an isolated sound-only strip. + The release and load sides of that same train family are bounded now too. `0x0045e390` drops the + optional sound handle `[this+0x346]` through `0x00531ef0` plus the mode-gated `0x005317b0` path, + clears the live train-effect handle root `[this+0x336]` by re-entering `0x0045cc90(0)` and + `0x0045cf40(0)`, iterates the variant table at `[this+0x316]` to free per-row pointer arrays, + two heap buffers, and any nested owned list rooted at `[row+0x0c]->[+0x75]`, then frees the main + table and the two payload strings `[this+0x32e]` and `[this+0x332]`. `0x0045e530` is the + load-side owner: it opens tags `0x61a9` and `0x61aa`, reads two heap strings, optionally rewrites + the first string by scanning the live collection at `[0x006d4020+0x429b8]`, rebuilds the train + visual family through `0x0045d4b0` with unit scale, republishes the early per-row handles through + `0x005548d0`, and under scenario latch `[0x006cec78+0x46c34] > 0x2585` also enters the optional + child-record branch under tag `0x61b2` before closing `0x61ab`. That makes the train-side strip a + real payload-owned family with explicit preload, service, load, and teardown phases rather than a + one-off visual helper. + Two shared selector-slot toggles under that same family are bounded now too. `0x0045cc90` owns + the three selector-driven effect slots at `[table+0x34]`, `[table+0x38]`, and `[table+0x3c]`: + in build mode it allocates selectors `1`, `2`, and `3` through `0x00475ed0`, reseeds their + shared anchors through `0x00475010/0x00475030`, and then enables every live emitter in the main + row-object list by writing byte `1` into `[emitter+0x1d8]`; in release mode it tears those same + three slots down through `0x00475100`, clears the table fields again, and disables the same + emitter list by writing byte `0`. `0x0045cf40` is the same pattern for selector `5` into + `[table+0x40]`. So the train visual family now has one explicit selector-slot toggle layer above + the named `0x00475ed0` bundle catalog, rather than touching those effect slots only through the + broader load and teardown owners. + One smaller service leaf under that same family is grounded now too. `0x0045e8c0` walks the + fixed 32-entry row-object strip rooted at `[this+0x277]` and dispatches vtable slot `+0x10` on + every live row object. When the caller supplies a valid selected row index instead of `-1`, it + re-enters that selected row through vtable slot `+0x0c`, and when the paired per-row flag byte in + the neighboring strip is nonzero it also pushes `0,0,1.0f,1.0f` through `0x0052eab0` on that + selected row object. The current grounded callers at `0x0041c680` and `0x0041c69a` derive the + selected row from byte `[cargo+0x20]`, so this is best read as the row-object service plus + selected-entry refresh leaf under the train visual family, not a generic object-list sweep. + One adjacent helper block is tighter now too, and it should stay separate from the concrete + `0x005c8c50` vtable rather than being folded into it. The small predicates + `0x0040cc40/0x0040cc60/0x0040cc80` all follow the same `[this+0x173] -> 0x0062b268` chain into + one linked candidate/profile record. `0x0040cc40` returns whether candidate subtype byte + `[candidate+0x32]` equals `1`, `0x0040cc60` returns raw candidate byte `[candidate+0xba]`, and + `0x0040cc80` returns the stricter conjunction `subtype == 1 && class == 3` using class byte + `[candidate+0x8c]`. The current grounded caller for all three is + `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where they derive + the two boolean mode inputs for `0x00415020`; that makes them a shared candidate-profile helper + cluster adjacent to the specialization family, not direct overrides in the `0x005c8c50` table. + The neighboring `0x0040ccf0` stays on the same “adjacent but not the same vtable” side of the + boundary: it resolves one linked instance through `0x0047de00`, follows that instance's vtable + `+0x80` owner chain, and returns candidate class byte `[candidate+0x8c]`. Current grounded + callers at `0x00480fb5` and `0x004b03ce` compare that returned class against `3` and `4`, so the + current safest note is simply “linked-instance candidate-class reader.” One gated collection-side + scan in the same neighborhood is bounded now too. `0x0040cd10` first requires shell latch + `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current + subject's center world-grid cell through `0x00455f60`, reads the local site roster count and id + list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through + `0x006cec20`. Its current grounded caller is the broader collection sweep at `0x00413860`, so + the strongest current read is a gated center-cell site-roster scan rather than one more direct + specialization override. + One small neighboring world-grid helper is grounded cleanly enough to keep too. `0x0040ccd0` + takes one live world root, one X-like index, and one Y-like index, multiplies the Y-like term by + world width `[world+0x2145]`, adds the X-like term, scales the resulting slot by fixed cell + stride `0x1d7`, and returns the corresponding cell pointer under base `[world+0x2129]`. Current + grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386` and + several world-grid overlay passes in the `0x004525bc..0x00452bb2` range, so that helper is now + best read as the shared `(x,y) -> world-cell*` resolver rather than another object-specific + method. + The next sibling table at `0x005c9750` is tighter now too, though still not fully decoded. The + structural anchor is `map_load_city_database` `0x00474610`: that loader stages bundle tags + `0x61a9..0x61ab`, iterates one collection, and dispatches each entry through vtable slot `+0x44`. + In `0x005c9750`, that same slot resolves into the sibling record family beside + `0x0041ab70/0x0041ab80`, which is enough to treat the table as the city-database entry family + rather than a generic unresolved runtime object. The small load-side slot `0x0041ab70` simply + jumps into `0x0045c6f0`, which restores two strings into `[this+0x32e]` and `[this+0x332]`, + stages the same `0x61a9/0x61aa/0x61ab` tag family, and iterates the child runtime band rooted at + `[this+0x316]`. The one real behavioral slot we recovered there is `0x0041ab80`: it refreshes + one named handle through owner `0x006d4020`, writes the resulting handle into `[this+0x1c]`, + queries three base floats through `0x0045c480`, and returns one scaled float derived from the + first queried component. That method is currently called from later world-side branches at + `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The exact user-facing semantics of the handle and + the many constant-return virtuals in the same table are still open, but the family boundary is no + longer arbitrary: this is now the current city-database entry vtable cluster, not another + placed-structure specialization. One correction matters here too: the lower + `0x00455660/0x00455800/0x00455810/0x00455930` helpers are no longer city-only. Local `.rdata` + now shows the same shared slots under both the city-entry table `0x005c9750` and the sibling + `Infrastructure` table `0x005cfd00`, whose constructors at `0x0048a240/0x0048a2dc/0x00490a3c` + all re-enter `0x00455b20`, install `0x005cfd00`, and seed the same scalar-band family through + `0x00455b70` with the literal stem `Infrastructure`. So the safest current family name for those + low helpers is the broader `0x23a` runtime-object band rather than city-entry-only. `0x00455800` + and `0x00455810` are simply the paired normalized coordinate getters over `[this+0x1e2]` and + `[this+0x1ea]`, which explains why they recur all over the city-side, route-link, and + placed-structure placement code. The narrower helper `0x00455660` sits above those getters: it + scales the caller-supplied normalized coordinate pair, converts it through + `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied integer height bias, optionally + rounds that height through `0x005a10d0` when the auxiliary-preview gate `0x00434050` is active, + and finally publishes the resulting world-anchor triplet through `0x00530720`. One + serializer-side sibling is bounded too. `0x00455930` queries two triplet-like scalar bands + through `0x0052e720` and `0x0052e880` and writes the resulting six dwords through `0x00531030`; + its load-side stream counterpart `0x00455870` reads the same six four-byte lanes back through + `0x00531150`, republishes the first triplet through `0x00530720`, republishes the second through + `0x0052e8b0`, and returns the summed byte count. The neighboring tagged string-triplet serializer + `0x004559d0` is now no longer reversed either: it writes bracket tags `0x55f1/0x55f2/0x55f3` + through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through + `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before the closing + tag. + +### Shared Runtime-Object and Support Families + +The low helper strip beneath that shared family is tighter now too: `0x0052ecd0` is the + common local-state reset that clears the list and handle roots, resets the string/scalar side + bands, preserves only selected low bits of `[this+0x20]`, and reseeds the recurring default + `1.0f` lanes; `0x0052ebd0/0x0052ec50` are the load/save companions for the two flag bits stored + in that same byte; `0x0052eb90` releases every entry hanging from list root `[this+0x79]` + through `0x00554d50`; and `0x0052eca0` is the grouped-table cursor over `[this+0x14]`, + `[this+0x21]`, and `[this+0x3a]` that returns the next `0x45`-byte subrecord in the current + group when one exists. The next shared initializer `0x0052edf0` then binds caller + pointer `[this+0x04]`, resolves optional handles into `[this+0x10]` and `[this+0x1c]`, copies + one anchor triplet into `[this+0x1e2/+0x1e6/+0x1ea]`, sets bit `0x08`, and seeds packed color + `[this+0x43] = 0x007f7f7f`; its release-side siblings `0x0052eeb0` and `0x0052ef10` clear the + two owned list roots `[this+0x79]` and `[this+0x7d]` through distinct per-entry destructors + before freeing the list roots themselves. The broader release body `0x0052ef70` sits above that + strip: it clears the active shell preview-owner latch when it still points at `this`, drops the + dependent handle at `[this+0x0c]`, recursively tears down the nested object list `[this+0x75]`, + clears sibling owned list `[this+0x81]`, detaches any world binding rooted at `[this+0x04/+0x08]`, + and finally frees the optional handles at `[this+0x10]` and `[this+0x1c]`. The next shared + dirty-bit helper `0x0052f120` is now bounded too: when byte `[this+0x20]` still carries bit + `0x02`, it rebuilds the cached 16-dword transform-style block at `[this+0x14e]` from scale + `[this+0x36]`, anchor triplet `[this+0x1e2/+0x1e6/+0x1ea]`, and either the live local vector + lanes `[this+0x4b/+0x4f/+0x53]` or the stored fallback block at `[this+0x18e]`, then flips the + dirty bit over to the cached-ready bit `0x04`. The next two adjacent helpers are bounded too: + `0x0052f1e0` is a pure five-vec3 boolean geometry predicate built from signed-volume or + separating-plane style tests, and `0x0052f370` is the quantized selector that rounds world + coordinates, folds them through table `0x006d9098`, samples one grouped metric through owner + `[this+0x04]`, updates byte `[this+0x5c]`, and then chooses the active `0x45`-byte subrecord by + storing index `[this+0x21]` and pointer `[this+0x18]`. The adjacent emission owner `0x0052f500` + is tighter now too: it starts from that selected grouped subrecord, snapshots the global packet + write pointer and remaining count at `0x00cc3b64/0x00cc3b5c`, optionally refreshes the cached + transform block and applies the five-vec3 predicate when state bit `0x01` is active, and then + hands off to the concrete emitters `0x0052dd00` and `0x0052e060`. Those two helpers are no + longer best read as shell-only batch expanders. `0x0052dd00` emits the materialized group packet + rows as one `0x20`-byte segment-record window for the layout-state presentation owner + `0x005490b0`, while `0x0052e060` emits the same row family as one `0x18`-byte vertex24 window + for the shell-side presentation branch `0x00528821`. The next shared helpers under that emission + band are now + bounded too: `0x0052d8a0/0x0052d950/0x0052d9a0` are the three owned-list registration helpers for + child objects and copied-anchor records on `[this+0x75]`, `[this+0x79]`, and `[this+0x7d]`; + `0x0052daa0` is the explicit grouped-subrecord selector; `0x0052db10` materializes the current + group's packet rows after storing scalar `[this+0x69]`; and `0x0052dc00` then buckets those + materialized rows by four float thresholds. A concrete owner above that strip is grounded now + too: `vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children` + `0x004858e0` uses those same registration and grouped-row helpers while building + `%1_ExhaustSmoke.3dp`, `%1_MuzzleFlash.3dp`, `%1_RoadWheelL%2.3dp`, + `%1_RoadWheelR%2.3dp`, `%1_IdlerWheelL.3dp`, `%1_IdlerWheelR.3dp`, + `%1_DriveWheelL.3dp`, `%1_DriveWheelR.3dp`, `%1_TrackL.3dp`, `%1_TrackR.3dp`, and + `%1_MantletLight1.3dp` child records under the broader vehicle-visual owner `0x00485760`. + The next shared helpers under that emission band are now + bounded too. `0x0052fb70` is the packed-color propagation helper over `[this+0x43/+0x47]`: when + shell gate `[0x006d4024+0x114742]` is live it combines stored high-byte state with either dim + RGB `0x003c3c3c` or full-bright RGB `0x00ffffff`, pushes the same dim-or-bright triplet into the + child list `[this+0x75]` through `0x0052e680`, and optionally recurses that update over the whole + child tree; when the shell gate is absent it instead stores the raw byte into `[this+0x47]` and + only recurses that byte state. `0x0052fd60` then republishes current anchor triplet + `[this+0x1e2/+0x1e6/+0x1ea]` into every attached entry hanging from list root `[this+0x81]` + through `0x005545d0`. The heavier relocation sibling `0x0052fdc0` marks the object dirty, adds a + caller-supplied triplet delta to the same anchor, quantizes old and new X/Z lanes against the + live world grid, rebinds world handle `[this+0x08]` through `0x00533c20/0x00533bf0` when the + quantized cell changes, and on success re-enters `0x0052fd60`; out-of-bounds moves restore the + prior anchor and fail. One more adjacent rotation-side helper is now bounded too: `0x0052ffb0` + converts the current local 4-dword orientation block at `[this+0x1ce..+0x1da]` into a temporary + axis-angle representation, scales the recovered angle by the caller float, and rebuilds the + stored orientation block by re-entering `0x0052e9f0`. The immediate anchor-publish sibling + `0x00530720` is now explicit too: it is the absolute-triplet form of the same relocation family, + storing one caller-supplied anchor directly into `[this+0x1e2/+0x1e6/+0x1ea]`, optionally + rebinding world handle `[this+0x08]` when the quantized X/Z cell changes, and then re-entering + `0x0052fd60`. The adjacent packet-side query `0x00530030` is bounded as well: it starts from the + currently selected grouped `0x45`-byte subrecord, snapshots the same global packet source span as + `0x0052f500`, lazily refreshes cached basis lanes when needed, transforms one caller-supplied + input triplet through that basis, and then walks the remaining packet span until + `0x0052f1e0` reports one overlap or the span is exhausted. One sibling-table strip is now + explicit too. Table `0x005dd1f0` has the tiny wrappers `0x00530640`, `0x00530670`, and + `0x00530680` as its shared seeded-constructor, reset, and release thunks over `0x0052edf0`, + `0x0052ecd0`, and `0x0052ef70`, while `0x005305c0` is the small list-bit propagator that sets or + clears bit `0` in `[entry+0xb0]` across owned list `[this+0x79]`. The first heavier body under + that same table is now bounded too: `0x00530690` copies one pair of 16-dword cached blocks from a + source object into `[this+0x10e]` and `[this+0xce]`, refreshes local cached transform + `[this+0x14e]`, and recurses the same copy into child list `[this+0x75]`. The `Infrastructure` + side is tighter now too. The optional child + The next adjacent field-accessor strip is explicit too: `0x00533100/0x00533120` are the indexed + float set/get helpers for `[this+0x14e4 + index*4]`; `0x00533130/40`, `0x00533150/60`, + `0x00533170/80`, and `0x00533190/a0` are four direct dword set/get pairs over + `[this+0x1534]`, `[this+0x1540]`, `[this+0x153c]`, and `[this+0x1544]`; `0x005331b0/c0` are the + float set/get pair for `[this+0x14e0]`; and `0x005331d0` is the direct getter for `[this+0x1548]`. + The important caller-side grounding is narrow but real: `0x0052f370` samples one indexed float + through `0x00533120` while choosing the active grouped subrecord, and `shell_emit_ranked_overlay_cell_items` + `0x00524780` reads the current threshold pair through `0x00533160` and `0x00533180`. So this + strip is now bounded as a genuine shared field-accessor family under the same runtime-object + owner, even though the exact high-level meanings of those fields remain open. + attach helper `0x0048a1e0` allocates and seeds one fresh `Infrastructure` child and, when the + owner already has more than one child, clones the first child's two triplet bands into that new + child before attaching it. The looped rebuild `0x0048dd50` then rebuilds the owner-visible + `Infrastructure` children one ordinal at a time, tears down the higher extras above ordinal `5`, + refreshes cached primary-child slot `[this+0x248]` when needed, and finishes with the same + world-cell and route-side follow-on family around `0x00448a70`, `0x00493660`, and `0x0048b660`. + The smaller attach helper `0x00490a3c` is now bounded too: it conditionally allocates one + `Infrastructure` child from a caller-supplied payload stem, attaches it to the current owner, and + then seeds three caller-supplied position lanes through `0x00539530` and `0x0053a5b0`. The + direct route-entry side of the same family is no longer anonymous either: `0x0048e140`, + `0x0048e160`, and `0x0048e180` are the three direct resolvers over owner fields + `[this+0x206/+0x20a/+0x20e]` into the live route-entry collection `0x006cfca8`. Another shared + sibling family is tight enough now too: the real + packed-byte-triplet owner is `0x0052e680`, and the two local + wrappers `0x00455820` and `0x00455840` both force its recursion flag on. `0x00455820` forwards + three explicit byte arguments, while `0x00455840` unpacks one packed `u24`-style dword into + three byte lanes first. The downstream setter writes packed byte-triplet lane `[this+0x43]`, + defaults that lane to `0x007f7f7f` when all three bytes are zero, and when recursion is enabled + it walks child list `[this+0x75]` through `0x00556ef0/0x00556f00` and re-applies the same packed + update recursively to every child. The shared formatter thunk `0x00455860` is no longer a blind + jump target either: `0x00530820` now reads as the common group-selection status-label formatter + over the same `0x23a` family. It only answers when shell gate `[0x006d4024+0x1146be]` is live, + state bit `0x10` is clear, vtable slot `+0x14` says the current object should answer, and the + owned-entry bit propagator `0x005305c0` succeeds. Under that gate it formats one caller-owned + text buffer from either a fixed fallback block, a simple mode-`1` `X` or index form, or a + grouped-table form built from the current `0x45`-byte subrecord's float lane plus current index + `[this+0x21]`. The sibling `Infrastructure` table `0x005cfd00` also still carries three tiny + fixed-return slots after that shared formatter path: two return literal `0x46`, and one returns + fixed float `1.25f`, so those slots are now bounded as small table constants rather than as + missing behavior. One nearby global helper family is bounded enough too: `0x005309d0` lazily + clears and arms the indexed table rooted at `0x00ccb880`, `0x00530a00` services or releases one + slot in that table according to its local state dword, `0x00530b70/0x00530b90/0x00530c10` query + one slot's primary handle metric, primary handle, and payload-length lanes, and `0x00530ba0` + performs the release-side cleanup for one slot's owned buffers. Current callers are broad + enough that the table's exact resource type still stays open, but the init/service/query/cleanup + split is now grounded. The broader bundle or stream slot layer under that same table is bounded + now too: `0x00530c80` is the common open-or-reuse entry for named slots, `0x00531030` and + `0x00531150` are the shared write and read byte pumps, `0x00531340` and `0x00531360` are the + four-byte tagged-header wrappers used all over map, setup, world, and runtime bundle code, and + `0x00531380/0x00531410` are the shared variable-length heap-string load/save helpers built on + top of those byte pumps. The immediate neighbors are bounded too: `0x00531490` writes one raw + NUL-terminated string without the length prefix, `0x005314b0` is a callback-driven selector over + global `0x00ccba08`, and `0x00531500` is a small gate that only returns true when `[this+0x04]` + equals `1` and global `0x00ccb9f4` is nonnull. The next adjacent strip is now bounded + structurally too even though the owning subsystem is still open: `0x00531520..0x005317b0` + mostly share the inverse gate `[this+0x04] == 1 && 0x00ccb9f4 == 0`, then forward into one of + three global owners `0x00ccba00`, `0x00ccb9f8`, or `0x00ccb9fc`. The clearest member of that + strip is `0x005315c0`, a plain 3x4 affine point transform over three caller-supplied float + pointers. The rest are still best read as structural wrappers: `0x00531640` resolves the + zero-based index of the first callback-selected string matching the current `0x00ccb9fc` string + source, `0x005316d0` forwards one callback-selected entry pointer into `0x00569730`, and + `0x00531710/0x00531730/0x00531750/0x00531770/0x00531790/0x005317b0` are the small + mode-gated dispatch or query wrappers into the neighboring `0x5695..0x56ac..` family. The next + adjacent owner strip is bounded enough now too: `0x00531800/0x00531840` are the null-`0x00ccb9f4` + guarded call wrappers into `0x0056ae80(0x00ccb9f8)` and `0x00569cf0(0x00ccb9fc)` with scoped + reentrancy counter `0x00ccb9f0`; `0x00531880` releases optional handle `[this+0x4c]` through + two function-pointer calls when global `0x00624d58 == 1`; `0x005318b0` spin-waits for that same + reentrancy counter to drain; `0x005318c0` picks between owners `0x00ccb9f8` and `0x00ccb9fc` + from global selector `0x00ccba04`; and `0x005318f0` is the shared constructor that allocates + and initializes globals `0x00ccb9f8`, `0x00ccb9fc`, and `0x00ccba00`, then arms mode flag + `[this+0x04] = 1` when all three are live. The next owner block is no longer just a loose + cluster either: `0x00531a10` is the full teardown path for that same family, first raising + `0x00ccb9f4`, optionally fading scalar lanes `[0x00ccba00+0x104]` and `[0x00ccb9fc+0x58]` + through `0x00557d90/0x00569ae0/0x00569ca0` plus a `0x10`-tick sleep, then spin-waiting on + `0x005318b0`, releasing optional handle `[this+0x4c]`, shutting the three globals down, and + clearing `[this+0x04]` again. `0x00531c00` is the symmetric rebuild side: it force-calls + `0x00531a10(this,1)`, reconstructs the family through `0x005318f0`, and seeds the default live + state through `0x005696b0`, `0x00569660`, `0x00557d90`, `0x0056a8e0`, and `0x00569ae0` from + shell-owned scalars. The smaller strip between them is bounded structurally too: `0x00531d30` + refreshes the primary scalar and dispatches `0x00557e50`; `0x00531dc0` is the dual-scalar idle + predicate over `[0x00ccb9f8+0x20]` and `[0x00ccb9fc+0x58]`; `0x00531e50` is the string-driven + sibling of `0x00531e10`, tail-jumping into `0x0056a520` when the same family is ready; `0x00531e90` + stages one 16-dword local payload block into `[this+0x08..+0x44]` and forces + `[0x00ccb9fc+0x60] = 2`; `0x00531ed0` and `0x00531ef0` are the small active-mode field and + selected-hash-root queries; `0x00531f40` services `0x00ccb9f8/0x00ccb9fc` and clears staged flag + `[this+0x48]`; `0x00531f90` registers one of the guarded callbacks `0x00531800/0x00531840`; and + `0x00531fd0` is the timed primary-scalar transition service that coordinates `0x00ccba00` with + globals `0x00624d58/0x00624d60` under the same reentrancy counter `0x00ccb9f0`. The local + controller layer above that family is bounded now too: `0x00532150/0x00532200` are the + construct/destruct pair for the controller object itself, `0x00532230` rebuilds from one + callback-selected entry through `0x005314b0 -> 0x00531c00`, and `0x00532260` rebinds primary + handle `[this+0x4c]` while registering transition callback `0x00531fd0` and seeding selector + `[this+0x50]`. One other sibling table is bounded enough now + to keep separate too: local `.rdata` at `0x005c9a60` carries the same shared low `0x23a` slots + plus table-specific overrides `0x0041f680`, `0x0041f720`, `0x0041f7b0`, `0x0041f7e0`, + `0x0041f810`, and `0x0041f850`, with nearby literals `(%1)` and `Marker09`. The exact subtype + name behind that table is still open, but the behavior split is strong enough: `0x0041f680` + first refreshes the current global preview/helper owner through `0x00455de0` and then forwards + mode `1` plus handle `[this+0x23a]` into `0x004cf830`; `0x0041f720` formats `[this+0x356]`, + publishes the resulting shell text, and conditionally dispatches + `world_switch_preview_or_tool_mode_and_seed_parameter_block` `0x00452fa0` with action `0x12` + when world state `[0x0062c120+0x2175]` is `0` or `0x15`; `0x0041f7b0` publishes one + fixed payload and only then jumps to + `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510` when that same + world state is `0x12`. The + same table also has a tighter adjacent helper strip now: `0x0041f6a0` is the direct + `[this+0x37f] -> 0x00517cf0` slot-count query, `0x0041f6b0` is the rounded normalized-coordinate + world-scalar query above `0x0044afa0`, and that deeper helper is no longer opaque: it first + computes one distance-like term from the current cell to global preview-anchor fields + `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`, samples the + companion float raster `[world+0x1605]` at the current cell plus two 8-direction rings, keeps + the strongest local rise above the center sample, adds one thresholded preview-scalar bias from + `[0x0062be68+0x20]`, and then adds `0x32` more when the small global gate `0x0041fff0` passes. + That gate itself now reads as a shared shell/preview threshold test: it returns true when + `[0x006cec74+0x2bb] == 2`, or when the same mode dword is merely nonzero and preview scalar + `[0x0062be68+0x20]` exceeds the float threshold at `0x005c9a9c`. `0x0041f6e0` resolves the + current center world-grid cell and checks one packed `u16` token through `0x0042b2d0`, and + `0x0041f6f0` is the raw byte getter over `[this+0x42]`. One nearby mode-gated flag reader is + bounded too: `0x0041f910` returns + literal `1` when shell mode gate `0x004338c0` is inactive or the object class dword + `[this+0x23e]` is nonzero, and only on the class-0 path does it return the same byte + `[this+0x42]`. That gate itself is tighter now too: `0x004338c0` is just the normalized boolean + wrapper over `0x004d4150`, which returns nonzero when the shell-side owner field at `0x006d07b4` + is live. The release side under that same sibling family is bounded too: `0x00420650` + lazily seeds `[this+0x317]` from shell-profile word `[0x006cec78+0x0d]` before re-entering + `0x00420350`, and that body is now bounded as the local scalar refresh over `[this+0x31b]`: + it compares the seeded word against the current shell-profile word, maps the delta through one + bounded piecewise float curve, and applies one extra affine adjustment when `[this+0x23e]` is + nonzero. `0x00420670` then frees the optional dynamic payload at + `[this+0x37f]`, clears the cached `u16` link chain through `0x0041f8d0`, and tails into base + cleanup `0x00455d20`; and the small collection-side wrapper `0x00421700` simply resolves one + entry id, re-enters `0x00420670`, and erases that id from the owning collection. The + city-entry family also now has one tighter + helper-object branch. `0x00474030` + switches over mode enum `0..10`, maps those cases into `0x00475ed0` with selector families + `4/0xd/0xe` and fixed scalar presets `0.5/0.75/1.0/1.5/2.0`, and on success publishes the + caller-supplied world triplet through `[helper+0x4]`. The refresh helper `0x00474260` first + reloads payload through `0x00455fc0`, then samples the current normalized coordinates plus one + world-height scalar from `0x00448bd0`, and rebuilds `[this+0x23a]` through that same + mode-selected helper builder using mode `[this+0x242]`. The surrounding collection-side and + teardown helpers are tight enough now too. `0x004743d0` and `0x00474400` are the two release + siblings over the same helper field `[this+0x23a]`: both destroy that helper through `0x00475100` + when live and clear the field, but `0x004743d0` tails into the smaller base cleanup + `0x00455650`, while `0x00474400` tails into the heavier dynamic-payload cleanup `0x00455d20`. + The small predicate `0x00474430` simply returns `1` unless shell mode gate `0x004338c0` is + active, in which case it returns byte `[this+0x42]`; the exact meaning of that flag byte is still + open, but the mode-gated query itself is bounded now. One level higher, `0x00474450` constructs + the collection rooted at vtable `0x005ce4a8` with fixed parameters `(0,0,0,0x14,0x0a,0,0)`, and + bootstrap caller `0x004487a9` stores that collection into global `0x006cea50`. The collection's + entry path is also bounded now: `0x004744a0` seeds a stack-local temporary entry through + `0x00474110`, allocates one `0x250`-byte live record, resolves it, constructs it through + `0x00474130`, and then tears the temporary entry down through `0x004743d0`; `0x00474510` + resolves one entry id, releases it through `0x00474400`, and removes it from the collection. The + collection-owned load loop at `0x00474540` sits directly beneath `map_load_city_database` + `0x00474610`: it opens the same `0x61a9/0x61aa/0x61ab` bracket on the caller-supplied bundle, + binds the selected path context, iterates the current collection, dispatches each record through + vtable slot `+0x40`, accumulates the returned byte counts, and tears down the temporary entry + after each record. That still leaves broader semantic questions open, but the current static edges + around the city-entry family are now largely exhausted. The adjacent scaffolding is bounded too. + Base helper `0x00455b20` initializes the shared `0x23a`-sized record family by installing base + vtable `0x005cb1c0`, clearing the scalar bands `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroing + the seven-dword block `[+0x212..+0x22a]`, and re-entering `0x0052ecd0`; that is why it shows up + not only in the city-entry temporary constructor `0x00474110`, but also in several later object + construction paths outside the city family. The city collection itself now has a bounded teardown + side too: `0x00474480` is the small release-and-free wrapper for the collection rooted at + `0x005ce4a8`, and teardown caller `0x004492c3` uses it before freeing the global collection + pointer at `0x006cea50`. On the load side, `0x00445713`'s broader setup branch re-enters + `map_load_city_database` `0x00474610` on that same global `0x006cea50` collection. Outside the + city-specific branch, the two tiny dispatch wrappers `0x00455a40` and `0x00455a50` are also now + bounded as raw vtable-slot helpers: the first jumps through entry slot `+0x44`, while the second + pushes one caller argument into slot `+0x40` and then clears the global roots + `0x006acd38/0x006acd3c/0x006acd40`. Finally, `0x00455a70` is now bounded as the generic + current-position triplet publisher that queries `0x0052e720`, converts through + `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds a caller-supplied height bias, optionally rounds + under `0x00434050`, and publishes through `0x00530720`. The temporary-entry constructor and live + entry constructor are bounded now too. `0x00474110` is the tiny stack-local initializer: it + re-enters shared base init `0x00455b20`, clears helper fields `[+0x23a]` and `[+0x242]`, + installs vtable `0x005ce428`, and returns. `0x00474130` is the real live-entry constructor: it + stores the entry id into `[+0x23e]`, clears the trailing helper payload block `[+0x246..+0x24e]`, + stores mode `[+0x242]`, derives one world-height scalar from the supplied coordinate pair through + `0x00448bd0`, builds helper field `[+0x23a]` through `0x00474030`, and then seeds the remaining + default scalar or flag tuple through `0x00455b70` using the fixed defaults at + `0x005ce49c/0x005ce4a0/0x005ce4a4`. That broader helper is no longer city-specific either: + `0x00455b70` is now bounded as the shared scalar-band initializer that clears the same + `[+0x206/+0x20a/+0x20e/+0x22e/+0x232]` family, optionally copies up to three caller-supplied + strings into `[+0x206/+0x20a/+0x20e]`, synthesizes one default local token buffer when the middle + string is absent, chooses one effective mode string from the third or first input, derives one + owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and + then seeds the remaining scalar band through `0x0052edf0` and `0x0052e670`. + The same specialization also now has one tighter UI-facing side. The override trio + `0x0040e4e0`, `0x0040e880`, and `0x0040e9d0` all sit in the same `0x005c8c50` table and reuse + the linked-site-capable vtable `+0x70` latch together with creation-mode byte `[this+0x3d4]`. + `0x0040e4e0` is the strongest current owner for contextual status text: it branches across + linked-peer checks, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current + owner state, and candidate or linked-peer display labels, then formats localized ids such as + `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd` before pushing the result through + shell presenter `0x00538c70`. `0x0040e880` pairs with that publisher on the action side: it + first resets the same presenter through the fixed token at `0x005c87a8`, then dispatches several + world-side follow-ons through `0x00413620`, + `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`, + `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` `0x00452db0`, + and `world_switch_preview_or_tool_mode_and_seed_parameter_block` `0x00452fa0` under the same + linked-peer and world-mode gates. `0x0040e9d0` is the narrower query-style formatter: + when shell branch `[0x006cec74+0x74]` is live it formats one localized label with the fixed + suffix `\nAbsIndex %d`, otherwise it can return one company-side owner label through + `0x00426b10`, and only then falls back to `0x00455860`. So the current best read is that this + concrete specialization owns both the ambient or animation transient family and one linked-peer + status or action UI surface, without yet proving the user-facing subtype name. + One smaller subtype hook cluster is tighter now too. The concrete table also carries + `0x0040d170` and `0x0040d1b0`, both of which resolve the current candidate through cached stem id + `[this+0x3cc]` and then test candidate dword `[candidate+0x4b]`. When that flag is nonzero, + `0x0040d170` tail-calls the primary transient builder `0x0045c310` and `0x0040d1b0` tail-calls + the matching release path `0x0045c3c0`. The same neighborhood now also gives direct cached-record + resolvers instead of more anonymous pointer math: `0x0040d1f0` returns the linked peer from + `[this+0x2a8]` through `0x006cec20`, while `0x0040d210` returns the owner-side record from + `[this+0x276]` through `0x0062be10`. That makes the specialization-side ownership split cleaner: + the `0x005c8c50` family is not only formatting labels and driving side effects, it also has a + direct candidate-flag hook for building or dropping the primary transient handle. + The last lower side reads are tighter now too. `0x0040e450` first seeds the projected-slot cache + through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470` before it re-enters + `0x00418a60`, and the broader stem-based builder at `0x00418be0` now has one named optional side + renderer instead of an anonymous callsite: + `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`. + The side refresh split is bounded now too. `0x0040ee10` publishes one local position or scalar + triplet through the shared setter `0x00530720`, then tails into + `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`; + that smaller follow-on only runs on the current subtype-`1`, class-`3`, linked-site branch, and + recomputes one local-runtime triplet from the linked peer's route-entry anchor when that anchor + is still live. The heavier sibling above that side refresh is bounded now too: + `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` is the + world-coordinate mutation helper that recomputes `[site+0x388]` and `[site+0x38c]`, rewrites the + world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`, updates the subtype-`4` + proximity-bucket family when needed, rebuilds the same local position or scalar triplet, and + then tails into the linked-site anchor follow-on at `0x0040e360`. One later caller into that + same side-refresh family is bounded now too: `0x00419110` clamps a caller rectangle to the live + world bounds, resolves one per-cell bucket chain through the hashed map at `[arg0+0x88]` and + `0x0053dae0`, and then re-enters `0x0040eba0` for every bucketed site in that rectangle using + the stored per-entry coordinate pair plus two zero flags. Current grounded caller is the edit-side + branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, + so this now looks like a bucket-map-driven local-runtime side-state refresh wrapper rather than + another broad site sweep. + The sibling policy-`1` side is tighter now too. The constructor lane no longer stops at “one + linked site id at `[site+0x2a8]`”: the subtype-`1` branch in + `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0` now clearly + allocates that linked record through + `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, whose lower + constructor is `placed_structure_construct_linked_site_record_from_anchor_and_coords` + `0x00480210`. That lower constructor seeds the linked record's own id and anchor-site id, clears + the local route-anchor and display-name fields, projects the anchor footprint into world space, + and then either binds an already-covered route entry through + `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` or + falls through into the neighboring policy-`1` route-entry synthesis family around `0x00493cf0` + before rebinding the chosen route entry through `0x0048abc0`. + The cleanup side is tighter now too. Linked-site removal now has a bounded owner at + `placed_structure_collection_remove_linked_site_record` `0x004813d0`: it resolves the linked + record through `0x006cec20`, runs the per-record teardown + `placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, removes the + live entry from the collection, and only then re-enters the still-bounded company-wide follow-on + at `0x00429c10` when the removed record passed the narrower transit-like latch. That per-record + teardown is no longer just “clear some scratch fields.” It now clearly clears the route-style + scratch lane, clears the five proximity buckets at `[site+0x590..0x5b8]`, detaches or invalidates + the current route-entry anchor, frees the three per-site byte arrays at `[site+0x24..0x2c]`, + clears this site's indexed byte from the corresponding arrays of later placed-structure records, + and then re-enters `0x00436040` with the current site id. + That company-side follow-on is no longer just one opaque callback either. It is now bounded as + `company_collection_refresh_active_company_linked_transit_site_peer_caches` `0x00429c10`, which + walks the active company roster and re-enters + `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each company. That per-company + fast pass stamps a refresh tick at `[company+0x0d3e]`, clears and repopulates the + placed-structure-side cache cells addressed through `[site+0x5bd][company_id]`, marks the + eligible linked transit sites for that company, allocates one `0x0d`-stride peer table for each + eligible site, and fills those peer rows from + `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` + `0x004a6630`. That helper no longer reads as one anonymous route sweep: it either uses the fixed + pair directly or falls back across tracker endpoint combinations before returning the winning + route-entry id, one route-step count, and one companion mismatch count. The fast cache now reads + more cleanly too: peer-record dword `+0x05` stores that step count, while float `+0x09` stores + the normalized continuity share derived from `(steps - mismatches) / max(steps, 1)`, not a raw + delta-per-step ratio. The + adjacent timed wrapper `company_service_linked_transit_site_caches` `0x00409720` now shows the + cadence too: `0x004093d0` is the shorter-interval refresh, while the older heavier sibling at + `0x00407bd0` was only revisited on the longer interval. + That heavier sibling is now bounded too: + `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` no longer looks like a + generic tail refresh. It reuses the fast peer tables, rebuilds candidate-local amount bands plus + normalized issue-opinion scales, and then folds the peer-side route metrics back into three + per-site cache floats with a cleaner split: + `+0x12` is the raw surviving site-score total, + `+0x0e` is the continuity-and-step-weighted companion total, + and `+0x16` is the promoted final site-ranking lane chosen from the strongest grouped candidate + bands. + That also closes most of the cross-version impact question: + the pre-`1.03` versus `1.03+` tracker metric split now looks like it mainly perturbs the weighted + `+0x0e` lane and the promoted `+0x16` lane, not the raw `+0x12` total. + That final lane then feeds the neighboring selectors + `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280` and + `company_build_linked_transit_autoroute_entry` `0x00408380`. That makes the company-side follow-on + read more like a linked-transit autoroute cache family than a generic company maintenance pass. + The neighboring reachability gate is tighter now too: + `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860` caches one company-side + route-entry anchor, and + `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0` + uses that anchor to decide whether a foreign linked transit site can still participate in the + current company's fast peer cache. + The first direct train-side consumer above that cache family is bounded now too: + `train_try_append_linked_transit_autoroute_entry` `0x00409770`. After servicing the owning + company's caches, it asks `0x00408380` for one staged `0x33`-byte route entry using the train's + current anchor site, then either appends that entry through `0x004b3160` and refreshes the new + trailing selection through `0x004b2f00`, or rotates one existing slot in place when the local + two-entry cap has already been reached. So this edge now reaches an actual train-side autoroute + append lane rather than stopping at anonymous company-side cache cells. The weighted cache lanes + still do not escape that route-choice family directly: this train-side append path only inherits + the weighted site and peer choice by calling `0x00408380`, not by reading cache `+0x0e/+0x16` + itself. + The train-side follow-on above that seed path is bounded now too. The owning company can count + its live roster through `company_count_owned_trains` `0x004264c0`, measure one aggregate linked + transit site pressure through `company_compute_owned_linked_transit_site_score_total` + `0x00408f70`, and then rebalance that roster through + `company_balance_linked_transit_train_roster` `0x00409950`. + The aggregate helper no longer reads as a raw sum either: + it starts from the site-cache `+0x12` totals, converts that into one tentative roster target + through year and site-count ladders, and on build `1.03+` adds one special distance-side scaling + branch when exactly two eligible linked transit sites survive. + Because it consumes `+0x12` rather than `+0x0e` or `+0x16`, current evidence now says the tracker + compatibility split is more important for seeded route choice and ranked site choice than for the + final company train-count target itself. The local linked-transit chain is now bounded enough to + say that directly: weighted cache lanes feed `0x00408280 -> 0x00408380 -> 0x00409770/0x00409830`, + while the separate pressure or roster lane feeds `0x00408f70 -> 0x00409950` from raw `+0x12`. + The balancer then applies two age bands to company-owned trains: + very old trains are removed when the roster already exceeds target or upgraded when it still + needs capacity, while the mid-age band can trigger one narrower upgrade pass. + After that it fills any remaining deficit by either packaging multiplayer opcode `0x75` or + locally re-entering + `company_try_add_linked_transit_train_and_publish_news` `0x00409830`. The two visible news + helpers under it are bounded too: `0x00409830` emits RT3.lng `2896` for a newly added train, + while `company_publish_train_upgrade_news` `0x00409300` emits RT3.lng `2897` for the upgrade + branch. + The subtype-`4` sibling side is bounded now too. The nearby-site bucket family now has: + `placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0`, + `placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10`, and + `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, plus the two collection sweeps + `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480` and + `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0`. + Current evidence says those five buckets store `(peer site id, distance)` pairs for nearby + station-or-transit peers, grouped through the five-way classifier at `0x0040d350`. The older + stream-backed side is bounded too: `placed_structure_collection_load_dynamic_side_buffers_from_stream` + `0x00481430` walks the live placed-structure collection and re-enters + `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0`, which repopulates the + route-entry list, the three per-site byte arrays, the five proximity buckets, and the trailing + scratch band from the caller-supplied persistence stream. + The linked-site route-entry list itself is tighter now too. The refresh or teardown branch at + `0x0040e102` re-enters `placed_structure_remove_route_entry_key_and_compact` `0x0047d810`, which + removes one matching `u16` key from the six-byte list rooted at `[site+0x462]/[site+0x466]`, + compacts the surviving entries into a replacement buffer, and decrements the stored route-entry + count. + The broader linked-site mutable runtime strip is tighter now too. + `placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch` + `0x0047f320` is no longer just a teardown-side stub: it resolves an effective comparison mode + from the linked candidate class byte `[candidate+0x8c]` unless the caller overrides it, derives + one radius threshold from current world coordinates `[site+0x4a8/+0x4ac]`, frees the prior + sampled-cell buffer at `[site+0x34]`, always clears the route-link scratch pair + `[site+0x462]/[site+0x466]`, and then scans one bounded world-grid rectangle through + `[0x0062c120+0x2129]` with per-cell distance measured by `0x0051db80`. For accepted cells it + emits temporary twelve-byte `(grid x, grid y, sampled score)` rows through `0x0042b190`, + `0x0042c530`, and `0x0042c580`; when caller arg0 is zero it compacts one representative subset + of those temporary rows into the persistent list at `[site+0x34]/[site+0x38]`, while nonzero + arg0 callers use the same helper as a clear-and-scan companion without the final materialization + step. Current grounded callers are the linked-site refresh and teardown strip + `0x00480542/0x004805c2/0x00480727/0x004807e2`. + The proximity-bucket rebuild side above that list is tighter now too. + `placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells` + `0x0047fef0` first requires the current record to pass the narrower station-or-transit class gate + `0x0047fd50`, quantizes the current site position through `0x00455800/0x00455810`, walks the + surrounding live cell window through `[0x0062c120+0x2129]`, follows each cell's linked + placed-structure chain through word field `[cell+0x0d6]` plus next-id `[peer+0x2a2]`, keeps only + peers whose resolved candidate subtype byte `[candidate+0x32]` equals `4`, and appends the + surviving `(peer site id, distance)` pairs into the same five bucket arrays rooted at + `[site+0x590..+0x5a4]`. So the narrower one-peer append helper `0x0047fdb0` now has a real + broader owner rather than only collection sweeps. + The whole linked-site refresh owner is correspondingly clearer now too. + `placed_structure_refresh_linked_site_runtime_side_buffers_and_route_entry_anchor` `0x00480710` + first clears the current proximity buckets through `0x0047dcd0`, runs `0x0047f320(1,arg1)` + against the pre-update state, republishes the current site position into the world-grid owner map + through `0x0042bbf0/0x0042bbb0`, reruns `0x0047f320(0,-1)` to materialize the current + sampled-cell list, and then rebuilds the nearby-transit buckets through `0x0047fef0`. After that + it either reuses a still-valid route-entry anchor through + `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` and + `placed_structure_rebind_route_entry_anchor_to_site_id` `0x0048abc0`, or synthesizes a + replacement through `0x00493cf0` before rebinding it the same way; when an old anchor survives + but now points at a different owner, the helper clears the prior `[entry+0x222]` back to `-1`. + The world-cell owner and route-gather helpers beneath that strip are bounded now too. Word + `[cell+0xd4]` is the head of one placed-structure owner chain: `0x0042bbb0` prepends the current + site id into that chain by writing the previous head into `[site+0x3c]` through the tiny setter + `0x0047d6f0`, while `0x0042bbf0` removes one site id from the same chain by walking the linked + `[site+0x3c]` next pointers until it can splice the requested site out. The sampled-cell rebuild + also now has its lower route-gather leaf: `0x0042c530` walks one world cell's linked-site chain + from word `[cell+0xd6]` through next-id `[site+0x2a2]` and appends each visited site id plus the + caller payload into the six-byte route-entry list helper `0x0042b190`. That same compact list now + has its two local companions bounded too: `0x0042b230` removes one row by leading `u16` key, and + `0x0042b2d0` is the shared contains-key predicate over the same `[...+0xeb]/[...+0xef]` list. + The neighboring `[cell+0xd6]` linked-site chain is bounded now too. `0x0042c9a0` prepends one + site id into that chain by writing the previous head into `[site+0x2a2]` through the tiny setter + `0x0040cb00`, storing the new head back into `[cell+0xd6]`, and then re-entering the paired + rebuild helpers `0x0042c690` and `0x0042c8f0`. `0x0042c9f0` is the remove companion over the + same chain: it walks the linked `[site+0x2a2]` next pointers until it can splice the requested + site id out of the `[cell+0xd6]` head chain, then reruns the same two rebuild helpers. + The two remaining numeric leaves under this strip are bounded now too. `0x0042c580` accumulates + the directional word fan from `[cell+0xf3 + dir*2]` while stepping toward one caller-supplied + grid target through the fixed offset tables at `0x00624b28/0x00624b48`, and that is the floating + sampled-score source later stored by `0x0047f320`. `0x0042c960` is the shared rounded + issue-opinion-scaled word-lane query: it multiplies one local word lane `[this+index*2] << 4` + against the scenario-side scale returned by `0x00437d20(index)` and rounds the result through + `0x005a10d0`. + The broader company-side owner above these pieces is tighter now too. The periodic service pass + `company_service_periodic_city_connection_finance_and_linked_transit_lanes` `0x004019e0` now + reads as the current outer owner for this branch: it sequences the city-connection announcement + lanes, the linked-transit train-roster balancer, the acquisition-side sibling + `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`, the annual finance-policy helper + `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, and the shorter-versus- + longer linked-transit cache refresh tail through `0x004093d0` and `0x00407bd0`. That outer pass + also has one tighter temporary-state role now: it clears company bytes `0x0d17/0x0d18/0x0d56`, + mirrors `0x0d17` into scenario field `0x006cec78+0x4c74` only while the earlier route-building + side runs, and restores the original scenario value on exit. Current evidence now ties `0x0d17` + to the shared preferred-locomotive chooser `0x004078a0`: the override is only armed when that + helper picks one locomotive whose engine-type dword is `2`. That engine-type lane now best reads + as electric rather than an unnamed class slot, because the linked approval helper around + `0x0041d550` now reads as a real locomotive-era and engine-type policy gate, dispatching the same + `0/1/2` field across three scenario-opinion lanes while the local player-facing engine-type + family is explicitly `Steam / Diesel / Electric`. That same gate also now ties the later scenario + bytes `0x4c97..0x4c99` back to the editor-side `Locomotives` page rather than treating them as + anonymous availability flags: they are the live `All Steam Locos Avail.`, `All Diesel Locos + Avail.`, and `All Electric Locos Avail.` policy bytes behind `0x004cd680` / `0x004cf0d0`. The + current logic is also tighter than a plain override tier: a positive engine-family opinion result + can carry the gate by itself only while none of those three editor bytes is enabled; once any of + them is nonzero, `0x0041d550` instead requires one matching intersection between the record-local + family bytes and the enabled editor family bytes. The `WhaleL` carveout is narrower now too: + current data-file correlation ties that stem to the `Orca NX462` / `WhaleL_NE` locomotive family, + and it explicitly zeros that positive-opinion result before the later family-availability checks, + so it loses the shortcut rather than gaining a special approval path. The same + chooser now also has a bounded fallback below it, `locomotive_collection_select_best_era_matched_non_electric_fallback_id` + `0x00461cd0`, which explicitly skips engine-type `2` and chooses the lowest-penalty remaining + locomotive by era mismatch and approval gates. The route-search side is tighter too: this + electric-only override now clearly feeds the first path-sweep branch in `0x0049bd40`, forcing the + larger `1.8` initial quality multiplier instead of `1.4`, which is the same branch otherwise + chosen by explicit route-policy byte `4`. The neighboring `0x00442a40..0x00442ae1` helper strip + is tighter now too: it is not generic issue math, it is the forward and inverse mapper between + two compact locomotive engine-family index spaces and the raw issue bands `0x0f1..0x15f / + 0x1c9..0x1da` plus `0x160..0x1c4 / 0x1db..0x1f6`, and the same strip is reused by both the + stream save/load pair `0x0042ddd0/0x00430feb` and the shell-side issue-row resolvers + `0x00462449/0x004624ae` over the fixed table at `0x00610398`. So the later annual finance helper is reading + same-cycle side-channel state from the earlier city-connection and linked-transit branches, not + unrelated long-lived finance fields. The inner + finance helper is not debt-only either. Current grounded outcomes include bankruptcy news + `2881`, the debt restructure family `2882..2886`, a later share-repurchase headline `2887`, and + the dividend-side adjustment branch. The main commit verbs under that helper are now grounded too: + `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, + `company_issue_bond_and_record_terms` `0x004275c0`, + `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and + `company_issue_public_shares_and_raise_capital` `0x00427450`. The threshold side is tighter now + too. The earliest creditor-pressure lane requires scenario mode `0x0c`, the bankruptcy toggle + `[0x006cec78+0x4a8f]` to be clear, at least `13` years since `[company+0x163]`, and at least + `4` years since founding year `[company+0x157]`; it then scans the last three years of the + derived net-profits and revenue lanes `0x2b` and `0x2c`, chooses one negative pressure ladder + `-600000 / -1100000 / -1600000 / + -2000000` from the current slot-`0x2c` bands around `120000 / 230000 / 340000`, requires the + broader support-adjusted share-price or public-support scalar at least `15` or `20` depending on + whether all three sampled years failed, checks the current fuel-cost lane in slot `0x09` against + `0.08` times that ladder, and requires the + three-year slot-`0x2b` total to clear one final `-60000` gate before it falls into the + bankruptcy commit and RT3.lng `2881` headline. + The middle debt-capital layer is split more clearly now too. With `[+0x4a8b]` clear, one annual + bond lane first simulates full repayment through `company_repay_bond_slot_and_compact_debt_table` + and then uses the post-repayment cash window with fixed `-250000` and `-30000` thresholds plus + the broader linked-transit train-service latch `[company+0x0d56]` to decide whether to append one + or more `500000` principal, `30`-year bonds. The repurchase lane is separate again: when the + city-connection announcement-side latch `[company+0x0d18]` is set, growth setting `2` does not + suppress it, and `[+0x4a87]` is clear, it starts from one `1000`-share batch, can replace its + default `1.0` factor with one linked-chairman personality scalar, scales that by `1.6` when + growth setting `1` is active, and then runs one `800000` stock-value gate plus one + support-adjusted-share-price-times-factor-times-`1000`-times-`1.2` affordability gate before the + repeated `1000`-share buyback commits behind RT3.lng `2887`. The ordering above this helper is + tighter now too: + `company_service_periodic_city_connection_finance_and_linked_transit_lanes` clears those latches + first, runs the city-connection and linked-transit branches, and only then enters the annual + finance helper, so these look like same-cycle reaction gates rather than long-lived balance-sheet + flags. + After the earlier debt or bankruptcy outcomes stay inactive, the later stock-capital lane also + has a tighter bounded shape now too: it only opens on build `1.03+`, only after the earlier + bankruptcy, bond, and repurchase outcomes stay inactive, and with the bond and stock toggles + `[+0x4a8b]` and `[+0x4a87]` clear, at least two bond slots live, and at least one year since + founding. It derives one issue batch from outstanding shares rounded down to `1000`-share lots + with floor `2000`, trims that batch until the broader support-adjusted share-price scalar times + batch no longer exceeds the `55000` gate, recomputes the pressured support-adjusted share-price + scalar and the paired `price/book` ratio, then tests the remaining gates in a fixed order: + share-price floor `22`, proceeds floor `55000`, current cash from `0x2329/0x0d` against the + chosen highest-coupon bond principal plus `5000`, one later stock-issue cooldown gate that + converts the current issue mixed-radix calendar tuple at `[company+0x16b/+0x16f]` through + `calendar_point_pack_tuple_to_absolute_counter` `0x0051d3c0` and compares the result against the + active world absolute calendar counter `[world+0x15]`, and only then the coupon-versus-price-to-book + approval ladder `0.07/1.3 -> 0.14/0.35`. The issue mutator preserves the previous tuple in + `[company+0x173/+0x177]` and refreshes the current tuple from `[world+0x0d/+0x11]` on the + derived-pricing lane. On success it issues two + same-sized tranches through repeated `company_issue_public_shares_and_raise_capital` calls and + publishes a separate equity-offering news family rooted at localized id `4053`, not the earlier + debt or buyback headline family. + The dividend side is bounded too: it requires the dividend toggle `[0x006cec78+0x4a93]` to be + clear, mode `0x0c`, at least `1` year since `[company+0x0d2d]`, and at least `2` years since + founding, then averages the last three years of the net-profits lane `0x2b`, folds in the + unassigned-share pool and the current `0x0d` band, applies the map-editor building-growth + setting `[0x006cec78+0x4c7c]`, treats growth setting `1` as a `0.66` scale-down and setting `2` + as a zeroing pass on the current dividend, quantizes surviving adjustments in tenths, and + finally clamps against + `company_compute_board_approved_dividend_rate_ceiling` `0x00426260`. + The linked-transit route-seeding side has one tighter sibling now too: + `company_reset_linked_transit_caches_and_reseed_empty_train_routes` `0x00401940`. It clears the + two company-side linked-transit cache timestamps, forces one immediate cache rebuild through + `0x00409720`, strips route lists from company-owned trains in modes `0x0a/0x13`, and then + re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770` only when a train's + route list has become empty. + On the wider chooser question, the current evidence is also tighter than before: every recovered + external owner of `0x00402cb0` is still in the city-connection family, so the two later direct + placement lanes currently read as city-connection fallback behavior rather than a broadly shared + world placement service. + It can still unwind through route-state cleanup without committing new placed structures, so the + exact lower helper semantics are not fully closed, but the broader chooser is no longer + anonymous and its main policy split is now visible. The two lower helpers directly under those + commit lanes are bounded now too: + `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840` is the shared + projected-footprint offset helper over candidate bytes `[candidate+0xb8]` and `[candidate+0xb9]`, + and `placed_structure_validate_projected_candidate_placement` `0x004197e0` is the shared + go-or-no-go validator that checks company, territory, world-tile, and footprint occupancy state + before either direct-placement commit is allowed to fire. Its strongest current subtype branch is + a station-attachment or upgrade-style lane keyed by `[candidate+0x32] == 1`, which now has the + concrete failure family `2901..2906`: blocked upgrade footprint, ground not flat enough, not + your track, insufficient track-laying capacity, cannot connect to existing track, and ground too + steep. That tightens the chooser materially without yet proving that the validator is + station-only for every caller. + The recurring outer owner is tighter now too: + `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580` walks every + fourth live placed structure from a scenario-time-derived offset and re-enters the per-site + rebuild with stack flag `0`, giving the route-style lane a concrete recurring maintenance sweep + under `simulation_service_periodic_boundary_work` rather than only a floating caller note. One + neighboring helper is now bounded on the message side too: + `shell_building_detail_handle_subject_value_row_band_action` `0x004ba270` switches over the + clicked row family `0x7d07..0x7d14`, treats subject bytes `+0x21/+0x22/+0x23` as one current + selection plus one bounded low/high pair, increments the family dirty latch at `0x006cfe0c` on + change, and republishes the refreshed value through the shared shell control helper on code + `0x66`. One neighboring helper is now bounded on the side-list path too: + `shell_building_detail_propagate_selected_subject_state_into_side_list` `0x004b9ec0` walks the + sibling list owner at `0x006cfe08`, copies the active subject state into each side-list record, + mirrors the current service or capability id at `+0x24`, and preserves the `0x40/0x20/0x10` + subflags from the active subject. That means the value-row actions and later selector rows now + read as propagating one shared building-detail state across the sibling list rather than only + mutating one isolated subject record. One neighboring helper is + now bounded separately too: `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20` + owns the mutually exclusive value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and + `0x7d13/0x7d14`, choosing among them from the same selected-subject flag byte and payload fields + at `+0x22/+0x23`, while the larger cargo-or-service row owner also gates the extra visual lanes + `0x7d6a`, `0x7d6b`, and `0x7d9d` from that same subflag family. The asset-string block is tighter + too: that branch family now explicitly uses `AnyCargo.imb`, `AnyFreight.imb`, `PassMail.imb`, + `Caboose.imb`, and `Dining.imb`, with the bit-`0x20` special lane already aligned to + `Caboose.imb` and the sibling bit-`0x10` special lane now aligned to `Dining.imb`. The larger + `0x7f58..0x801f` band is no longer just a styled row family either: + `shell_building_detail_present_flagged_service_capability_popup` `0x004b9fd0` is now grounded as + its explanatory popup callback. It resolves either one fixed express-side row from `0x00621e04` + or one active candidate or service id from `[subject+0x24]`, then formats one popup through the + shell message-box path. The neighboring refresh helper `shell_building_detail_refresh_flagged_service_capability_rows` + `0x004b9a20` is tighter now too: `0x7d07..0x7d1c` is not one anonymous block, but a real mask + partition over subject bits `0x20` and `0x10`, with one zero-mask pair, one bit-`0x20`-only + pair, one exclusive-or pair, and later one-bit and two-bit indicator rows. RT3.lng now closes + the fixed popup text family too: the single-line branch uses + `3922` `%1\nLoads available at %2: %3`, while the richer ordinary-candidate branch uses + `2981` `%1\nLoads available at %2: %3 Current Price: %4` and can append + `2982` `Price at next station, %1: %2 (%3%4)`. The selector band is narrower too: current + refresh-side evidence shows `0x7f58..0x801f` as one selected-ordinal highlight family over the + three fixed express rows plus the ordinary active-candidate rows, not as a generic unstructured + list. The neighboring `0x8020..0x8051` band is tighter too: it is primarily the matching + remove-entry family for the selected subject's live id list, with two special row indices + re-routing into the `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction + when the current `0x20/0x10` service-bit combination demands it. That means the exact captions + are no longer broadly open across the whole selector family: the fixed express-side rows, the + mask partitions, and the add/remove structure are grounded, and the remaining caption gap is + mostly the ordinary candidate rows further down the same band. The top-level toggles are + tighter now too: the paired + `0x7d02/0x7d03` controls are the real mode switch over subject bit `0x40`, choosing between the + bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`, while + the smaller `0x7d0f/0x7d10` controls flip the same special-service subflags later rendered as + `Caboose` and `Dining Car`. One adjacent control is tighter now too: the extracted + `BuildingDetail.win` resource contains the plain-English line `Set the initial cargo amount for + 'Disable Cargo Economy' scenarios.`, and the `0x7d01` plus `0x7d09/0x7d0a` message-side branch + can mirror the current subject or selection through + `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` into the auxiliary + owner queue at `[0x006cd8d8+0x8f48]`, with side-owner presence now explicitly grounded through + `shell_has_auxiliary_preview_owner` `0x00434050`. That queued request is tighter too: both + current callsites forward the same side-list mirror latch at `[0x006cfe08+0x0c]`, so the + auxiliary owner now clearly sees not just the staged subject but also whether the local + `BuildingDetail` side-list is in mirrored-subject mode. The same `0x7d01` lane also now has one + clear rejection note: localized id `3587` `This option is only available by following the + tutorial.` now sits behind the active tutorial flag at `0x006d3b4c` and the cached previous + tutorial expected-control id at `0x00622b38`, while the neighboring tutorial helper + `tutorial_advance_step_and_refresh_expected_control_ids` `0x00516be0` now grounds + `0x00622b34/0x00622b38/0x00622b3c` as the current and previous expected-control cache rather + than anonymous globals. The last field is tighter now too: `0x00622b3c` is currently best read + as the active tutorial step's alternate-accepted companion control id, because the generic shell + control path compares clicked control ids against it directly and suppresses the `3587` tutorial + rejection when they match. That does not fully close the player-facing caption bind for every + control, but it does bound the neighboring side-owner sync and tutorial-rejection lane instead + of leaving it as anonymous glue. + The extra pre-insert gate is narrower than it + first looked. It is now grounded as tutorial-only: + `tutorial_validate_train_route_station_indicator_step` `0x00516d00` checks the current tutorial + step from the shell tutorial descriptor table at `0x00622b48` before a live station-or-transit + site id can be committed into the staged route entry, and the currently accepted steps align with + localized prompts `3777` and `3778`, the two train-routing tutorial instructions that tell the + player to click the Milan and Turin station indicators. Outside that tutorial state family, the + route-entry insertion path is not gated there. The adjacent validator is tighter now too: + `train_route_list_validate_reachability_and_station_pair` `0x004b2c10` walks that same route list, + resolves placed-structure-backed entries through the live placed-structure and route-node + collections, uses the direct route-node payload branch for the remaining entry family, and fails + with `3089..3091` when the resulting route cannot be traversed or does not preserve a valid + terminal station pair. The post-validation follow-on is bounded too: + `train_current_route_context_uses_strict_reachability_mode` `0x004a9460` is now the small shared + gate above the stricter branch, keyed off the current linked route object's downstream class type, + and `train_set_route_operating_mode_and_scalar` `0x004ab980` now reads as the shared train mode + setter beneath route editing, with the local and multiplayer insertion paths choosing mode + `0x13` only when that stricter second validation succeeds and mode `0x0a` on the looser fallback + path. The first + deeper world-mode interaction branch is now better + bounded: `GameUppermost.win` hotspots, cursor drag, held Shift state, discrete shell view-step + commands, direct keyboard turn/pan/zoom bindings, the `TrackLay.win` and `StationPlace.win` + world-command surfaces, and a frame-owned hover or focus-target transition branch all feed the + same shell-controller-backed path. The remaining uncertainty has moved farther from basic + ownership: the hover-target branch clearly exists, and `0x07d6` now looks like the shared + main-world interaction surface rather than a generic detail button for one tool family only. One + more shell-side consumer is bounded now too: `0x004bc350` is a world-surface brush handler over + that same `0x07d6` control plus the adjacent mode family `0x0faa..0x0faf` and ordinal strip + `0x0fa0..0x0fa7`. That family is no longer just a generic unlabeled brush owner: the + detail-panel manager now grounds the sibling tool-window strip immediately above it as + `Bulldoze.win`, `ChangeHeight.win`, `ChangeTrees.win`, `PaintTerrain.win`, `PaintRegion.win`, + `PaintSound.win`, and `PaintTerritory.win`, each with its own constructor, refresh pass, and + message owner beneath the same controller rooted at `0x006d0818`. Once its local drag latch is + active it dispatches the current mode dword at `[0x006d0818+0x8c]` into the companion-float + helpers `0x0044d4e0`, `0x0044d880`, and `0x0044da70`, or into the secondary-raster nibble path + `0x00448e20 -> 0x00419110`, so the remaining uncertainty has narrowed from ownership to the + exact one-to-one mode-button mapping inside that grounded tool-window strip. The + `PaintTerrain.win` side is tighter now too: constructor `0x004f7ce0` seeds shell singleton + `0x006d1304`, callback root `0x006d1334`, a constructor-time bulk-update latch at + `0x006d1330/0x006d1331`, and the broader terrain mode or scalar state from `0x00622748..0x00622788` + plus `0x006d1308..0x006d1324`; it then registers the callback strip `0x004f5960`, + `0x004f59f0`, `0x004f6070`, and `0x004f69e0` through `0x00540120`. The direct message owner + under that same family is no longer just a loose branch fan-out either: `0x004f6f50` owns + messages `2/0xca/0xcb`, keeps control `0x07d6` as the live world-surface drag latch, routes + explicit undo control `0x2775` into `0x004f5c30`, maps the selector and mode strips + `0x2711..0x2730`, `0x27d9..0x27df`, `0x283d..0x2843`, `0x28a1..0x28e6`, `0x2915..0x291e`, + `0x2964..0x2967`, and `0x29cd..` into the cached terrain lanes, and then fans the active drag + path into preview helpers `0x004f6930`, `0x004fb5e0`, `0x004fc280`, `0x004fc4d0`, and + `0x004fc630` depending on the current terrain mode. Inside that same family + `0x004f5a80/0x004f5c30` are now the bounded local undo snapshot pair, `0x004f5dd0` is the + tiny active-scalar-group selector, `0x004f6b50` owns the ten-entry mode strip rooted at + `0x28dd`, `0x004f6390` is the broad mode-panel repaint owner, `0x004f6250` is the + mode-dependent world-dispatch bridge, `0x004f6930` samples the current preview raster at + world coordinates, and `0x004fb5e0` is the heavier preview-raster rebuild and shell-surface + publish worker. The next local helpers under that same family are tighter now too: + `0x004f5ea0` and `0x004f5ec0` are just the two tiny special-mode predicates + `(mode 5, variant 2)` and `(mode 4, variant 2)`, `0x004f8770` is the weighted RGB sampler + over the current preview or undo-backed raster neighborhood, `0x004f89b0` is the local + byte-grid connected-component grower over the eight-neighbor tables `0x00624b28/0x00624b48`, + and `0x004f8bb0` is the main drag-path preview compositor that consumes the drag sample strip + `[this+0xf0/+0xf4/+0xf8]`, allocates temporary float or byte grids, and then rasterizes the + surviving preview rectangle through the current terrain descriptor tables at `0x005f3500`, + the weighted color sampler `0x004f8770`, the component grower `0x004f89b0`, and several live + world samplers before writing final RGBA pixels back into the preview surface. The late tail + under that same compositor is tighter too: the mode-`4`, variant-`2` path toggles + secondary-raster byte-2 bit `0x20` by comparing current and previous cells through + `0x00534f40`; the broader mode-`4/5` world-facing branch samples class set `2/4/5` through + `0x00534ec0`, re-enters `0x0044de30` and `0x0044df10`, latches pending world coordinates into + `[0x006d1304+0x78/+0x7c]`, and rewrites the low nibble plus the signed overlay-vector planes + through `0x00448df0`, `0x00448e20`, `0x00448ec0`, `0x00448ee0`, `0x00448e60`, and + `0x00448e90`. After the optional mode-`5` smoothing sweep through `0x004f8370`, the publish + tail either materializes one shell preview surface through `0x0051f090 -> 0x00534730` or, for + the mode-`4/5` world-facing variants, converts the surviving preview rectangle back into + world-space bounds and re-enters `0x0044e940`, + `world_refresh_active_preview_mode_from_four_dword_parameter_block` `0x00452f20`, and + `0x0044d410`. The companion + preview-rebuild owner `0x004fb5e0` is tighter on entry, too: `0x004f726c` is the early + rebuild path that first copies the live preview raster into `[this+0x118]` and snapshots undo + state through `0x004f5a80`, while `0x004f7ada` is the later drag-active path that first + allocates a temporary occupancy mask before rebuilding and then conditionally mirrors that + mask through `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds` + `0x00450520` on the world-mode-`0x17` side path. So the remaining uncertainty + has narrowed again from family ownership to the exact meaning of a few per-mode scalar and + token lanes, not to whether `PaintTerrain.win` itself is still a mixed shell/world owner. diff --git a/docs/control-loop-atlas/station-detail-overlay.md b/docs/control-loop-atlas/station-detail-overlay.md new file mode 100644 index 0000000..c9915a2 --- /dev/null +++ b/docs/control-loop-atlas/station-detail-overlay.md @@ -0,0 +1,148 @@ +# Input, Save/Load, and Simulation: Station-detail Overlay + +### Station-detail overlay + +The shell-side candidate preview pair now has a grounded world consumer + too. `world_render_station_candidate_service_map_overlay` at `0x0043f640` reads the active + `(station id, candidate id)` pair from + `world_store_station_detail_candidate_service_preview_pair_globals` `0x0043f620` and + `world_clear_station_detail_candidate_service_preview_pair_globals` `0x0043f610`, scans the + placed-structure collection, and then splits the legend by candidate mode. When the active candidate carries a + nonzero route-style byte at `[candidate+0x46]`, the overlay uses the heavier helper + `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` in both + directions between the preview station and each scanned site and formats the resulting directional + rows as `3874` `Coming To %1` and `3875` `Going From %1`. When that byte is zero, the same overlay + falls back to the direct local-service path through + `placed_structure_query_candidate_local_service_metrics` and formats the two legend rows instead + as `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes + collapse to `3878` `--None--`, and one title lane falls back to literal `All`. Current disassembly + no longer supports treating `3872` `Already Connected by Another Company` or `3873` `Not + Connected` as direct overlay-body emits. +#### Corrected boundary + +The neighboring connection-state note pair now appears + to live in a city connection-bonus label formatter, not in `0x0043f640`. That formatter is now + bounded as `city_site_format_connection_bonus_status_label` at `0x004207d0`: it directly chooses + localized ids `3868` through `3873` after consulting the reusable city-peer scan + `city_connection_bonus_exists_matching_peer_site` at `0x00420030`. Separately, `3879` `Out of + Sync` is grounded under the multiplayer preview dataset path instead: + `multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync` at `0x0046b780` checks + global `0x006cd91c`, raises the `Out of Sync` shell status through `0x5386e0`, and then continues + through the wider multiplayer preview launch-state service. So the station-detail overlay + currently owns only the `Coming To`, `Going From`, `Current Supply`, `Current Demand`, `--None--`, + and `All` legend lanes. +#### Ownership side + +One reusable site helper is grounded now too. + `placed_structure_query_linked_company_id` at `0x0047efe0` resolves the current placed structure's + linked instance through `0x0062b26c` and returns its company id from `[instance+0x276]`; the + adjacent city bonus formatter at `0x004207d0` compares that id against the active company selector + before choosing whether a scanned site should carry `3871` `Connected By Another Company` or + `3872` `Already Connected by Another Company`. The larger caller boundary is no longer open + either: the first bounded announcement owner above this formatter family is now + `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, which re-enters the + peer-route candidate builder at `0x004046a0` and later publishes one of the localized + city-connection bonus news strings `2888`, `2890`, or `2921` through the shell news path. +#### Peer-selector side + +The city bonus formatter no longer depends only on + boolean peer existence. The companion helper + `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` is now grounded as the + first-match selector paired with `city_connection_bonus_exists_matching_peer_site`: it walks the + same city-peer candidate set, applies the same site-class table plus the narrower + station-or-transit and linked-instance class-byte flags, and returns one representative matching + peer site id instead of a boolean. `city_site_format_connection_bonus_status_label` reuses that + selector after the note checks so it can recover one linked company context from the selected + peer. The remaining open edge here is therefore above this formatter family, not inside the + peer-scan pair itself. +#### Caller side + +The reusable bridge between the status formatter and the + company news lane is now bounded too. `city_connection_bonus_build_peer_route_candidate` at + `0x004046a0` reuses `city_connection_bonus_select_first_matching_peer_site` with both selector + flags forced on, samples the selected peer's derived coordinates through `0x0047df30` and + `0x0047df50`, and then either tries the shared heavy builder + `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0` or falls + back to the smaller wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` + `0x00404640` before handing the result back to the company-side announcement sweep at + `0x00406050`. The score side of that announcement lane is tighter now as well: + `city_compute_connection_bonus_candidate_weight` at `0x004010f0` provides the per-city opportunity + weight, `company_query_min_linked_site_distance_to_xy` at `0x00405920` provides the nearest + linked-site distance term, `company_count_linked_transit_sites` at `0x00426590` provides one of + the company-side caps, `company_compute_connection_bonus_value_ladder` at `0x00425320` supplies + the bounded company-side value scalar, and + `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580` now bounds the + shared prime-rate-side helper that this lane reuses beside the raw issue-`0x39` total, + `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` now bounds the raw additive + issue-total helper beneath that term, and `company_connection_bonus_lane_is_unlocked` at + `0x00427590` is the small boolean gate above the ladder. Wider governance and CompanyDetail xrefs + now tighten slot `0x2b` into the rolling net-profits lane reused by annual finance checks and a + per-share/history formatter, while the report-history descriptor table now aligns raw slot `0x09` + with the Income Statement fuel-cost lane surfaced by tooltip `1309`. The wider result now reads + more like recent net profits minus recent fuel burden than a governance-pressure term. That now + also sharpens the annual finance lane at `0x00401c50`: the first bankruptcy branch reads as + sustained cash-and-debt stress over recent profits and fuel burden, the later fallback branch as + a deeper `-300000` cash / three bad years cleanup trigger, and the later stock-issue branch reads + as a price-to-book-versus-coupon approval ladder rather than a generic support vote. The tail is + cleaner now too: it compares total retired versus newly issued principal to choose the `2882..2886` + debt headline family, then publishes `2887` separately from the accumulated repurchased-share + count. The sibling news owner above the same + city-pair route family is bounded now too: + `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` + filters and scores candidate city entries, re-enters the same shared heavy builder through + `city_connection_try_build_route_between_region_entry_pair` `0x00404c60` for the dense pair + sweep and the final retry, and then publishes `2889` `%1 has started a new company - the %2` + or `2890` `%1 has connected %2 to %3.` through the shell news path. The remaining open edge on + this branch is therefore narrower now: it is mostly whether `0x39` should be read as the + narrower city-connection public-opinion lane or as part of a broader management-attitude family, + not the ownership of the connection-bonus formatter, peer-route candidate path, or company news + gate. +#### Route-list side + +The neighboring helper + `placed_structure_append_unique_route_entry` at `0x0047f010` is now grounded as the + append-if-missing builder for the six-byte route-entry list rooted at `[site+0x462]` and + `[site+0x466]`. That matters here because the directional overlay query at `0x0047e690` consumes + the same list, so the remaining uncertainty is no longer list ownership. It is down to the exact + semantics of each entry's `u32` payload. +#### Route-entry and Cache Side + +The adjacent helper strip is tighter now too. + `placed_structure_service_candidate_local_service_comparison_cache_decay_and_row_propagation` + `0x0047df70` is the recurring age-and-propagation service pass over the paired comparison-cache + float tables `[site+0x3e]` and `[site+0x112]` with age stamps at `[site+0x1e6]`; it zeroes stale + entries older than `0x1d8800`, decays younger ones by the fixed `0x005ce900/0x005ce8f8` scales, + and then propagates stronger marked row values back through the three five-float row bands rooted + at `[site+0x24/+0x28/+0x2c]`. The wrapper + `placed_structure_query_candidate_route_or_local_service_comparison_score` `0x0047e9a0` is now + bounded too: it delegates to `placed_structure_query_candidate_directional_route_overlay_summary` + `0x0047e690` when the requested candidate carries a grouped routing class, otherwise it uses the + simpler local `[cell+0x103]` lane and the current sample list at `[site+0x34/+0x38]` before + writing back into the same comparison-cache bands. The route-entry strip beneath the linked-peer + family is no longer open either: `placed_structure_resolve_route_entry_anchor_record` + `0x0047f310` is the direct resolver over `[site+0x08]`, and + `placed_structure_route_anchor_matches_or_reaches_route_entry_id` `0x0047f250` is the boolean + gate above it, first checking a direct match against `[site+0x08]` and then re-entering + `0x0048e050(mode 2, fallback -1)` on the resolved route-entry record. The route-link companion + `route_link_route_entry_reaches_peer_site_route_group` `0x0047f2d0` is tighter now too: it reads + the peer site's route-entry anchor from `[peer+0x08]`, resolves the current link's own anchor, + and re-enters `0x0048e3c0` to test whether the two anchors belong to the same reachable + route-side family. One smaller linked-peer-side setter is grounded as well: + `placed_structure_set_overlay_mark_byte_and_refresh_linked_peer_overlay_if_changed` `0x0047f290` + updates byte `[site+0x5bc]` and then re-enters + `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0` when the + byte changes. +#### Terrain-class Side + +The nearby linked-instance raster wrappers are no + longer anonymous. `world_resolve_secondary_raster_class_record_at_float_xy` `0x0044e270` is the + world-side float-XY lookup over `[world+0x2131]` plus class table `0x006cfc9c`; + `placed_structure_query_linked_instance_secondary_raster_class_id` `0x0047f170` is the raw + linked-instance wrapper that returns the shifted class id directly; and the paired + record-returning wrappers `placed_structure_resolve_linked_instance_secondary_raster_class_record` + `0x0047f0e0` and + `placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query` + `0x0047f1f0` now bound the two record-returning lanes used by the later world-side and + linked-peer filters. That means the remaining uncertainty in this neighborhood is no longer the + route-entry or terrain-class helper ownership; it is the broader user-facing meaning of the later + callers that consume those gates.